@cartanova/qgrid-cli 2.0.3 → 2.1.1

package/bundle/src/application/qgrid/qgrid.frame.ts

@@ -72,6 +72,14 @@ async function deleteOAuthState(state: string): Promise<void> {
   await cache.delete({ key: `${OAUTH_STATE_PREFIX}${state}` });
 }
 
+function getOAuthRedirectUri(): string {
+  const publicBaseUrl = process.env.QGRID_PUBLIC_BASE_URL?.replace(/\/+$/, "");
+  if (publicBaseUrl) return `${publicBaseUrl}/callback`;
+
+  const serverPort = process.env.PORT ?? "44900";
+  return `http://localhost:${serverPort}/callback`;
+}
+
 const logger = getLogger(["qgrid"]);
 const oauthLogger = getLogger(["qgrid", "oauth"]);
 
@@ -101,37 +109,50 @@ class QgridFrameClass extends BaseFrameClass {
     const result = await QgridDispatcher.query(args, args.timeout);
 
     if (effectiveLogMode === "auto") {
-      const toolCallCount = result.content.filter((item) => item.type === "tool-call").length;
-      const responseText = result.content
-        .filter((item) => item.type === "text")
-        .map((item) => item.text)
-        .join("\n");
-
-      RequestLogModel.save([
-        {
-          token_name: result.tokenName,
-          project_name: args.projectName?.length ? args.projectName : null,
-          model_name: result.model ?? null,
-          user_prompt: args.prompt,
-          system_prompt: args.system ?? null,
-          response: responseText,
-          input_tokens: result.usage.input_tokens,
-          output_tokens: result.usage.output_tokens,
-          cache_read_tokens: result.usage.cache_read_input_tokens,
-          cache_creation_tokens: result.usage.cache_creation_input_tokens,
-          duration_ms: result.durationMs,
-          cost_usd: result.costUsd !== null ? Math.round(result.costUsd * MICRO_USD) : null,
-          effort: args.effort ?? null,
-          history: args.history ? JSON.parse(args.history) : null,
-          status: "succeeded",
-          tool_call_count: toolCallCount,
-        },
-      ]).catch((e) => logger.error(`requestLog save failed: ${(e as Error).message}`));
+      this.saveAutoRequestLog(args, result);
     }
 
     return result;
   }
 
+  // logMode "auto" 단일 요청 로깅: run lifecycle(step 분해) 없이 request_log 1건만 남긴다.
+  // query와 queryStream 양쪽에서 사용.
+  private saveAutoRequestLog(args: QueryInput, result: QueryOutput): void {
+    const toolCallCount = result.content.filter((item) => item.type === "tool-call").length;
+    const responseText = result.content
+      .filter((item) => item.type === "text")
+      .map((item) => item.text)
+      .join("\n");
+
+    RequestLogModel.save([
+      {
+        token_name: result.tokenName,
+        project_name: args.projectName?.length ? args.projectName : null,
+        model_name: result.model ?? null,
+        user_prompt: args.prompt,
+        system_prompt: args.system ?? null,
+        response: responseText,
+        input_tokens: result.usage.input_tokens,
+        output_tokens: result.usage.output_tokens,
+        cache_read_tokens: result.usage.cache_read_input_tokens,
+        cache_creation_tokens: result.usage.cache_creation_input_tokens,
+        duration_ms: result.durationMs,
+        cost_usd: result.costUsd !== null ? Math.round(result.costUsd * MICRO_USD) : null,
+        effort: args.effort ?? null,
+        // malformed history가 와도 성공한 턴(특히 stream sse.end())을 깨지 않도록 방어.
+        history: ((): { type: string }[] | null => {
+          try {
+            return args.history ? JSON.parse(args.history) : null;
+          } catch {
+            return null;
+          }
+        })(),
+        status: "succeeded",
+        tool_call_count: toolCallCount,
+      },
+    ]).catch((e) => logger.error(`requestLog save failed: ${(e as Error).message}`));
+  }
+
   @api({ httpMethod: "POST", clients: ["axios", "tanstack-mutation"] })
   async prepareStream(args: QueryInput): Promise<{ streamId: string }> {
     const streamId = crypto.randomUUID();
@@ -214,6 +235,9 @@ class QgridFrameClass extends BaseFrameClass {
         } catch (e) {
           logger.error(`stream afterQuery failed: ${(e as Error).message}`);
         }
+      } else if (effectiveLogMode === "auto") {
+        // run lifecycle을 안 타는 단일 stream 요청도 request_log 1건은 남긴다 (query와 대칭).
+        this.saveAutoRequestLog(args, streamResult);
       }
       if (!sse.closed) sse.publish("done", { ...streamResult, runContext });
     } else if (streamError) {
@@ -360,8 +384,7 @@ class QgridFrameClass extends BaseFrameClass {
   async oauthStart(name: string): Promise<OAuthStartResult> {
     const { codeVerifier, codeChallenge, state } = generatePKCE();
 
-    const serverPort = process.env.PORT ?? "44900";
-    const redirectUri = `http://localhost:${serverPort}/callback`;
+    const redirectUri = getOAuthRedirectUri();
     const authUrl = buildAuthUrl(codeChallenge, state, redirectUri);
 
     await setOAuthState(state, { codeVerifier, name, redirectUri });

package/bundle/src/application/request-log/request-log.model.ts

@@ -175,9 +175,7 @@ class RequestLogModelClass extends BaseModelClass<
       cache_creation_tokens: 0,
       duration_ms: 0,
       tool_call_count: 0,
-      ...(params.history !== undefined
-        ? { history: params.history as { type: string }[] }
-        : {}),
+      ...(params.history !== undefined ? { history: params.history as { type: string }[] } : {}),
     });
     return wdb.transaction(async (trx) => {
       const ids = await trx.ubUpsert("request_logs");

package/bundle/src/utils/providers/common/model-cost.ts

@@ -43,6 +43,7 @@ const ANTHROPIC_COSTS: Record<string, ModelCosts> = {
   "claude-opus-4-5": { inputTokens: 5, outputTokens: 25, cachedInputTokens: 0.5 },
   "claude-opus-4-6": { inputTokens: 5, outputTokens: 25, cachedInputTokens: 0.5 },
   "claude-opus-4-7": { inputTokens: 5, outputTokens: 25, cachedInputTokens: 0.5 },
+  "claude-opus-4-8": { inputTokens: 5, outputTokens: 25, cachedInputTokens: 0.5 },
 };
 
 const DEFAULT_COSTS: ModelCosts = { inputTokens: 3, outputTokens: 15, cachedInputTokens: 0.3 };

package/bundle/src/utils/providers/openai/codex-worker.test.ts

@@ -0,0 +1,72 @@
+import { describe, expect, it, vi } from "vitest";
+
+import { CodexAppServerWorker, type StreamCallbacks } from "./codex-worker";
+
+function createWorkerWithFakeRpc() {
+  const worker = new CodexAppServerWorker({
+    tokenId: 1,
+    tokenName: "token",
+    accessToken: "access",
+    accountId: "account",
+  });
+  const handlers = new Map<string, (params: never) => void>();
+  const rpc = {
+    onNotification(method: string, handler: (params: never) => void) {
+      handlers.set(method, handler);
+    },
+  };
+  (
+    worker as unknown as {
+      rpc: typeof rpc;
+    }
+  ).rpc = rpc;
+  return { worker, handlers };
+}
+
+describe("CodexAppServerWorker active turn cleanup", () => {
+  it("rejects a non-streaming turn when the worker process exits", async () => {
+    const { worker } = createWorkerWithFakeRpc();
+    const promise = (
+      worker as unknown as {
+        consumeTurnNotifications(threadId: string, model: string): Promise<unknown>;
+      }
+    ).consumeTurnNotifications("thread-1", "gpt-test");
+
+    (
+      worker as unknown as {
+        failActiveTurn(error: Error): void;
+      }
+    ).failActiveTurn(new Error("codex worker exited while turn was running"));
+
+    await expect(promise).rejects.toThrow("codex worker exited while turn was running");
+  });
+
+  it("notifies stream callbacks when the worker process exits", async () => {
+    const { worker } = createWorkerWithFakeRpc();
+    const callbacks: StreamCallbacks = {
+      onDelta: vi.fn(),
+      onComplete: vi.fn(),
+      onError: vi.fn(),
+    };
+    const promise = (
+      worker as unknown as {
+        consumeStreamNotifications(
+          threadId: string,
+          model: string,
+          cb: StreamCallbacks,
+        ): Promise<void>;
+      }
+    ).consumeStreamNotifications("thread-1", "gpt-test", callbacks);
+
+    (
+      worker as unknown as {
+        failActiveTurn(error: Error): void;
+      }
+    ).failActiveTurn(new Error("codex worker exited while turn was running"));
+
+    await expect(promise).rejects.toThrow("codex worker exited while turn was running");
+    expect(callbacks.onError).toHaveBeenCalledWith(
+      expect.objectContaining({ message: "codex worker exited while turn was running" }),
+    );
+  });
+});

package/bundle/src/utils/providers/openai/codex-worker.ts

@@ -1,5 +1,5 @@
 import { spawn, type ChildProcess } from "node:child_process";
-import { mkdirSync, readFileSync, rmSync } from "node:fs";
+import { mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 
 import { getLogger } from "@logtape/logtape";
 
@@ -54,6 +54,9 @@ export interface StreamCallbacks {
   onTurnId?: (turnId: string) => void;
 }
 
+type RefreshableWorkerCredentials = Pick<WorkerConfig, "accessToken" | "accountId" | "planType">;
+type ActiveTurnAbort = (error: Error) => void;
+
 // thread/start 공통 옵션
 const THREAD_DEFAULTS = {
   sandbox: "read-only",
@@ -68,6 +71,31 @@ const BASE_INSTRUCTIONS = {
   withSchema: "You are a helpful assistant. Respond using the provided output schema.",
 } as const;
 
+// codex가 매 요청에 자동 주입하는 내장 tool(shell/web_search/spawn_agent 등 14개)과
+// instruction 블록(permissions/environment_context/skills, ~10KB)을 비활성화
+// $CODEX_HOME/config.toml 로 써넣으면 codex 부팅 시 scan
+// 통제불가: update_plan/request_user_input
+const CODEX_CONFIG_TOML = `web_search = "disabled"
+include_permissions_instructions = false
+include_apps_instructions = false
+include_environment_context = false
+
+[features]
+shell_tool = false
+tool_search = false
+tool_suggest = false
+multi_agent = false
+image_generation = false
+apps = false
+plugins = false
+
+[tools]
+view_image = false
+
+[skills]
+include_instructions = false
+`;
+
 // ── Worker ──────────────────────────────────────────────────────────
 
 export class CodexAppServerWorker {
@@ -78,8 +106,11 @@ export class CodexAppServerWorker {
   private ready = false;
   private destroyed = false;
   private busy = false;
+  private activeTurnAbort?: ActiveTurnAbort;
   active = true;
   onReady?: () => void;
+  // restart 시 rpc 객체가 새로 생성되므로, 핸들러를 보관했다가 매 spawn마다 재바인딩한다.
+  serverRequestHandler?: (method: string, params: unknown) => Promise<unknown>;
 
   constructor(private config: WorkerConfig) {
     const suffix = config.workerIndex !== undefined ? `-${config.workerIndex}` : "";
@@ -91,15 +122,26 @@ export class CodexAppServerWorker {
   private async spawnAndInit(): Promise<void> {
     const cwd = `${this.codexHome}/cwd`;
     mkdirSync(cwd, { recursive: true });
+    // codex 내장 tool/web_search/instruction 블록 비활성화
+    writeFileSync(`${this.codexHome}/config.toml`, CODEX_CONFIG_TOML);
 
     this.proc = spawn("codex", ["app-server", "--listen", "stdio://"], {
       stdio: ["pipe", "pipe", "pipe"],
       cwd,
-      env: { PATH: process.env.PATH, TMPDIR: process.env.TMPDIR, CODEX_HOME: this.codexHome },
+      env: {
+        PATH: process.env.PATH,
+        TMPDIR: process.env.TMPDIR,
+        CODEX_HOME: this.codexHome,
+        // environment 비활성화 → has_environment=false → shell/apply_patch/view_image 제거
+        CODEX_EXEC_SERVER_URL: "none",
+      },
     });
 
     this.proc.on("exit", (code) => {
       logger.info(`worker ${this.config.tokenName} exited (code=${code})`);
+      this.failActiveTurn(
+        new Error(`codex worker exited while turn was running (code=${code ?? "unknown"})`),
+      );
       this.ready = false;
       this.rpc = null;
       this.proc = null;
@@ -107,6 +149,8 @@ export class CodexAppServerWorker {
     });
 
     this.rpc = new CodexRpcClient(this.proc);
+    // restart 후에도 refresh server-request 핸들러를 유지 (없으면 codex 토큰 회전 실패 → session expired)
+    this.bindServerRequestHandler();
 
     await this.rpc.request("initialize", {
       clientInfo: { name: "qgrid", version: "1.0.0" },
@@ -179,6 +223,7 @@ export class CodexAppServerWorker {
   async kill(): Promise<void> {
     this.destroyed = true;
     this.ready = false;
+    this.failActiveTurn(new Error("codex worker stopped"));
     this.rpc?.destroy();
 
     if (this.proc) {
@@ -213,6 +258,24 @@ export class CodexAppServerWorker {
     return this.config.tokenName;
   }
 
+  canReuseForToken(_tokenName: string, credentials: RefreshableWorkerCredentials): boolean {
+    return (
+      this.config.accountId === credentials.accountId &&
+      (this.config.planType ?? undefined) === (credentials.planType ?? undefined)
+    );
+  }
+
+  updateTokenState(tokenName: string, credentials: RefreshableWorkerCredentials): void {
+    this.config.tokenName = tokenName;
+    this.config.accessToken = credentials.accessToken;
+    this.config.accountId = credentials.accountId;
+    if (credentials.planType) {
+      this.config.planType = credentials.planType;
+    } else {
+      delete this.config.planType;
+    }
+  }
+
   // ── Rate limits ─────────────────────────────────────────────────
 
   async getRateLimits(): Promise<unknown> {
@@ -223,6 +286,14 @@ export class CodexAppServerWorker {
   // ── Server-request delegation ───────────────────────────────────
 
   setServerRequestHandler(handler: (method: string, params: unknown) => Promise<unknown>): void {
+    this.serverRequestHandler = handler;
+    this.bindServerRequestHandler();
+  }
+
+  // spawnAndInit에서 rpc 생성 직후 호출. restart로 rpc가 새로 만들어져도 핸들러가 유지된다.
+  bindServerRequestHandler(): void {
+    const handler = this.serverRequestHandler;
+    if (!handler) return;
     this.rpc?.onServerRequest("account/chatgptAuthTokens/refresh", (params) =>
       handler("account/chatgptAuthTokens/refresh", params),
     );
@@ -305,11 +376,18 @@ export class CodexAppServerWorker {
     } catch {}
   }
 
+  private failActiveTurn(error: Error): void {
+    const abort = this.activeTurnAbort;
+    this.activeTurnAbort = undefined;
+    abort?.(error);
+  }
+
   private consumeTurnNotifications(threadId: string, model: string): Promise<TurnResult> {
     return new Promise<TurnResult>((resolve, reject) => {
+      let settled = false;
+      let abort: ActiveTurnAbort;
       const timeout = setTimeout(() => {
-        cleanup();
-        reject(new Error("turn timeout (600s)"));
+        finishWithError(new Error("turn timeout (600s)"));
       }, 600_000);
 
       let text = "";
@@ -324,6 +402,7 @@ export class CodexAppServerWorker {
 
       const cleanup = () => {
         clearTimeout(timeout);
+        if (this.activeTurnAbort === abort) this.activeTurnAbort = undefined;
         for (const n of [
           "item/completed",
           "item/agentMessage/delta",
@@ -335,6 +414,23 @@ export class CodexAppServerWorker {
         }
       };
 
+      const finishWithError = (error: Error) => {
+        if (settled) return;
+        settled = true;
+        cleanup();
+        reject(error);
+      };
+
+      const finishWithResult = (result: TurnResult) => {
+        if (settled) return;
+        settled = true;
+        cleanup();
+        resolve(result);
+      };
+
+      abort = finishWithError;
+      this.activeTurnAbort = abort;
+
       this.rpc!.onNotification("item/completed", (p) => {
         if (p.threadId !== threadId) return;
         if (p.item.type === "agentMessage") text = p.item.text;
@@ -348,16 +444,14 @@ export class CodexAppServerWorker {
       this.rpc!.onNotification("turn/completed", (p) => {
         if (p.threadId !== threadId) return;
         durationMs = p.turn.durationMs ?? 0;
-        cleanup();
-        if (p.turn.status === "completed") resolve({ text, usage, durationMs, model });
-        else reject(new Error(`turn failed: ${JSON.stringify(p.turn.error)}`));
+        if (p.turn.status === "completed") finishWithResult({ text, usage, durationMs, model });
+        else finishWithError(new Error(`turn failed: ${JSON.stringify(p.turn.error)}`));
       });
 
       this.rpc!.onNotification("error", (p) => {
         if (p.threadId !== threadId) return;
         if (!p.willRetry) {
-          cleanup();
-          reject(new Error(`codex error: ${p.error.message}`));
+          finishWithError(new Error(`codex error: ${p.error.message}`));
         }
       });
     });
@@ -369,10 +463,10 @@ export class CodexAppServerWorker {
     cb: StreamCallbacks,
   ): Promise<void> {
     return new Promise<void>((resolve, reject) => {
+      let settled = false;
+      let abort: ActiveTurnAbort;
       const timeout = setTimeout(() => {
-        cleanup();
-        cb.onError(new Error("turn timeout (600s)"));
-        reject(new Error("turn timeout (600s)"));
+        finishWithError(new Error("turn timeout (600s)"));
       }, 600_000);
 
       let text = "";
@@ -386,6 +480,7 @@ export class CodexAppServerWorker {
 
       const cleanup = () => {
         clearTimeout(timeout);
+        if (this.activeTurnAbort === abort) this.activeTurnAbort = undefined;
         for (const n of [
           "item/completed",
           "item/agentMessage/delta",
@@ -397,6 +492,25 @@ export class CodexAppServerWorker {
         }
       };
 
+      const finishWithError = (error: Error) => {
+        if (settled) return;
+        settled = true;
+        cleanup();
+        cb.onError(error);
+        reject(error);
+      };
+
+      const finishWithComplete = (result: TurnResult) => {
+        if (settled) return;
+        settled = true;
+        cleanup();
+        cb.onComplete(result);
+        resolve();
+      };
+
+      abort = finishWithError;
+      this.activeTurnAbort = abort;
+
       this.rpc!.onNotification("item/agentMessage/delta", (p) => {
         if (p.threadId !== threadId) return;
         text += p.delta;
@@ -415,24 +529,17 @@ export class CodexAppServerWorker {
 
       this.rpc!.onNotification("turn/completed", (p) => {
         if (p.threadId !== threadId) return;
-        cleanup();
         if (p.turn.status === "completed") {
-          cb.onComplete({ text, usage, durationMs: p.turn.durationMs ?? 0, model });
-          resolve();
+          finishWithComplete({ text, usage, durationMs: p.turn.durationMs ?? 0, model });
         } else {
-          const err = new Error(`turn ${p.turn.status}: ${JSON.stringify(p.turn.error)}`);
-          cb.onError(err);
-          reject(err);
+          finishWithError(new Error(`turn ${p.turn.status}: ${JSON.stringify(p.turn.error)}`));
         }
       });
 
       this.rpc!.onNotification("error", (p) => {
         if (p.threadId !== threadId) return;
         if (!p.willRetry) {
-          cleanup();
-          const err = new Error(`codex error: ${p.error.message}`);
-          cb.onError(err);
-          reject(err);
+          finishWithError(new Error(`codex error: ${p.error.message}`));
         }
       });
     });

package/bundle/src/utils/providers/openai/openai-dispatcher.test.ts

@@ -0,0 +1,59 @@
+import { describe, expect, it, vi } from "vitest";
+
+import { type OpenAICredentials } from "../../../application/token/token.types";
+import { type CodexAppServerWorker } from "./codex-worker";
+import { OpenAIDispatcher } from "./openai-dispatcher";
+
+function credentials(overrides: Partial<OpenAICredentials> = {}): OpenAICredentials {
+  return {
+    accessToken: "access",
+    refreshToken: "refresh",
+    accessTokenExpiresAt: Date.now() + 60_000,
+    accountId: "account",
+    planType: "plus",
+    ...overrides,
+  };
+}
+
+function fakeWorker(reusable: boolean): CodexAppServerWorker {
+  return {
+    kill: vi.fn(async () => {}),
+    canReuseForToken: vi.fn(() => reusable),
+    updateTokenState: vi.fn(),
+  } as unknown as CodexAppServerWorker;
+}
+
+describe("OpenAIDispatcher token updates", () => {
+  it("keeps existing workers when only OpenAI auth tokens rotate", async () => {
+    const dispatcher = new OpenAIDispatcher();
+    const worker = fakeWorker(true);
+    const spawnWorkers = vi.spyOn(dispatcher, "spawnWorkers").mockResolvedValue(undefined);
+    dispatcher.workerPool.set(1, [worker]);
+
+    const rotated = credentials({
+      accessToken: "new-access",
+      refreshToken: "new-refresh",
+      idToken: "new-id",
+      accessTokenExpiresAt: Date.now() + 120_000,
+    });
+    await dispatcher.onTokenUpdated(1, "renamed-token", rotated);
+
+    expect(worker.kill).not.toHaveBeenCalled();
+    expect(worker.updateTokenState).toHaveBeenCalledWith("renamed-token", rotated);
+    expect(spawnWorkers).not.toHaveBeenCalled();
+    expect(dispatcher.workerPool.get(1)).toEqual([worker]);
+  });
+
+  it("restarts workers when the OpenAI login identity changes", async () => {
+    const dispatcher = new OpenAIDispatcher();
+    const worker = fakeWorker(false);
+    const spawnWorkers = vi.spyOn(dispatcher, "spawnWorkers").mockResolvedValue(undefined);
+    dispatcher.workerPool.set(1, [worker]);
+
+    const changedIdentity = credentials({ accountId: "other-account" });
+    await dispatcher.onTokenUpdated(1, "token", changedIdentity);
+
+    expect(worker.kill).toHaveBeenCalledTimes(1);
+    expect(spawnWorkers).toHaveBeenCalledWith(1, "token", changedIdentity);
+  });
+});

package/bundle/src/utils/providers/openai/openai-dispatcher.ts

@@ -92,6 +92,18 @@ export class OpenAIDispatcher implements ProviderDispatcher {
 
   async onTokenUpdated(id: number, name: string, credentials: OpenAICredentials): Promise<void> {
     const existing = this.workerPool.get(id) ?? [];
+    if (existing.length === 0) {
+      await this.spawnWorkers(id, name, credentials);
+      return;
+    }
+
+    if (existing.every((w) => w.canReuseForToken(name, credentials))) {
+      existing.forEach((w) => w.updateTokenState(name, credentials));
+      logger.info(`workers updated in-place for token ${id} (${name})`);
+      this.drainQueue();
+      return;
+    }
+
     this.workerPool.delete(id);
     await Promise.allSettled(existing.map((w) => w.kill()));
     await this.spawnWorkers(id, name, credentials);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cartanova/qgrid-cli",
-  "version": "2.0.3",
+  "version": "2.1.1",
   "repository": {
     "type": "git",
     "url": "https://github.com/cartanova-ai/qgrid"