@georgedong32/ccs 7.66.0

package/dist/cliproxy/executor/index.js

@@ -0,0 +1,989 @@
+"use strict";
+/**
+ * CLIProxy Executor - Main Orchestrator
+ *
+ * Coordinates the full execution flow:
+ * 1. Configuration resolution and validation
+ * 2. Binary management and remote proxy checks
+ * 3. Authentication and account management
+ * 4. Proxy lifecycle (spawn/detect/join)
+ * 5. Environment setup and proxy chains
+ * 6. Claude CLI execution with cleanup handlers
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findAvailablePort = exports.isPortAvailable = exports.execClaudeWithCLIProxy = void 0;
+const child_process_1 = require("child_process");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const progress_indicator_1 = require("../../utils/progress-indicator");
+const ui_1 = require("../../utils/ui");
+const config_manager_1 = require("../../utils/config-manager");
+const shell_executor_1 = require("../../utils/shell-executor");
+const binary_manager_1 = require("../binary-manager");
+const config_generator_1 = require("../config-generator");
+const remote_proxy_client_1 = require("../remote-proxy-client");
+const auth_handler_1 = require("../auth-handler");
+const types_1 = require("../types");
+const platform_detector_1 = require("../platform-detector");
+const model_config_1 = require("../model-config");
+const codex_plan_compatibility_1 = require("../codex-plan-compatibility");
+const proxy_config_resolver_1 = require("../proxy-config-resolver");
+const model_catalog_1 = require("../model-catalog");
+const codex_reasoning_proxy_1 = require("../codex-reasoning-proxy");
+const tool_sanitization_proxy_1 = require("../tool-sanitization-proxy");
+const account_manager_1 = require("../account-manager");
+const email_account_identity_1 = require("../accounts/email-account-identity");
+const websearch_manager_1 = require("../../utils/websearch-manager");
+const image_analysis_1 = require("../../utils/image-analysis");
+const unified_config_loader_1 = require("../../config/unified-config-loader");
+const https_tunnel_proxy_1 = require("../https-tunnel-proxy");
+const auth_types_1 = require("../auth/auth-types");
+const profile_continuity_inheritance_1 = require("../../auth/profile-continuity-inheritance");
+// Import modular components
+const lifecycle_manager_1 = require("./lifecycle-manager");
+const env_resolver_1 = require("./env-resolver");
+const retry_handler_1 = require("./retry-handler");
+const session_bridge_1 = require("./session-bridge");
+const thinking_arg_parser_1 = require("./thinking-arg-parser");
+const account_safety_1 = require("../account-safety");
+const antigravity_responsibility_1 = require("../antigravity-responsibility");
+const websearch_manager_2 = require("../../utils/websearch-manager");
+const thinking_override_resolver_1 = require("./thinking-override-resolver");
+/** Default executor configuration */
+const DEFAULT_CONFIG = {
+    port: config_generator_1.CLIPROXY_DEFAULT_PORT,
+    timeout: 5000,
+    verbose: false,
+    pollInterval: 100,
+};
+/**
+ * Execute Claude CLI with CLIProxy (main entry point)
+ *
+ * @param claudeCli Path to Claude CLI executable
+ * @param provider CLIProxy provider (gemini, codex, agy, qwen)
+ * @param args Arguments to pass to Claude CLI
+ * @param config Optional executor configuration
+ */
+async function execClaudeWithCLIProxy(claudeCli, provider, args, config = {}) {
+    // Filter out undefined values to prevent overwriting defaults
+    const filteredConfig = Object.fromEntries(Object.entries(config).filter(([, v]) => v !== undefined));
+    const cfg = { ...DEFAULT_CONFIG, ...filteredConfig };
+    const verbose = cfg.verbose || args.includes('--verbose') || args.includes('-v');
+    // Validate Claude CLI exists before proceeding
+    if (!fs.existsSync(claudeCli)) {
+        console.error((0, ui_1.fail)(`Claude CLI not found at: ${claudeCli}`));
+        console.error('    Run "ccs doctor --fix" to reinstall or check your PATH');
+        process.exit(1);
+    }
+    const log = (msg) => {
+        if (verbose) {
+            console.error(`[cliproxy] ${msg}`);
+        }
+    };
+    // Helper: Extract unique providers from composite tiers
+    const compositeProviders = cfg.isComposite && cfg.compositeTiers
+        ? [...new Set(Object.values(cfg.compositeTiers).map((t) => t.provider))]
+        : [];
+    // 0. Resolve proxy configuration (CLI > ENV > config.yaml > defaults)
+    const unifiedConfig = (0, unified_config_loader_1.loadOrCreateUnifiedConfig)();
+    // 0a. Runtime backend/provider validation
+    const backend = unifiedConfig.cliproxy?.backend ?? platform_detector_1.DEFAULT_BACKEND;
+    // Collect all providers to validate (default + composite tiers)
+    const allProviders = [provider, ...compositeProviders];
+    for (const p of allProviders) {
+        if (backend === 'original' && types_1.PLUS_ONLY_PROVIDERS.includes(p)) {
+            console.error('');
+            console.error((0, ui_1.fail)(`${p} requires CLIProxyAPIPlus backend`));
+            console.error('');
+            console.error('To use this provider, either:');
+            console.error('  1. Set `cliproxy.backend: plus` in ~/.ccs/config.yaml');
+            console.error('  2. Use --backend=plus flag: ccs ' + p + ' --backend=plus');
+            console.error('');
+            throw new Error(`Provider ${p} requires Plus backend`);
+        }
+    }
+    const cliproxyServerConfig = unifiedConfig.cliproxy_server;
+    const { config: proxyConfig, remainingArgs: argsWithoutProxy } = (0, proxy_config_resolver_1.resolveProxyConfig)(args, {
+        remote: cliproxyServerConfig?.remote
+            ? {
+                enabled: cliproxyServerConfig.remote.enabled,
+                host: cliproxyServerConfig.remote.host,
+                port: cliproxyServerConfig.remote.port,
+                protocol: cliproxyServerConfig.remote.protocol,
+                auth_token: cliproxyServerConfig.remote.auth_token,
+                management_key: cliproxyServerConfig.remote.management_key,
+                timeout: cliproxyServerConfig.remote.timeout,
+            }
+            : undefined,
+        local: cliproxyServerConfig?.local
+            ? {
+                port: cliproxyServerConfig.local.port,
+                auto_start: cliproxyServerConfig.local.auto_start,
+            }
+            : undefined,
+    });
+    // Port resolution and validation
+    if (cfg.port && cfg.port !== config_generator_1.CLIPROXY_DEFAULT_PORT) {
+        if (proxyConfig.port !== config_generator_1.CLIPROXY_DEFAULT_PORT) {
+            cfg.port = proxyConfig.port;
+        }
+    }
+    else if (proxyConfig.port !== config_generator_1.CLIPROXY_DEFAULT_PORT) {
+        cfg.port = proxyConfig.port;
+    }
+    cfg.port = (0, config_generator_1.validatePort)(cfg.port);
+    log(`Proxy mode: ${proxyConfig.mode}`);
+    if (proxyConfig.mode === 'remote') {
+        log(`Remote host: ${proxyConfig.host}:${proxyConfig.port} (${proxyConfig.protocol})`);
+    }
+    // Setup first-class CCS WebSearch runtime
+    (0, websearch_manager_1.ensureWebSearchMcpOrThrow)();
+    const imageAnalysisMcpReady = (0, image_analysis_1.ensureImageAnalysisMcpOrThrow)();
+    (0, websearch_manager_1.displayWebSearchStatus)();
+    const providerConfig = (0, config_generator_1.getProviderConfig)(provider);
+    log(`Provider: ${providerConfig.displayName}`);
+    (0, account_safety_1.warnOAuthBanRisk)(provider);
+    // Check remote proxy if configured
+    let useRemoteProxy = false;
+    if (proxyConfig.mode === 'remote' && proxyConfig.host) {
+        const status = await (0, remote_proxy_client_1.checkRemoteProxy)({
+            host: proxyConfig.host,
+            port: proxyConfig.port,
+            protocol: proxyConfig.protocol,
+            authToken: proxyConfig.authToken,
+            timeout: proxyConfig.timeout ?? 2000,
+            allowSelfSigned: proxyConfig.allowSelfSigned ?? false,
+        });
+        if (status.reachable) {
+            useRemoteProxy = true;
+            console.log((0, ui_1.ok)(`Connected to remote proxy at ${proxyConfig.host}:${proxyConfig.port} (${status.latencyMs}ms)`));
+        }
+        else {
+            console.error((0, ui_1.warn)(`Remote proxy unreachable: ${status.error}`));
+            if (proxyConfig.remoteOnly) {
+                throw new Error('Remote proxy unreachable and --remote-only specified');
+            }
+            if (proxyConfig.fallbackEnabled) {
+                if (proxyConfig.autoStartLocal) {
+                    console.log((0, ui_1.info)('Falling back to local proxy...'));
+                }
+                else {
+                    if (process.stdin.isTTY) {
+                        const readline = await Promise.resolve().then(() => __importStar(require('readline')));
+                        const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+                        const answer = await new Promise((resolve) => {
+                            rl.question('Start local proxy instead? [Y/n] ', resolve);
+                        });
+                        rl.close();
+                        if (answer.toLowerCase() === 'n') {
+                            throw new Error('Remote proxy unreachable and user declined fallback');
+                        }
+                    }
+                    console.log((0, ui_1.info)('Starting local proxy...'));
+                }
+            }
+            else {
+                throw new Error('Remote proxy unreachable and fallback disabled');
+            }
+        }
+    }
+    // Variables for local proxy mode
+    let binaryPath;
+    let sessionId;
+    // 1. Ensure binary exists (downloads if needed) - SKIP for remote mode
+    if (!useRemoteProxy) {
+        const spinner = new progress_indicator_1.ProgressIndicator('Preparing CLIProxy');
+        spinner.start();
+        try {
+            binaryPath = await (0, binary_manager_1.ensureCLIProxyBinary)(verbose);
+            spinner.succeed('CLIProxy binary ready');
+        }
+        catch (error) {
+            spinner.fail('Failed to prepare CLIProxy');
+            const err = error;
+            if ((0, retry_handler_1.isNetworkError)(err)) {
+                (0, retry_handler_1.handleNetworkError)(err);
+            }
+            throw error;
+        }
+    }
+    // 2. Handle special flags (simplified flag parsing - full implementation continues below)
+    const forceAuth = argsWithoutProxy.includes('--auth');
+    const pasteCallback = argsWithoutProxy.includes('--paste-callback');
+    const portForward = argsWithoutProxy.includes('--port-forward');
+    const forceHeadless = argsWithoutProxy.includes('--headless');
+    if (pasteCallback && portForward) {
+        console.error((0, ui_1.fail)('Cannot use --paste-callback with --port-forward'));
+        console.error('    --paste-callback: Manually paste OAuth redirect URL');
+        console.error('    --port-forward: Use SSH port forwarding for callback');
+        process.exit(1);
+    }
+    const forceLogout = argsWithoutProxy.includes('--logout');
+    const forceConfig = argsWithoutProxy.includes('--config');
+    const addAccount = argsWithoutProxy.includes('--add');
+    const showAccounts = argsWithoutProxy.includes('--accounts');
+    const forceImport = argsWithoutProxy.includes('--import');
+    const acceptAgyRisk = (0, antigravity_responsibility_1.hasAntigravityRiskAcceptanceFlag)(argsWithoutProxy);
+    const incognitoFlag = argsWithoutProxy.includes('--incognito');
+    const noIncognitoFlag = argsWithoutProxy.includes('--no-incognito');
+    const kiroNoIncognitoConfig = provider === 'kiro' ? (unifiedConfig.cliproxy?.kiro_no_incognito ?? true) : false;
+    const noIncognito = incognitoFlag ? false : noIncognitoFlag || kiroNoIncognitoConfig;
+    // Parse --use flag
+    let useAccount;
+    const useIdx = argsWithoutProxy.indexOf('--use');
+    if (useIdx !== -1 &&
+        argsWithoutProxy[useIdx + 1] &&
+        !argsWithoutProxy[useIdx + 1].startsWith('-')) {
+        useAccount = argsWithoutProxy[useIdx + 1];
+    }
+    // Parse --nickname flag
+    let setNickname;
+    const nicknameIdx = argsWithoutProxy.indexOf('--nickname');
+    if (nicknameIdx !== -1 &&
+        argsWithoutProxy[nicknameIdx + 1] &&
+        !argsWithoutProxy[nicknameIdx + 1].startsWith('-')) {
+        setNickname = argsWithoutProxy[nicknameIdx + 1];
+    }
+    // Parse --kiro-auth-method flag
+    let kiroAuthMethod;
+    const kiroMethodIdx = argsWithoutProxy.indexOf('--kiro-auth-method');
+    if (kiroMethodIdx !== -1) {
+        const rawMethod = argsWithoutProxy[kiroMethodIdx + 1];
+        if (!rawMethod || rawMethod.startsWith('-')) {
+            console.error((0, ui_1.fail)('--kiro-auth-method requires a value'));
+            console.error('    Supported values: aws, aws-authcode, google, github');
+            process.exitCode = 1;
+            return;
+        }
+        const normalized = rawMethod.trim().toLowerCase();
+        if (!(0, auth_types_1.isKiroAuthMethod)(normalized)) {
+            console.error((0, ui_1.fail)(`Invalid --kiro-auth-method value: ${rawMethod}`));
+            console.error('    Supported values: aws, aws-authcode, google, github');
+            process.exitCode = 1;
+            return;
+        }
+        kiroAuthMethod = (0, auth_types_1.normalizeKiroAuthMethod)(normalized);
+    }
+    if (kiroAuthMethod && provider !== 'kiro' && !compositeProviders.includes('kiro')) {
+        console.error((0, ui_1.fail)('--kiro-auth-method is only valid for ccs kiro'));
+        process.exitCode = 1;
+        return;
+    }
+    // Parse --thinking / --effort flags (aliases; first occurrence wins)
+    const thinkingParse = (0, thinking_arg_parser_1.parseThinkingOverride)(argsWithoutProxy);
+    if (thinkingParse.error) {
+        const { flag } = thinkingParse.error;
+        console.error((0, ui_1.fail)(`${flag} requires a value`));
+        if (provider === 'codex') {
+            console.error('    Codex examples: --effort xhigh, --effort high, --effort medium');
+            console.error('    Alias: --thinking xhigh (same behavior)');
+        }
+        else {
+            console.error('    Examples: --thinking low, --thinking 8192, --thinking off');
+            console.error('    Levels: minimal, low, medium, high, xhigh, auto');
+        }
+        process.exit(1);
+    }
+    const { thinkingOverride, thinkingSource } = (0, thinking_override_resolver_1.resolveRuntimeThinkingOverride)(thinkingParse.value, process.env.CCS_THINKING);
+    const thinkingCfg = (0, unified_config_loader_1.getThinkingConfig)();
+    if (thinkingParse.duplicateDisplays.length > 0) {
+        console.warn(`[!] Multiple reasoning flags detected. Using first occurrence: ${thinkingParse.sourceDisplay}`);
+    }
+    if (thinkingParse.sourceFlag === '--effort' && provider !== 'codex') {
+        console.warn((0, ui_1.warn)('`--effort` is primarily for codex. Continuing as alias of `--thinking` for compatibility.'));
+    }
+    // Parse --1m / --no-1m flags for extended context (1M token window)
+    let extendedContextOverride;
+    const has1mFlag = argsWithoutProxy.includes('--1m') || argsWithoutProxy.some((arg) => arg.startsWith('--1m='));
+    const hasNo1mFlag = argsWithoutProxy.includes('--no-1m') ||
+        argsWithoutProxy.some((arg) => arg.startsWith('--no-1m='));
+    if (has1mFlag && hasNo1mFlag) {
+        console.error((0, ui_1.fail)('Cannot use both --1m and --no-1m flags'));
+        process.exit(1);
+    }
+    else if (has1mFlag) {
+        extendedContextOverride = true;
+    }
+    else if (hasNo1mFlag) {
+        extendedContextOverride = false;
+    }
+    // undefined = auto behavior (Gemini: on, others: off)
+    // Handle --accounts
+    if (showAccounts) {
+        const accounts = (0, account_manager_1.getProviderAccounts)(provider);
+        if (accounts.length === 0) {
+            console.log((0, ui_1.info)(`No accounts registered for ${providerConfig.displayName}`));
+            console.log(`    Run "ccs ${provider} --auth" to add an account`);
+        }
+        else {
+            console.log(`\n${providerConfig.displayName} Accounts:\n`);
+            for (const acct of accounts) {
+                const defaultMark = acct.isDefault ? ' (default)' : '';
+                const nickname = acct.nickname ? `[${acct.nickname}]` : '';
+                console.log(`  ${nickname.padEnd(12)} ${(0, email_account_identity_1.formatAccountDisplayName)(acct)}${defaultMark}`);
+            }
+            console.log(`\n  Use "ccs ${provider} --use <nickname-or-id>" to switch accounts`);
+        }
+        process.exit(0);
+    }
+    // Handle --use
+    if (useAccount) {
+        const account = (0, account_manager_1.findAccountByQuery)(provider, useAccount);
+        if (!account) {
+            console.error((0, ui_1.fail)(`Account not found: "${useAccount}"`));
+            const accounts = (0, account_manager_1.getProviderAccounts)(provider);
+            if (accounts.length > 0) {
+                console.error(`    Available accounts:`);
+                for (const acct of accounts) {
+                    const displayName = (0, email_account_identity_1.formatAccountDisplayName)(acct);
+                    const label = acct.nickname ? `${acct.nickname} (${displayName})` : displayName;
+                    console.error(`      - ${label}`);
+                }
+            }
+            process.exit(1);
+        }
+        (0, account_manager_1.setDefaultAccount)(provider, account.id);
+        (0, account_manager_1.touchAccount)(provider, account.id);
+        const switchedLabel = account.nickname
+            ? `${account.nickname} (${(0, email_account_identity_1.formatAccountDisplayName)(account)})`
+            : (0, email_account_identity_1.formatAccountDisplayName)(account);
+        console.log((0, ui_1.ok)(`Switched to account: ${switchedLabel}`));
+    }
+    // Handle --nickname (rename account)
+    if (setNickname && !addAccount) {
+        const defaultAccount = (0, account_manager_1.getDefaultAccount)(provider);
+        if (!defaultAccount) {
+            console.error((0, ui_1.fail)(`No account found for ${providerConfig.displayName}`));
+            console.error(`    Run "ccs ${provider} --auth" to add an account first`);
+            process.exit(1);
+        }
+        try {
+            const success = (0, account_manager_1.renameAccount)(provider, defaultAccount.id, setNickname);
+            if (success) {
+                console.log((0, ui_1.ok)(`Renamed account to: ${setNickname}`));
+            }
+            else {
+                console.error((0, ui_1.fail)('Failed to rename account'));
+                process.exit(1);
+            }
+        }
+        catch (err) {
+            console.error((0, ui_1.fail)(err instanceof Error ? err.message : 'Failed to rename account'));
+            process.exit(1);
+        }
+        process.exit(0);
+    }
+    // Handle --config
+    if (forceConfig && (0, model_catalog_1.supportsModelConfig)(provider)) {
+        // Block --config for composite variants (per-tier models in config.yaml)
+        if (cfg.isComposite) {
+            const variantName = cfg.profileName || provider;
+            console.log((0, ui_1.warn)('Composite variants use per-tier config. Edit config.yaml to change tier models.'));
+            console.error(`    Use "ccs cliproxy edit ${variantName}" to modify composite variants`);
+            process.exit(1);
+        }
+        else {
+            await (0, model_config_1.configureProviderModel)(provider, true, cfg.customSettingsPath);
+            process.exit(0);
+        }
+    }
+    // Handle --logout
+    if (forceLogout) {
+        const { clearAuth } = await Promise.resolve().then(() => __importStar(require('../auth-handler')));
+        if (clearAuth(provider)) {
+            console.log((0, ui_1.ok)(`Logged out from ${providerConfig.displayName}`));
+        }
+        else {
+            console.log((0, ui_1.info)(`No authentication found for ${providerConfig.displayName}`));
+        }
+        process.exit(0);
+    }
+    // Handle --import (Kiro only)
+    if (forceImport) {
+        if (provider !== 'kiro') {
+            console.error((0, ui_1.fail)('--import is only available for Kiro'));
+            console.error(`    Run "ccs ${provider} --auth" to authenticate`);
+            process.exit(1);
+        }
+        if (forceAuth) {
+            console.error((0, ui_1.fail)('Cannot use --import with --auth'));
+            console.error('    --import: Import existing token from Kiro IDE');
+            console.error('    --auth: Trigger new OAuth flow in browser');
+            process.exit(1);
+        }
+        if (forceLogout) {
+            console.error((0, ui_1.fail)('Cannot use --import with --logout'));
+            process.exit(1);
+        }
+        const { triggerOAuth } = await Promise.resolve().then(() => __importStar(require('../auth-handler')));
+        const authSuccess = await triggerOAuth(provider, {
+            verbose,
+            import: true,
+            ...(kiroAuthMethod ? { kiroMethod: kiroAuthMethod } : {}),
+            ...(setNickname ? { nickname: setNickname } : {}),
+        });
+        if (!authSuccess) {
+            console.error((0, ui_1.fail)('Failed to import Kiro token from IDE'));
+            console.error('    Make sure you are logged into Kiro IDE first');
+            process.exit(1);
+        }
+        process.exit(0);
+    }
+    // 3. Ensure OAuth completed (if provider requires it)
+    const remoteAuthToken = proxyConfig.authToken?.trim();
+    const skipLocalAuth = useRemoteProxy && !!remoteAuthToken;
+    if (skipLocalAuth) {
+        log(`Using remote proxy authentication (skipping local OAuth)`);
+    }
+    if (provider === 'agy' && forceAuth && skipLocalAuth) {
+        const acknowledged = await (0, antigravity_responsibility_1.ensureCliAntigravityResponsibility)({
+            context: 'oauth',
+            acceptedByFlag: acceptAgyRisk,
+        });
+        if (!acknowledged) {
+            throw new Error(`Antigravity auth blocked. Re-run after completing confirmation or pass ${antigravity_responsibility_1.ANTIGRAVITY_ACCEPT_RISK_FLAGS[0]}.`);
+        }
+        console.error((0, ui_1.info)('Remote proxy mode is active; local OAuth flow is skipped in --auth mode.'));
+        return;
+    }
+    if (provider === 'agy' && !forceAuth) {
+        const requiresAuthNow = providerConfig.requiresOAuth && !(0, auth_handler_1.isAuthenticated)(provider);
+        if (skipLocalAuth || !requiresAuthNow) {
+            const acknowledged = await (0, antigravity_responsibility_1.ensureCliAntigravityResponsibility)({
+                context: 'run',
+                acceptedByFlag: acceptAgyRisk,
+            });
+            if (!acknowledged) {
+                console.error((0, ui_1.fail)(`Antigravity session blocked. Re-run after completing confirmation or pass ${antigravity_responsibility_1.ANTIGRAVITY_ACCEPT_RISK_FLAGS[0]}.`));
+                process.exit(1);
+            }
+        }
+    }
+    if (providerConfig.requiresOAuth && !skipLocalAuth) {
+        log(`Checking authentication for ${provider}`);
+        // Multi-provider auth check for composite variants
+        if (compositeProviders.length > 0) {
+            // Handle forceAuth for composite providers
+            if (forceAuth) {
+                const { triggerOAuth } = await Promise.resolve().then(() => __importStar(require('../auth-handler')));
+                const failures = [];
+                for (const p of compositeProviders) {
+                    const authSuccess = await triggerOAuth(p, {
+                        verbose,
+                        add: addAccount,
+                        ...(acceptAgyRisk ? { acceptAgyRisk: true } : {}),
+                        ...(kiroAuthMethod && p === 'kiro' ? { kiroMethod: kiroAuthMethod } : {}),
+                        ...(forceHeadless ? { headless: true } : {}),
+                        ...(setNickname ? { nickname: setNickname } : {}),
+                        ...(noIncognito ? { noIncognito: true } : {}),
+                        ...(pasteCallback ? { pasteCallback: true } : {}),
+                        ...(portForward ? { portForward: true } : {}),
+                    });
+                    if (!authSuccess) {
+                        failures.push(p);
+                    }
+                }
+                if (failures.length > 0) {
+                    const succeeded = compositeProviders.filter((p) => !failures.includes(p));
+                    console.error((0, ui_1.fail)(`Auth failed for: ${failures.join(', ')}`));
+                    if (succeeded.length > 0) {
+                        console.error((0, ui_1.info)(`Succeeded: ${succeeded.join(', ')}`));
+                    }
+                    process.exit(1);
+                }
+                process.exit(0);
+            }
+            // Check for unauthenticated providers
+            const unauthenticatedProviders = [];
+            for (const p of compositeProviders) {
+                if (!(0, auth_handler_1.isAuthenticated)(p)) {
+                    unauthenticatedProviders.push(p);
+                }
+            }
+            if (unauthenticatedProviders.length > 0) {
+                console.error((0, ui_1.fail)('Composite variant requires authentication for multiple providers:'));
+                for (const p of unauthenticatedProviders) {
+                    console.error(`    - ${p} (run "ccs ${p} --auth")`);
+                }
+                process.exit(1);
+            }
+        }
+        else if (forceAuth || !(0, auth_handler_1.isAuthenticated)(provider)) {
+            const { triggerOAuth } = await Promise.resolve().then(() => __importStar(require('../auth-handler')));
+            const authSuccess = await triggerOAuth(provider, {
+                verbose,
+                add: addAccount,
+                ...(acceptAgyRisk ? { acceptAgyRisk: true } : {}),
+                ...(kiroAuthMethod ? { kiroMethod: kiroAuthMethod } : {}),
+                ...(forceHeadless ? { headless: true } : {}),
+                ...(setNickname ? { nickname: setNickname } : {}),
+                ...(noIncognito ? { noIncognito: true } : {}),
+                ...(pasteCallback ? { pasteCallback: true } : {}),
+                ...(portForward ? { portForward: true } : {}),
+            });
+            if (!authSuccess) {
+                throw new Error(`Authentication required for ${providerConfig.displayName}`);
+            }
+            if (forceAuth) {
+                process.exit(0);
+            }
+        }
+        else {
+            log(`${provider} already authenticated`);
+        }
+        // 3a. Proactive token refresh (multi-provider for composite)
+        if (compositeProviders.length > 0) {
+            for (const p of compositeProviders) {
+                await (0, retry_handler_1.handleTokenExpiration)(p, verbose);
+            }
+        }
+        else {
+            await (0, retry_handler_1.handleTokenExpiration)(provider, verbose);
+        }
+        // 3a-1. Update lastUsedAt
+        const usedAccount = (0, account_manager_1.getDefaultAccount)(provider);
+        if (usedAccount) {
+            (0, account_manager_1.touchAccount)(provider, usedAccount.id);
+        }
+    }
+    // 3b. Preflight quota check (providers with quota-based rotation)
+    if (!skipLocalAuth) {
+        // Multi-tier quota check for composite variants (check if any tier uses a managed provider)
+        if (compositeProviders.length > 0) {
+            const managedQuotaProviders = ['agy', 'claude'];
+            for (const managedProvider of managedQuotaProviders) {
+                if (compositeProviders.includes(managedProvider)) {
+                    await (0, retry_handler_1.handleQuotaCheck)(managedProvider);
+                }
+            }
+        }
+        else {
+            await (0, retry_handler_1.handleQuotaCheck)(provider);
+        }
+    }
+    // 3c. Account safety: enforce cross-provider isolation
+    if (!skipLocalAuth) {
+        (0, account_safety_1.cleanupStaleAutoPauses)();
+        const isolated = (0, account_safety_1.enforceProviderIsolation)(provider);
+        if (isolated === 0) {
+            // No enforcement — still warn about duplicates for awareness
+            (0, account_safety_1.warnCrossProviderDuplicates)(provider);
+        }
+        else {
+            // 'exit' handlers must be synchronous — restoreAutoPausedAccounts uses sync fs APIs
+            process.on('exit', () => {
+                (0, account_safety_1.restoreAutoPausedAccounts)(provider);
+            });
+        }
+    }
+    // 4. First-run model configuration
+    if (!cfg.isComposite && (0, model_catalog_1.supportsModelConfig)(provider) && !skipLocalAuth) {
+        await (0, model_config_1.configureProviderModel)(provider, false, cfg.customSettingsPath);
+    }
+    // 5. Check for broken models (multi-tier for composite)
+    if (compositeProviders.length > 0 && cfg.compositeTiers) {
+        // Check all tier models in composite variant
+        const tiers = ['opus', 'sonnet', 'haiku'];
+        for (const tier of tiers) {
+            const tierConfig = cfg.compositeTiers[tier];
+            if (tierConfig && (0, model_catalog_1.isModelBroken)(tierConfig.provider, tierConfig.model)) {
+                const modelEntry = (0, model_catalog_1.findModel)(tierConfig.provider, tierConfig.model);
+                const issueUrl = (0, model_catalog_1.getModelIssueUrl)(tierConfig.provider, tierConfig.model);
+                console.error('');
+                console.error((0, ui_1.warn)(`${tier} tier: ${modelEntry?.name || tierConfig.model} has known issues with Claude Code`));
+                console.error('    Tool calls will fail. Consider changing the model in config.yaml.');
+                if (issueUrl) {
+                    console.error(`    Tracking: ${issueUrl}`);
+                }
+                console.error('');
+            }
+        }
+    }
+    else {
+        const currentModel = (0, model_config_1.getCurrentModel)(provider, cfg.customSettingsPath);
+        if (currentModel && (0, model_catalog_1.isModelBroken)(provider, currentModel)) {
+            const modelEntry = (0, model_catalog_1.findModel)(provider, currentModel);
+            const issueUrl = (0, model_catalog_1.getModelIssueUrl)(provider, currentModel);
+            const replacementModel = (0, model_catalog_1.getSuggestedReplacementModel)(provider, currentModel);
+            console.error('');
+            console.error((0, ui_1.warn)(`${modelEntry?.name || currentModel} has known issues with Claude Code`));
+            if (replacementModel) {
+                console.error(`    Tool calls will fail. Use "${replacementModel}" instead.`);
+            }
+            else {
+                console.error('    Tool calls will fail. Consider changing the model in config.yaml.');
+            }
+            if (issueUrl) {
+                console.error(`    Tracking: ${issueUrl}`);
+            }
+            if (skipLocalAuth) {
+                console.error('    Note: Model may be overridden by remote proxy configuration.');
+            }
+            else {
+                console.error(`    Run "ccs ${provider} --config" to change model.`);
+            }
+            console.error('');
+        }
+    }
+    // 6. Ensure user settings file exists
+    (0, config_generator_1.ensureProviderSettings)(provider);
+    if (provider === 'codex' && !cfg.isComposite && !skipLocalAuth) {
+        await (0, codex_plan_compatibility_1.reconcileCodexModelForActivePlan)({
+            settingsPath: cfg.customSettingsPath || (0, config_generator_1.getProviderSettingsPath)(provider),
+            currentModel: (0, model_config_1.getCurrentModel)(provider, cfg.customSettingsPath),
+            verbose,
+        });
+    }
+    // Local proxy mode: generate config, spawn/join proxy, track session
+    let proxy = null;
+    let configPath;
+    if (!useRemoteProxy) {
+        log(`Generating config for ${provider}`);
+        configPath = (0, config_generator_1.generateConfig)(provider, cfg.port);
+        log(`Config written: ${configPath}`);
+        // 6a. Check or join existing proxy
+        const { sessionId: existingSessionId, shouldSpawn } = await (0, session_bridge_1.checkOrJoinProxy)(cfg.port, cfg.timeout, verbose);
+        sessionId = existingSessionId;
+        // 6b. Spawn new proxy if needed
+        if (shouldSpawn && binaryPath) {
+            proxy = (0, lifecycle_manager_1.spawnProxy)(binaryPath, configPath, verbose);
+            // 7. Wait for proxy readiness
+            await (0, lifecycle_manager_1.waitForProxyReadyWithSpinner)(cfg.port, cfg.timeout, cfg.pollInterval, backend, configPath);
+            // Register session
+            if (proxy.pid) {
+                sessionId = (0, session_bridge_1.registerProxySession)(cfg.port, proxy.pid, backend, verbose);
+            }
+        }
+    }
+    // 8. Setup HTTPS tunnel if needed
+    let httpsTunnel = null;
+    let tunnelPort = null;
+    if (useRemoteProxy && proxyConfig.protocol === 'https' && proxyConfig.host) {
+        try {
+            httpsTunnel = new https_tunnel_proxy_1.HttpsTunnelProxy({
+                remoteHost: proxyConfig.host,
+                remotePort: proxyConfig.port,
+                authToken: proxyConfig.authToken,
+                verbose,
+                allowSelfSigned: proxyConfig.allowSelfSigned ?? false,
+            });
+            tunnelPort = await httpsTunnel.start();
+            log(`HTTPS tunnel started on port ${tunnelPort} → https://${proxyConfig.host}:${proxyConfig.port}`);
+        }
+        catch (error) {
+            const err = error;
+            console.error((0, ui_1.warn)(`Failed to start HTTPS tunnel: ${err.message}`));
+            throw new Error(`HTTPS tunnel startup failed: ${err.message}`);
+        }
+    }
+    const imageAnalysisProxyTarget = useRemoteProxy && proxyConfig.host
+        ? {
+            host: proxyConfig.host,
+            port: proxyConfig.port,
+            protocol: proxyConfig.protocol,
+            authToken: proxyConfig.authToken,
+            managementKey: proxyConfig.managementKey,
+            allowSelfSigned: proxyConfig.allowSelfSigned,
+            isRemote: true,
+        }
+        : {
+            host: '127.0.0.1',
+            port: cfg.port,
+            protocol: 'http',
+            isRemote: false,
+        };
+    const imageAnalysisResolution = await (0, env_resolver_1.resolveCliproxyImageAnalysisEnv)({
+        profileName: cfg.profileName || provider,
+        provider,
+        profileSettingsPath: cfg.customSettingsPath,
+        isComposite: cfg.isComposite,
+        proxyTarget: imageAnalysisProxyTarget,
+        tunnelPort,
+        proxyReachable: true,
+    });
+    const imageAnalysisProvisioningFailed = !imageAnalysisMcpReady && imageAnalysisResolution.env.CCS_IMAGE_ANALYSIS_ENABLED === '1';
+    const imageAnalysisEnv = imageAnalysisProvisioningFailed
+        ? {
+            ...imageAnalysisResolution.env,
+            CCS_CURRENT_PROVIDER: '',
+            CCS_IMAGE_ANALYSIS_SKIP: '1',
+        }
+        : imageAnalysisResolution.env;
+    const imageAnalysisWarning = imageAnalysisProvisioningFailed
+        ? 'ImageAnalysis MCP provisioning failed. This session will use native Read.'
+        : imageAnalysisResolution.warning;
+    // 9. Setup tool sanitization proxy
+    let toolSanitizationProxy = null;
+    let toolSanitizationPort = null;
+    let inheritedClaudeConfigDir = cfg.claudeConfigDir;
+    if (!inheritedClaudeConfigDir && cfg.profileName) {
+        const continuityInheritance = await (0, profile_continuity_inheritance_1.resolveProfileContinuityInheritance)({
+            profileName: cfg.profileName,
+            profileType: 'cliproxy',
+            target: 'claude',
+        });
+        inheritedClaudeConfigDir = continuityInheritance.claudeConfigDir;
+        if (continuityInheritance.sourceAccount && process.env.CCS_DEBUG) {
+            log(`Continuity inheritance active: profile "${cfg.profileName}" -> account "${continuityInheritance.sourceAccount}"`);
+        }
+    }
+    (0, image_analysis_1.syncImageAnalysisMcpToConfigDir)(inheritedClaudeConfigDir);
+    // Build initial env vars to get ANTHROPIC_BASE_URL
+    const initialEnvVars = (0, env_resolver_1.buildClaudeEnvironment)({
+        provider,
+        useRemoteProxy,
+        remoteConfig: proxyConfig.host
+            ? {
+                host: proxyConfig.host,
+                port: proxyConfig.port,
+                protocol: proxyConfig.protocol,
+                authToken: proxyConfig.authToken,
+            }
+            : undefined,
+        httpsTunnel: httpsTunnel ?? undefined,
+        tunnelPort: tunnelPort ?? undefined,
+        localPort: cfg.port,
+        customSettingsPath: cfg.customSettingsPath,
+        thinkingOverride,
+        extendedContextOverride,
+        verbose,
+        isComposite: cfg.isComposite,
+        compositeTiers: cfg.compositeTiers,
+        compositeDefaultTier: cfg.compositeDefaultTier,
+        claudeConfigDir: inheritedClaudeConfigDir,
+        imageAnalysisEnv,
+    });
+    if (initialEnvVars.ANTHROPIC_BASE_URL) {
+        try {
+            toolSanitizationProxy = new tool_sanitization_proxy_1.ToolSanitizationProxy({
+                upstreamBaseUrl: initialEnvVars.ANTHROPIC_BASE_URL,
+                verbose,
+                warnOnSanitize: true,
+            });
+            toolSanitizationPort = await toolSanitizationProxy.start();
+            log(`Tool sanitization proxy active on port ${toolSanitizationPort}`);
+        }
+        catch (error) {
+            const err = error;
+            toolSanitizationProxy = null;
+            toolSanitizationPort = null;
+            if (verbose) {
+                console.error((0, ui_1.warn)(`Tool sanitization proxy disabled: ${err.message}`));
+            }
+        }
+    }
+    const postSanitizationBaseUrl = toolSanitizationPort
+        ? `http://127.0.0.1:${toolSanitizationPort}`
+        : initialEnvVars.ANTHROPIC_BASE_URL;
+    // 10. Setup Codex reasoning proxy (single-provider Codex only)
+    let codexReasoningProxy = null;
+    let codexReasoningPort = null;
+    // Composite variants require root model-routed endpoints, never provider-pinned codex endpoints.
+    if (provider === 'codex' && !cfg.isComposite) {
+        if (!postSanitizationBaseUrl) {
+            log('ANTHROPIC_BASE_URL not set for Codex, reasoning proxy disabled');
+        }
+        else {
+            try {
+                const traceEnabled = process.env.CCS_CODEX_REASONING_TRACE === '1' ||
+                    process.env.CCS_CODEX_REASONING_TRACE === 'true';
+                const stripPathPrefix = useRemoteProxy ? '/api/provider/codex' : undefined;
+                const codexThinkingOff = (0, thinking_override_resolver_1.shouldDisableCodexReasoning)(thinkingCfg, thinkingOverride);
+                codexReasoningProxy = new codex_reasoning_proxy_1.CodexReasoningProxy({
+                    upstreamBaseUrl: postSanitizationBaseUrl,
+                    verbose,
+                    defaultEffort: 'medium',
+                    disableEffort: codexThinkingOff,
+                    traceFilePath: traceEnabled ? path.join((0, config_manager_1.getCcsDir)(), 'codex-reasoning-proxy.log') : '',
+                    modelMap: {
+                        defaultModel: initialEnvVars.ANTHROPIC_MODEL,
+                        opusModel: initialEnvVars.ANTHROPIC_DEFAULT_OPUS_MODEL,
+                        sonnetModel: initialEnvVars.ANTHROPIC_DEFAULT_SONNET_MODEL,
+                        haikuModel: initialEnvVars.ANTHROPIC_DEFAULT_HAIKU_MODEL,
+                    },
+                    stripPathPrefix,
+                });
+                codexReasoningPort = await codexReasoningProxy.start();
+                log(`Codex reasoning proxy active: http://127.0.0.1:${codexReasoningPort}/api/provider/codex`);
+            }
+            catch (error) {
+                const err = error;
+                codexReasoningProxy = null;
+                codexReasoningPort = null;
+                if (verbose) {
+                    console.error((0, ui_1.warn)(`Codex reasoning proxy disabled: ${err.message}`));
+                }
+            }
+        }
+    }
+    // 11. Build final environment with all proxy chains
+    const env = (0, env_resolver_1.buildClaudeEnvironment)({
+        provider,
+        useRemoteProxy,
+        remoteConfig: proxyConfig.host
+            ? {
+                host: proxyConfig.host,
+                port: proxyConfig.port,
+                protocol: proxyConfig.protocol,
+                authToken: proxyConfig.authToken,
+            }
+            : undefined,
+        httpsTunnel: httpsTunnel ?? undefined,
+        tunnelPort: tunnelPort ?? undefined,
+        codexReasoningProxy: codexReasoningProxy ?? undefined,
+        codexReasoningPort: codexReasoningPort ?? undefined,
+        toolSanitizationProxy: toolSanitizationProxy ?? undefined,
+        toolSanitizationPort: toolSanitizationPort ?? undefined,
+        localPort: cfg.port,
+        customSettingsPath: cfg.customSettingsPath,
+        thinkingOverride,
+        extendedContextOverride,
+        verbose,
+        isComposite: cfg.isComposite,
+        compositeTiers: cfg.compositeTiers,
+        compositeDefaultTier: cfg.compositeDefaultTier,
+        claudeConfigDir: inheritedClaudeConfigDir,
+        imageAnalysisEnv,
+    });
+    if (cfg.isComposite && cfg.compositeTiers && cfg.compositeDefaultTier) {
+        const mode = useRemoteProxy
+            ? proxyConfig.protocol === 'https'
+                ? 'remote-https'
+                : 'remote-http'
+            : 'local';
+        const defaultTierProvider = cfg.compositeTiers[cfg.compositeDefaultTier]?.provider ?? provider;
+        log(`Composite self-check: mode=${mode}, baseUrl=${env.ANTHROPIC_BASE_URL || 'unset'}, defaultTier=${cfg.compositeDefaultTier}, defaultProvider=${defaultTierProvider}`);
+    }
+    const webSearchEnv = (0, websearch_manager_2.getWebSearchHookEnv)();
+    (0, env_resolver_1.logEnvironment)(env, webSearchEnv, verbose);
+    if (imageAnalysisWarning) {
+        console.error((0, ui_1.info)(imageAnalysisWarning));
+    }
+    // 11b. Print thinking status feedback (TTY only, non-piped sessions)
+    if (process.stderr.isTTY) {
+        const { thinkingLabel, sourceLabel } = (0, thinking_override_resolver_1.buildThinkingStartupStatus)(thinkingCfg, thinkingOverride, thinkingSource, thinkingParse.sourceDisplay);
+        console.error(`[i] Thinking: ${thinkingLabel} (${sourceLabel})`);
+    }
+    // 12. Filter CCS-specific flags before passing to Claude CLI
+    const ccsFlags = [
+        '--auth',
+        '--paste-callback',
+        '--port-forward',
+        '--headless',
+        '--logout',
+        '--config',
+        '--add',
+        '--accounts',
+        '--use',
+        '--nickname',
+        '--kiro-auth-method',
+        '--thinking',
+        '--effort',
+        '--1m',
+        '--no-1m',
+        '--incognito',
+        '--no-incognito',
+        '--import',
+        '--accept-agr-risk',
+        '--accept-antigravity-risk',
+        '--settings',
+        ...proxy_config_resolver_1.PROXY_CLI_FLAGS,
+    ];
+    const claudeArgs = argsWithoutProxy.filter((arg, idx) => {
+        if (ccsFlags.includes(arg))
+            return false;
+        if (arg.startsWith('--thinking='))
+            return false;
+        if (arg.startsWith('--effort='))
+            return false;
+        if (arg.startsWith('--1m=') || arg.startsWith('--no-1m='))
+            return false;
+        if (argsWithoutProxy[idx - 1] === '--use' ||
+            argsWithoutProxy[idx - 1] === '--nickname' ||
+            argsWithoutProxy[idx - 1] === '--kiro-auth-method' ||
+            argsWithoutProxy[idx - 1] === '--thinking' ||
+            argsWithoutProxy[idx - 1] === '--effort')
+            return false;
+        return true;
+    });
+    const isWindows = process.platform === 'win32';
+    const needsShell = isWindows && /\.(cmd|bat|ps1)$/i.test(claudeCli);
+    const settingsPath = cfg.customSettingsPath
+        ? cfg.customSettingsPath.replace(/^~/, os.homedir())
+        : (0, config_generator_1.getProviderSettingsPath)(provider);
+    let claude;
+    const imageAnalysisArgs = imageAnalysisMcpReady
+        ? (0, image_analysis_1.appendThirdPartyImageAnalysisToolArgs)(claudeArgs)
+        : claudeArgs;
+    const launchArgs = [
+        '--settings',
+        settingsPath,
+        ...(0, websearch_manager_1.appendThirdPartyWebSearchToolArgs)(imageAnalysisArgs),
+    ];
+    const traceEnv = (0, websearch_manager_1.createWebSearchTraceContext)({
+        launcher: 'cliproxy.executor',
+        args: launchArgs,
+        profile: cfg.profileName || provider,
+        profileType: 'cliproxy',
+        settingsPath,
+        claudeConfigDir: inheritedClaudeConfigDir,
+    });
+    const tracedEnv = { ...env, ...traceEnv };
+    if (needsShell) {
+        const cmdString = [claudeCli, ...launchArgs].map(shell_executor_1.escapeShellArg).join(' ');
+        claude = (0, child_process_1.spawn)(cmdString, {
+            stdio: 'inherit',
+            windowsHide: true,
+            shell: true,
+            env: tracedEnv,
+        });
+    }
+    else {
+        claude = (0, child_process_1.spawn)(claudeCli, launchArgs, {
+            stdio: 'inherit',
+            windowsHide: true,
+            env: tracedEnv,
+        });
+    }
+    // 12b. Start runtime quota monitor (adaptive polling during session)
+    if (!skipLocalAuth) {
+        const { startQuotaMonitor } = await Promise.resolve().then(() => __importStar(require('../quota-manager')));
+        const monitorAccount = (0, account_manager_1.getDefaultAccount)(provider);
+        if (monitorAccount) {
+            startQuotaMonitor(provider, monitorAccount.id);
+        }
+    }
+    // 13. Setup cleanup handlers
+    (0, session_bridge_1.setupCleanupHandlers)(claude, sessionId, cfg.port, codexReasoningProxy, toolSanitizationProxy, httpsTunnel, verbose);
+}
+exports.execClaudeWithCLIProxy = execClaudeWithCLIProxy;
+// Re-export utility functions for backwards compatibility
+var lifecycle_manager_2 = require("./lifecycle-manager");
+Object.defineProperty(exports, "isPortAvailable", { enumerable: true, get: function () { return lifecycle_manager_2.isPortAvailable; } });
+Object.defineProperty(exports, "findAvailablePort", { enumerable: true, get: function () { return lifecycle_manager_2.findAvailablePort; } });
+exports.default = execClaudeWithCLIProxy;
+//# sourceMappingURL=index.js.map