@jonnyhoo/ccs 1.0.0

package/dist/cliproxy/cliproxy-executor.js

@@ -0,0 +1,1025 @@
+"use strict";
+/**
+ * CLIProxy Executor - Spawn/Kill Pattern for CLIProxyAPI
+ *
+ * Mirrors GLMT architecture:
+ * 1. Ensure binary exists (Phase 1)
+ * 2. Generate config for provider
+ * 3. Spawn CLIProxyAPI binary
+ * 4. Poll port for readiness (no stdout signal)
+ * 5. Execute Claude CLI with proxied environment
+ * 6. Kill proxy on Claude exit
+ *
+ * Key difference from GLMT: Uses TCP port polling instead of PROXY_READY signal
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findAvailablePort = exports.isPortAvailable = exports.execClaudeWithCLIProxy = void 0;
+const child_process_1 = require("child_process");
+const net = __importStar(require("net"));
+const os = __importStar(require("os"));
+const progress_indicator_1 = require("../utils/progress-indicator");
+const ui_1 = require("../utils/ui");
+const shell_executor_1 = require("../utils/shell-executor");
+const binary_manager_1 = require("./binary-manager");
+const config_generator_1 = require("./config-generator");
+const remote_proxy_client_1 = require("./remote-proxy-client");
+const auth_handler_1 = require("./auth-handler");
+const types_1 = require("./types");
+const platform_detector_1 = require("./platform-detector");
+const model_config_1 = require("./model-config");
+const proxy_config_resolver_1 = require("./proxy-config-resolver");
+const websearch_manager_1 = require("../utils/websearch-manager");
+const get_image_analysis_hook_env_1 = require("../utils/hooks/get-image-analysis-hook-env");
+const model_catalog_1 = require("./model-catalog");
+const codex_reasoning_proxy_1 = require("./codex-reasoning-proxy");
+const tool_sanitization_proxy_1 = require("./tool-sanitization-proxy");
+const account_manager_1 = require("./account-manager");
+const platform_commands_1 = require("../utils/platform-commands");
+const websearch_manager_2 = require("../utils/websearch-manager");
+const session_tracker_1 = require("./session-tracker");
+const proxy_detector_1 = require("./proxy-detector");
+const startup_lock_1 = require("./startup-lock");
+const unified_config_loader_1 = require("../config/unified-config-loader");
+const quota_manager_1 = require("./quota-manager");
+const https_tunnel_proxy_1 = require("./https-tunnel-proxy");
+/** Default executor configuration */
+const DEFAULT_CONFIG = {
+    port: config_generator_1.CLIPROXY_DEFAULT_PORT,
+    timeout: 5000,
+    verbose: false,
+    pollInterval: 100,
+};
+/**
+ * Wait for TCP port to become available
+ * Uses polling since CLIProxyAPI doesn't emit PROXY_READY signal
+ */
+async function waitForProxyReady(port, timeout = 5000, pollInterval = 100) {
+    const start = Date.now();
+    while (Date.now() - start < timeout) {
+        try {
+            await new Promise((resolve, reject) => {
+                const socket = net.createConnection({ port, host: '127.0.0.1' }, () => {
+                    socket.destroy();
+                    resolve();
+                });
+                socket.on('error', (err) => {
+                    socket.destroy();
+                    reject(err);
+                });
+                // Individual connection timeout
+                socket.setTimeout(1000, () => {
+                    socket.destroy();
+                    reject(new Error('Connection timeout'));
+                });
+            });
+            return; // Connection successful - proxy is ready
+        }
+        catch {
+            // Connection failed, wait and retry
+            await new Promise((r) => setTimeout(r, pollInterval));
+        }
+    }
+    throw new Error(`CLIProxy not ready after ${timeout}ms on port ${port}`);
+}
+/**
+ * Execute Claude CLI with CLIProxy (main entry point)
+ *
+ * @param claudeCli Path to Claude CLI executable
+ * @param provider CLIProxy provider (gemini, codex, agy, qwen)
+ * @param args Arguments to pass to Claude CLI
+ * @param config Optional executor configuration
+ */
+async function execClaudeWithCLIProxy(claudeCli, provider, args, config = {}) {
+    // Filter out undefined values to prevent overwriting defaults
+    const filteredConfig = Object.fromEntries(Object.entries(config).filter(([, v]) => v !== undefined));
+    const cfg = { ...DEFAULT_CONFIG, ...filteredConfig };
+    const verbose = cfg.verbose || args.includes('--verbose') || args.includes('-v');
+    const log = (msg) => {
+        if (verbose) {
+            console.error(`[cliproxy] ${msg}`);
+        }
+    };
+    // 0. Resolve proxy configuration (CLI > ENV > config.yaml > defaults)
+    // This filters proxy flags from args and returns resolved config
+    const unifiedConfig = (0, unified_config_loader_1.loadOrCreateUnifiedConfig)();
+    // 0a. Runtime backend/provider validation - block kiro/ghcp if backend=original
+    const backend = unifiedConfig.cliproxy?.backend ?? platform_detector_1.DEFAULT_BACKEND;
+    if (backend === 'original' && types_1.PLUS_ONLY_PROVIDERS.includes(provider)) {
+        console.error('');
+        console.error((0, ui_1.fail)(`${provider} requires CLIProxyAPIPlus backend`));
+        console.error('');
+        console.error('To use this provider, either:');
+        console.error('  1. Set `cliproxy.backend: plus` in ~/.ccs/config.yaml');
+        console.error('  2. Use --backend=plus flag: ccs ' + provider + ' --backend=plus');
+        console.error('');
+        throw new Error(`Provider ${provider} requires Plus backend`);
+    }
+    const cliproxyServerConfig = unifiedConfig.cliproxy_server;
+    const { config: proxyConfig, remainingArgs: argsWithoutProxy } = (0, proxy_config_resolver_1.resolveProxyConfig)(args, {
+        remote: cliproxyServerConfig?.remote
+            ? {
+                enabled: cliproxyServerConfig.remote.enabled,
+                host: cliproxyServerConfig.remote.host,
+                port: cliproxyServerConfig.remote.port,
+                protocol: cliproxyServerConfig.remote.protocol,
+                auth_token: cliproxyServerConfig.remote.auth_token,
+                timeout: cliproxyServerConfig.remote.timeout,
+            }
+            : undefined,
+        local: cliproxyServerConfig?.local
+            ? {
+                port: cliproxyServerConfig.local.port,
+                auto_start: cliproxyServerConfig.local.auto_start,
+            }
+            : undefined,
+    });
+    // Use resolved port from proxy config (overrides ExecutorConfig)
+    // Priority: CLI flags > Variant port (cfg.port) > config.yaml > default
+    // cfg.port is set if variant has dedicated port; proxyConfig.port comes from CLI/ENV/config.yaml
+    if (cfg.port && cfg.port !== config_generator_1.CLIPROXY_DEFAULT_PORT) {
+        // Variant port already set via config param - keep it (highest priority after CLI flags)
+        // CLI flags would have been parsed in resolveProxyConfig and set proxyConfig.port
+        // So if proxyConfig.port differs from default AND cfg.port differs, CLI wins
+        if (proxyConfig.port !== config_generator_1.CLIPROXY_DEFAULT_PORT) {
+            cfg.port = proxyConfig.port; // CLI/ENV override variant port
+        }
+        // else: keep cfg.port (variant port)
+    }
+    else if (proxyConfig.port !== config_generator_1.CLIPROXY_DEFAULT_PORT) {
+        cfg.port = proxyConfig.port;
+    }
+    // Final port validation - ensure valid port after all resolution
+    cfg.port = (0, config_generator_1.validatePort)(cfg.port);
+    log(`Proxy mode: ${proxyConfig.mode}`);
+    if (proxyConfig.mode === 'remote') {
+        log(`Remote host: ${proxyConfig.host}:${proxyConfig.port} (${proxyConfig.protocol})`);
+    }
+    // Note: proxyConfig is available for Phase 4 (remote mode integration)
+    // Ensure MCP web-search is configured for third-party profiles
+    // WebSearch is a server-side tool executed by Anthropic's API
+    // Third-party providers don't have access, so we use MCP fallback
+    (0, websearch_manager_2.ensureMcpWebSearch)();
+    // Install WebSearch hook for Gemini CLI + MCP fallback
+    // Hook intercepts WebSearch, tries Gemini CLI first, falls back to MCP
+    (0, websearch_manager_2.installWebSearchHook)();
+    // Display WebSearch status (single line, equilibrium UX)
+    (0, websearch_manager_2.displayWebSearchStatus)();
+    // Validate provider
+    const providerConfig = (0, config_generator_1.getProviderConfig)(provider);
+    log(`Provider: ${providerConfig.displayName}`);
+    // Check remote proxy if configured (before binary download)
+    let useRemoteProxy = false;
+    if (proxyConfig.mode === 'remote' && proxyConfig.host) {
+        const status = await (0, remote_proxy_client_1.checkRemoteProxy)({
+            host: proxyConfig.host,
+            port: proxyConfig.port,
+            protocol: proxyConfig.protocol,
+            authToken: proxyConfig.authToken,
+            timeout: proxyConfig.timeout ?? 2000,
+            allowSelfSigned: proxyConfig.allowSelfSigned ?? false,
+        });
+        if (status.reachable) {
+            useRemoteProxy = true;
+            console.log((0, ui_1.ok)(`Connected to remote proxy at ${proxyConfig.host}:${proxyConfig.port} (${status.latencyMs}ms)`));
+        }
+        else {
+            console.error((0, ui_1.warn)(`Remote proxy unreachable: ${status.error}`));
+            if (proxyConfig.remoteOnly) {
+                throw new Error('Remote proxy unreachable and --remote-only specified');
+            }
+            if (proxyConfig.fallbackEnabled) {
+                if (proxyConfig.autoStartLocal) {
+                    console.log((0, ui_1.info)('Falling back to local proxy...'));
+                }
+                else {
+                    // Prompt user for fallback (only in TTY)
+                    if (process.stdin.isTTY) {
+                        const readline = await Promise.resolve().then(() => __importStar(require('readline')));
+                        const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+                        const answer = await new Promise((resolve) => {
+                            rl.question('Start local proxy instead? [Y/n] ', resolve);
+                        });
+                        rl.close();
+                        if (answer.toLowerCase() === 'n') {
+                            throw new Error('Remote proxy unreachable and user declined fallback');
+                        }
+                    }
+                    console.log((0, ui_1.info)('Starting local proxy...'));
+                }
+            }
+            else {
+                throw new Error('Remote proxy unreachable and fallback disabled');
+            }
+        }
+    }
+    // Variables for local proxy mode
+    let binaryPath;
+    let sessionId;
+    // 1. Ensure binary exists (downloads if needed) - SKIP for remote mode
+    if (!useRemoteProxy) {
+        const spinner = new progress_indicator_1.ProgressIndicator('Preparing CLIProxy');
+        spinner.start();
+        try {
+            binaryPath = await (0, binary_manager_1.ensureCLIProxyBinary)(verbose);
+            spinner.succeed('CLIProxy binary ready');
+        }
+        catch (error) {
+            spinner.fail('Failed to prepare CLIProxy');
+            const err = error;
+            // Check if network offline (DNS, connection, or timeout failure)
+            const networkErrors = [
+                'getaddrinfo',
+                'ENOTFOUND',
+                'ETIMEDOUT',
+                'ECONNREFUSED',
+                'ENETUNREACH',
+                'EAI_AGAIN',
+            ];
+            const isNetworkError = networkErrors.some((errCode) => err.message.includes(errCode));
+            if (isNetworkError) {
+                console.error('');
+                console.error((0, ui_1.fail)('No network connection detected'));
+                console.error('');
+                console.error('CLIProxy binary download requires internet access.');
+                console.error('Please check your network connection and try again.');
+                console.error('');
+                process.exit(1);
+            }
+            throw error;
+        }
+    }
+    // 2. Handle special flags (use argsWithoutProxy - proxy flags already stripped)
+    const forceAuth = argsWithoutProxy.includes('--auth');
+    const pasteCallback = argsWithoutProxy.includes('--paste-callback');
+    const forceHeadless = argsWithoutProxy.includes('--headless');
+    const forceLogout = argsWithoutProxy.includes('--logout');
+    const forceConfig = argsWithoutProxy.includes('--config');
+    const addAccount = argsWithoutProxy.includes('--add');
+    const showAccounts = argsWithoutProxy.includes('--accounts');
+    // Kiro-specific: --import to import token from Kiro IDE directly
+    const forceImport = argsWithoutProxy.includes('--import');
+    // Kiro-specific: browser mode for OAuth
+    // Default to normal browser (noIncognito=true) for reliability - incognito often fails on Linux
+    // --incognito flag opts into incognito mode, --no-incognito is legacy (now default)
+    const incognitoFlag = argsWithoutProxy.includes('--incognito');
+    const noIncognitoFlag = argsWithoutProxy.includes('--no-incognito');
+    // Config setting (defaults to true = normal browser)
+    const kiroNoIncognitoConfig = provider === 'kiro' ? (unifiedConfig.cliproxy?.kiro_no_incognito ?? true) : false;
+    // --incognito flag overrides everything to use incognito
+    const noIncognito = incognitoFlag ? false : noIncognitoFlag || kiroNoIncognitoConfig;
+    // Parse --use <account> flag
+    let useAccount;
+    const useIdx = argsWithoutProxy.indexOf('--use');
+    if (useIdx !== -1 &&
+        argsWithoutProxy[useIdx + 1] &&
+        !argsWithoutProxy[useIdx + 1].startsWith('-')) {
+        useAccount = argsWithoutProxy[useIdx + 1];
+    }
+    // Parse --nickname <name> flag
+    let setNickname;
+    const nicknameIdx = argsWithoutProxy.indexOf('--nickname');
+    if (nicknameIdx !== -1 &&
+        argsWithoutProxy[nicknameIdx + 1] &&
+        !argsWithoutProxy[nicknameIdx + 1].startsWith('-')) {
+        setNickname = argsWithoutProxy[nicknameIdx + 1];
+    }
+    // Parse --thinking <value> flag for thinking budget control
+    // Supports: level names (low, medium, high, xhigh, auto), numeric budget, or 'off'/'none'
+    // Accepts both --thinking=value and --thinking value formats
+    let thinkingOverride;
+    // Check for --thinking=value format first
+    const thinkingEqArg = argsWithoutProxy.find((arg) => arg.startsWith('--thinking='));
+    if (thinkingEqArg) {
+        const val = thinkingEqArg.substring('--thinking='.length);
+        // Handle empty value after equals (--thinking=)
+        if (!val || val.trim() === '') {
+            console.error((0, ui_1.fail)('--thinking requires a value'));
+            console.error('    Examples: --thinking=low, --thinking=8192, --thinking=off');
+            console.error('    Levels: minimal, low, medium, high, xhigh, auto');
+            process.exit(1);
+        }
+        // Parse as number if numeric, otherwise keep as string (level name)
+        const numVal = parseInt(val, 10);
+        thinkingOverride = !isNaN(numVal) ? numVal : val;
+        // W2: Warn if multiple --thinking flags found (check both formats)
+        const allThinkingFlags = argsWithoutProxy.filter((arg) => arg === '--thinking' || arg.startsWith('--thinking='));
+        if (allThinkingFlags.length > 1) {
+            console.warn(`[!] Multiple --thinking flags detected. Using first occurrence: ${thinkingEqArg}`);
+        }
+    }
+    else {
+        // Fall back to --thinking value format
+        const thinkingIdx = argsWithoutProxy.indexOf('--thinking');
+        if (thinkingIdx !== -1) {
+            const nextArg = argsWithoutProxy[thinkingIdx + 1];
+            // U1: Check if --thinking has a value (not missing or another flag)
+            if (!nextArg || nextArg.startsWith('-')) {
+                console.error((0, ui_1.fail)('--thinking requires a value'));
+                console.error('    Examples: --thinking low, --thinking 8192, --thinking off');
+                console.error('    Levels: minimal, low, medium, high, xhigh, auto');
+                process.exit(1);
+            }
+            const val = nextArg;
+            // Parse as number if numeric, otherwise keep as string (level name)
+            const numVal = parseInt(val, 10);
+            thinkingOverride = !isNaN(numVal) ? numVal : val;
+            // W2: Warn if multiple --thinking flags found (check both formats)
+            const allThinkingFlags = argsWithoutProxy.filter((arg) => arg === '--thinking' || arg.startsWith('--thinking='));
+            if (allThinkingFlags.length > 1) {
+                console.warn(`[!] Multiple --thinking flags detected. Using first occurrence: --thinking ${val}`);
+            }
+        }
+    }
+    // Handle --accounts: list accounts and exit
+    if (showAccounts) {
+        const accounts = (0, account_manager_1.getProviderAccounts)(provider);
+        if (accounts.length === 0) {
+            console.log((0, ui_1.info)(`No accounts registered for ${providerConfig.displayName}`));
+            console.log(`    Run "ccs ${provider} --auth" to add an account`);
+        }
+        else {
+            console.log(`\n${providerConfig.displayName} Accounts:\n`);
+            for (const acct of accounts) {
+                const defaultMark = acct.isDefault ? ' (default)' : '';
+                const nickname = acct.nickname ? `[${acct.nickname}]` : '';
+                console.log(`  ${nickname.padEnd(12)} ${acct.email || acct.id}${defaultMark}`);
+            }
+            console.log(`\n  Use "ccs ${provider} --use <nickname>" to switch accounts`);
+        }
+        process.exit(0);
+    }
+    // Handle --use: switch to specified account
+    if (useAccount) {
+        const account = (0, account_manager_1.findAccountByQuery)(provider, useAccount);
+        if (!account) {
+            console.error((0, ui_1.fail)(`Account not found: "${useAccount}"`));
+            const accounts = (0, account_manager_1.getProviderAccounts)(provider);
+            if (accounts.length > 0) {
+                console.error(`    Available accounts:`);
+                for (const acct of accounts) {
+                    console.error(`      - ${acct.nickname || acct.id} (${acct.email || 'no email'})`);
+                }
+            }
+            process.exit(1);
+        }
+        // Set as default for this and future sessions
+        (0, account_manager_1.setDefaultAccount)(provider, account.id);
+        (0, account_manager_1.touchAccount)(provider, account.id);
+        console.log((0, ui_1.ok)(`Switched to account: ${account.nickname || account.email || account.id}`));
+    }
+    // Handle --nickname: rename account and exit (unless used with --auth --add)
+    if (setNickname && !addAccount) {
+        const defaultAccount = (0, account_manager_1.getDefaultAccount)(provider);
+        if (!defaultAccount) {
+            console.error((0, ui_1.fail)(`No account found for ${providerConfig.displayName}`));
+            console.error(`    Run "ccs ${provider} --auth" to add an account first`);
+            process.exit(1);
+        }
+        try {
+            const success = (0, account_manager_1.renameAccount)(provider, defaultAccount.id, setNickname);
+            if (success) {
+                console.log((0, ui_1.ok)(`Renamed account to: ${setNickname}`));
+            }
+            else {
+                console.error((0, ui_1.fail)('Failed to rename account'));
+                process.exit(1);
+            }
+        }
+        catch (err) {
+            console.error((0, ui_1.fail)(err instanceof Error ? err.message : 'Failed to rename account'));
+            process.exit(1);
+        }
+        process.exit(0);
+    }
+    // Handle --config: configure model selection and exit
+    // Pass customSettingsPath for CLIProxy variants to save to correct file
+    if (forceConfig && (0, model_catalog_1.supportsModelConfig)(provider)) {
+        await (0, model_config_1.configureProviderModel)(provider, true, cfg.customSettingsPath);
+        process.exit(0);
+    }
+    // Handle --logout: clear auth and exit
+    if (forceLogout) {
+        const { clearAuth } = await Promise.resolve().then(() => __importStar(require('./auth-handler')));
+        if (clearAuth(provider)) {
+            console.log((0, ui_1.ok)(`Logged out from ${providerConfig.displayName}`));
+        }
+        else {
+            console.log((0, ui_1.info)(`No authentication found for ${providerConfig.displayName}`));
+        }
+        process.exit(0);
+    }
+    // Handle --import: import token from Kiro IDE directly (Kiro only)
+    if (forceImport) {
+        if (provider !== 'kiro') {
+            console.error((0, ui_1.fail)('--import is only available for Kiro'));
+            console.error(`    Run "ccs ${provider} --auth" to authenticate`);
+            process.exit(1);
+        }
+        // Validate flag conflicts
+        if (forceAuth) {
+            console.error((0, ui_1.fail)('Cannot use --import with --auth'));
+            console.error('    --import: Import existing token from Kiro IDE');
+            console.error('    --auth: Trigger new OAuth flow in browser');
+            process.exit(1);
+        }
+        if (forceLogout) {
+            console.error((0, ui_1.fail)('Cannot use --import with --logout'));
+            process.exit(1);
+        }
+        const { triggerOAuth } = await Promise.resolve().then(() => __importStar(require('./auth-handler')));
+        const authSuccess = await triggerOAuth(provider, {
+            verbose,
+            import: true,
+            ...(setNickname ? { nickname: setNickname } : {}),
+        });
+        if (!authSuccess) {
+            console.error((0, ui_1.fail)('Failed to import Kiro token from IDE'));
+            console.error('    Make sure you are logged into Kiro IDE first');
+            process.exit(1);
+        }
+        process.exit(0);
+    }
+    // 3. Ensure OAuth completed (if provider requires it)
+    // Skip local OAuth check when using remote proxy with auth token
+    // The remote proxy has its own OAuth sessions and handles authentication
+    // Note: Trim authToken to reject whitespace-only values
+    const remoteAuthToken = proxyConfig.authToken?.trim();
+    const skipLocalAuth = useRemoteProxy && !!remoteAuthToken;
+    if (skipLocalAuth) {
+        log(`Using remote proxy authentication (skipping local OAuth)`);
+    }
+    if (providerConfig.requiresOAuth && !skipLocalAuth) {
+        log(`Checking authentication for ${provider}`);
+        if (forceAuth || !(0, auth_handler_1.isAuthenticated)(provider)) {
+            // Pass headless only if explicitly set; otherwise let auth-handler auto-detect
+            const { triggerOAuth } = await Promise.resolve().then(() => __importStar(require('./auth-handler')));
+            const authSuccess = await triggerOAuth(provider, {
+                verbose,
+                add: addAccount,
+                ...(forceHeadless ? { headless: true } : {}),
+                ...(setNickname ? { nickname: setNickname } : {}),
+                ...(noIncognito ? { noIncognito: true } : {}),
+                ...(pasteCallback ? { pasteCallback: true } : {}),
+            });
+            if (!authSuccess) {
+                throw new Error(`Authentication required for ${providerConfig.displayName}`);
+            }
+            // If --auth was explicitly passed, exit after auth (don't start Claude)
+            if (forceAuth) {
+                process.exit(0);
+            }
+        }
+        else {
+            log(`${provider} already authenticated`);
+        }
+        // 3a. Proactive token refresh - prevent UND_ERR_SOCKET from expired tokens
+        // CLIProxyAPI may fail mid-request if token expires during use
+        const { ensureTokenValid } = await Promise.resolve().then(() => __importStar(require('./auth/token-manager')));
+        const tokenResult = await ensureTokenValid(provider, verbose);
+        if (!tokenResult.valid) {
+            // Token expired and refresh failed - trigger re-auth
+            console.error((0, ui_1.warn)('OAuth token expired and refresh failed'));
+            if (tokenResult.error) {
+                console.error(`    ${tokenResult.error}`);
+            }
+            console.error(`    Run "ccs ${provider} --auth" to re-authenticate`);
+            process.exit(1);
+        }
+        if (tokenResult.refreshed) {
+            log('Token was refreshed proactively');
+        }
+        // 3a-1. Update lastUsedAt for the account being used
+        // This ensures dashboard shows accurate "Last used" timestamps
+        const usedAccount = (0, account_manager_1.getDefaultAccount)(provider);
+        if (usedAccount) {
+            (0, account_manager_1.touchAccount)(provider, usedAccount.id);
+        }
+    }
+    // 3b. Preflight quota check - auto-switch to account with quota before launch
+    // Uses quota-manager for caching, tier priority, and cooldown support
+    // Skip for remote proxy - quota is managed on the remote server
+    if (provider === 'agy' && !skipLocalAuth) {
+        const preflight = await (0, quota_manager_1.preflightCheck)(provider);
+        if (!preflight.proceed) {
+            console.error((0, ui_1.fail)(`Cannot start session: ${preflight.reason}`));
+            process.exit(1);
+        }
+        if (preflight.switchedFrom) {
+            console.log((0, ui_1.info)(`Auto-switched to ${preflight.accountId}`));
+            console.log(`    Reason: ${preflight.reason}`);
+            if (preflight.quotaPercent !== undefined && preflight.quotaPercent !== null) {
+                console.log(`    New account quota: ${preflight.quotaPercent.toFixed(1)}%`);
+            }
+            else {
+                console.log(`    New account quota: N/A (fetch unavailable)`);
+            }
+        }
+    }
+    // 4. First-run model configuration (interactive)
+    // For supported providers, prompt user to select model on first run
+    // Pass customSettingsPath for CLIProxy variants
+    // Skip for remote proxy - model is configured on the remote server
+    if ((0, model_catalog_1.supportsModelConfig)(provider) && !skipLocalAuth) {
+        await (0, model_config_1.configureProviderModel)(provider, false, cfg.customSettingsPath); // false = only if not configured
+    }
+    // 5. Check for known broken models and warn user
+    // Show warning for both local and remote modes - user should be aware of model issues
+    const currentModel = (0, model_config_1.getCurrentModel)(provider, cfg.customSettingsPath);
+    if (currentModel && (0, model_catalog_1.isModelBroken)(provider, currentModel)) {
+        const modelEntry = (0, model_catalog_1.findModel)(provider, currentModel);
+        const issueUrl = (0, model_catalog_1.getModelIssueUrl)(provider, currentModel);
+        console.error('');
+        console.error((0, ui_1.warn)(`${modelEntry?.name || currentModel} has known issues with Claude Code`));
+        console.error('    Tool calls will fail. Use "gemini-3-pro-preview" instead.');
+        if (issueUrl) {
+            console.error(`    Tracking: ${issueUrl}`);
+        }
+        if (skipLocalAuth) {
+            console.error('    Note: Model may be overridden by remote proxy configuration.');
+        }
+        else {
+            console.error(`    Run "ccs ${provider} --config" to change model.`);
+        }
+        console.error('');
+    }
+    // 6. Ensure user settings file exists (creates from defaults if not)
+    (0, config_generator_1.ensureProviderSettings)(provider);
+    // Local proxy mode: generate config, spawn proxy, track session
+    let proxy = null;
+    if (!useRemoteProxy) {
+        // 6. Generate config file
+        log(`Generating config for ${provider}`);
+        const configPath = (0, config_generator_1.generateConfig)(provider, cfg.port);
+        log(`Config written: ${configPath}`);
+        // 6a. Pre-flight check using unified detection with startup lock
+        // This prevents race conditions when multiple CCS processes start simultaneously
+        (0, session_tracker_1.cleanupOrphanedSessions)(cfg.port);
+        // Use startup lock to coordinate with other CCS processes
+        await (0, startup_lock_1.withStartupLock)(async () => {
+            // Detect running proxy using multiple methods (HTTP, session-lock, port-process)
+            let proxyStatus = await (0, proxy_detector_1.detectRunningProxy)(cfg.port);
+            log(`Proxy detection: ${JSON.stringify(proxyStatus)}`);
+            // Check for version mismatch - restart proxy if installed version differs from running
+            if (proxyStatus.running && proxyStatus.verified && proxyStatus.version) {
+                const installedVersion = (0, binary_manager_1.getInstalledCliproxyVersion)();
+                if (installedVersion !== proxyStatus.version) {
+                    console.log((0, ui_1.warn)(`Version mismatch: running v${proxyStatus.version}, installed v${installedVersion}. Restarting proxy...`));
+                    log(`Stopping outdated proxy (PID: ${proxyStatus.pid ?? 'unknown'})...`);
+                    const stopResult = await (0, session_tracker_1.stopProxy)(cfg.port);
+                    if (stopResult.stopped) {
+                        log(`Stopped outdated proxy successfully`);
+                    }
+                    else {
+                        log(`Stop proxy result: ${stopResult.error ?? 'unknown error'}`);
+                    }
+                    // Wait for port to be released
+                    await new Promise((r) => setTimeout(r, 500));
+                    // Re-detect proxy status (should now be not running)
+                    proxyStatus = await (0, proxy_detector_1.detectRunningProxy)(cfg.port);
+                    log(`Re-detection after version mismatch restart: ${JSON.stringify(proxyStatus)}`);
+                }
+            }
+            if (proxyStatus.running && proxyStatus.verified) {
+                // Healthy proxy found - join it
+                if (proxyStatus.pid) {
+                    sessionId = (0, proxy_detector_1.reclaimOrphanedProxy)(cfg.port, proxyStatus.pid, verbose) ?? undefined;
+                }
+                if (sessionId) {
+                    console.log((0, ui_1.info)(`Joined existing CLIProxy on port ${cfg.port} (${proxyStatus.method})`));
+                }
+                else {
+                    // Failed to register session - proxy is running but we can't track it
+                    // This happens when port-process detection fails (permissions, platform issues)
+                    console.log((0, ui_1.info)(`Using existing CLIProxy on port ${cfg.port} (session tracking unavailable)`));
+                    log(`PID=${proxyStatus.pid ?? 'unknown'}, session registration skipped`);
+                }
+                return; // Exit lock early, skip spawning
+            }
+            if (proxyStatus.running && !proxyStatus.verified) {
+                // Proxy detected but not ready yet (another process is starting it)
+                log(`Proxy starting up (detected via ${proxyStatus.method}), waiting...`);
+                const becameHealthy = await (0, proxy_detector_1.waitForProxyHealthy)(cfg.port, cfg.timeout);
+                if (becameHealthy) {
+                    if (proxyStatus.pid) {
+                        sessionId = (0, proxy_detector_1.reclaimOrphanedProxy)(cfg.port, proxyStatus.pid, verbose) ?? undefined;
+                    }
+                    console.log((0, ui_1.info)(`Joined CLIProxy after startup wait`));
+                    return; // Exit lock early
+                }
+                // Proxy didn't become healthy - kill and respawn
+                if (proxyStatus.pid) {
+                    log(`Proxy PID ${proxyStatus.pid} not responding, killing...`);
+                    (0, platform_commands_1.killProcessOnPort)(cfg.port, verbose);
+                    await new Promise((r) => setTimeout(r, 500));
+                }
+            }
+            if (proxyStatus.blocked && proxyStatus.blocker) {
+                // Port blocked by non-CLIProxy process
+                // Last resort: try HTTP health check (handles Windows PID-XXXXX case)
+                const isActuallyOurs = await (0, proxy_detector_1.waitForProxyHealthy)(cfg.port, 1000);
+                if (isActuallyOurs) {
+                    sessionId = (0, proxy_detector_1.reclaimOrphanedProxy)(cfg.port, proxyStatus.blocker.pid, verbose) ?? undefined;
+                    console.log((0, ui_1.info)(`Reclaimed CLIProxy with unrecognized process name`));
+                    return;
+                }
+                // Truly blocked by another application
+                console.error('');
+                console.error((0, ui_1.warn)(`Port ${cfg.port} is blocked by ${proxyStatus.blocker.processName} (PID ${proxyStatus.blocker.pid})`));
+                console.error('');
+                console.error('To fix this, close the blocking application or run:');
+                console.error(`  ${(0, platform_commands_1.getPortCheckCommand)(cfg.port)}`);
+                console.error('');
+                throw new Error(`Port ${cfg.port} is in use by another application`);
+            }
+            // 6b. Spawn CLIProxyAPI binary
+            const proxyArgs = ['--config', configPath];
+            log(`Spawning: ${binaryPath} ${proxyArgs.join(' ')}`);
+            proxy = (0, child_process_1.spawn)(binaryPath, proxyArgs, {
+                stdio: ['ignore', 'ignore', 'ignore'],
+                detached: true,
+                env: {
+                    ...process.env,
+                    WRITABLE_PATH: (0, config_generator_1.getCliproxyWritablePath)(),
+                },
+            });
+            proxy.unref();
+            proxy.on('error', (error) => {
+                console.error((0, ui_1.fail)(`CLIProxy spawn error: ${error.message}`));
+            });
+            // 7. Wait for proxy readiness via TCP polling
+            const readySpinner = new progress_indicator_1.ProgressIndicator(`Waiting for CLIProxy on port ${cfg.port}`);
+            readySpinner.start();
+            try {
+                await waitForProxyReady(cfg.port, cfg.timeout, cfg.pollInterval);
+                readySpinner.succeed(`CLIProxy ready on port ${cfg.port}`);
+            }
+            catch (error) {
+                const backendLabel = backend === 'plus' ? 'CLIProxy Plus' : 'CLIProxy';
+                readySpinner.fail(`${backendLabel} startup failed`);
+                proxy.kill('SIGTERM');
+                const err = error;
+                console.error('');
+                console.error((0, ui_1.fail)(`${backendLabel} failed to start`));
+                console.error('');
+                console.error('Possible causes:');
+                console.error(`  1. Port ${cfg.port} already in use`);
+                console.error('  2. Binary crashed on startup');
+                console.error('  3. Invalid configuration');
+                console.error('');
+                console.error('Troubleshooting:');
+                console.error(`  - Check port: ${(0, platform_commands_1.getPortCheckCommand)(cfg.port)}`);
+                console.error('  - Run with --verbose for detailed logs');
+                console.error(`  - View config: ${(0, platform_commands_1.getCatCommand)(configPath)}`);
+                console.error('  - Try: ccs doctor --fix');
+                console.error('');
+                throw new Error(`CLIProxy startup failed: ${err.message}`);
+            }
+            // Register this session with the new proxy, including version and backend
+            const installedVersion = (0, binary_manager_1.getInstalledCliproxyVersion)();
+            sessionId = (0, session_tracker_1.registerSession)(cfg.port, proxy.pid, installedVersion, backend);
+            log(`Registered session ${sessionId} with new proxy (PID ${proxy.pid}, version ${installedVersion})`);
+        });
+    }
+    // 7. Execute Claude CLI with proxied environment
+    // Use remote or local env vars based on mode
+    // When remote is configured (even if using local), pass config for URL rewriting
+    const remoteRewriteConfig = proxyConfig.mode === 'remote' && proxyConfig.host
+        ? {
+            host: proxyConfig.host,
+            port: proxyConfig.port,
+            protocol: proxyConfig.protocol,
+            authToken: proxyConfig.authToken,
+        }
+        : undefined;
+    // For HTTPS remote, we need a local HTTP tunnel since Claude Code doesn't support
+    // HTTPS in ANTHROPIC_BASE_URL directly (undici limitation)
+    let httpsTunnel = null;
+    let tunnelPort = null;
+    if (useRemoteProxy && proxyConfig.protocol === 'https' && proxyConfig.host) {
+        try {
+            httpsTunnel = new https_tunnel_proxy_1.HttpsTunnelProxy({
+                remoteHost: proxyConfig.host,
+                remotePort: proxyConfig.port,
+                authToken: proxyConfig.authToken,
+                verbose,
+                allowSelfSigned: proxyConfig.allowSelfSigned ?? false,
+            });
+            tunnelPort = await httpsTunnel.start();
+            log(`HTTPS tunnel started on port ${tunnelPort} → https://${proxyConfig.host}:${proxyConfig.port}`);
+        }
+        catch (error) {
+            const err = error;
+            console.error((0, ui_1.warn)(`Failed to start HTTPS tunnel: ${err.message}`));
+            throw new Error(`HTTPS tunnel startup failed: ${err.message}`);
+        }
+    }
+    // Build env vars - use tunnel port for HTTPS remote, direct URL otherwise
+    const envVars = useRemoteProxy
+        ? httpsTunnel && tunnelPort
+            ? // HTTPS remote via local tunnel - use HTTP to tunnel
+                (0, config_generator_1.getRemoteEnvVars)(provider, {
+                    host: '127.0.0.1',
+                    port: tunnelPort,
+                    protocol: 'http', // Tunnel speaks HTTP locally
+                    authToken: proxyConfig.authToken,
+                }, cfg.customSettingsPath)
+            : // HTTP remote - direct connection
+                (0, config_generator_1.getRemoteEnvVars)(provider, {
+                    host: proxyConfig.host ?? 'localhost',
+                    port: proxyConfig.port,
+                    protocol: proxyConfig.protocol,
+                    authToken: proxyConfig.authToken,
+                }, cfg.customSettingsPath)
+        : (0, config_generator_1.getEffectiveEnvVars)(provider, cfg.port, cfg.customSettingsPath, remoteRewriteConfig);
+    // Apply thinking configuration to model (auto tier-based or manual override)
+    // This adds thinking suffix like model(high) or model(8192) for CLIProxyAPIPlus
+    (0, config_generator_1.applyThinkingConfig)(envVars, provider, thinkingOverride);
+    // Tool sanitization proxy - applies to ALL CLIProxy providers.
+    // Sanitizes MCP tool names exceeding Gemini's 64-char limit.
+    // Proxy chain order (request flow):
+    //   Claude CLI → ToolSanitizationProxy → [CodexReasoningProxy if codex] → CLIProxy → Backend
+    // Response flow is reversed, with each proxy transforming data back.
+    let toolSanitizationProxy = null;
+    let toolSanitizationPort = null;
+    if (envVars.ANTHROPIC_BASE_URL) {
+        try {
+            toolSanitizationProxy = new tool_sanitization_proxy_1.ToolSanitizationProxy({
+                upstreamBaseUrl: envVars.ANTHROPIC_BASE_URL,
+                verbose,
+                warnOnSanitize: true,
+            });
+            toolSanitizationPort = await toolSanitizationProxy.start();
+            log(`Tool sanitization proxy active on port ${toolSanitizationPort}`);
+        }
+        catch (error) {
+            // Non-fatal: continue without sanitization
+            const err = error;
+            toolSanitizationProxy = null;
+            toolSanitizationPort = null;
+            if (verbose) {
+                console.error((0, ui_1.warn)(`Tool sanitization proxy disabled: ${err.message}`));
+            }
+        }
+    }
+    // Determine the effective upstream URL after tool sanitization
+    const postSanitizationBaseUrl = toolSanitizationPort
+        ? `http://127.0.0.1:${toolSanitizationPort}`
+        : envVars.ANTHROPIC_BASE_URL;
+    // Codex-only: inject OpenAI reasoning effort based on tier model mapping.
+    // Maps by request.model:
+    // - OPUS/default model → xhigh
+    // - SONNET model → high
+    // - HAIKU model → medium
+    // - Unknown → medium
+    let codexReasoningProxy = null;
+    let codexReasoningPort = null;
+    if (provider === 'codex') {
+        if (!postSanitizationBaseUrl) {
+            log('ANTHROPIC_BASE_URL not set for Codex, reasoning proxy disabled');
+        }
+        else {
+            try {
+                const traceEnabled = process.env.CCS_CODEX_REASONING_TRACE === '1' ||
+                    process.env.CCS_CODEX_REASONING_TRACE === 'true';
+                // For remote proxy mode, strip /api/provider/codex prefix from paths
+                // because remote CLIProxyAPI uses root paths (/v1/messages), not provider-prefixed
+                const stripPathPrefix = useRemoteProxy ? '/api/provider/codex' : undefined;
+                codexReasoningProxy = new codex_reasoning_proxy_1.CodexReasoningProxy({
+                    upstreamBaseUrl: postSanitizationBaseUrl,
+                    verbose,
+                    defaultEffort: 'medium',
+                    traceFilePath: traceEnabled ? `${os.homedir()}/.ccs/codex-reasoning-proxy.log` : '',
+                    modelMap: {
+                        defaultModel: envVars.ANTHROPIC_MODEL,
+                        opusModel: envVars.ANTHROPIC_DEFAULT_OPUS_MODEL,
+                        sonnetModel: envVars.ANTHROPIC_DEFAULT_SONNET_MODEL,
+                        haikuModel: envVars.ANTHROPIC_DEFAULT_HAIKU_MODEL,
+                    },
+                    stripPathPrefix,
+                });
+                codexReasoningPort = await codexReasoningProxy.start();
+                log(`Codex reasoning proxy active: http://127.0.0.1:${codexReasoningPort}/api/provider/codex`);
+            }
+            catch (error) {
+                const err = error;
+                codexReasoningProxy = null;
+                codexReasoningPort = null;
+                if (verbose) {
+                    console.error((0, ui_1.warn)(`Codex reasoning proxy disabled: ${err.message}`));
+                }
+            }
+        }
+    }
+    // Determine the final ANTHROPIC_BASE_URL based on active proxies
+    // Chain order: Claude CLI → [CodexReasoningProxy] → [ToolSanitizationProxy] → CLIProxy
+    // The outermost active proxy becomes the effective base URL
+    let finalBaseUrl = envVars.ANTHROPIC_BASE_URL;
+    if (toolSanitizationPort) {
+        finalBaseUrl = `http://127.0.0.1:${toolSanitizationPort}`;
+    }
+    if (codexReasoningPort) {
+        // Codex reasoning proxy is the outermost layer for codex provider
+        finalBaseUrl = `http://127.0.0.1:${codexReasoningPort}/api/provider/codex`;
+    }
+    const effectiveEnvVars = {
+        ...envVars,
+        ANTHROPIC_BASE_URL: finalBaseUrl,
+    };
+    const webSearchEnv = (0, websearch_manager_1.getWebSearchHookEnv)();
+    const imageAnalysisEnv = (0, get_image_analysis_hook_env_1.getImageAnalysisHookEnv)(provider);
+    const env = {
+        ...process.env,
+        ...effectiveEnvVars,
+        ...webSearchEnv,
+        ...imageAnalysisEnv,
+        CCS_PROFILE_TYPE: 'cliproxy', // Signal to WebSearch hook this is a third-party provider
+    };
+    log(`Claude env: ANTHROPIC_BASE_URL=${effectiveEnvVars.ANTHROPIC_BASE_URL}`);
+    log(`Claude env: ANTHROPIC_MODEL=${envVars.ANTHROPIC_MODEL}`);
+    if (Object.keys(webSearchEnv).length > 0) {
+        log(`Claude env: WebSearch config=${JSON.stringify(webSearchEnv)}`);
+    }
+    // Log global env vars for visibility
+    if (envVars.DISABLE_TELEMETRY || envVars.DISABLE_ERROR_REPORTING || envVars.DISABLE_BUG_COMMAND) {
+        log(`Claude env: Global env applied (telemetry/reporting disabled)`);
+    }
+    // Filter out CCS-specific flags before passing to Claude CLI
+    // Note: Proxy flags (--proxy-host, etc.) already stripped by resolveProxyConfig()
+    const ccsFlags = [
+        '--auth',
+        '--paste-callback',
+        '--headless',
+        '--logout',
+        '--config',
+        '--add',
+        '--accounts',
+        '--use',
+        '--nickname',
+        '--thinking',
+        '--incognito',
+        '--no-incognito',
+        '--import',
+        '--settings', // Block user --settings to prevent duplicate flags
+        // Proxy flags are handled by resolveProxyConfig, but list for documentation
+        ...proxy_config_resolver_1.PROXY_CLI_FLAGS,
+    ];
+    const claudeArgs = argsWithoutProxy.filter((arg, idx) => {
+        // Filter out CCS flags
+        if (ccsFlags.includes(arg))
+            return false;
+        // Filter out --thinking=value format
+        if (arg.startsWith('--thinking='))
+            return false;
+        // Filter out value after --use, --nickname, or --thinking
+        if (argsWithoutProxy[idx - 1] === '--use' ||
+            argsWithoutProxy[idx - 1] === '--nickname' ||
+            argsWithoutProxy[idx - 1] === '--thinking')
+            return false;
+        return true;
+    });
+    const isWindows = process.platform === 'win32';
+    const needsShell = isWindows && /\.(cmd|bat|ps1)$/i.test(claudeCli);
+    // Get profile settings path for hooks (WebSearch, etc.)
+    // Use custom settings path for CLIProxy variants, otherwise use default provider path
+    const settingsPath = cfg.customSettingsPath
+        ? cfg.customSettingsPath.replace(/^~/, os.homedir())
+        : (0, config_generator_1.getProviderSettingsPath)(provider);
+    let claude;
+    if (needsShell) {
+        const cmdString = [claudeCli, '--settings', settingsPath, ...claudeArgs]
+            .map(shell_executor_1.escapeShellArg)
+            .join(' ');
+        claude = (0, child_process_1.spawn)(cmdString, {
+            stdio: 'inherit',
+            windowsHide: true,
+            shell: true,
+            env,
+        });
+    }
+    else {
+        claude = (0, child_process_1.spawn)(claudeCli, ['--settings', settingsPath, ...claudeArgs], {
+            stdio: 'inherit',
+            windowsHide: true,
+            env,
+        });
+    }
+    // 8. Cleanup: unregister session when Claude exits (local mode only)
+    // Proxy persists by default - use 'ccs cliproxy stop' to kill manually
+    // Capture port for cleanup (avoids closure issues)
+    const sessionPort = cfg.port;
+    claude.on('exit', (code, signal) => {
+        log(`Claude exited: code=${code}, signal=${signal}`);
+        if (codexReasoningProxy) {
+            codexReasoningProxy.stop();
+        }
+        if (toolSanitizationProxy) {
+            toolSanitizationProxy.stop();
+        }
+        if (httpsTunnel) {
+            httpsTunnel.stop();
+        }
+        // Unregister this session (proxy keeps running for persistence) - only for local mode
+        if (sessionId) {
+            (0, session_tracker_1.unregisterSession)(sessionId, sessionPort);
+            log(`Session ${sessionId} unregistered, proxy persists for other sessions or future use`);
+        }
+        if (signal) {
+            process.kill(process.pid, signal);
+        }
+        else {
+            process.exit(code || 0);
+        }
+    });
+    claude.on('error', (error) => {
+        console.error((0, ui_1.fail)(`Claude CLI error: ${error}`));
+        if (codexReasoningProxy) {
+            codexReasoningProxy.stop();
+        }
+        if (toolSanitizationProxy) {
+            toolSanitizationProxy.stop();
+        }
+        if (httpsTunnel) {
+            httpsTunnel.stop();
+        }
+        // Unregister session, proxy keeps running (local mode only)
+        if (sessionId) {
+            (0, session_tracker_1.unregisterSession)(sessionId, sessionPort);
+        }
+        process.exit(1);
+    });
+    // Handle parent process termination (SIGTERM, SIGINT)
+    const cleanup = () => {
+        log('Parent signal received, cleaning up');
+        if (codexReasoningProxy) {
+            codexReasoningProxy.stop();
+        }
+        if (toolSanitizationProxy) {
+            toolSanitizationProxy.stop();
+        }
+        if (httpsTunnel) {
+            httpsTunnel.stop();
+        }
+        // Unregister session, proxy keeps running (local mode only)
+        if (sessionId) {
+            (0, session_tracker_1.unregisterSession)(sessionId, sessionPort);
+        }
+        claude.kill('SIGTERM');
+    };
+    process.once('SIGTERM', cleanup);
+    process.once('SIGINT', cleanup);
+}
+exports.execClaudeWithCLIProxy = execClaudeWithCLIProxy;
+/**
+ * Check if a port is available
+ */
+async function isPortAvailable(port) {
+    return new Promise((resolve) => {
+        const server = net.createServer();
+        server.once('error', () => {
+            resolve(false);
+        });
+        server.once('listening', () => {
+            server.close();
+            resolve(true);
+        });
+        server.listen(port, '127.0.0.1');
+    });
+}
+exports.isPortAvailable = isPortAvailable;
+/**
+ * Find an available port in range
+ */
+async function findAvailablePort(startPort = config_generator_1.CLIPROXY_DEFAULT_PORT, range = 10) {
+    for (let port = startPort; port < startPort + range; port++) {
+        if (await isPortAvailable(port)) {
+            return port;
+        }
+    }
+    throw new Error(`No available port found in range ${startPort}-${startPort + range - 1}`);
+}
+exports.findAvailablePort = findAvailablePort;
+exports.default = execClaudeWithCLIProxy;
+//# sourceMappingURL=cliproxy-executor.js.map