@cartanova/qgrid-cli 2.6.0 → 2.6.2

package/bundle/dist/utils/slack-notify.js

@@ -0,0 +1,65 @@
+import { getLogger } from "@logtape/logtape";
+//#region src/utils/slack-notify.ts
+/**
+* Slack 알림 (chat.postMessage).
+*
+* fail-open: env 미설정이면 조용히 no-op 이고, 전송 실패는 warn 로그로만 남긴다.
+* 알림 경로가 토큰 라우팅이나 오류 전파를 지연·차단해서는 안 된다.
+*/
+const logger = getLogger(["qgrid", "slack"]);
+const SLACK_POST_MESSAGE_URL = "https://slack.com/api/chat.postMessage";
+const SLACK_TIMEOUT_MS = 5e3;
+/** 상태를 색으로 먼저 읽히게 하는 attachment 색상 바. */
+const SLACK_COLOR = {
+	good: "#2eb886",
+	bad: "#e01e5a"
+};
+async function notifySlack(notification) {
+	const botToken = process.env.SLACK_BOT_TOKEN;
+	const channel = process.env.SLACK_CHANNEL_ID;
+	const { title, subject, context, color } = notification;
+	if (!botToken || !channel) {
+		logger.debug(`slack not configured, skipping notification: ${title} ${subject ?? ""}`);
+		return;
+	}
+	const blocks = [{
+		type: "section",
+		text: {
+			type: "mrkdwn",
+			text: subject ? `*${title}*  \`${subject}\`` : `*${title}*`
+		}
+	}];
+	if (context) blocks.push({
+		type: "context",
+		elements: [{
+			type: "mrkdwn",
+			text: context
+		}]
+	});
+	try {
+		const res = await fetch(SLACK_POST_MESSAGE_URL, {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/json; charset=utf-8",
+				Authorization: `Bearer ${botToken}`
+			},
+			body: JSON.stringify({
+				channel,
+				text: subject ? `${title} — ${subject}` : title,
+				attachments: [{
+					...color ? { color } : {},
+					blocks
+				}]
+			}),
+			signal: AbortSignal.timeout(SLACK_TIMEOUT_MS)
+		});
+		const body = await res.json().catch(() => null);
+		if (!body?.ok) logger.warn(`slack notification rejected: ${body?.error ?? `http ${res.status}`}`);
+	} catch (e) {
+		logger.warn(`slack notification failed: ${e.message}`);
+	}
+}
+//#endregion
+export { SLACK_COLOR, notifySlack };
+
+//# sourceMappingURL=data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2xhY2stbm90aWZ5LmpzIiwibmFtZXMiOltdLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy91dGlscy9zbGFjay1ub3RpZnkudHMiXSwic291cmNlc0NvbnRlbnQiOlsiLyoqXG4gKiBTbGFjayDslYzrprwgKGNoYXQucG9zdE1lc3NhZ2UpLlxuICpcbiAqIGZhaWwtb3BlbjogZW52IOuvuOyEpOygleydtOuptCDsobDsmqntnoggbm8tb3Ag7J206rOgLCDsoITshqEg7Iuk7Yyo64qUIHdhcm4g66Gc6re466Gc66eMIOuCqOq4tOuLpC5cbiAqIOyVjOumvCDqsr3roZzqsIAg7Yag7YGwIOudvOyasO2MheydtOuCmCDsmKTrpZgg7KCE7YyM66W8IOyngOyXsMK37LCo64uo7ZW07ISc64qUIOyViCDrkJzri6QuXG4gKi9cbmltcG9ydCB7IGdldExvZ2dlciB9IGZyb20gXCJAbG9ndGFwZS9sb2d0YXBlXCI7XG5cbmNvbnN0IGxvZ2dlciA9IGdldExvZ2dlcihbXCJxZ3JpZFwiLCBcInNsYWNrXCJdKTtcblxuY29uc3QgU0xBQ0tfUE9TVF9NRVNTQUdFX1VSTCA9IFwiaHR0cHM6Ly9zbGFjay5jb20vYXBpL2NoYXQucG9zdE1lc3NhZ2VcIjtcbmNvbnN0IFNMQUNLX1RJTUVPVVRfTVMgPSA1XzAwMDtcblxuLyoqIOyDge2DnOulvCDsg4nsnLzroZwg66i87KCAIOydve2eiOqyjCDtlZjripQgYXR0YWNobWVudCDsg4nsg4Eg67CULiAqL1xuZXhwb3J0IGNvbnN0IFNMQUNLX0NPTE9SID0ge1xuICBnb29kOiBcIiMyZWI4ODZcIixcbiAgYmFkOiBcIiNlMDFlNWFcIixcbn0gYXMgY29uc3Q7XG5cbmV4cG9ydCB0eXBlIFNsYWNrTm90aWZpY2F0aW9uID0ge1xuICAvKiog7ZWcIOykhCDsoJzrqqkuIOustOyKqCDsnbzsnbQg7J287Ja064Ks64qU7KeA66eMIOuLtOuKlOuLpC4gKi9cbiAgdGl0bGU6IHN0cmluZztcbiAgLyoqIOygnOuqqSDsmIYg7L2U65OcIOyKpO2DgOydvOuhnCDrtpnripQg64yA7IOBIOyLneuzhOyekC4gKi9cbiAgc3ViamVjdD86IHN0cmluZztcbiAgLyoqIOygnOuqqSDslYTrnpgg7J6R7J2AIOq4gOyUqOuhnCDrgrTroKTqsIDripQg67aA6rCAIOygleuztCDigJQg7J297KeAIOyViuyVhOuPhCDrkJjripQg6rKD65OkLiAqL1xuICBjb250ZXh0Pzogc3RyaW5nO1xuICBjb2xvcj86ICh0eXBlb2YgU0xBQ0tfQ09MT1IpW2tleW9mIHR5cGVvZiBTTEFDS19DT0xPUl07XG59O1xuXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gbm90aWZ5U2xhY2sobm90aWZpY2F0aW9uOiBTbGFja05vdGlmaWNhdGlvbik6IFByb21pc2U8dm9pZD4ge1xuICBjb25zdCBib3RUb2tlbiA9IHByb2Nlc3MuZW52LlNMQUNLX0JPVF9UT0tFTjtcbiAgY29uc3QgY2hhbm5lbCA9IHByb2Nlc3MuZW52LlNMQUNLX0NIQU5ORUxfSUQ7XG4gIGNvbnN0IHsgdGl0bGUsIHN1YmplY3QsIGNvbnRleHQsIGNvbG9yIH0gPSBub3RpZmljYXRpb247XG4gIGlmICghYm90VG9rZW4gfHwgIWNoYW5uZWwpIHtcbiAgICBsb2dnZXIuZGVidWcoYHNsYWNrIG5vdCBjb25maWd1cmVkLCBza2lwcGluZyBub3RpZmljYXRpb246ICR7dGl0bGV9ICR7c3ViamVjdCA/PyBcIlwifWApO1xuICAgIHJldHVybjtcbiAgfVxuXG4gIGNvbnN0IGJsb2NrczogdW5rbm93bltdID0gW1xuICAgIHtcbiAgICAgIHR5cGU6IFwic2VjdGlvblwiLFxuICAgICAgdGV4dDogeyB0eXBlOiBcIm1ya2R3blwiLCB0ZXh0OiBzdWJqZWN0ID8gYCoke3RpdGxlfSogIFxcYCR7c3ViamVjdH1cXGBgIDogYCoke3RpdGxlfSpgIH0sXG4gICAgfSxcbiAgXTtcbiAgaWYgKGNvbnRleHQpIHtcbiAgICBibG9ja3MucHVzaCh7IHR5cGU6IFwiY29udGV4dFwiLCBlbGVtZW50czogW3sgdHlwZTogXCJtcmtkd25cIiwgdGV4dDogY29udGV4dCB9XSB9KTtcbiAgfVxuXG4gIHRyeSB7XG4gICAgY29uc3QgcmVzID0gYXdhaXQgZmV0Y2goU0xBQ0tfUE9TVF9NRVNTQUdFX1VSTCwge1xuICAgICAgbWV0aG9kOiBcIlBPU1RcIixcbiAgICAgIGhlYWRlcnM6IHtcbiAgICAgICAgXCJDb250ZW50LVR5cGVcIjogXCJhcHBsaWNhdGlvbi9qc29uOyBjaGFyc2V0PXV0Zi04XCIsXG4gICAgICAgIEF1dGhvcml6YXRpb246IGBCZWFyZXIgJHtib3RUb2tlbn1gLFxuICAgICAgfSxcbiAgICAgIGJvZHk6IEpTT04uc3RyaW5naWZ5KHtcbiAgICAgICAgY2hhbm5lbCxcbiAgICAgICAgLy8g7JWM66a8IOuvuOumrOuztOq4sMK37KCR6re87ISx7JqpIOuMgOyytCDthY3siqTtirguIGJsb2NrcyDrp4wg67O064K066m0IO2RuOyLnCDslYzrprzsnbQg67mI7Lm47Jy866GcIOucrOuLpC5cbiAgICAgICAgdGV4dDogc3ViamVjdCA/IGAke3RpdGxlfSDigJQgJHtzdWJqZWN0fWAgOiB0aXRsZSxcbiAgICAgICAgYXR0YWNobWVudHM6IFt7IC4uLihjb2xvciA/IHsgY29sb3IgfSA6IHt9KSwgYmxvY2tzIH1dLFxuICAgICAgfSksXG4gICAgICBzaWduYWw6IEFib3J0U2lnbmFsLnRpbWVvdXQoU0xBQ0tfVElNRU9VVF9NUyksXG4gICAgfSk7XG5cbiAgICAvLyBib3Qg66+47LSI64yAKG5vdF9pbl9jaGFubmVsKcK37J6Y66q765CcIOyxhOuEkCDrk7Eg6rCA7J6lIO2dlO2VnCDsmKTshKTsoJXsnYAgSFRUUCAyMDAgKyBvazpmYWxzZSDroZwg7Jio64ukLlxuICAgIC8vIHN0YXR1cyDrp4wg67O066m0IOyhsOyaqe2eiCDshLHqs7Ug7LKY66as64+8IOyVjOumvOydtCDthrXsp7jroZwg7IKs65287KeE64ukLlxuICAgIGNvbnN0IGJvZHkgPSAoYXdhaXQgcmVzLmpzb24oKS5jYXRjaCgoKSA9PiBudWxsKSkgYXMgeyBvaz86IGJvb2xlYW47IGVycm9yPzogc3RyaW5nIH0gfCBudWxsO1xuICAgIGlmICghYm9keT8ub2spIHtcbiAgICAgIGxvZ2dlci53YXJuKGBzbGFjayBub3RpZmljYXRpb24gcmVqZWN0ZWQ6ICR7Ym9keT8uZXJyb3IgPz8gYGh0dHAgJHtyZXMuc3RhdHVzfWB9YCk7XG4gICAgfVxuICB9IGNhdGNoIChlKSB7XG4gICAgbG9nZ2VyLndhcm4oYHNsYWNrIG5vdGlmaWNhdGlvbiBmYWlsZWQ6ICR7KGUgYXMgRXJyb3IpLm1lc3NhZ2V9YCk7XG4gIH1cbn1cbiJdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7QUFRQSxNQUFNLFNBQVMsVUFBVSxDQUFDLFNBQVMsT0FBTyxDQUFDO0FBRTNDLE1BQU0seUJBQXlCO0FBQy9CLE1BQU0sbUJBQW1COztBQUd6QixNQUFhLGNBQWM7Q0FDekIsTUFBTTtDQUNOLEtBQUs7QUFDUDtBQVlBLGVBQXNCLFlBQVksY0FBZ0Q7Q0FDaEYsTUFBTSxXQUFXLFFBQVEsSUFBSTtDQUM3QixNQUFNLFVBQVUsUUFBUSxJQUFJO0NBQzVCLE1BQU0sRUFBRSxPQUFPLFNBQVMsU0FBUyxVQUFVO0NBQzNDLElBQUksQ0FBQyxZQUFZLENBQUMsU0FBUztFQUN6QixPQUFPLE1BQU0sZ0RBQWdELE1BQU0sR0FBRyxXQUFXLElBQUk7RUFDckY7Q0FDRjtDQUVBLE1BQU0sU0FBb0IsQ0FDeEI7RUFDRSxNQUFNO0VBQ04sTUFBTTtHQUFFLE1BQU07R0FBVSxNQUFNLFVBQVUsSUFBSSxNQUFNLE9BQU8sUUFBUSxNQUFNLElBQUksTUFBTTtFQUFHO0NBQ3RGLENBQ0Y7Q0FDQSxJQUFJLFNBQ0YsT0FBTyxLQUFLO0VBQUUsTUFBTTtFQUFXLFVBQVUsQ0FBQztHQUFFLE1BQU07R0FBVSxNQUFNO0VBQVEsQ0FBQztDQUFFLENBQUM7Q0FHaEYsSUFBSTtFQUNGLE1BQU0sTUFBTSxNQUFNLE1BQU0sd0JBQXdCO0dBQzlDLFFBQVE7R0FDUixTQUFTO0lBQ1AsZ0JBQWdCO0lBQ2hCLGVBQWUsVUFBVTtHQUMzQjtHQUNBLE1BQU0sS0FBSyxVQUFVO0lBQ25CO0lBRUEsTUFBTSxVQUFVLEdBQUcsTUFBTSxLQUFLLFlBQVk7SUFDMUMsYUFBYSxDQUFDO0tBQUUsR0FBSSxRQUFRLEVBQUUsTUFBTSxJQUFJLENBQUM7S0FBSTtJQUFPLENBQUM7R0FDdkQsQ0FBQztHQUNELFFBQVEsWUFBWSxRQUFRLGdCQUFnQjtFQUM5QyxDQUFDO0VBSUQsTUFBTSxPQUFRLE1BQU0sSUFBSSxLQUFLLENBQUMsQ0FBQyxZQUFZLElBQUk7RUFDL0MsSUFBSSxDQUFDLE1BQU0sSUFDVCxPQUFPLEtBQUssZ0NBQWdDLE1BQU0sU0FBUyxRQUFRLElBQUksVUFBVTtDQUVyRixTQUFTLEdBQUc7RUFDVixPQUFPLEtBQUssOEJBQStCLEVBQVksU0FBUztDQUNsRTtBQUNGIn0=

package/bundle/src/application/qgrid/oauth.ts

@@ -20,6 +20,9 @@ const logger = getLogger(["qgrid", "oauth"]);
 const CLIENT_ID = "9d1c250a-e61b-44d9-88ed-5944d1962f5e";
 const AUTHORIZE_URL = "https://claude.com/cai/oauth/authorize";
 const TOKEN_URL = "https://platform.claude.com/v1/oauth/token";
+// client 허용 목록에 있는 콘솔 콜백. 인증 후 콘솔 페이지가 `code#state`를 표시하고
+// 사용자가 붙여넣는 코드 플로우(Claude Code CLI와 동일)에 사용한다.
+export const CONSOLE_CALLBACK_URL = "https://console.anthropic.com/oauth/code/callback";
 
 // login 시 사용 (authorize URL)
 const ALL_SCOPES = [
@@ -114,6 +117,25 @@ export async function exchangeCodeForTokens(
   };
 }
 
+/**
+ * refresh 실패를 status 와 함께 전달한다. 호출부가 문자열 메시지를 파싱하지 않고
+ * 영구 실패(400/401)를 판별할 수 있어야 하기 때문이다.
+ */
+export class RefreshFailedError extends Error {
+  override readonly name = "RefreshFailedError";
+  constructor(
+    readonly status: number,
+    readonly body: string,
+  ) {
+    super(`Token refresh failed (${status}): ${body}`);
+  }
+
+  /** 재로그인 외 복구 불가한 인증 실패인지. 일시 오류(5xx·네트워크)는 제외된다. */
+  get isAuthDead(): boolean {
+    return this.status === 400 || this.status === 401;
+  }
+}
+
 export async function refreshAccessToken(refreshToken: string): Promise<OAuthTokens> {
   const res = await fetch(TOKEN_URL, {
     method: "POST",
@@ -127,7 +149,7 @@ export async function refreshAccessToken(refreshToken: string): Promise<OAuthTok
   });
   if (!res.ok) {
     const text = await res.text();
-    throw new Error(`Token refresh failed (${res.status}): ${text}`);
+    throw new RefreshFailedError(res.status, text);
   }
   const data = (await res.json()) as {
     access_token: string;

package/bundle/src/application/qgrid/qgrid-oauth-redirect.test.ts

@@ -1,22 +1,69 @@
 import { Sonamu } from "sonamu";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 
+import { CONSOLE_CALLBACK_URL } from "./oauth";
 import { QgridFrame } from "./qgrid.frame";
 
-// oauthStart 는 PKCE 상태를 cache 에 저장한다 — redirect 파생 검증에는 실제 cache 가 필요 없다.
-vi.mock("sonamu/cache", () => ({
-  getCacheManagerRef: () => ({
-    set: vi.fn(async () => {}),
-    get: vi.fn(async () => undefined),
-    delete: vi.fn(async () => {}),
-  }),
+const { exchangeMock, tokenSaveMock, tokenDelMock, findByAccountMock } = vi.hoisted(() => ({
+  exchangeMock: vi.fn(),
+  tokenSaveMock: vi.fn(async () => [1]),
+  tokenDelMock: vi.fn(async () => 1),
+  findByAccountMock: vi.fn(async () => []),
 }));
 
-function redirectUriOf(authUrl: string): string | null {
-  return new URL(authUrl).searchParams.get("redirect_uri");
+// oauthStart 는 PKCE 상태를 cache 에 저장한다 — Map 스텁으로 왕복만 지원한다.
+vi.mock("sonamu/cache", () => {
+  const store = new Map<string, string>();
+  return {
+    getCacheManagerRef: () => ({
+      set: vi.fn(async ({ key, value }: { key: string; value: string }) => {
+        store.set(key, value);
+      }),
+      get: vi.fn(async ({ key }: { key: string }) => store.get(key)),
+      delete: vi.fn(async ({ key }: { key: string }) => {
+        store.delete(key);
+      }),
+    }),
+  };
+});
+
+vi.mock("./oauth", async (importOriginal) => ({
+  ...(await importOriginal<typeof import("./oauth")>()),
+  exchangeCodeForTokens: exchangeMock,
+}));
+
+vi.mock("../token/token.model", () => ({
+  TokenModel: {
+    save: tokenSaveMock,
+    del: tokenDelMock,
+    findByAccountIdentifier: findByAccountMock,
+    // 실제 구현과 같은 순서(dedup → save)로 동작시켜 저장 payload 검증이 유지되게 한다.
+    replaceByAccount: async (
+      _provider: string,
+      accountId: string | undefined,
+      saveParams: unknown,
+    ) => {
+      let isNew = false;
+      if (accountId) {
+        const olds = (await findByAccountMock()) as unknown as { id: number; active: boolean }[];
+        if (olds.length > 0) await tokenDelMock();
+        else isNew = true;
+      }
+      await (tokenSaveMock as unknown as (rows: unknown[]) => Promise<number[]>)([saveParams]);
+      return { isNew };
+    },
+  },
+}));
+
+function authUrlParam(authUrl: string, key: string): string | null {
+  return new URL(authUrl).searchParams.get(key);
+}
+
+function mockHttpContext(headers: Record<string, string>, protocol = "http"): void {
+  vi.spyOn(Sonamu, "getContext").mockReturnValue({ headers, request: { protocol } } as never);
 }
 
-describe("QgridFrame.oauthStart redirect derivation", () => {
+describe("QgridFrame.oauthStart redirect resolution", () => {
   let savedPort: string | undefined;
 
   beforeEach(() => {
@@ -29,32 +76,91 @@ describe("QgridFrame.oauthStart redirect derivation", () => {
     vi.restoreAllMocks();
   });
 
-  it("derives the callback from the browser-sent Origin header", async () => {
-    vi.spyOn(Sonamu, "getContext").mockReturnValue({
-      headers: { origin: "https://qgrid.example.com" },
-      request: { protocol: "https" },
-    } as never);
+  it("uses the redirect flow with the request-derived callback on loopback origins", async () => {
+    mockHttpContext({ origin: "http://localhost:44900" });
+
+    const { authUrl, mode } = await QgridFrame.oauthStart("tok");
+    expect(mode).toBe("redirect");
+    expect(authUrlParam(authUrl, "redirect_uri")).toBe("http://localhost:44900/callback");
+  });
+
+  it("switches to the code flow with the console callback on remote origins", async () => {
+    mockHttpContext({ origin: "https://qgrid.example.com" });
 
-    const { authUrl } = await QgridFrame.oauthStart("tok");
-    expect(redirectUriOf(authUrl)).toBe("https://qgrid.example.com/callback");
+    const { authUrl, mode } = await QgridFrame.oauthStart("tok");
+    expect(mode).toBe("code");
+    expect(authUrlParam(authUrl, "redirect_uri")).toBe(CONSOLE_CALLBACK_URL);
   });
 
-  it("falls back to forwarded proto and host headers when Origin is absent", async () => {
-    vi.spyOn(Sonamu, "getContext").mockReturnValue({
-      headers: { host: "dev0.cartanova.ai:44900", "x-forwarded-proto": "https" },
-      request: { protocol: "http" },
-    } as never);
+  it("treats forwarded remote hosts as the code flow when Origin is absent", async () => {
+    mockHttpContext({ host: "qgrid.example.com", "x-forwarded-proto": "https" });
 
-    const { authUrl } = await QgridFrame.oauthStart("tok");
-    expect(redirectUriOf(authUrl)).toBe("https://dev0.cartanova.ai:44900/callback");
+    const { authUrl, mode } = await QgridFrame.oauthStart("tok");
+    expect(mode).toBe("code");
+    expect(authUrlParam(authUrl, "redirect_uri")).toBe(CONSOLE_CALLBACK_URL);
   });
 
-  it("falls back to localhost without an HTTP context", async () => {
+  it("falls back to the localhost redirect flow without an HTTP context", async () => {
     vi.spyOn(Sonamu, "getContext").mockImplementation(() => {
       throw new Error("no context");
     });
 
-    const { authUrl } = await QgridFrame.oauthStart("tok");
-    expect(redirectUriOf(authUrl)).toBe("http://localhost:44900/callback");
+    const { authUrl, mode } = await QgridFrame.oauthStart("tok");
+    expect(mode).toBe("redirect");
+    expect(authUrlParam(authUrl, "redirect_uri")).toBe("http://localhost:44900/callback");
+  });
+});
+
+describe("QgridFrame.oauthComplete code flow", () => {
+  afterEach(() => {
+    vi.restoreAllMocks();
+    exchangeMock.mockReset();
+    tokenSaveMock.mockClear();
+    findByAccountMock.mockClear().mockResolvedValue([]);
+  });
+
+  it("exchanges a pasted code#state against the stored pending state and saves the token", async () => {
+    mockHttpContext({ origin: "https://qgrid.example.com" });
+    const { authUrl } = await QgridFrame.oauthStart("test-token-2");
+    const state = authUrlParam(authUrl, "state")!;
+
+    exchangeMock.mockResolvedValueOnce({
+      accessToken: "at",
+      refreshToken: "rt",
+      expiresAt: 123,
+      scope: "user:inference",
+      accountUuid: "acc-1",
+    });
+
+    await expect(QgridFrame.oauthComplete(`  the-code#${state} `)).resolves.toEqual({
+      added: true,
+      name: "test-token-2",
+    });
+
+    expect(exchangeMock).toHaveBeenCalledWith(
+      "the-code",
+      expect.any(String),
+      state,
+      CONSOLE_CALLBACK_URL,
+    );
+    expect(tokenSaveMock).toHaveBeenCalledWith([
+      expect.objectContaining({
+        provider: "anthropic",
+        name: "test-token-2",
+        credentials: expect.objectContaining({ accessToken: "at", accountUuid: "acc-1" }),
+      }),
+    ]);
+  });
+
+  it("rejects input without a #state part", async () => {
+    await expect(QgridFrame.oauthComplete("just-a-code")).rejects.toThrow(/code#state/);
+    expect(exchangeMock).not.toHaveBeenCalled();
+  });
+
+  it("rejects an unknown or expired state", async () => {
+    await expect(QgridFrame.oauthComplete("code#no-such-state")).rejects.toThrow(
+      /not found or expired/,
+    );
+    expect(exchangeMock).not.toHaveBeenCalled();
   });
 });

package/bundle/src/application/qgrid/qgrid.frame.ts

@@ -13,16 +13,19 @@ import {
 } from "../../utils/providers/common/credentials";
 import { CallerSchemaValidationError } from "../../utils/providers/common/schema-validation";
 import { MICRO_USD, RequestLogModel } from "../request-log/request-log.model";
+import { type RequestLogListParams } from "../request-log/request-log.types";
 import { type TokenSubsetA } from "../sonamu.generated";
 import { TokenModel, type TokenUpdateFields } from "../token/token.model";
 import { TokenCredentials } from "../token/token.types";
 import {
   type AnthropicUsageRaw,
   buildAuthUrl,
+  CONSOLE_CALLBACK_URL,
   exchangeCodeForTokens,
   fetchUsage,
   generatePKCE,
   refreshAccessToken,
+  RefreshFailedError,
 } from "./oauth";
 import {
   afterQuery,
@@ -44,6 +47,7 @@ import {
   type TokenStats,
   type UsageResponse,
 } from "./qgrid.types";
+import { deactivateAuthDeadToken, notifyTokenAdded } from "./token-death";
 import { ToolSchemaCompositionError } from "./tool-emulation-schema";
 
 const pendingStreams = new Map<string, QueryInput>();
@@ -80,15 +84,14 @@ async function deleteOAuthState(state: string): Promise<void> {
   await cache.delete({ key: `${OAUTH_STATE_PREFIX}${state}` });
 }
 
-// OAuth callback 은 대시보드가 접속한 qgrid 주소로 돌아온다. 브라우저가 보낸
-// Origin(우선) 또는 Host 헤더에서 base URL 을 파생하므로 별도 env 설정이 필요 없다.
-// HTTP context 가 없는 직접 호출(테스트 등)만 localhost 로 폴백한다.
-function getOAuthRedirectUri(): string {
+// OAuth 접속 주소는 브라우저가 보낸 Origin(우선) 또는 Host 헤더에서 파생한다.
+// HTTP context 가 없는 직접 호출(테스트 등)은 null 을 반환한다.
+function deriveRequestBaseUrl(): string | null {
   try {
     const { headers, request } = Sonamu.getContext();
     const origin = headers.origin;
     if (typeof origin === "string" && /^https?:\/\//.test(origin)) {
-      return `${origin.replace(/\/+$/, "")}/callback`;
+      return origin.replace(/\/+$/, "");
     }
     const forwardedHost = headers["x-forwarded-host"];
     const host = (Array.isArray(forwardedHost) ? forwardedHost[0] : forwardedHost) ?? headers.host;
@@ -97,12 +100,34 @@ function getOAuthRedirectUri(): string {
       const proto =
         (Array.isArray(forwardedProto) ? forwardedProto[0] : forwardedProto)?.split(",")[0] ??
         request.protocol;
-      return `${proto}://${host}/callback`;
+      return `${proto}://${host}`;
     }
   } catch {
     // direct frame call — HTTP context 없음
   }
-  return `http://localhost:${process.env.PORT ?? "44900"}/callback`;
+  return null;
+}
+
+const LOOPBACK_HOSTNAMES = new Set(["localhost", "127.0.0.1", "[::1]", "::1"]);
+
+function isLoopbackBase(base: string): boolean {
+  try {
+    return LOOPBACK_HOSTNAMES.has(new URL(base).hostname);
+  } catch {
+    return false;
+  }
+}
+
+// Anthropic OAuth client 는 redirect_uri 허용 목록을 강제한다: 루프백(localhost)과
+// 콘솔 콜백만 허용된다. 따라서 루프백 접속은 자동 리다이렉트 플로우를,
+// 원격 접속은 콘솔 콜백 + 코드 붙여넣기 플로우(Claude Code CLI 와 동일)를 쓴다.
+function resolveOAuthRedirect(): { redirectUri: string; mode: "redirect" | "code" } {
+  const base = deriveRequestBaseUrl();
+  if (base && !isLoopbackBase(base)) {
+    return { redirectUri: CONSOLE_CALLBACK_URL, mode: "code" };
+  }
+  const loopbackBase = base ?? `http://localhost:${process.env.PORT ?? "44900"}`;
+  return { redirectUri: `${loopbackBase}/callback`, mode: "redirect" };
 }
 
 function rejectImageGenerationStream(args: QueryInput): void {
@@ -175,6 +200,9 @@ function createHttpDisconnectHandle(): {
 const logger = getLogger(["qgrid"]);
 const oauthLogger = getLogger(["qgrid", "oauth"]);
 
+// per-token refresh dedup — 회전 겹침으로 인한 사망 오판을 막는다.
+const inflightAnthropicRefresh = new Map<number, Promise<string>>();
+
 class QgridFrameClass extends BaseFrameClass {
   constructor() {
     super("Qgrid");
@@ -442,9 +470,11 @@ class QgridFrameClass extends BaseFrameClass {
     return QgridDispatcher.getStats();
   }
 
+  // 화면의 목록 필터를 그대로 받아 같은 조건의 합계를 돌려준다 — 목록과 비용이
+  // 서로 다른 모수를 보면 사용자에게는 숫자가 어긋난 것으로 읽힌다.
   @api({ httpMethod: "GET", clients: ["axios", "tanstack-query"] })
-  async totalCost(tokenName?: string): Promise<{ usd: number }> {
-    return { usd: await RequestLogModel.totalCost({ token_name: tokenName }) };
+  async totalCost(params?: RequestLogListParams): Promise<{ usd: number }> {
+    return { usd: await RequestLogModel.totalCost(params) };
   }
 
   @api({ httpMethod: "GET", clients: ["axios", "tanstack-query"] })
@@ -533,12 +563,64 @@ class QgridFrameClass extends BaseFrameClass {
   async oauthStart(name: string): Promise<OAuthStartResult> {
     const { codeVerifier, codeChallenge, state } = generatePKCE();
 
-    const redirectUri = getOAuthRedirectUri();
+    const { redirectUri, mode } = resolveOAuthRedirect();
     const authUrl = buildAuthUrl(codeChallenge, state, redirectUri);
 
     await setOAuthState(state, { codeVerifier, name, redirectUri });
 
-    return { authUrl };
+    return { authUrl, mode };
+  }
+
+  // 코드 붙여넣기 플로우(원격 접속): 콘솔 콜백이 표시한 `code#state` 를 받아 교환한다.
+  @api({ httpMethod: "POST", clients: ["axios", "tanstack-mutation"] })
+  async oauthComplete(pastedCode: string): Promise<{ added: boolean; name: string }> {
+    const trimmed = pastedCode.trim();
+    const separatorAt = trimmed.indexOf("#");
+    const code = separatorAt > 0 ? trimmed.slice(0, separatorAt) : "";
+    const state = separatorAt > 0 ? trimmed.slice(separatorAt + 1) : "";
+    if (!code || !state) {
+      throw new BadRequestException(
+        "expected the code shown after login, in code#state form" as LocalizedString,
+      );
+    }
+
+    const pending = await getOAuthState(state);
+    if (!pending) {
+      throw new BadRequestException(
+        "login session not found or expired — start the login again" as LocalizedString,
+      );
+    }
+    await deleteOAuthState(state);
+
+    await this.completeAnthropicLogin(code, state, pending);
+    return { added: true, name: pending.name };
+  }
+
+  // 교환 + 계정 중복 제거 + 저장 — redirect 콜백과 코드 붙여넣기 플로우가 공유한다.
+  private async completeAnthropicLogin(
+    code: string,
+    state: string,
+    pending: PendingOAuth,
+  ): Promise<void> {
+    const tokens = await exchangeCodeForTokens(
+      code,
+      pending.codeVerifier,
+      state,
+      pending.redirectUri,
+    );
+
+    const { isNew } = await TokenModel.replaceByAccount("anthropic", tokens.accountUuid, {
+      provider: "anthropic",
+      credentials: {
+        accessToken: tokens.accessToken,
+        refreshToken: tokens.refreshToken,
+        expiresAt: tokens.expiresAt ?? 0,
+        accountUuid: tokens.accountUuid ?? "",
+      },
+      name: pending.name,
+    });
+
+    if (isNew) notifyTokenAdded(pending.name, "anthropic");
   }
 
   async handleOAuthCallback(code: string, state: string, reply: FastifyReply): Promise<void> {
@@ -550,37 +632,7 @@ class QgridFrameClass extends BaseFrameClass {
     await deleteOAuthState(state);
 
     try {
-      const tokens = await exchangeCodeForTokens(
-        code,
-        pending.codeVerifier,
-        state,
-        pending.redirectUri,
-      );
-
-      if (tokens.accountUuid) {
-        const oldEntries = await TokenModel.findByAccountIdentifier(
-          "A",
-          "anthropic",
-          tokens.accountUuid,
-        );
-        if (oldEntries.length > 0) {
-          await TokenModel.del(oldEntries.map((o) => o.id));
-        }
-      }
-
-      await TokenModel.save([
-        {
-          provider: "anthropic",
-          credentials: {
-            accessToken: tokens.accessToken,
-            refreshToken: tokens.refreshToken,
-            expiresAt: tokens.expiresAt ?? 0,
-            accountUuid: tokens.accountUuid ?? "",
-          },
-          name: pending.name,
-        },
-      ]);
-
+      await this.completeAnthropicLogin(code, state, pending);
       return reply.redirect(`/?oauth=success&name=${encodeURIComponent(pending.name)}`);
     } catch (e) {
       return reply.redirect(`/?oauth=error&reason=${encodeURIComponent((e as Error).message)}`);
@@ -596,36 +648,25 @@ class QgridFrameClass extends BaseFrameClass {
     QgridDispatcher.openaiDispatcher
       .completeBrowserLogin()
       .then(async (creds) => {
-        if (creds.accountId) {
-          const oldEntries = await TokenModel.findByAccountIdentifier(
-            "A",
-            "openai",
-            creds.accountId,
-          );
-          if (oldEntries.length > 0) {
-            await TokenModel.del(oldEntries.map((o) => o.id));
-          }
-        }
-        await TokenModel.save([
-          {
-            provider: "openai",
-            credentials: {
-              accessToken: creds.accessToken,
-              refreshToken: creds.refreshToken,
-              idToken: creds.idToken,
-              accessTokenExpiresAt: Date.now() + 10 * 24 * 3600 * 1000,
-              accountId: creds.accountId,
-            },
-            name,
+        const { isNew } = await TokenModel.replaceByAccount("openai", creds.accountId, {
+          provider: "openai",
+          credentials: {
+            accessToken: creds.accessToken,
+            refreshToken: creds.refreshToken,
+            idToken: creds.idToken,
+            accessTokenExpiresAt: Date.now() + 10 * 24 * 3600 * 1000,
+            accountId: creds.accountId,
           },
-        ]);
+          name,
+        });
         logger.info(`OpenAI token saved for ${name}`);
+        if (isNew) notifyTokenAdded(name, "openai");
       })
       .catch((e) => {
         logger.warn(`OpenAI browser login failed: ${(e as Error).message}`);
       });
 
-    return { authUrl };
+    return { authUrl, mode: "redirect" };
   }
 
   @api({ httpMethod: "GET", clients: ["axios", "tanstack-query"] })
@@ -699,11 +740,36 @@ class QgridFrameClass extends BaseFrameClass {
     return convertAnthropicUsage(raw);
   }
 
+  // 동시 refresh 가 회전을 겹치면 뒤늦은 호출이 이미 폐기된 refresh token 을 쓰게 되어
+  // 멀쩡한 토큰이 사망으로 오판된다. openai-refresh.ts 와 같은 per-token dedup 을 둔다.
   async refreshToken(token: TokenSubsetA): Promise<string> {
+    const inflight = inflightAnthropicRefresh.get(token.id);
+    if (inflight) return inflight;
+
+    const promise = this.doRefreshToken(token);
+    inflightAnthropicRefresh.set(token.id, promise);
+    try {
+      return await promise;
+    } finally {
+      inflightAnthropicRefresh.delete(token.id);
+    }
+  }
+
+  private async doRefreshToken(token: TokenSubsetA): Promise<string> {
     const creds = token.credentials;
     const rt = getRefreshToken(creds);
     if (!rt) throw new Error("No refresh token");
-    const refreshed = await refreshAccessToken(rt);
+
+    let refreshed;
+    try {
+      refreshed = await refreshAccessToken(rt);
+    } catch (e) {
+      if (e instanceof RefreshFailedError && e.isAuthDead) {
+        await deactivateAuthDeadToken(token, rt, `anthropic:${e.status}`);
+      }
+      throw e;
+    }
+
     const updated = TokenCredentials.parse({
       ...creds,
       accessToken: refreshed.accessToken,

package/bundle/src/application/qgrid/qgrid.types.ts

@@ -274,6 +274,9 @@ export type TokenStats = z.infer<typeof TokenStats>;
 
 export const OAuthStartResult = z.object({
   authUrl: z.string(),
+  // redirect: 브라우저 자동 복귀(루프백 접속). code: 콘솔 콜백 + 코드 붙여넣기(원격 접속).
+  // OpenAI 경로는 codex 가 콜백을 처리하므로 항상 redirect 를 반환한다.
+  mode: z.enum(["redirect", "code"]),
 });
 export type OAuthStartResult = z.infer<typeof OAuthStartResult>;