@cartanova/qgrid-cli 2.6.0 → 2.6.2

package/bundle/web-dist/server/assets/{tokens-DHU9lUT2.js → tokens-BA4vwDat.js}

@@ -1,7 +1,7 @@
 import { Z as __toESM, _ as require_jsx_runtime, g as useQueryClient, v as require_react } from "./sd.generated-ek-tz-7H.js";
-import { a as TokenService, n as QgridService } from "./services.generated-1Kcul41h.js";
+import { a as TokenService, n as QgridService } from "./services.generated-Bh7Vs8Ds.js";
 import { i as Q, o as lucideKeyRound } from "../entry-server.generated.js";
-import { t as useUpdateTokenMutation } from "./use-update-token-mutation-axqnye4L.js";
+import { t as useUpdateTokenMutation } from "./use-update-token-mutation-BQRzEPy2.js";
 //#region ~icons/lucide/plus.jsx
 var import_react = /* @__PURE__ */ __toESM(require_react());
 var import_jsx_runtime = require_jsx_runtime();
@@ -20,50 +20,168 @@ var lucidePlus = (props) => /* @__PURE__ */ (0, import_jsx_runtime.jsx)("svg", {
 	})
 });
 //#endregion
-//#region src/components/qgrid/AddTokenModal.tsx
-function AddTokenModal() {
-	const [open, setOpen] = (0, import_react.useState)(false);
-	const [oauthLoading, setOauthLoading] = (0, import_react.useState)(null);
-	const [name, setName] = (0, import_react.useState)("");
+//#region src/components/qgrid/OAuthCodeEntry.tsx
+/**
+* 원격 접속(code 모드) Claude 로그인의 코드 입력 단계.
+* Add Token 모달과 재로그인이 같은 문구·에러·재시작 동선을 쓰도록 한 곳에 둔다.
+*/
+function OAuthCodeEntry({ isPending, isError, onSubmit, onRestart }) {
+	const [pastedCode, setPastedCode] = (0, import_react.useState)("");
+	return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", {
+		className: "space-y-2",
+		children: [
+			/* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", {
+				className: "text-[12px] text-sand-600 leading-relaxed",
+				children: "새 탭에서 Claude 로그인을 완료하면 코드가 표시됩니다. 코드 전체를 아래에 붙여넣으세요."
+			}),
+			/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Q, {
+				value: pastedCode,
+				onChange: (e) => setPastedCode(e.target.value),
+				placeholder: "code#state",
+				className: "w-full border border-sand-200 rounded-md px-3 py-2 text-sm font-mono text-sand-900 bg-white placeholder:text-sand-300 focus:outline-none focus:border-sienna-300"
+			}),
+			isError && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", {
+				className: "text-[11px] text-red-500",
+				children: "코드 확인에 실패했습니다 — 표시된 코드 전체를 다시 붙여넣거나 로그인을 다시 시작하세요."
+			}),
+			/* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", {
+				type: "button",
+				className: "w-full py-2.5 text-sm font-medium rounded-md bg-sand-900 text-white hover:bg-sand-800 disabled:opacity-50 transition-colors duration-150 flex items-center justify-center gap-2",
+				disabled: !pastedCode.trim() || isPending,
+				onClick: () => onSubmit(pastedCode),
+				children: isPending ? /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("span", {
+					className: "flex items-center gap-1.5",
+					children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: "w-3.5 h-3.5 border-2 border-white border-t-transparent rounded-full animate-spin" }), "Verifying..."]
+				}) : "Complete login"
+			}),
+			/* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", {
+				type: "button",
+				className: "w-full py-1.5 text-[12px] text-sand-500 hover:text-sand-700 transition-colors duration-150",
+				onClick: () => {
+					setPastedCode("");
+					onRestart();
+				},
+				children: "처음부터 다시 시작"
+			})
+		]
+	});
+}
+//#endregion
+//#region src/components/qgrid/use-oauth-login-flow.ts
+var OPENAI_POLL_INTERVAL_MS = 3e3;
+var OPENAI_POLL_TIMEOUT_MS = 3e5;
+/** 캐시에 적재된 토큰 행 수. 폴링 조기 종료 판정에만 쓰는 근사치다. */
+function countTokens(queryClient) {
+	let total = 0;
+	for (const query of queryClient.getQueryCache().findAll({ queryKey: ["Token"] })) {
+		const rows = query.state.data?.rows;
+		if (Array.isArray(rows)) total = Math.max(total, rows.length);
+	}
+	return total;
+}
+/**
+* provider별 OAuth 로그인 시작과 코드 제출을 한 곳에 모은다.
+* Add Token 모달과 tokens 목록의 재로그인 버튼이 같은 플로우를 쓴다 — 두 진입점이
+* redirect/code 분기나 폴링 처리를 각자 구현하면 원격 접속 경험이 갈라진다.
+*/
+function useOAuthLoginFlow() {
+	const [loadingProvider, setLoadingProvider] = (0, import_react.useState)(null);
+	const [codeEntry, setCodeEntry] = (0, import_react.useState)(false);
 	const queryClient = useQueryClient();
 	const oauthStartMutation = QgridService.useOauthStartMutation();
 	const oauthStartOpenAIMutation = QgridService.useOauthStartOpenAIMutation();
-	const handleOAuthLogin = async (provider) => {
-		if (!name.trim()) return;
-		if (provider === "openai") {
-			const popup = window.open("about:blank", "_blank");
-			setOauthLoading("openai");
-			try {
-				const { authUrl } = await oauthStartOpenAIMutation.mutateAsync({ name: name.trim() });
+	const oauthCompleteMutation = QgridService.useOauthCompleteMutation();
+	const pollTimers = (0, import_react.useRef)({});
+	const stopPolling = () => {
+		if (pollTimers.current.interval !== void 0) clearInterval(pollTimers.current.interval);
+		if (pollTimers.current.timeout !== void 0) clearTimeout(pollTimers.current.timeout);
+		pollTimers.current = {};
+	};
+	(0, import_react.useEffect)(() => stopPolling, []);
+	const invalidateTokens = () => Promise.all([queryClient.invalidateQueries({ queryKey: ["Token"] }), queryClient.invalidateQueries({ queryKey: ["Qgrid"] })]);
+	const start = async (provider, name) => {
+		const trimmed = name.trim();
+		if (!trimmed) return;
+		const popup = window.open("about:blank", "_blank");
+		setLoadingProvider(provider);
+		try {
+			if (provider === "openai") {
+				const { authUrl } = await oauthStartOpenAIMutation.mutateAsync({ name: trimmed });
 				if (popup) popup.location.href = authUrl;
 				else window.open(authUrl, "_blank");
-				const poll = setInterval(async () => {
-					await queryClient.invalidateQueries({ queryKey: ["Token"] });
-					await queryClient.invalidateQueries({ queryKey: ["Qgrid"] });
-				}, 3e3);
-				setTimeout(() => {
-					clearInterval(poll);
-					setOauthLoading(null);
-				}, 3e5);
-			} catch (e) {
-				console.error("OAuth start failed:", e);
-				setOauthLoading(null);
+				const before = countTokens(queryClient);
+				stopPolling();
+				pollTimers.current.interval = window.setInterval(() => {
+					invalidateTokens().then(() => {
+						if (countTokens(queryClient) > before) {
+							stopPolling();
+							setLoadingProvider(null);
+						}
+					});
+				}, OPENAI_POLL_INTERVAL_MS);
+				pollTimers.current.timeout = window.setTimeout(() => {
+					stopPolling();
+					setLoadingProvider(null);
+				}, OPENAI_POLL_TIMEOUT_MS);
+				return;
 			}
-		} else {
-			setOauthLoading("anthropic");
-			try {
-				const { authUrl } = await oauthStartMutation.mutateAsync({ name: name.trim() });
+			const { authUrl, mode } = await oauthStartMutation.mutateAsync({ name: trimmed });
+			if (mode === "code") {
+				if (popup) popup.location.href = authUrl;
+				else window.open(authUrl, "_blank");
+				setCodeEntry(true);
+				setLoadingProvider(null);
+			} else {
+				popup?.close();
 				window.location.href = authUrl;
-			} catch (e) {
-				console.error("OAuth start failed:", e);
-				setOauthLoading(null);
 			}
+		} catch (e) {
+			popup?.close();
+			console.error("OAuth start failed:", e);
+			setLoadingProvider(null);
 		}
 	};
+	/** @returns 교환 성공 여부. 실패 시 `completeMutation.isError` 로 안내 문구를 띄운다. */
+	const submitCode = async (pastedCode) => {
+		const trimmed = pastedCode.trim();
+		if (!trimmed) return false;
+		try {
+			await oauthCompleteMutation.mutateAsync({ pastedCode: trimmed });
+		} catch (e) {
+			console.error("OAuth complete failed:", e);
+			return false;
+		}
+		await invalidateTokens();
+		return true;
+	};
+	const reset = () => {
+		stopPolling();
+		setLoadingProvider(null);
+		setCodeEntry(false);
+		oauthCompleteMutation.reset();
+	};
+	return {
+		loadingProvider,
+		codeEntry,
+		start,
+		submitCode,
+		reset,
+		completeMutation: oauthCompleteMutation
+	};
+}
+//#endregion
+//#region src/components/qgrid/AddTokenModal.tsx
+function AddTokenModal() {
+	const [open, setOpen] = (0, import_react.useState)(false);
+	const [name, setName] = (0, import_react.useState)("");
+	const oauth = useOAuthLoginFlow();
 	const close = () => {
 		setOpen(false);
 		setName("");
-		setOauthLoading(null);
+		oauth.reset();
+	};
+	const submitPastedCode = async (pastedCode) => {
+		if (await oauth.submitCode(pastedCode)) close();
 	};
 	return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [/* @__PURE__ */ (0, import_jsx_runtime.jsxs)("button", {
 		type: "button",
@@ -97,15 +215,20 @@ function AddTokenModal() {
 						onChange: (e) => setName(e.target.value),
 						placeholder: "e.g. your-token-name",
 						className: "mt-1 w-full border border-sand-200 rounded-md px-3 py-2 text-sm text-sand-900 bg-white placeholder:text-sand-300 focus:outline-none focus:border-sienna-300"
-					})] }), /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", {
+					})] }), oauth.codeEntry ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)(OAuthCodeEntry, {
+						isPending: oauth.completeMutation.isPending,
+						isError: oauth.completeMutation.isError,
+						onSubmit: (code) => void submitPastedCode(code),
+						onRestart: oauth.reset
+					}) : /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", {
 						className: "space-y-2",
 						children: [
 							/* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", {
 								type: "button",
 								className: "w-full py-2.5 text-sm font-medium rounded-md bg-sand-900 text-white hover:bg-sand-800 disabled:opacity-50 transition-colors duration-150 flex items-center justify-center gap-2",
-								disabled: !name.trim() || oauthLoading !== null,
-								onClick: () => handleOAuthLogin("openai"),
-								children: oauthLoading === "openai" ? /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("span", {
+								disabled: !name.trim() || oauth.loadingProvider !== null,
+								onClick: () => void oauth.start("openai", name),
+								children: oauth.loadingProvider === "openai" ? /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("span", {
 									className: "flex items-center gap-1.5",
 									children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: "w-3.5 h-3.5 border-2 border-white border-t-transparent rounded-full animate-spin" }), "Waiting for login..."]
 								}) : /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(lucideKeyRound, { className: "size-4" }), "Login with OpenAI"] })
@@ -124,11 +247,11 @@ function AddTokenModal() {
 							/* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", {
 								type: "button",
 								className: "w-full py-2.5 text-sm font-medium rounded-md border border-sand-300 text-sand-700 hover:bg-sand-100 disabled:opacity-50 transition-colors duration-150 flex items-center justify-center gap-2",
-								disabled: !name.trim() || oauthLoading !== null,
-								onClick: () => handleOAuthLogin("anthropic"),
-								children: oauthLoading === "anthropic" ? /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("span", {
+								disabled: !name.trim() || oauth.loadingProvider !== null,
+								onClick: () => void oauth.start("anthropic", name),
+								children: oauth.loadingProvider === "anthropic" ? /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("span", {
 									className: "flex items-center gap-1.5",
-									children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: "w-3.5 h-3.5 border-2 border-sand-400 border-t-transparent rounded-full animate-spin" }), "Redirecting..."]
+									children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: "w-3.5 h-3.5 border-2 border-sand-400 border-t-transparent rounded-full animate-spin" }), "Waiting for login..."]
 								}) : /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(lucideKeyRound, { className: "size-4" }), "Login with Claude"] })
 							})
 						]
@@ -222,6 +345,7 @@ function TokenTable({ data, isLoading }) {
 	const removeMutation = QgridService.useRemoveTokenMutation();
 	const updateMutation = useUpdateTokenMutation();
 	const toggleMutation = QgridService.useToggleTokenMutation();
+	const oauth = useOAuthLoginFlow();
 	const invalidate = () => Promise.all([queryClient.invalidateQueries({ queryKey: ["Token"] }), queryClient.invalidateQueries({ queryKey: ["Qgrid"] })]);
 	const handleToggle = async (token) => {
 		await toggleMutation.mutateAsync({ id: token.id });
@@ -233,6 +357,9 @@ function TokenTable({ data, isLoading }) {
 		await invalidate();
 		setDeleteTarget(null);
 	};
+	const submitReloginCode = async (pastedCode) => {
+		if (await oauth.submitCode(pastedCode)) oauth.reset();
+	};
 	const openEdit = (token) => {
 		setEditTarget(token);
 		setEditName(token.name ?? "");
@@ -344,17 +471,28 @@ function TokenTable({ data, isLoading }) {
 									className: "px-3 py-3",
 									children: /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", {
 										className: "flex items-center gap-1",
-										children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", {
-											type: "button",
-											className: "p-1 rounded text-sand-400 hover:text-sienna-500 transition-colors duration-150",
-											onClick: () => openEdit(token),
-											children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(lucidePencil, { className: "size-4" })
-										}), /* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", {
-											type: "button",
-											className: "p-1 rounded text-sand-400 hover:text-red-500 transition-colors duration-150",
-											onClick: () => setDeleteTarget(token),
-											children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(lucideTrash2, { className: "size-4" })
-										})]
+										children: [
+											!token.active && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", {
+												type: "button",
+												title: "기존 이름으로 다시 로그인",
+												className: "px-2 py-0.5 mr-1 text-[11px] font-medium rounded-md border border-sand-300 text-sand-600 hover:bg-sand-100 disabled:opacity-50 transition-colors duration-150 inline-flex items-center gap-1",
+												disabled: oauth.loadingProvider !== null,
+												onClick: () => void oauth.start(token.provider, token.name ?? ""),
+												children: oauth.loadingProvider === token.provider ? /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: "w-3 h-3 border-2 border-sand-400 border-t-transparent rounded-full animate-spin" }), "로그인 대기"] }) : "재로그인"
+											}),
+											/* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", {
+												type: "button",
+												className: "p-1 rounded text-sand-400 hover:text-sienna-500 transition-colors duration-150",
+												onClick: () => openEdit(token),
+												children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(lucidePencil, { className: "size-4" })
+											}),
+											/* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", {
+												type: "button",
+												className: "p-1 rounded text-sand-400 hover:text-red-500 transition-colors duration-150",
+												onClick: () => setDeleteTarget(token),
+												children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(lucideTrash2, { className: "size-4" })
+											})
+										]
 									})
 								})
 							]
@@ -363,6 +501,31 @@ function TokenTable({ data, isLoading }) {
 				})]
 			})
 		}),
+		oauth.codeEntry && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", {
+			className: "fixed inset-0 z-50 flex items-start justify-center pt-[15vh]",
+			children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", {
+				className: "absolute inset-0 bg-sand-900/8 backdrop-blur-sm",
+				onClick: oauth.reset,
+				onKeyDown: () => {}
+			}), /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", {
+				className: "relative panel shadow-xl w-full max-w-md mx-4",
+				children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", {
+					className: "px-5 py-4 border-b border-sand-100/60",
+					children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)("h3", {
+						className: "text-base font-medium text-sand-900",
+						children: "재로그인"
+					})
+				}), /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", {
+					className: "px-5 py-4",
+					children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(OAuthCodeEntry, {
+						isPending: oauth.completeMutation.isPending,
+						isError: oauth.completeMutation.isError,
+						onSubmit: (code) => void submitReloginCode(code),
+						onRestart: oauth.reset
+					})
+				})]
+			})]
+		}),
 		editTarget && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", {
 			className: "fixed inset-0 z-50 flex items-start justify-center pt-[15vh]",
 			children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", {

package/bundle/web-dist/server/assets/{use-update-token-mutation-axqnye4L.js → use-update-token-mutation-BQRzEPy2.js}

@@ -1,4 +1,4 @@
-import { n as QgridService, o as useMutation } from "./services.generated-1Kcul41h.js";
+import { n as QgridService, o as useMutation } from "./services.generated-Bh7Vs8Ds.js";
 //#region src/services/token/use-update-token-mutation.ts
 function useUpdateTokenMutation() {
 	return useMutation({ mutationFn: ({ id, name, quotaThreshold, weight }) => QgridService.updateToken(id, name, quotaThreshold, weight) });

package/bundle/web-dist/server/entry-server.generated.js

@@ -22703,7 +22703,7 @@ var sections = [{
 		}
 	]
 }];
-var qgridVersion = "2.6.0";
+var qgridVersion = "2.6.2";
 function Sidebar({ className }) {
 	const pathname = useRouterState({ select: (s) => s.location.pathname });
 	const isActive = (path) => {
@@ -44584,11 +44584,11 @@ function RootComponent() {
 }
 //#endregion
 //#region src/routes/tokens.tsx
-var $$splitComponentImporter$4 = () => import("./assets/tokens-DHU9lUT2.js");
+var $$splitComponentImporter$4 = () => import("./assets/tokens-BA4vwDat.js");
 var Route$4 = createFileRoute("/tokens")({ component: lazyRouteComponent($$splitComponentImporter$4, "component") });
 //#endregion
 //#region src/routes/monit.tsx
-var $$splitComponentImporter$3 = () => import("./assets/monit-Hm9dIPhx.js");
+var $$splitComponentImporter$3 = () => import("./assets/monit-DIsEsDJN.js");
 var monitSearchSchema = object({ level: _enum([
 	"all",
 	"scaling",
@@ -44601,7 +44601,7 @@ var Route$3 = createFileRoute("/monit")({
 });
 //#endregion
 //#region src/routes/logs.tsx
-var $$splitComponentImporter$2 = () => import("./assets/logs-Dbk2Ig2z.js");
+var $$splitComponentImporter$2 = () => import("./assets/logs-CwoOsveV.js");
 var logsSearchSchema = object({
 	token: string().optional(),
 	project: string().optional(),
@@ -44613,11 +44613,11 @@ var Route$2 = createFileRoute("/logs")({
 });
 //#endregion
 //#region src/routes/index.tsx
-var $$splitComponentImporter$1 = () => import("./assets/routes-DztxeUjk.js");
+var $$splitComponentImporter$1 = () => import("./assets/routes-Bts-KJ9W.js");
 var Route$1 = createFileRoute("/")({ component: lazyRouteComponent($$splitComponentImporter$1, "component") });
 //#endregion
 //#region src/routes/requests/show.tsx
-var $$splitComponentImporter = () => import("./assets/show-BHUSw7qv.js");
+var $$splitComponentImporter = () => import("./assets/show-DJfaCNUw.js");
 var showSearchSchema = object({ id: number() });
 var Route = createFileRoute("/requests/show")({
 	validateSearch: showSearchSchema,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cartanova/qgrid-cli",
-  "version": "2.6.0",
+  "version": "2.6.2",
   "repository": {
     "type": "git",
     "url": "https://github.com/cartanova-ai/qgrid"

package/skills/qgrid/references/cli-env-and-server-boot.md

@@ -90,5 +90,5 @@ On shutdown, it stops provider dispatchers and the token subscriber.
 
 ## OAuth callbacks
 
-- Anthropic OAuth uses `/callback` on the qgrid server. The callback base URL is derived per request from the browser-sent `Origin` header (falling back to `X-Forwarded-Host`/`Host`), so no env configuration is needed; direct non-HTTP calls fall back to localhost and `PORT`.
+- Anthropic OAuth: loopback dashboards use `/callback` on the qgrid server (base derived per request from `Origin`, falling back to `X-Forwarded-Host`/`Host`). Remote dashboards cannot use a public callback (client redirect-URI allowlist), so `oauthStart` returns `mode: "code"` with the console callback and the user pastes the shown `code#state` into the dashboard (`oauthComplete`). No env configuration either way; direct non-HTTP calls fall back to localhost and `PORT`.
 - OpenAI OAuth is handled by Codex app-server's own callback flow and completed through qgrid's OpenAI OAuth APIs.

package/skills/qgrid/references/token-auth-quota-lifecycle.md

@@ -94,7 +94,11 @@ Anthropic OAuth is implemented directly in qgrid.
 6. Existing Anthropic tokens with the same `accountUuid` are deleted.
 7. qgrid saves a new `provider: "anthropic"` token.
 
-The callback base is derived per request from the `Origin` header (falling back to `X-Forwarded-Host`/`Host`) — the address the dashboard is reached at is where the callback returns. Without an HTTP context it falls back to `http://localhost:${PORT}/callback`.
+The Anthropic OAuth client enforces a redirect-URI allowlist: loopback (`http://localhost:*/callback`) and the console callback (`https://console.anthropic.com/oauth/code/callback`) only — arbitrary public URLs cannot be registered. qgrid therefore picks the flow per request from the `Origin` header (falling back to `X-Forwarded-Host`/`Host`):
+
+- Loopback origin: redirect flow — the callback returns to the request-derived base URL (`mode: "redirect"`).
+- Remote origin: code flow — `redirect_uri` is the console callback; after login the console page shows `code#state`, which the user pastes into the dashboard and `oauthComplete` exchanges (`mode: "code"`, same flow as Claude Code CLI).
+- No HTTP context (direct calls/tests): falls back to `http://localhost:${PORT}/callback`.
 
 Refresh:
 
@@ -197,6 +201,17 @@ OpenAI token changes can create, update, deactivate, or kill persistent Codex wo
 
 Anthropic token changes only affect the in-memory token pool because every request fresh-spawns Claude Code.
 
+## Auth-Dead Detection And Token Registration
+
+When a refresh fails in a way that only re-login can fix, qgrid removes the token from routing instead of letting every subsequent request 401.
+
+- Detection lives at the existing refresh failure points, not a background scanner. OpenAI classifies on the error code (`refresh_token_expired`, `refresh_token_reused`, `refresh_token_invalidated`) regardless of HTTP status; Anthropic treats refresh 400/401 as auth-dead.
+- Before deactivating, qgrid re-reads the token and confirms the refresh token used by the failed attempt still matches the stored one. Anthropic refresh tokens rotate, so a late retry carrying an already-rotated token is a normal race, not a death — those are logged and skipped. `QgridFrame.refreshToken` also dedups concurrent refreshes per token.
+- Deactivation is one conditional `active=true → false` update. The process whose update affects a row is the only one that sends the Slack death notification, so a shared database produces exactly one alert per event.
+- The provider's last active token is never auto-deactivated. A systemic failure (client_id revocation, OAuth contract change) would otherwise empty the pool; qgrid logs an error and keeps the token instead.
+- The other notification is registration: a login whose account has no existing token sends one alert. Re-login replaces an existing row through the account dedup and stays silent, as does manually toggling a token back to active — neither is a new account joining the pool. When the provider response carries no account identifier, dedup is skipped entirely, so qgrid cannot tell new from returning and stays silent; it warns instead, making the unreplaced row diagnosable.
+- Notifications are fail-open: unset `SLACK_BOT_TOKEN`/`SLACK_CHANNEL_ID` is a silent no-op, and send failures (including HTTP 200 with `ok:false`) only warn. Payloads carry an internal reason code such as `anthropic:400`, never the raw provider response body.
+
 ## Quota Threshold Semantics
 
 `quota_threshold` is a routing gate, not a hard external-provider guarantee.