qwenproxy-cli 1.6.9 → 1.6.11

package/src/services/chat-cleanup.ts

@@ -79,7 +79,15 @@ export async function deleteChatsForAccountId(accountId: string): Promise<boolea
   if (!credentials) {
     throw new Error(`Credenciais da conta ${account.email} não encontradas.`);
   }
-  return deleteChatsForAccount(credentials);
+  const wasInitialized = isPlaywrightInitialized(account.id);
+  try {
+    return await deleteChatsForAccount(credentials);
+  } finally {
+    if (!wasInitialized && !isAuthMockEnabled()) {
+      const { closePlaywrightForAccount } = await import("./playwright.ts");
+      await closePlaywrightForAccount(account.id).catch(() => {});
+    }
+  }
 }
 
 export async function deleteChatsForConfiguredAccounts(keepBrowserOpen = false): Promise<DeleteChatsResult> {
@@ -100,6 +108,7 @@ export async function deleteChatsForConfiguredAccounts(keepBrowserOpen = false):
       const account = accounts[i];
       const currentIdx = i + 1;
       const totalCount = accounts.length;
+      const wasInitialized = isPlaywrightInitialized(account.id);
       try {
         const ok = await deleteChatsForAccount(account, currentIdx, totalCount);
         if (ok) succeeded++;
@@ -109,7 +118,7 @@ export async function deleteChatsForConfiguredAccounts(keepBrowserOpen = false):
           error instanceof Error ? error.message : String(error),
         );
       } finally {
-        if (!keepBrowserOpen) {
+        if ((!keepBrowserOpen || !wasInitialized) && !isAuthMockEnabled()) {
           const { closePlaywrightForAccount } = await import("./playwright.ts");
           await closePlaywrightForAccount(account.id).catch(() => {});
         }

package/src/services/playwright.ts

@@ -68,6 +68,7 @@ import {
   unmarkAccountHeadersReady,
   isAccountHeadersReady,
   markAccountRateLimited,
+  getAccountCooldownInfo,
 } from "../core/account-manager.ts";
 import { getAccountsByPriority } from "../core/account-priority.ts";
 import {
@@ -365,7 +366,24 @@ export async function isPageLoggedIn(
             return false;
           }
 
-          const res = await fetch("/api/v1/auths/", { method: "GET" });
+          // In Qwen Web 0.3.26+, UI login stores the JWT in localStorage("token")
+          // without setting a "token=" cookie in document.cookie. Sync it so
+          // same-origin probes and context.cookies() always include it.
+          const lsToken = (localStorage.getItem("token") || "").trim();
+          if (lsToken && !/(?:^|;\s*)token=/.test(document.cookie || "")) {
+            try {
+              document.cookie = `token=${encodeURIComponent(lsToken)}; path=/; domain=.qwen.ai; max-age=31536000`;
+            } catch {}
+          }
+          const authHeaders: Record<string, string> = lsToken
+            ? { Authorization: `Bearer ${lsToken}` }
+            : {};
+
+          const res = await fetch("/api/v1/auths/", {
+            method: "GET",
+            headers: authHeaders,
+            credentials: "include",
+          });
           if (res.status !== 200) return false;
           const json: any = await res.json().catch(() => null);
           if (!json) return false;
@@ -398,6 +416,7 @@ export async function isPageLoggedIn(
           try {
             const settingsRes = await fetch("/api/v2/users/user/settings", {
               method: "GET",
+              headers: authHeaders,
               credentials: "include",
               signal: AbortSignal.timeout(3000),
             });
@@ -1390,18 +1409,19 @@ export async function getBasicHeaders(accountId: string): Promise<{
     } else if (
       hadUsableHeaders &&
       headersAge > HEADER_CACHE_TTL * HEADER_REFRESH_THRESHOLD &&
-      !cache.refreshInProgress
+      !cache.refreshInProgress &&
+      // Header capture types into the chat input and sends a probe message on
+      // the account's page. Doing that while the account is serving a stream
+      // would mutate the live conversation (and can navigate the SPA), so the
+      // proactive refresh waits until the account has no active lease.
+      !hasActiveAccountLease(accountId)
     ) {
       // Background refresh at 70% TTL: keep headers fresh without blocking
-      cache.refreshInProgress = true;
       refreshHeadersInternal(accountId)
         .catch((error) => {
           console.warn(
             `⚠️  [Playwright] Background header refresh failed for ${accountId}: ${getErrorMessage(error)}`,
           );
-        })
-        .finally(() => {
-          cache.refreshInProgress = false;
         });
     }
 
@@ -1551,8 +1571,13 @@ export async function initPlaywrightForAccount(
         return;
       }
 
-    // If a context limit is configured, make room by closing idle contexts.
-    await evictIdlePlaywrightContextsToLimit().catch(() => {});
+    // If a context limit is configured, make room BEFORE launching by evicting down to (max - 1)
+    // so the new context brings total active contexts to at most max.
+    if (config.playwright.maxActiveContexts > 0) {
+      await evictIdlePlaywrightContextsToLimit(
+        Math.max(1, config.playwright.maxActiveContexts - 1),
+      ).catch(() => {});
+    }
 
     const profilePath = getAccountProfilePath(account.id);
     const fingerprint = getFingerprintProfile(account.id);
@@ -1819,8 +1844,15 @@ export async function initPlaywrightForAccount(
           c.name.toLowerCase().includes("session"),
       );
 
+      let initialLoginAttempted = false;
       if (!hasAuthCookie && account.email && account.password) {
-        await loginToQwen(account.id, account.email, account.password);
+        initialLoginAttempted = true;
+        const loggedIn = await loginToQwen(account.id, account.email, account.password);
+        if (!loggedIn) {
+          throw new Error(
+            `Authentication failed for account ${maskEmail(account.email)}`,
+          );
+        }
       }
 
       // Initial navigation to chat home
@@ -1832,13 +1864,21 @@ export async function initPlaywrightForAccount(
         await sleep(1500);
         const currentUrl = acctPage.url();
         const isAuthUrl = currentUrl.includes("/auth") || currentUrl.includes("/login");
-        if (isAuthUrl && account.email && account.password) {
+        if (isAuthUrl && !initialLoginAttempted && account.email && account.password) {
           console.log(
             `[Playwright] Initial login needed for ${maskEmail(account.email)}, authenticating...`,
           );
-          await loginToQwen(account.id, account.email, account.password);
+          const loggedIn = await loginToQwen(account.id, account.email, account.password);
+          if (!loggedIn) {
+            throw new Error(
+              `Authentication failed for account ${maskEmail(account.email)}`,
+            );
+          }
         }
       } catch (err: any) {
+        if (err?.message?.includes("Authentication failed for account")) {
+          throw err;
+        }
         console.warn(
           `⚠️  [Playwright] Initial navigation check for ${maskEmail(account.email)}: ${err.message}`,
         );
@@ -1849,12 +1889,17 @@ export async function initPlaywrightForAccount(
         await captureQwenHeaders(account.id);
       }
 
-      // Header capture may leave the UI on a generated chat page. Return the
-      // primary tab to the canonical chat home.
+      // Header capture may leave the UI on a punish or auth page. Return the
+      // primary tab to the canonical chat home only when not already on a clean Qwen page.
       if (!acctPage.isClosed()) {
         try {
           const currentUrl = new URL(acctPage.url());
-          if (currentUrl.origin !== qwenOrigin() || currentUrl.pathname !== "/") {
+          if (
+            currentUrl.origin !== qwenOrigin() ||
+            currentUrl.pathname.includes("/auth") ||
+            currentUrl.pathname.includes("/login") ||
+            currentUrl.pathname.includes("_____tmd_____")
+          ) {
             await acctPage.goto(qwenUrl("/"), {
               waitUntil: "domcontentloaded",
               timeout: config.timeouts.navigation,
@@ -1874,6 +1919,7 @@ export async function initPlaywrightForAccount(
     } finally {
       release();
     }
+    await evictIdlePlaywrightContextsToLimit().catch(() => {});
   })();
 
   try {
@@ -2551,10 +2597,31 @@ async function loginToQwen(
     const uiResult = await loginViaUi(page, email, password);
     if (uiResult.success) {
       cookieCaches.delete(accountId);
-      await saveStorageState(page.context(), accountId);
       try {
-        const liveCookies = await page.context().cookies();
-        const tokenCookie = liveCookies.find((c) => c.name === "token");
+        let liveCookies = await page.context().cookies();
+        let tokenCookie = liveCookies.find((c) => c.name === "token");
+        if (!tokenCookie) {
+          const lsTok =
+            uiResult.token ||
+            (await page.evaluate(() => (localStorage.getItem("token") || "").trim()).catch(() => ""));
+          if (lsTok) {
+            await page.context().addCookies([
+              {
+                name: "token",
+                value: lsTok,
+                domain: ".qwen.ai",
+                path: "/",
+                expires: Math.floor(Date.now() / 1000) + 31536000,
+                httpOnly: false,
+                secure: true,
+                sameSite: "Lax",
+              },
+            ]).catch(() => {});
+            liveCookies = await page.context().cookies();
+            tokenCookie = liveCookies.find((c) => c.name === "token");
+          }
+        }
+        await saveStorageState(page.context(), accountId);
         if (tokenCookie) {
           const cookieStr = liveCookies.map((c) => `${c.name}=${c.value}`).join("; ");
           const cache = getHeaderCache(accountId);
@@ -2563,7 +2630,9 @@ async function loginToQwen(
           markAccountHeadersReady(accountId);
           const { saveAuthSession } = await import("../core/database.ts");
           const exp = parseJwtExpiry(tokenCookie.value);
-          let rTok = uiResult.refreshToken;
+          let rTok =
+            uiResult.refreshToken ||
+            liveCookies.find((c) => c.name === "refresh_token")?.value;
           if (!rTok) {
             try {
               rTok = (await page.evaluate(() => localStorage.getItem("refresh_token") || "")) || undefined;
@@ -2657,10 +2726,11 @@ async function loginViaApi(
 
     const signinUrl = "https://auth.qwen.ai/api/v2/auths/signin";
     const requestId = crypto.randomUUID();
+    const webVersion = getQwenWebVersion() || "0.3.26";
 
     const evalRes = await page
       .evaluate(
-        async ({ email, password, signinUrl, requestId, tz }) => {
+        async ({ email, password, signinUrl, requestId, tz, version }) => {
           try {
             const response = await fetch(signinUrl, {
               method: "POST",
@@ -2670,7 +2740,7 @@ async function loginViaApi(
                 accept: "application/json, text/plain, */*",
                 "content-type": "application/json",
                 source: "web",
-                version: getQwenWebVersion() || "0.3.26",
+                version,
                 "x-request-origin": "https://chat.qwen.ai",
                 timezone: tz,
                 "x-request-id": requestId,
@@ -2683,7 +2753,14 @@ async function loginViaApi(
             return { ok: false, error: e.message };
           }
         },
-        { email, password: hashedPassword, signinUrl, requestId, tz: formatAsciiTimezone() },
+        {
+          email,
+          password: hashedPassword,
+          signinUrl,
+          requestId,
+          tz: formatAsciiTimezone(),
+          version: webVersion,
+        },
       )
       .catch(() => null);
 
@@ -2701,7 +2778,7 @@ async function loginViaApi(
       const fallbackUrl = qwenUrl("/api/v2/auths/signin");
       const fallbackRes = await page
         .evaluate(
-          async ({ email, password, fallbackUrl, requestId, tz }) => {
+          async ({ email, password, fallbackUrl, requestId, tz, version }) => {
             try {
               const response = await fetch(fallbackUrl, {
                 method: "POST",
@@ -2711,7 +2788,7 @@ async function loginViaApi(
                   accept: "application/json, text/plain, */*",
                   "content-type": "application/json",
                   source: "web",
-                  version: getQwenWebVersion() || "0.3.26",
+                  version,
                   timezone: tz,
                   "x-request-id": requestId,
                 },
@@ -2723,7 +2800,14 @@ async function loginViaApi(
               return { ok: false, error: e.message };
             }
           },
-          { email, password: hashedPassword, fallbackUrl, requestId, tz: formatAsciiTimezone() },
+          {
+            email,
+            password: hashedPassword,
+            fallbackUrl,
+            requestId,
+            tz: formatAsciiTimezone(),
+            version: webVersion,
+          },
         )
         .catch(() => null);
 
@@ -3009,30 +3093,37 @@ async function loginViaUi(
 
     await sleep(500);
 
-    // Multi-modal submit: DOM click, Playwright force click, and Enter press
+    // Submit the form: click the submit button if visible; only press Enter as fallback
+    // (pressing Enter inside <form> after clicking submit triggers a native HTML form reload on Qwen 0.3.26).
     const submitSelector =
       'button.qwenchat-auth-pc-submit-button, button[type="submit"], button:has-text("Log in"), button:has-text("Sign in"), button:has-text("Fazer login"), button:has-text("Entrar"), button:has-text("Iniciar sesión"), button:has-text("登录")';
     const submitButton = page.locator(submitSelector).first();
 
-    await page.evaluate((sel) => {
-      try {
-        const btn = document.querySelector(sel) as HTMLButtonElement | null;
-        if (btn) {
-          btn.removeAttribute("disabled");
-          btn.classList.remove("ant-btn-disabled");
-          btn.click();
-        }
-      } catch {}
-    }, submitSelector).catch(() => {});
-
+    let submitted = false;
     try {
       if (await submitButton.isVisible({ timeout: 2000 }).catch(() => false)) {
-        await submitButton.click({ force: true, timeout: 2000 }).catch(() => {});
+        await submitButton.click({ timeout: 2000 }).catch(() => {});
+        submitted = true;
       }
     } catch {}
 
-    const passInput = page.locator(passwordSelector).first();
-    await passInput.press("Enter", { timeout: 2000 }).catch(() => {});
+    if (!submitted) {
+      await page.evaluate(() => {
+        try {
+          const btn = document.querySelector(
+            'button.qwenchat-auth-pc-submit-button, button[type="submit"]',
+          ) as HTMLButtonElement | null;
+          if (btn) {
+            btn.removeAttribute("disabled");
+            btn.classList.remove("ant-btn-disabled");
+            btn.click();
+          }
+        } catch {}
+      }).catch(() => {});
+
+      const passInput = page.locator(passwordSelector).first();
+      await passInput.press("Enter", { timeout: 2000 }).catch(() => {});
+    }
     // Post-submit verification loop: wait up to 15s for captcha, redirect, cookies, or errors
     const postSubmitDeadline = Date.now() + 15_000;
     while (Date.now() < postSubmitDeadline) {
@@ -3054,9 +3145,12 @@ async function loginViaUi(
         ".ant-form-item-explain-error",
         ".ant-message-error",
         ".ant-message-notice",
+        ".ant-message-custom-content",
+        ".ant-notification-notice",
         '[role="alert"]',
         ".qwenchat-auth-error",
         ".auth-error-message",
+        ".qwenchat-toast",
       ].join(", ");
       const errorEl = page.locator(errorSelector).first();
       if (await errorEl.isVisible().catch(() => false)) {
@@ -3072,8 +3166,15 @@ async function loginViaUi(
       }
 
       // Check if an OTP code verification screen appeared (e.g. 2FA / email verification code)
-      const codeSelector =
-        'input[placeholder*="code" i], input[placeholder*="código" i], input[name*="code" i]';
+      const codeSelector = [
+        'input[placeholder*="code" i]',
+        'input[placeholder*="código" i]',
+        'input[name*="code" i]',
+        ".qwenchat-verification-code-input",
+        ".qwenchat-verification-code-input-cell",
+        '[aria-label*="Verification code" i]',
+        '[aria-label*="código de verificação" i]',
+      ].join(", ");
       const codeInput = page.locator(codeSelector).first();
       if (await codeInput.isVisible().catch(() => false)) {
         return {
@@ -3082,21 +3183,50 @@ async function loginViaUi(
         };
       }
 
-      // Check if auth cookie 'token' appeared
+      // Check if auth cookie 'token' appeared or localStorage 'token' was populated (Qwen 0.3.26+)
       try {
         const liveCookies = await page.context().cookies();
-        if (liveCookies.some((c) => c.name === "token")) {
-          return { success: true };
+        const rTokCookie = liveCookies.find((c) => c.name === "refresh_token")?.value;
+        const tokCookie = liveCookies.find((c) => c.name === "token")?.value;
+        if (tokCookie) {
+          return { success: true, token: tokCookie, refreshToken: rTokCookie };
         }
-      } catch {}
-
-      // Check if page redirected away from /auth and is logged in
-      const currentUrl = page.url();
-      if (!currentUrl.includes("/auth") && !currentUrl.includes("/login")) {
-        if (await isPageLoggedIn(page, 3000)) {
-          return { success: true };
+        const currentUrl = page.url();
+        if (!currentUrl.includes("/auth") && !currentUrl.includes("/login")) {
+          const lsTok = await page
+            .evaluate(() => {
+              const t = (localStorage.getItem("token") || "").trim();
+              if (t) {
+                try {
+                  document.cookie = `token=${encodeURIComponent(t)}; path=/; domain=.qwen.ai; max-age=31536000`;
+                } catch {}
+              }
+              return t;
+            })
+            .catch(() => "");
+          if (lsTok) {
+            await page
+              .context()
+              .addCookies([
+                {
+                  name: "token",
+                  value: lsTok,
+                  domain: ".qwen.ai",
+                  path: "/",
+                  expires: Math.floor(Date.now() / 1000) + 31536000,
+                  httpOnly: false,
+                  secure: true,
+                  sameSite: "Lax",
+                },
+              ])
+              .catch(() => {});
+            return { success: true, token: lsTok, refreshToken: rTokCookie };
+          }
+          if (await isPageLoggedIn(page, 3000)) {
+            return { success: true, refreshToken: rTokCookie };
+          }
         }
-      }
+      } catch {}
 
       await sleep(1000);
     }
@@ -3128,7 +3258,7 @@ export async function refreshAccountToken(
     return { success: false, error: "Account page not active" };
   }
 
-  // 1. Get refresh token from SQLite session or localStorage
+  // 1. Get refresh token from SQLite session, localStorage, or browser cookies (Qwen 0.3.26+)
   const { getValidAuthSession, saveAuthSession } = await import("../core/database.ts");
   const session = getValidAuthSession(accountId);
   let refreshToken = session?.refreshToken;
@@ -3141,11 +3271,19 @@ export async function refreshAccountToken(
     } catch {}
   }
 
+  if (!refreshToken) {
+    try {
+      const liveCookies = await page.context().cookies();
+      refreshToken = liveCookies.find((c) => c.name === "refresh_token")?.value;
+    } catch {}
+  }
+
   // 2. If we have a refresh token, invoke the working refresh endpoint in-page
   if (refreshToken) {
     try {
+      const webVersion = getQwenWebVersion() || "0.3.26";
       const refreshResult = await page.evaluate(
-        async ({ rTok, tz }) => {
+        async ({ rTok, tz, version }) => {
           try {
             const response = await fetch("https://auth.qwen.ai/api/v2/auths/refresh", {
               method: "GET",
@@ -3153,7 +3291,7 @@ export async function refreshAccountToken(
               headers: {
                 accept: "application/json, text/plain, */*",
                 source: "web",
-                version: getQwenWebVersion() || "0.3.26",
+                version,
                 "x-request-origin": "https://chat.qwen.ai",
                 timezone: tz,
                 authorization: `Bearer ${rTok}`,
@@ -3165,7 +3303,7 @@ export async function refreshAccountToken(
             return { ok: false, error: e.message };
           }
         },
-        { rTok: refreshToken, tz: formatAsciiTimezone() },
+        { rTok: refreshToken, tz: formatAsciiTimezone(), version: webVersion },
       );
 
       const json = refreshResult?.data;
@@ -4046,19 +4184,32 @@ async function refreshHeadersInternal(
         await executeReauth();
       } else {
         try {
-          await page.goto(qwenUrl("/"), {
-            waitUntil: "domcontentloaded",
-            timeout: Math.min(
-              config.timeouts.navigation,
-              boundedTimeoutMs,
-              SESSION_PROBE_NAVIGATION_TIMEOUT_MS,
-            ),
-          });
-          await sleep(2000);
-          const url = page.url();
+          const currentUrl = typeof page.url === "function" ? page.url() : "";
+          const needsNavigation =
+            !currentUrl.startsWith(qwenOrigin()) ||
+            currentUrl.includes("/auth") ||
+            currentUrl.includes("/login") ||
+            currentUrl.includes("_____tmd_____");
+
+          if (needsNavigation) {
+            await page.goto(qwenUrl("/"), {
+              waitUntil: "domcontentloaded",
+              timeout: Math.min(
+                config.timeouts.navigation,
+                boundedTimeoutMs,
+                SESSION_PROBE_NAVIGATION_TIMEOUT_MS,
+              ),
+            });
+            await sleep(2000);
+          }
+
+          const url = typeof page.url === "function" ? page.url() : "";
           const isAuthUrl = url.includes("auth") || url.includes("login");
           if (isAuthUrl) {
-            await executeReauth();
+            const refreshed = await refreshAccountToken(accountId);
+            if (!refreshed.success) {
+              await executeReauth();
+            }
           }
         } catch (navErr) {
           console.warn(
@@ -4118,12 +4269,18 @@ async function refreshHeadersInternal(
 
     await captureQwenHeaders(accountId, undefined, boundedTimeoutMs);
 
-    // Best-effort restore: header capture can leave the tab on a chat page.
+    // Best-effort restore: if header capture left the tab on a punish/auth URL,
+    // return to the canonical chat home without reloading an already-clean Qwen page.
     const capturedPage = accountPages.get(accountId);
     if (capturedPage && !capturedPage.isClosed()) {
       try {
         const currentUrl = new URL(capturedPage.url());
-        if (currentUrl.origin !== qwenOrigin() || currentUrl.pathname !== "/") {
+        if (
+          currentUrl.origin !== qwenOrigin() ||
+          currentUrl.pathname.includes("/auth") ||
+          currentUrl.pathname.includes("/login") ||
+          currentUrl.pathname.includes("_____tmd_____")
+        ) {
           await capturedPage.goto(qwenUrl("/"), {
             waitUntil: "domcontentloaded",
             timeout: Math.min(config.timeouts.navigation, boundedTimeoutMs),
@@ -4568,7 +4725,13 @@ function priorityOrderForEviction(accountIds: string[]): string[] {
   const ranked = getAccountsByPriority(accountIds.map((id) => ({ id })));
   const rank = new Map<string, number>();
   for (const [index, account] of ranked.entries()) {
-    rank.set(account.id, index);
+    // Accounts currently on cooldown (RateLimited / MembershipLimit / WafChallenge)
+    // cannot serve traffic and must be evicted before any healthy warm account.
+    if (getAccountCooldownInfo(account.id)) {
+      rank.set(account.id, Number.MAX_SAFE_INTEGER);
+    } else {
+      rank.set(account.id, index);
+    }
   }
   return orderContextsForEviction(
     accountIds,
@@ -4625,15 +4788,21 @@ export async function closeIdlePlaywrightAccounts(
  * PLAYWRIGHT_MAX_ACTIVE_CONTEXTS. Never closes a context whose account mutex
  * is busy, so active streams are preserved.
  */
-export async function evictIdlePlaywrightContextsToLimit(): Promise<number> {
-  const max = config.playwright.maxActiveContexts;
-  if (max <= 0) return 0;
+export async function evictIdlePlaywrightContextsToLimit(
+  targetLimit?: number,
+): Promise<number> {
+  const configuredMax = config.playwright.maxActiveContexts;
+  if (configuredMax <= 0) return 0;
+  const max = targetLimit !== undefined ? Math.max(0, targetLimit) : configuredMax;
   if (accountPages.size <= max) return 0;
 
   const candidates = priorityOrderForEviction(
     Array.from(accountPages.keys()).filter((accountId) => {
       if (isAccountServingStream(accountId)) return false;
-      if (isAccountRecentlyActive(accountId, 30_000)) return false;
+      // A request may hold a stream lease while still acquiring the page mutex
+      // (pre-stream setup). Closing that context would fail the request even
+      // though the mutex still looks idle, so treat any lease as "in use".
+      if (hasActiveAccountLease(accountId)) return false;
       const mutex = accountMutexes.get(accountId);
       return mutex?.isIdle();
     }),
@@ -4647,6 +4816,7 @@ export async function evictIdlePlaywrightContextsToLimit(): Promise<number> {
   for (const candidate of candidates) {
     if (accountPages.size <= max) break;
     if (isAccountServingStream(candidate.accountId)) continue;
+    if (hasActiveAccountLease(candidate.accountId)) continue;
     const mutex = accountMutexes.get(candidate.accountId);
     if (!mutex?.isIdle()) continue;
 

package/src/services/qwen.ts

@@ -129,6 +129,20 @@ const browserStreamStates = new Map<string, BrowserStreamState>();
 const browserStreamBindingPages = new WeakSet<object>();
 const browserStreamBindingContexts = new WeakSet<object>();
 
+/**
+ * Whether the account currently has an in-flight browser stream. Captcha
+ * recovery uses this to avoid navigating the page that is feeding a live
+ * stream (it opens an ephemeral tab instead).
+ */
+export function hasActiveBrowserStreamsForAccount(accountId: string): boolean {
+  for (const state of browserStreamStates.values()) {
+    if (state.accountId === accountId && !state.done) {
+      return true;
+    }
+  }
+  return false;
+}
+
 /**
  * Abort all active browser streams for an account immediately.
  * Called when an account page is navigated by captcha recovery, closed, or reset,
@@ -1364,12 +1378,22 @@ async function createQwenBrowserResponse(
         await ensureBrowserStreamBinding(page);
         if (typeof (page as any).on === "function") {
           const onFrameNavigated = (frame: any) => {
-            if (!settled && typeof (page as any).mainFrame === "function" && frame === (page as any).mainFrame()) {
-              const url = typeof frame.url === "function" ? frame.url() : String(frame.url || "");
-              // Safe SPA in-app routing within Qwen Web (e.g. /c/<id>, /#) must NEVER abort active streams
+            if (
+              !settled &&
+              typeof (page as any).mainFrame === "function" &&
+              frame === (page as any).mainFrame()
+            ) {
+              const url =
+                typeof frame.url === "function"
+                  ? frame.url()
+                  : String(frame.url || "");
+              // Same-origin SPA routing within Qwen Web (e.g. /c/<id>, /#) keeps
+              // the live DOM and MUST NOT abort the stream. Only a genuine
+              // unload (auth, Baxia punish, or another origin) kills the fetch.
               if (
                 url.startsWith(qwenOrigin()) &&
                 !url.includes("/auth") &&
+                !url.includes("/login") &&
                 !url.includes("_____tmd_____") &&
                 !url.includes("/punish")
               ) {
@@ -1393,10 +1417,12 @@ async function createQwenBrowserResponse(
           };
           (page as any).on("framenavigated", onFrameNavigated);
           (page as any).on("close", onPageClosed);
+          (page as any).on("crash", onPageClosed);
           pageCleanup = () => {
             try {
               (page as any).off?.("framenavigated", onFrameNavigated);
               (page as any).off?.("close", onPageClosed);
+              (page as any).off?.("crash", onPageClosed);
             } catch {}
           };
         }