qwenproxy-cli 1.6.4 → 1.6.6

package/src/services/qwen.ts

@@ -31,6 +31,7 @@ import { withAccountPage, assertAntiBotHeaders, onBrowserContextCreated, isPlayw
 import { recoverBaxiaCaptcha } from "./captcha-coordinator.ts";
 import { startBaxiaCaptchaWatcher } from "./captcha-solver.ts";
 import { isAccountBusy } from "../core/account-concurrency.ts";
+import { formatAsciiTimezone, sanitizeHeaderForFetch } from "../utils/timezone.ts";
 
 // Re-exported from extracted modules for backward compatibility
 export {
@@ -611,18 +612,21 @@ export function buildCapturedQwenHeaders(
 // the first's whole generation). FIFO handoff on release keeps the old
 // leak-recovery semantics (release is idempotent; a dropped stream still blocks
 // its slot until cancel/idle-timeout frees it — same as before).
+export const STREAM_SLOT_MAX_HOLD_MS = 30 * 60 * 1000; // 30 minutes
+
 interface AccountStreamSlots {
-  active: number;
-  queue: Array<() => void>;
+  activeSlots: Map<number, number>; // slotId -> startedAt
+  queue: Array<(releaseFn: () => void) => void>;
 }
 const accountStreamMutexes = new Map<string, AccountStreamSlots>();
+let nextStreamSlotId = 1;
 
-function getAccountStreamMutex(
+export function getAccountStreamMutex(
   accountId: string,
 ): AccountStreamSlots {
   let slots = accountStreamMutexes.get(accountId);
   if (!slots) {
-    slots = { active: 0, queue: [] };
+    slots = { activeSlots: new Map(), queue: [] };
     accountStreamMutexes.set(accountId, slots);
   }
   return slots;
@@ -632,29 +636,78 @@ function streamSlotCapacity(): number {
   return Math.max(1, config.concurrency.maxStreamsPerAccount);
 }
 
-function createStreamSlotRelease(slots: AccountStreamSlots): () => void {
+function createStreamSlotRelease(slots: AccountStreamSlots, slotId: number): () => void {
   let released = false;
   return () => {
     if (released) return;
     released = true;
-    slots.active -= 1;
+    slots.activeSlots.delete(slotId);
     const next = slots.queue.shift();
     if (next) {
       // Hand the slot directly to the waiter (FIFO), same as the old mutex.
-      slots.active += 1;
-      next();
+      const nextId = nextStreamSlotId++;
+      slots.activeSlots.set(nextId, Date.now());
+      next(createStreamSlotRelease(slots, nextId));
     }
   };
 }
 
-async function acquireAccountStreamLock(accountId: string): Promise<() => void> {
+export function sweepStaleAccountStreamSlots(maxHoldMs: number = STREAM_SLOT_MAX_HOLD_MS): number {
+  const now = Date.now();
+  let sweptCount = 0;
+  for (const [accountId, slots] of accountStreamMutexes.entries()) {
+    for (const [slotId, startedAt] of Array.from(slots.activeSlots.entries())) {
+      if (now - startedAt >= maxHoldMs) {
+        logger.warn(
+          `[Qwen] Force-releasing stale stream slot | account=${accountId} | slotId=${slotId} | heldFor=${now - startedAt}ms | maxHold=${maxHoldMs}ms`,
+        );
+        slots.activeSlots.delete(slotId);
+        sweptCount++;
+        const next = slots.queue.shift();
+        if (next) {
+          const nextId = nextStreamSlotId++;
+          slots.activeSlots.set(nextId, now);
+          next(createStreamSlotRelease(slots, nextId));
+        }
+      }
+    }
+  }
+  return sweptCount;
+}
+
+let staleSlotSweeperTimer: NodeJS.Timeout | null = null;
+
+export function ensureStaleSlotSweeperStarted(): void {
+  if (staleSlotSweeperTimer) return;
+  staleSlotSweeperTimer = setInterval(() => {
+    try {
+      sweepStaleAccountStreamSlots();
+    } catch (err) {
+      logger.error("[Qwen] Error in stale stream slot sweeper", {
+        error: err instanceof Error ? err.message : String(err),
+      });
+    }
+  }, 60_000);
+  staleSlotSweeperTimer.unref();
+}
+
+export function stopStaleSlotSweeperForTests(): void {
+  if (staleSlotSweeperTimer) {
+    clearInterval(staleSlotSweeperTimer);
+    staleSlotSweeperTimer = null;
+  }
+}
+
+export async function acquireAccountStreamLock(accountId: string): Promise<() => void> {
+  ensureStaleSlotSweeperStarted();
   const slots = getAccountStreamMutex(accountId);
-  if (slots.active < streamSlotCapacity()) {
-    slots.active += 1;
-    return Promise.resolve(createStreamSlotRelease(slots));
+  if (slots.activeSlots.size < streamSlotCapacity()) {
+    const slotId = nextStreamSlotId++;
+    slots.activeSlots.set(slotId, Date.now());
+    return Promise.resolve(createStreamSlotRelease(slots, slotId));
   }
   return new Promise<() => void>((resolve) => {
-    slots.queue.push(() => resolve(createStreamSlotRelease(slots)));
+    slots.queue.push((releaseFn) => resolve(releaseFn));
   });
 }
 
@@ -830,7 +883,7 @@ async function withQwenBrowserPage<T>(
  * adds Cookie, User-Agent, Origin, Referer, and sec-* headers, so we only
  * pass the anti-bot tokens and metadata that the browser cannot infer.
  */
-function getBrowserFetchHeaders(
+export function getBrowserFetchHeaders(
   headers: Record<string, string>,
 ): Record<string, string> {
   const browserAllowedHeaders = new Set([
@@ -847,11 +900,13 @@ function getBrowserFetchHeaders(
     "x-accel-buffering",
   ]);
 
-  return Object.fromEntries(
-    Object.entries(headers).filter(([name]) =>
-      browserAllowedHeaders.has(name.toLowerCase()),
-    ),
-  );
+  const result: Record<string, string> = {};
+  for (const [name, value] of Object.entries(headers)) {
+    if (browserAllowedHeaders.has(name.toLowerCase())) {
+      result[name] = sanitizeHeaderForFetch(String(value ?? ""));
+    }
+  }
+  return result;
 }
 
 interface BrowserTextResponse {
@@ -906,13 +961,14 @@ export async function requestQwenTextInBrowser(
 
   const evaluateRequest = (page: Page) =>
     page.evaluate(
-      async ({ url, method, headers, body, referrer, timeoutMs }: {
+      async ({ url, method, headers, body, referrer, timeoutMs, tz }: {
         url: string;
         method: "GET" | "POST" | "DELETE";
         headers: Record<string, string>;
         body?: string;
         referrer?: string;
         timeoutMs: number;
+        tz: string;
       }): Promise<BrowserTextResponse> => {
         const controller = new AbortController();
         const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
@@ -939,7 +995,7 @@ export async function requestQwenTextInBrowser(
                     source: "web",
                     version: "0.3.11",
                     "x-request-origin": "https://chat.qwen.ai",
-                    timezone: new Date().toString().split(" (")[0],
+                    timezone: tz,
                     authorization: `Bearer ${rTok}`,
                   },
                   signal: AbortSignal.timeout(5000),
@@ -985,6 +1041,7 @@ export async function requestQwenTextInBrowser(
         body,
         referrer: options.referrer,
         timeoutMs: options.timeoutMs ?? Math.min(config.timeouts.page, 20_000),
+        tz: formatAsciiTimezone(),
       },
     );
   const recoverOnTimeout = !options.noMutexRecovery;
@@ -1931,7 +1988,7 @@ export async function disableNativeTools(accountId?: string): Promise<void> {
           async (page) => {
             const requestId = crypto.randomUUID();
             const response = await page.evaluate(
-              async ({ payload, timeoutMs, requestId }: { payload: any; timeoutMs: number; requestId: string }) => {
+              async ({ payload, timeoutMs, requestId, tz }: { payload: any; timeoutMs: number; requestId: string; tz: string }) => {
                 const controller = new AbortController();
                 const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
                 try {
@@ -1943,7 +2000,7 @@ export async function disableNativeTools(accountId?: string): Promise<void> {
                         accept: "application/json, text/plain, */*",
                         "content-type": "application/json",
                         "x-request-id": requestId,
-                        timezone: new Date().toString().split(" (")[0],
+                        timezone: tz,
                         source: "web",
                       },
                       body: JSON.stringify(payload),
@@ -1955,7 +2012,7 @@ export async function disableNativeTools(accountId?: string): Promise<void> {
                   clearTimeout(timeoutId);
                 }
               },
-              { payload, timeoutMs: config.timeouts.http, requestId },
+              { payload, timeoutMs: config.timeouts.http, requestId, tz: formatAsciiTimezone() },
             );
             return response;
           },
@@ -2241,7 +2298,7 @@ export async function deleteSingleQwenChat(
   const requestHeaders: Record<string, string> = {
     source: "web",
     version: "0.2.89",
-    timezone: new Date().toString().split(" (")[0],
+    timezone: formatAsciiTimezone(),
     "x-request-id": crypto.randomUUID(),
     Referer: qwenUrl(`/c/${encodeURIComponent(chatId)}`),
   };
@@ -2294,7 +2351,7 @@ export async function fetchRemoteQwenChats(
 
   const requestHeaders: Record<string, string> = {
     version: "0.2.89",
-    timezone: new Date().toString().split(" (")[0],
+    timezone: formatAsciiTimezone(),
     "x-request-id": crypto.randomUUID(),
     Referer: qwenUrl("/settings/chats"),
   };
@@ -2356,7 +2413,7 @@ export async function fetchQwenModels(
         async (page) => {
           const requestId = crypto.randomUUID();
           const response = await page.evaluate(
-            async ({ timeoutMs, requestId }: { timeoutMs: number; requestId: string }) => {
+            async ({ timeoutMs, requestId, tz }: { timeoutMs: number; requestId: string; tz: string }) => {
               const controller = new AbortController();
               const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
               try {
@@ -2365,7 +2422,7 @@ export async function fetchQwenModels(
                   headers: {
                     accept: "application/json, text/plain, */*",
                     "x-request-id": requestId,
-                    timezone: new Date().toString().split(" (")[0],
+                    timezone: tz,
                     source: "web",
                   },
                   signal: controller.signal,
@@ -2375,7 +2432,7 @@ export async function fetchQwenModels(
                 clearTimeout(timeoutId);
               }
             },
-            { timeoutMs: config.timeouts.http, requestId },
+            { timeoutMs: config.timeouts.http, requestId, tz: formatAsciiTimezone() },
           );
           return response;
         },
@@ -2421,7 +2478,7 @@ export async function fetchQwenModels(
       bxUa,
       bxUmidtoken,
       extra: {
-        timezone: new Date().toString(),
+        timezone: formatAsciiTimezone(),
       },
     }),
     undefined,

package/src/tools/tool-call-heuristics.ts

@@ -0,0 +1,88 @@
+/**
+ * tool-call-heuristics.ts — Heuristics for deciding whether a turn that produced
+ * NO (successful) tool call should be auto-retried.
+ *
+ * The existing retry path only fires when a `<tool_call>` block was emitted
+ * but could not be parsed (malformed / undeclared). It does NOT cover the case
+ * where the model emits no tool-call block at all and instead answers with
+ * prose that references tools as if they were missing, e.g.:
+ *
+ *   "Tool bash does not exists."
+ *   "Tool read does not exists."
+ *
+ * In that case the client sees `finish_reason: "stop"` with no `tool_calls`,
+ * ends its turn, and the loop stalls until a human nudges it ("continue").
+ */
+
+export type MissingToolCallReason = "malformed" | "no_call" | "json_in_text" | null;
+
+export interface MissingToolCallInput {
+  /** Number of tool definitions declared on the request. */
+  declaredToolCount: number;
+  /** Tool calls that parsed AND resolved to a declared tool. */
+  successfulToolCallCount: number;
+  /** `<tool_call>` blocks captured but rejected (bad JSON / undeclared name). */
+  malformedToolCallCount: number;
+  /** Total tool-call blocks the parser saw (malformed + capped + valid). */
+  emittedToolCallCount: number;
+  /** Assistant-visible text for the turn (excluding the tool-call blocks). */
+  text: string;
+}
+
+export interface MissingToolCallDecision {
+  retry: boolean;
+  reason: MissingToolCallReason;
+}
+
+/**
+ * Matches a model reply that talks about a tool as if it did not exist, which
+ * is the signature of the "lost tool definitions under long context" failure.
+ * Kept deliberately narrow to avoid retrying legitimate prose.
+ */
+export function isToolHesitationText(text: string): boolean {
+  if (!text) return false;
+  return /\btools?\b[^.\n]{0,24}?\b(?:does\s*n[o']?t|do\s*n[o']?t|does\s*not|do\s*not)\b[^.\n]{0,12}?\bexist/i.test(
+    text,
+  );
+}
+
+/**
+ * Detects when the model dumped a raw tool-call JSON payload as prose instead
+ * of emitting it as a structured tool call.
+ */
+export function isRawToolCallJsonInText(text: string): boolean {
+  if (!text) return false;
+  const hasToolCallJson =
+    /\{\s*"name"\s*:\s*"[a-zA-Z_][a-zA-Z0-9_]*"\s*,\s*"arguments"\s*:\s*\{/i.test(text);
+  const hasStrayCloseTag = /<\/tool_call>/.test(text);
+  return hasToolCallJson || hasStrayCloseTag;
+}
+
+export function decideMissingToolCallRetry(
+  input: MissingToolCallInput,
+): MissingToolCallDecision {
+  const {
+    declaredToolCount,
+    successfulToolCallCount,
+    malformedToolCallCount,
+    emittedToolCallCount,
+    text,
+  } = input;
+
+  // No tools were declared: a text answer is the expected outcome.
+  if (declaredToolCount <= 0) return { retry: false, reason: null };
+
+  // A usable call was produced: nothing to recover.
+  if (successfulToolCallCount > 0) return { retry: false, reason: null };
+
+  // Existing behaviour: a block was emitted but it was rejected.
+  if (malformedToolCallCount > 0) return { retry: true, reason: "malformed" };
+
+  // New behaviour: no `<tool_call>` block was emitted at all, yet the model
+  // talked about tools as missing (the "does not exists" case).
+  if (emittedToolCallCount === 0 && isToolHesitationText(text)) {
+    return { retry: true, reason: "no_call" };
+  }
+
+  return { retry: false, reason: null };
+}

package/src/utils/timezone.ts

@@ -0,0 +1,56 @@
+/**
+ * timezone.ts — Locale-safe ASCII timezone header formatting and sanitization.
+ *
+ * Guarantees that HTTP headers passed into browser `window.fetch()` contain
+ * exclusively ISO-8859-1 code points (<= 255), preventing:
+ * `TypeError: Failed to read the 'headers' property from 'RequestInit': String contains non ISO-8859-1 code point`
+ * on systems configured with non-English locales (e.g. Russian, CJK, Arabic).
+ */
+
+const DAYS = ["Sun", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat"];
+const MONTHS = [
+  "Jan",
+  "Feb",
+  "Mar",
+  "Apr",
+  "May",
+  "Jun",
+  "Jul",
+  "Aug",
+  "Sep",
+  "Oct",
+  "Nov",
+  "Dec",
+];
+
+/**
+ * Format a Date into standard English browser date string matching Chrome,
+ * guaranteed pure ASCII (<= 127).
+ * Example: "Tue Oct 20 2026 14:35:10 GMT-0300"
+ */
+export function formatAsciiTimezone(date: Date = new Date()): string {
+  const dayName = DAYS[date.getDay()];
+  const monthName = MONTHS[date.getMonth()];
+  const day = String(date.getDate()).padStart(2, "0");
+  const year = date.getFullYear();
+  const hours = String(date.getHours()).padStart(2, "0");
+  const minutes = String(date.getMinutes()).padStart(2, "0");
+  const seconds = String(date.getSeconds()).padStart(2, "0");
+
+  const offsetMinutes = -date.getTimezoneOffset();
+  const sign = offsetMinutes >= 0 ? "+" : "-";
+  const absOffset = Math.abs(offsetMinutes);
+  const offsetHours = String(Math.floor(absOffset / 60)).padStart(2, "0");
+  const offsetMins = String(absOffset % 60).padStart(2, "0");
+  const tzOffset = `GMT${sign}${offsetHours}${offsetMins}`;
+
+  return `${dayName} ${monthName} ${day} ${year} ${hours}:${minutes}:${seconds} ${tzOffset}`;
+}
+
+/**
+ * Sanitizes header values for browser fetch, stripping any code points > 255.
+ */
+export function sanitizeHeaderForFetch(val: string): string {
+  if (typeof val !== "string") return "";
+  return val.replace(/[^\x00-\xFF]/g, "");
+}