@jonnyhoo/ccs 1.1.1 → 1.1.3

package/dist/cliproxy/cliproxy-executor.js

@@ -1,1228 +0,0 @@
-"use strict";
-/**
- * CLIProxy Executor - Spawn/Kill Pattern for CLIProxyAPI
- *
- * Mirrors GLMT architecture:
- * 1. Ensure binary exists (Phase 1)
- * 2. Generate config for provider
- * 3. Spawn CLIProxyAPI binary
- * 4. Poll port for readiness (no stdout signal)
- * 5. Execute Claude CLI with proxied environment
- * 6. Kill proxy on Claude exit
- *
- * Key difference from GLMT: Uses TCP port polling instead of PROXY_READY signal
- */
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.findAvailablePort = exports.isPortAvailable = exports.execClaudeWithCLIProxy = void 0;
-const child_process_1 = require("child_process");
-const fs = __importStar(require("fs"));
-const net = __importStar(require("net"));
-const os = __importStar(require("os"));
-const yaml = __importStar(require("js-yaml"));
-const progress_indicator_1 = require("../utils/progress-indicator");
-const ui_1 = require("../utils/ui");
-const shell_executor_1 = require("../utils/shell-executor");
-const binary_manager_1 = require("./binary-manager");
-const config_generator_1 = require("./config-generator");
-const remote_proxy_client_1 = require("./remote-proxy-client");
-const auth_handler_1 = require("./auth-handler");
-const types_1 = require("./types");
-const platform_detector_1 = require("./platform-detector");
-const model_config_1 = require("./model-config");
-const proxy_config_resolver_1 = require("./proxy-config-resolver");
-const websearch_manager_1 = require("../utils/websearch-manager");
-const get_image_analysis_hook_env_1 = require("../utils/hooks/get-image-analysis-hook-env");
-const model_catalog_1 = require("./model-catalog");
-const codex_reasoning_proxy_1 = require("./codex-reasoning-proxy");
-const endpoint_setup_1 = require("./endpoint-setup");
-const tool_sanitization_proxy_1 = require("./tool-sanitization-proxy");
-const anthropic_to_openai_proxy_1 = require("./anthropic-to-openai-proxy");
-const account_manager_1 = require("./account-manager");
-const platform_commands_1 = require("../utils/platform-commands");
-const websearch_manager_2 = require("../utils/websearch-manager");
-const session_tracker_1 = require("./session-tracker");
-const proxy_detector_1 = require("./proxy-detector");
-const startup_lock_1 = require("./startup-lock");
-const unified_config_loader_1 = require("../config/unified-config-loader");
-const quota_manager_1 = require("./quota-manager");
-const https_tunnel_proxy_1 = require("./https-tunnel-proxy");
-const router_1 = require("../router");
-/**
- * Check if a provider has a direct API key configured.
- * Sources (in priority order):
- *   1. Environment variables (CCS_{PROVIDER}_API_KEY) - portable across machines
- *   2. CLIProxy config.yaml ({provider}-api-key) - written by --setup
- *
- * When env vars are found, they are auto-persisted to config for durability.
- * When present, OAuth authentication can be skipped (direct API key mode).
- */
-function hasProviderApiKey(provider, port = config_generator_1.CLIPROXY_DEFAULT_PORT, verbose = false) {
-    // 1. Check env vars first (highest priority, most portable)
-    const envEndpoint = (0, endpoint_setup_1.getEndpointFromEnv)(provider);
-    if (envEndpoint) {
-        // Auto-persist to config for durability (best-effort)
-        (0, endpoint_setup_1.persistEnvEndpoint)(provider, envEndpoint, verbose, port);
-        return true;
-    }
-    // 2. Check CLIProxy config.yaml
-    const keyFieldMap = {
-        codex: 'codex-api-key',
-        gemini: 'gemini-api-key',
-        claude: 'claude-api-key',
-    };
-    const keyField = keyFieldMap[provider];
-    if (!keyField)
-        return false;
-    try {
-        const configPath = (0, config_generator_1.getConfigPathForPort)(port);
-        if (!fs.existsSync(configPath))
-            return false;
-        const content = fs.readFileSync(configPath, 'utf-8');
-        const config = yaml.load(content);
-        const entries = config[keyField];
-        return Array.isArray(entries) && entries.some((e) => !!e['api-key']?.trim());
-    }
-    catch {
-        return false;
-    }
-}
-/** Default executor configuration */
-const DEFAULT_CONFIG = {
-    port: config_generator_1.CLIPROXY_DEFAULT_PORT,
-    timeout: 5000,
-    verbose: false,
-    pollInterval: 100,
-};
-/**
- * Wait for TCP port to become available
- * Uses polling since CLIProxyAPI doesn't emit PROXY_READY signal
- */
-async function waitForProxyReady(port, timeout = 5000, pollInterval = 100) {
-    const start = Date.now();
-    while (Date.now() - start < timeout) {
-        try {
-            await new Promise((resolve, reject) => {
-                const socket = net.createConnection({ port, host: '127.0.0.1' }, () => {
-                    socket.destroy();
-                    resolve();
-                });
-                socket.on('error', (err) => {
-                    socket.destroy();
-                    reject(err);
-                });
-                // Individual connection timeout
-                socket.setTimeout(1000, () => {
-                    socket.destroy();
-                    reject(new Error('Connection timeout'));
-                });
-            });
-            return; // Connection successful - proxy is ready
-        }
-        catch {
-            // Connection failed, wait and retry
-            await new Promise((r) => setTimeout(r, pollInterval));
-        }
-    }
-    throw new Error(`CLIProxy not ready after ${timeout}ms on port ${port}`);
-}
-/**
- * Execute Claude CLI with CLIProxy (main entry point)
- *
- * @param claudeCli Path to Claude CLI executable
- * @param provider CLIProxy provider (gemini, codex, agy, qwen)
- * @param args Arguments to pass to Claude CLI
- * @param config Optional executor configuration
- */
-async function execClaudeWithCLIProxy(claudeCli, provider, args, config = {}) {
-    // Filter out undefined values to prevent overwriting defaults
-    const filteredConfig = Object.fromEntries(Object.entries(config).filter(([, v]) => v !== undefined));
-    const cfg = { ...DEFAULT_CONFIG, ...filteredConfig };
-    const verbose = cfg.verbose || args.includes('--verbose') || args.includes('-v');
-    const log = (msg) => {
-        if (verbose) {
-            console.error(`[cliproxy] ${msg}`);
-        }
-    };
-    // 0. Resolve proxy configuration (CLI > ENV > config.yaml > defaults)
-    // This filters proxy flags from args and returns resolved config
-    const unifiedConfig = (0, unified_config_loader_1.loadOrCreateUnifiedConfig)();
-    // 0a. Runtime backend/provider validation - block kiro/ghcp if backend=original
-    const backend = unifiedConfig.cliproxy?.backend ?? platform_detector_1.DEFAULT_BACKEND;
-    if (backend === 'original' && types_1.PLUS_ONLY_PROVIDERS.includes(provider)) {
-        console.error('');
-        console.error((0, ui_1.fail)(`${provider} requires CLIProxyAPIPlus backend`));
-        console.error('');
-        console.error('To use this provider, either:');
-        console.error('  1. Set `cliproxy.backend: plus` in ~/.ccs/config.yaml');
-        console.error('  2. Use --backend=plus flag: ccs ' + provider + ' --backend=plus');
-        console.error('');
-        throw new Error(`Provider ${provider} requires Plus backend`);
-    }
-    const cliproxyServerConfig = unifiedConfig.cliproxy_server;
-    const { config: proxyConfig, remainingArgs: argsWithoutProxy } = (0, proxy_config_resolver_1.resolveProxyConfig)(args, {
-        remote: cliproxyServerConfig?.remote
-            ? {
-                enabled: cliproxyServerConfig.remote.enabled,
-                host: cliproxyServerConfig.remote.host,
-                port: cliproxyServerConfig.remote.port,
-                protocol: cliproxyServerConfig.remote.protocol,
-                auth_token: cliproxyServerConfig.remote.auth_token,
-                timeout: cliproxyServerConfig.remote.timeout,
-            }
-            : undefined,
-        local: cliproxyServerConfig?.local
-            ? {
-                port: cliproxyServerConfig.local.port,
-                auto_start: cliproxyServerConfig.local.auto_start,
-            }
-            : undefined,
-    });
-    // Use resolved port from proxy config (overrides ExecutorConfig)
-    // Priority: CLI flags > Variant port (cfg.port) > config.yaml > default
-    // cfg.port is set if variant has dedicated port; proxyConfig.port comes from CLI/ENV/config.yaml
-    if (cfg.port && cfg.port !== config_generator_1.CLIPROXY_DEFAULT_PORT) {
-        // Variant port already set via config param - keep it (highest priority after CLI flags)
-        // CLI flags would have been parsed in resolveProxyConfig and set proxyConfig.port
-        // So if proxyConfig.port differs from default AND cfg.port differs, CLI wins
-        if (proxyConfig.port !== config_generator_1.CLIPROXY_DEFAULT_PORT) {
-            cfg.port = proxyConfig.port; // CLI/ENV override variant port
-        }
-        // else: keep cfg.port (variant port)
-    }
-    else if (proxyConfig.port !== config_generator_1.CLIPROXY_DEFAULT_PORT) {
-        cfg.port = proxyConfig.port;
-    }
-    // Final port validation - ensure valid port after all resolution
-    cfg.port = (0, config_generator_1.validatePort)(cfg.port);
-    log(`Proxy mode: ${proxyConfig.mode}`);
-    if (proxyConfig.mode === 'remote') {
-        log(`Remote host: ${proxyConfig.host}:${proxyConfig.port} (${proxyConfig.protocol})`);
-    }
-    // Note: proxyConfig is available for Phase 4 (remote mode integration)
-    // Ensure MCP web-search is configured for third-party profiles
-    // WebSearch is a server-side tool executed by Anthropic's API
-    // Third-party providers don't have access, so we use MCP fallback
-    (0, websearch_manager_2.ensureMcpWebSearch)();
-    // Install WebSearch hook for Gemini CLI + MCP fallback
-    // Hook intercepts WebSearch, tries Gemini CLI first, falls back to MCP
-    (0, websearch_manager_2.installWebSearchHook)();
-    // Display WebSearch status (single line, equilibrium UX)
-    (0, websearch_manager_2.displayWebSearchStatus)();
-    // Validate provider
-    const providerConfig = (0, config_generator_1.getProviderConfig)(provider);
-    log(`Provider: ${providerConfig.displayName}`);
-    // Check remote proxy if configured (before binary download)
-    let useRemoteProxy = false;
-    if (proxyConfig.mode === 'remote' && proxyConfig.host) {
-        const status = await (0, remote_proxy_client_1.checkRemoteProxy)({
-            host: proxyConfig.host,
-            port: proxyConfig.port,
-            protocol: proxyConfig.protocol,
-            authToken: proxyConfig.authToken,
-            timeout: proxyConfig.timeout ?? 2000,
-            allowSelfSigned: proxyConfig.allowSelfSigned ?? false,
-        });
-        if (status.reachable) {
-            useRemoteProxy = true;
-            console.log((0, ui_1.ok)(`Connected to remote proxy at ${proxyConfig.host}:${proxyConfig.port} (${status.latencyMs}ms)`));
-        }
-        else {
-            console.error((0, ui_1.warn)(`Remote proxy unreachable: ${status.error}`));
-            if (proxyConfig.remoteOnly) {
-                throw new Error('Remote proxy unreachable and --remote-only specified');
-            }
-            if (proxyConfig.fallbackEnabled) {
-                if (proxyConfig.autoStartLocal) {
-                    console.log((0, ui_1.info)('Falling back to local proxy...'));
-                }
-                else {
-                    // Prompt user for fallback (only in TTY)
-                    if (process.stdin.isTTY) {
-                        const readline = await Promise.resolve().then(() => __importStar(require('readline')));
-                        const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-                        const answer = await new Promise((resolve) => {
-                            rl.question('Start local proxy instead? [Y/n] ', resolve);
-                        });
-                        rl.close();
-                        if (answer.toLowerCase() === 'n') {
-                            throw new Error('Remote proxy unreachable and user declined fallback');
-                        }
-                    }
-                    console.log((0, ui_1.info)('Starting local proxy...'));
-                }
-            }
-            else {
-                throw new Error('Remote proxy unreachable and fallback disabled');
-            }
-        }
-    }
-    // Variables for local proxy mode
-    let binaryPath;
-    let sessionId;
-    // 1. Ensure binary exists (downloads if needed) - SKIP for remote mode
-    if (!useRemoteProxy) {
-        const spinner = new progress_indicator_1.ProgressIndicator('Preparing CLIProxy');
-        spinner.start();
-        try {
-            binaryPath = await (0, binary_manager_1.ensureCLIProxyBinary)(verbose);
-            spinner.succeed('CLIProxy binary ready');
-        }
-        catch (error) {
-            spinner.fail('Failed to prepare CLIProxy');
-            const err = error;
-            // Check if network offline (DNS, connection, or timeout failure)
-            const networkErrors = [
-                'getaddrinfo',
-                'ENOTFOUND',
-                'ETIMEDOUT',
-                'ECONNREFUSED',
-                'ENETUNREACH',
-                'EAI_AGAIN',
-            ];
-            const isNetworkError = networkErrors.some((errCode) => err.message.includes(errCode));
-            if (isNetworkError) {
-                console.error('');
-                console.error((0, ui_1.fail)('No network connection detected'));
-                console.error('');
-                console.error('CLIProxy binary download requires internet access.');
-                console.error('Please check your network connection and try again.');
-                console.error('');
-                process.exit(1);
-            }
-            throw error;
-        }
-    }
-    // 2. Handle special flags (use argsWithoutProxy - proxy flags already stripped)
-    const forceAuth = argsWithoutProxy.includes('--auth');
-    const forceSetup = argsWithoutProxy.includes('--setup');
-    const pasteCallback = argsWithoutProxy.includes('--paste-callback');
-    const forceHeadless = argsWithoutProxy.includes('--headless');
-    const forceLogout = argsWithoutProxy.includes('--logout');
-    const forceConfig = argsWithoutProxy.includes('--config');
-    const addAccount = argsWithoutProxy.includes('--add');
-    const showAccounts = argsWithoutProxy.includes('--accounts');
-    // Kiro-specific: --import to import token from Kiro IDE directly
-    const forceImport = argsWithoutProxy.includes('--import');
-    // Kiro-specific: browser mode for OAuth
-    // Default to normal browser (noIncognito=true) for reliability - incognito often fails on Linux
-    // --incognito flag opts into incognito mode, --no-incognito is legacy (now default)
-    const incognitoFlag = argsWithoutProxy.includes('--incognito');
-    const noIncognitoFlag = argsWithoutProxy.includes('--no-incognito');
-    // Config setting (defaults to true = normal browser)
-    const kiroNoIncognitoConfig = provider === 'kiro' ? (unifiedConfig.cliproxy?.kiro_no_incognito ?? true) : false;
-    // --incognito flag overrides everything to use incognito
-    const noIncognito = incognitoFlag ? false : noIncognitoFlag || kiroNoIncognitoConfig;
-    // Parse --use <account> flag
-    let useAccount;
-    const useIdx = argsWithoutProxy.indexOf('--use');
-    if (useIdx !== -1 &&
-        argsWithoutProxy[useIdx + 1] &&
-        !argsWithoutProxy[useIdx + 1].startsWith('-')) {
-        useAccount = argsWithoutProxy[useIdx + 1];
-    }
-    // Parse --nickname <name> flag
-    let setNickname;
-    const nicknameIdx = argsWithoutProxy.indexOf('--nickname');
-    if (nicknameIdx !== -1 &&
-        argsWithoutProxy[nicknameIdx + 1] &&
-        !argsWithoutProxy[nicknameIdx + 1].startsWith('-')) {
-        setNickname = argsWithoutProxy[nicknameIdx + 1];
-    }
-    // Parse --thinking <value> flag for thinking budget control
-    // Supports: level names (low, medium, high, xhigh, auto), numeric budget, or 'off'/'none'
-    // Accepts both --thinking=value and --thinking value formats
-    let thinkingOverride;
-    // Check for --thinking=value format first
-    const thinkingEqArg = argsWithoutProxy.find((arg) => arg.startsWith('--thinking='));
-    if (thinkingEqArg) {
-        const val = thinkingEqArg.substring('--thinking='.length);
-        // Handle empty value after equals (--thinking=)
-        if (!val || val.trim() === '') {
-            console.error((0, ui_1.fail)('--thinking requires a value'));
-            console.error('    Examples: --thinking=low, --thinking=8192, --thinking=off');
-            console.error('    Levels: minimal, low, medium, high, xhigh, auto');
-            process.exit(1);
-        }
-        // Parse as number if numeric, otherwise keep as string (level name)
-        const numVal = parseInt(val, 10);
-        thinkingOverride = !isNaN(numVal) ? numVal : val;
-        // W2: Warn if multiple --thinking flags found (check both formats)
-        const allThinkingFlags = argsWithoutProxy.filter((arg) => arg === '--thinking' || arg.startsWith('--thinking='));
-        if (allThinkingFlags.length > 1) {
-            console.warn(`[!] Multiple --thinking flags detected. Using first occurrence: ${thinkingEqArg}`);
-        }
-    }
-    else {
-        // Fall back to --thinking value format
-        const thinkingIdx = argsWithoutProxy.indexOf('--thinking');
-        if (thinkingIdx !== -1) {
-            const nextArg = argsWithoutProxy[thinkingIdx + 1];
-            // U1: Check if --thinking has a value (not missing or another flag)
-            if (!nextArg || nextArg.startsWith('-')) {
-                console.error((0, ui_1.fail)('--thinking requires a value'));
-                console.error('    Examples: --thinking low, --thinking 8192, --thinking off');
-                console.error('    Levels: minimal, low, medium, high, xhigh, auto');
-                process.exit(1);
-            }
-            const val = nextArg;
-            // Parse as number if numeric, otherwise keep as string (level name)
-            const numVal = parseInt(val, 10);
-            thinkingOverride = !isNaN(numVal) ? numVal : val;
-            // W2: Warn if multiple --thinking flags found (check both formats)
-            const allThinkingFlags = argsWithoutProxy.filter((arg) => arg === '--thinking' || arg.startsWith('--thinking='));
-            if (allThinkingFlags.length > 1) {
-                console.warn(`[!] Multiple --thinking flags detected. Using first occurrence: --thinking ${val}`);
-            }
-        }
-    }
-    // Handle --setup: configure custom API endpoint and exit
-    if (forceSetup) {
-        if ((0, endpoint_setup_1.supportsSetup)(provider)) {
-            await (0, endpoint_setup_1.setupProviderEndpoint)(provider, verbose, cfg.port);
-        }
-        else {
-            console.error((0, ui_1.fail)(`--setup is not available for ${provider}`));
-            console.error(`    Supported providers: codex, gemini, claude`);
-            process.exit(1);
-        }
-        process.exit(0);
-    }
-    // Handle --accounts: list accounts and exit
-    if (showAccounts) {
-        const accounts = (0, account_manager_1.getProviderAccounts)(provider);
-        if (accounts.length === 0) {
-            console.log((0, ui_1.info)(`No accounts registered for ${providerConfig.displayName}`));
-            console.log(`    Run "ccs ${provider} --auth" to add an account`);
-        }
-        else {
-            console.log(`\n${providerConfig.displayName} Accounts:\n`);
-            for (const acct of accounts) {
-                const defaultMark = acct.isDefault ? ' (default)' : '';
-                const nickname = acct.nickname ? `[${acct.nickname}]` : '';
-                console.log(`  ${nickname.padEnd(12)} ${acct.email || acct.id}${defaultMark}`);
-            }
-            console.log(`\n  Use "ccs ${provider} --use <nickname>" to switch accounts`);
-        }
-        process.exit(0);
-    }
-    // Handle --use: switch to specified account
-    if (useAccount) {
-        const account = (0, account_manager_1.findAccountByQuery)(provider, useAccount);
-        if (!account) {
-            console.error((0, ui_1.fail)(`Account not found: "${useAccount}"`));
-            const accounts = (0, account_manager_1.getProviderAccounts)(provider);
-            if (accounts.length > 0) {
-                console.error(`    Available accounts:`);
-                for (const acct of accounts) {
-                    console.error(`      - ${acct.nickname || acct.id} (${acct.email || 'no email'})`);
-                }
-            }
-            process.exit(1);
-        }
-        // Set as default for this and future sessions
-        (0, account_manager_1.setDefaultAccount)(provider, account.id);
-        (0, account_manager_1.touchAccount)(provider, account.id);
-        console.log((0, ui_1.ok)(`Switched to account: ${account.nickname || account.email || account.id}`));
-    }
-    // Handle --nickname: rename account and exit (unless used with --auth --add)
-    if (setNickname && !addAccount) {
-        const defaultAccount = (0, account_manager_1.getDefaultAccount)(provider);
-        if (!defaultAccount) {
-            console.error((0, ui_1.fail)(`No account found for ${providerConfig.displayName}`));
-            console.error(`    Run "ccs ${provider} --auth" to add an account first`);
-            process.exit(1);
-        }
-        try {
-            const success = (0, account_manager_1.renameAccount)(provider, defaultAccount.id, setNickname);
-            if (success) {
-                console.log((0, ui_1.ok)(`Renamed account to: ${setNickname}`));
-            }
-            else {
-                console.error((0, ui_1.fail)('Failed to rename account'));
-                process.exit(1);
-            }
-        }
-        catch (err) {
-            console.error((0, ui_1.fail)(err instanceof Error ? err.message : 'Failed to rename account'));
-            process.exit(1);
-        }
-        process.exit(0);
-    }
-    // Handle --config: configure model selection and exit
-    // Pass customSettingsPath for CLIProxy variants to save to correct file
-    if (forceConfig && (0, model_catalog_1.supportsModelConfig)(provider)) {
-        await (0, model_config_1.configureProviderModel)(provider, true, cfg.customSettingsPath);
-        process.exit(0);
-    }
-    // Handle --logout: clear auth and exit
-    if (forceLogout) {
-        const { clearAuth } = await Promise.resolve().then(() => __importStar(require('./auth-handler')));
-        if (clearAuth(provider)) {
-            console.log((0, ui_1.ok)(`Logged out from ${providerConfig.displayName}`));
-        }
-        else {
-            console.log((0, ui_1.info)(`No authentication found for ${providerConfig.displayName}`));
-        }
-        process.exit(0);
-    }
-    // Handle --import: import token from Kiro IDE directly (Kiro only)
-    if (forceImport) {
-        if (provider !== 'kiro') {
-            console.error((0, ui_1.fail)('--import is only available for Kiro'));
-            console.error(`    Run "ccs ${provider} --auth" to authenticate`);
-            process.exit(1);
-        }
-        // Validate flag conflicts
-        if (forceAuth) {
-            console.error((0, ui_1.fail)('Cannot use --import with --auth'));
-            console.error('    --import: Import existing token from Kiro IDE');
-            console.error('    --auth: Trigger new OAuth flow in browser');
-            process.exit(1);
-        }
-        if (forceLogout) {
-            console.error((0, ui_1.fail)('Cannot use --import with --logout'));
-            process.exit(1);
-        }
-        const { triggerOAuth } = await Promise.resolve().then(() => __importStar(require('./auth-handler')));
-        const authSuccess = await triggerOAuth(provider, {
-            verbose,
-            import: true,
-            ...(setNickname ? { nickname: setNickname } : {}),
-        });
-        if (!authSuccess) {
-            console.error((0, ui_1.fail)('Failed to import Kiro token from IDE'));
-            console.error('    Make sure you are logged into Kiro IDE first');
-            process.exit(1);
-        }
-        process.exit(0);
-    }
-    // 3. Ensure OAuth completed (if provider requires it)
-    // Skip local OAuth check when:
-    //   a) Using remote proxy with auth token, OR
-    //   b) Provider has a direct API key (env var or CLIProxy config)
-    // Note: Trim authToken to reject whitespace-only values
-    const remoteAuthToken = proxyConfig.authToken?.trim();
-    const hasApiKey = hasProviderApiKey(provider, cfg.port, verbose);
-    const skipLocalAuth = (useRemoteProxy && !!remoteAuthToken) || hasApiKey;
-    if (skipLocalAuth) {
-        if (useRemoteProxy && !!remoteAuthToken) {
-            log(`Using remote proxy authentication (skipping local OAuth)`);
-        }
-        else if (hasApiKey) {
-            const envEndpoint = (0, endpoint_setup_1.getEndpointFromEnv)(provider);
-            if (envEndpoint) {
-                log(`Using provider API key from env var (skipping OAuth)`);
-            }
-            else {
-                log(`Using provider API key from CLIProxy config (skipping OAuth)`);
-            }
-        }
-    }
-    if (providerConfig.requiresOAuth && !skipLocalAuth) {
-        log(`Checking authentication for ${provider}`);
-        if (forceAuth || !(0, auth_handler_1.isAuthenticated)(provider)) {
-            // Pass headless only if explicitly set; otherwise let auth-handler auto-detect
-            const { triggerOAuth } = await Promise.resolve().then(() => __importStar(require('./auth-handler')));
-            const authSuccess = await triggerOAuth(provider, {
-                verbose,
-                add: addAccount,
-                ...(forceHeadless ? { headless: true } : {}),
-                ...(setNickname ? { nickname: setNickname } : {}),
-                ...(noIncognito ? { noIncognito: true } : {}),
-                ...(pasteCallback ? { pasteCallback: true } : {}),
-            });
-            if (!authSuccess) {
-                // If provider supports API key setup, offer it as alternative to OAuth
-                if ((0, endpoint_setup_1.supportsSetup)(provider) && process.stdin.isTTY) {
-                    console.error('');
-                    console.error((0, ui_1.warn)(`OAuth login failed for ${providerConfig.displayName}`));
-                    console.error('');
-                    const { InteractivePrompt } = await Promise.resolve().then(() => __importStar(require('../utils/prompt')));
-                    const useApiKey = await InteractivePrompt.confirm('Configure a custom API endpoint instead? (--setup)', { default: true });
-                    if (useApiKey) {
-                        await (0, endpoint_setup_1.setupProviderEndpoint)(provider, verbose, cfg.port);
-                        process.exit(0);
-                    }
-                }
-                throw new Error(`Authentication required for ${providerConfig.displayName}`);
-            }
-            // If --auth was explicitly passed, exit after auth (don't start Claude)
-            if (forceAuth) {
-                process.exit(0);
-            }
-        }
-        else {
-            log(`${provider} already authenticated`);
-        }
-        // 3a. Proactive token refresh - prevent UND_ERR_SOCKET from expired tokens
-        // CLIProxyAPI may fail mid-request if token expires during use
-        const { ensureTokenValid } = await Promise.resolve().then(() => __importStar(require('./auth/token-manager')));
-        const tokenResult = await ensureTokenValid(provider, verbose);
-        if (!tokenResult.valid) {
-            // Token expired and refresh failed - trigger re-auth
-            console.error((0, ui_1.warn)('OAuth token expired and refresh failed'));
-            if (tokenResult.error) {
-                console.error(`    ${tokenResult.error}`);
-            }
-            console.error(`    Run "ccs ${provider} --auth" to re-authenticate`);
-            process.exit(1);
-        }
-        if (tokenResult.refreshed) {
-            log('Token was refreshed proactively');
-        }
-        // 3a-1. Update lastUsedAt for the account being used
-        // This ensures dashboard shows accurate "Last used" timestamps
-        const usedAccount = (0, account_manager_1.getDefaultAccount)(provider);
-        if (usedAccount) {
-            (0, account_manager_1.touchAccount)(provider, usedAccount.id);
-        }
-    }
-    // 3b. Preflight quota check - auto-switch to account with quota before launch
-    // Uses quota-manager for caching, tier priority, and cooldown support
-    // Skip for remote proxy - quota is managed on the remote server
-    if (provider === 'agy' && !skipLocalAuth) {
-        const preflight = await (0, quota_manager_1.preflightCheck)(provider);
-        if (!preflight.proceed) {
-            console.error((0, ui_1.fail)(`Cannot start session: ${preflight.reason}`));
-            process.exit(1);
-        }
-        if (preflight.switchedFrom) {
-            console.log((0, ui_1.info)(`Auto-switched to ${preflight.accountId}`));
-            console.log(`    Reason: ${preflight.reason}`);
-            if (preflight.quotaPercent !== undefined && preflight.quotaPercent !== null) {
-                console.log(`    New account quota: ${preflight.quotaPercent.toFixed(1)}%`);
-            }
-            else {
-                console.log(`    New account quota: N/A (fetch unavailable)`);
-            }
-        }
-    }
-    // 4. First-run model configuration (interactive)
-    // For supported providers, prompt user to select model on first run
-    // Pass customSettingsPath for CLIProxy variants
-    // Skip for remote proxy - model is configured on the remote server
-    if ((0, model_catalog_1.supportsModelConfig)(provider) && !skipLocalAuth) {
-        await (0, model_config_1.configureProviderModel)(provider, false, cfg.customSettingsPath); // false = only if not configured
-    }
-    // 5. Check for known broken models and warn user
-    // Show warning for both local and remote modes - user should be aware of model issues
-    const currentModel = (0, model_config_1.getCurrentModel)(provider, cfg.customSettingsPath);
-    if (currentModel && (0, model_catalog_1.isModelBroken)(provider, currentModel)) {
-        const modelEntry = (0, model_catalog_1.findModel)(provider, currentModel);
-        const issueUrl = (0, model_catalog_1.getModelIssueUrl)(provider, currentModel);
-        console.error('');
-        console.error((0, ui_1.warn)(`${modelEntry?.name || currentModel} has known issues with Claude Code`));
-        console.error('    Tool calls will fail. Use "gemini-3-pro-preview" instead.');
-        if (issueUrl) {
-            console.error(`    Tracking: ${issueUrl}`);
-        }
-        if (skipLocalAuth) {
-            console.error('    Note: Model may be overridden by remote proxy configuration.');
-        }
-        else {
-            console.error(`    Run "ccs ${provider} --config" to change model.`);
-        }
-        console.error('');
-    }
-    // 6. Ensure user settings file exists (creates from defaults if not)
-    (0, config_generator_1.ensureProviderSettings)(provider);
-    // Local proxy mode: generate config, spawn proxy, track session
-    // When a direct API key is configured, CLIProxy is bypassed entirely.
-    // Instead, AnthropicToOpenAIProxy handles protocol translation (Anthropic→OpenAI).
-    let proxy = null;
-    let a2oProxy = null;
-    let a2oPort = null;
-    // Direct API key mode: bypass CLIProxy entirely, use protocol translation proxy
-    // ONLY when API key comes from environment variables (CCS_CODEX_API_KEY, etc.)
-    // CLIProxy config keys (codex-api-key) are meant to be used BY CLIProxy, not to bypass it
-    const envEndpoint = (0, endpoint_setup_1.getEndpointFromEnv)(provider);
-    const providerEndpoint = envEndpoint;
-    const useDirectApiKey = !!envEndpoint;
-    if (useDirectApiKey && providerEndpoint && !useRemoteProxy) {
-        log(`Direct API key mode: bypassing CLIProxy, using protocol translation proxy`);
-        log(`Target endpoint: ${providerEndpoint.baseUrl}`);
-        try {
-            a2oProxy = new anthropic_to_openai_proxy_1.AnthropicToOpenAIProxy({
-                targetBaseUrl: providerEndpoint.baseUrl,
-                apiKey: providerEndpoint.apiKey,
-                verbose,
-                timeoutMs: 120000,
-            });
-            a2oPort = await a2oProxy.start();
-            log(`Anthropic→OpenAI translation proxy active on port ${a2oPort}`);
-        }
-        catch (error) {
-            const err = error;
-            console.error((0, ui_1.fail)(`Failed to start protocol translation proxy: ${err.message}`));
-            throw error;
-        }
-    }
-    else if (!useRemoteProxy) {
-        // 6. Generate config file
-        log(`Generating config for ${provider}`);
-        const configPath = (0, config_generator_1.generateConfig)(provider, cfg.port);
-        log(`Config written: ${configPath}`);
-        // 6a. Pre-flight check using unified detection with startup lock
-        // This prevents race conditions when multiple CCS processes start simultaneously
-        (0, session_tracker_1.cleanupOrphanedSessions)(cfg.port);
-        // Use startup lock to coordinate with other CCS processes
-        await (0, startup_lock_1.withStartupLock)(async () => {
-            // Detect running proxy using multiple methods (HTTP, session-lock, port-process)
-            let proxyStatus = await (0, proxy_detector_1.detectRunningProxy)(cfg.port);
-            log(`Proxy detection: ${JSON.stringify(proxyStatus)}`);
-            // Check for version mismatch - restart proxy if installed version differs from running
-            if (proxyStatus.running && proxyStatus.verified && proxyStatus.version) {
-                const installedVersion = (0, binary_manager_1.getInstalledCliproxyVersion)();
-                if (installedVersion !== proxyStatus.version) {
-                    console.log((0, ui_1.warn)(`Version mismatch: running v${proxyStatus.version}, installed v${installedVersion}. Restarting proxy...`));
-                    log(`Stopping outdated proxy (PID: ${proxyStatus.pid ?? 'unknown'})...`);
-                    const stopResult = await (0, session_tracker_1.stopProxy)(cfg.port);
-                    if (stopResult.stopped) {
-                        log(`Stopped outdated proxy successfully`);
-                    }
-                    else {
-                        log(`Stop proxy result: ${stopResult.error ?? 'unknown error'}`);
-                    }
-                    // Wait for port to be released
-                    await new Promise((r) => setTimeout(r, 500));
-                    // Re-detect proxy status (should now be not running)
-                    proxyStatus = await (0, proxy_detector_1.detectRunningProxy)(cfg.port);
-                    log(`Re-detection after version mismatch restart: ${JSON.stringify(proxyStatus)}`);
-                }
-            }
-            if (proxyStatus.running && proxyStatus.verified) {
-                // Healthy proxy found - join it
-                if (proxyStatus.pid) {
-                    sessionId = (0, proxy_detector_1.reclaimOrphanedProxy)(cfg.port, proxyStatus.pid, verbose) ?? undefined;
-                }
-                if (sessionId) {
-                    console.log((0, ui_1.info)(`Joined existing CLIProxy on port ${cfg.port} (${proxyStatus.method})`));
-                }
-                else {
-                    // Failed to register session - proxy is running but we can't track it
-                    // This happens when port-process detection fails (permissions, platform issues)
-                    console.log((0, ui_1.info)(`Using existing CLIProxy on port ${cfg.port} (session tracking unavailable)`));
-                    log(`PID=${proxyStatus.pid ?? 'unknown'}, session registration skipped`);
-                }
-                return; // Exit lock early, skip spawning
-            }
-            if (proxyStatus.running && !proxyStatus.verified) {
-                // Proxy detected but not ready yet (another process is starting it)
-                log(`Proxy starting up (detected via ${proxyStatus.method}), waiting...`);
-                const becameHealthy = await (0, proxy_detector_1.waitForProxyHealthy)(cfg.port, cfg.timeout);
-                if (becameHealthy) {
-                    if (proxyStatus.pid) {
-                        sessionId = (0, proxy_detector_1.reclaimOrphanedProxy)(cfg.port, proxyStatus.pid, verbose) ?? undefined;
-                    }
-                    console.log((0, ui_1.info)(`Joined CLIProxy after startup wait`));
-                    return; // Exit lock early
-                }
-                // Proxy didn't become healthy - kill and respawn
-                if (proxyStatus.pid) {
-                    log(`Proxy PID ${proxyStatus.pid} not responding, killing...`);
-                    (0, platform_commands_1.killProcessOnPort)(cfg.port, verbose);
-                    await new Promise((r) => setTimeout(r, 500));
-                }
-            }
-            if (proxyStatus.blocked && proxyStatus.blocker) {
-                // Port blocked by non-CLIProxy process
-                // Last resort: try HTTP health check (handles Windows PID-XXXXX case)
-                const isActuallyOurs = await (0, proxy_detector_1.waitForProxyHealthy)(cfg.port, 1000);
-                if (isActuallyOurs) {
-                    sessionId = (0, proxy_detector_1.reclaimOrphanedProxy)(cfg.port, proxyStatus.blocker.pid, verbose) ?? undefined;
-                    console.log((0, ui_1.info)(`Reclaimed CLIProxy with unrecognized process name`));
-                    return;
-                }
-                // Truly blocked by another application
-                console.error('');
-                console.error((0, ui_1.warn)(`Port ${cfg.port} is blocked by ${proxyStatus.blocker.processName} (PID ${proxyStatus.blocker.pid})`));
-                console.error('');
-                console.error('To fix this, close the blocking application or run:');
-                console.error(`  ${(0, platform_commands_1.getPortCheckCommand)(cfg.port)}`);
-                console.error('');
-                throw new Error(`Port ${cfg.port} is in use by another application`);
-            }
-            // 6b. Spawn CLIProxyAPI binary
-            const proxyArgs = ['--config', configPath];
-            log(`Spawning: ${binaryPath} ${proxyArgs.join(' ')}`);
-            proxy = (0, child_process_1.spawn)(binaryPath, proxyArgs, {
-                stdio: ['ignore', 'ignore', 'ignore'],
-                detached: true,
-                env: {
-                    ...process.env,
-                    WRITABLE_PATH: (0, config_generator_1.getCliproxyWritablePath)(),
-                },
-            });
-            proxy.unref();
-            proxy.on('error', (error) => {
-                console.error((0, ui_1.fail)(`CLIProxy spawn error: ${error.message}`));
-            });
-            // 7. Wait for proxy readiness via TCP polling
-            const readySpinner = new progress_indicator_1.ProgressIndicator(`Waiting for CLIProxy on port ${cfg.port}`);
-            readySpinner.start();
-            try {
-                await waitForProxyReady(cfg.port, cfg.timeout, cfg.pollInterval);
-                readySpinner.succeed(`CLIProxy ready on port ${cfg.port}`);
-            }
-            catch (error) {
-                const backendLabel = backend === 'plus' ? 'CLIProxy Plus' : 'CLIProxy';
-                readySpinner.fail(`${backendLabel} startup failed`);
-                proxy.kill('SIGTERM');
-                const err = error;
-                console.error('');
-                console.error((0, ui_1.fail)(`${backendLabel} failed to start`));
-                console.error('');
-                console.error('Possible causes:');
-                console.error(`  1. Port ${cfg.port} already in use`);
-                console.error('  2. Binary crashed on startup');
-                console.error('  3. Invalid configuration');
-                console.error('');
-                console.error('Troubleshooting:');
-                console.error(`  - Check port: ${(0, platform_commands_1.getPortCheckCommand)(cfg.port)}`);
-                console.error('  - Run with --verbose for detailed logs');
-                console.error(`  - View config: ${(0, platform_commands_1.getCatCommand)(configPath)}`);
-                console.error('  - Try: ccs doctor --fix');
-                console.error('');
-                throw new Error(`CLIProxy startup failed: ${err.message}`);
-            }
-            // Register this session with the new proxy, including version and backend
-            const installedVersion = (0, binary_manager_1.getInstalledCliproxyVersion)();
-            sessionId = (0, session_tracker_1.registerSession)(cfg.port, proxy.pid, installedVersion, backend);
-            log(`Registered session ${sessionId} with new proxy (PID ${proxy.pid}, version ${installedVersion})`);
-        });
-    }
-    // 7. Execute Claude CLI with proxied environment
-    // Use remote or local env vars based on mode
-    // When remote is configured (even if using local), pass config for URL rewriting
-    const remoteRewriteConfig = proxyConfig.mode === 'remote' && proxyConfig.host
-        ? {
-            host: proxyConfig.host,
-            port: proxyConfig.port,
-            protocol: proxyConfig.protocol,
-            authToken: proxyConfig.authToken,
-        }
-        : undefined;
-    // For HTTPS remote, we need a local HTTP tunnel since Claude Code doesn't support
-    // HTTPS in ANTHROPIC_BASE_URL directly (undici limitation)
-    let httpsTunnel = null;
-    let tunnelPort = null;
-    if (useRemoteProxy && proxyConfig.protocol === 'https' && proxyConfig.host) {
-        try {
-            httpsTunnel = new https_tunnel_proxy_1.HttpsTunnelProxy({
-                remoteHost: proxyConfig.host,
-                remotePort: proxyConfig.port,
-                authToken: proxyConfig.authToken,
-                verbose,
-                allowSelfSigned: proxyConfig.allowSelfSigned ?? false,
-            });
-            tunnelPort = await httpsTunnel.start();
-            log(`HTTPS tunnel started on port ${tunnelPort} → https://${proxyConfig.host}:${proxyConfig.port}`);
-        }
-        catch (error) {
-            const err = error;
-            console.error((0, ui_1.warn)(`Failed to start HTTPS tunnel: ${err.message}`));
-            throw new Error(`HTTPS tunnel startup failed: ${err.message}`);
-        }
-    }
-    // Build env vars - use tunnel port for HTTPS remote, or local proxy
-    let envVars;
-    if (useRemoteProxy) {
-        envVars = httpsTunnel && tunnelPort
-            ? // HTTPS remote via local tunnel - use HTTP to tunnel
-                (0, config_generator_1.getRemoteEnvVars)(provider, {
-                    host: '127.0.0.1',
-                    port: tunnelPort,
-                    protocol: 'http', // Tunnel speaks HTTP locally
-                    authToken: proxyConfig.authToken,
-                }, cfg.customSettingsPath)
-            : // HTTP remote - direct connection
-                (0, config_generator_1.getRemoteEnvVars)(provider, {
-                    host: proxyConfig.host ?? 'localhost',
-                    port: proxyConfig.port,
-                    protocol: proxyConfig.protocol,
-                    authToken: proxyConfig.authToken,
-                }, cfg.customSettingsPath);
-    }
-    else {
-        envVars = (0, config_generator_1.getEffectiveEnvVars)(provider, cfg.port, cfg.customSettingsPath, remoteRewriteConfig);
-    }
-    // Direct API key mode: override ANTHROPIC_BASE_URL to point to translation proxy
-    // The A2O proxy replaces CLIProxy at the bottom of the proxy chain
-    if (useDirectApiKey && a2oPort) {
-        envVars.ANTHROPIC_BASE_URL = `http://127.0.0.1:${a2oPort}/api/provider/${provider}`;
-        log(`Direct API key: ANTHROPIC_BASE_URL overridden to translation proxy`);
-    }
-    // Apply thinking configuration to model (auto tier-based or manual override)
-    // This adds thinking suffix like model(high) or model(8192) for CLIProxyAPIPlus
-    (0, config_generator_1.applyThinkingConfig)(envVars, provider, thinkingOverride);
-    // Tool sanitization proxy - applies to ALL CLIProxy providers.
-    // Sanitizes MCP tool names exceeding Gemini's 64-char limit.
-    // Proxy chain order (request flow):
-    //   Claude CLI → ToolSanitizationProxy → [CodexReasoningProxy if codex] → CLIProxy → Backend
-    // Response flow is reversed, with each proxy transforming data back.
-    let toolSanitizationProxy = null;
-    let toolSanitizationPort = null;
-    if (envVars.ANTHROPIC_BASE_URL) {
-        try {
-            toolSanitizationProxy = new tool_sanitization_proxy_1.ToolSanitizationProxy({
-                upstreamBaseUrl: envVars.ANTHROPIC_BASE_URL,
-                verbose,
-                warnOnSanitize: true,
-            });
-            toolSanitizationPort = await toolSanitizationProxy.start();
-            log(`Tool sanitization proxy active on port ${toolSanitizationPort}`);
-        }
-        catch (error) {
-            // Non-fatal: continue without sanitization
-            const err = error;
-            toolSanitizationProxy = null;
-            toolSanitizationPort = null;
-            if (verbose) {
-                console.error((0, ui_1.warn)(`Tool sanitization proxy disabled: ${err.message}`));
-            }
-        }
-    }
-    // Determine the effective upstream URL after tool sanitization
-    const postSanitizationBaseUrl = toolSanitizationPort
-        ? `http://127.0.0.1:${toolSanitizationPort}`
-        : envVars.ANTHROPIC_BASE_URL;
-    // Codex-only: inject OpenAI reasoning effort based on tier model mapping.
-    // Maps by request.model:
-    // - OPUS/default model → xhigh
-    // - SONNET model → high
-    // - HAIKU model → medium
-    // - Unknown → medium
-    let codexReasoningProxy = null;
-    let codexReasoningPort = null;
-    if (provider === 'codex') {
-        if (!postSanitizationBaseUrl) {
-            log('ANTHROPIC_BASE_URL not set for Codex, reasoning proxy disabled');
-        }
-        else {
-            try {
-                const traceEnabled = process.env.CCS_CODEX_REASONING_TRACE === '1' ||
-                    process.env.CCS_CODEX_REASONING_TRACE === 'true';
-                // For remote proxy mode or direct API key mode, strip /api/provider/codex prefix
-                // because the upstream (remote CLIProxyAPI or AnthropicToOpenAIProxy) uses root paths
-                const stripPathPrefix = (useRemoteProxy || useDirectApiKey) ? '/api/provider/codex' : undefined;
-                codexReasoningProxy = new codex_reasoning_proxy_1.CodexReasoningProxy({
-                    upstreamBaseUrl: postSanitizationBaseUrl,
-                    verbose,
-                    defaultEffort: 'medium',
-                    traceFilePath: traceEnabled ? `${os.homedir()}/.ccs/codex-reasoning-proxy.log` : '',
-                    modelMap: {
-                        defaultModel: envVars.ANTHROPIC_MODEL,
-                        opusModel: envVars.ANTHROPIC_DEFAULT_OPUS_MODEL,
-                        sonnetModel: envVars.ANTHROPIC_DEFAULT_SONNET_MODEL,
-                        haikuModel: envVars.ANTHROPIC_DEFAULT_HAIKU_MODEL,
-                    },
-                    stripPathPrefix,
-                });
-                codexReasoningPort = await codexReasoningProxy.start();
-                log(`Codex reasoning proxy active: http://127.0.0.1:${codexReasoningPort}/api/provider/codex`);
-            }
-            catch (error) {
-                const err = error;
-                codexReasoningProxy = null;
-                codexReasoningPort = null;
-                if (verbose) {
-                    console.error((0, ui_1.warn)(`Codex reasoning proxy disabled: ${err.message}`));
-                }
-            }
-        }
-    }
-    // Determine the final ANTHROPIC_BASE_URL based on active proxies
-    // Chain order: Claude CLI → [ScenarioRoutingProxy] → [CodexReasoningProxy] → [ToolSanitizationProxy] → CLIProxy/DirectEndpoint
-    // The outermost active proxy becomes the effective base URL
-    let finalBaseUrl = envVars.ANTHROPIC_BASE_URL;
-    if (toolSanitizationPort) {
-        finalBaseUrl = `http://127.0.0.1:${toolSanitizationPort}`;
-    }
-    if (codexReasoningPort) {
-        // Codex reasoning proxy is the outermost layer for codex provider
-        finalBaseUrl = `http://127.0.0.1:${codexReasoningPort}/api/provider/codex`;
-    }
-    // Scenario Routing Proxy - routes sub-agent requests to different profiles
-    // Only enabled for local proxy mode when router config is enabled
-    // Routes through ToolSanitizationProxy (or CLIProxy if not available) to preserve proxy chain
-    let scenarioRoutingProxy = null;
-    let scenarioRoutingPort = null;
-    if (!useRemoteProxy && unifiedConfig.router?.enabled && envVars.ANTHROPIC_BASE_URL) {
-        try {
-            // ScenarioRoutingProxy should route through ToolSanitizationProxy to preserve
-            // the proxy chain (tool sanitization is needed for all providers).
-            // Note: CodexReasoningProxy is codex-specific, so we skip it for routed requests
-            // (they may go to non-codex providers).
-            const routingUpstreamBase = toolSanitizationPort
-                ? `http://127.0.0.1:${toolSanitizationPort}`
-                : `http://127.0.0.1:${cfg.port}`; // Direct to CLIProxy if no sanitization
-            const { upstreams, defaultUpstream } = (0, router_1.buildScenarioUpstreams)(unifiedConfig.router, routingUpstreamBase, provider);
-            // Only create proxy if there are actually routes configured
-            if (Object.keys(upstreams).length > 0) {
-                scenarioRoutingProxy = new router_1.ScenarioRoutingProxy({
-                    routerConfig: unifiedConfig.router,
-                    defaultUpstream: defaultUpstream,
-                    upstreams,
-                    verbose,
-                });
-                scenarioRoutingPort = await scenarioRoutingProxy.start();
-                log(`Scenario routing proxy active on port ${scenarioRoutingPort}`);
-                log(`Routes: ${JSON.stringify(unifiedConfig.router.routes)}`);
-                // Update final URL to point to scenario routing proxy
-                // The path will be rewritten by ScenarioRoutingProxy based on detected scenario
-                finalBaseUrl = `http://127.0.0.1:${scenarioRoutingPort}`;
-            }
-            else {
-                log('Scenario routing enabled but no valid routes configured, skipping proxy');
-            }
-        }
-        catch (error) {
-            // Non-fatal: continue without scenario routing
-            const err = error;
-            scenarioRoutingProxy = null;
-            scenarioRoutingPort = null;
-            if (verbose) {
-                console.error((0, ui_1.warn)(`Scenario routing proxy disabled: ${err.message}`));
-            }
-        }
-    }
-    const effectiveEnvVars = {
-        ...envVars,
-        ANTHROPIC_BASE_URL: finalBaseUrl,
-    };
-    const webSearchEnv = (0, websearch_manager_1.getWebSearchHookEnv)();
-    const imageAnalysisEnv = (0, get_image_analysis_hook_env_1.getImageAnalysisHookEnv)(provider);
-    const env = {
-        ...process.env,
-        ...effectiveEnvVars,
-        ...webSearchEnv,
-        ...imageAnalysisEnv,
-        CCS_PROFILE_TYPE: 'cliproxy', // Signal to WebSearch hook this is a third-party provider
-    };
-    log(`Claude env: ANTHROPIC_BASE_URL=${effectiveEnvVars.ANTHROPIC_BASE_URL}`);
-    log(`Claude env: ANTHROPIC_MODEL=${envVars.ANTHROPIC_MODEL}`);
-    if (Object.keys(webSearchEnv).length > 0) {
-        log(`Claude env: WebSearch config=${JSON.stringify(webSearchEnv)}`);
-    }
-    // Log global env vars for visibility
-    if (envVars.DISABLE_TELEMETRY || envVars.DISABLE_ERROR_REPORTING || envVars.DISABLE_BUG_COMMAND) {
-        log(`Claude env: Global env applied (telemetry/reporting disabled)`);
-    }
-    // Filter out CCS-specific flags before passing to Claude CLI
-    // Note: Proxy flags (--proxy-host, etc.) already stripped by resolveProxyConfig()
-    const ccsFlags = [
-        '--auth',
-        '--setup',
-        '--paste-callback',
-        '--headless',
-        '--logout',
-        '--config',
-        '--add',
-        '--accounts',
-        '--use',
-        '--nickname',
-        '--thinking',
-        '--incognito',
-        '--no-incognito',
-        '--import',
-        '--settings', // Block user --settings to prevent duplicate flags
-        // Proxy flags are handled by resolveProxyConfig, but list for documentation
-        ...proxy_config_resolver_1.PROXY_CLI_FLAGS,
-    ];
-    const claudeArgs = argsWithoutProxy.filter((arg, idx) => {
-        // Filter out CCS flags
-        if (ccsFlags.includes(arg))
-            return false;
-        // Filter out --thinking=value format
-        if (arg.startsWith('--thinking='))
-            return false;
-        // Filter out value after --use, --nickname, or --thinking
-        if (argsWithoutProxy[idx - 1] === '--use' ||
-            argsWithoutProxy[idx - 1] === '--nickname' ||
-            argsWithoutProxy[idx - 1] === '--thinking')
-            return false;
-        return true;
-    });
-    const isWindows = process.platform === 'win32';
-    const needsShell = isWindows && /\.(cmd|bat|ps1)$/i.test(claudeCli);
-    // Get profile settings path for hooks (WebSearch, etc.)
-    // Use custom settings path for CLIProxy variants, otherwise use default provider path
-    const baseSettingsPath = cfg.customSettingsPath
-        ? cfg.customSettingsPath.replace(/^~/, os.homedir())
-        : (0, config_generator_1.getProviderSettingsPath)(provider);
-    // Generate session-specific settings file with dynamic ANTHROPIC_BASE_URL.
-    // Claude CLI's --settings env values override process env vars, so we must
-    // write the correct runtime URL into the settings file itself.
-    let settingsPath = baseSettingsPath;
-    try {
-        const settingsContent = fs.readFileSync(baseSettingsPath, 'utf-8');
-        const settings = JSON.parse(settingsContent);
-        if (settings.env) {
-            settings.env.ANTHROPIC_BASE_URL = effectiveEnvVars.ANTHROPIC_BASE_URL;
-            settings.env.ANTHROPIC_AUTH_TOKEN = envVars.ANTHROPIC_AUTH_TOKEN || settings.env.ANTHROPIC_AUTH_TOKEN;
-        }
-        const sessionSettingsPath = baseSettingsPath.replace(/\.json$/, '.session.json');
-        fs.writeFileSync(sessionSettingsPath, JSON.stringify(settings, null, 2) + '\n', { mode: 0o600 });
-        settingsPath = sessionSettingsPath;
-        log(`Session settings written: ${sessionSettingsPath}`);
-    }
-    catch (err) {
-        log(`Failed to create session settings, using original: ${err.message}`);
-    }
-    let claude;
-    if (needsShell) {
-        const cmdString = [claudeCli, '--settings', settingsPath, ...claudeArgs]
-            .map(shell_executor_1.escapeShellArg)
-            .join(' ');
-        claude = (0, child_process_1.spawn)(cmdString, {
-            stdio: 'inherit',
-            windowsHide: true,
-            shell: true,
-            env,
-        });
-    }
-    else {
-        claude = (0, child_process_1.spawn)(claudeCli, ['--settings', settingsPath, ...claudeArgs], {
-            stdio: 'inherit',
-            windowsHide: true,
-            env,
-        });
-    }
-    // 8. Cleanup: unregister session when Claude exits (local mode only)
-    // Proxy persists by default - use 'ccs cliproxy stop' to kill manually
-    // Capture port for cleanup (avoids closure issues)
-    const sessionPort = cfg.port;
-    claude.on('exit', (code, signal) => {
-        log(`Claude exited: code=${code}, signal=${signal}`);
-        if (scenarioRoutingProxy) {
-            scenarioRoutingProxy.stop();
-        }
-        if (codexReasoningProxy) {
-            codexReasoningProxy.stop();
-        }
-        if (toolSanitizationProxy) {
-            toolSanitizationProxy.stop();
-        }
-        if (httpsTunnel) {
-            httpsTunnel.stop();
-        }
-        if (a2oProxy) {
-            a2oProxy.stop();
-        }
-        // Unregister this session (proxy keeps running for persistence) - only for local mode
-        if (sessionId) {
-            (0, session_tracker_1.unregisterSession)(sessionId, sessionPort);
-            log(`Session ${sessionId} unregistered, proxy persists for other sessions or future use`);
-        }
-        if (signal) {
-            process.kill(process.pid, signal);
-        }
-        else {
-            process.exit(code || 0);
-        }
-    });
-    claude.on('error', (error) => {
-        console.error((0, ui_1.fail)(`Claude CLI error: ${error}`));
-        if (scenarioRoutingProxy) {
-            scenarioRoutingProxy.stop();
-        }
-        if (codexReasoningProxy) {
-            codexReasoningProxy.stop();
-        }
-        if (toolSanitizationProxy) {
-            toolSanitizationProxy.stop();
-        }
-        if (httpsTunnel) {
-            httpsTunnel.stop();
-        }
-        if (a2oProxy) {
-            a2oProxy.stop();
-        }
-        // Unregister session, proxy keeps running (local mode only)
-        if (sessionId) {
-            (0, session_tracker_1.unregisterSession)(sessionId, sessionPort);
-        }
-        process.exit(1);
-    });
-    // Handle parent process termination (SIGTERM, SIGINT)
-    const cleanup = () => {
-        log('Parent signal received, cleaning up');
-        if (scenarioRoutingProxy) {
-            scenarioRoutingProxy.stop();
-        }
-        if (codexReasoningProxy) {
-            codexReasoningProxy.stop();
-        }
-        if (toolSanitizationProxy) {
-            toolSanitizationProxy.stop();
-        }
-        if (httpsTunnel) {
-            httpsTunnel.stop();
-        }
-        if (a2oProxy) {
-            a2oProxy.stop();
-        }
-        // Unregister session, proxy keeps running (local mode only)
-        if (sessionId) {
-            (0, session_tracker_1.unregisterSession)(sessionId, sessionPort);
-        }
-        claude.kill('SIGTERM');
-    };
-    process.once('SIGTERM', cleanup);
-    process.once('SIGINT', cleanup);
-}
-exports.execClaudeWithCLIProxy = execClaudeWithCLIProxy;
-/**
- * Check if a port is available
- */
-async function isPortAvailable(port) {
-    return new Promise((resolve) => {
-        const server = net.createServer();
-        server.once('error', () => {
-            resolve(false);
-        });
-        server.once('listening', () => {
-            server.close();
-            resolve(true);
-        });
-        server.listen(port, '127.0.0.1');
-    });
-}
-exports.isPortAvailable = isPortAvailable;
-/**
- * Find an available port in range
- */
-async function findAvailablePort(startPort = config_generator_1.CLIPROXY_DEFAULT_PORT, range = 10) {
-    for (let port = startPort; port < startPort + range; port++) {
-        if (await isPortAvailable(port)) {
-            return port;
-        }
-    }
-    throw new Error(`No available port found in range ${startPort}-${startPort + range - 1}`);
-}
-exports.findAvailablePort = findAvailablePort;
-exports.default = execClaudeWithCLIProxy;
-//# sourceMappingURL=cliproxy-executor.js.map