qwenproxy-cli 1.6.11 → 1.6.12

package/dist/index.js

@@ -266,7 +266,7 @@ var init_config = __esm({
       // Version header on Qwen API requests = the deployed web bundle version
       // (fallback when dynamic DOM detection is not yet completed).
       // Override via env when Qwen ships a new bundle.
-      QWEN_WEB_VERSION: z.string().default("0.3.26"),
+      QWEN_WEB_VERSION: z.string().default("0.3.43"),
       // Controls bx-ua/bx-umidtoken injection on the GENERAL API paths
       // (chats/new, settings): those work without them (live-probed). The
       // completions path is the exception — the 0.2.86 HAR shows the real
@@ -309,6 +309,7 @@ var init_config = __esm({
       CAPTCHA_SOLVER_ENABLED: z.string().default("true"),
       CAPTCHA_SOLVER_MAX_ATTEMPTS: z.string().default("3"),
       CAPTCHA_SOLVER_TIMEOUT_MS: z.string().default("15000"),
+      CAPTCHA_SLIDER_TIMEOUT_MS: z.string().default("8000"),
       CAPTCHA_SOLVER_RETRY_DELAY_MS: z.string().default("1000"),
       CAPTCHA_SOLVER_SETTLE_MS: z.string().default("2000"),
       CAPTCHA_ACCOUNT_COOLDOWN_MS: z.string().default("120000"),
@@ -460,6 +461,8 @@ var init_config = __esm({
         enabled: env.CAPTCHA_SOLVER_ENABLED === "true",
         maxAttempts: Math.max(1, Math.min(5, parseInt(env.CAPTCHA_SOLVER_MAX_ATTEMPTS))),
         timeoutMs: Math.max(0, parseInt(env.CAPTCHA_SOLVER_TIMEOUT_MS)),
+        /** Max wait for a challenge slider to become visible (slow WAF renders). */
+        sliderTimeoutMs: Math.max(500, parseInt(env.CAPTCHA_SLIDER_TIMEOUT_MS)),
         retryDelayMs: Math.max(0, parseInt(env.CAPTCHA_SOLVER_RETRY_DELAY_MS)),
         settleMs: Math.max(0, parseInt(env.CAPTCHA_SOLVER_SETTLE_MS)),
         /** Rest an account whose challenge could not be cleared before reusing it. */
@@ -3619,6 +3622,294 @@ function extractBaxiaChallengeUrl(body, baseUrl) {
   }
   return null;
 }
+async function findVisibleLocatorWithin(page, selectors, timeoutMs) {
+  const deadline = Date.now() + Math.max(0, timeoutMs);
+  while (true) {
+    const found = await findVisibleLocator(page, selectors);
+    if (found) return found;
+    if (Date.now() >= deadline) return null;
+    await sleep(Math.min(150, Math.max(1, deadline - Date.now())));
+  }
+}
+async function waitForHidden(locator, timeoutMs) {
+  const deadline = Date.now() + Math.max(0, timeoutMs);
+  while (true) {
+    if (!await isVisible(locator)) return true;
+    if (Date.now() >= deadline) return false;
+    await sleep(Math.min(100, Math.max(1, deadline - Date.now())));
+  }
+}
+async function computeAliyunPuzzleOffset(page) {
+  return page.evaluate(() => {
+    const background = document.querySelector(
+      "#aliyunCaptcha-img"
+    );
+    const piece = document.querySelector(
+      "#aliyunCaptcha-puzzle"
+    );
+    if (!background || !piece) {
+      return Promise.resolve({ ok: false, reason: "missing puzzle images" });
+    }
+    const compute = () => {
+      try {
+        const width = background.naturalWidth;
+        const height = background.naturalHeight;
+        const pieceWidth = piece.naturalWidth;
+        const pieceHeight = piece.naturalHeight;
+        if (!width || !height || !pieceWidth || !pieceHeight) {
+          return { ok: false, reason: "image dimensions unavailable" };
+        }
+        const backgroundCanvas = document.createElement("canvas");
+        backgroundCanvas.id = "captcha-solver-canvas";
+        backgroundCanvas.width = width;
+        backgroundCanvas.height = height;
+        const backgroundContext = backgroundCanvas.getContext("2d");
+        if (!backgroundContext) {
+          return { ok: false, reason: "no background context" };
+        }
+        const pieceCanvas = document.createElement("canvas");
+        pieceCanvas.id = "captcha-solver-canvas";
+        pieceCanvas.width = pieceWidth;
+        pieceCanvas.height = pieceHeight;
+        const pieceContext = pieceCanvas.getContext("2d");
+        if (!pieceContext) {
+          return { ok: false, reason: "no piece context" };
+        }
+        try {
+          backgroundContext.drawImage(background, 0, 0);
+        } catch {
+          return { ok: false, reason: "background canvas tainted" };
+        }
+        try {
+          pieceContext.drawImage(piece, 0, 0);
+        } catch {
+          return { ok: false, reason: "puzzle canvas tainted" };
+        }
+        const backgroundData = backgroundContext.getImageData(
+          0,
+          0,
+          width,
+          height
+        ).data;
+        const pieceData = pieceContext.getImageData(
+          0,
+          0,
+          pieceWidth,
+          pieceHeight
+        ).data;
+        let pieceMinX = pieceWidth;
+        let pieceMaxX = -1;
+        let pieceMinY = pieceHeight;
+        let pieceMaxY = -1;
+        for (let y = 0; y < pieceHeight; y++) {
+          for (let x = 0; x < pieceWidth; x++) {
+            if (pieceData[(y * pieceWidth + x) * 4 + 3] > 100) {
+              if (x < pieceMinX) pieceMinX = x;
+              if (x > pieceMaxX) pieceMaxX = x;
+              if (y < pieceMinY) pieceMinY = y;
+              if (y > pieceMaxY) pieceMaxY = y;
+            }
+          }
+        }
+        const puzzleWidth = pieceMaxX - pieceMinX + 1;
+        if (puzzleWidth <= 0) {
+          return { ok: false, reason: "empty puzzle piece" };
+        }
+        const yStart = Math.max(1, Math.min(height - 2, pieceMinY + 5));
+        const yEnd = Math.max(
+          yStart,
+          Math.min(height - 2, pieceMaxY - 5)
+        );
+        const columnGradients = new Float32Array(width);
+        for (let x = 1; x < width - 1; x++) {
+          let gradient = 0;
+          for (let y = yStart; y <= yEnd; y++) {
+            const left = (y * width + x - 1) * 4;
+            const right = (y * width + x + 1) * 4;
+            gradient += Math.abs(backgroundData[right] - backgroundData[left]) + Math.abs(backgroundData[right + 1] - backgroundData[left + 1]) + Math.abs(backgroundData[right + 2] - backgroundData[left + 2]);
+          }
+          columnGradients[x] = gradient;
+        }
+        let bestX = 0;
+        let bestScore = 0;
+        const minCandidateX = 30;
+        const maxCandidateX = width - puzzleWidth - 20;
+        for (let candidateX = minCandidateX; candidateX <= maxCandidateX; candidateX++) {
+          let leftMax = 0;
+          for (let dx = -2; dx <= 2; dx++) {
+            const value = columnGradients[candidateX + pieceMinX + dx] || 0;
+            if (value > leftMax) leftMax = value;
+          }
+          let rightMax = 0;
+          for (let dx = -3; dx <= 1; dx++) {
+            const value = columnGradients[candidateX + pieceMaxX + dx] || 0;
+            if (value > rightMax) rightMax = value;
+          }
+          const score = Math.sqrt(leftMax * rightMax);
+          if (score > bestScore) {
+            bestScore = score;
+            bestX = candidateX;
+          }
+        }
+        if (bestScore <= 0) {
+          return { ok: false, reason: "no matching hole edge" };
+        }
+        return {
+          ok: true,
+          offsetX: bestX - pieceMinX,
+          naturalWidth: width
+        };
+      } catch (error) {
+        return {
+          ok: false,
+          reason: error instanceof Error ? error.message : String(error)
+        };
+      }
+    };
+    return new Promise((resolve) => {
+      if (background.complete && piece.complete) {
+        resolve(compute());
+        return;
+      }
+      let settled = false;
+      const finish = () => {
+        if (settled) return;
+        settled = true;
+        resolve(compute());
+      };
+      const fail = () => {
+        if (settled) return;
+        settled = true;
+        resolve({ ok: false, reason: "puzzle image load error" });
+      };
+      background.addEventListener("load", finish, { once: true });
+      piece.addEventListener("load", finish, { once: true });
+      background.addEventListener("error", fail, { once: true });
+      piece.addEventListener("error", fail, { once: true });
+      setTimeout(() => {
+        if (settled) return;
+        settled = true;
+        resolve({ ok: false, reason: "puzzle image load timeout" });
+      }, 2e3);
+    });
+  });
+}
+async function solveAliyunWafCaptcha(page, options = {}) {
+  const waitForMs = Math.max(0, options.waitForMs ?? 0);
+  const maxAttempts = Math.max(
+    1,
+    Math.min(5, options.maxAttempts ?? DEFAULT_MAX_ATTEMPTS)
+  );
+  const retryDelayMs = Math.max(
+    0,
+    options.retryDelayMs ?? DEFAULT_RETRY_DELAY_MS
+  );
+  const settleMs = Math.max(0, options.settleMs ?? DEFAULT_SETTLE_MS);
+  const sliderTimeoutMs = Math.max(
+    500,
+    options.sliderTimeoutMs ?? DEFAULT_SLIDER_TIMEOUT_MS
+  );
+  const detected = await findVisibleLocatorWithin(
+    page,
+    ALIYUN_WAF_BLOCK_SELECTORS,
+    waitForMs
+  );
+  if (!detected) return false;
+  return withCaptchaMouseLock(async () => {
+    const block = detected.locator;
+    if (!await isVisible(block)) return false;
+    logBaxiaCaptcha("aliyun_detected", { selector: detected.selector });
+    let lastReason = "unknown";
+    for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+      try {
+        const offset = await computeAliyunPuzzleOffset(page);
+        if (!offset.ok || typeof offset.offsetX !== "number" || typeof offset.naturalWidth !== "number" || offset.naturalWidth <= 0) {
+          lastReason = offset.reason || "offset_unavailable";
+          logBaxiaCaptcha("aliyun_offset_failed", {
+            attempt,
+            reason: lastReason
+          });
+        } else {
+          const slider = page.locator(ALIYUN_PUZZLE_SLIDER_SELECTOR).first();
+          const track = page.locator(ALIYUN_PUZZLE_TRACK_SELECTOR).first();
+          await slider.waitFor({ state: "visible", timeout: sliderTimeoutMs });
+          const [sliderBox, trackBox] = await Promise.all([
+            slider.boundingBox(),
+            track.boundingBox()
+          ]);
+          if (!sliderBox || !trackBox || trackBox.width <= 0) {
+            lastReason = "bounds_unavailable";
+            logBaxiaCaptcha("aliyun_offset_failed", {
+              attempt,
+              reason: lastReason
+            });
+          } else {
+            const scale = trackBox.width / offset.naturalWidth;
+            const dragDistance = Math.round(offset.offsetX * scale);
+            logBaxiaCaptcha("aliyun_geometry", {
+              attempt,
+              offset: offset.offsetX,
+              scale: Number(scale.toFixed(2)),
+              distance: dragDistance
+            });
+            if (dragDistance <= 0) {
+              lastReason = "non_positive_distance";
+            } else {
+              const startX = sliderBox.x + sliderBox.width / 2;
+              const startY = sliderBox.y + sliderBox.height / 2;
+              await humanDrag(
+                page,
+                startX,
+                startY,
+                startX + dragDistance,
+                startY
+              );
+              if (await waitForHidden(block, settleMs)) {
+                logBaxiaCaptcha(
+                  "aliyun_solve_succeeded",
+                  { attempt, distance: dragDistance },
+                  true
+                );
+                return true;
+              }
+              lastReason = "not_solved";
+            }
+          }
+        }
+      } catch (error) {
+        lastReason = error instanceof Error ? error.name : "UnknownError";
+        logBaxiaCaptcha("aliyun_offset_failed", {
+          attempt,
+          error: lastReason,
+          detail: sanitizeCaptchaErrorDetail(error)
+        });
+      }
+      if (attempt < maxAttempts && retryDelayMs > 0) {
+        await sleep(retryDelayMs);
+      }
+    }
+    logBaxiaCaptcha(
+      "aliyun_solve_failed",
+      { attempts: maxAttempts, reason: lastReason },
+      true
+    );
+    return false;
+  });
+}
+async function solveVisibleCaptcha(page, options = {}) {
+  if (typeof page.isClosed === "function" && page.isClosed()) return false;
+  const totalWaitMs = Math.max(0, options.waitForMs ?? 0);
+  const aliyunWaitMs = Math.min(totalWaitMs, ALIYUN_PROBE_MAX_WAIT_MS);
+  const startedAt = Date.now();
+  if (await solveAliyunWafCaptcha(page, { ...options, waitForMs: aliyunWaitMs })) {
+    return true;
+  }
+  const remainingWaitMs = Math.max(
+    0,
+    totalWaitMs - (Date.now() - startedAt)
+  );
+  return solveBaxiaCaptcha(page, { ...options, waitForMs: remainingWaitMs });
+}
 async function isVisible(locator) {
   return locator.isVisible().catch(() => false);
 }
@@ -3888,7 +4179,7 @@ function startBaxiaCaptchaWatcher(page, timeoutMs, options = {}) {
     promise
   };
 }
-var BAXIA_DIALOG_SELECTOR, BAXIA_CONTENT_SELECTOR, CAPTCHA_EVENT_EMOJI, captchaDebugEnabled, BAXIA_IFRAME_SELECTORS, BAXIA_DOCUMENT_SELECTORS, BAXIA_IFRAME_SELECTOR, BAXIA_SLIDER_SELECTOR, BAXIA_TRACK_SELECTOR, BAXIA_SUCCESS_SELECTOR, BAXIA_RELOAD_SELECTOR, DEFAULT_MAX_ATTEMPTS, DEFAULT_RETRY_DELAY_MS, DEFAULT_SETTLE_MS, DEFAULT_SLIDER_TIMEOUT_MS, captchaMouseLock;
+var BAXIA_DIALOG_SELECTOR, BAXIA_CONTENT_SELECTOR, CAPTCHA_EVENT_EMOJI, captchaDebugEnabled, BAXIA_IFRAME_SELECTORS, BAXIA_DOCUMENT_SELECTORS, BAXIA_IFRAME_SELECTOR, BAXIA_SLIDER_SELECTOR, BAXIA_TRACK_SELECTOR, BAXIA_SUCCESS_SELECTOR, BAXIA_RELOAD_SELECTOR, DEFAULT_MAX_ATTEMPTS, DEFAULT_RETRY_DELAY_MS, DEFAULT_SETTLE_MS, DEFAULT_SLIDER_TIMEOUT_MS, ALIYUN_WAF_CAPTCHA_SELECTOR, ALIYUN_WAF_CAPTCHA_WIDGET, ALIYUN_WAF_BLOCK_SELECTORS, ALIYUN_PUZZLE_SLIDER_SELECTOR, ALIYUN_PUZZLE_TRACK_SELECTOR, ALIYUN_PROBE_MAX_WAIT_MS, captchaMouseLock;
 var init_captcha_solver = __esm({
   "src/services/captcha-solver.ts"() {
     "use strict";
@@ -3914,14 +4205,20 @@ var init_captcha_solver = __esm({
       solve_failed: "\u274C",
       recovery_succeeded: "\u2705",
       recovery_not_solved: "\u26A0\uFE0F",
-      recovery_failed: "\u274C"
+      recovery_failed: "\u274C",
+      aliyun_detected: "\u{1F9E9}",
+      aliyun_offset_failed: "\u{1F4D0}",
+      aliyun_geometry: "\u{1F4D0}",
+      aliyun_solve_succeeded: "\u2705",
+      aliyun_solve_failed: "\u274C"
     };
     captchaDebugEnabled = process.env.CAPTCHA_DEBUG === "true";
     BAXIA_IFRAME_SELECTORS = [
       `${BAXIA_DIALOG_SELECTOR} ${BAXIA_CONTENT_SELECTOR} iframe`,
       `${BAXIA_CONTENT_SELECTOR} iframe`,
       "iframe#baxia-dialog-content",
-      'iframe[src*="_____tmd_____/punish"]'
+      'iframe[src*="_____tmd_____/punish"]',
+      'iframe[src*="nocaptcha"]'
     ];
     BAXIA_DOCUMENT_SELECTORS = [
       "#nocaptcha",
@@ -3929,14 +4226,23 @@ var init_captcha_solver = __esm({
       "#baxia-punish"
     ];
     BAXIA_IFRAME_SELECTOR = BAXIA_IFRAME_SELECTORS.join(", ");
-    BAXIA_SLIDER_SELECTOR = "#nc_1_n1z, .nc_1_n1z, .btn_slide, .nc_wrapper .btn_slide, ._nc .btn_slide, .nc-container .btn_slide";
-    BAXIA_TRACK_SELECTOR = "#nc_1_n1t, .nc_scale, .nc_wrapper .nc_scale, ._nc .nc_scale, .nc-container .nc_scale";
+    BAXIA_SLIDER_SELECTOR = '#nc_1_n1z, .nc_1_n1z, .btn_slide, .nc_iconfont.btn_slide, span[id*="_n1z"], .nc_wrapper .btn_slide, ._nc .btn_slide, .nc-container .btn_slide';
+    BAXIA_TRACK_SELECTOR = '#nc_1_n1t, .nc_scale, span[id*="_n1t"], .nc_wrapper .nc_scale, ._nc .nc_scale, .nc-container .nc_scale';
     BAXIA_SUCCESS_SELECTOR = '.btn_ok, .nc_ok, .nc_success, .nc_result, .nc_wrapper.nc-success, .nc_wrapper.success, [data-nc-lang="SUCCESS"], [data-nc-lang="success"], #nc-loading-circle';
     BAXIA_RELOAD_SELECTOR = '#nc_1_refresh1, .errloading a, .nc-container .errloading a, .btn_refresh, .clickCaptcha_text .btn_refresh, [data-nc-lang="REFRESH"], a[id*="refresh"]';
     DEFAULT_MAX_ATTEMPTS = 3;
     DEFAULT_RETRY_DELAY_MS = 1e3;
     DEFAULT_SETTLE_MS = 2e3;
     DEFAULT_SLIDER_TIMEOUT_MS = 8e3;
+    ALIYUN_WAF_CAPTCHA_SELECTOR = "#waf_nc_block";
+    ALIYUN_WAF_CAPTCHA_WIDGET = "#aliyunCaptcha-window-embed";
+    ALIYUN_WAF_BLOCK_SELECTORS = [
+      ALIYUN_WAF_CAPTCHA_SELECTOR,
+      ALIYUN_WAF_CAPTCHA_WIDGET
+    ];
+    ALIYUN_PUZZLE_SLIDER_SELECTOR = "#aliyunCaptcha-sliding-slider";
+    ALIYUN_PUZZLE_TRACK_SELECTOR = "#aliyunCaptcha-sliding-body";
+    ALIYUN_PROBE_MAX_WAIT_MS = 2e3;
     captchaMouseLock = Promise.resolve();
   }
 });
@@ -4090,6 +4396,14 @@ function updateQwenWebVersion(version) {
 function getQwenWebVersion() {
   return dynamicWebVersion || config.qwen.webVersion;
 }
+function updateQwenBxVersion(version) {
+  if (version && typeof version === "string" && /^\d+\.\d+\.\d+/.test(version)) {
+    dynamicBxVersion = version.trim();
+  }
+}
+function getQwenBxVersion() {
+  return dynamicBxVersion || config.auth.bxV;
+}
 function buildQwenRequestHeaders(opts) {
   const headers = {
     ...opts.extra ?? {},
@@ -4106,7 +4420,7 @@ function buildQwenRequestHeaders(opts) {
     Connection: "keep-alive",
     "User-Agent": opts.userAgent || getDefaultQwenUserAgent(),
     "X-Request-Id": uuidv4(),
-    "bx-v": opts.bxV || "2.5.37",
+    "bx-v": opts.bxV || getQwenBxVersion(),
     source: "web",
     version: opts.version || getQwenWebVersion(),
     timezone: opts.extra?.timezone || opts.extra?.Timezone || formatAsciiTimezone(),
@@ -4130,7 +4444,7 @@ function buildQwenRequestHeaders(opts) {
   }
   return headers;
 }
-var dynamicWebVersion, QWEN_WEB_VERSION, DEFAULT_QWEN_USER_AGENT, QWEN_TIMEZONE_HEADER;
+var dynamicWebVersion, dynamicBxVersion, QWEN_WEB_VERSION, DEFAULT_QWEN_USER_AGENT, QWEN_TIMEZONE_HEADER;
 var init_qwen_headers = __esm({
   "src/services/qwen-headers.ts"() {
     "use strict";
@@ -4139,6 +4453,7 @@ var init_qwen_headers = __esm({
     init_fingerprint();
     init_timezone();
     dynamicWebVersion = null;
+    dynamicBxVersion = null;
     QWEN_WEB_VERSION = config.qwen.webVersion;
     DEFAULT_QWEN_USER_AGENT = getDefaultQwenUserAgent(151);
     QWEN_TIMEZONE_HEADER = (/* @__PURE__ */ new Date()).toString().split(" (")[0];
@@ -4752,11 +5067,12 @@ async function getOrLaunchSharedBrowser(browserType = "chromium", headless = con
 async function clearVisibleChallenge(page) {
   if (page.isClosed()) return;
   if (config.captcha.enabled) {
-    await solveBaxiaCaptcha(page, {
+    await solveVisibleCaptcha(page, {
       waitForMs: 0,
       maxAttempts: config.captcha.maxAttempts,
       retryDelayMs: config.captcha.retryDelayMs,
-      settleMs: config.captcha.settleMs
+      settleMs: config.captcha.settleMs,
+      sliderTimeoutMs: config.captcha.sliderTimeoutMs
     }).catch(() => false);
   }
   try {
@@ -5369,6 +5685,7 @@ async function getBasicHeaders(accountId) {
               mobile = data.mobile ? "?1" : "?0";
             }
             let bundleVersion = null;
+            let baxiaVersion = null;
             try {
               const el = document.querySelector('link[href*="qwen-chat-fe"], script[src*="qwen-chat-fe"], img[src*="qwen-chat-fe"]');
               const src = el ? el.getAttribute("href") || el.getAttribute("src") || "" : "";
@@ -5376,7 +5693,14 @@ async function getBasicHeaders(accountId) {
               if (match) bundleVersion = match[1];
             } catch {
             }
-            return { ua, secChUa, platform, mobile, bundleVersion };
+            try {
+              const baxia = window.baxiaCommon;
+              if (typeof baxia?.version === "string") {
+                baxiaVersion = baxia.version;
+              }
+            } catch {
+            }
+            return { ua, secChUa, platform, mobile, bundleVersion, baxiaVersion };
           }),
           config.timeouts.page,
           `User-agent lookup timed out for ${accountId}`
@@ -5385,6 +5709,9 @@ async function getBasicHeaders(accountId) {
         if (nav.bundleVersion) {
           updateQwenWebVersion(nav.bundleVersion);
         }
+        if (nav.baxiaVersion) {
+          updateQwenBxVersion(nav.baxiaVersion);
+        }
         cachedUserAgents.set(accountId, userAgent);
         const hints = getHeaderCache(accountId).headers;
         clientHints = {
@@ -5416,7 +5743,7 @@ async function getBasicHeaders(accountId) {
       markAccountHeadersReady(accountId);
       const bxUa2 = cache3.headers["bx-ua"];
       const bxUmidtoken2 = cache3.headers["bx-umidtoken"];
-      const bxV2 = cache3.headers["bx-v"] || "2.5.37";
+      const bxV2 = cache3.headers["bx-v"] || getQwenBxVersion();
       const cookie2 = await getCookies(accountId);
       return { cookie: cookie2, userAgent, bxV: bxV2, bxUa: bxUa2, bxUmidtoken: bxUmidtoken2, ...clientHints };
     }
@@ -5427,7 +5754,7 @@ async function getBasicHeaders(accountId) {
         cookieCaches.set(accountId, { cookie: cookie2, timestamp: Date.now() });
         const bxUa2 = cache3.headers["bx-ua"];
         const bxUmidtoken2 = cache3.headers["bx-umidtoken"];
-        const bxV2 = cache3.headers["bx-v"] || "2.5.37";
+        const bxV2 = cache3.headers["bx-v"] || getQwenBxVersion();
         cache3.lastRefresh = Date.now();
         markAccountHeadersReady(accountId);
         console.log(
@@ -5502,6 +5829,9 @@ async function getBasicHeaders(accountId) {
             if (persisted.version) {
               updateQwenWebVersion(persisted.version);
             }
+            if (persisted.bxV) {
+              updateQwenBxVersion(persisted.bxV);
+            }
             cache3.lastRefresh = persisted.capturedAt;
             markAccountHeadersReady(accountId);
           }
@@ -5529,7 +5859,7 @@ async function getBasicHeaders(accountId) {
     markAccountHeadersReady(accountId);
     const bxUa = cache3.headers["bx-ua"];
     const bxUmidtoken = cache3.headers["bx-umidtoken"];
-    const bxV = cache3.headers["bx-v"] || "2.5.37";
+    const bxV = cache3.headers["bx-v"] || getQwenBxVersion();
     cookieCaches.delete(accountId);
     const cookie = await getCookies(accountId, true);
     if (cache3.headers) {
@@ -5774,6 +6104,9 @@ async function initPlaywrightForAccount(rawAccount, headless = config.playwright
                 if (persisted.version) {
                   updateQwenWebVersion(persisted.version);
                 }
+                if (persisted.bxV) {
+                  updateQwenBxVersion(persisted.bxV);
+                }
                 cache3.lastRefresh = persisted.capturedAt;
                 markAccountHeadersReady(account.id);
                 restoredFromDb = true;
@@ -6123,7 +6456,7 @@ async function startEmailOtpLogin(email, options = {}) {
       {
         email: normalizedEmail,
         requestId,
-        version: getQwenWebVersion() || "0.3.26",
+        version: getQwenWebVersion(),
         timezone: formatAsciiTimezone()
       }
     ).catch((err) => ({ ok: false, error: err?.message || String(err) }));
@@ -6218,7 +6551,7 @@ async function verifyEmailOtpLogin(sessionId, code) {
       email: session.email,
       code: cleanCode,
       requestId,
-      version: getQwenWebVersion() || "0.3.26",
+      version: getQwenWebVersion(),
       timezone: formatAsciiTimezone()
     }
   ).catch((err) => ({ ok: false, error: err?.message || String(err) }));
@@ -6265,8 +6598,8 @@ async function verifyEmailOtpLogin(sessionId, code) {
     saveAuthSession2(session.accountId, {
       cookie: `token=${accessToken}`,
       userAgent: session.fingerprint.userAgent,
-      bxV: "2.5.37",
-      version: getQwenWebVersion() || "0.3.26",
+      bxV: getQwenBxVersion(),
+      version: getQwenWebVersion(),
       userId: userId || void 0,
       tokenExpiresAt: exp || void 0,
       refreshToken: refreshToken || void 0,
@@ -6376,7 +6709,7 @@ async function loginToQwen(accountId, email, password) {
           saveAuthSession2(accountId, {
             cookie: cookieStr,
             userAgent: cache3.headers["user-agent"] || "",
-            bxV: cache3.headers["bx-v"] || "2.5.37",
+            bxV: cache3.headers["bx-v"] || getQwenBxVersion(),
             bxUa: cache3.headers["bx-ua"] || "",
             bxUmidtoken: cache3.headers["bx-umidtoken"] || "",
             secChUa: cache3.headers["sec-ch-ua"] || void 0,
@@ -6448,7 +6781,7 @@ async function loginToQwen(accountId, email, password) {
           saveAuthSession2(accountId, {
             cookie: cookieStr,
             userAgent: cache3.headers["user-agent"] || "",
-            bxV: cache3.headers["bx-v"] || "2.5.37",
+            bxV: cache3.headers["bx-v"] || getQwenBxVersion(),
             bxUa: cache3.headers["bx-ua"] || "",
             bxUmidtoken: cache3.headers["bx-umidtoken"] || "",
             secChUa: cache3.headers["sec-ch-ua"] || void 0,
@@ -6519,7 +6852,7 @@ async function loginViaApi(page, email, password) {
     }
     const signinUrl = "https://auth.qwen.ai/api/v2/auths/signin";
     const requestId = crypto5.randomUUID();
-    const webVersion = getQwenWebVersion() || "0.3.26";
+    const webVersion = getQwenWebVersion();
     const evalRes = await page.evaluate(
       async ({ email: email2, password: password2, signinUrl: signinUrl2, requestId: requestId2, tz, version }) => {
         try {
@@ -6691,6 +7024,15 @@ async function loginViaUi(page, email, password) {
     if (!page.url().includes("/auth") && await isPageLoggedIn(page, 3e3).catch(() => false)) {
       return { success: true };
     }
+    if (config.captcha.enabled) {
+      await solveVisibleCaptcha(page, {
+        waitForMs: 1500,
+        maxAttempts: config.captcha.maxAttempts,
+        retryDelayMs: config.captcha.retryDelayMs,
+        settleMs: config.captcha.settleMs,
+        sliderTimeoutMs: config.captcha.sliderTimeoutMs
+      }).catch(() => false);
+    }
     const emailSelector = [
       'input[type="email"]',
       'input[name="email"]',
@@ -6846,10 +7188,11 @@ async function loginViaUi(page, email, password) {
     while (Date.now() < postSubmitDeadline) {
       if (page.isClosed()) break;
       if (config.captcha.enabled) {
-        await solveBaxiaCaptcha(page, {
+        await solveVisibleCaptcha(page, {
           waitForMs: 1500,
           maxAttempts: config.captcha.maxAttempts,
-          retryDelayMs: config.captcha.retryDelayMs
+          retryDelayMs: config.captcha.retryDelayMs,
+          sliderTimeoutMs: config.captcha.sliderTimeoutMs
         }).catch(() => {
         });
       }
@@ -6972,7 +7315,7 @@ async function refreshAccountToken(accountId) {
   }
   if (refreshToken) {
     try {
-      const webVersion = getQwenWebVersion() || "0.3.26";
+      const webVersion = getQwenWebVersion();
       const refreshResult = await page.evaluate(
         async ({ rTok, tz, version }) => {
           try {
@@ -7037,7 +7380,7 @@ async function refreshAccountToken(accountId) {
           saveAuthSession2(accountId, {
             cookie: cookieStr,
             userAgent: cache3.headers["user-agent"] || session?.userAgent || "",
-            bxV: cache3.headers["bx-v"] || session?.bxV || "2.5.37",
+            bxV: cache3.headers["bx-v"] || session?.bxV || getQwenBxVersion(),
             bxUa: cache3.headers["bx-ua"] || session?.bxUa || "",
             bxUmidtoken: cache3.headers["bx-umidtoken"] || session?.bxUmidtoken || "",
             secChUa: cache3.headers["sec-ch-ua"] || session?.secChUa,
@@ -7072,7 +7415,7 @@ async function refreshAccountToken(accountId) {
         saveAuthSession2(accountId, {
           cookie: cookieStr,
           userAgent: cache3.headers["user-agent"] || session?.userAgent || "",
-          bxV: cache3.headers["bx-v"] || session?.bxV || "2.5.37",
+          bxV: cache3.headers["bx-v"] || session?.bxV || getQwenBxVersion(),
           bxUa: cache3.headers["bx-ua"] || session?.bxUa || "",
           bxUmidtoken: cache3.headers["bx-umidtoken"] || session?.bxUmidtoken || "",
           secChUa: cache3.headers["sec-ch-ua"] || session?.secChUa,
@@ -7220,7 +7563,7 @@ async function captureQwenHeaders(accountId, pageOverride, timeoutMs = config.ti
           cookie: reqHeaders["cookie"] || "",
           "bx-ua": reqHeaders["bx-ua"] || "",
           "bx-umidtoken": reqHeaders["bx-umidtoken"] || "",
-          "bx-v": reqHeaders["bx-v"] || "2.5.37",
+          "bx-v": reqHeaders["bx-v"] || getQwenBxVersion(),
           "user-agent": reqHeaders["user-agent"] || "",
           "x-request-id": reqHeaders["x-request-id"] || "",
           "version": reqHeaders["version"] || "",
@@ -7252,6 +7595,9 @@ async function captureQwenHeaders(accountId, pageOverride, timeoutMs = config.ti
         if (capturedHeaders["version"]) {
           updateQwenWebVersion(capturedHeaders["version"]);
         }
+        if (capturedHeaders["bx-v"]) {
+          updateQwenBxVersion(capturedHeaders["bx-v"]);
+        }
         markAccountHeadersReady(accountId);
         cache3.lastRefresh = Date.now();
         cookieCaches.delete(accountId);
@@ -7709,7 +8055,7 @@ async function refreshHeadersInternal(accountId, timeoutMs = config.timeouts.hea
             saveAuthSession2(accountId, {
               cookie: cookieStr,
               userAgent: cache3.headers["user-agent"] || "",
-              bxV: cache3.headers["bx-v"] || "2.5.37",
+              bxV: cache3.headers["bx-v"] || getQwenBxVersion(),
               bxUa: cache3.headers["bx-ua"] || "",
               bxUmidtoken: cache3.headers["bx-umidtoken"] || "",
               secChUa: cache3.headers["sec-ch-ua"] || void 0,
@@ -8712,13 +9058,13 @@ async function getBasicHeaders2(accountId) {
     return {
       cookie: "token=mock",
       userAgent: "mock",
-      bxV: "2.5.37",
+      bxV: getQwenBxVersion(),
       bxUa: "mock-bx-ua",
       bxUmidtoken: "mock-bx-umidtoken",
       secChUa: "",
       secChUaMobile: "?0",
       secChUaPlatform: "",
-      version: "0.3.26"
+      version: getQwenWebVersion()
     };
   }
   const resolvedAccountId = accountId ?? loadAccounts()[0]?.id;
@@ -8779,6 +9125,7 @@ var init_auth_playwright = __esm({
     init_errors();
     init_accounts();
     init_config();
+    init_qwen_headers();
     init_playwright();
     init_jwt();
   }
@@ -8903,6 +9250,7 @@ var init_model_alias = __esm({
     DEFAULT_FALLBACK_MODELS = [
       "qwen3.8-max",
       "qwen3.7-plus",
+      "qwen4.0-max-preview",
       "qwen3.8-omni-flash",
       "qwen3.7-max",
       "qwen3.6-plus",
@@ -9249,9 +9597,10 @@ async function solveChallengeOnPage(page, challengeUrl, waitForMs = config.captc
   const solverOptions = {
     maxAttempts: config.captcha.maxAttempts,
     retryDelayMs: config.captcha.retryDelayMs,
-    settleMs: config.captcha.settleMs
+    settleMs: config.captcha.settleMs,
+    sliderTimeoutMs: config.captcha.sliderTimeoutMs
   };
-  if (await solveBaxiaCaptcha(page, { ...solverOptions, waitForMs: 0 })) {
+  if (await solveVisibleCaptcha(page, { ...solverOptions, waitForMs: 0 })) {
     return true;
   }
   logBaxiaCaptcha(
@@ -9261,7 +9610,7 @@ async function solveChallengeOnPage(page, challengeUrl, waitForMs = config.captc
   );
   await gotoBestEffort(page, challengeUrl ?? qwenUrl("/"));
   try {
-    return await solveBaxiaCaptcha(page, { ...solverOptions, waitForMs });
+    return await solveVisibleCaptcha(page, { ...solverOptions, waitForMs });
   } finally {
     if (page.url().includes(CHALLENGE_PATH_MARKER)) {
       await gotoBestEffort(page, qwenUrl("/"));
@@ -9299,9 +9648,10 @@ async function recoverBaxiaCaptcha(accountId, label, options = {}) {
           const solverOptions = {
             maxAttempts: config.captcha.maxAttempts,
             retryDelayMs: config.captcha.retryDelayMs,
-            settleMs: config.captcha.settleMs
+            settleMs: config.captcha.settleMs,
+            sliderTimeoutMs: config.captcha.sliderTimeoutMs
           };
-          if (await solveBaxiaCaptcha(page, { ...solverOptions, waitForMs: 0 })) {
+          if (await solveVisibleCaptcha(page, { ...solverOptions, waitForMs: 0 })) {
             return true;
           }
           const ctx = typeof page.context === "function" ? page.context() : null;
@@ -11618,7 +11968,7 @@ var init_media_generation = __esm({
 
 // src/services/qwen-chat-pool.ts
 import crypto6 from "crypto";
-async function createQwenChatSession(headers, model, accountId, chatMode = "thread") {
+async function createQwenChatSession(headers, model, accountId, chatMode = "thread", captchaRecoveryAttempts = 1) {
   if (isAuthMockEnabled()) {
     return process.env.TEST_SESSION_ID || "mock-session";
   }
@@ -11646,16 +11996,29 @@ async function createQwenChatSession(headers, model, accountId, chatMode = "thre
   if (!chatId || typeof chatId !== "string") {
     const rawLower = raw.toLowerCase();
     if (looksLikeAntiBotChallengeText(raw)) {
-      try {
-        const { recoverBaxiaCaptcha: recoverBaxiaCaptcha2 } = await Promise.resolve().then(() => (init_captcha_coordinator(), captcha_coordinator_exports));
-        const solved = await recoverBaxiaCaptcha2(accountId, "createQwenChatSession", {
-          challengeBody: raw
-        });
-        if (solved) {
-          return createQwenChatSession(headers, model, accountId, chatMode);
+      if (captchaRecoveryAttempts > 0) {
+        try {
+          const { recoverBaxiaCaptcha: recoverBaxiaCaptcha2 } = await Promise.resolve().then(() => (init_captcha_coordinator(), captcha_coordinator_exports));
+          const solved = await recoverBaxiaCaptcha2(accountId, "createQwenChatSession", {
+            challengeBody: raw
+          });
+          if (solved) {
+            return createQwenChatSession(
+              headers,
+              model,
+              accountId,
+              chatMode,
+              captchaRecoveryAttempts - 1
+            );
+          }
+        } catch {
         }
-      } catch {
       }
+      throw new QwenUpstreamError(
+        `Qwen create chat blocked by WAF challenge: ${raw.substring(0, 300)}`,
+        "FAIL_SYS_USER_VALIDATE",
+        403
+      );
     }
     const isUnauthorized = json?.data?.code?.toLowerCase() === "unauthorized" || json?.code?.toLowerCase() === "unauthorized" || rawLower.includes("unauthorized") || rawLower.includes("permission to access") || rawLower.includes("token has expired") || rawLower.includes("401");
     if (isUnauthorized) {
@@ -11832,6 +12195,20 @@ async function refillQwenChatPool(headers, model, accountId) {
         console.warn(
           `[WarmPool] Account ${accountId || "global"} rate-limited during chat creation. Marked for cooldown.`
         );
+      } else if (accountId && (err.upstreamCode === "FAIL_SYS_USER_VALIDATE" || err.upstreamCode === "RGV587_ERROR" || /_____tmd_____|rgv587_error|fail_sys_user_validate/i.test(
+        err.message
+      ))) {
+        const existing = getAccountCooldownInfo(accountId);
+        if (existing?.reason === "WafChallenge") {
+          console.warn(
+            `[WarmPool] Account ${accountId} still on WAF quarantine (${Math.ceil(existing.remainingMs / 1e3)}s left); skipping re-escalation.`
+          );
+        } else {
+          const block = recordWafHardBlock(accountId);
+          console.warn(
+            `[WarmPool] Unsolved WAF challenge on ${accountId} during chat creation; quarantined ${Math.ceil(block.cooldownMs / 1e3)}s and rotated the fingerprint.`
+          );
+        }
       }
     }
     if (isToolcallDebugEnabled()) {
@@ -11867,6 +12244,7 @@ var init_qwen_chat_pool = __esm({
     init_config();
     init_logger();
     init_account_manager();
+    init_waf_isolation();
     init_model_alias();
     init_qwen_url();
     init_qwen_errors();
@@ -12436,7 +12814,7 @@ async function requestQwenTextInBrowser(accountId, method, path21, headers, body
     browserHeaders["Content-Type"] = "application/json";
   }
   const evaluateRequest = (page) => page.evaluate(
-    async ({ url: url2, method: method2, headers: headers2, body: body2, referrer, timeoutMs, tz }) => {
+    async ({ url: url2, method: method2, headers: headers2, body: body2, referrer, timeoutMs, tz, version }) => {
       const controller = new AbortController();
       const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
       try {
@@ -12458,7 +12836,7 @@ async function requestQwenTextInBrowser(accountId, method, path21, headers, body
                 headers: {
                   accept: "application/json, text/plain, */*",
                   source: "web",
-                  version: "0.3.11",
+                  version,
                   "x-request-origin": "https://chat.qwen.ai",
                   timezone: tz,
                   authorization: `Bearer ${rTok}`
@@ -12506,7 +12884,8 @@ async function requestQwenTextInBrowser(accountId, method, path21, headers, body
       body,
       referrer: options.referrer,
       timeoutMs: options.timeoutMs ?? Math.min(config.timeouts.page, 2e4),
-      tz: formatAsciiTimezone()
+      tz: formatAsciiTimezone(),
+      version: getQwenWebVersion()
     }
   );
   const recoverOnTimeout = !options.noMutexRecovery;
@@ -13463,7 +13842,7 @@ async function deleteSingleQwenChat(accountId, chatId) {
   }
   const requestHeaders = {
     source: "web",
-    version: getQwenWebVersion() || "0.3.26",
+    version: getQwenWebVersion(),
     timezone: formatAsciiTimezone(),
     "x-request-id": crypto7.randomUUID(),
     Referer: qwenUrl(`/c/${encodeURIComponent(chatId)}`)
@@ -13507,7 +13886,7 @@ async function fetchRemoteQwenChats(accountId) {
     return [];
   }
   const requestHeaders = {
-    version: getQwenWebVersion() || "0.3.26",
+    version: getQwenWebVersion(),
     timezone: formatAsciiTimezone(),
     "x-request-id": crypto7.randomUUID(),
     Referer: qwenUrl("/settings/chats")
@@ -27196,11 +27575,42 @@ var init_server_log_buffer = __esm({
 // src/services/session-keeper.ts
 var session_keeper_exports = {};
 __export(session_keeper_exports, {
+  computeSessionKeeperBackoffMs: () => computeSessionKeeperBackoffMs,
+  isSessionKeeperAccountBackedOff: () => isSessionKeeperAccountBackedOff,
   isSessionKeeperRunning: () => isSessionKeeperRunning,
+  resetSessionKeeperRetryStateForTests: () => resetSessionKeeperRetryStateForTests,
   runSessionKeeperOnceForTesting: () => runSessionKeeperOnceForTesting,
   startSessionKeeper: () => startSessionKeeper,
   stopSessionKeeper: () => stopSessionKeeper
 });
+function computeSessionKeeperBackoffMs(failures) {
+  const exponent = Math.max(0, Math.min(failures - 1, 8));
+  return Math.min(
+    KEEP_ALIVE_BACKOFF_MAX_MS,
+    KEEP_ALIVE_BACKOFF_BASE_MS * 2 ** exponent
+  );
+}
+function isKeepAliveBackedOff(accountId) {
+  const state = keepAliveRetries.get(accountId);
+  return Boolean(state && Date.now() < state.nextAttemptAt);
+}
+function recordKeepAliveFailure(accountId) {
+  const state = keepAliveRetries.get(accountId) ?? {
+    failures: 0,
+    nextAttemptAt: 0
+  };
+  state.failures += 1;
+  const backoffMs = computeSessionKeeperBackoffMs(state.failures);
+  state.nextAttemptAt = Date.now() + backoffMs;
+  keepAliveRetries.set(accountId, state);
+  return backoffMs;
+}
+function resetSessionKeeperRetryStateForTests() {
+  keepAliveRetries.clear();
+}
+function isSessionKeeperAccountBackedOff(accountId) {
+  return isKeepAliveBackedOff(accountId);
+}
 function isSessionKeeperRunning() {
   return running;
 }
@@ -27211,13 +27621,25 @@ async function runKeepAliveCycle() {
     if (config.sessionKeeper.enabled) {
       const accountIds = getActivePlaywrightAccountIds();
       for (const accountId of accountIds) {
-        await keepAlivePlaywrightAccount(accountId).catch((error) => {
-          if (isPlaywrightAlreadyClosedError(error)) return;
-          const message = error instanceof Error ? error.message : String(error);
-          console.warn(
-            `[SessionKeeper] Keep-alive failed for ${accountId}: ${message}`
-          );
-        });
+        if (isKeepAliveBackedOff(accountId)) {
+          continue;
+        }
+        try {
+          const keptAlive = await keepAlivePlaywrightAccount(accountId);
+          if (keptAlive) {
+            keepAliveRetries.delete(accountId);
+          }
+        } catch (error) {
+          if (isPlaywrightAlreadyClosedError(error)) {
+            keepAliveRetries.delete(accountId);
+          } else {
+            const message = error instanceof Error ? error.message : String(error);
+            const backoffMs = recordKeepAliveFailure(accountId);
+            console.warn(
+              `[SessionKeeper] Keep-alive failed for ${accountId}: ${message} (retry in ${Math.round(backoffMs / 1e3)}s)`
+            );
+          }
+        }
         await sleep(humanDelay(250, 900));
       }
     }
@@ -27257,11 +27679,12 @@ function stopSessionKeeper() {
     intervalId = null;
   }
   cycleInProgress = false;
+  keepAliveRetries.clear();
 }
 async function runSessionKeeperOnceForTesting() {
   await runKeepAliveCycle();
 }
-var running, intervalId, cycleInProgress;
+var running, intervalId, cycleInProgress, KEEP_ALIVE_BACKOFF_BASE_MS, KEEP_ALIVE_BACKOFF_MAX_MS, keepAliveRetries;
 var init_session_keeper = __esm({
   "src/services/session-keeper.ts"() {
     "use strict";
@@ -27271,6 +27694,9 @@ var init_session_keeper = __esm({
     running = false;
     intervalId = null;
     cycleInProgress = false;
+    KEEP_ALIVE_BACKOFF_BASE_MS = 2e3;
+    KEEP_ALIVE_BACKOFF_MAX_MS = 5 * 6e4;
+    keepAliveRetries = /* @__PURE__ */ new Map();
   }
 });
 
@@ -27296,7 +27722,7 @@ function getAppVersion() {
     }
   } catch {
   }
-  cachedVersion = "v1.6.11";
+  cachedVersion = "v1.6.12";
   return cachedVersion;
 }
 var cachedVersion;