qwenproxy-cli 1.6.8 → 1.6.10

package/dist/reset-cooldowns.js

@@ -1334,7 +1334,7 @@ var init_config = __esm({
       // Version header on Qwen API requests = the deployed web bundle version
       // (fallback when dynamic DOM detection is not yet completed).
       // Override via env when Qwen ships a new bundle.
-      QWEN_WEB_VERSION: z.string().default("0.2.91"),
+      QWEN_WEB_VERSION: z.string().default("0.3.26"),
       // Controls bx-ua/bx-umidtoken injection on the GENERAL API paths
       // (chats/new, settings): those work without them (live-probed). The
       // completions path is the exception — the 0.2.86 HAR shows the real
@@ -2768,6 +2768,9 @@ function updateQwenWebVersion(version) {
     dynamicWebVersion = version.trim();
   }
 }
+function getQwenWebVersion() {
+  return dynamicWebVersion || config.qwen.webVersion;
+}
 var dynamicWebVersion, QWEN_WEB_VERSION, DEFAULT_QWEN_USER_AGENT, QWEN_TIMEZONE_HEADER;
 var init_qwen_headers = __esm({
   "src/services/qwen-headers.ts"() {
@@ -3253,7 +3256,19 @@ async function isPageLoggedIn(page, timeoutMs = SESSION_PROBE_NAVIGATION_TIMEOUT
         if (localStorage.getItem("qwen_token_logged_out_marker")) {
           return false;
         }
-        const res = await fetch("/api/v1/auths/", { method: "GET" });
+        const lsToken = (localStorage.getItem("token") || "").trim();
+        if (lsToken && !/(?:^|;\s*)token=/.test(document.cookie || "")) {
+          try {
+            document.cookie = `token=${encodeURIComponent(lsToken)}; path=/; domain=.qwen.ai; max-age=31536000`;
+          } catch {
+          }
+        }
+        const authHeaders = lsToken ? { Authorization: `Bearer ${lsToken}` } : {};
+        const res = await fetch("/api/v1/auths/", {
+          method: "GET",
+          headers: authHeaders,
+          credentials: "include"
+        });
         if (res.status !== 200) return false;
         const json = await res.json().catch(() => null);
         if (!json) return false;
@@ -3271,6 +3286,7 @@ async function isPageLoggedIn(page, timeoutMs = SESSION_PROBE_NAVIGATION_TIMEOUT
         try {
           const settingsRes = await fetch("/api/v2/users/user/settings", {
             method: "GET",
+            headers: authHeaders,
             credentials: "include",
             signal: AbortSignal.timeout(3e3)
           });
@@ -4099,8 +4115,15 @@ async function initPlaywrightForAccount(rawAccount, headless = config.playwright
         const hasAuthCookie = cookies.some(
           (c) => c.name.toLowerCase().includes("token") || c.name.toLowerCase().includes("session")
         );
+        let initialLoginAttempted = false;
         if (!hasAuthCookie && account.email && account.password) {
-          await loginToQwen(account.id, account.email, account.password);
+          initialLoginAttempted = true;
+          const loggedIn = await loginToQwen(account.id, account.email, account.password);
+          if (!loggedIn) {
+            throw new Error(
+              `Authentication failed for account ${maskEmail(account.email)}`
+            );
+          }
         }
         try {
           await acctPage.goto(qwenUrl("/"), {
@@ -4110,13 +4133,21 @@ async function initPlaywrightForAccount(rawAccount, headless = config.playwright
           await sleep2(1500);
           const currentUrl = acctPage.url();
           const isAuthUrl = currentUrl.includes("/auth") || currentUrl.includes("/login");
-          if (isAuthUrl && account.email && account.password) {
+          if (isAuthUrl && !initialLoginAttempted && account.email && account.password) {
             console.log(
               `[Playwright] Initial login needed for ${maskEmail(account.email)}, authenticating...`
             );
-            await loginToQwen(account.id, account.email, account.password);
+            const loggedIn = await loginToQwen(account.id, account.email, account.password);
+            if (!loggedIn) {
+              throw new Error(
+                `Authentication failed for account ${maskEmail(account.email)}`
+              );
+            }
           }
         } catch (err) {
+          if (err?.message?.includes("Authentication failed for account")) {
+            throw err;
+          }
           console.warn(
             `\u26A0\uFE0F  [Playwright] Initial navigation check for ${maskEmail(account.email)}: ${err.message}`
           );
@@ -4259,10 +4290,30 @@ async function loginToQwen(accountId, email, password) {
     const uiResult = await loginViaUi(page, email, password);
     if (uiResult.success) {
       cookieCaches.delete(accountId);
-      await saveStorageState(page.context(), accountId);
       try {
-        const liveCookies = await page.context().cookies();
-        const tokenCookie = liveCookies.find((c) => c.name === "token");
+        let liveCookies = await page.context().cookies();
+        let tokenCookie = liveCookies.find((c) => c.name === "token");
+        if (!tokenCookie) {
+          const lsTok = uiResult.token || await page.evaluate(() => (localStorage.getItem("token") || "").trim()).catch(() => "");
+          if (lsTok) {
+            await page.context().addCookies([
+              {
+                name: "token",
+                value: lsTok,
+                domain: ".qwen.ai",
+                path: "/",
+                expires: Math.floor(Date.now() / 1e3) + 31536e3,
+                httpOnly: false,
+                secure: true,
+                sameSite: "Lax"
+              }
+            ]).catch(() => {
+            });
+            liveCookies = await page.context().cookies();
+            tokenCookie = liveCookies.find((c) => c.name === "token");
+          }
+        }
+        await saveStorageState(page.context(), accountId);
         if (tokenCookie) {
           const cookieStr = liveCookies.map((c) => `${c.name}=${c.value}`).join("; ");
           const cache = getHeaderCache(accountId);
@@ -4271,7 +4322,7 @@ async function loginToQwen(accountId, email, password) {
           markAccountHeadersReady(accountId);
           const { saveAuthSession: saveAuthSession2 } = await Promise.resolve().then(() => (init_database(), database_exports));
           const exp = parseJwtExpiry(tokenCookie.value);
-          let rTok = uiResult.refreshToken;
+          let rTok = uiResult.refreshToken || liveCookies.find((c) => c.name === "refresh_token")?.value;
           if (!rTok) {
             try {
               rTok = await page.evaluate(() => localStorage.getItem("refresh_token") || "") || void 0;
@@ -4352,8 +4403,9 @@ async function loginViaApi(page, email, password) {
     }
     const signinUrl = "https://auth.qwen.ai/api/v2/auths/signin";
     const requestId = crypto3.randomUUID();
+    const webVersion = getQwenWebVersion() || "0.3.26";
     const evalRes = await page.evaluate(
-      async ({ email: email2, password: password2, signinUrl: signinUrl2, requestId: requestId2, tz }) => {
+      async ({ email: email2, password: password2, signinUrl: signinUrl2, requestId: requestId2, tz, version }) => {
         try {
           const response = await fetch(signinUrl2, {
             method: "POST",
@@ -4363,7 +4415,7 @@ async function loginViaApi(page, email, password) {
               accept: "application/json, text/plain, */*",
               "content-type": "application/json",
               source: "web",
-              version: "0.3.11",
+              version,
               "x-request-origin": "https://chat.qwen.ai",
               timezone: tz,
               "x-request-id": requestId2
@@ -4376,7 +4428,14 @@ async function loginViaApi(page, email, password) {
           return { ok: false, error: e.message };
         }
       },
-      { email, password: hashedPassword, signinUrl, requestId, tz: formatAsciiTimezone() }
+      {
+        email,
+        password: hashedPassword,
+        signinUrl,
+        requestId,
+        tz: formatAsciiTimezone(),
+        version: webVersion
+      }
     ).catch(() => null);
     let data = evalRes?.data;
     let signinSuccess = Boolean(
@@ -4385,7 +4444,7 @@ async function loginViaApi(page, email, password) {
     if (!signinSuccess && !data?.data?.code) {
       const fallbackUrl = qwenUrl("/api/v2/auths/signin");
       const fallbackRes = await page.evaluate(
-        async ({ email: email2, password: password2, fallbackUrl: fallbackUrl2, requestId: requestId2, tz }) => {
+        async ({ email: email2, password: password2, fallbackUrl: fallbackUrl2, requestId: requestId2, tz, version }) => {
           try {
             const response = await fetch(fallbackUrl2, {
               method: "POST",
@@ -4395,7 +4454,7 @@ async function loginViaApi(page, email, password) {
                 accept: "application/json, text/plain, */*",
                 "content-type": "application/json",
                 source: "web",
-                version: "0.3.11",
+                version,
                 timezone: tz,
                 "x-request-id": requestId2
               },
@@ -4407,7 +4466,14 @@ async function loginViaApi(page, email, password) {
             return { ok: false, error: e.message };
           }
         },
-        { email, password: hashedPassword, fallbackUrl, requestId, tz: formatAsciiTimezone() }
+        {
+          email,
+          password: hashedPassword,
+          fallbackUrl,
+          requestId,
+          tz: formatAsciiTimezone(),
+          version: webVersion
+        }
       ).catch(() => null);
       if (fallbackRes?.data) {
         data = fallbackRes.data;
@@ -4632,28 +4698,34 @@ async function loginViaUi(page, email, password) {
     await sleep2(500);
     const submitSelector = 'button.qwenchat-auth-pc-submit-button, button[type="submit"], button:has-text("Log in"), button:has-text("Sign in"), button:has-text("Fazer login"), button:has-text("Entrar"), button:has-text("Iniciar sesi\xF3n"), button:has-text("\u767B\u5F55")';
     const submitButton = page.locator(submitSelector).first();
-    await page.evaluate((sel) => {
-      try {
-        const btn = document.querySelector(sel);
-        if (btn) {
-          btn.removeAttribute("disabled");
-          btn.classList.remove("ant-btn-disabled");
-          btn.click();
-        }
-      } catch {
-      }
-    }, submitSelector).catch(() => {
-    });
+    let submitted = false;
     try {
       if (await submitButton.isVisible({ timeout: 2e3 }).catch(() => false)) {
-        await submitButton.click({ force: true, timeout: 2e3 }).catch(() => {
+        await submitButton.click({ timeout: 2e3 }).catch(() => {
         });
+        submitted = true;
       }
     } catch {
     }
-    const passInput = page.locator(passwordSelector).first();
-    await passInput.press("Enter", { timeout: 2e3 }).catch(() => {
-    });
+    if (!submitted) {
+      await page.evaluate(() => {
+        try {
+          const btn = document.querySelector(
+            'button.qwenchat-auth-pc-submit-button, button[type="submit"]'
+          );
+          if (btn) {
+            btn.removeAttribute("disabled");
+            btn.classList.remove("ant-btn-disabled");
+            btn.click();
+          }
+        } catch {
+        }
+      }).catch(() => {
+      });
+      const passInput = page.locator(passwordSelector).first();
+      await passInput.press("Enter", { timeout: 2e3 }).catch(() => {
+      });
+    }
     const postSubmitDeadline = Date.now() + 15e3;
     while (Date.now() < postSubmitDeadline) {
       if (page.isClosed()) break;
@@ -4671,9 +4743,12 @@ async function loginViaUi(page, email, password) {
         ".ant-form-item-explain-error",
         ".ant-message-error",
         ".ant-message-notice",
+        ".ant-message-custom-content",
+        ".ant-notification-notice",
         '[role="alert"]',
         ".qwenchat-auth-error",
-        ".auth-error-message"
+        ".auth-error-message",
+        ".qwenchat-toast"
       ].join(", ");
       const errorEl = page.locator(errorSelector).first();
       if (await errorEl.isVisible().catch(() => false)) {
@@ -4687,7 +4762,15 @@ async function loginViaUi(page, email, password) {
           };
         }
       }
-      const codeSelector = 'input[placeholder*="code" i], input[placeholder*="c\xF3digo" i], input[name*="code" i]';
+      const codeSelector = [
+        'input[placeholder*="code" i]',
+        'input[placeholder*="c\xF3digo" i]',
+        'input[name*="code" i]',
+        ".qwenchat-verification-code-input",
+        ".qwenchat-verification-code-input-cell",
+        '[aria-label*="Verification code" i]',
+        '[aria-label*="c\xF3digo de verifica\xE7\xE3o" i]'
+      ].join(", ");
       const codeInput = page.locator(codeSelector).first();
       if (await codeInput.isVisible().catch(() => false)) {
         return {
@@ -4697,16 +4780,44 @@ async function loginViaUi(page, email, password) {
       }
       try {
         const liveCookies = await page.context().cookies();
-        if (liveCookies.some((c) => c.name === "token")) {
-          return { success: true };
+        const rTokCookie = liveCookies.find((c) => c.name === "refresh_token")?.value;
+        const tokCookie = liveCookies.find((c) => c.name === "token")?.value;
+        if (tokCookie) {
+          return { success: true, token: tokCookie, refreshToken: rTokCookie };
         }
-      } catch {
-      }
-      const currentUrl = page.url();
-      if (!currentUrl.includes("/auth") && !currentUrl.includes("/login")) {
-        if (await isPageLoggedIn(page, 3e3)) {
-          return { success: true };
+        const currentUrl = page.url();
+        if (!currentUrl.includes("/auth") && !currentUrl.includes("/login")) {
+          const lsTok = await page.evaluate(() => {
+            const t = (localStorage.getItem("token") || "").trim();
+            if (t) {
+              try {
+                document.cookie = `token=${encodeURIComponent(t)}; path=/; domain=.qwen.ai; max-age=31536000`;
+              } catch {
+              }
+            }
+            return t;
+          }).catch(() => "");
+          if (lsTok) {
+            await page.context().addCookies([
+              {
+                name: "token",
+                value: lsTok,
+                domain: ".qwen.ai",
+                path: "/",
+                expires: Math.floor(Date.now() / 1e3) + 31536e3,
+                httpOnly: false,
+                secure: true,
+                sameSite: "Lax"
+              }
+            ]).catch(() => {
+            });
+            return { success: true, token: lsTok, refreshToken: rTokCookie };
+          }
+          if (await isPageLoggedIn(page, 3e3)) {
+            return { success: true, refreshToken: rTokCookie };
+          }
         }
+      } catch {
       }
       await sleep2(1e3);
     }
@@ -4736,10 +4847,18 @@ async function refreshAccountToken(accountId) {
     } catch {
     }
   }
+  if (!refreshToken) {
+    try {
+      const liveCookies = await page.context().cookies();
+      refreshToken = liveCookies.find((c) => c.name === "refresh_token")?.value;
+    } catch {
+    }
+  }
   if (refreshToken) {
     try {
+      const webVersion = getQwenWebVersion() || "0.3.26";
       const refreshResult = await page.evaluate(
-        async ({ rTok, tz }) => {
+        async ({ rTok, tz, version }) => {
           try {
             const response = await fetch("https://auth.qwen.ai/api/v2/auths/refresh", {
               method: "GET",
@@ -4747,7 +4866,7 @@ async function refreshAccountToken(accountId) {
               headers: {
                 accept: "application/json, text/plain, */*",
                 source: "web",
-                version: "0.3.11",
+                version,
                 "x-request-origin": "https://chat.qwen.ai",
                 timezone: tz,
                 authorization: `Bearer ${rTok}`
@@ -4759,7 +4878,7 @@ async function refreshAccountToken(accountId) {
             return { ok: false, error: e.message };
           }
         },
-        { rTok: refreshToken, tz: formatAsciiTimezone() }
+        { rTok: refreshToken, tz: formatAsciiTimezone(), version: webVersion }
       );
       const json = refreshResult?.data;
       if (json && json.success === true && json.data) {

package/dist/sync-clients.js

@@ -119,7 +119,7 @@ var envSchema = z.object({
   // Version header on Qwen API requests = the deployed web bundle version
   // (fallback when dynamic DOM detection is not yet completed).
   // Override via env when Qwen ships a new bundle.
-  QWEN_WEB_VERSION: z.string().default("0.2.91"),
+  QWEN_WEB_VERSION: z.string().default("0.3.26"),
   // Controls bx-ua/bx-umidtoken injection on the GENERAL API paths
   // (chats/new, settings): those work without them (live-probed). The
   // completions path is the exception — the 0.2.86 HAR shows the real

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "qwenproxy-cli",
-  "version": "1.6.8",
+  "version": "1.6.10",
   "description": "High-performance OpenAI & Anthropic compatible API gateway for Qwen with multi-account rotation, interactive TUI, and resilient tool calling.",
   "main": "src/index.ts",
   "bin": {

package/src/core/config.ts

@@ -34,7 +34,7 @@ const envSchema = z
     // Version header on Qwen API requests = the deployed web bundle version
     // (fallback when dynamic DOM detection is not yet completed).
     // Override via env when Qwen ships a new bundle.
-    QWEN_WEB_VERSION: z.string().default("0.2.91"),
+    QWEN_WEB_VERSION: z.string().default("0.3.26"),
     // Controls bx-ua/bx-umidtoken injection on the GENERAL API paths
     // (chats/new, settings): those work without them (live-probed). The
     // completions path is the exception — the 0.2.86 HAR shows the real

package/src/core/version.ts

@@ -17,6 +17,6 @@ export function getAppVersion(): string {
       }
     }
   } catch {}
-  cachedVersion = "v1.6.8";
+  cachedVersion = "v1.6.10";
   return cachedVersion;
 }

package/src/services/auth-playwright.ts

@@ -84,7 +84,7 @@ export async function getBasicHeaders(accountId?: string): Promise<{
       secChUa: "",
       secChUaMobile: "?0",
       secChUaPlatform: "",
-      version: "0.2.89",
+      version: "0.3.26",
     };
   }