@cartanova/qgrid-cli 2.7.6 → 2.7.9

package/bundle/src/application/sonamu.generated.http

@@ -41,7 +41,8 @@ Content-Type: application/json
       "active": false,
       "ord": 0,
       "quota_threshold": null,
-      "weight": 1
+      "weight": 1,
+      "keepalive_enabled": false
     }
   ]
 }
@@ -437,7 +438,9 @@ Content-Type: application/json
     "modelName": "MODELNAME",
     "effort": "EFFORT",
     "projectName": "PROJECTNAME",
-    "history": "HISTORY"
+    "history": "HISTORY",
+    "isStructured": false,
+    "jsonSchema": null
   }
 }
 
@@ -501,7 +504,8 @@ Content-Type: application/json
     "costSource": "provider",
     "totalDurationMs": 0,
     "history": "HISTORY",
-    "errorMessage": "ERRORMESSAGE"
+    "errorMessage": "ERRORMESSAGE",
+    "responseJsonOk": false
   }
 }
 
@@ -566,7 +570,8 @@ Content-Type: application/json
   "id": 0,
   "name": "NAME",
   "quotaThreshold": null,
-  "weight": 0
+  "weight": 0,
+  "keepaliveEnabled": false
 }
 
 ###

package/bundle/src/application/sonamu.generated.sso.ts

@@ -213,6 +213,7 @@ export const tokenSubsetQueries = {
       ord: "tokens.ord",
       quota_threshold: "tokens.quota_threshold",
       weight: "tokens.weight",
+      keepalive_enabled: "tokens.keepalive_enabled",
     });
   },
 };

package/bundle/src/application/sonamu.generated.ts

@@ -299,6 +299,7 @@ export const TokenBaseSchema = z.object({
   ord: z.int(),
   quota_threshold: z.int().nullable(),
   weight: z.int(),
+  keepalive_enabled: z.boolean(),
 });
 export type TokenBaseSchema = z.infer<typeof TokenBaseSchema> & {
   readonly __hasDefault__: readonly [
@@ -307,6 +308,7 @@ export type TokenBaseSchema = z.infer<typeof TokenBaseSchema> & {
     "ord",
     "quota_threshold",
     "weight",
+    "keepalive_enabled",
     "id",
   ];
 };
@@ -558,6 +560,7 @@ export const TokenSubsetA = z.object({
   ord: z.int(),
   quota_threshold: z.int().nullable(),
   weight: z.int(),
+  keepalive_enabled: z.boolean(),
 });
 export type TokenSubsetA = z.infer<typeof TokenSubsetA>;
 export type TokenSubsetMapping = {

package/bundle/src/application/token/token.entity.json

@@ -26,6 +26,12 @@
       "type": "integer",
       "desc": "가중 라운드로빈 라우팅 가중치 (1..100)",
       "dbDefault": "1"
+    },
+    {
+      "name": "keepalive_enabled",
+      "type": "boolean",
+      "desc": "Anthropic 5시간 토큰 윈도우 keepalive 사용 여부",
+      "dbDefault": "false"
     }
   ],
   "indexes": [
@@ -46,7 +52,8 @@
       "active",
       "ord",
       "quota_threshold",
-      "weight"
+      "weight",
+      "keepalive_enabled"
     ]
   },
   "enums": {

package/bundle/src/application/token/token.model.test.ts

@@ -111,6 +111,35 @@ describe("TokenModel.updateFields", () => {
   });
 });
 
+describe("TokenModel.replaceByAccount", () => {
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  it("re-login으로 row가 교체돼도 기존 keepalive 선택을 보존한다", async () => {
+    vi.spyOn(TokenModel, "findByAccountIdentifier").mockResolvedValue([
+      {
+        id: 1,
+        created_at: new Date(),
+        active: true,
+        ord: 0,
+        quota_threshold: 80,
+        weight: 1,
+        keepalive_enabled: true,
+        ...baseToken,
+      },
+    ]);
+    vi.spyOn(TokenModel, "del").mockResolvedValue(1);
+    const save = vi.spyOn(TokenModel, "save").mockResolvedValue([2]);
+
+    await TokenModel.replaceByAccount("anthropic", "acc-1", baseToken);
+
+    expect(save).toHaveBeenCalledWith([
+      expect.objectContaining({ keepalive_enabled: true }),
+    ]);
+  });
+});
+
 describe("TokenModel.findActiveByProviderAndName", () => {
   afterEach(() => {
     vi.restoreAllMocks();

package/bundle/src/application/token/token.model.ts

@@ -23,6 +23,7 @@ export type TokenUpdateFields = {
   name?: string;
   quota_threshold?: number | null;
   weight?: number;
+  keepalive_enabled?: boolean;
 };
 
 function applyCreateDefaults(sp: TokenSaveParams): TokenSaveParams {
@@ -235,8 +236,12 @@ class TokenModelClass extends BaseModelClass<
     accountId: string | undefined,
     saveParams: TokenSaveParams,
   ): Promise<void> {
+    let keepaliveEnabled = saveParams.keepalive_enabled;
     if (accountId) {
       const oldEntries = await this.findByAccountIdentifier("A", provider, accountId);
+      if (keepaliveEnabled === undefined && oldEntries.length > 0) {
+        keepaliveEnabled = oldEntries.some((entry) => entry.keepalive_enabled);
+      }
       if (oldEntries.length > 0) await this.del(oldEntries.map((o) => o.id));
     } else {
       logger.warn(
@@ -244,7 +249,11 @@ class TokenModelClass extends BaseModelClass<
       );
     }
 
-    await this.save([saveParams]);
+    await this.save([
+      keepaliveEnabled === undefined
+        ? saveParams
+        : { ...saveParams, keepalive_enabled: keepaliveEnabled },
+    ]);
   }
 
   /**

package/bundle/src/application/token/token.types.test.ts

@@ -42,4 +42,14 @@ describe("TokenSaveParams", () => {
       expect(() => TokenSaveParams.parse({ ...baseToken, weight })).toThrow();
     }
   });
+
+  it("keeps per-token keepalive opt-in optional and accepts booleans", () => {
+    expect(TokenSaveParams.parse(baseToken)).not.toHaveProperty("keepalive_enabled");
+    expect(
+      TokenSaveParams.parse({ ...baseToken, keepalive_enabled: true }).keepalive_enabled,
+    ).toBe(true);
+    expect(() =>
+      TokenSaveParams.parse({ ...baseToken, keepalive_enabled: "true" }),
+    ).toThrow();
+  });
 });

package/bundle/src/application/token/token.types.ts

@@ -41,6 +41,7 @@ export const TokenSaveParams = TokenBaseSchema.partial({
   ord: true,
   quota_threshold: true,
   weight: true,
+  keepalive_enabled: true,
 }).extend({
   quota_threshold: TokenQuotaThreshold.optional(),
   weight: TokenWeight.optional(),

package/bundle/src/i18n/sd.generated.ts

@@ -320,6 +320,7 @@ const entityLabels = {
   "entity.Token.ord": "정렬 순서",
   "entity.Token.quota_threshold": "quota 사용률 임계치(%). null이면 미설정",
   "entity.Token.weight": "가중 라운드로빈 라우팅 가중치 (1..100)",
+  "entity.Token.keepalive_enabled": "Anthropic 5시간 토큰 윈도우 keepalive 사용 여부",
   "enum.TokenOrderBy.id-desc": "ID최신순",
   "enum.TokenOrderBy.ord-asc": "순서순",
   "enum.TokenSearchField.id": "ID",

package/bundle/src/migrations/20260820153531_alter_tokens_add1_alter1.ts

@@ -0,0 +1,15 @@
+import { type Knex } from "knex";
+
+export async function up(knex: Knex): Promise<void> {
+  await knex.schema.alterTable("tokens", (table) => {
+    // add
+    table.boolean("keepalive_enabled").notNullable().defaultTo(knex.raw("false"));
+  });
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.alterTable("tokens", (table) => {
+    // rollback - add
+    table.dropColumns("keepalive_enabled");
+  });
+}

package/bundle/src/sonamu.config.ts

@@ -25,6 +25,7 @@ import {
 import { loadSettings, setSettingChangeHandler } from "./application/setting/setting.store";
 import { handleServerError } from "./server-error-handler";
 import { AnthropicDispatcher } from "./utils/providers/anthropic/anthropic-dispatcher";
+import { stopOpenAICallbackRelay } from "./utils/providers/openai/openai-callback-relay";
 import { OpenAIDispatcher } from "./utils/providers/openai/openai-dispatcher";
 
 const host = process.env.HOST ?? "localhost";
@@ -241,6 +242,7 @@ export default defineConfig({
         const log = getLogger(["qgrid", "startup"]);
         stopExpiredTokenReminder();
         stopTokenWindowKeepalive();
+        stopOpenAICallbackRelay();
         setSettingChangeHandler(null);
         QgridDispatcher.subscriber?.setTokenChangeHandler(null);
         if (QgridDispatcher.openaiDispatcher) {

package/bundle/src/utils/providers/openai/openai-callback-relay.test.ts

@@ -0,0 +1,109 @@
+import http from "node:http";
+import type { AddressInfo } from "node:net";
+
+import { afterEach, describe, expect, it } from "vitest";
+
+import {
+  OPENAI_CALLBACK_PATH,
+  OPENAI_CALLBACK_PORTS,
+  openAICallbackRedirectUri,
+  startOpenAICallbackRelay,
+  stopOpenAICallbackRelay,
+} from "./openai-callback-relay";
+
+const DASHBOARD = "http://localhost:44900";
+
+function freePort(): Promise<number> {
+  return new Promise((resolve) => {
+    const probe = http.createServer();
+    probe.listen(0, "127.0.0.1", () => {
+      const port = (probe.address() as AddressInfo).port;
+      probe.close(() => resolve(port));
+    });
+  });
+}
+
+function occupy(port: number): Promise<http.Server> {
+  return new Promise((resolve) => {
+    const server = http.createServer();
+    server.listen(port, "127.0.0.1", () => resolve(server));
+  });
+}
+
+function get(url: string): Promise<{ status: number; location?: string }> {
+  return new Promise((resolve, reject) => {
+    const request = http.get(url, (response) => {
+      response.resume();
+      resolve({
+        status: response.statusCode ?? 0,
+        ...(response.headers.location ? { location: response.headers.location } : {}),
+      });
+    });
+    request.on("error", reject);
+  });
+}
+
+describe("openai callback relay", () => {
+  const occupied: http.Server[] = [];
+
+  afterEach(async () => {
+    stopOpenAICallbackRelay();
+    await Promise.all(occupied.splice(0).map((s) => new Promise((r) => s.close(r))));
+  });
+
+  it("pins the redirect URI to the ports OpenAI registered for the Codex CLI client", () => {
+    expect(OPENAI_CALLBACK_PORTS).toEqual([1455, 1457]);
+    expect(openAICallbackRedirectUri(1455)).toBe("http://localhost:1455/auth/callback");
+  });
+
+  it("forwards only code and state to the qgrid callback route", async () => {
+    const port = await freePort();
+    const redirectUri = await startOpenAICallbackRelay(DASHBOARD, 60_000, [port]);
+    expect(redirectUri).toBe(`http://localhost:${port}${OPENAI_CALLBACK_PATH}`);
+
+    const result = await get(
+      `http://127.0.0.1:${port}${OPENAI_CALLBACK_PATH}?code=the-code&state=the-state&extra=x`,
+    );
+
+    expect(result.status).toBe(302);
+    expect(result.location).toBe(
+      `${DASHBOARD}${OPENAI_CALLBACK_PATH}?code=the-code&state=the-state`,
+    );
+  });
+
+  it("answers 404 on any other path", async () => {
+    const port = await freePort();
+    await startOpenAICallbackRelay(DASHBOARD, 60_000, [port]);
+
+    expect((await get(`http://127.0.0.1:${port}/callback?code=c&state=s`)).status).toBe(404);
+  });
+
+  it("falls back to the next registered port when the first is taken", async () => {
+    const taken = await freePort();
+    const fallback = await freePort();
+    occupied.push(await occupy(taken));
+
+    const redirectUri = await startOpenAICallbackRelay(DASHBOARD, 60_000, [taken, fallback]);
+
+    expect(redirectUri).toBe(`http://localhost:${fallback}${OPENAI_CALLBACK_PATH}`);
+  });
+
+  it("reuses the running listener for a second login", async () => {
+    const port = await freePort();
+    const first = await startOpenAICallbackRelay(DASHBOARD, 60_000, [port]);
+    const second = await startOpenAICallbackRelay(DASHBOARD, 60_000, [await freePort()]);
+
+    expect(second).toBe(first);
+  });
+
+  it("fails when every registered port is taken", async () => {
+    const a = await freePort();
+    const b = await freePort();
+    occupied.push(await occupy(a), await occupy(b));
+
+    await expect(startOpenAICallbackRelay(DASHBOARD, 60_000, [a, b])).rejects.toThrow(
+      /PORTS_UNAVAILABLE/,
+    );
+  });
+});
+

package/bundle/src/utils/providers/openai/openai-callback-relay.ts

@@ -0,0 +1,105 @@
+import http from "node:http";
+
+import { getLogger } from "@logtape/logtape";
+
+const logger = getLogger(["qgrid", "oauth"]);
+
+/**
+ * OpenAI matches the Codex CLI client's redirect URIs by exact string, and only these two loopback
+ * callbacks are registered. Any other host, port, or path makes /oauth/authorize fail with
+ * `invalid_authorize_request` before the login screen renders, so qgrid cannot point the callback
+ * at its own configurable server port. Keep in sync with the Codex CLI allow-list (default 1455,
+ * fallback 1457).
+ */
+export const OPENAI_CALLBACK_PORTS = [1455, 1457] as const;
+export const OPENAI_CALLBACK_PATH = "/auth/callback";
+
+export function openAICallbackRedirectUri(port: number): string {
+  return `http://localhost:${port}${OPENAI_CALLBACK_PATH}`;
+}
+
+type Relay = {
+  server: http.Server;
+  redirectUri: string;
+  dashboardBase: string;
+  expiryTimer: NodeJS.Timeout;
+};
+
+let relay: Relay | null = null;
+
+function forward(request: http.IncomingMessage, response: http.ServerResponse): void {
+  const current = relay;
+  const incoming = new URL(request.url ?? "/", "http://localhost");
+  if (!current || incoming.pathname !== OPENAI_CALLBACK_PATH) {
+    response.writeHead(404, { "Content-Type": "text/plain; charset=utf-8" });
+    response.end("not found");
+    return;
+  }
+
+  // Only the two OAuth result fields cross over, onto a fixed loopback base. The request never
+  // contributes scheme, authority, or path bytes to the redirect target.
+  const target = new URL(OPENAI_CALLBACK_PATH, current.dashboardBase);
+  for (const field of ["code", "state"] as const) {
+    const value = incoming.searchParams.get(field);
+    if (value) target.searchParams.set(field, value);
+  }
+  response.writeHead(302, { Location: target.toString(), "Cache-Control": "no-store" });
+  response.end();
+}
+
+function listenOn(port: number): Promise<http.Server | null> {
+  return new Promise((resolve, reject) => {
+    const server = http.createServer(forward);
+    server.once("error", (error: NodeJS.ErrnoException) => {
+      server.close();
+      if (error.code === "EADDRINUSE" || error.code === "EACCES") resolve(null);
+      else reject(error);
+    });
+    // Bind loopback only, like the Codex CLI: the relay must not be reachable off-host.
+    server.listen(port, "127.0.0.1", () => resolve(server));
+  });
+}
+
+/**
+ * Opens a short-lived loopback listener on a registered Codex callback port and forwards the
+ * authorization code to qgrid own callback route. Returns the redirect URI to put in the authorize
+ * request. Repeated logins reuse the running listener and refresh its lifetime.
+ */
+export async function startOpenAICallbackRelay(
+  dashboardBase: string,
+  ttlMs: number,
+  ports: readonly number[] = OPENAI_CALLBACK_PORTS,
+): Promise<string> {
+  if (relay) {
+    relay.dashboardBase = dashboardBase;
+    relay.expiryTimer.refresh();
+    return relay.redirectUri;
+  }
+
+  for (const port of ports) {
+    const server = await listenOn(port);
+    if (!server) continue;
+
+    const expiryTimer = setTimeout(() => stopOpenAICallbackRelay(), ttlMs);
+    expiryTimer.unref();
+    const address = server.address();
+    const boundPort = typeof address === "object" && address ? address.port : port;
+    relay = {
+      server,
+      redirectUri: openAICallbackRedirectUri(boundPort),
+      dashboardBase,
+      expiryTimer,
+    };
+    logger.info(`openai oauth callback relay listening on 127.0.0.1:${boundPort}`);
+    return relay.redirectUri;
+  }
+
+  throw new Error(`OPENAI_CALLBACK_PORTS_UNAVAILABLE_${ports.join("_")}`);
+}
+
+export function stopOpenAICallbackRelay(): void {
+  if (!relay) return;
+  clearTimeout(relay.expiryTimer);
+  relay.server.close();
+  relay = null;
+}

package/bundle/src/utils/providers/openai/openai-quota.test.ts

@@ -147,6 +147,37 @@ describe("readOpenAIQuotaUsage", () => {
     });
   });
 
+  it("converts the current WHAM limit_window_seconds duration to minutes", async () => {
+    const fetchMock = vi.fn<typeof fetch>(async () =>
+      new Response(
+        JSON.stringify({
+          rate_limit: {
+            primary_window: {
+              used_percent: 21,
+              limit_window_seconds: 604_800,
+              reset_at: 123,
+            },
+          },
+        }),
+        { status: 200 },
+      ),
+    );
+
+    await expect(
+      readOpenAIQuotaUsage({
+        credentials: { accessToken: "access", accountId: "acct" },
+        fetch: fetchMock,
+      }),
+    ).resolves.toMatchObject({
+      kind: "ok",
+      raw: {
+        rateLimits: {
+          primary: { usedPercent: 21, windowDurationMins: 10_080, resetsAt: 123 },
+        },
+      },
+    });
+  });
+
   it("fails open for direct HTTP failures", async () => {
     await expect(
       readOpenAIQuotaUsage({

package/bundle/src/utils/providers/openai/openai-quota.ts

@@ -47,11 +47,17 @@ function windowFrom(value: unknown) {
   const source = value as Record<string, unknown>;
   const usedPercent = Number(source.usedPercent ?? source.used_percent);
   if (!Number.isFinite(usedPercent)) return null;
-  const duration = source.windowDurationMins ?? source.window_minutes;
+  const durationMins = source.windowDurationMins ?? source.window_minutes;
+  const durationSeconds = source.limitWindowSeconds ?? source.limit_window_seconds;
   const resets = source.resetsAt ?? source.reset_at;
   return {
     usedPercent,
-    windowDurationMins: duration === null || duration === undefined ? null : Number(duration),
+    windowDurationMins:
+      durationMins !== null && durationMins !== undefined
+        ? Number(durationMins)
+        : durationSeconds !== null && durationSeconds !== undefined
+          ? Number(durationSeconds) / 60
+          : null,
     resetsAt: resets === null || resets === undefined ? null : Number(resets),
   };
 }