@cartanova/qgrid-cli 2.7.1 → 2.7.3

package/bundle/src/application/qgrid/qgrid.frame.ts

@@ -12,15 +12,20 @@ import {
   getRefreshToken,
 } from "../../utils/providers/common/credentials";
 import { CallerSchemaValidationError } from "../../utils/providers/common/schema-validation";
+import {
+  buildOpenAIAuthUrl,
+  exchangeOpenAICode,
+  generateOpenAIPKCE,
+} from "../../utils/providers/openai/openai-oauth";
 import { MICRO_USD, RequestLogModel } from "../request-log/request-log.model";
 import { type RequestLogListParams } from "../request-log/request-log.types";
 import { type TokenSubsetA } from "../sonamu.generated";
 import { TokenModel, type TokenUpdateFields } from "../token/token.model";
 import { TokenCredentials } from "../token/token.types";
 import {
+  CONSOLE_CALLBACK_URL,
   type AnthropicUsageRaw,
   buildAuthUrl,
-  CONSOLE_CALLBACK_URL,
   exchangeCodeForTokens,
   fetchUsage,
   generatePKCE,
@@ -53,7 +58,12 @@ import { ToolSchemaCompositionError } from "./tool-emulation-schema";
 
 const pendingStreams = new Map<string, QueryInput>();
 
-type PendingOAuth = { codeVerifier: string; name: string; redirectUri: string };
+type PendingOAuth = {
+  codeVerifier: string;
+  name: string;
+  redirectUri: string;
+  provider: "anthropic" | "openai";
+};
 const OAUTH_STATE_PREFIX = "oauth:state:";
 const OAUTH_STATE_TTL = "5m";
 
@@ -85,50 +95,24 @@ async function deleteOAuthState(state: string): Promise<void> {
   await cache.delete({ key: `${OAUTH_STATE_PREFIX}${state}` });
 }
 
-// OAuth 접속 주소는 브라우저가 보낸 Origin(우선) 또는 Host 헤더에서 파생한다.
-// HTTP context 가 없는 직접 호출(테스트 등)은 null 을 반환한다.
-function deriveRequestBaseUrl(): string | null {
-  try {
-    const { headers, request } = Sonamu.getContext();
-    const origin = headers.origin;
-    if (typeof origin === "string" && /^https?:\/\//.test(origin)) {
-      return origin.replace(/\/+$/, "");
-    }
-    const forwardedHost = headers["x-forwarded-host"];
-    const host = (Array.isArray(forwardedHost) ? forwardedHost[0] : forwardedHost) ?? headers.host;
-    if (host) {
-      const forwardedProto = headers["x-forwarded-proto"];
-      const proto =
-        (Array.isArray(forwardedProto) ? forwardedProto[0] : forwardedProto)?.split(",")[0] ??
-        request.protocol;
-      return `${proto}://${host}`;
-    }
-  } catch {
-    // direct frame call — HTTP context 없음
-  }
-  return null;
-}
-
-const LOOPBACK_HOSTNAMES = new Set(["localhost", "127.0.0.1", "[::1]", "::1"]);
+const trustedLoopbackBase = () => `http://localhost:${process.env.PORT ?? "44900"}`;
 
-function isLoopbackBase(base: string): boolean {
-  try {
-    return LOOPBACK_HOSTNAMES.has(new URL(base).hostname);
-  } catch {
-    return false;
-  }
-}
-
-// Anthropic OAuth client 는 redirect_uri 허용 목록을 강제한다: 루프백(localhost)과
-// 콘솔 콜백만 허용된다. 따라서 루프백 접속은 자동 리다이렉트 플로우를,
-// 원격 접속은 콘솔 콜백 + 코드 붙여넣기 플로우(Claude Code CLI 와 동일)를 쓴다.
+// Anthropic's remote/manual flow uses its fixed console callback. Headers may select between two
+// allowlisted URIs, but never contribute authority or path bytes to either URI.
 function resolveOAuthRedirect(): { redirectUri: string; mode: "redirect" | "code" } {
-  const base = deriveRequestBaseUrl();
-  if (base && !isLoopbackBase(base)) {
-    return { redirectUri: CONSOLE_CALLBACK_URL, mode: "code" };
-  }
-  const loopbackBase = base ?? `http://localhost:${process.env.PORT ?? "44900"}`;
-  return { redirectUri: `${loopbackBase}/callback`, mode: "redirect" };
+  try {
+    const { headers } = Sonamu.getContext();
+    const origin = typeof headers.origin === "string" ? headers.origin : undefined;
+    const forwarded = headers["x-forwarded-host"];
+    const rawHost = Array.isArray(forwarded) ? forwarded[0] : (forwarded ?? headers.host);
+    const host = origin
+      ? new URL(origin).hostname
+      : new URL(`http://${rawHost ?? "localhost"}`).hostname;
+    if (!new Set(["localhost", "127.0.0.1", "::1", "[::1]"]).has(host)) {
+      return { redirectUri: CONSOLE_CALLBACK_URL, mode: "code" };
+    }
+  } catch {}
+  return { redirectUri: `${trustedLoopbackBase()}/callback`, mode: "redirect" };
 }
 
 function rejectImageGenerationStream(args: QueryInput): void {
@@ -283,23 +267,14 @@ class QgridFrameClass extends BaseFrameClass {
 
     const ctx = Sonamu.getContext();
     const sse = ctx.createSSE(StreamEvents);
-    let threadId: string | undefined;
-    let turnId: string | undefined;
     let streamResult: QueryOutput | undefined;
     let streamError: Error | undefined;
     let clientClosed = false;
     const abortController = new AbortController();
 
-    const interruptOpenAI = () => {
-      if (threadId && turnId) {
-        QgridDispatcher.openaiDispatcher?.interruptWorkerTurn(threadId, turnId).catch(() => {});
-      }
-    };
-
     sse.onClose(() => {
       clientClosed = true;
       abortController.abort();
-      interruptOpenAI();
     });
 
     let runInfo: { requestLogId: number; stepIndex: number } | undefined;
@@ -322,18 +297,6 @@ class QgridFrameClass extends BaseFrameClass {
           onDelta: (text) => {
             if (!clientClosed && !sse.closed) sse.publish("delta", { text });
           },
-          onThreadId: (id) => {
-            threadId = id;
-            if ((clientClosed || sse.closed) && turnId) {
-              interruptOpenAI();
-            }
-          },
-          onTurnId: (id) => {
-            turnId = id;
-            if ((clientClosed || sse.closed) && threadId) {
-              interruptOpenAI();
-            }
-          },
           onComplete: (result) => {
             streamResult = result;
           },
@@ -577,7 +540,7 @@ class QgridFrameClass extends BaseFrameClass {
     const { redirectUri, mode } = resolveOAuthRedirect();
     const authUrl = buildAuthUrl(codeChallenge, state, redirectUri);
 
-    await setOAuthState(state, { codeVerifier, name, redirectUri });
+    await setOAuthState(state, { codeVerifier, name, redirectUri, provider: "anthropic" });
 
     return { authUrl, mode };
   }
@@ -603,6 +566,10 @@ class QgridFrameClass extends BaseFrameClass {
     }
     await deleteOAuthState(state);
 
+    if (pending.provider !== "anthropic") {
+      throw new BadRequestException("login session is not for Anthropic" as LocalizedString);
+    }
+
     await this.completeAnthropicLogin(code, state, pending);
     return { added: true, name: pending.name };
   }
@@ -643,40 +610,34 @@ class QgridFrameClass extends BaseFrameClass {
     await deleteOAuthState(state);
 
     try {
-      await this.completeAnthropicLogin(code, state, pending);
+      if (pending.provider === "openai") {
+        const creds = await exchangeOpenAICode(code, pending.codeVerifier, pending.redirectUri);
+        await TokenModel.replaceByAccount("openai", creds.accountId, {
+          provider: "openai",
+          credentials: creds,
+          name: pending.name,
+        });
+        logger.info(`OpenAI token saved for ${pending.name}`);
+        notifyTokenAdded(pending.name, "openai");
+      } else {
+        await this.completeAnthropicLogin(code, state, pending);
+      }
       return reply.redirect(`/?oauth=success&name=${encodeURIComponent(pending.name)}`);
-    } catch (e) {
-      return reply.redirect(`/?oauth=error&reason=${encodeURIComponent((e as Error).message)}`);
+    } catch {
+      logger.warn("oauth callback failed", {
+        provider: pending.provider,
+        reason: "exchange_failed",
+      });
+      return reply.redirect("/?oauth=error&reason=exchange_failed");
     }
   }
 
   @api({ httpMethod: "POST", clients: ["axios", "tanstack-mutation"] })
   async oauthStartOpenAI(name: string): Promise<OAuthStartResult> {
-    if (!QgridDispatcher.openaiDispatcher) throw new Error("OpenAI dispatcher not initialized");
-    const { authUrl } = await QgridDispatcher.openaiDispatcher.startBrowserLogin(name);
-
-    // fire-and-forget: codex login 완료 대기 → 토큰 저장
-    QgridDispatcher.openaiDispatcher
-      .completeBrowserLogin()
-      .then(async (creds) => {
-        await TokenModel.replaceByAccount("openai", creds.accountId, {
-          provider: "openai",
-          credentials: {
-            accessToken: creds.accessToken,
-            refreshToken: creds.refreshToken,
-            idToken: creds.idToken,
-            accessTokenExpiresAt: Date.now() + 10 * 24 * 3600 * 1000,
-            accountId: creds.accountId,
-          },
-          name,
-        });
-        logger.info(`OpenAI token saved for ${name}`);
-        notifyTokenAdded(name, "openai");
-      })
-      .catch((e) => {
-        logger.warn(`OpenAI browser login failed: ${(e as Error).message}`);
-      });
-
+    const { codeVerifier, codeChallenge, state } = generateOpenAIPKCE();
+    const redirectUri = `${trustedLoopbackBase()}/auth/callback`;
+    const authUrl = buildOpenAIAuthUrl(codeChallenge, state, redirectUri);
+    await setOAuthState(state, { codeVerifier, name, redirectUri, provider: "openai" });
     return { authUrl, mode: "redirect" };
   }
 

package/bundle/src/application/qgrid/qgrid.types.ts

@@ -74,12 +74,12 @@ export const QueryTimeoutMs = z.number().int().positive().max(MAX_QUERY_TIMEOUT_
 
 // ─── Run Lifecycle Context (SDK ↔ Server contract) ───
 
-// codex thread 좌표. thread 재사용으로 conversation_id(=prompt_cache_key)를 고정해
+// OpenAI cache affinity 좌표(구 codex thread 좌표). prompt_cache_key 를 고정해
 // OpenAI prompt caching 을 살리기 위한 핸들. 서버가 발급하고 클라가 다음 요청에 그대로 회송한다.
 // 핸들 미전송 시 기존 "매 turn 새 thread + history inject" 동작으로 폴백(QgridRunContext 참조).
 export const QgridThreadCoord = z.object({
   workerId: z.number(), // 고정 라우팅 (thread 는 worker 프로세스 메모리에만 존재)
-  threadId: z.string(), // codex conversation_id = prompt_cache_key
+  threadId: z.string(), // opaque cache affinity key = prompt_cache_key
   epoch: z.number(), // worker spawn 카운터. restart 로 thread 증발 감지
   systemHash: z.string(), // system_prompt 해시. 다른 대화 오접속 방지
 });
@@ -114,11 +114,16 @@ export const QueryInput = z.looseObject({
   serviceTier: ServiceTier.optional(),
   history: z.string().optional(),
   projectName: z.string().optional(),
+  // SDK-derived opaque affinity. It is intentionally distinct from the caller's sessionKey.
+  cacheAffinityKey: z
+    .string()
+    .regex(/^[0-9a-f]{64}$/)
+    .optional(),
   // 생략하면 로깅한다. false는 request log 쓰기만 끄고 dispatch/thread는 유지한다.
   logger: z.boolean().optional(),
   runContext: QgridRunContext.optional(),
   toolResults: z.array(QgridToolResultInput).optional(),
-  // codex 내장 image_generation tool 을 켠다(OpenAI 경로 전용, opt-in, non-stream).
+  // OpenAI Responses image_generation tool 을 켠다(OpenAI 경로 전용, opt-in, non-stream).
   imageGeneration: z.boolean().optional(),
   // qgrid 가격 추정 및 Codex 이미지 요청 힌트. 이미지 모델은 gpt-image-2 로 고정 가정한다.
   imageGenerationOptions: ImageGenerationOptions.optional(),
@@ -148,6 +153,7 @@ export const QueryOutput = z.object({
   usage: z.object({
     input_tokens: z.number(),
     output_tokens: z.number(),
+    reasoning_tokens: z.number(),
     cache_creation_input_tokens: z.number(),
     cache_creation_5m_input_tokens: z.number().optional(),
     cache_creation_1h_input_tokens: z.number().optional(),
@@ -180,6 +186,7 @@ export const StreamEvents = z.object({
     usage: z.object({
       input_tokens: z.number(),
       output_tokens: z.number(),
+      reasoning_tokens: z.number(),
       cache_creation_input_tokens: z.number(),
       cache_creation_5m_input_tokens: z.number().optional(),
       cache_creation_1h_input_tokens: z.number().optional(),
@@ -275,7 +282,7 @@ export type TokenStats = z.infer<typeof TokenStats>;
 export const OAuthStartResult = z.object({
   authUrl: z.string(),
   // redirect: 브라우저 자동 복귀(루프백 접속). code: 콘솔 콜백 + 코드 붙여넣기(원격 접속).
-  // OpenAI 경로는 codex 가 콜백을 처리하므로 항상 redirect 를 반환한다.
+  // OpenAI 경로는 고정 loopback 콜백의 직접 PKCE 라 항상 redirect 를 반환한다.
   mode: z.enum(["redirect", "code"]),
 });
 export type OAuthStartResult = z.infer<typeof OAuthStartResult>;

package/bundle/src/application/qgrid/token-subscriber.ts

@@ -161,7 +161,7 @@ export class TokenSubscriber {
       this.dispatcher.removeCache(payload.id);
       await this.dispatcher.openaiDispatcher
         ?.onTokenRemoved(payload.id)
-        .catch((e) => logger.warn(`openai worker remove failed: ${(e as Error).message}`));
+        .catch((e) => logger.warn(`openai token remove failed: ${(e as Error).message}`));
       // anthropic 토큰 이벤트는 동기(void) — provider 를 모르므로 무해하게 항상 제거 시도.
       this.dispatcher.anthropicDispatcher?.onTokenRemoved(payload.id);
       logger.info(`NOTIFY ${payload.op} id=${payload.id} → removed from cache`);
@@ -172,7 +172,7 @@ export class TokenSubscriber {
       this.dispatcher.removeCache(payload.id);
       await this.dispatcher.openaiDispatcher
         ?.onTokenRemoved(payload.id)
-        .catch((e) => logger.warn(`openai worker remove failed: ${(e as Error).message}`));
+        .catch((e) => logger.warn(`openai token remove failed: ${(e as Error).message}`));
       this.dispatcher.anthropicDispatcher?.onTokenRemoved(payload.id);
       logger.info(`NOTIFY ${payload.op} id=${payload.id} → missing, removed from cache`);
       return;
@@ -192,7 +192,7 @@ export class TokenSubscriber {
             row.quota_threshold,
             row.weight,
           )
-          .catch((e) => logger.warn(`openai worker spawn failed: ${(e as Error).message}`));
+          .catch((e) => logger.warn(`openai token add failed: ${(e as Error).message}`));
       } else if (row.active) {
         if (openaiDispatcher) {
           await openaiDispatcher
@@ -204,7 +204,7 @@ export class TokenSubscriber {
               row.weight,
             )
             .then(() => openaiDispatcher.onTokenActivated(payload.id))
-            .catch((e) => logger.warn(`openai worker update failed: ${(e as Error).message}`));
+            .catch((e) => logger.warn(`openai token update failed: ${(e as Error).message}`));
         }
       } else {
         openaiDispatcher?.onTokenDeactivated(payload.id);

package/bundle/src/application/qgrid/tool-emulation-schema.ts

@@ -11,7 +11,6 @@
  *   → "Composing Tools With A User Output Schema"
  */
 
-import { type JsonValue } from "../../codex-protocol/serde_json/JsonValue";
 import {
   SCHEMA_ARRAY_KEYWORDS,
   SCHEMA_DEPENDENCIES_KEYWORD,
@@ -19,6 +18,7 @@ import {
   SCHEMA_SINGLE_KEYWORDS,
   UNSUPPORTED_REFERENCE_KEYWORDS,
 } from "../../utils/providers/common/json-schema-keywords";
+import { type JsonValue } from "../../utils/providers/common/provider-types";
 import { type QgridTool } from "./qgrid.types";
 
 const USER_OUTPUT_DEFINITION = "__qgrid_user_output";

package/bundle/src/application/qgrid/tool-emulation.test.ts

@@ -11,6 +11,7 @@ const baseResult = {
   usage: {
     input_tokens: 1,
     output_tokens: 1,
+    reasoning_tokens: 0,
     cache_creation_input_tokens: 0,
     cache_read_input_tokens: 0,
   },

package/bundle/src/application/queries.generated.ts

@@ -94,6 +94,9 @@ export namespace RequestLogService {
       [subset, rawParams],
       ["RequestLog", "getRequestLogs"],
     );
+
+  export const responseTypeTs = (id: number): SSRQuery =>
+    createSSRQuery("RequestLogModel", "responseTypeTs", [id], ["RequestLog", "responseTypeTs"]);
 }
 
 export namespace QgridService {
@@ -122,4 +125,7 @@ export namespace MonitService {
 
   export const monitInfo = (): SSRQuery =>
     createSSRQuery("MonitFrame", "monitInfo", [], ["Monit", "monitInfo"]);
+
+  export const monitStats = (): SSRQuery =>
+    createSSRQuery("MonitFrame", "monitStats", [], ["Monit", "monitStats"]);
 }

package/bundle/src/application/request-log/json-schema-type-text.test.ts

@@ -0,0 +1,96 @@
+import { describe, expect, it } from "vitest";
+
+import { renderJsonSchemaTypeText } from "./json-schema-type-text";
+
+function schema(value: unknown): string {
+  return JSON.stringify(value);
+}
+
+describe("renderJsonSchemaTypeText", () => {
+  it("renders a flat object with optionality from required", () => {
+    const result = renderJsonSchemaTypeText(
+      schema({
+        type: "object",
+        properties: {
+          dish: { type: "string" },
+          spiceLevel: { type: "number" },
+          note: { type: "string" },
+        },
+        required: ["dish", "spiceLevel"],
+      }),
+    );
+    expect(result).toBe(
+      ["type Response = {", "  dish: string", "  spiceLevel: number", "  note?: string", "}"].join(
+        "\n",
+      ),
+    );
+  });
+
+  it("renders nested arrays of objects without tuple unions", () => {
+    const result = renderJsonSchemaTypeText(
+      schema({
+        type: "object",
+        properties: {
+          sides: {
+            type: "array",
+            // maxItems 는 요약에서 무시한다 — 튜플 유니온 장황함이 이 렌더러를 만든 이유다.
+            maxItems: 3,
+            items: {
+              type: "object",
+              properties: { name: { type: "string" }, required: { type: "boolean" } },
+              required: ["name", "required"],
+            },
+          },
+        },
+        required: ["sides"],
+      }),
+    );
+    expect(result).toContain("sides: {");
+    expect(result).toContain("}[]");
+    expect(result).not.toContain("|");
+  });
+
+  it("renders enum, const, union, and nullable types", () => {
+    expect(
+      renderJsonSchemaTypeText(
+        schema({
+          type: "object",
+          properties: {
+            kind: { enum: ["add", "modify"] },
+            version: { const: 2 },
+            id: { anyOf: [{ type: "string" }, { type: "number" }] },
+            tag: { type: ["string", "null"] },
+            ids: { type: "array", items: { anyOf: [{ type: "string" }, { type: "number" }] } },
+          },
+          required: ["kind", "version", "id", "tag", "ids"],
+        }),
+      ),
+    ).toBe(
+      [
+        "type Response = {",
+        '  kind: "add" | "modify"',
+        "  version: 2",
+        "  id: string | number",
+        "  tag: string | null",
+        "  ids: (string | number)[]",
+        "}",
+      ].join("\n"),
+    );
+  });
+
+  it("quotes non-identifier keys and folds unknown keywords to unknown", () => {
+    const result = renderJsonSchemaTypeText(
+      schema({
+        type: "object",
+        properties: { "not-ident": { format: "weird" }, empty: { type: "object" } },
+        required: ["not-ident"],
+      }),
+    );
+    expect(result).toContain('"not-ident": unknown');
+    expect(result).toContain("empty?: Record<string, unknown>");
+  });
+
+  it("returns null on unparseable schema text", () => {
+    expect(renderJsonSchemaTypeText("{broken")).toBeNull();
+  });
+});

package/bundle/src/application/request-log/json-schema-type-text.ts

@@ -0,0 +1,83 @@
+/**
+ * JSON Schema → 간결한 TypeScript `type` 선언 텍스트.
+ *
+ * 라이브러리(json-schema-to-typescript 계열)는 interface + maxItems 튜플 유니온 등
+ * 장황한 출력을 내서 detail 화면 요약용으로 부적합하다. qgrid 가 받는 스키마는
+ * zod 직렬화 산물(object root, draft-07 부분집합)이라 이 정도 지원이면 충분하고,
+ * 모르는 키워드는 unknown 으로 접어 절대 던지지 않는다.
+ */
+
+type SchemaNode = Record<string, unknown>;
+
+/** TS/zod 표시 코드 공용 식별자 판별 — zod-code-format 의 키 unquote 도 이걸 쓴다. */
+export const IDENT_SOURCE = "[A-Za-z_$][\\w$]*";
+const IDENT_RE = new RegExp(`^${IDENT_SOURCE}$`);
+
+function renderKey(key: string): string {
+  return IDENT_RE.test(key) ? key : JSON.stringify(key);
+}
+
+function renderPrimitive(type: unknown): string {
+  if (type === "string") return "string";
+  if (type === "number" || type === "integer") return "number";
+  if (type === "boolean") return "boolean";
+  if (type === "null") return "null";
+  return "unknown";
+}
+
+function renderNode(node: unknown, depth: number): string {
+  if (node === true) return "unknown";
+  if (!node || typeof node !== "object" || Array.isArray(node)) return "unknown";
+  const schema = node as SchemaNode;
+
+  if (Array.isArray(schema.enum)) {
+    return schema.enum.map((value) => JSON.stringify(value)).join(" | ");
+  }
+  if (schema.const !== undefined) return JSON.stringify(schema.const);
+
+  const variants = (schema.anyOf ?? schema.oneOf) as unknown;
+  if (Array.isArray(variants) && variants.length > 0) {
+    return [...new Set(variants.map((variant) => renderNode(variant, depth)))].join(" | ");
+  }
+
+  const type = schema.type;
+  if (Array.isArray(type)) {
+    return [...new Set(type.map(renderPrimitive))].join(" | ");
+  }
+
+  if (type === "object" || (type === undefined && schema.properties)) {
+    const properties = (schema.properties ?? {}) as Record<string, unknown>;
+    const required = new Set(Array.isArray(schema.required) ? (schema.required as string[]) : []);
+    const keys = Object.keys(properties);
+    if (keys.length === 0) return "Record<string, unknown>";
+    const inner = "  ".repeat(depth + 1);
+    const lines = keys.map(
+      (key) =>
+        `${inner}${renderKey(key)}${required.has(key) ? "" : "?"}: ${renderNode(properties[key], depth + 1)}`,
+    );
+    return `{\n${lines.join("\n")}\n${"  ".repeat(depth)}}`;
+  }
+
+  if (type === "array") {
+    const item = renderNode(schema.items, depth);
+    // 유니온 요소는 괄호가 없으면 `A | B[]` 로 잘못 읽힌다.
+    if (item.includes(" | ")) return `(${item})[]`;
+    return `${item}[]`;
+  }
+
+  return renderPrimitive(type);
+}
+
+/** 이미 파싱된 스키마 값용 — 호출부가 같은 JSON 을 두 번 파싱하지 않게 한다. */
+export function renderParsedJsonSchemaTypeText(schema: unknown, name = "Response"): string {
+  return `type ${name} = ${renderNode(schema, 0)}`;
+}
+
+/** 실패(파싱 불가 등) 시 null — 호출부가 표시 자체를 생략한다. */
+export function renderJsonSchemaTypeText(schemaJson: string, name = "Response"): string | null {
+  try {
+    return renderParsedJsonSchemaTypeText(JSON.parse(schemaJson) as unknown, name);
+  } catch {
+    return null;
+  }
+}