@cartanova/qgrid-cli 2.5.10 → 2.6.1

package/bundle/web-dist/server/assets/{logs-33YNafdW.js → logs-D0z1Ghj1.js}

@@ -1,6 +1,6 @@
-import { _ as require_jsx_runtime, d as string, l as number, u as object, v as require_react } from "./sd.generated-C3gcvRcU.js";
-import { a as TokenService, n as QgridService, r as RequestLogService } from "./services.generated-B2_Auwvk.js";
-import { a as Link, o as useNavigate } from "./lazyRouteComponent-BCJr868T.js";
+import { _ as require_jsx_runtime, d as string, l as number, u as object, v as require_react } from "./sd.generated-ek-tz-7H.js";
+import { a as TokenService, n as QgridService, r as RequestLogService } from "./services.generated-BNuxWs7K.js";
+import { a as Link, o as useNavigate } from "./lazyRouteComponent-PRxXWW3t.js";
 import { n as Route } from "../entry-server.generated.js";
 import { n as formatMicroUsd, r as formatUsd, t as cacheHitRate } from "./cost-CSH_t17I.js";
 require_react();

package/bundle/web-dist/server/assets/{monit--9mVsjNU.js → monit-dBXxnAyI.js}

@@ -1,5 +1,5 @@
-import { Z as __toESM, _ as require_jsx_runtime, c as _enum, p as require_react_dom, u as object, v as require_react } from "./sd.generated-C3gcvRcU.js";
-import { s as useQuery, t as MonitService } from "./services.generated-B2_Auwvk.js";
+import { Z as __toESM, _ as require_jsx_runtime, c as _enum, p as require_react_dom, u as object, v as require_react } from "./sd.generated-ek-tz-7H.js";
+import { s as useQuery, t as MonitService } from "./services.generated-BNuxWs7K.js";
 import { a as clsx, r as Route } from "../entry-server.generated.js";
 //#region ../../node_modules/.pnpm/@tanstack+virtual-core@3.17.4/node_modules/@tanstack/virtual-core/dist/esm/lazy-measurements.js
 var import_react = /* @__PURE__ */ __toESM(require_react(), 1);

package/bundle/web-dist/server/assets/{routes-BK3Xh1UB.js → routes-B3p7fuwk.js}

@@ -1,8 +1,8 @@
-import { Z as __toESM, _ as require_jsx_runtime, g as useQueryClient, p as require_react_dom, v as require_react } from "./sd.generated-C3gcvRcU.js";
-import { a as TokenService, n as QgridService } from "./services.generated-B2_Auwvk.js";
+import { Z as __toESM, _ as require_jsx_runtime, g as useQueryClient, p as require_react_dom, v as require_react } from "./sd.generated-ek-tz-7H.js";
+import { a as TokenService, n as QgridService } from "./services.generated-BNuxWs7K.js";
 import { i as Q } from "../entry-server.generated.js";
 import { r as formatUsd } from "./cost-CSH_t17I.js";
-import { t as useUpdateTokenMutation } from "./use-update-token-mutation-CNBgTysy.js";
+import { t as useUpdateTokenMutation } from "./use-update-token-mutation-BBCC2GKM.js";
 //#region ../../node_modules/.pnpm/@dnd-kit+utilities@3.2.2_react@19.2.4/node_modules/@dnd-kit/utilities/dist/utilities.esm.js
 var import_react_dom = /* @__PURE__ */ __toESM(require_react_dom());
 var import_react = /* @__PURE__ */ __toESM(require_react());

package/bundle/web-dist/server/assets/{sd.generated-C3gcvRcU.js → sd.generated-ek-tz-7H.js}

@@ -22558,6 +22558,7 @@ var entityLabels = {
 	"entity.RequestLog.image_cost_method": "이미지 비용 추정 방식",
 	"entity.RequestLog.effort": "effort level",
 	"entity.RequestLog.history": "inject_items 히스토리",
+	"entity.RequestLog.tools": "요청에 장착된 tool 정의 목록",
 	"entity.RequestLog.status": "실행 상태",
 	"entity.RequestLog.error_message": "에러 메시지",
 	"entity.RequestLog.tool_call_count": "tool call 횟수",

package/bundle/web-dist/server/assets/{services.generated-B2_Auwvk.js → services.generated-BNuxWs7K.js}

@@ -1,4 +1,4 @@
-import { B as resolveStaleTime, C as infiniteQueryBehavior, D as notifyManager, G as timeoutManager, H as shouldThrowError, I as noop, K as focusManager, N as isValidTimeout, O as pendingThenable, R as replaceData, S as hasPreviousPage, T as fetchState, V as shallowEqualObjects, W as timeUntilStale, Z as __toESM, _ as require_jsx_runtime, a as fetch, b as getDefaultState, f as require_lib, g as useQueryClient, i as dedupeAndFlatten, j as hashKey, k as environmentManager, o as useRefreshable, q as Subscribable, s as useSSEStream, v as require_react, x as hasNextPage, z as resolveEnabled } from "./sd.generated-C3gcvRcU.js";
+import { B as resolveStaleTime, C as infiniteQueryBehavior, D as notifyManager, G as timeoutManager, H as shouldThrowError, I as noop, K as focusManager, N as isValidTimeout, O as pendingThenable, R as replaceData, S as hasPreviousPage, T as fetchState, V as shallowEqualObjects, W as timeUntilStale, Z as __toESM, _ as require_jsx_runtime, a as fetch, b as getDefaultState, f as require_lib, g as useQueryClient, i as dedupeAndFlatten, j as hashKey, k as environmentManager, o as useRefreshable, q as Subscribable, s as useSSEStream, v as require_react, x as hasNextPage, z as resolveEnabled } from "./sd.generated-ek-tz-7H.js";
 //#region ../../node_modules/.pnpm/@tanstack+query-core@5.95.2/node_modules/@tanstack/query-core/build/modern/queryObserver.js
 var QueryObserver = class extends Subscribable {
 	constructor(client, options) {
@@ -1076,6 +1076,15 @@ var QgridService;
 	}
 	_QgridService.oauthStart = oauthStart;
 	_QgridService.useOauthStartMutation = () => useMutation({ mutationFn: (params) => oauthStart(params.name) });
+	async function oauthComplete(pastedCode) {
+		return fetch({
+			method: "POST",
+			url: `/api/qgrid/oauthComplete`,
+			data: { pastedCode }
+		});
+	}
+	_QgridService.oauthComplete = oauthComplete;
+	_QgridService.useOauthCompleteMutation = () => useMutation({ mutationFn: (params) => oauthComplete(params.pastedCode) });
 	async function oauthStartOpenAI(name) {
 		return fetch({
 			method: "POST",

package/bundle/web-dist/server/assets/{show-Dxxxe608.js → show-0iNioJ2I.js}

@@ -1,6 +1,6 @@
-import { J as __commonJSMin, Y as __exportAll, Z as __toESM, _ as require_jsx_runtime, v as require_react } from "./sd.generated-C3gcvRcU.js";
-import { i as RequestLogStepService, r as RequestLogService } from "./services.generated-B2_Auwvk.js";
-import { a as Link } from "./lazyRouteComponent-BCJr868T.js";
+import { J as __commonJSMin, Y as __exportAll, Z as __toESM, _ as require_jsx_runtime, v as require_react } from "./sd.generated-ek-tz-7H.js";
+import { i as RequestLogStepService, r as RequestLogService } from "./services.generated-BNuxWs7K.js";
+import { a as Link } from "./lazyRouteComponent-PRxXWW3t.js";
 import { t as Route } from "../entry-server.generated.js";
 import { n as formatMicroUsd, t as cacheHitRate } from "./cost-CSH_t17I.js";
 import minpath from "node:path";
@@ -25801,6 +25801,12 @@ function extractText(content) {
 	}).join("\n");
 	return JSON.stringify(content);
 }
+function MonoPre({ className, children }) {
+	return /* @__PURE__ */ (0, import_jsx_runtime.jsx)("pre", {
+		className: `text-[12px] text-sand-700 whitespace-pre-wrap wrap-break-word font-mono leading-relaxed max-h-40 overflow-auto ${className ?? ""}`,
+		children
+	});
+}
 function HistorySection({ history }) {
 	return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Section, {
 		title: "History",
@@ -25814,20 +25820,37 @@ function HistorySection({ history }) {
 						className: "text-[10px] uppercase tracking-wider text-sand-500 font-medium mb-1",
 						children: historyItemLabel(item)
 					}),
-					item.content !== null && item.content !== void 0 && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("pre", {
-						className: "text-[12px] text-sand-700 whitespace-pre-wrap wrap-break-word font-mono leading-relaxed max-h-40 overflow-auto",
-						children: extractText(item.content)
+					item.content !== null && item.content !== void 0 && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(MonoPre, { children: extractText(item.content) }),
+					item.arguments && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(MonoPre, { children: item.arguments }),
+					item.output && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(MonoPre, { children: item.output })
+				]
+			}, `hist-${i}`))
+		})
+	});
+}
+function ToolsSection({ tools }) {
+	return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Section, {
+		title: `Tools (${tools.length})`,
+		defaultOpen: false,
+		children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", {
+			className: "space-y-1.5",
+			children: tools.map((tool, i) => /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", {
+				className: "rounded-md px-3 py-2 bg-caution-400/10",
+				children: [
+					/* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", {
+						className: "text-[10px] uppercase tracking-wider text-sand-500 font-medium mb-1",
+						children: ["fn: ", tool.name]
 					}),
-					item.arguments && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("pre", {
-						className: "text-[12px] text-sand-700 whitespace-pre-wrap wrap-break-word font-mono leading-relaxed max-h-40 overflow-auto",
-						children: item.arguments
+					tool.description && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", {
+						className: "text-[12px] text-sand-700 leading-relaxed",
+						children: tool.description
 					}),
-					item.output && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("pre", {
-						className: "text-[12px] text-sand-700 whitespace-pre-wrap wrap-break-word font-mono leading-relaxed max-h-40 overflow-auto",
-						children: item.output
+					tool.inputSchema !== void 0 && tool.inputSchema !== null && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(MonoPre, {
+						className: "mt-1",
+						children: JSON.stringify(tool.inputSchema, null, 2)
 					})
 				]
-			}, `hist-${i}`))
+			}, `tool-${i}`))
 		})
 	});
 }
@@ -25865,6 +25888,8 @@ function RequestDetail({ id }) {
 	const tokensPerSecEnabled = isTokensPerSecEnabled(data);
 	const history = data.history ?? null;
 	const hasHistory = history !== null && history.length > 0;
+	const tools = data.tools ?? null;
+	const hasTools = tools !== null && tools.length > 0;
 	const promptSections = /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", {
 		className: "space-y-4",
 		children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Section, {
@@ -25901,6 +25926,7 @@ function RequestDetail({ id }) {
 			/* @__PURE__ */ (0, import_jsx_runtime.jsx)(HeaderBar, { data }),
 			data.error_message && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(ErrorPanel, { message: data.error_message }),
 			hasHistory && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(HistorySection, { history }),
+			hasTools && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(ToolsSection, { tools }),
 			hasSteps ? /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", {
 				className: "flex gap-4 items-start",
 				children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", {

package/bundle/web-dist/server/assets/{tokens-BWPVvdfi.js → tokens-CvytQ9Xy.js}

@@ -1,7 +1,7 @@
-import { Z as __toESM, _ as require_jsx_runtime, g as useQueryClient, v as require_react } from "./sd.generated-C3gcvRcU.js";
-import { a as TokenService, n as QgridService } from "./services.generated-B2_Auwvk.js";
+import { Z as __toESM, _ as require_jsx_runtime, g as useQueryClient, v as require_react } from "./sd.generated-ek-tz-7H.js";
+import { a as TokenService, n as QgridService } from "./services.generated-BNuxWs7K.js";
 import { i as Q, o as lucideKeyRound } from "../entry-server.generated.js";
-import { t as useUpdateTokenMutation } from "./use-update-token-mutation-CNBgTysy.js";
+import { t as useUpdateTokenMutation } from "./use-update-token-mutation-BBCC2GKM.js";
 //#region ~icons/lucide/plus.jsx
 var import_react = /* @__PURE__ */ __toESM(require_react());
 var import_jsx_runtime = require_jsx_runtime();
@@ -23,16 +23,19 @@ var lucidePlus = (props) => /* @__PURE__ */ (0, import_jsx_runtime.jsx)("svg", {
 //#region src/components/qgrid/AddTokenModal.tsx
 function AddTokenModal() {
 	const [open, setOpen] = (0, import_react.useState)(false);
-	const [oauthLoading, setOauthLoading] = (0, import_react.useState)(false);
+	const [oauthLoading, setOauthLoading] = (0, import_react.useState)(null);
 	const [name, setName] = (0, import_react.useState)("");
+	const [codeEntry, setCodeEntry] = (0, import_react.useState)(false);
+	const [pastedCode, setPastedCode] = (0, import_react.useState)("");
 	const queryClient = useQueryClient();
 	const oauthStartMutation = QgridService.useOauthStartMutation();
 	const oauthStartOpenAIMutation = QgridService.useOauthStartOpenAIMutation();
+	const oauthCompleteMutation = QgridService.useOauthCompleteMutation();
 	const handleOAuthLogin = async (provider) => {
 		if (!name.trim()) return;
 		if (provider === "openai") {
 			const popup = window.open("about:blank", "_blank");
-			setOauthLoading(true);
+			setOauthLoading("openai");
 			try {
 				const { authUrl } = await oauthStartOpenAIMutation.mutateAsync({ name: name.trim() });
 				if (popup) popup.location.href = authUrl;
@@ -43,27 +46,51 @@ function AddTokenModal() {
 				}, 3e3);
 				setTimeout(() => {
 					clearInterval(poll);
-					setOauthLoading(false);
+					setOauthLoading(null);
 				}, 3e5);
 			} catch (e) {
 				console.error("OAuth start failed:", e);
-				setOauthLoading(false);
+				setOauthLoading(null);
 			}
 		} else {
-			setOauthLoading(true);
+			const popup = window.open("about:blank", "_blank");
+			setOauthLoading("anthropic");
 			try {
-				const { authUrl } = await oauthStartMutation.mutateAsync({ name: name.trim() });
-				window.location.href = authUrl;
+				const { authUrl, mode } = await oauthStartMutation.mutateAsync({ name: name.trim() });
+				if (mode === "code") {
+					if (popup) popup.location.href = authUrl;
+					else window.open(authUrl, "_blank");
+					setCodeEntry(true);
+					setOauthLoading(null);
+				} else {
+					popup?.close();
+					window.location.href = authUrl;
+				}
 			} catch (e) {
+				popup?.close();
 				console.error("OAuth start failed:", e);
-				setOauthLoading(false);
+				setOauthLoading(null);
 			}
 		}
 	};
+	const submitPastedCode = async () => {
+		if (!pastedCode.trim()) return;
+		try {
+			await oauthCompleteMutation.mutateAsync({ pastedCode: pastedCode.trim() });
+		} catch (e) {
+			console.error("OAuth complete failed:", e);
+			return;
+		}
+		await Promise.all([queryClient.invalidateQueries({ queryKey: ["Token"] }), queryClient.invalidateQueries({ queryKey: ["Qgrid"] })]);
+		close();
+	};
 	const close = () => {
 		setOpen(false);
 		setName("");
-		setOauthLoading(false);
+		setOauthLoading(null);
+		setCodeEntry(false);
+		setPastedCode("");
+		oauthCompleteMutation.reset();
 	};
 	return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [/* @__PURE__ */ (0, import_jsx_runtime.jsxs)("button", {
 		type: "button",
@@ -97,15 +124,53 @@ function AddTokenModal() {
 						onChange: (e) => setName(e.target.value),
 						placeholder: "e.g. your-token-name",
 						className: "mt-1 w-full border border-sand-200 rounded-md px-3 py-2 text-sm text-sand-900 bg-white placeholder:text-sand-300 focus:outline-none focus:border-sienna-300"
-					})] }), /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", {
+					})] }), codeEntry ? /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", {
 						className: "space-y-2",
 						children: [
+							/* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", {
+								className: "text-[12px] text-sand-600 leading-relaxed",
+								children: "새 탭에서 Claude 로그인을 완료하면 코드가 표시됩니다. 코드 전체를 아래에 붙여넣으세요."
+							}),
+							/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Q, {
+								value: pastedCode,
+								onChange: (e) => setPastedCode(e.target.value),
+								placeholder: "code#state",
+								className: "w-full border border-sand-200 rounded-md px-3 py-2 text-sm font-mono text-sand-900 bg-white placeholder:text-sand-300 focus:outline-none focus:border-sienna-300"
+							}),
+							oauthCompleteMutation.isError && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", {
+								className: "text-[11px] text-red-500",
+								children: "코드 확인에 실패했습니다 — 표시된 코드 전체를 다시 붙여넣거나 로그인을 다시 시작하세요."
+							}),
 							/* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", {
 								type: "button",
 								className: "w-full py-2.5 text-sm font-medium rounded-md bg-sand-900 text-white hover:bg-sand-800 disabled:opacity-50 transition-colors duration-150 flex items-center justify-center gap-2",
-								disabled: !name.trim() || oauthLoading,
+								disabled: !pastedCode.trim() || oauthCompleteMutation.isPending,
+								onClick: submitPastedCode,
+								children: oauthCompleteMutation.isPending ? /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("span", {
+									className: "flex items-center gap-1.5",
+									children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: "w-3.5 h-3.5 border-2 border-white border-t-transparent rounded-full animate-spin" }), "Verifying..."]
+								}) : "Complete login"
+							}),
+							/* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", {
+								type: "button",
+								className: "w-full py-1.5 text-[12px] text-sand-500 hover:text-sand-700 transition-colors duration-150",
+								onClick: () => {
+									setCodeEntry(false);
+									setPastedCode("");
+									oauthCompleteMutation.reset();
+								},
+								children: "처음부터 다시 시작"
+							})
+						]
+					}) : /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", {
+						className: "space-y-2",
+						children: [
+							/* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", {
+								type: "button",
+								className: "w-full py-2.5 text-sm font-medium rounded-md bg-sand-900 text-white hover:bg-sand-800 disabled:opacity-50 transition-colors duration-150 flex items-center justify-center gap-2",
+								disabled: !name.trim() || oauthLoading !== null,
 								onClick: () => handleOAuthLogin("openai"),
-								children: oauthLoading ? /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("span", {
+								children: oauthLoading === "openai" ? /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("span", {
 									className: "flex items-center gap-1.5",
 									children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: "w-3.5 h-3.5 border-2 border-white border-t-transparent rounded-full animate-spin" }), "Waiting for login..."]
 								}) : /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(lucideKeyRound, { className: "size-4" }), "Login with OpenAI"] })
@@ -121,12 +186,15 @@ function AddTokenModal() {
 									/* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className: "flex-1 h-px bg-sand-200" })
 								]
 							}),
-							/* @__PURE__ */ (0, import_jsx_runtime.jsxs)("button", {
+							/* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", {
 								type: "button",
 								className: "w-full py-2.5 text-sm font-medium rounded-md border border-sand-300 text-sand-700 hover:bg-sand-100 disabled:opacity-50 transition-colors duration-150 flex items-center justify-center gap-2",
-								disabled: !name.trim() || oauthLoading,
+								disabled: !name.trim() || oauthLoading !== null,
 								onClick: () => handleOAuthLogin("anthropic"),
-								children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(lucideKeyRound, { className: "size-4" }), "Login with Claude"]
+								children: oauthLoading === "anthropic" ? /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("span", {
+									className: "flex items-center gap-1.5",
+									children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: "w-3.5 h-3.5 border-2 border-sand-400 border-t-transparent rounded-full animate-spin" }), "Waiting for login..."]
+								}) : /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(lucideKeyRound, { className: "size-4" }), "Login with Claude"] })
 							})
 						]
 					})]

package/bundle/web-dist/server/assets/{use-update-token-mutation-CNBgTysy.js → use-update-token-mutation-BBCC2GKM.js}

@@ -1,4 +1,4 @@
-import { n as QgridService, o as useMutation } from "./services.generated-B2_Auwvk.js";
+import { n as QgridService, o as useMutation } from "./services.generated-BNuxWs7K.js";
 //#region src/services/token/use-update-token-mutation.ts
 function useUpdateTokenMutation() {
 	return useMutation({ mutationFn: ({ id, name, quotaThreshold, weight }) => QgridService.updateToken(id, name, quotaThreshold, weight) });

package/bundle/web-dist/server/entry-server.generated.js

@@ -1,5 +1,5 @@
-import { A as functionalUpdate, B as resolveStaleTime, C as infiniteQueryBehavior, D as notifyManager, E as onlineManager, F as matchQuery, I as noop$1, J as __commonJSMin, K as focusManager, L as partialMatchKey, M as hashQueryKeyByOptions, P as matchMutation, U as skipToken, X as __require, Z as __toESM, _ as require_jsx_runtime, c as _enum, d as string, h as QueryClientProvider, j as hashKey, l as number, m as require_shim, n as SUPPORTED_LOCALES, p as require_react_dom, q as Subscribable, r as setLocale, t as SD, u as object, v as require_react, w as Query, y as Mutation } from "./assets/sd.generated-C3gcvRcU.js";
-import { A as decodePath, C as findRouteMatch, D as createLRUCache, E as processRouteTree, F as last, I as replaceEqualDeep, M as findLast, N as functionalUpdate$1, O as invariant, P as isPromise, S as findFlatMatch, T as processRouteMasks, _ as interpolatePath, a as Link$1, b as trimPath, c as usePrevious$1, d as useRouter, f as getRouterContext, g as cleanPath, h as isNotFound, i as createRootRouteWithContext, j as deepEqual$2, k as createControlledPromise, l as matchContext, m as rootRouteId, n as createFileRoute, p as warning, r as createLazyFileRoute, s as useLayoutEffect$3, t as lazyRouteComponent, u as useRouterState, v as joinPaths, w as findSingleMatch, x as trimPathRight, y as resolvePath } from "./assets/lazyRouteComponent-BCJr868T.js";
+import { A as functionalUpdate, B as resolveStaleTime, C as infiniteQueryBehavior, D as notifyManager, E as onlineManager, F as matchQuery, I as noop$1, J as __commonJSMin, K as focusManager, L as partialMatchKey, M as hashQueryKeyByOptions, P as matchMutation, U as skipToken, X as __require, Z as __toESM, _ as require_jsx_runtime, c as _enum, d as string, h as QueryClientProvider, j as hashKey, l as number, m as require_shim, n as SUPPORTED_LOCALES, p as require_react_dom, q as Subscribable, r as setLocale, t as SD, u as object, v as require_react, w as Query, y as Mutation } from "./assets/sd.generated-ek-tz-7H.js";
+import { A as decodePath, C as findRouteMatch, D as createLRUCache, E as processRouteTree, F as last, I as replaceEqualDeep, M as findLast, N as functionalUpdate$1, O as invariant, P as isPromise, S as findFlatMatch, T as processRouteMasks, _ as interpolatePath, a as Link$1, b as trimPath, c as usePrevious$1, d as useRouter, f as getRouterContext, g as cleanPath, h as isNotFound, i as createRootRouteWithContext, j as deepEqual$2, k as createControlledPromise, l as matchContext, m as rootRouteId, n as createFileRoute, p as warning, r as createLazyFileRoute, s as useLayoutEffect$3, t as lazyRouteComponent, u as useRouterState, v as joinPaths, w as findSingleMatch, x as trimPathRight, y as resolvePath } from "./assets/lazyRouteComponent-PRxXWW3t.js";
 //#region ../../node_modules/.pnpm/@tanstack+query-core@5.95.2/node_modules/@tanstack/query-core/build/modern/hydration.js
 function defaultTransformerFn(data) {
 	return data;
@@ -22703,7 +22703,7 @@ var sections = [{
 		}
 	]
 }];
-var qgridVersion = "2.5.10";
+var qgridVersion = "2.6.1";
 function Sidebar({ className }) {
 	const pathname = useRouterState({ select: (s) => s.location.pathname });
 	const isActive = (path) => {
@@ -44584,11 +44584,11 @@ function RootComponent() {
 }
 //#endregion
 //#region src/routes/tokens.tsx
-var $$splitComponentImporter$4 = () => import("./assets/tokens-BWPVvdfi.js");
+var $$splitComponentImporter$4 = () => import("./assets/tokens-CvytQ9Xy.js");
 var Route$4 = createFileRoute("/tokens")({ component: lazyRouteComponent($$splitComponentImporter$4, "component") });
 //#endregion
 //#region src/routes/monit.tsx
-var $$splitComponentImporter$3 = () => import("./assets/monit--9mVsjNU.js");
+var $$splitComponentImporter$3 = () => import("./assets/monit-dBXxnAyI.js");
 var monitSearchSchema = object({ level: _enum([
 	"all",
 	"scaling",
@@ -44601,7 +44601,7 @@ var Route$3 = createFileRoute("/monit")({
 });
 //#endregion
 //#region src/routes/logs.tsx
-var $$splitComponentImporter$2 = () => import("./assets/logs-33YNafdW.js");
+var $$splitComponentImporter$2 = () => import("./assets/logs-D0z1Ghj1.js");
 var logsSearchSchema = object({
 	token: string().optional(),
 	project: string().optional(),
@@ -44613,11 +44613,11 @@ var Route$2 = createFileRoute("/logs")({
 });
 //#endregion
 //#region src/routes/index.tsx
-var $$splitComponentImporter$1 = () => import("./assets/routes-BK3Xh1UB.js");
+var $$splitComponentImporter$1 = () => import("./assets/routes-B3p7fuwk.js");
 var Route$1 = createFileRoute("/")({ component: lazyRouteComponent($$splitComponentImporter$1, "component") });
 //#endregion
 //#region src/routes/requests/show.tsx
-var $$splitComponentImporter = () => import("./assets/show-Dxxxe608.js");
+var $$splitComponentImporter = () => import("./assets/show-0iNioJ2I.js");
 var showSearchSchema = object({ id: number() });
 var Route = createFileRoute("/requests/show")({
 	validateSearch: showSearchSchema,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cartanova/qgrid-cli",
-  "version": "2.5.10",
+  "version": "2.6.1",
   "repository": {
     "type": "git",
     "url": "https://github.com/cartanova-ai/qgrid"

package/skills/qgrid/references/cli-env-and-server-boot.md

@@ -43,7 +43,6 @@ Sonamu's native `SONAMU_DB_HOST`, `SONAMU_DB_PORT`, `SONAMU_DB_USER`,
 | `NODE_ENV` | direct API: `development`; packaged CLI: `production` | Sonamu runtime profile. Use `staging` for remote non-production API deployments such as dev0. The profile does not create or rename the explicitly configured DB. |
 | `HOST` | `localhost` | Sonamu server listen host when running API directly. |
 | `PORT` | `44900` | Sonamu server listen port. In CLI mode this is derived from `--port`, not read as user input. |
-| `QGRID_PUBLIC_BASE_URL` | empty | Public base URL used to construct Anthropic OAuth callback URL. If unset, callback defaults to `http://localhost:${PORT}/callback`. |
 | `PROJECT_NAME` | `Qgrid` | Sonamu project name. Not the same as request log `projectName`. |
 
 Do not treat CLI bundle bootstrapping internals as user-facing qgrid configuration.
@@ -91,5 +90,5 @@ On shutdown, it stops provider dispatchers and the token subscriber.
 
 ## OAuth callbacks
 
-- Anthropic OAuth uses `/callback` on the qgrid server. The callback URL is based on `QGRID_PUBLIC_BASE_URL` when set, otherwise localhost and `PORT`.
+- Anthropic OAuth: loopback dashboards use `/callback` on the qgrid server (base derived per request from `Origin`, falling back to `X-Forwarded-Host`/`Host`). Remote dashboards cannot use a public callback (client redirect-URI allowlist), so `oauthStart` returns `mode: "code"` with the console callback and the user pastes the shown `code#state` into the dashboard (`oauthComplete`). No env configuration either way; direct non-HTTP calls fall back to localhost and `PORT`.
 - OpenAI OAuth is handled by Codex app-server's own callback flow and completed through qgrid's OpenAI OAuth APIs.

package/skills/qgrid/references/token-auth-quota-lifecycle.md

@@ -94,7 +94,11 @@ Anthropic OAuth is implemented directly in qgrid.
 6. Existing Anthropic tokens with the same `accountUuid` are deleted.
 7. qgrid saves a new `provider: "anthropic"` token.
 
-`QGRID_PUBLIC_BASE_URL` controls the public callback base. If unset, callback defaults to `http://localhost:${PORT}/callback`.
+The Anthropic OAuth client enforces a redirect-URI allowlist: loopback (`http://localhost:*/callback`) and the console callback (`https://console.anthropic.com/oauth/code/callback`) only — arbitrary public URLs cannot be registered. qgrid therefore picks the flow per request from the `Origin` header (falling back to `X-Forwarded-Host`/`Host`):
+
+- Loopback origin: redirect flow — the callback returns to the request-derived base URL (`mode: "redirect"`).
+- Remote origin: code flow — `redirect_uri` is the console callback; after login the console page shows `code#state`, which the user pastes into the dashboard and `oauthComplete` exchanges (`mode: "code"`, same flow as Claude Code CLI).
+- No HTTP context (direct calls/tests): falls back to `http://localhost:${PORT}/callback`.
 
 Refresh: