qwenproxy-cli 1.6.10 → 1.6.12

package/src/services/playwright.ts

@@ -68,6 +68,7 @@ import {
   unmarkAccountHeadersReady,
   isAccountHeadersReady,
   markAccountRateLimited,
+  getAccountCooldownInfo,
 } from "../core/account-manager.ts";
 import { getAccountsByPriority } from "../core/account-priority.ts";
 import {
@@ -77,10 +78,15 @@ import {
   type FingerprintProfile,
 } from "./fingerprint.ts";
 import { subtlePageActivity } from "./human-behavior.ts";
-import { solveBaxiaCaptcha } from "./captcha-solver.ts";
+import { solveVisibleCaptcha } from "./captcha-solver.ts";
 import { qwenOrigin, qwenUrl } from "./qwen-url.ts";
 import { setWafContextResetListener } from "../core/waf-isolation.ts";
-import { updateQwenWebVersion, getQwenWebVersion } from "./qwen-headers.ts";
+import {
+  getQwenBxVersion,
+  getQwenWebVersion,
+  updateQwenBxVersion,
+  updateQwenWebVersion,
+} from "./qwen-headers.ts";
 import { getAccountProfilePath, getProfilesDir } from "../core/paths.ts";
 import { parseJwtExpiry, isTokenExpiringSoon } from "../utils/jwt.ts";
 import { formatAsciiTimezone } from "../utils/timezone.ts";
@@ -597,13 +603,14 @@ const CHAT_INPUT_ACTION_TIMEOUT_MS = 10_000;
  */
 async function clearVisibleChallenge(page: Page): Promise<void> {
   if (page.isClosed()) return;
-  // 1. Solve slider puzzle captcha if present
+  // 1. Solve a slider/jigsaw challenge if present (Baxia NC or Aliyun WAF)
   if (config.captcha.enabled) {
-    await solveBaxiaCaptcha(page, {
+    await solveVisibleCaptcha(page, {
       waitForMs: 0,
       maxAttempts: config.captcha.maxAttempts,
       retryDelayMs: config.captcha.retryDelayMs,
       settleMs: config.captcha.settleMs,
+      sliderTimeoutMs: config.captcha.sliderTimeoutMs,
     }).catch(() => false);
   }
 
@@ -1306,13 +1313,22 @@ export async function getBasicHeaders(accountId: string): Promise<{
               mobile = data.mobile ? "?1" : "?0";
             }
             let bundleVersion: string | null = null;
+            let baxiaVersion: string | null = null;
             try {
               const el = document.querySelector('link[href*="qwen-chat-fe"], script[src*="qwen-chat-fe"], img[src*="qwen-chat-fe"]');
               const src = el ? (el.getAttribute("href") || el.getAttribute("src") || "") : "";
               const match = src.match(/qwen-chat-fe\/(\d+\.\d+\.\d+)/) || document.documentElement.innerHTML.match(/qwen-chat-fe\/(\d+\.\d+\.\d+)/);
               if (match) bundleVersion = match[1];
             } catch {}
-            return { ua, secChUa, platform, mobile, bundleVersion };
+            try {
+              const baxia = (window as unknown as {
+                baxiaCommon?: { version?: unknown };
+              }).baxiaCommon;
+              if (typeof baxia?.version === "string") {
+                baxiaVersion = baxia.version;
+              }
+            } catch {}
+            return { ua, secChUa, platform, mobile, bundleVersion, baxiaVersion };
           }),
           config.timeouts.page,
           `User-agent lookup timed out for ${accountId}`,
@@ -1321,6 +1337,9 @@ export async function getBasicHeaders(accountId: string): Promise<{
         if (nav.bundleVersion) {
           updateQwenWebVersion(nav.bundleVersion);
         }
+        if (nav.baxiaVersion) {
+          updateQwenBxVersion(nav.baxiaVersion);
+        }
         cachedUserAgents.set(accountId, userAgent);
         const hints = getHeaderCache(accountId).headers;
         clientHints = {
@@ -1358,7 +1377,7 @@ export async function getBasicHeaders(accountId: string): Promise<{
       markAccountHeadersReady(accountId);
       const bxUa = cache.headers["bx-ua"];
       const bxUmidtoken = cache.headers["bx-umidtoken"];
-      const bxV = cache.headers["bx-v"] || "2.5.37";
+      const bxV = cache.headers["bx-v"] || getQwenBxVersion();
       const cookie = await getCookies(accountId);
       return { cookie, userAgent, bxV, bxUa, bxUmidtoken, ...clientHints };
     }
@@ -1382,7 +1401,7 @@ export async function getBasicHeaders(accountId: string): Promise<{
         cookieCaches.set(accountId, { cookie, timestamp: Date.now() });
         const bxUa = cache.headers["bx-ua"];
         const bxUmidtoken = cache.headers["bx-umidtoken"];
-        const bxV = cache.headers["bx-v"] || "2.5.37";
+        const bxV = cache.headers["bx-v"] || getQwenBxVersion();
         cache.lastRefresh = Date.now();
         markAccountHeadersReady(accountId);
         console.log(
@@ -1408,18 +1427,19 @@ export async function getBasicHeaders(accountId: string): Promise<{
     } else if (
       hadUsableHeaders &&
       headersAge > HEADER_CACHE_TTL * HEADER_REFRESH_THRESHOLD &&
-      !cache.refreshInProgress
+      !cache.refreshInProgress &&
+      // Header capture types into the chat input and sends a probe message on
+      // the account's page. Doing that while the account is serving a stream
+      // would mutate the live conversation (and can navigate the SPA), so the
+      // proactive refresh waits until the account has no active lease.
+      !hasActiveAccountLease(accountId)
     ) {
       // Background refresh at 70% TTL: keep headers fresh without blocking
-      cache.refreshInProgress = true;
       refreshHeadersInternal(accountId)
         .catch((error) => {
           console.warn(
             `⚠️  [Playwright] Background header refresh failed for ${accountId}: ${getErrorMessage(error)}`,
           );
-        })
-        .finally(() => {
-          cache.refreshInProgress = false;
         });
     }
 
@@ -1463,6 +1483,9 @@ export async function getBasicHeaders(accountId: string): Promise<{
             if (persisted.version) {
               updateQwenWebVersion(persisted.version);
             }
+            if (persisted.bxV) {
+              updateQwenBxVersion(persisted.bxV);
+            }
             cache.lastRefresh = persisted.capturedAt;
             markAccountHeadersReady(accountId);
           }
@@ -1492,7 +1515,7 @@ export async function getBasicHeaders(accountId: string): Promise<{
     markAccountHeadersReady(accountId);
     const bxUa = cache.headers["bx-ua"];
     const bxUmidtoken = cache.headers["bx-umidtoken"];
-    const bxV = cache.headers["bx-v"] || "2.5.37";
+    const bxV = cache.headers["bx-v"] || getQwenBxVersion();
 
     // Read cookie AFTER all refreshes (re-login may have updated it)
     cookieCaches.delete(accountId);
@@ -1569,8 +1592,13 @@ export async function initPlaywrightForAccount(
         return;
       }
 
-    // If a context limit is configured, make room by closing idle contexts.
-    await evictIdlePlaywrightContextsToLimit().catch(() => {});
+    // If a context limit is configured, make room BEFORE launching by evicting down to (max - 1)
+    // so the new context brings total active contexts to at most max.
+    if (config.playwright.maxActiveContexts > 0) {
+      await evictIdlePlaywrightContextsToLimit(
+        Math.max(1, config.playwright.maxActiveContexts - 1),
+      ).catch(() => {});
+    }
 
     const profilePath = getAccountProfilePath(account.id);
     const fingerprint = getFingerprintProfile(account.id);
@@ -1779,6 +1807,9 @@ export async function initPlaywrightForAccount(
               if (persisted.version) {
                 updateQwenWebVersion(persisted.version);
               }
+              if (persisted.bxV) {
+                updateQwenBxVersion(persisted.bxV);
+              }
               cache.lastRefresh = persisted.capturedAt;
               markAccountHeadersReady(account.id);
               restoredFromDb = true;
@@ -1882,12 +1913,17 @@ export async function initPlaywrightForAccount(
         await captureQwenHeaders(account.id);
       }
 
-      // Header capture may leave the UI on a generated chat page. Return the
-      // primary tab to the canonical chat home.
+      // Header capture may leave the UI on a punish or auth page. Return the
+      // primary tab to the canonical chat home only when not already on a clean Qwen page.
       if (!acctPage.isClosed()) {
         try {
           const currentUrl = new URL(acctPage.url());
-          if (currentUrl.origin !== qwenOrigin() || currentUrl.pathname !== "/") {
+          if (
+            currentUrl.origin !== qwenOrigin() ||
+            currentUrl.pathname.includes("/auth") ||
+            currentUrl.pathname.includes("/login") ||
+            currentUrl.pathname.includes("_____tmd_____")
+          ) {
             await acctPage.goto(qwenUrl("/"), {
               waitUntil: "domcontentloaded",
               timeout: config.timeouts.navigation,
@@ -1907,6 +1943,7 @@ export async function initPlaywrightForAccount(
     } finally {
       release();
     }
+    await evictIdlePlaywrightContextsToLimit().catch(() => {});
   })();
 
   try {
@@ -2226,7 +2263,7 @@ export async function startEmailOtpLogin(
       {
         email: normalizedEmail,
         requestId,
-        version: getQwenWebVersion() || "0.3.26",
+        version: getQwenWebVersion(),
         timezone: formatAsciiTimezone(),
       },
     ).catch((err: any) => ({ ok: false, error: err?.message || String(err) }));
@@ -2338,7 +2375,7 @@ export async function verifyEmailOtpLogin(
       email: session.email,
       code: cleanCode,
       requestId,
-      version: getQwenWebVersion() || "0.3.26",
+      version: getQwenWebVersion(),
       timezone: formatAsciiTimezone(),
     },
   ).catch((err: any) => ({ ok: false, error: err?.message || String(err) }));
@@ -2395,8 +2432,8 @@ export async function verifyEmailOtpLogin(
     saveAuthSession(session.accountId, {
       cookie: `token=${accessToken}`,
       userAgent: session.fingerprint.userAgent,
-      bxV: "2.5.37",
-      version: getQwenWebVersion() || "0.3.26",
+      bxV: getQwenBxVersion(),
+      version: getQwenWebVersion(),
       userId: userId || undefined,
       tokenExpiresAt: exp || undefined,
       refreshToken: refreshToken || undefined,
@@ -2552,7 +2589,7 @@ async function loginToQwen(
           saveAuthSession(accountId, {
             cookie: cookieStr,
             userAgent: cache.headers["user-agent"] || "",
-            bxV: cache.headers["bx-v"] || "2.5.37",
+            bxV: cache.headers["bx-v"] || getQwenBxVersion(),
             bxUa: cache.headers["bx-ua"] || "",
             bxUmidtoken: cache.headers["bx-umidtoken"] || "",
             secChUa: cache.headers["sec-ch-ua"] || undefined,
@@ -2628,7 +2665,7 @@ async function loginToQwen(
           saveAuthSession(accountId, {
             cookie: cookieStr,
             userAgent: cache.headers["user-agent"] || "",
-            bxV: cache.headers["bx-v"] || "2.5.37",
+            bxV: cache.headers["bx-v"] || getQwenBxVersion(),
             bxUa: cache.headers["bx-ua"] || "",
             bxUmidtoken: cache.headers["bx-umidtoken"] || "",
             secChUa: cache.headers["sec-ch-ua"] || undefined,
@@ -2713,7 +2750,7 @@ async function loginViaApi(
 
     const signinUrl = "https://auth.qwen.ai/api/v2/auths/signin";
     const requestId = crypto.randomUUID();
-    const webVersion = getQwenWebVersion() || "0.3.26";
+    const webVersion = getQwenWebVersion();
 
     const evalRes = await page
       .evaluate(
@@ -2922,6 +2959,18 @@ async function loginViaUi(
       return { success: true };
     }
 
+    // A WAF jigsaw can render before the form is usable. Clear it first so the
+    // email/password fields are not covered and the submit is not rejected.
+    if (config.captcha.enabled) {
+      await solveVisibleCaptcha(page, {
+        waitForMs: 1_500,
+        maxAttempts: config.captcha.maxAttempts,
+        retryDelayMs: config.captcha.retryDelayMs,
+        settleMs: config.captcha.settleMs,
+        sliderTimeoutMs: config.captcha.sliderTimeoutMs,
+      }).catch(() => false);
+    }
+
     // Wait for email input
     const emailSelector = [
       'input[type="email"]',
@@ -3116,12 +3165,13 @@ async function loginViaUi(
     while (Date.now() < postSubmitDeadline) {
       if (page.isClosed()) break;
 
-      // If a slider puzzle captcha appeared after submit, solve it automatically
+      // If a slider/jigsaw challenge appeared after submit, solve it automatically
       if (config.captcha.enabled) {
-        await solveBaxiaCaptcha(page, {
+        await solveVisibleCaptcha(page, {
           waitForMs: 1500,
           maxAttempts: config.captcha.maxAttempts,
           retryDelayMs: config.captcha.retryDelayMs,
+          sliderTimeoutMs: config.captcha.sliderTimeoutMs,
         }).catch(() => {});
       }
 
@@ -3268,7 +3318,7 @@ export async function refreshAccountToken(
   // 2. If we have a refresh token, invoke the working refresh endpoint in-page
   if (refreshToken) {
     try {
-      const webVersion = getQwenWebVersion() || "0.3.26";
+      const webVersion = getQwenWebVersion();
       const refreshResult = await page.evaluate(
         async ({ rTok, tz, version }) => {
           try {
@@ -3341,7 +3391,7 @@ export async function refreshAccountToken(
           saveAuthSession(accountId, {
             cookie: cookieStr,
             userAgent: cache.headers["user-agent"] || session?.userAgent || "",
-            bxV: cache.headers["bx-v"] || session?.bxV || "2.5.37",
+            bxV: cache.headers["bx-v"] || session?.bxV || getQwenBxVersion(),
             bxUa: cache.headers["bx-ua"] || session?.bxUa || "",
             bxUmidtoken: cache.headers["bx-umidtoken"] || session?.bxUmidtoken || "",
             secChUa: cache.headers["sec-ch-ua"] || session?.secChUa,
@@ -3378,7 +3428,7 @@ export async function refreshAccountToken(
         saveAuthSession(accountId, {
           cookie: cookieStr,
           userAgent: cache.headers["user-agent"] || session?.userAgent || "",
-          bxV: cache.headers["bx-v"] || session?.bxV || "2.5.37",
+          bxV: cache.headers["bx-v"] || session?.bxV || getQwenBxVersion(),
           bxUa: cache.headers["bx-ua"] || session?.bxUa || "",
           bxUmidtoken: cache.headers["bx-umidtoken"] || session?.bxUmidtoken || "",
           secChUa: cache.headers["sec-ch-ua"] || session?.secChUa,
@@ -3581,7 +3631,7 @@ export async function captureQwenHeaders(
         cookie: reqHeaders["cookie"] || "",
         "bx-ua": reqHeaders["bx-ua"] || "",
         "bx-umidtoken": reqHeaders["bx-umidtoken"] || "",
-        "bx-v": reqHeaders["bx-v"] || "2.5.37",
+        "bx-v": reqHeaders["bx-v"] || getQwenBxVersion(),
         "user-agent": reqHeaders["user-agent"] || "",
         "x-request-id": reqHeaders["x-request-id"] || "",
         "version": reqHeaders["version"] || "",
@@ -3625,6 +3675,9 @@ export async function captureQwenHeaders(
       if (capturedHeaders["version"]) {
         updateQwenWebVersion(capturedHeaders["version"]);
       }
+      if (capturedHeaders["bx-v"]) {
+        updateQwenBxVersion(capturedHeaders["bx-v"]);
+      }
       markAccountHeadersReady(accountId);
       cache.lastRefresh = Date.now();
       // Header interception can set challenge/session cookies, so do not reuse
@@ -4171,19 +4224,32 @@ async function refreshHeadersInternal(
         await executeReauth();
       } else {
         try {
-          await page.goto(qwenUrl("/"), {
-            waitUntil: "domcontentloaded",
-            timeout: Math.min(
-              config.timeouts.navigation,
-              boundedTimeoutMs,
-              SESSION_PROBE_NAVIGATION_TIMEOUT_MS,
-            ),
-          });
-          await sleep(2000);
-          const url = page.url();
+          const currentUrl = typeof page.url === "function" ? page.url() : "";
+          const needsNavigation =
+            !currentUrl.startsWith(qwenOrigin()) ||
+            currentUrl.includes("/auth") ||
+            currentUrl.includes("/login") ||
+            currentUrl.includes("_____tmd_____");
+
+          if (needsNavigation) {
+            await page.goto(qwenUrl("/"), {
+              waitUntil: "domcontentloaded",
+              timeout: Math.min(
+                config.timeouts.navigation,
+                boundedTimeoutMs,
+                SESSION_PROBE_NAVIGATION_TIMEOUT_MS,
+              ),
+            });
+            await sleep(2000);
+          }
+
+          const url = typeof page.url === "function" ? page.url() : "";
           const isAuthUrl = url.includes("auth") || url.includes("login");
           if (isAuthUrl) {
-            await executeReauth();
+            const refreshed = await refreshAccountToken(accountId);
+            if (!refreshed.success) {
+              await executeReauth();
+            }
           }
         } catch (navErr) {
           console.warn(
@@ -4224,7 +4290,7 @@ async function refreshHeadersInternal(
             saveAuthSession(accountId, {
               cookie: cookieStr,
               userAgent: cache.headers["user-agent"] || "",
-              bxV: cache.headers["bx-v"] || "2.5.37",
+              bxV: cache.headers["bx-v"] || getQwenBxVersion(),
               bxUa: cache.headers["bx-ua"] || "",
               bxUmidtoken: cache.headers["bx-umidtoken"] || "",
               secChUa: cache.headers["sec-ch-ua"] || undefined,
@@ -4243,12 +4309,18 @@ async function refreshHeadersInternal(
 
     await captureQwenHeaders(accountId, undefined, boundedTimeoutMs);
 
-    // Best-effort restore: header capture can leave the tab on a chat page.
+    // Best-effort restore: if header capture left the tab on a punish/auth URL,
+    // return to the canonical chat home without reloading an already-clean Qwen page.
     const capturedPage = accountPages.get(accountId);
     if (capturedPage && !capturedPage.isClosed()) {
       try {
         const currentUrl = new URL(capturedPage.url());
-        if (currentUrl.origin !== qwenOrigin() || currentUrl.pathname !== "/") {
+        if (
+          currentUrl.origin !== qwenOrigin() ||
+          currentUrl.pathname.includes("/auth") ||
+          currentUrl.pathname.includes("/login") ||
+          currentUrl.pathname.includes("_____tmd_____")
+        ) {
           await capturedPage.goto(qwenUrl("/"), {
             waitUntil: "domcontentloaded",
             timeout: Math.min(config.timeouts.navigation, boundedTimeoutMs),
@@ -4693,7 +4765,13 @@ function priorityOrderForEviction(accountIds: string[]): string[] {
   const ranked = getAccountsByPriority(accountIds.map((id) => ({ id })));
   const rank = new Map<string, number>();
   for (const [index, account] of ranked.entries()) {
-    rank.set(account.id, index);
+    // Accounts currently on cooldown (RateLimited / MembershipLimit / WafChallenge)
+    // cannot serve traffic and must be evicted before any healthy warm account.
+    if (getAccountCooldownInfo(account.id)) {
+      rank.set(account.id, Number.MAX_SAFE_INTEGER);
+    } else {
+      rank.set(account.id, index);
+    }
   }
   return orderContextsForEviction(
     accountIds,
@@ -4750,15 +4828,21 @@ export async function closeIdlePlaywrightAccounts(
  * PLAYWRIGHT_MAX_ACTIVE_CONTEXTS. Never closes a context whose account mutex
  * is busy, so active streams are preserved.
  */
-export async function evictIdlePlaywrightContextsToLimit(): Promise<number> {
-  const max = config.playwright.maxActiveContexts;
-  if (max <= 0) return 0;
+export async function evictIdlePlaywrightContextsToLimit(
+  targetLimit?: number,
+): Promise<number> {
+  const configuredMax = config.playwright.maxActiveContexts;
+  if (configuredMax <= 0) return 0;
+  const max = targetLimit !== undefined ? Math.max(0, targetLimit) : configuredMax;
   if (accountPages.size <= max) return 0;
 
   const candidates = priorityOrderForEviction(
     Array.from(accountPages.keys()).filter((accountId) => {
       if (isAccountServingStream(accountId)) return false;
-      if (isAccountRecentlyActive(accountId, 30_000)) return false;
+      // A request may hold a stream lease while still acquiring the page mutex
+      // (pre-stream setup). Closing that context would fail the request even
+      // though the mutex still looks idle, so treat any lease as "in use".
+      if (hasActiveAccountLease(accountId)) return false;
       const mutex = accountMutexes.get(accountId);
       return mutex?.isIdle();
     }),
@@ -4772,6 +4856,7 @@ export async function evictIdlePlaywrightContextsToLimit(): Promise<number> {
   for (const candidate of candidates) {
     if (accountPages.size <= max) break;
     if (isAccountServingStream(candidate.accountId)) continue;
+    if (hasActiveAccountLease(candidate.accountId)) continue;
     const mutex = accountMutexes.get(candidate.accountId);
     if (!mutex?.isIdle()) continue;
 

package/src/services/qwen-chat-pool.ts

@@ -4,8 +4,10 @@ import { config, type ChatMode, isLocalChatMode, isStatelessChatMode } from "../
 import { logger, isToolcallDebugEnabled } from "../core/logger.ts";
 import {
   computeQuotaCooldownMs,
+  getAccountCooldownInfo,
   markAccountRateLimited,
 } from "../core/account-manager.ts";
+import { recordWafHardBlock } from "../core/waf-isolation.ts";
 import { mapClientModelToQwen } from "../core/model-alias.ts";
 import { qwenUrl } from "./qwen-url.ts";
 import { QwenUpstreamError } from "./qwen-errors.ts";
@@ -23,6 +25,7 @@ async function createQwenChatSession(
   model: string,
   accountId?: string,
   chatMode: ChatMode = "thread",
+  captchaRecoveryAttempts = 1,
 ): Promise<string> {
   if (isAuthMockEnabled()) {
     return process.env.TEST_SESSION_ID || "mock-session";
@@ -60,15 +63,32 @@ async function createQwenChatSession(
   if (!chatId || typeof chatId !== "string") {
     const rawLower = raw.toLowerCase();
     if (looksLikeAntiBotChallengeText(raw)) {
-      try {
-        const { recoverBaxiaCaptcha } = await import("./captcha-coordinator.ts");
-        const solved = await recoverBaxiaCaptcha(accountId, "createQwenChatSession", {
-          challengeBody: raw,
-        });
-        if (solved) {
-          return createQwenChatSession(headers, model, accountId, chatMode);
-        }
-      } catch {}
+      if (captchaRecoveryAttempts > 0) {
+        try {
+          const { recoverBaxiaCaptcha } = await import("./captcha-coordinator.ts");
+          const solved = await recoverBaxiaCaptcha(accountId, "createQwenChatSession", {
+            challengeBody: raw,
+          });
+          if (solved) {
+            return createQwenChatSession(
+              headers,
+              model,
+              accountId,
+              chatMode,
+              captchaRecoveryAttempts - 1,
+            );
+          }
+        } catch {}
+      }
+
+      // Surface the WAF category to the caller so the warm pool can quarantine
+      // the account instead of treating this as a generic invalid payload
+      // (which would retry the same flagged device identity forever).
+      throw new QwenUpstreamError(
+        `Qwen create chat blocked by WAF challenge: ${raw.substring(0, 300)}`,
+        "FAIL_SYS_USER_VALIDATE",
+        403,
+      );
     }
 
     const isUnauthorized =
@@ -346,6 +366,29 @@ async function refillQwenChatPool(
         console.warn(
           `[WarmPool] Account ${accountId || "global"} rate-limited during chat creation. Marked for cooldown.`,
         );
+      } else if (
+        accountId &&
+        (err.upstreamCode === "FAIL_SYS_USER_VALIDATE" ||
+          err.upstreamCode === "RGV587_ERROR" ||
+          /_____tmd_____|rgv587_error|fail_sys_user_validate/i.test(
+            err.message,
+          ))
+      ) {
+        // A background warm-up that hits an unsolvable challenge must park the
+        // account: otherwise the next refill repeats the same flagged request
+        // and spreads the WAF block. Guarded so an already-quarantined account
+        // is not escalated twice by concurrent refills.
+        const existing = getAccountCooldownInfo(accountId);
+        if (existing?.reason === "WafChallenge") {
+          console.warn(
+            `[WarmPool] Account ${accountId} still on WAF quarantine (${Math.ceil(existing.remainingMs / 1000)}s left); skipping re-escalation.`,
+          );
+        } else {
+          const block = recordWafHardBlock(accountId);
+          console.warn(
+            `[WarmPool] Unsolved WAF challenge on ${accountId} during chat creation; quarantined ${Math.ceil(block.cooldownMs / 1000)}s and rotated the fingerprint.`,
+          );
+        }
       }
     }
     if (isToolcallDebugEnabled()) {

package/src/services/qwen-headers.ts

@@ -21,6 +21,7 @@ export function getDefaultQwenUserAgent(major = getChromeMajor()): string {
 }
 
 let dynamicWebVersion: string | null = null;
+let dynamicBxVersion: string | null = null;
 
 export function updateQwenWebVersion(version?: string | null): void {
   if (version && typeof version === "string" && /^\d+\.\d+\.\d+/.test(version)) {
@@ -32,6 +33,22 @@ export function getQwenWebVersion(): string {
   return dynamicWebVersion || config.qwen.webVersion;
 }
 
+/**
+ * Aliyun Baxia publishes its SDK version at `window.baxiaCommon.version` and
+ * also sends it as the `bx-v` header. Detecting it at runtime keeps the
+ * anti-bot fingerprint aligned when Alibaba ships a new SDK; the static
+ * QWEN_BX_V value remains as a last-resort fallback.
+ */
+export function updateQwenBxVersion(version?: string | null): void {
+  if (version && typeof version === "string" && /^\d+\.\d+\.\d+/.test(version)) {
+    dynamicBxVersion = version.trim();
+  }
+}
+
+export function getQwenBxVersion(): string {
+  return dynamicBxVersion || config.auth.bxV;
+}
+
 export const QWEN_WEB_VERSION = config.qwen.webVersion;
 export const DEFAULT_QWEN_USER_AGENT = getDefaultQwenUserAgent(151);
 const QWEN_TIMEZONE_HEADER = new Date().toString().split(" (")[0];
@@ -77,7 +94,7 @@ export function buildQwenRequestHeaders(
     Connection: "keep-alive",
     "User-Agent": opts.userAgent || getDefaultQwenUserAgent(),
     "X-Request-Id": uuidv4(),
-    "bx-v": opts.bxV || "2.5.37",
+    "bx-v": opts.bxV || getQwenBxVersion(),
     source: "web",
     version: opts.version || getQwenWebVersion(),
     timezone: opts.extra?.timezone || opts.extra?.Timezone || formatAsciiTimezone(),