@cartanova/qgrid-cli 2.5.10 → 2.6.1

package/bundle/src/application/qgrid/qgrid.frame.ts

@@ -19,6 +19,7 @@ import { TokenCredentials } from "../token/token.types";
 import {
   type AnthropicUsageRaw,
   buildAuthUrl,
+  CONSOLE_CALLBACK_URL,
   exchangeCodeForTokens,
   fetchUsage,
   generatePKCE,
@@ -80,12 +81,50 @@ async function deleteOAuthState(state: string): Promise<void> {
   await cache.delete({ key: `${OAUTH_STATE_PREFIX}${state}` });
 }
 
-function getOAuthRedirectUri(): string {
-  const publicBaseUrl = process.env.QGRID_PUBLIC_BASE_URL?.replace(/\/+$/, "");
-  if (publicBaseUrl) return `${publicBaseUrl}/callback`;
+// OAuth 접속 주소는 브라우저가 보낸 Origin(우선) 또는 Host 헤더에서 파생한다.
+// HTTP context 가 없는 직접 호출(테스트 등)은 null 을 반환한다.
+function deriveRequestBaseUrl(): string | null {
+  try {
+    const { headers, request } = Sonamu.getContext();
+    const origin = headers.origin;
+    if (typeof origin === "string" && /^https?:\/\//.test(origin)) {
+      return origin.replace(/\/+$/, "");
+    }
+    const forwardedHost = headers["x-forwarded-host"];
+    const host = (Array.isArray(forwardedHost) ? forwardedHost[0] : forwardedHost) ?? headers.host;
+    if (host) {
+      const forwardedProto = headers["x-forwarded-proto"];
+      const proto =
+        (Array.isArray(forwardedProto) ? forwardedProto[0] : forwardedProto)?.split(",")[0] ??
+        request.protocol;
+      return `${proto}://${host}`;
+    }
+  } catch {
+    // direct frame call — HTTP context 없음
+  }
+  return null;
+}
 
-  const serverPort = process.env.PORT ?? "44900";
-  return `http://localhost:${serverPort}/callback`;
+const LOOPBACK_HOSTNAMES = new Set(["localhost", "127.0.0.1", "[::1]", "::1"]);
+
+function isLoopbackBase(base: string): boolean {
+  try {
+    return LOOPBACK_HOSTNAMES.has(new URL(base).hostname);
+  } catch {
+    return false;
+  }
+}
+
+// Anthropic OAuth client 는 redirect_uri 허용 목록을 강제한다: 루프백(localhost)과
+// 콘솔 콜백만 허용된다. 따라서 루프백 접속은 자동 리다이렉트 플로우를,
+// 원격 접속은 콘솔 콜백 + 코드 붙여넣기 플로우(Claude Code CLI 와 동일)를 쓴다.
+function resolveOAuthRedirect(): { redirectUri: string; mode: "redirect" | "code" } {
+  const base = deriveRequestBaseUrl();
+  if (base && !isLoopbackBase(base)) {
+    return { redirectUri: CONSOLE_CALLBACK_URL, mode: "code" };
+  }
+  const loopbackBase = base ?? `http://localhost:${process.env.PORT ?? "44900"}`;
+  return { redirectUri: `${loopbackBase}/callback`, mode: "redirect" };
 }
 
 function rejectImageGenerationStream(args: QueryInput): void {
@@ -516,54 +555,87 @@ class QgridFrameClass extends BaseFrameClass {
   async oauthStart(name: string): Promise<OAuthStartResult> {
     const { codeVerifier, codeChallenge, state } = generatePKCE();
 
-    const redirectUri = getOAuthRedirectUri();
+    const { redirectUri, mode } = resolveOAuthRedirect();
     const authUrl = buildAuthUrl(codeChallenge, state, redirectUri);
 
     await setOAuthState(state, { codeVerifier, name, redirectUri });
 
-    return { authUrl };
+    return { authUrl, mode };
   }
 
-  async handleOAuthCallback(code: string, state: string, reply: FastifyReply): Promise<void> {
+  // 코드 붙여넣기 플로우(원격 접속): 콘솔 콜백이 표시한 `code#state` 를 받아 교환한다.
+  @api({ httpMethod: "POST", clients: ["axios", "tanstack-mutation"] })
+  async oauthComplete(pastedCode: string): Promise<{ added: boolean; name: string }> {
+    const trimmed = pastedCode.trim();
+    const separatorAt = trimmed.indexOf("#");
+    const code = separatorAt > 0 ? trimmed.slice(0, separatorAt) : "";
+    const state = separatorAt > 0 ? trimmed.slice(separatorAt + 1) : "";
+    if (!code || !state) {
+      throw new BadRequestException(
+        "expected the code shown after login, in code#state form" as LocalizedString,
+      );
+    }
+
     const pending = await getOAuthState(state);
     if (!pending) {
-      logger.warn("oauth callback: invalid_state");
-      return reply.redirect("/?oauth=error&reason=invalid_state");
+      throw new BadRequestException(
+        "login session not found or expired — start the login again" as LocalizedString,
+      );
     }
     await deleteOAuthState(state);
 
-    try {
-      const tokens = await exchangeCodeForTokens(
-        code,
-        pending.codeVerifier,
-        state,
-        pending.redirectUri,
-      );
+    await this.completeAnthropicLogin(code, state, pending);
+    return { added: true, name: pending.name };
+  }
 
-      if (tokens.accountUuid) {
-        const oldEntries = await TokenModel.findByAccountIdentifier(
-          "A",
-          "anthropic",
-          tokens.accountUuid,
-        );
-        if (oldEntries.length > 0) {
-          await TokenModel.del(oldEntries.map((o) => o.id));
-        }
+  // 교환 + 계정 중복 제거 + 저장 — redirect 콜백과 코드 붙여넣기 플로우가 공유한다.
+  private async completeAnthropicLogin(
+    code: string,
+    state: string,
+    pending: PendingOAuth,
+  ): Promise<void> {
+    const tokens = await exchangeCodeForTokens(
+      code,
+      pending.codeVerifier,
+      state,
+      pending.redirectUri,
+    );
+
+    if (tokens.accountUuid) {
+      const oldEntries = await TokenModel.findByAccountIdentifier(
+        "A",
+        "anthropic",
+        tokens.accountUuid,
+      );
+      if (oldEntries.length > 0) {
+        await TokenModel.del(oldEntries.map((o) => o.id));
       }
+    }
 
-      await TokenModel.save([
-        {
-          provider: "anthropic",
-          credentials: {
-            accessToken: tokens.accessToken,
-            refreshToken: tokens.refreshToken,
-            expiresAt: tokens.expiresAt ?? 0,
-            accountUuid: tokens.accountUuid ?? "",
-          },
-          name: pending.name,
+    await TokenModel.save([
+      {
+        provider: "anthropic",
+        credentials: {
+          accessToken: tokens.accessToken,
+          refreshToken: tokens.refreshToken,
+          expiresAt: tokens.expiresAt ?? 0,
+          accountUuid: tokens.accountUuid ?? "",
         },
-      ]);
+        name: pending.name,
+      },
+    ]);
+  }
 
+  async handleOAuthCallback(code: string, state: string, reply: FastifyReply): Promise<void> {
+    const pending = await getOAuthState(state);
+    if (!pending) {
+      logger.warn("oauth callback: invalid_state");
+      return reply.redirect("/?oauth=error&reason=invalid_state");
+    }
+    await deleteOAuthState(state);
+
+    try {
+      await this.completeAnthropicLogin(code, state, pending);
       return reply.redirect(`/?oauth=success&name=${encodeURIComponent(pending.name)}`);
     } catch (e) {
       return reply.redirect(`/?oauth=error&reason=${encodeURIComponent((e as Error).message)}`);
@@ -608,7 +680,7 @@ class QgridFrameClass extends BaseFrameClass {
         logger.warn(`OpenAI browser login failed: ${(e as Error).message}`);
       });
 
-    return { authUrl };
+    return { authUrl, mode: "redirect" };
   }
 
   @api({ httpMethod: "GET", clients: ["axios", "tanstack-query"] })

package/bundle/src/application/qgrid/qgrid.types.ts

@@ -274,6 +274,9 @@ export type TokenStats = z.infer<typeof TokenStats>;
 
 export const OAuthStartResult = z.object({
   authUrl: z.string(),
+  // redirect: 브라우저 자동 복귀(루프백 접속). code: 콘솔 콜백 + 코드 붙여넣기(원격 접속).
+  // OpenAI 경로는 codex 가 콜백을 처리하므로 항상 redirect 를 반환한다.
+  mode: z.enum(["redirect", "code"]),
 });
 export type OAuthStartResult = z.infer<typeof OAuthStartResult>;
 

package/bundle/src/application/request-log/request-log.entity.json

@@ -97,6 +97,13 @@
       "nullable": true,
       "desc": "inject_items 히스토리"
     },
+    {
+      "name": "tools",
+      "type": "json",
+      "id": "ToolDefinitions",
+      "nullable": true,
+      "desc": "요청에 장착된 tool 정의 목록"
+    },
     {
       "name": "status",
       "type": "enum",
@@ -153,6 +160,7 @@
       "image_cost_method",
       "effort",
       "history",
+      "tools",
       "status",
       "error_message",
       "tool_call_count",

package/bundle/src/application/request-log/request-log.model.test.ts

@@ -113,7 +113,7 @@ describe("RequestLogModel run lifecycle", () => {
     vi.restoreAllMocks();
   });
 
-  it("stores the requested model but no serving model when a run starts", async () => {
+  it("stores the requested model and attached tools but no serving model when a run starts", async () => {
     const ubRegister = vi.fn();
     const transaction = vi.fn(
       async (cb: (trx: { ubUpsert: () => Promise<number[]> }) => Promise<number>) =>
@@ -130,6 +130,7 @@ describe("RequestLogModel run lifecycle", () => {
       RequestLogModel.createRun({
         user_prompt: "hi",
         requested_model_name: "openai/gpt-5-codex",
+        tools: [{ name: "getWeather", description: "Get weather", inputSchema: { type: "object" } }],
       }),
     ).resolves.toBe(17);
 
@@ -139,6 +140,7 @@ describe("RequestLogModel run lifecycle", () => {
         status: "running",
         requested_model_name: "openai/gpt-5-codex",
         model_name: null,
+        tools: [{ name: "getWeather", description: "Get weather", inputSchema: { type: "object" } }],
       }),
     );
   });

package/bundle/src/application/request-log/request-log.model.ts

@@ -14,7 +14,11 @@ import { SD } from "../../i18n/sd.generated";
 import { calculateCostUsd } from "../../utils/providers/common/model-cost";
 import { type RequestLogSubsetKey, type RequestLogSubsetMapping } from "../sonamu.generated";
 import { requestLogLoaderQueries, requestLogSubsetQueries } from "../sonamu.generated.sso";
-import { type RequestLogListParams, type RequestLogSaveParams } from "./request-log.types";
+import {
+  type RequestLogListParams,
+  type RequestLogSaveParams,
+  type ToolDefinitions,
+} from "./request-log.types";
 
 // cost_usd는 정수 micro-USD로 저장. 실제 USD = cost_usd / MICRO_USD.
 export const MICRO_USD = 1_000_000;
@@ -287,6 +291,7 @@ class RequestLogModelClass extends BaseModelClass<
     effort?: string | null;
     project_name?: string | null;
     history?: unknown;
+    tools?: ToolDefinitions;
     is_image_generation?: boolean;
   }): Promise<number> {
     const wdb = this.getPuri("w");
@@ -309,6 +314,7 @@ class RequestLogModelClass extends BaseModelClass<
       // 이미지 turn 식별(R13). run 경로(tools+image 조합)도 auto 경로와 동일하게 마킹.
       is_image_generation: params.is_image_generation ?? false,
       ...(params.history !== undefined ? { history: params.history as { type: string }[] } : {}),
+      ...(params.tools !== undefined ? { tools: params.tools } : {}),
     });
     return wdb.transaction(async (trx) => {
       const ids = await trx.ubUpsert("request_logs");

package/bundle/src/application/request-log/request-log.types.ts

@@ -1,5 +1,6 @@
 import { z } from "zod";
 
+import { QgridTool } from "../qgrid/qgrid.types";
 import { RequestLogBaseListParams, RequestLogBaseSchema } from "../sonamu.generated";
 
 export const HistoryItems = z.array(
@@ -15,6 +16,10 @@ export const HistoryItems = z.array(
 );
 export type HistoryItems = z.infer<typeof HistoryItems>;
 
+// 요청에 장착된 tool 정의 목록 — 저장 형태는 QgridTool 계약을 그대로 따른다.
+export const ToolDefinitions = z.array(QgridTool);
+export type ToolDefinitions = z.infer<typeof ToolDefinitions>;
+
 // RequestLog - ListParams
 // project_name NULL 분기: IS NULL만 조회(unassigned 필터) 또는 IS NOT NULL만(distinct 조회).
 export const RequestLogListParams = RequestLogBaseListParams.extend({

package/bundle/src/application/sonamu.generated.http

@@ -199,6 +199,7 @@ Content-Type: application/json
       "image_cost_method": null,
       "effort": null,
       "history": null,
+      "tools": null,
       "status": "running",
       "error_message": null,
       "tool_call_count": 0,
@@ -252,7 +253,6 @@ Content-Type: application/json
     "serviceTier": "fast",
     "history": "HISTORY",
     "projectName": "PROJECTNAME",
-    "isStep": false,
     "logger": false,
     "runContext": {
       "requestLogId": 0,
@@ -313,7 +313,6 @@ Content-Type: application/json
     "serviceTier": "fast",
     "history": "HISTORY",
     "projectName": "PROJECTNAME",
-    "isStep": false,
     "logger": false,
     "runContext": {
       "requestLogId": 0,
@@ -501,6 +500,15 @@ Content-Type: application/json
 
 ###
 
+POST {{baseUrl}}/api/qgrid/oauthComplete
+Content-Type: application/json
+
+{
+  "pastedCode": "PASTEDCODE"
+}
+
+###
+
 POST {{baseUrl}}/api/qgrid/oauthStartOpenAI
 Content-Type: application/json
 

package/bundle/src/application/sonamu.generated.sso.ts

@@ -42,6 +42,7 @@ export const requestLogSubsetQueries = {
       image_cost_method: "request_logs.image_cost_method",
       effort: "request_logs.effort",
       history: "request_logs.history",
+      tools: "request_logs.tools",
       status: "request_logs.status",
       error_message: "request_logs.error_message",
       tool_call_count: "request_logs.tool_call_count",

package/bundle/src/application/sonamu.generated.ts

@@ -42,6 +42,16 @@ const TokenCredentials = z.union([
 ]);
 type TokenCredentials = z.infer<typeof TokenCredentials>;
 
+// CustomScalar: ToolDefinitions
+const ToolDefinitions = z.array(
+  z.object({
+    name: z.string(),
+    description: z.string().optional(),
+    inputSchema: z.unknown(),
+  }),
+);
+type ToolDefinitions = z.infer<typeof ToolDefinitions>;
+
 // Enums: RequestLog
 export const RequestLogOrderBy = z.enum(["id-desc"]).describe("RequestLogOrderBy");
 export type RequestLogOrderBy = z.infer<typeof RequestLogOrderBy>;
@@ -111,6 +121,7 @@ export const RequestLogBaseSchema = z.object({
   image_cost_method: z.string().max(100).nullable(),
   effort: z.string().max(10).nullable(),
   history: HistoryItems.nullable(),
+  tools: ToolDefinitions.nullable(),
   status: RequestLogStatus,
   error_message: z.string().nullable(),
   tool_call_count: z.int(),
@@ -141,6 +152,7 @@ export type RequestLogBaseSchema = z.infer<typeof RequestLogBaseSchema> & {
     "image_cost_method",
     "effort",
     "history",
+    "tools",
     "status",
     "error_message",
     "tool_call_count",
@@ -308,6 +320,7 @@ export const RequestLogSubsetA = z.object({
   image_cost_method: z.string().max(100).nullable(),
   effort: z.string().max(10).nullable(),
   history: HistoryItems.nullable(),
+  tools: ToolDefinitions.nullable(),
   status: RequestLogStatus,
   error_message: z.string().nullable(),
   tool_call_count: z.int(),

package/bundle/src/i18n/sd.generated.ts

@@ -234,6 +234,7 @@ const entityLabels = {
   "entity.RequestLog.image_cost_method": "이미지 비용 추정 방식",
   "entity.RequestLog.effort": "effort level",
   "entity.RequestLog.history": "inject_items 히스토리",
+  "entity.RequestLog.tools": "요청에 장착된 tool 정의 목록",
   "entity.RequestLog.status": "실행 상태",
   "entity.RequestLog.error_message": "에러 메시지",
   "entity.RequestLog.tool_call_count": "tool call 횟수",

package/bundle/src/migrations/20260806141701_alter_request_logs_add1_alter1.ts

@@ -0,0 +1,15 @@
+import { type Knex } from "knex";
+
+export async function up(knex: Knex): Promise<void> {
+  await knex.schema.alterTable("request_logs", (table) => {
+    // add
+    table.jsonb("tools").nullable();
+  });
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.alterTable("request_logs", (table) => {
+    // rollback - add
+    table.dropColumns("tools");
+  });
+}