@cartanova/qgrid-cli 2.7.7 → 2.8.0

package/bundle/src/application/qgrid/qgrid.frame.ts

@@ -12,6 +12,11 @@ import {
   getRefreshToken,
 } from "../../utils/providers/common/credentials";
 import { CallerSchemaValidationError } from "../../utils/providers/common/schema-validation";
+import {
+  OPENAI_CALLBACK_PORTS,
+  openAICallbackRedirectUri,
+  startOpenAICallbackRelay,
+} from "../../utils/providers/openai/openai-callback-relay";
 import {
   buildOpenAIAuthUrl,
   exchangeOpenAICode,
@@ -70,6 +75,7 @@ type PendingOAuth = {
 };
 const OAUTH_STATE_PREFIX = "oauth:state:";
 const OAUTH_STATE_TTL = "5m";
+const OAUTH_STATE_TTL_MS = 5 * 60_000;
 
 function unixSecondsToIso(seconds: number | null | undefined): string | null {
   return typeof seconds === "number" ? new Date(seconds * 1000).toISOString() : null;
@@ -101,9 +107,7 @@ async function deleteOAuthState(state: string): Promise<void> {
 
 const trustedLoopbackBase = () => `http://localhost:${process.env.PORT ?? "44900"}`;
 
-// Anthropic's remote/manual flow uses its fixed console callback. Headers may select between two
-// allowlisted URIs, but never contribute authority or path bytes to either URI.
-function resolveOAuthRedirect(): { redirectUri: string; mode: "redirect" | "code" } {
+function isRemoteOAuthRequest(): boolean {
   try {
     const { headers } = Sonamu.getContext();
     const origin = typeof headers.origin === "string" ? headers.origin : undefined;
@@ -112,13 +116,35 @@ function resolveOAuthRedirect(): { redirectUri: string; mode: "redirect" | "code
     const host = origin
       ? new URL(origin).hostname
       : new URL(`http://${rawHost ?? "localhost"}`).hostname;
-    if (!new Set(["localhost", "127.0.0.1", "::1", "[::1]"]).has(host)) {
-      return { redirectUri: CONSOLE_CALLBACK_URL, mode: "code" };
-    }
+    return !new Set(["localhost", "127.0.0.1", "::1", "[::1]"]).has(host);
   } catch {}
+  return false;
+}
+
+// Anthropic's remote/manual flow uses its fixed console callback. Headers may select between two
+// allowlisted URIs, but never contribute authority or path bytes to either URI.
+function resolveOAuthRedirect(): { redirectUri: string; mode: "redirect" | "code" } {
+  if (isRemoteOAuthRequest()) {
+    return { redirectUri: CONSOLE_CALLBACK_URL, mode: "code" };
+  }
   return { redirectUri: `${trustedLoopbackBase()}/callback`, mode: "redirect" };
 }
 
+function parsePastedOAuthResult(input: string): { code: string; state: string } | null {
+  const trimmed = input.trim();
+  try {
+    const callback = new URL(trimmed);
+    const code = callback.searchParams.get("code")?.trim() ?? "";
+    const state = callback.searchParams.get("state")?.trim() ?? "";
+    if (code && state) return { code, state };
+  } catch {}
+
+  const separatorAt = trimmed.indexOf("#");
+  const code = separatorAt > 0 ? trimmed.slice(0, separatorAt).trim() : "";
+  const state = separatorAt > 0 ? trimmed.slice(separatorAt + 1).trim() : "";
+  return code && state ? { code, state } : null;
+}
+
 function rejectImageGenerationStream(args: QueryInput): void {
   if (!args.imageGeneration) return;
   throw new BadRequestException(
@@ -401,6 +427,8 @@ class QgridFrameClass extends BaseFrameClass {
       project_name: input.projectName,
       system_prompt: input.systemPrompt,
       history: input.history ? JSON.parse(input.history) : undefined,
+      is_structured: input.isStructured,
+      json_schema: input.jsonSchema,
     });
     return { requestLogId };
   }
@@ -457,6 +485,7 @@ class QgridFrameClass extends BaseFrameClass {
       duration_ms: input.totalDurationMs,
       history: input.history ? JSON.parse(input.history) : undefined,
       error_message: input.errorMessage,
+      response_json_ok: input.responseJsonOk,
     });
     return { ok: true };
   }
@@ -574,18 +603,16 @@ class QgridFrameClass extends BaseFrameClass {
     return { authUrl, mode };
   }
 
-  // 코드 붙여넣기 플로우(원격 접속): 콘솔 콜백이 표시한 `code#state` 를 받아 교환한다.
+  // 원격 접속의 수동 완료: Anthropic `code#state` 또는 OpenAI callback URL을 받아 교환한다.
   @api({ httpMethod: "POST", clients: ["axios", "tanstack-mutation"] })
   async oauthComplete(pastedCode: string): Promise<{ added: boolean; name: string }> {
-    const trimmed = pastedCode.trim();
-    const separatorAt = trimmed.indexOf("#");
-    const code = separatorAt > 0 ? trimmed.slice(0, separatorAt) : "";
-    const state = separatorAt > 0 ? trimmed.slice(separatorAt + 1) : "";
-    if (!code || !state) {
+    const result = parsePastedOAuthResult(pastedCode);
+    if (!result) {
       throw new BadRequestException(
-        "expected the code shown after login, in code#state form" as LocalizedString,
+        "expected the callback URL or code shown after login, in code#state form" as LocalizedString,
       );
     }
+    const { code, state } = result;
 
     const pending = await getOAuthState(state);
     if (!pending) {
@@ -595,11 +622,12 @@ class QgridFrameClass extends BaseFrameClass {
     }
     await deleteOAuthState(state);
 
-    if (pending.provider !== "anthropic") {
-      throw new BadRequestException("login session is not for Anthropic" as LocalizedString);
+    if (pending.provider === "openai") {
+      await this.completeOpenAILogin(code, pending);
+    } else {
+      await this.completeAnthropicLogin(code, state, pending);
     }
 
-    await this.completeAnthropicLogin(code, state, pending);
     return { added: true, name: pending.name };
   }
 
@@ -630,6 +658,17 @@ class QgridFrameClass extends BaseFrameClass {
     notifyTokenAdded(pending.name, "anthropic");
   }
 
+  private async completeOpenAILogin(code: string, pending: PendingOAuth): Promise<void> {
+    const creds = await exchangeOpenAICode(code, pending.codeVerifier, pending.redirectUri);
+    await TokenModel.replaceByAccount("openai", creds.accountId, {
+      provider: "openai",
+      credentials: creds,
+      name: pending.name,
+    });
+    logger.info(`OpenAI token saved for ${pending.name}`);
+    notifyTokenAdded(pending.name, "openai");
+  }
+
   async handleOAuthCallback(code: string, state: string, reply: FastifyReply): Promise<void> {
     const pending = await getOAuthState(state);
     if (!pending) {
@@ -640,14 +679,7 @@ class QgridFrameClass extends BaseFrameClass {
 
     try {
       if (pending.provider === "openai") {
-        const creds = await exchangeOpenAICode(code, pending.codeVerifier, pending.redirectUri);
-        await TokenModel.replaceByAccount("openai", creds.accountId, {
-          provider: "openai",
-          credentials: creds,
-          name: pending.name,
-        });
-        logger.info(`OpenAI token saved for ${pending.name}`);
-        notifyTokenAdded(pending.name, "openai");
+        await this.completeOpenAILogin(code, pending);
       } else {
         await this.completeAnthropicLogin(code, state, pending);
       }
@@ -664,10 +696,24 @@ class QgridFrameClass extends BaseFrameClass {
   @api({ httpMethod: "POST", clients: ["axios", "tanstack-mutation"] })
   async oauthStartOpenAI(name: string): Promise<OAuthStartResult> {
     const { codeVerifier, codeChallenge, state } = generateOpenAIPKCE();
-    const redirectUri = `${trustedLoopbackBase()}/auth/callback`;
+    const mode = isRemoteOAuthRequest() ? "code" : "redirect";
+    let redirectUri: string;
+    if (mode === "code") {
+      // OpenAI accepts only the Codex CLI's registered loopback URI. On a remote dashboard the
+      // browser cannot reach the server's loopback, so the user pastes the resulting callback URL.
+      redirectUri = openAICallbackRedirectUri(OPENAI_CALLBACK_PORTS[0]);
+    } else {
+      try {
+        redirectUri = await startOpenAICallbackRelay(trustedLoopbackBase(), OAUTH_STATE_TTL_MS);
+      } catch {
+        throw new BadRequestException(
+          `OpenAI login needs local port ${OPENAI_CALLBACK_PORTS.join(" or ")} — close any running \`codex login\` and retry` as LocalizedString,
+        );
+      }
+    }
     const authUrl = buildOpenAIAuthUrl(codeChallenge, state, redirectUri);
     await setOAuthState(state, { codeVerifier, name, redirectUri, provider: "openai" });
-    return { authUrl, mode: "redirect" };
+    return { authUrl, mode };
   }
 
   @api({ httpMethod: "GET", clients: ["axios", "tanstack-query"] })

package/bundle/src/application/qgrid/qgrid.types.ts

@@ -114,7 +114,7 @@ export const QueryInput = z.looseObject({
   serviceTier: ServiceTier.optional(),
   history: z.string().optional(),
   projectName: z.string().optional(),
-  // 내부·대시보드 호출용 지정 주소. 공개 AI SDK provider options 에는 노출하지 않는다.
+  // raw/dashboard와 공개 AI SDK providerOptions.qgrid.tokenName이 공유하는 지정 주소.
   tokenName: z.string().optional(),
   // SDK-derived opaque affinity. It is intentionally distinct from the caller's sessionKey.
   cacheAffinityKey: z
@@ -214,6 +214,8 @@ export const CreateRunInput = z.object({
   effort: z.string().optional(),
   projectName: z.string().optional(),
   history: z.string().optional(),
+  isStructured: z.boolean().optional(),
+  jsonSchema: z.string().nullable().optional(),
 });
 export type CreateRunInput = z.infer<typeof CreateRunInput>;
 
@@ -266,6 +268,7 @@ export const FinishRunInput = z.object({
   totalDurationMs: z.number().optional(),
   history: z.string().optional(),
   errorMessage: z.string().optional(),
+  responseJsonOk: z.boolean().optional(),
 });
 export type FinishRunInput = z.infer<typeof FinishRunInput>;
 
@@ -284,7 +287,7 @@ export type TokenStats = z.infer<typeof TokenStats>;
 export const OAuthStartResult = z.object({
   authUrl: z.string(),
   // redirect: 브라우저 자동 복귀(루프백 접속). code: 콘솔 콜백 + 코드 붙여넣기(원격 접속).
-  // OpenAI 경로는 고정 loopback 콜백의 직접 PKCE 라 항상 redirect 를 반환한다.
+  // OpenAI 원격 경로는 등록된 loopback callback URL 전체를 붙여넣는 code 모드를 쓴다.
   mode: z.enum(["redirect", "code"]),
 });
 export type OAuthStartResult = z.infer<typeof OAuthStartResult>;

package/bundle/src/application/request-log/request-log.model.test.ts

@@ -279,6 +279,27 @@ describe("RequestLogModel run lifecycle", () => {
     vi.restoreAllMocks();
   });
 
+  it("keeps legacy external runs unstructured when metadata is omitted", async () => {
+    const ubRegister = vi.fn();
+    const transaction = vi.fn(
+      async (cb: (trx: { ubUpsert: () => Promise<number[]> }) => Promise<number>) =>
+        cb({ ubUpsert: vi.fn(async () => [16]) }),
+    );
+    vi.spyOn(
+      RequestLogModel as unknown as {
+        getPuri: () => { ubRegister: typeof ubRegister; transaction: typeof transaction };
+      },
+      "getPuri",
+    ).mockReturnValue({ ubRegister, transaction });
+
+    await RequestLogModel.createRun({ user_prompt: "plain text" });
+
+    expect(ubRegister).toHaveBeenCalledWith(
+      "request_logs",
+      expect.objectContaining({ is_structured: false, json_schema: null }),
+    );
+  });
+
   it("stores the requested model and attached tools but no serving model when a run starts", async () => {
     const ubRegister = vi.fn();
     const transaction = vi.fn(
@@ -296,6 +317,8 @@ describe("RequestLogModel run lifecycle", () => {
       RequestLogModel.createRun({
         user_prompt: "hi",
         requested_model_name: "openai/gpt-5-codex",
+        is_structured: true,
+        json_schema: '{"type":"object"}',
         tools: [{ name: "getWeather", description: "Get weather", inputSchema: { type: "object" } }],
       }),
     ).resolves.toBe(17);
@@ -306,6 +329,8 @@ describe("RequestLogModel run lifecycle", () => {
         status: "running",
         requested_model_name: "openai/gpt-5-codex",
         model_name: null,
+        is_structured: true,
+        json_schema: '{"type":"object"}',
         tools: [{ name: "getWeather", description: "Get weather", inputSchema: { type: "object" } }],
       }),
     );

package/bundle/src/application/request-log/request-log.model.ts

@@ -483,6 +483,7 @@ class RequestLogModelClass extends BaseModelClass<
     history?: unknown;
     tools?: ToolDefinitions;
     is_image_generation?: boolean;
+    is_structured?: boolean;
     json_schema?: string | null;
   }): Promise<number> {
     const wdb = this.getPuri("w");
@@ -505,7 +506,8 @@ class RequestLogModelClass extends BaseModelClass<
       // 이미지 turn 식별(R13). run 경로(tools+image 조합)도 auto 경로와 동일하게 마킹.
       is_image_generation: params.is_image_generation ?? false,
       json_schema: params.json_schema ?? null,
-      is_structured: params.json_schema !== null && params.json_schema !== undefined,
+      is_structured:
+        params.is_structured ?? (params.json_schema !== null && params.json_schema !== undefined),
       ...(params.history !== undefined ? { history: params.history as { type: string }[] } : {}),
       ...(params.tools !== undefined ? { tools: params.tools } : {}),
     });

package/bundle/src/application/sonamu.generated.http

@@ -41,7 +41,8 @@ Content-Type: application/json
       "active": false,
       "ord": 0,
       "quota_threshold": null,
-      "weight": 1
+      "weight": 1,
+      "keepalive_enabled": false
     }
   ]
 }
@@ -437,7 +438,9 @@ Content-Type: application/json
     "modelName": "MODELNAME",
     "effort": "EFFORT",
     "projectName": "PROJECTNAME",
-    "history": "HISTORY"
+    "history": "HISTORY",
+    "isStructured": false,
+    "jsonSchema": null
   }
 }
 
@@ -501,7 +504,8 @@ Content-Type: application/json
     "costSource": "provider",
     "totalDurationMs": 0,
     "history": "HISTORY",
-    "errorMessage": "ERRORMESSAGE"
+    "errorMessage": "ERRORMESSAGE",
+    "responseJsonOk": false
   }
 }
 

package/bundle/src/sonamu.config.ts

@@ -25,6 +25,7 @@ import {
 import { loadSettings, setSettingChangeHandler } from "./application/setting/setting.store";
 import { handleServerError } from "./server-error-handler";
 import { AnthropicDispatcher } from "./utils/providers/anthropic/anthropic-dispatcher";
+import { stopOpenAICallbackRelay } from "./utils/providers/openai/openai-callback-relay";
 import { OpenAIDispatcher } from "./utils/providers/openai/openai-dispatcher";
 
 const host = process.env.HOST ?? "localhost";
@@ -241,6 +242,7 @@ export default defineConfig({
         const log = getLogger(["qgrid", "startup"]);
         stopExpiredTokenReminder();
         stopTokenWindowKeepalive();
+        stopOpenAICallbackRelay();
         setSettingChangeHandler(null);
         QgridDispatcher.subscriber?.setTokenChangeHandler(null);
         if (QgridDispatcher.openaiDispatcher) {

package/bundle/src/utils/providers/anthropic/anthropic-dispatcher.test.ts

@@ -12,12 +12,14 @@ const {
   runClaudeSessionMock,
   refreshTokenMock,
   readAnthropicQuotaUsageMock,
+  invalidateAnthropicQuotaUsageMock,
   loggerInfoMock,
   loggerWarnMock,
 } = vi.hoisted(() => ({
   runClaudeSessionMock: vi.fn(),
   refreshTokenMock: vi.fn(),
   readAnthropicQuotaUsageMock: vi.fn(),
+  invalidateAnthropicQuotaUsageMock: vi.fn(),
   loggerInfoMock: vi.fn(),
   loggerWarnMock: vi.fn(),
 }));
@@ -33,6 +35,7 @@ vi.mock("./claude-session", async (importActual) => {
 
 vi.mock("./anthropic-quota", () => ({
   readAnthropicQuotaUsage: readAnthropicQuotaUsageMock,
+  invalidateAnthropicQuotaUsage: invalidateAnthropicQuotaUsageMock,
 }));
 
 vi.mock("../../../application/qgrid/qgrid.frame", () => ({
@@ -112,6 +115,7 @@ describe("AnthropicDispatcher", () => {
     refreshTokenMock.mockReset();
     refreshTokenMock.mockResolvedValue("sk-ant-oat01-refreshed");
     readAnthropicQuotaUsageMock.mockReset();
+    invalidateAnthropicQuotaUsageMock.mockReset();
     loggerInfoMock.mockReset();
     loggerWarnMock.mockReset();
   });
@@ -211,6 +215,21 @@ describe("AnthropicDispatcher", () => {
     runClaudeSessionMock.mockResolvedValueOnce(sessionResult({ quotaExhausted: true }));
 
     await expect(d.generate(baseReq())).rejects.toThrow(/quota exhausted/);
+    expect(invalidateAnthropicQuotaUsageMock).toHaveBeenCalledWith("sk-ant-oat01-test");
+  });
+
+  it("refresh 후 quota 소진은 선택 전후 access token cache를 모두 무효화한다", async () => {
+    const d = new AnthropicDispatcher();
+    d.onTokenAdded(1, "tok-A", creds(10_000), null, 1);
+    runClaudeSessionMock.mockResolvedValueOnce(sessionResult({ quotaExhausted: true }));
+
+    await expect(d.generate(baseReq())).rejects.toThrow(/quota exhausted/);
+
+    expect(invalidateAnthropicQuotaUsageMock).toHaveBeenNthCalledWith(1, "sk-ant-oat01-test");
+    expect(invalidateAnthropicQuotaUsageMock).toHaveBeenNthCalledWith(
+      2,
+      "sk-ant-oat01-refreshed",
+    );
   });
 
   it("claude 에러 → 에러", async () => {
@@ -306,6 +325,23 @@ describe("AnthropicDispatcher", () => {
     expect((await d.generate(baseReq())).tokenName).toBe("tok-B");
   });
 
+  it("Fable 요청은 Fable 전용 quota가 소진된 토큰을 건너뛴다", async () => {
+    const d = new AnthropicDispatcher();
+    d.onTokenAdded(1, "tok-A", creds(), 80, 1);
+    d.onTokenAdded(2, "tok-B", creds(), 80, 1);
+    readAnthropicQuotaUsageMock
+      .mockResolvedValueOnce(quotaOk(100))
+      .mockResolvedValueOnce(quotaOk(10));
+
+    const result = await d.generate(baseReq({ model: "claude-fable-5" }));
+
+    expect(result.tokenName).toBe("tok-B");
+    expect(readAnthropicQuotaUsageMock).toHaveBeenCalledWith(
+      expect.any(String),
+      "claude-fable-5",
+    );
+  });
+
   it("resets the schedule when a token weight changes", async () => {
     const d = new AnthropicDispatcher();
     d.onTokenAdded(1, "tok-A", creds(), null, 1);

package/bundle/src/utils/providers/anthropic/anthropic-dispatcher.ts

@@ -26,7 +26,11 @@ import {
 import { serializeAndValidateDispatchSchema } from "../common/schema-validation";
 import { SmoothWeightedRoundRobin } from "../common/smooth-weighted-round-robin";
 import { assertSupportedOneMillionSuffix, canonicalAnthropicModel } from "./anthropic-constants";
-import { readAnthropicQuotaUsage, type AnthropicQuotaUsageResult } from "./anthropic-quota";
+import {
+  invalidateAnthropicQuotaUsage,
+  readAnthropicQuotaUsage,
+  type AnthropicQuotaUsageResult,
+} from "./anthropic-quota";
 import { makeAnthropicWorkerId, runClaudeSession } from "./claude-session";
 
 const logger = getLogger(["qgrid", "anthropic-dispatcher"]);
@@ -163,7 +167,7 @@ export class AnthropicDispatcher implements ProviderDispatcher {
 
   // 지정 요청은 해당 토큰만 quota 판정하고 weighted 상태를 건드리지 않는다.
   // 미지정 요청만 quota 통과 후보로 smooth weighted round-robin 을 진행한다.
-  private async selectToken(preferredTokenId?: number): Promise<PooledToken | null> {
+  private async selectToken(model: string, preferredTokenId?: number): Promise<PooledToken | null> {
     const preferred =
       preferredTokenId === undefined ? undefined : this.tokenPool.get(preferredTokenId);
     if (preferredTokenId !== undefined && !preferred) {
@@ -172,7 +176,7 @@ export class AnthropicDispatcher implements ProviderDispatcher {
 
     const rows = preferred ? [preferred] : [...this.tokenPool.values()];
     if (rows.length === 0) return null;
-    const { eligible, overThresholdTokens } = await this.filterEligibleTokens(rows);
+    const { eligible, overThresholdTokens } = await this.filterEligibleTokens(rows, model);
     if (eligible.length === 0) {
       logger.warn("quota_threshold gate: all_exceeded", {
         provider: "anthropic",
@@ -193,7 +197,10 @@ export class AnthropicDispatcher implements ProviderDispatcher {
     return this.tokenPool.get(selectedId) ?? null;
   }
 
-  private async filterEligibleTokens(rows: PooledToken[]): Promise<{
+  private async filterEligibleTokens(
+    rows: PooledToken[],
+    model: string,
+  ): Promise<{
     eligible: PooledToken[];
     overThresholdTokens: Array<{ tokenName: string; threshold: number }>;
   }> {
@@ -207,7 +214,7 @@ export class AnthropicDispatcher implements ProviderDispatcher {
     const checks = await Promise.allSettled(
       thresholded.map(async (token) => ({
         token,
-        result: await readAnthropicQuotaUsage(token.credentials.accessToken),
+        result: await readAnthropicQuotaUsage(token.credentials.accessToken, model),
       })),
     );
 
@@ -314,7 +321,7 @@ export class AnthropicDispatcher implements ProviderDispatcher {
     const model = canonicalAnthropicModel(req.model);
     const jsonSchema = serializeAndValidateDispatchSchema(req.outputSchema, "anthropic");
 
-    const token = await this.selectToken(req.preferredTokenId);
+    const token = await this.selectToken(model, req.preferredTokenId);
     if (!token) throw new Error("No anthropic tokens available");
 
     const exec = async (): Promise<GenerateResult> => {
@@ -359,7 +366,13 @@ export class AnthropicDispatcher implements ProviderDispatcher {
         onDelta,
       );
 
-      if (session.quotaExhausted) throw new Error(`quota exhausted (${token.name})`);
+      if (session.quotaExhausted) {
+        invalidateAnthropicQuotaUsage(token.credentials.accessToken);
+        if (accessToken !== token.credentials.accessToken) {
+          invalidateAnthropicQuotaUsage(accessToken);
+        }
+        throw new Error(`quota exhausted (${token.name})`);
+      }
       if (session.isError) {
         // 진단(SON-495): isError 판정 사유(subtype/terminal_reason)를 메시지 앞에 드러낸다.
         // 그동안 detail 이 session.text(완전한 JSON 본문)뿐이라 "schema 위반인지 / max retries 인지 /

package/bundle/src/utils/providers/anthropic/anthropic-quota.test.ts

@@ -34,6 +34,28 @@ describe("readAnthropicQuotaUsage", () => {
     });
   });
 
+  it("uses the separate Fable 5 limit only for Fable requests", async () => {
+    const usage = {
+      data: {
+        five_hour: { utilization: 10, resets_at: null },
+        seven_day_overage_included: { utilization: 100, resets_at: null },
+      },
+      cachedAt: Date.now(),
+    };
+    fetchUsageWithMetaMock.mockResolvedValue(usage);
+
+    await expect(readAnthropicQuotaUsage("access-token", "claude-fable-5")).resolves.toMatchObject({
+      kind: "ok",
+      utilizationPct: 100,
+    });
+    await expect(
+      readAnthropicQuotaUsage("access-token", "claude-sonnet-4-6"),
+    ).resolves.toMatchObject({
+      kind: "ok",
+      utilizationPct: 10,
+    });
+  });
+
   it("keeps low percent utilization unchanged", async () => {
     fetchUsageWithMetaMock.mockResolvedValueOnce({
       data: { five_hour: { utilization: 1, resets_at: null } },

package/bundle/src/utils/providers/anthropic/anthropic-quota.ts

@@ -1,4 +1,9 @@
-import { fetchUsageWithMeta } from "../../../application/qgrid/oauth";
+import {
+  fetchUsageWithMeta,
+  invalidateAnthropicQuotaUsage,
+} from "../../../application/qgrid/oauth";
+
+export { invalidateAnthropicQuotaUsage };
 
 export type AnthropicQuotaUsageResult =
   | { kind: "ok"; utilizationPct: number; cacheAgeMs: number }
@@ -6,12 +11,21 @@ export type AnthropicQuotaUsageResult =
 
 export async function readAnthropicQuotaUsage(
   accessToken: string,
+  model?: string,
 ): Promise<AnthropicQuotaUsageResult> {
   try {
     const { data, cachedAt } = await fetchUsageWithMeta(accessToken);
     if (data.error) return { kind: "lookup_failed", reason: data.error };
 
-    const utilization = data.five_hour?.utilization;
+    const utilizations = [data.five_hour?.utilization];
+    if (model === "claude-fable-5") {
+      utilizations.push(data.seven_day_overage_included?.utilization);
+    }
+    const utilization = Math.max(
+      ...utilizations.filter(
+        (value): value is number => typeof value === "number" && Number.isFinite(value),
+      ),
+    );
     if (typeof utilization !== "number" || !Number.isFinite(utilization)) {
       return { kind: "lookup_failed", reason: "five_hour utilization unavailable" };
     }

package/bundle/src/utils/providers/openai/openai-callback-relay.test.ts

@@ -0,0 +1,109 @@
+import http from "node:http";
+import type { AddressInfo } from "node:net";
+
+import { afterEach, describe, expect, it } from "vitest";
+
+import {
+  OPENAI_CALLBACK_PATH,
+  OPENAI_CALLBACK_PORTS,
+  openAICallbackRedirectUri,
+  startOpenAICallbackRelay,
+  stopOpenAICallbackRelay,
+} from "./openai-callback-relay";
+
+const DASHBOARD = "http://localhost:44900";
+
+function freePort(): Promise<number> {
+  return new Promise((resolve) => {
+    const probe = http.createServer();
+    probe.listen(0, "127.0.0.1", () => {
+      const port = (probe.address() as AddressInfo).port;
+      probe.close(() => resolve(port));
+    });
+  });
+}
+
+function occupy(port: number): Promise<http.Server> {
+  return new Promise((resolve) => {
+    const server = http.createServer();
+    server.listen(port, "127.0.0.1", () => resolve(server));
+  });
+}
+
+function get(url: string): Promise<{ status: number; location?: string }> {
+  return new Promise((resolve, reject) => {
+    const request = http.get(url, (response) => {
+      response.resume();
+      resolve({
+        status: response.statusCode ?? 0,
+        ...(response.headers.location ? { location: response.headers.location } : {}),
+      });
+    });
+    request.on("error", reject);
+  });
+}
+
+describe("openai callback relay", () => {
+  const occupied: http.Server[] = [];
+
+  afterEach(async () => {
+    stopOpenAICallbackRelay();
+    await Promise.all(occupied.splice(0).map((s) => new Promise((r) => s.close(r))));
+  });
+
+  it("pins the redirect URI to the ports OpenAI registered for the Codex CLI client", () => {
+    expect(OPENAI_CALLBACK_PORTS).toEqual([1455, 1457]);
+    expect(openAICallbackRedirectUri(1455)).toBe("http://localhost:1455/auth/callback");
+  });
+
+  it("forwards only code and state to the qgrid callback route", async () => {
+    const port = await freePort();
+    const redirectUri = await startOpenAICallbackRelay(DASHBOARD, 60_000, [port]);
+    expect(redirectUri).toBe(`http://localhost:${port}${OPENAI_CALLBACK_PATH}`);
+
+    const result = await get(
+      `http://127.0.0.1:${port}${OPENAI_CALLBACK_PATH}?code=the-code&state=the-state&extra=x`,
+    );
+
+    expect(result.status).toBe(302);
+    expect(result.location).toBe(
+      `${DASHBOARD}${OPENAI_CALLBACK_PATH}?code=the-code&state=the-state`,
+    );
+  });
+
+  it("answers 404 on any other path", async () => {
+    const port = await freePort();
+    await startOpenAICallbackRelay(DASHBOARD, 60_000, [port]);
+
+    expect((await get(`http://127.0.0.1:${port}/callback?code=c&state=s`)).status).toBe(404);
+  });
+
+  it("falls back to the next registered port when the first is taken", async () => {
+    const taken = await freePort();
+    const fallback = await freePort();
+    occupied.push(await occupy(taken));
+
+    const redirectUri = await startOpenAICallbackRelay(DASHBOARD, 60_000, [taken, fallback]);
+
+    expect(redirectUri).toBe(`http://localhost:${fallback}${OPENAI_CALLBACK_PATH}`);
+  });
+
+  it("reuses the running listener for a second login", async () => {
+    const port = await freePort();
+    const first = await startOpenAICallbackRelay(DASHBOARD, 60_000, [port]);
+    const second = await startOpenAICallbackRelay(DASHBOARD, 60_000, [await freePort()]);
+
+    expect(second).toBe(first);
+  });
+
+  it("fails when every registered port is taken", async () => {
+    const a = await freePort();
+    const b = await freePort();
+    occupied.push(await occupy(a), await occupy(b));
+
+    await expect(startOpenAICallbackRelay(DASHBOARD, 60_000, [a, b])).rejects.toThrow(
+      /PORTS_UNAVAILABLE/,
+    );
+  });
+});
+