@cartanova/qgrid-cli 2.7.0 → 2.7.2

package/bundle/src/application/qgrid/qgrid.frame.test.ts

@@ -22,23 +22,29 @@ const {
   finishRunWithErrorMock,
   finishRunAbortedMock,
   getRateLimitsByTokenIdMock,
-} = vi.hoisted(() => ({
-  findOneMock: vi.fn(),
-  findManyMock: vi.fn(),
-  saveMock: vi.fn(),
-  updateFieldsMock: vi.fn(),
-  requestLogSaveMock: vi.fn(),
-  requestLogCreateRunMock: vi.fn(),
-  appendStepMock: vi.fn(),
-  dispatcherQueryMock: vi.fn(),
-  dispatcherQueryStreamMock: vi.fn(),
-  beforeQueryMock: vi.fn(),
-  afterQueryMock: vi.fn(),
-  assertNativeRunAdmissionMock: vi.fn(),
-  finishRunWithErrorMock: vi.fn(),
-  finishRunAbortedMock: vi.fn(),
-  getRateLimitsByTokenIdMock: vi.fn(),
-}));
+} = vi.hoisted(() => {
+  // isolate:false 공유 레지스트리 방어: 같은 fork 에서 앞선 파일이 request-log/token/
+  // run-lifecycle 실모듈을 캐시해 두면 아래 vi.mock 들이 조용히 무시된다(실 DB 호출로
+  // 폭발). import 보다 먼저 레지스트리를 비워 이 파일은 항상 mock 그래프로 시작한다.
+  vi.resetModules();
+  return {
+    findOneMock: vi.fn(),
+    findManyMock: vi.fn(),
+    saveMock: vi.fn(),
+    updateFieldsMock: vi.fn(),
+    requestLogSaveMock: vi.fn(),
+    requestLogCreateRunMock: vi.fn(),
+    appendStepMock: vi.fn(),
+    dispatcherQueryMock: vi.fn(),
+    dispatcherQueryStreamMock: vi.fn(),
+    beforeQueryMock: vi.fn(),
+    afterQueryMock: vi.fn(),
+    assertNativeRunAdmissionMock: vi.fn(),
+    finishRunWithErrorMock: vi.fn(),
+    finishRunAbortedMock: vi.fn(),
+    getRateLimitsByTokenIdMock: vi.fn(),
+  };
+});
 
 vi.mock("../request-log/request-log.model", () => ({
   MICRO_USD: 1_000_000,
@@ -467,56 +473,62 @@ describe("QgridFrame.query request logging", () => {
     expect(dispatcherQueryMock).not.toHaveBeenCalled();
   });
 
-  it("returns 400 for an Anthropic positional tuple before logging or dispatch", async () => {
-    await expect(
-      QgridFrame.query({
-        prompt: "hi",
-        model: "anthropic/claude-opus-4-8",
-        jsonSchema: JSON.stringify({
-          type: "object",
-          properties: {
-            tuple: {
-              type: "array",
-              items: [{ type: "string" }, { type: "integer" }],
-            },
+  // SON-532: anthropic 은 strictify 를 거치지 않으므로 strict 변환이 다루지 못하던 형태
+  // (positional tuple 등)도 거절 사유가 아니다 — 원형 그대로 프롬프트에 안내된다.
+  it.each([
+    [
+      "positional tuple",
+      {
+        type: "object",
+        properties: {
+          tuple: { type: "array", items: [{ type: "string" }, { type: "integer" }] },
+        },
+        required: ["tuple"],
+      },
+    ],
+    [
+      "tuple nested under not",
+      { type: "object", not: { type: "array", items: [{ type: "string" }] } },
+    ],
+    [
+      "prefixItems tuple with missing type",
+      {
+        type: "object",
+        properties: { tuple: { prefixItems: [{ type: "string" }, { type: "integer" }] } },
+        required: ["tuple"],
+      },
+    ],
+    [
+      "prefixItems tuple with nullable union type",
+      {
+        type: "object",
+        properties: {
+          tuple: {
+            type: ["array", "null"],
+            prefixItems: [{ type: "string" }, { type: "integer" }],
           },
-          required: ["tuple"],
-        }),
-      }),
-    ).rejects.toMatchObject({
-      statusCode: 400,
-      message: expect.stringContaining(
-        "positional tuple schemas are not supported on Anthropic",
-      ),
-    });
-
-    expect(beforeQueryMock).not.toHaveBeenCalled();
-    expect(dispatcherQueryMock).not.toHaveBeenCalled();
-  });
+        },
+        required: ["tuple"],
+      },
+    ],
+  ] as const)(
+    "accepts an Anthropic schema with %s and proceeds to dispatch (SON-532)",
+    async (_label, schema) => {
+      beforeQueryMock.mockResolvedValueOnce({ requestLogId: 41, stepIndex: 0 });
+      dispatcherQueryMock.mockResolvedValueOnce(queryOutput());
+      afterQueryMock.mockResolvedValueOnce({});
 
-  it("returns 400 for an Anthropic tuple nested under not before logging or dispatch", async () => {
-    await expect(
-      QgridFrame.query({
-        prompt: "hi",
-        model: "anthropic/claude-opus-4-8",
-        jsonSchema: JSON.stringify({
-          type: "object",
-          not: {
-            type: "array",
-            items: [{ type: "string" }],
-          },
+      await expect(
+        QgridFrame.query({
+          prompt: "hi",
+          model: "anthropic/claude-opus-4-8",
+          jsonSchema: JSON.stringify(schema),
         }),
-      }),
-    ).rejects.toMatchObject({
-      statusCode: 400,
-      message: expect.stringContaining(
-        "positional tuple schemas are not supported on Anthropic",
-      ),
-    });
+      ).resolves.toMatchObject({ text: "hello" });
 
-    expect(beforeQueryMock).not.toHaveBeenCalled();
-    expect(dispatcherQueryMock).not.toHaveBeenCalled();
-  });
+      expect(dispatcherQueryMock).toHaveBeenCalledOnce();
+    },
+  );
 
   it("returns 400 for an OpenAI tuple under not instead of changing negative semantics", async () => {
     await expect(
@@ -654,40 +666,13 @@ describe("QgridFrame.query request logging", () => {
     },
   );
 
-  it.each([
-    ["missing", undefined],
-    ["nullable union", ["array", "null"]],
-  ] as const)(
-    "returns 400 for an Anthropic positional tuple with %s type before logging or dispatch",
-    async (_label, type) => {
-      await expect(
-        QgridFrame.query({
-          prompt: "hi",
-          model: "anthropic/claude-opus-4-8",
-          jsonSchema: JSON.stringify({
-            type: "object",
-            properties: {
-              tuple: {
-                ...(type === undefined ? {} : { type }),
-                prefixItems: [{ type: "string" }, { type: "integer" }],
-              },
-            },
-            required: ["tuple"],
-          }),
-        }),
-      ).rejects.toMatchObject({
-        statusCode: 400,
-        message: expect.stringContaining(
-          "positional tuple schemas are not supported on Anthropic",
-        ),
-      });
-
-      expect(beforeQueryMock).not.toHaveBeenCalled();
-      expect(dispatcherQueryMock).not.toHaveBeenCalled();
-    },
-  );
+  // SON-532: argv 64KiB 제한은 --json-schema 전용이었다. 프롬프트 전달은 system 크기
+  // 분기(--system-prompt-file)가 흡수하므로 전역 복잡도 한도만 남는다.
+  it("accepts an Anthropic schema that exceeds the old argv size limit (SON-532)", async () => {
+    beforeQueryMock.mockResolvedValueOnce({ requestLogId: 41, stepIndex: 0 });
+    dispatcherQueryMock.mockResolvedValueOnce(queryOutput());
+    afterQueryMock.mockResolvedValueOnce({});
 
-  it("returns 400 when the final Anthropic schema exceeds the safe argv size", async () => {
     await expect(
       QgridFrame.query({
         prompt: "hi",
@@ -704,13 +689,9 @@ describe("QgridFrame.query request logging", () => {
           properties: { answer: { type: "string" } },
         }),
       }),
-    ).rejects.toMatchObject({
-      statusCode: 400,
-      message: expect.stringContaining("Anthropic dispatch schema exceeds argv"),
-    });
+    ).resolves.toMatchObject({ text: "hello" });
 
-    expect(beforeQueryMock).not.toHaveBeenCalled();
-    expect(dispatcherQueryMock).not.toHaveBeenCalled();
+    expect(dispatcherQueryMock).toHaveBeenCalledOnce();
   });
 
   it("accepts logger: false in the wire schema", () => {
@@ -757,30 +738,22 @@ describe("QgridFrame.prepareStream", () => {
     });
   });
 
-  it("returns 400 for an Anthropic tuple under patternProperties before allocating a stream id", async () => {
-    await expect(
-      QgridFrame.prepareStream({
-        prompt: "hi",
-        model: "anthropic/claude-opus-4-8",
-        jsonSchema: JSON.stringify({
-          type: "object",
-          patternProperties: {
-            "^tuple$": {
-              type: "array",
-              prefixItems: [{ type: "string" }],
-            },
+  it("accepts an Anthropic tuple under patternProperties and allocates a stream id (SON-532)", async () => {
+    const { streamId } = await QgridFrame.prepareStream({
+      prompt: "hi",
+      model: "anthropic/claude-opus-4-8",
+      jsonSchema: JSON.stringify({
+        type: "object",
+        patternProperties: {
+          "^tuple$": {
+            type: "array",
+            prefixItems: [{ type: "string" }],
           },
-        }),
+        },
       }),
-    ).rejects.toMatchObject({
-      statusCode: 400,
-      message: expect.stringContaining(
-        "positional tuple schemas are not supported on Anthropic",
-      ),
     });
 
-    expect(requestLogSaveMock).not.toHaveBeenCalled();
-    expect(dispatcherQueryMock).not.toHaveBeenCalled();
+    expect(streamId).toEqual(expect.any(String));
   });
 
   it("returns 400 for a deeply nested tool schema before allocating a stream id", async () => {
@@ -796,42 +769,36 @@ describe("QgridFrame.prepareStream", () => {
     });
   });
 
-  it("returns 400 for an unsupported composed-schema reference before allocating a stream id", async () => {
-    await expect(
-      QgridFrame.prepareStream({
-        prompt: "hi",
-        model: "anthropic/claude-sonnet-4-6",
-        tools: [{ name: "lookup", inputSchema: { type: "object" } }],
-        jsonSchema: JSON.stringify({
-          type: "object",
-          properties: { answer: { $ref: "#named-anchor" } },
-        }),
+  // strict 합성 시절엔 $defs rebase 때문에 named anchor $ref 를 거절해야 했다.
+  // 프롬프트 전달은 원문을 그대로 안내하므로 재작성이 없고 거절 사유도 사라진다(SON-532).
+  it("accepts a named-anchor $ref on Anthropic and allocates a stream id (SON-532)", async () => {
+    const { streamId } = await QgridFrame.prepareStream({
+      prompt: "hi",
+      model: "anthropic/claude-sonnet-4-6",
+      tools: [{ name: "lookup", inputSchema: { type: "object" } }],
+      jsonSchema: JSON.stringify({
+        type: "object",
+        properties: { answer: { $ref: "#named-anchor" } },
       }),
-    ).rejects.toMatchObject({
-      statusCode: 400,
-      message: expect.stringContaining(
-        "only root-relative JSON Pointer $ref values are supported",
-      ),
     });
+
+    expect(streamId).toEqual(expect.any(String));
   });
 
-  it("returns 400 for an oversized Anthropic argv schema before allocating a stream id", async () => {
-    await expect(
-      QgridFrame.prepareStream({
-        prompt: "hi",
-        model: "anthropic/claude-sonnet-4-6",
-        tools: [
-          {
-            name: "lookup",
-            description: "x".repeat(64 * 1024),
-            inputSchema: { type: "object" },
-          },
-        ],
-      }),
-    ).rejects.toMatchObject({
-      statusCode: 400,
-      message: expect.stringContaining("Anthropic dispatch schema exceeds argv"),
+  it("accepts an Anthropic schema beyond the old argv limit and allocates a stream id (SON-532)", async () => {
+    const { streamId } = await QgridFrame.prepareStream({
+      prompt: "hi",
+      model: "anthropic/claude-sonnet-4-6",
+      tools: [
+        {
+          name: "lookup",
+          description: "x".repeat(64 * 1024),
+          inputSchema: { type: "object" },
+        },
+      ],
     });
+
+    expect(streamId).toEqual(expect.any(String));
   });
 });
 

package/bundle/src/application/qgrid/qgrid.frame.ts

@@ -12,15 +12,20 @@ import {
   getRefreshToken,
 } from "../../utils/providers/common/credentials";
 import { CallerSchemaValidationError } from "../../utils/providers/common/schema-validation";
+import {
+  buildOpenAIAuthUrl,
+  exchangeOpenAICode,
+  generateOpenAIPKCE,
+} from "../../utils/providers/openai/openai-oauth";
 import { MICRO_USD, RequestLogModel } from "../request-log/request-log.model";
 import { type RequestLogListParams } from "../request-log/request-log.types";
 import { type TokenSubsetA } from "../sonamu.generated";
 import { TokenModel, type TokenUpdateFields } from "../token/token.model";
 import { TokenCredentials } from "../token/token.types";
 import {
+  CONSOLE_CALLBACK_URL,
   type AnthropicUsageRaw,
   buildAuthUrl,
-  CONSOLE_CALLBACK_URL,
   exchangeCodeForTokens,
   fetchUsage,
   generatePKCE,
@@ -53,7 +58,12 @@ import { ToolSchemaCompositionError } from "./tool-emulation-schema";
 
 const pendingStreams = new Map<string, QueryInput>();
 
-type PendingOAuth = { codeVerifier: string; name: string; redirectUri: string };
+type PendingOAuth = {
+  codeVerifier: string;
+  name: string;
+  redirectUri: string;
+  provider: "anthropic" | "openai";
+};
 const OAUTH_STATE_PREFIX = "oauth:state:";
 const OAUTH_STATE_TTL = "5m";
 
@@ -85,50 +95,24 @@ async function deleteOAuthState(state: string): Promise<void> {
   await cache.delete({ key: `${OAUTH_STATE_PREFIX}${state}` });
 }
 
-// OAuth 접속 주소는 브라우저가 보낸 Origin(우선) 또는 Host 헤더에서 파생한다.
-// HTTP context 가 없는 직접 호출(테스트 등)은 null 을 반환한다.
-function deriveRequestBaseUrl(): string | null {
-  try {
-    const { headers, request } = Sonamu.getContext();
-    const origin = headers.origin;
-    if (typeof origin === "string" && /^https?:\/\//.test(origin)) {
-      return origin.replace(/\/+$/, "");
-    }
-    const forwardedHost = headers["x-forwarded-host"];
-    const host = (Array.isArray(forwardedHost) ? forwardedHost[0] : forwardedHost) ?? headers.host;
-    if (host) {
-      const forwardedProto = headers["x-forwarded-proto"];
-      const proto =
-        (Array.isArray(forwardedProto) ? forwardedProto[0] : forwardedProto)?.split(",")[0] ??
-        request.protocol;
-      return `${proto}://${host}`;
-    }
-  } catch {
-    // direct frame call — HTTP context 없음
-  }
-  return null;
-}
-
-const LOOPBACK_HOSTNAMES = new Set(["localhost", "127.0.0.1", "[::1]", "::1"]);
+const trustedLoopbackBase = () => `http://localhost:${process.env.PORT ?? "44900"}`;
 
-function isLoopbackBase(base: string): boolean {
-  try {
-    return LOOPBACK_HOSTNAMES.has(new URL(base).hostname);
-  } catch {
-    return false;
-  }
-}
-
-// Anthropic OAuth client 는 redirect_uri 허용 목록을 강제한다: 루프백(localhost)과
-// 콘솔 콜백만 허용된다. 따라서 루프백 접속은 자동 리다이렉트 플로우를,
-// 원격 접속은 콘솔 콜백 + 코드 붙여넣기 플로우(Claude Code CLI 와 동일)를 쓴다.
+// Anthropic's remote/manual flow uses its fixed console callback. Headers may select between two
+// allowlisted URIs, but never contribute authority or path bytes to either URI.
 function resolveOAuthRedirect(): { redirectUri: string; mode: "redirect" | "code" } {
-  const base = deriveRequestBaseUrl();
-  if (base && !isLoopbackBase(base)) {
-    return { redirectUri: CONSOLE_CALLBACK_URL, mode: "code" };
-  }
-  const loopbackBase = base ?? `http://localhost:${process.env.PORT ?? "44900"}`;
-  return { redirectUri: `${loopbackBase}/callback`, mode: "redirect" };
+  try {
+    const { headers } = Sonamu.getContext();
+    const origin = typeof headers.origin === "string" ? headers.origin : undefined;
+    const forwarded = headers["x-forwarded-host"];
+    const rawHost = Array.isArray(forwarded) ? forwarded[0] : (forwarded ?? headers.host);
+    const host = origin
+      ? new URL(origin).hostname
+      : new URL(`http://${rawHost ?? "localhost"}`).hostname;
+    if (!new Set(["localhost", "127.0.0.1", "::1", "[::1]"]).has(host)) {
+      return { redirectUri: CONSOLE_CALLBACK_URL, mode: "code" };
+    }
+  } catch {}
+  return { redirectUri: `${trustedLoopbackBase()}/callback`, mode: "redirect" };
 }
 
 function rejectImageGenerationStream(args: QueryInput): void {
@@ -138,6 +122,8 @@ function rejectImageGenerationStream(args: QueryInput): void {
   );
 }
 
+// anthropic 은 --json-schema 를 쓰지 않으므로(SON-532) strict 변환·argv 제한 없이 원형의
+// 구문·복잡도만 검증된다 — provider 분기는 buildAndValidateStrictOutputSchema 가 소유한다.
 function rejectInvalidCallerSchemas(args: QueryInput): void {
   if (args.jsonSchema === undefined && !args.tools?.length) return;
 
@@ -281,23 +267,14 @@ class QgridFrameClass extends BaseFrameClass {
 
     const ctx = Sonamu.getContext();
     const sse = ctx.createSSE(StreamEvents);
-    let threadId: string | undefined;
-    let turnId: string | undefined;
     let streamResult: QueryOutput | undefined;
     let streamError: Error | undefined;
     let clientClosed = false;
     const abortController = new AbortController();
 
-    const interruptOpenAI = () => {
-      if (threadId && turnId) {
-        QgridDispatcher.openaiDispatcher?.interruptWorkerTurn(threadId, turnId).catch(() => {});
-      }
-    };
-
     sse.onClose(() => {
       clientClosed = true;
       abortController.abort();
-      interruptOpenAI();
     });
 
     let runInfo: { requestLogId: number; stepIndex: number } | undefined;
@@ -320,18 +297,6 @@ class QgridFrameClass extends BaseFrameClass {
           onDelta: (text) => {
             if (!clientClosed && !sse.closed) sse.publish("delta", { text });
           },
-          onThreadId: (id) => {
-            threadId = id;
-            if ((clientClosed || sse.closed) && turnId) {
-              interruptOpenAI();
-            }
-          },
-          onTurnId: (id) => {
-            turnId = id;
-            if ((clientClosed || sse.closed) && threadId) {
-              interruptOpenAI();
-            }
-          },
           onComplete: (result) => {
             streamResult = result;
           },
@@ -575,7 +540,7 @@ class QgridFrameClass extends BaseFrameClass {
     const { redirectUri, mode } = resolveOAuthRedirect();
     const authUrl = buildAuthUrl(codeChallenge, state, redirectUri);
 
-    await setOAuthState(state, { codeVerifier, name, redirectUri });
+    await setOAuthState(state, { codeVerifier, name, redirectUri, provider: "anthropic" });
 
     return { authUrl, mode };
   }
@@ -601,6 +566,10 @@ class QgridFrameClass extends BaseFrameClass {
     }
     await deleteOAuthState(state);
 
+    if (pending.provider !== "anthropic") {
+      throw new BadRequestException("login session is not for Anthropic" as LocalizedString);
+    }
+
     await this.completeAnthropicLogin(code, state, pending);
     return { added: true, name: pending.name };
   }
@@ -641,40 +610,34 @@ class QgridFrameClass extends BaseFrameClass {
     await deleteOAuthState(state);
 
     try {
-      await this.completeAnthropicLogin(code, state, pending);
+      if (pending.provider === "openai") {
+        const creds = await exchangeOpenAICode(code, pending.codeVerifier, pending.redirectUri);
+        await TokenModel.replaceByAccount("openai", creds.accountId, {
+          provider: "openai",
+          credentials: creds,
+          name: pending.name,
+        });
+        logger.info(`OpenAI token saved for ${pending.name}`);
+        notifyTokenAdded(pending.name, "openai");
+      } else {
+        await this.completeAnthropicLogin(code, state, pending);
+      }
       return reply.redirect(`/?oauth=success&name=${encodeURIComponent(pending.name)}`);
-    } catch (e) {
-      return reply.redirect(`/?oauth=error&reason=${encodeURIComponent((e as Error).message)}`);
+    } catch {
+      logger.warn("oauth callback failed", {
+        provider: pending.provider,
+        reason: "exchange_failed",
+      });
+      return reply.redirect("/?oauth=error&reason=exchange_failed");
     }
   }
 
   @api({ httpMethod: "POST", clients: ["axios", "tanstack-mutation"] })
   async oauthStartOpenAI(name: string): Promise<OAuthStartResult> {
-    if (!QgridDispatcher.openaiDispatcher) throw new Error("OpenAI dispatcher not initialized");
-    const { authUrl } = await QgridDispatcher.openaiDispatcher.startBrowserLogin(name);
-
-    // fire-and-forget: codex login 완료 대기 → 토큰 저장
-    QgridDispatcher.openaiDispatcher
-      .completeBrowserLogin()
-      .then(async (creds) => {
-        await TokenModel.replaceByAccount("openai", creds.accountId, {
-          provider: "openai",
-          credentials: {
-            accessToken: creds.accessToken,
-            refreshToken: creds.refreshToken,
-            idToken: creds.idToken,
-            accessTokenExpiresAt: Date.now() + 10 * 24 * 3600 * 1000,
-            accountId: creds.accountId,
-          },
-          name,
-        });
-        logger.info(`OpenAI token saved for ${name}`);
-        notifyTokenAdded(name, "openai");
-      })
-      .catch((e) => {
-        logger.warn(`OpenAI browser login failed: ${(e as Error).message}`);
-      });
-
+    const { codeVerifier, codeChallenge, state } = generateOpenAIPKCE();
+    const redirectUri = `${trustedLoopbackBase()}/auth/callback`;
+    const authUrl = buildOpenAIAuthUrl(codeChallenge, state, redirectUri);
+    await setOAuthState(state, { codeVerifier, name, redirectUri, provider: "openai" });
     return { authUrl, mode: "redirect" };
   }
 

package/bundle/src/application/qgrid/qgrid.types.ts

@@ -74,12 +74,12 @@ export const QueryTimeoutMs = z.number().int().positive().max(MAX_QUERY_TIMEOUT_
 
 // ─── Run Lifecycle Context (SDK ↔ Server contract) ───
 
-// codex thread 좌표. thread 재사용으로 conversation_id(=prompt_cache_key)를 고정해
+// OpenAI cache affinity 좌표(구 codex thread 좌표). prompt_cache_key 를 고정해
 // OpenAI prompt caching 을 살리기 위한 핸들. 서버가 발급하고 클라가 다음 요청에 그대로 회송한다.
 // 핸들 미전송 시 기존 "매 turn 새 thread + history inject" 동작으로 폴백(QgridRunContext 참조).
 export const QgridThreadCoord = z.object({
   workerId: z.number(), // 고정 라우팅 (thread 는 worker 프로세스 메모리에만 존재)
-  threadId: z.string(), // codex conversation_id = prompt_cache_key
+  threadId: z.string(), // opaque cache affinity key = prompt_cache_key
   epoch: z.number(), // worker spawn 카운터. restart 로 thread 증발 감지
   systemHash: z.string(), // system_prompt 해시. 다른 대화 오접속 방지
 });
@@ -114,11 +114,16 @@ export const QueryInput = z.looseObject({
   serviceTier: ServiceTier.optional(),
   history: z.string().optional(),
   projectName: z.string().optional(),
+  // SDK-derived opaque affinity. It is intentionally distinct from the caller's sessionKey.
+  cacheAffinityKey: z
+    .string()
+    .regex(/^[0-9a-f]{64}$/)
+    .optional(),
   // 생략하면 로깅한다. false는 request log 쓰기만 끄고 dispatch/thread는 유지한다.
   logger: z.boolean().optional(),
   runContext: QgridRunContext.optional(),
   toolResults: z.array(QgridToolResultInput).optional(),
-  // codex 내장 image_generation tool 을 켠다(OpenAI 경로 전용, opt-in, non-stream).
+  // OpenAI Responses image_generation tool 을 켠다(OpenAI 경로 전용, opt-in, non-stream).
   imageGeneration: z.boolean().optional(),
   // qgrid 가격 추정 및 Codex 이미지 요청 힌트. 이미지 모델은 gpt-image-2 로 고정 가정한다.
   imageGenerationOptions: ImageGenerationOptions.optional(),
@@ -148,6 +153,7 @@ export const QueryOutput = z.object({
   usage: z.object({
     input_tokens: z.number(),
     output_tokens: z.number(),
+    reasoning_tokens: z.number(),
     cache_creation_input_tokens: z.number(),
     cache_creation_5m_input_tokens: z.number().optional(),
     cache_creation_1h_input_tokens: z.number().optional(),
@@ -180,6 +186,7 @@ export const StreamEvents = z.object({
     usage: z.object({
       input_tokens: z.number(),
       output_tokens: z.number(),
+      reasoning_tokens: z.number(),
       cache_creation_input_tokens: z.number(),
       cache_creation_5m_input_tokens: z.number().optional(),
       cache_creation_1h_input_tokens: z.number().optional(),
@@ -275,7 +282,7 @@ export type TokenStats = z.infer<typeof TokenStats>;
 export const OAuthStartResult = z.object({
   authUrl: z.string(),
   // redirect: 브라우저 자동 복귀(루프백 접속). code: 콘솔 콜백 + 코드 붙여넣기(원격 접속).
-  // OpenAI 경로는 codex 가 콜백을 처리하므로 항상 redirect 를 반환한다.
+  // OpenAI 경로는 고정 loopback 콜백의 직접 PKCE 라 항상 redirect 를 반환한다.
   mode: z.enum(["redirect", "code"]),
 });
 export type OAuthStartResult = z.infer<typeof OAuthStartResult>;