@kaitranntt/ccs 7.76.0-dev.1 → 7.76.0-dev.3

package/dist/cliproxy/executor/index.js

@@ -34,58 +34,34 @@ var __importStar = (this && this.__importStar) || function (mod) {
     return result;
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.__testExports = exports.findAvailablePort = exports.isPortAvailable = exports.execClaudeWithCLIProxy = exports.hasGitLabTokenLoginFlag = exports.readOptionValue = void 0;
-const child_process_1 = require("child_process");
+exports.__testExports = exports._resolveRuntimeQuotaMonitorProviders = exports.filterCcsFlags = exports.CCS_FLAGS = exports.hasGitLabTokenLoginFlag = exports.readOptionValue = exports.findAvailablePort = exports.isPortAvailable = exports.execClaudeWithCLIProxy = void 0;
 const fs = __importStar(require("fs"));
-const os = __importStar(require("os"));
-const path = __importStar(require("path"));
-const progress_indicator_1 = require("../../utils/progress-indicator");
 const ui_1 = require("../../utils/ui");
-const config_manager_1 = require("../../utils/config-manager");
-const shell_executor_1 = require("../../utils/shell-executor");
-const binary_manager_1 = require("../binary-manager");
 const config_generator_1 = require("../config/config-generator");
-const remote_proxy_client_1 = require("../services/remote-proxy-client");
-const auth_handler_1 = require("../auth/auth-handler");
-const types_1 = require("../types");
 const model_config_1 = require("../config/model-config");
-const codex_plan_compatibility_1 = require("../ai-providers/codex-plan-compatibility");
-const proxy_config_resolver_1 = require("../proxy/proxy-config-resolver");
 const model_catalog_1 = require("../model-catalog");
-const codex_reasoning_proxy_1 = require("../ai-providers/codex-reasoning-proxy");
-const tool_sanitization_proxy_1 = require("../proxy/tool-sanitization-proxy");
-const account_manager_1 = require("../accounts/account-manager");
-const email_account_identity_1 = require("../accounts/email-account-identity");
 const websearch_manager_1 = require("../../utils/websearch-manager");
 const image_analysis_1 = require("../../utils/image-analysis");
-const browser_1 = require("../../utils/browser");
-const unified_config_loader_1 = require("../../config/unified-config-loader");
+const config_loader_facade_1 = require("../../config/config-loader-facade");
 const https_tunnel_proxy_1 = require("../proxy/https-tunnel-proxy");
-const auth_types_1 = require("../auth/auth-types");
 const profile_continuity_inheritance_1 = require("../../auth/profile-continuity-inheritance");
 // Import modular components
+const browser_launch_setup_1 = require("./browser-launch-setup");
+const account_resolution_1 = require("./account-resolution");
 const lifecycle_manager_1 = require("./lifecycle-manager");
 const env_resolver_1 = require("./env-resolver");
-const retry_handler_1 = require("./retry-handler");
-const quota_manager_1 = require("../quota/quota-manager");
 const session_bridge_1 = require("./session-bridge");
-const thinking_arg_parser_1 = require("./thinking-arg-parser");
-const account_safety_1 = require("../accounts/account-safety");
-const antigravity_responsibility_1 = require("../auth/antigravity-responsibility");
 const websearch_manager_2 = require("../../utils/websearch-manager");
+const auth_coordinator_1 = require("./auth-coordinator");
 const thinking_override_resolver_1 = require("./thinking-override-resolver");
 const https_tunnel_policy_1 = require("./https-tunnel-policy");
-function resolveRuntimeQuotaMonitorProviders(provider, compositeProviders) {
-    const candidates = compositeProviders.length > 0 ? compositeProviders : [provider];
-    const resolved = [];
-    for (const candidate of candidates) {
-        if (quota_manager_1.MANAGED_QUOTA_PROVIDERS.includes(candidate) &&
-            !resolved.includes(candidate)) {
-            resolved.push(candidate);
-        }
-    }
-    return resolved;
-}
+const arg_parser_1 = require("./arg-parser");
+const proxy_resolver_1 = require("./proxy-resolver");
+const proxy_chain_builder_1 = require("./proxy-chain-builder");
+const model_warnings_1 = require("./model-warnings");
+const claude_launcher_1 = require("./claude-launcher");
+/** Local alias so internal call sites need no change */
+const resolveRuntimeQuotaMonitorProviders = account_resolution_1.resolveRuntimeQuotaMonitorProviders;
 /** Default executor configuration */
 const DEFAULT_CONFIG = {
     port: config_generator_1.CLIPROXY_DEFAULT_PORT,
@@ -93,35 +69,9 @@ const DEFAULT_CONFIG = {
     verbose: false,
     pollInterval: 100,
 };
-function readOptionValue(args, flag) {
-    const inlinePrefix = `${flag}=`;
-    const inlineArg = args.find((arg) => arg.startsWith(inlinePrefix));
-    if (inlineArg !== undefined) {
-        const value = inlineArg.slice(inlinePrefix.length).trim();
-        return {
-            present: true,
-            value: value.length > 0 ? value : undefined,
-            missingValue: value.length === 0,
-        };
-    }
-    const index = args.indexOf(flag);
-    if (index === -1) {
-        return { present: false, missingValue: false };
-    }
-    const next = args[index + 1];
-    if (!next || next.startsWith('-')) {
-        return { present: true, missingValue: true };
-    }
-    return { present: true, value: next.trim(), missingValue: false };
-}
-exports.readOptionValue = readOptionValue;
-function hasGitLabTokenLoginFlag(args) {
-    return args.includes('--gitlab-token-login') || args.includes('--token-login');
-}
-exports.hasGitLabTokenLoginFlag = hasGitLabTokenLoginFlag;
-function getGitLabTokenLoginFlagName(args) {
-    return args.includes('--gitlab-token-login') ? '--gitlab-token-login' : '--token-login';
-}
+// readOptionValue, hasGitLabTokenLoginFlag, CCS_FLAGS, filterCcsFlags are
+// re-exported from ./arg-parser via the export block at the bottom of this file
+// for backwards compatibility with external callers.
 /**
  * Execute Claude CLI with CLIProxy (main entry point)
  *
@@ -151,405 +101,48 @@ async function execClaudeWithCLIProxy(claudeCli, provider, args, config = {}) {
         ? [...new Set(Object.values(cfg.compositeTiers).map((t) => t.provider))]
         : [];
     // 0. Resolve proxy configuration (CLI > ENV > config.yaml > defaults)
-    const unifiedConfig = (0, unified_config_loader_1.loadOrCreateUnifiedConfig)();
+    const unifiedConfig = (0, config_loader_facade_1.loadOrCreateUnifiedConfig)();
     // Collect all providers to validate (default + composite tiers)
     const allProviders = [provider, ...compositeProviders];
-    const cliproxyServerConfig = unifiedConfig.cliproxy_server;
-    const { config: proxyConfig, remainingArgs: argsWithoutProxy } = (0, proxy_config_resolver_1.resolveProxyConfig)(args, {
-        remote: cliproxyServerConfig?.remote
-            ? {
-                enabled: cliproxyServerConfig.remote.enabled,
-                host: cliproxyServerConfig.remote.host,
-                port: cliproxyServerConfig.remote.port,
-                protocol: cliproxyServerConfig.remote.protocol,
-                auth_token: cliproxyServerConfig.remote.auth_token,
-                management_key: cliproxyServerConfig.remote.management_key,
-                timeout: cliproxyServerConfig.remote.timeout,
-            }
-            : undefined,
-        local: cliproxyServerConfig?.local
-            ? {
-                port: cliproxyServerConfig.local.port,
-                auto_start: cliproxyServerConfig.local.auto_start,
-            }
-            : undefined,
+    const { proxyConfig, useRemoteProxy, localBackend, binaryPath, argsWithoutProxy } = await (0, proxy_resolver_1.resolveExecutorProxy)(args, {
+        unifiedConfig,
+        allProviders,
+        verbose,
+        cfg,
+        log,
     });
-    let browserLaunchOverride;
-    let argsWithoutBrowserFlags = argsWithoutProxy;
-    try {
-        const browserLaunchFlags = (0, browser_1.resolveBrowserLaunchFlagResolution)(argsWithoutProxy);
-        browserLaunchOverride = browserLaunchFlags.override;
-        argsWithoutBrowserFlags = browserLaunchFlags.argsWithoutFlags;
-    }
-    catch (error) {
-        console.error((0, ui_1.fail)(error.message));
-        process.exit(1);
-        return;
-    }
-    const browserConfig = (0, unified_config_loader_1.getBrowserConfig)();
-    const browserAttachConfig = (0, browser_1.getEffectiveClaudeBrowserAttachConfig)(browserConfig);
-    const claudeBrowserExposure = (0, browser_1.resolveBrowserExposure)({
-        enabled: browserAttachConfig.enabled,
-        policy: browserConfig.claude.policy,
-    }, browserLaunchOverride);
-    const blockedBrowserOverrideWarning = (0, browser_1.getBlockedBrowserOverrideWarning)('Claude Browser Attach', claudeBrowserExposure);
-    if (blockedBrowserOverrideWarning) {
-        console.error((0, ui_1.warn)(blockedBrowserOverrideWarning));
-    }
-    // Port resolution and validation
-    if (cfg.port && cfg.port !== config_generator_1.CLIPROXY_DEFAULT_PORT) {
-        if (proxyConfig.port !== config_generator_1.CLIPROXY_DEFAULT_PORT) {
-            cfg.port = proxyConfig.port;
-        }
-    }
-    else if (proxyConfig.port !== config_generator_1.CLIPROXY_DEFAULT_PORT) {
-        cfg.port = proxyConfig.port;
-    }
-    cfg.port = (0, config_generator_1.validatePort)(cfg.port);
-    log(`Proxy mode: ${proxyConfig.mode}`);
-    if (proxyConfig.mode === 'remote') {
-        log(`Remote host: ${proxyConfig.host}:${proxyConfig.port} (${proxyConfig.protocol})`);
-    }
+    const { browserLaunchOverride, argsWithoutBrowserFlags } = (0, browser_launch_setup_1.resolveBrowserLaunchFlags)(argsWithoutProxy);
     // Setup first-class CCS WebSearch runtime
     (0, websearch_manager_1.ensureWebSearchMcpOrThrow)();
     const imageAnalysisMcpReady = (0, image_analysis_1.ensureImageAnalysisMcpOrThrow)();
-    const browserAttachRuntime = browserAttachConfig.enabled && claudeBrowserExposure.exposeForLaunch
-        ? await (0, browser_1.resolveOptionalBrowserAttachRuntime)(browserAttachConfig)
-        : undefined;
-    const browserRuntimeEnv = browserAttachRuntime?.runtimeEnv;
-    if (browserAttachRuntime?.warning) {
-        process.stderr.write(`${(0, ui_1.warn)(browserAttachRuntime.warning)}\n`);
-    }
-    if (browserRuntimeEnv) {
-        (0, browser_1.ensureBrowserMcpOrThrow)();
-    }
     (0, websearch_manager_1.displayWebSearchStatus)();
     const providerConfig = (0, config_generator_1.getProviderConfig)(provider);
     log(`Provider: ${providerConfig.displayName}`);
-    (0, account_safety_1.warnOAuthBanRisk)(provider);
-    // Check remote proxy if configured
-    let useRemoteProxy = false;
-    let localBackend = 'original';
-    if (proxyConfig.mode === 'remote' && proxyConfig.host) {
-        const status = await (0, remote_proxy_client_1.checkRemoteProxy)({
-            host: proxyConfig.host,
-            port: proxyConfig.port,
-            protocol: proxyConfig.protocol,
-            authToken: proxyConfig.authToken,
-            timeout: proxyConfig.timeout ?? 2000,
-            allowSelfSigned: proxyConfig.allowSelfSigned ?? false,
-        });
-        if (status.reachable) {
-            useRemoteProxy = true;
-            console.log((0, ui_1.ok)(`Connected to remote proxy at ${proxyConfig.host}:${proxyConfig.port} (${status.latencyMs}ms)`));
-        }
-        else {
-            console.error((0, ui_1.warn)(`Remote proxy unreachable: ${status.error}`));
-            if (proxyConfig.remoteOnly) {
-                throw new Error('Remote proxy unreachable and --remote-only specified');
-            }
-            if (proxyConfig.fallbackEnabled) {
-                if (proxyConfig.autoStartLocal) {
-                    console.log((0, ui_1.info)('Falling back to local proxy...'));
-                }
-                else {
-                    if (process.stdin.isTTY) {
-                        const readline = await Promise.resolve().then(() => __importStar(require('readline')));
-                        const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-                        const answer = await new Promise((resolve) => {
-                            rl.question('Start local proxy instead? [Y/n] ', resolve);
-                        });
-                        rl.close();
-                        if (answer.toLowerCase() === 'n') {
-                            throw new Error('Remote proxy unreachable and user declined fallback');
-                        }
-                    }
-                    console.log((0, ui_1.info)('Starting local proxy...'));
-                }
-            }
-            else {
-                throw new Error('Remote proxy unreachable and fallback disabled');
-            }
-        }
-    }
-    if (!useRemoteProxy) {
-        localBackend = (0, binary_manager_1.getConfiguredBackend)({ notifyOnPlus: true });
-        for (const p of allProviders) {
-            if (localBackend === 'original' && types_1.PLUS_ONLY_PROVIDERS.includes(p)) {
-                console.error('');
-                console.error((0, ui_1.fail)((0, binary_manager_1.getPlusBackendUnavailableMessage)(p)));
-                console.error('');
-                throw new Error(`Provider ${p} requires local CLIProxy Plus backend`);
-            }
-        }
-    }
     // Variables for local proxy mode
-    let binaryPath;
     let sessionId;
-    // 1. Ensure binary exists (downloads if needed) - SKIP for remote mode
-    if (!useRemoteProxy) {
-        const spinner = new progress_indicator_1.ProgressIndicator('Preparing CLIProxy');
-        spinner.start();
-        try {
-            binaryPath = await (0, binary_manager_1.ensureCLIProxyBinary)(verbose, { skipAutoUpdate: true });
-            spinner.succeed('CLIProxy binary ready');
-        }
-        catch (error) {
-            spinner.fail('Failed to prepare CLIProxy');
-            const err = error;
-            if ((0, retry_handler_1.isNetworkError)(err)) {
-                (0, retry_handler_1.handleNetworkError)(err);
-            }
-            throw error;
-        }
-    }
-    // 2. Handle special flags (simplified flag parsing - full implementation continues below)
-    const forceAuth = argsWithoutProxy.includes('--auth');
-    const pasteCallback = argsWithoutProxy.includes('--paste-callback');
-    const portForward = argsWithoutProxy.includes('--port-forward');
-    const forceHeadless = argsWithoutProxy.includes('--headless');
-    if (pasteCallback && portForward) {
-        console.error((0, ui_1.fail)('Cannot use --paste-callback with --port-forward'));
-        console.error('    --paste-callback: Manually paste OAuth redirect URL');
-        console.error('    --port-forward: Use SSH port forwarding for callback');
-        process.exit(1);
-    }
-    const forceLogout = argsWithoutProxy.includes('--logout');
-    const forceConfig = argsWithoutProxy.includes('--config');
-    const addAccount = argsWithoutProxy.includes('--add');
-    const showAccounts = argsWithoutProxy.includes('--accounts');
-    const forceImport = argsWithoutProxy.includes('--import');
-    const gitlabTokenLogin = hasGitLabTokenLoginFlag(argsWithoutProxy);
-    const acceptAgyRisk = (0, antigravity_responsibility_1.hasAntigravityRiskAcceptanceFlag)(argsWithoutProxy);
-    const incognitoFlag = argsWithoutProxy.includes('--incognito');
-    const noIncognitoFlag = argsWithoutProxy.includes('--no-incognito');
-    const kiroNoIncognitoConfig = provider === 'kiro' ? (unifiedConfig.cliproxy?.kiro_no_incognito ?? true) : false;
-    const noIncognito = incognitoFlag ? false : noIncognitoFlag || kiroNoIncognitoConfig;
-    // Parse --use flag
-    let useAccount;
-    const useIdx = argsWithoutProxy.indexOf('--use');
-    if (useIdx !== -1 &&
-        argsWithoutProxy[useIdx + 1] &&
-        !argsWithoutProxy[useIdx + 1].startsWith('-')) {
-        useAccount = argsWithoutProxy[useIdx + 1];
-    }
-    // Parse --nickname flag
-    let setNickname;
-    const nicknameIdx = argsWithoutProxy.indexOf('--nickname');
-    if (nicknameIdx !== -1 &&
-        argsWithoutProxy[nicknameIdx + 1] &&
-        !argsWithoutProxy[nicknameIdx + 1].startsWith('-')) {
-        setNickname = argsWithoutProxy[nicknameIdx + 1];
-    }
-    // Parse --kiro-auth-method flag
-    let kiroAuthMethod;
-    const kiroMethodValue = readOptionValue(argsWithoutProxy, '--kiro-auth-method');
-    if (kiroMethodValue.present) {
-        const rawMethod = kiroMethodValue.value;
-        if (kiroMethodValue.missingValue || !rawMethod) {
-            console.error((0, ui_1.fail)('--kiro-auth-method requires a value'));
-            console.error('    Supported values: aws, aws-authcode, google, github, idc');
-            process.exitCode = 1;
-            return;
-        }
-        const normalized = rawMethod.trim().toLowerCase();
-        if (!(0, auth_types_1.isKiroAuthMethod)(normalized)) {
-            console.error((0, ui_1.fail)(`Invalid --kiro-auth-method value: ${rawMethod}`));
-            console.error('    Supported values: aws, aws-authcode, google, github, idc');
-            process.exitCode = 1;
-            return;
-        }
-        kiroAuthMethod = (0, auth_types_1.normalizeKiroAuthMethod)(normalized);
-    }
-    let kiroIDCStartUrl;
-    const kiroIDCStartUrlValue = readOptionValue(argsWithoutProxy, '--kiro-idc-start-url');
-    if (kiroIDCStartUrlValue.present && kiroIDCStartUrlValue.value) {
-        kiroIDCStartUrl = kiroIDCStartUrlValue.value;
-    }
-    else if (kiroIDCStartUrlValue.present) {
-        console.error((0, ui_1.fail)('--kiro-idc-start-url requires a value'));
-        process.exitCode = 1;
-        return;
-    }
-    let kiroIDCRegion;
-    const kiroIDCRegionValue = readOptionValue(argsWithoutProxy, '--kiro-idc-region');
-    if (kiroIDCRegionValue.present && kiroIDCRegionValue.value) {
-        kiroIDCRegion = kiroIDCRegionValue.value;
-    }
-    else if (kiroIDCRegionValue.present) {
-        console.error((0, ui_1.fail)('--kiro-idc-region requires a value'));
-        process.exitCode = 1;
-        return;
-    }
-    let kiroIDCFlow;
-    const kiroIDCFlowValue = readOptionValue(argsWithoutProxy, '--kiro-idc-flow');
-    if (kiroIDCFlowValue.present) {
-        const rawFlow = kiroIDCFlowValue.value;
-        if (kiroIDCFlowValue.missingValue || !rawFlow) {
-            console.error((0, ui_1.fail)('--kiro-idc-flow requires a value'));
-            console.error('    Supported values: authcode, device');
-            process.exitCode = 1;
-            return;
-        }
-        const normalized = rawFlow.trim().toLowerCase();
-        if (!(0, auth_types_1.isKiroIDCFlow)(normalized)) {
-            console.error((0, ui_1.fail)(`Invalid --kiro-idc-flow value: ${rawFlow}`));
-            console.error('    Supported values: authcode, device');
-            process.exitCode = 1;
-            return;
-        }
-        kiroIDCFlow = (0, auth_types_1.normalizeKiroIDCFlow)(normalized);
-    }
-    let gitlabBaseUrl;
-    const gitlabBaseUrlValue = readOptionValue(argsWithoutProxy, '--gitlab-url');
-    if (gitlabBaseUrlValue.present && gitlabBaseUrlValue.value) {
-        gitlabBaseUrl = gitlabBaseUrlValue.value.trim();
-    }
-    else if (gitlabBaseUrlValue.present) {
-        console.error((0, ui_1.fail)('--gitlab-url requires a value'));
-        process.exitCode = 1;
-        return;
-    }
-    if (kiroAuthMethod && provider !== 'kiro' && !compositeProviders.includes('kiro')) {
-        console.error((0, ui_1.fail)('--kiro-auth-method is only valid for ccs kiro'));
-        process.exitCode = 1;
-        return;
-    }
-    if ((kiroIDCStartUrl || kiroIDCRegion || kiroIDCFlow) &&
-        provider !== 'kiro' &&
-        !compositeProviders.includes('kiro')) {
-        console.error((0, ui_1.fail)('--kiro-idc-start-url, --kiro-idc-region, and --kiro-idc-flow are only valid for ccs kiro'));
-        process.exitCode = 1;
-        return;
-    }
-    if (!kiroAuthMethod && (kiroIDCStartUrl || kiroIDCRegion || kiroIDCFlow)) {
-        kiroAuthMethod = 'idc';
-    }
-    if (kiroAuthMethod === 'idc' && !kiroIDCStartUrl) {
-        console.error((0, ui_1.fail)('Kiro IDC login requires --kiro-idc-start-url'));
-        console.error('    Example: ccs kiro --auth --kiro-auth-method idc --kiro-idc-start-url https://d-xxx.awsapps.com/start');
-        process.exitCode = 1;
-        return;
-    }
-    if (kiroAuthMethod &&
-        kiroAuthMethod !== 'idc' &&
-        (kiroIDCStartUrl || kiroIDCRegion || kiroIDCFlow)) {
-        console.error((0, ui_1.fail)('--kiro-idc-start-url, --kiro-idc-region, and --kiro-idc-flow require --kiro-auth-method idc'));
-        process.exitCode = 1;
+    // 2. Parse all CCS executor flags (extracted to arg-parser.ts)
+    const parsedFlags = (0, arg_parser_1.parseExecutorFlags)(argsWithoutProxy, {
+        provider,
+        compositeProviders,
+        unifiedConfig,
+    });
+    if (process.exitCode === 1)
         return;
-    }
-    if ((gitlabTokenLogin || gitlabBaseUrl) && provider !== 'gitlab') {
-        const flagName = gitlabTokenLogin
-            ? getGitLabTokenLoginFlagName(argsWithoutProxy)
-            : '--gitlab-url';
-        console.error((0, ui_1.fail)(`${flagName} is only valid for ccs gitlab`));
-        process.exitCode = 1;
+    // Validate cross-flag combinations (exits with code 1 on violation)
+    (0, arg_parser_1.validateFlagCombinations)(parsedFlags, { provider, compositeProviders }, argsWithoutProxy);
+    if (process.exitCode === 1)
         return;
-    }
-    // Parse --thinking / --effort flags (aliases; first occurrence wins)
-    const thinkingParse = (0, thinking_arg_parser_1.parseThinkingOverride)(argsWithoutProxy);
-    if (thinkingParse.error) {
-        const { flag } = thinkingParse.error;
-        console.error((0, ui_1.fail)(`${flag} requires a value`));
-        if (provider === 'codex') {
-            console.error('    Codex examples: --effort xhigh, --effort high, --effort medium');
-            console.error('    Alias: --thinking xhigh (same behavior)');
-        }
-        else {
-            console.error('    Examples: --thinking low, --thinking 8192, --thinking off');
-            console.error('    Levels: minimal, low, medium, high, xhigh, max, auto');
-        }
-        process.exit(1);
-    }
+    const { forceConfig, addAccount, showAccounts, useAccount, setNickname, extendedContextOverride, thinkingParse, } = parsedFlags;
     const { thinkingOverride, thinkingSource } = (0, thinking_override_resolver_1.resolveRuntimeThinkingOverride)(thinkingParse.value, process.env.CCS_THINKING);
-    const thinkingCfg = (0, unified_config_loader_1.getThinkingConfig)();
+    const thinkingCfg = (0, config_loader_facade_1.getThinkingConfig)();
     if (thinkingParse.duplicateDisplays.length > 0) {
         console.warn(`[!] Multiple reasoning flags detected. Using first occurrence: ${thinkingParse.sourceDisplay}`);
     }
     if (thinkingParse.sourceFlag === '--effort' && provider !== 'codex') {
         console.warn((0, ui_1.warn)('`--effort` is primarily for codex. Continuing as alias of `--thinking` for compatibility.'));
     }
-    // Parse --1m / --no-1m flags for extended context (1M token window)
-    let extendedContextOverride;
-    const has1mFlag = argsWithoutProxy.includes('--1m') || argsWithoutProxy.some((arg) => arg.startsWith('--1m='));
-    const hasNo1mFlag = argsWithoutProxy.includes('--no-1m') ||
-        argsWithoutProxy.some((arg) => arg.startsWith('--no-1m='));
-    if (has1mFlag && hasNo1mFlag) {
-        console.error((0, ui_1.fail)('Cannot use both --1m and --no-1m flags'));
-        process.exit(1);
-    }
-    else if (has1mFlag) {
-        extendedContextOverride = true;
-    }
-    else if (hasNo1mFlag) {
-        extendedContextOverride = false;
-    }
-    // undefined = auto behavior (Gemini: on, others: off)
-    // Handle --accounts
-    if (showAccounts) {
-        const accounts = (0, account_manager_1.getProviderAccounts)(provider);
-        if (accounts.length === 0) {
-            console.log((0, ui_1.info)(`No accounts registered for ${providerConfig.displayName}`));
-            console.log(`    Run "ccs ${provider} --auth" to add an account`);
-        }
-        else {
-            console.log(`\n${providerConfig.displayName} Accounts:\n`);
-            for (const acct of accounts) {
-                const defaultMark = acct.isDefault ? ' (default)' : '';
-                const nickname = acct.nickname ? `[${acct.nickname}]` : '';
-                console.log(`  ${nickname.padEnd(12)} ${(0, email_account_identity_1.formatAccountDisplayName)(acct)}${defaultMark}`);
-            }
-            console.log(`\n  Use "ccs ${provider} --use <nickname-or-id>" to switch accounts`);
-        }
-        process.exit(0);
-    }
-    // Handle --use
-    if (useAccount) {
-        const account = (0, account_manager_1.findAccountByQuery)(provider, useAccount);
-        if (!account) {
-            console.error((0, ui_1.fail)(`Account not found: "${useAccount}"`));
-            const accounts = (0, account_manager_1.getProviderAccounts)(provider);
-            if (accounts.length > 0) {
-                console.error(`    Available accounts:`);
-                for (const acct of accounts) {
-                    const displayName = (0, email_account_identity_1.formatAccountDisplayName)(acct);
-                    const label = acct.nickname ? `${acct.nickname} (${displayName})` : displayName;
-                    console.error(`      - ${label}`);
-                }
-            }
-            process.exit(1);
-        }
-        (0, account_manager_1.setDefaultAccount)(provider, account.id);
-        (0, account_manager_1.touchAccount)(provider, account.id);
-        const switchedLabel = account.nickname
-            ? `${account.nickname} (${(0, email_account_identity_1.formatAccountDisplayName)(account)})`
-            : (0, email_account_identity_1.formatAccountDisplayName)(account);
-        console.log((0, ui_1.ok)(`Switched to account: ${switchedLabel}`));
-    }
-    // Handle --nickname (rename account)
-    if (setNickname && !addAccount) {
-        const defaultAccount = (0, account_manager_1.getDefaultAccount)(provider);
-        if (!defaultAccount) {
-            console.error((0, ui_1.fail)(`No account found for ${providerConfig.displayName}`));
-            console.error(`    Run "ccs ${provider} --auth" to add an account first`);
-            process.exit(1);
-        }
-        try {
-            const success = (0, account_manager_1.renameAccount)(provider, defaultAccount.id, setNickname);
-            if (success) {
-                console.log((0, ui_1.ok)(`Renamed account to: ${setNickname}`));
-            }
-            else {
-                console.error((0, ui_1.fail)('Failed to rename account'));
-                process.exit(1);
-            }
-        }
-        catch (err) {
-            console.error((0, ui_1.fail)(err instanceof Error ? err.message : 'Failed to rename account'));
-            process.exit(1);
-        }
-        process.exit(0);
-    }
+    // Handle --accounts / --use / --nickname (warnOAuthBanRisk emitted inside)
+    await (0, account_resolution_1.resolveAccounts)({ provider, showAccounts, useAccount, setNickname, addAccount });
     // Handle --config
     if (forceConfig && (0, model_catalog_1.supportsModelConfig)(provider)) {
         // Block --config for composite variants (per-tier models in config.yaml)
@@ -564,264 +157,49 @@ async function execClaudeWithCLIProxy(claudeCli, provider, args, config = {}) {
             process.exit(0);
         }
     }
-    // Handle --logout
-    if (forceLogout) {
-        const { clearAuth } = await Promise.resolve().then(() => __importStar(require('../auth/auth-handler')));
-        if (clearAuth(provider)) {
-            console.log((0, ui_1.ok)(`Logged out from ${providerConfig.displayName}`));
-        }
-        else {
-            console.log((0, ui_1.info)(`No authentication found for ${providerConfig.displayName}`));
-        }
-        process.exit(0);
-    }
-    // Handle --import (Kiro only)
-    if (forceImport) {
-        if (provider !== 'kiro') {
-            console.error((0, ui_1.fail)('--import is only available for Kiro'));
-            console.error(`    Run "ccs ${provider} --auth" to authenticate`);
-            process.exit(1);
-        }
-        if (forceAuth) {
-            console.error((0, ui_1.fail)('Cannot use --import with --auth'));
-            console.error('    --import: Import existing token from Kiro IDE');
-            console.error('    --auth: Trigger new OAuth flow in browser');
-            process.exit(1);
-        }
-        if (forceLogout) {
-            console.error((0, ui_1.fail)('Cannot use --import with --logout'));
-            process.exit(1);
-        }
-        const { triggerOAuth } = await Promise.resolve().then(() => __importStar(require('../auth/auth-handler')));
-        const authSuccess = await triggerOAuth(provider, {
-            verbose,
-            import: true,
-            ...(kiroAuthMethod ? { kiroMethod: kiroAuthMethod } : {}),
-            ...(kiroIDCStartUrl ? { kiroIDCStartUrl } : {}),
-            ...(kiroIDCRegion ? { kiroIDCRegion } : {}),
-            ...(kiroIDCFlow ? { kiroIDCFlow } : {}),
-            ...(setNickname ? { nickname: setNickname } : {}),
-        });
-        if (!authSuccess) {
-            console.error((0, ui_1.fail)('Failed to import Kiro token from IDE'));
-            console.error('    Make sure you are logged into Kiro IDE first');
-            process.exit(1);
-        }
-        process.exit(0);
-    }
+    // Build auth coordination context (used for logout/import/antigravity/oauth)
+    const authCtx = {
+        provider,
+        compositeProviders,
+        parsedFlags,
+        cfg,
+        unifiedConfig,
+        verbose,
+        log,
+    };
+    // Handle --logout (early exit)
+    await (0, auth_coordinator_1.handleLogout)(authCtx);
+    // Handle --import (early exit, Kiro only)
+    await (0, auth_coordinator_1.handleImport)(authCtx);
     // 3. Ensure OAuth completed (if provider requires it)
     const remoteAuthToken = proxyConfig.authToken?.trim();
-    const skipLocalAuth = useRemoteProxy && !!remoteAuthToken;
+    const skipLocalAuth = (0, auth_coordinator_1.resolveSkipLocalAuth)(remoteAuthToken, useRemoteProxy);
     if (skipLocalAuth) {
         log(`Using remote proxy authentication (skipping local OAuth)`);
     }
-    if (provider === 'agy' && forceAuth && skipLocalAuth) {
-        const acknowledged = await (0, antigravity_responsibility_1.ensureCliAntigravityResponsibility)({
-            context: 'oauth',
-            acceptedByFlag: acceptAgyRisk,
-        });
-        if (!acknowledged) {
-            throw new Error(`Antigravity auth blocked. Re-run after completing confirmation or pass ${antigravity_responsibility_1.ANTIGRAVITY_ACCEPT_RISK_FLAGS[0]}.`);
-        }
-        console.error((0, ui_1.info)('Remote proxy mode is active; local OAuth flow is skipped in --auth mode.'));
+    // Antigravity gate (runs before OAuth check)
+    const { earlyReturn: agyEarlyReturn } = await (0, auth_coordinator_1.runAntigravityGate)(authCtx, skipLocalAuth);
+    if (agyEarlyReturn)
         return;
-    }
-    if (provider === 'agy' && !forceAuth) {
-        const requiresAuthNow = providerConfig.requiresOAuth && !(0, auth_handler_1.isAuthenticated)(provider);
-        if (skipLocalAuth || !requiresAuthNow) {
-            const acknowledged = await (0, antigravity_responsibility_1.ensureCliAntigravityResponsibility)({
-                context: 'run',
-                acceptedByFlag: acceptAgyRisk,
-            });
-            if (!acknowledged) {
-                console.error((0, ui_1.fail)(`Antigravity session blocked. Re-run after completing confirmation or pass ${antigravity_responsibility_1.ANTIGRAVITY_ACCEPT_RISK_FLAGS[0]}.`));
-                process.exit(1);
-            }
-        }
-    }
     if (providerConfig.requiresOAuth && !skipLocalAuth) {
-        log(`Checking authentication for ${provider}`);
-        // Multi-provider auth check for composite variants
-        if (compositeProviders.length > 0) {
-            // Handle forceAuth for composite providers
-            if (forceAuth) {
-                const { triggerOAuth } = await Promise.resolve().then(() => __importStar(require('../auth/auth-handler')));
-                const failures = [];
-                for (const p of compositeProviders) {
-                    const authSuccess = await triggerOAuth(p, {
-                        verbose,
-                        add: addAccount,
-                        ...(acceptAgyRisk ? { acceptAgyRisk: true } : {}),
-                        ...(kiroAuthMethod && p === 'kiro' ? { kiroMethod: kiroAuthMethod } : {}),
-                        ...(kiroIDCStartUrl && p === 'kiro' ? { kiroIDCStartUrl } : {}),
-                        ...(kiroIDCRegion && p === 'kiro' ? { kiroIDCRegion } : {}),
-                        ...(kiroIDCFlow && p === 'kiro' ? { kiroIDCFlow } : {}),
-                        ...(gitlabTokenLogin && p === 'gitlab' ? { gitlabAuthMode: 'pat' } : {}),
-                        ...(gitlabBaseUrl && p === 'gitlab' ? { gitlabBaseUrl } : {}),
-                        ...(forceHeadless ? { headless: true } : {}),
-                        ...(setNickname ? { nickname: setNickname } : {}),
-                        ...(noIncognito ? { noIncognito: true } : {}),
-                        ...(pasteCallback ? { pasteCallback: true } : {}),
-                        ...(portForward ? { portForward: true } : {}),
-                    });
-                    if (!authSuccess) {
-                        failures.push(p);
-                    }
-                }
-                if (failures.length > 0) {
-                    const succeeded = compositeProviders.filter((p) => !failures.includes(p));
-                    console.error((0, ui_1.fail)(`Auth failed for: ${failures.join(', ')}`));
-                    if (succeeded.length > 0) {
-                        console.error((0, ui_1.info)(`Succeeded: ${succeeded.join(', ')}`));
-                    }
-                    process.exit(1);
-                }
-                process.exit(0);
-            }
-            // Check for unauthenticated providers
-            const unauthenticatedProviders = [];
-            for (const p of compositeProviders) {
-                if (!(0, auth_handler_1.isAuthenticated)(p)) {
-                    unauthenticatedProviders.push(p);
-                }
-            }
-            if (unauthenticatedProviders.length > 0) {
-                console.error((0, ui_1.fail)('Composite variant requires authentication for multiple providers:'));
-                for (const p of unauthenticatedProviders) {
-                    console.error(`    - ${p} (run "ccs ${p} --auth")`);
-                }
-                process.exit(1);
-            }
-        }
-        else if (forceAuth || !(0, auth_handler_1.isAuthenticated)(provider)) {
-            const { triggerOAuth } = await Promise.resolve().then(() => __importStar(require('../auth/auth-handler')));
-            const authSuccess = await triggerOAuth(provider, {
-                verbose,
-                add: addAccount,
-                ...(acceptAgyRisk ? { acceptAgyRisk: true } : {}),
-                ...(kiroAuthMethod ? { kiroMethod: kiroAuthMethod } : {}),
-                ...(kiroIDCStartUrl ? { kiroIDCStartUrl } : {}),
-                ...(kiroIDCRegion ? { kiroIDCRegion } : {}),
-                ...(kiroIDCFlow ? { kiroIDCFlow } : {}),
-                ...(gitlabTokenLogin ? { gitlabAuthMode: 'pat' } : {}),
-                ...(gitlabBaseUrl ? { gitlabBaseUrl } : {}),
-                ...(forceHeadless ? { headless: true } : {}),
-                ...(setNickname ? { nickname: setNickname } : {}),
-                ...(noIncognito ? { noIncognito: true } : {}),
-                ...(pasteCallback ? { pasteCallback: true } : {}),
-                ...(portForward ? { portForward: true } : {}),
-            });
-            if (!authSuccess) {
-                throw new Error(`Authentication required for ${providerConfig.displayName}`);
-            }
-            if (forceAuth) {
-                process.exit(0);
-            }
-        }
-        else {
-            log(`${provider} already authenticated`);
-        }
-        // 3a. Proactive token refresh (multi-provider for composite)
-        if (compositeProviders.length > 0) {
-            for (const p of compositeProviders) {
-                await (0, retry_handler_1.handleTokenExpiration)(p, verbose);
-            }
-        }
-        else {
-            await (0, retry_handler_1.handleTokenExpiration)(provider, verbose);
-        }
-        // 3a-1. Update lastUsedAt
-        const usedAccount = (0, account_manager_1.getDefaultAccount)(provider);
-        if (usedAccount) {
-            (0, account_manager_1.touchAccount)(provider, usedAccount.id);
-        }
+        await (0, auth_coordinator_1.ensureProviderAuthentication)(authCtx);
     }
     // 3b. Preflight quota check (providers with quota-based rotation)
     if (!skipLocalAuth) {
-        // Multi-tier quota check for composite variants (check if any tier uses a managed provider)
-        if (compositeProviders.length > 0) {
-            for (const managedProvider of quota_manager_1.MANAGED_QUOTA_PROVIDERS) {
-                if (compositeProviders.includes(managedProvider)) {
-                    await (0, retry_handler_1.handleQuotaCheck)(managedProvider);
-                }
-            }
-        }
-        else {
-            await (0, retry_handler_1.handleQuotaCheck)(provider);
-        }
+        await (0, auth_coordinator_1.runPreflightQuotaCheck)(provider, compositeProviders);
     }
     // 3c. Account safety: enforce cross-provider isolation
     if (!skipLocalAuth) {
-        (0, account_safety_1.cleanupStaleAutoPauses)();
-        const isolated = (0, account_safety_1.enforceProviderIsolation)(provider);
-        if (isolated === 0) {
-            // No enforcement — still warn about duplicates for awareness
-            (0, account_safety_1.warnCrossProviderDuplicates)(provider);
-        }
-        else {
-            // 'exit' handlers must be synchronous — restoreAutoPausedAccounts uses sync fs APIs
-            process.on('exit', () => {
-                (0, account_safety_1.restoreAutoPausedAccounts)(provider);
-            });
-        }
+        (0, auth_coordinator_1.runAccountSafetyGuards)(provider, compositeProviders);
     }
-    // 4. First-run model configuration
-    if (!cfg.isComposite && (0, model_catalog_1.supportsModelConfig)(provider) && !skipLocalAuth) {
-        await (0, model_config_1.configureProviderModel)(provider, false, cfg.customSettingsPath);
+    // 4. First-run model configuration + codex plan reconcile
+    if (!skipLocalAuth) {
+        await (0, auth_coordinator_1.ensureModelConfiguration)(provider, cfg, verbose);
     }
     // 5. Check for broken models (multi-tier for composite)
-    if (compositeProviders.length > 0 && cfg.compositeTiers) {
-        // Check all tier models in composite variant
-        const tiers = ['opus', 'sonnet', 'haiku'];
-        for (const tier of tiers) {
-            const tierConfig = cfg.compositeTiers[tier];
-            if (tierConfig && (0, model_catalog_1.isModelBroken)(tierConfig.provider, tierConfig.model)) {
-                const modelEntry = (0, model_catalog_1.findModel)(tierConfig.provider, tierConfig.model);
-                const issueUrl = (0, model_catalog_1.getModelIssueUrl)(tierConfig.provider, tierConfig.model);
-                console.error('');
-                console.error((0, ui_1.warn)(`${tier} tier: ${modelEntry?.name || tierConfig.model} has known issues with Claude Code`));
-                console.error('    Tool calls will fail. Consider changing the model in config.yaml.');
-                if (issueUrl) {
-                    console.error(`    Tracking: ${issueUrl}`);
-                }
-                console.error('');
-            }
-        }
-    }
-    else {
-        const currentModel = (0, model_config_1.getCurrentModel)(provider, cfg.customSettingsPath);
-        if (currentModel && (0, model_catalog_1.isModelBroken)(provider, currentModel)) {
-            const modelEntry = (0, model_catalog_1.findModel)(provider, currentModel);
-            const issueUrl = (0, model_catalog_1.getModelIssueUrl)(provider, currentModel);
-            const replacementModel = (0, model_catalog_1.getSuggestedReplacementModel)(provider, currentModel);
-            console.error('');
-            console.error((0, ui_1.warn)(`${modelEntry?.name || currentModel} has known issues with Claude Code`));
-            if (replacementModel) {
-                console.error(`    Tool calls will fail. Use "${replacementModel}" instead.`);
-            }
-            else {
-                console.error('    Tool calls will fail. Consider changing the model in config.yaml.');
-            }
-            if (issueUrl) {
-                console.error(`    Tracking: ${issueUrl}`);
-            }
-            if (skipLocalAuth) {
-                console.error('    Note: Model may be overridden by remote proxy configuration.');
-            }
-            else {
-                console.error(`    Run "ccs ${provider} --config" to change model.`);
-            }
-            console.error('');
-        }
-    }
+    (0, model_warnings_1.warnBrokenModels)({ provider, cfg, compositeProviders, skipLocalAuth });
     // 6. Ensure user settings file exists
-    (0, config_generator_1.ensureProviderSettings)(provider);
-    if (provider === 'codex' && !cfg.isComposite && !skipLocalAuth) {
-        await (0, codex_plan_compatibility_1.reconcileCodexModelForActivePlan)({
-            currentModel: (0, model_config_1.getCurrentModel)(provider, cfg.customSettingsPath),
-            verbose,
-        });
-    }
+    (0, auth_coordinator_1.ensureProviderSettingsFile)(provider);
     // Local proxy mode: generate config, spawn/join proxy, track session
     let proxy = null;
     let configPath;
@@ -843,7 +221,7 @@ async function execClaudeWithCLIProxy(claudeCli, provider, args, config = {}) {
             }
         }
     }
-    // 8. Setup HTTPS tunnel if needed
+    // 8. Setup HTTPS tunnel if needed (tunnelPort used by imageAnalysisProxyTarget below)
     let httpsTunnel = null;
     let tunnelPort = null;
     const useHttpsTunnel = (0, https_tunnel_policy_1.shouldStartHttpsTunnel)({
@@ -907,9 +285,11 @@ async function execClaudeWithCLIProxy(claudeCli, provider, args, config = {}) {
     const imageAnalysisWarning = imageAnalysisProvisioningFailed
         ? 'ImageAnalysis MCP provisioning failed. This session will use compatibility fallback when available.'
         : imageAnalysisResolution.warning;
-    // 9. Setup tool sanitization proxy
+    // 9. Resolve config dir + browser runtime (needed before proxy chain)
     let toolSanitizationProxy = null;
     let toolSanitizationPort = null;
+    let codexReasoningProxy = null;
+    let codexReasoningPort = null;
     let inheritedClaudeConfigDir = cfg.claudeConfigDir;
     if (!inheritedClaudeConfigDir && cfg.profileName) {
         const continuityInheritance = await (0, profile_continuity_inheritance_1.resolveProfileContinuityInheritance)({
@@ -923,11 +303,8 @@ async function execClaudeWithCLIProxy(claudeCli, provider, args, config = {}) {
         }
     }
     (0, image_analysis_1.syncImageAnalysisMcpToConfigDir)(inheritedClaudeConfigDir);
-    if (browserRuntimeEnv &&
-        inheritedClaudeConfigDir &&
-        !(0, browser_1.syncBrowserMcpToConfigDir)(inheritedClaudeConfigDir)) {
-        throw new Error('Browser MCP is enabled, but CCS could not sync the browser MCP config into the inherited Claude instance.');
-    }
+    // Resolve browser attach runtime and sync browser MCP (needs inheritedClaudeConfigDir)
+    const { browserRuntimeEnv } = await (0, browser_launch_setup_1.resolveBrowserRuntime)(browserLaunchOverride, inheritedClaudeConfigDir);
     // Build initial env vars to get ANTHROPIC_BASE_URL
     const initialEnvVars = (0, env_resolver_1.buildClaudeEnvironment)({
         provider,
@@ -953,71 +330,19 @@ async function execClaudeWithCLIProxy(claudeCli, provider, args, config = {}) {
         claudeConfigDir: inheritedClaudeConfigDir,
         imageAnalysisEnv,
     });
-    if (initialEnvVars.ANTHROPIC_BASE_URL) {
-        try {
-            toolSanitizationProxy = new tool_sanitization_proxy_1.ToolSanitizationProxy({
-                upstreamBaseUrl: initialEnvVars.ANTHROPIC_BASE_URL,
-                verbose,
-                warnOnSanitize: true,
-                allowSelfSigned: useRemoteProxy ? (proxyConfig.allowSelfSigned ?? false) : false,
-            });
-            toolSanitizationPort = await toolSanitizationProxy.start();
-            log(`Tool sanitization proxy active on port ${toolSanitizationPort}`);
-        }
-        catch (error) {
-            const err = error;
-            toolSanitizationProxy = null;
-            toolSanitizationPort = null;
-            if (verbose) {
-                console.error((0, ui_1.warn)(`Tool sanitization proxy disabled: ${err.message}`));
-            }
-        }
-    }
-    const postSanitizationBaseUrl = toolSanitizationPort
-        ? `http://127.0.0.1:${toolSanitizationPort}`
-        : initialEnvVars.ANTHROPIC_BASE_URL;
-    // 10. Setup Codex reasoning proxy (single-provider Codex only)
-    let codexReasoningProxy = null;
-    let codexReasoningPort = null;
-    // Composite variants require root model-routed endpoints, never provider-pinned codex endpoints.
-    if (provider === 'codex' && !cfg.isComposite) {
-        if (!postSanitizationBaseUrl) {
-            log('ANTHROPIC_BASE_URL not set for Codex, reasoning proxy disabled');
-        }
-        else {
-            try {
-                const traceEnabled = process.env.CCS_CODEX_REASONING_TRACE === '1' ||
-                    process.env.CCS_CODEX_REASONING_TRACE === 'true';
-                const stripPathPrefix = useRemoteProxy ? '/api/provider/codex' : undefined;
-                const codexThinkingOff = (0, thinking_override_resolver_1.shouldDisableCodexReasoning)(thinkingCfg, thinkingOverride);
-                codexReasoningProxy = new codex_reasoning_proxy_1.CodexReasoningProxy({
-                    upstreamBaseUrl: postSanitizationBaseUrl,
-                    verbose,
-                    defaultEffort: 'medium',
-                    disableEffort: codexThinkingOff,
-                    traceFilePath: traceEnabled ? path.join((0, config_manager_1.getCcsDir)(), 'codex-reasoning-proxy.log') : '',
-                    allowSelfSigned: useRemoteProxy ? (proxyConfig.allowSelfSigned ?? false) : false,
-                    modelMap: {
-                        defaultModel: initialEnvVars.ANTHROPIC_MODEL,
-                        opusModel: initialEnvVars.ANTHROPIC_DEFAULT_OPUS_MODEL,
-                        sonnetModel: initialEnvVars.ANTHROPIC_DEFAULT_SONNET_MODEL,
-                        haikuModel: initialEnvVars.ANTHROPIC_DEFAULT_HAIKU_MODEL,
-                    },
-                    stripPathPrefix,
-                });
-                codexReasoningPort = await codexReasoningProxy.start();
-                log(`Codex reasoning proxy active: http://127.0.0.1:${codexReasoningPort}/api/provider/codex`);
-            }
-            catch (error) {
-                const err = error;
-                codexReasoningProxy = null;
-                codexReasoningPort = null;
-                if (verbose) {
-                    console.error((0, ui_1.warn)(`Codex reasoning proxy disabled: ${err.message}`));
-                }
-            }
-        }
-    }
+    // 9b. Build env-dependent proxy chain (tool-sanitization + codex-reasoning)
+    ({ toolSanitizationProxy, toolSanitizationPort, codexReasoningProxy, codexReasoningPort } =
+        await (0, proxy_chain_builder_1.buildProxyChain)({
+            provider,
+            useRemoteProxy,
+            proxyConfig,
+            cfg,
+            initialEnvVars,
+            thinkingOverride,
+            thinkingCfg,
+            verbose,
+            log,
+        }));
     // 11. Build final environment with all proxy chains
     const env = (0, env_resolver_1.buildClaudeEnvironment)({
         provider,
@@ -1073,122 +398,41 @@ async function execClaudeWithCLIProxy(claudeCli, provider, args, config = {}) {
         const { thinkingLabel, sourceLabel } = (0, thinking_override_resolver_1.buildThinkingStartupStatus)(thinkingCfg, thinkingOverride, thinkingSource, thinkingParse.sourceDisplay);
         console.error(`[i] Thinking: ${thinkingLabel} (${sourceLabel})`);
     }
-    // 12. Filter CCS-specific flags before passing to Claude CLI
-    const ccsFlags = [
-        '--auth',
-        '--paste-callback',
-        '--port-forward',
-        '--headless',
-        '--logout',
-        '--config',
-        '--add',
-        '--accounts',
-        '--use',
-        '--nickname',
-        '--kiro-auth-method',
-        '--kiro-idc-start-url',
-        '--kiro-idc-region',
-        '--kiro-idc-flow',
-        '--thinking',
-        '--effort',
-        '--1m',
-        '--no-1m',
-        '--incognito',
-        '--no-incognito',
-        '--import',
-        '--accept-agr-risk',
-        '--accept-antigravity-risk',
-        '--settings',
-        ...proxy_config_resolver_1.PROXY_CLI_FLAGS,
-    ];
-    const claudeArgs = argsWithoutBrowserFlags.filter((arg, idx) => {
-        if (ccsFlags.includes(arg))
-            return false;
-        if (arg.startsWith('--kiro-auth-method='))
-            return false;
-        if (arg.startsWith('--kiro-idc-start-url='))
-            return false;
-        if (arg.startsWith('--kiro-idc-region='))
-            return false;
-        if (arg.startsWith('--kiro-idc-flow='))
-            return false;
-        if (arg.startsWith('--thinking='))
-            return false;
-        if (arg.startsWith('--effort='))
-            return false;
-        if (arg.startsWith('--1m=') || arg.startsWith('--no-1m='))
-            return false;
-        if (argsWithoutBrowserFlags[idx - 1] === '--use' ||
-            argsWithoutBrowserFlags[idx - 1] === '--nickname' ||
-            argsWithoutBrowserFlags[idx - 1] === '--kiro-auth-method' ||
-            argsWithoutBrowserFlags[idx - 1] === '--kiro-idc-start-url' ||
-            argsWithoutBrowserFlags[idx - 1] === '--kiro-idc-region' ||
-            argsWithoutBrowserFlags[idx - 1] === '--kiro-idc-flow' ||
-            argsWithoutBrowserFlags[idx - 1] === '--thinking' ||
-            argsWithoutBrowserFlags[idx - 1] === '--effort')
-            return false;
-        return true;
-    });
-    const isWindows = process.platform === 'win32';
-    const needsShell = isWindows && /\.(cmd|bat|ps1)$/i.test(claudeCli);
-    const settingsPath = cfg.customSettingsPath
-        ? cfg.customSettingsPath.replace(/^~/, os.homedir())
-        : (0, config_generator_1.getProviderSettingsPath)(provider);
-    let claude;
-    const imageAnalysisArgs = imageAnalysisMcpReady
-        ? (0, image_analysis_1.appendThirdPartyImageAnalysisToolArgs)(claudeArgs)
-        : claudeArgs;
-    const browserArgs = browserRuntimeEnv
-        ? (0, browser_1.appendBrowserToolArgs)(imageAnalysisArgs)
-        : imageAnalysisArgs;
-    const launchArgs = [
-        '--settings',
-        settingsPath,
-        ...(0, websearch_manager_1.appendThirdPartyWebSearchToolArgs)(browserArgs),
-    ];
-    const traceEnv = (0, websearch_manager_1.createWebSearchTraceContext)({
-        launcher: 'cliproxy.executor',
-        args: launchArgs,
-        profile: cfg.profileName || provider,
-        profileType: 'cliproxy',
-        settingsPath,
-        claudeConfigDir: inheritedClaudeConfigDir,
+    // 12. Filter CCS flags, spawn Claude CLI, start quota monitor, wire cleanup
+    const claudeArgs = (0, arg_parser_1.filterCcsFlags)(argsWithoutBrowserFlags);
+    await (0, claude_launcher_1.launchClaude)({
+        claudeCli,
+        claudeArgs,
+        env,
+        cfg,
+        provider,
+        compositeProviders,
+        skipLocalAuth,
+        sessionId,
+        imageAnalysisMcpReady,
+        browserRuntimeEnv,
+        inheritedClaudeConfigDir,
+        codexReasoningProxy,
+        toolSanitizationProxy,
+        httpsTunnel,
+        verbose,
     });
-    const tracedEnv = { ...env, ...traceEnv };
-    if (needsShell) {
-        const cmdString = [claudeCli, ...launchArgs].map(shell_executor_1.escapeShellArg).join(' ');
-        claude = (0, child_process_1.spawn)(cmdString, {
-            stdio: 'inherit',
-            windowsHide: true,
-            shell: (0, shell_executor_1.getWindowsEscapedCommandShell)(),
-            env: tracedEnv,
-        });
-    }
-    else {
-        claude = (0, child_process_1.spawn)(claudeCli, launchArgs, {
-            stdio: 'inherit',
-            windowsHide: true,
-            env: tracedEnv,
-        });
-    }
-    // 12b. Start runtime quota monitor (adaptive polling during session)
-    if (!skipLocalAuth) {
-        const { startQuotaMonitor } = await Promise.resolve().then(() => __importStar(require('../quota/quota-manager')));
-        for (const monitorProvider of resolveRuntimeQuotaMonitorProviders(provider, compositeProviders)) {
-            const monitorAccount = (0, account_manager_1.getDefaultAccount)(monitorProvider);
-            if (monitorAccount) {
-                startQuotaMonitor(monitorProvider, monitorAccount.id);
-            }
-        }
-    }
-    // 13. Setup cleanup handlers
-    (0, session_bridge_1.setupCleanupHandlers)(claude, sessionId, cfg.port, codexReasoningProxy, toolSanitizationProxy, httpsTunnel, verbose);
 }
 exports.execClaudeWithCLIProxy = execClaudeWithCLIProxy;
 // Re-export utility functions for backwards compatibility
 var lifecycle_manager_2 = require("./lifecycle-manager");
 Object.defineProperty(exports, "isPortAvailable", { enumerable: true, get: function () { return lifecycle_manager_2.isPortAvailable; } });
 Object.defineProperty(exports, "findAvailablePort", { enumerable: true, get: function () { return lifecycle_manager_2.findAvailablePort; } });
+// Re-export arg-parser helpers (previously inlined here; external callers can
+// import from index or directly from ./arg-parser)
+var arg_parser_2 = require("./arg-parser");
+Object.defineProperty(exports, "readOptionValue", { enumerable: true, get: function () { return arg_parser_2.readOptionValue; } });
+Object.defineProperty(exports, "hasGitLabTokenLoginFlag", { enumerable: true, get: function () { return arg_parser_2.hasGitLabTokenLoginFlag; } });
+Object.defineProperty(exports, "CCS_FLAGS", { enumerable: true, get: function () { return arg_parser_2.CCS_FLAGS; } });
+Object.defineProperty(exports, "filterCcsFlags", { enumerable: true, get: function () { return arg_parser_2.filterCcsFlags; } });
+// Re-export account-resolution helpers for backwards compat with __testExports consumers
+var account_resolution_2 = require("./account-resolution");
+Object.defineProperty(exports, "_resolveRuntimeQuotaMonitorProviders", { enumerable: true, get: function () { return account_resolution_2.resolveRuntimeQuotaMonitorProviders; } });
 exports.__testExports = {
     resolveRuntimeQuotaMonitorProviders,
 };