@kaitranntt/ccs 7.76.0-dev.2 → 7.76.0-dev.4

package/dist/config/unified-config-loader.js

@@ -1,9 +1,19 @@
 "use strict";
 /**
- * Unified Config Loader
+ * Unified Config Loader — orchestrator
  *
  * Loads and saves the unified YAML configuration.
  * Provides fallback to legacy JSON format for backward compatibility.
+ *
+ * Phase 1-6 refactor (issue #1164):
+ *   Phase 1 → src/config/loader/io-locks.ts
+ *   Phase 2 → src/config/loader/normalizers.ts
+ *   Phase 3 → src/config/loader/yaml-serializer.ts
+ *   Phase 4 → src/config/loader/defaults-merger.ts
+ *   Phase 5 → src/config/loader/config-getters.ts
+ *
+ * This file re-exports the full public API so all existing import sites
+ * continue to work without modification.
  */
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
@@ -29,185 +39,74 @@ var __importStar = (this && this.__importStar) || function (mod) {
     return result;
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getCursorConfig = exports.getLoggingConfig = exports.getImageAnalysisConfig = exports.getBrowserConfig = exports.getDashboardAuthConfig = exports.isDashboardAuthEnabled = exports.getOfficialChannelsConfig = exports.getThinkingConfig = exports.getCliproxySafetyConfig = exports.getContinuityInheritanceMap = exports.getGlobalEnvConfig = exports.getWebSearchConfig = exports.setDefaultProfile = exports.getDefaultProfile = exports.isUnifiedMode = exports.updateUnifiedConfig = exports.mutateUnifiedConfig = exports.saveUnifiedConfig = exports.loadOrCreateUnifiedConfig = exports.loadUnifiedConfig = exports.getConfigFormat = exports.hasLegacyConfig = exports.hasUnifiedConfig = exports.getConfigJsonPath = exports.getConfigYamlPath = void 0;
+exports.setDefaultProfile = exports.getDefaultProfile = exports.isUnifiedMode = exports.updateUnifiedConfig = exports.mutateUnifiedConfig = exports.saveUnifiedConfig = exports.loadOrCreateUnifiedConfig = exports.loadUnifiedConfig = exports.getConfigFormat = exports.getCursorConfig = exports.getLoggingConfig = exports.getImageAnalysisConfig = exports.getBrowserConfig = exports.getDashboardAuthConfig = exports.isDashboardAuthEnabled = exports.getOfficialChannelsConfig = exports.getThinkingConfig = exports.getCliproxySafetyConfig = exports.getContinuityInheritanceMap = exports.getGlobalEnvConfig = exports.getWebSearchConfig = exports.mergeWithDefaults = exports.generateYamlWithComments = exports.generateYamlHeader = exports.normalizeOfficialChannelsConfig = exports.normalizeContinuityConfig = exports.normalizeContinuityInheritanceMap = exports.validateCompositeVariants = exports.hasPositiveDuration = exports.normalizeSessionAffinityTtl = exports.canonicalizeBrowserConfig = exports.normalizeBrowserEvalMode = exports.normalizeBrowserPolicy = exports.normalizeBrowserDevtoolsPort = exports.withConfigWriteLock = exports.sleepSync = exports.hasLegacyConfig = exports.hasUnifiedConfig = exports.releaseLock = exports.acquireLock = exports.getConfigJsonPath = exports.getConfigYamlPath = exports.GO_DURATION_PATTERN = exports.GO_DURATION_SEGMENT = exports.LOCK_STALE_MS = exports.CONFIG_LOCK = exports.CONFIG_JSON = exports.CONFIG_YAML = void 0;
 const fs = __importStar(require("fs"));
-const path = __importStar(require("path"));
-const crypto = __importStar(require("crypto"));
 const yaml = __importStar(require("js-yaml"));
-const config_manager_1 = require("../utils/config-manager");
 const unified_config_types_1 = require("./unified-config-types");
-const composite_validator_1 = require("../cliproxy/config/composite-validator");
 const feature_flags_1 = require("./feature-flags");
-const official_channels_runtime_1 = require("../channels/official-channels-runtime");
-const browser_settings_1 = require("../utils/browser/browser-settings");
-const image_analysis_backend_resolver_1 = require("../utils/hooks/image-analysis-backend-resolver");
-const types_1 = require("../utils/websearch/types");
-const CONFIG_YAML = 'config.yaml';
-const CONFIG_JSON = 'config.json';
-const CONFIG_LOCK = 'config.yaml.lock';
-const LOCK_STALE_MS = 5000; // Lock is stale after 5 seconds
-const GO_DURATION_SEGMENT = String.raw `(?:\d+(?:\.\d+)?(?:ns|us|µs|μs|ms|s|m|h))`;
-const GO_DURATION_PATTERN = new RegExp(`^${GO_DURATION_SEGMENT}+$`);
-function normalizeBrowserDevtoolsPort(value) {
-    if (!Number.isFinite(value)) {
-        return unified_config_types_1.DEFAULT_BROWSER_CONFIG.claude.devtools_port;
-    }
-    const port = Math.floor(value);
-    if (port < 1 || port > 65535) {
-        return unified_config_types_1.DEFAULT_BROWSER_CONFIG.claude.devtools_port;
-    }
-    return port;
-}
-function normalizeBrowserPolicy(value) {
-    return value === 'auto' || value === 'manual' ? value : unified_config_types_1.DEFAULT_BROWSER_CONFIG.claude.policy;
-}
-function normalizeBrowserEvalMode(value) {
-    if (value === 'disabled' || value === 'readonly' || value === 'readwrite') {
-        return value;
-    }
-    return unified_config_types_1.DEFAULT_BROWSER_CONFIG.claude.eval_mode ?? 'readonly';
-}
-function canonicalizeBrowserConfig(config, fallback = unified_config_types_1.DEFAULT_BROWSER_CONFIG) {
-    const claudeUserDataDir = config?.claude?.user_data_dir === undefined
-        ? fallback.claude.user_data_dir || (0, browser_settings_1.getRecommendedBrowserUserDataDir)()
-        : config.claude.user_data_dir.trim() || (0, browser_settings_1.getRecommendedBrowserUserDataDir)();
-    return {
-        claude: {
-            enabled: config?.claude?.enabled ?? fallback.claude.enabled,
-            policy: normalizeBrowserPolicy(config?.claude?.policy ?? fallback.claude.policy),
-            user_data_dir: claudeUserDataDir,
-            devtools_port: normalizeBrowserDevtoolsPort(config?.claude?.devtools_port ?? fallback.claude.devtools_port),
-            eval_mode: normalizeBrowserEvalMode(config?.claude?.eval_mode ?? fallback.claude.eval_mode),
-        },
-        codex: {
-            enabled: config?.codex?.enabled ?? fallback.codex.enabled,
-            policy: normalizeBrowserPolicy(config?.codex?.policy ?? fallback.codex.policy),
-            eval_mode: normalizeBrowserEvalMode(config?.codex?.eval_mode ?? fallback.codex.eval_mode),
-        },
-    };
-}
-function normalizeSessionAffinityTtl(value, fallback) {
-    if (typeof value !== 'string') {
-        return fallback;
-    }
-    const trimmed = value.trim();
-    if (!trimmed || !GO_DURATION_PATTERN.test(trimmed) || !hasPositiveDuration(trimmed)) {
-        return fallback;
-    }
-    return trimmed;
-}
-function hasPositiveDuration(value) {
-    const segments = value.match(new RegExp(GO_DURATION_SEGMENT, 'g'));
-    if (!segments) {
-        return false;
-    }
-    return segments.some((segment) => {
-        const numeric = parseFloat(segment);
-        return Number.isFinite(numeric) && numeric > 0;
-    });
-}
-/**
- * Get path to unified config.yaml
- */
-function getConfigYamlPath() {
-    return path.join((0, config_manager_1.getCcsDir)(), CONFIG_YAML);
-}
-exports.getConfigYamlPath = getConfigYamlPath;
-/**
- * Get path to legacy config.json
- */
-function getConfigJsonPath() {
-    return path.join((0, config_manager_1.getCcsDir)(), CONFIG_JSON);
-}
-exports.getConfigJsonPath = getConfigJsonPath;
-/**
- * Get path to config lockfile
- */
-function getLockFilePath() {
-    return path.join((0, config_manager_1.getCcsDir)(), CONFIG_LOCK);
-}
-/**
- * Acquire lockfile for config write operations.
- * Returns a lock token if acquired, null if already locked by another process.
- * Cleans up stale locks (older than LOCK_STALE_MS).
- */
-function acquireLock() {
-    const lockPath = getLockFilePath();
-    const lockDir = path.dirname(lockPath);
-    const lockToken = crypto.randomUUID();
-    const lockData = `${process.pid}\n${Date.now()}\n${lockToken}`;
-    try {
-        if (!fs.existsSync(lockDir)) {
-            fs.mkdirSync(lockDir, { recursive: true, mode: 0o700 });
-        }
-        // Check if lock exists
-        if (fs.existsSync(lockPath)) {
-            const content = fs.readFileSync(lockPath, 'utf8');
-            const [pidStr, timestampStr] = content.trim().split('\n');
-            const pid = Number.parseInt(pidStr, 10);
-            const timestamp = Number.parseInt(timestampStr, 10);
-            const hasLiveOwner = Number.isInteger(pid) && pid > 0 && processExists(pid);
-            const isStale = !Number.isFinite(timestamp) || Date.now() - timestamp > LOCK_STALE_MS;
-            if (hasLiveOwner) {
-                return null;
-            }
-            if (isStale || !hasLiveOwner) {
-                fs.unlinkSync(lockPath);
-            }
-        }
-        // Acquire lock
-        fs.writeFileSync(lockPath, lockData, { flag: 'wx', mode: 0o600 });
-        return lockToken;
-    }
-    catch (error) {
-        // EEXIST means another process acquired the lock between our check and write
-        if (error.code === 'EEXIST') {
-            return null;
-        }
-        return null;
-    }
-}
-/**
- * Release lockfile after config write operation.
- */
-function releaseLock(lockToken) {
-    const lockPath = getLockFilePath();
-    try {
-        if (fs.existsSync(lockPath)) {
-            const content = fs.readFileSync(lockPath, 'utf8');
-            const fileToken = content.trim().split('\n')[2];
-            if (fileToken === lockToken) {
-                fs.unlinkSync(lockPath);
-            }
-        }
-    }
-    catch {
-        // Ignore cleanup errors
-    }
-}
-function processExists(pid) {
-    try {
-        process.kill(pid, 0);
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-/**
- * Check if unified config.yaml exists
- */
-function hasUnifiedConfig() {
-    return fs.existsSync(getConfigYamlPath());
-}
-exports.hasUnifiedConfig = hasUnifiedConfig;
-/**
- * Check if legacy config.json exists
- */
-function hasLegacyConfig() {
-    return fs.existsSync(getConfigJsonPath());
-}
-exports.hasLegacyConfig = hasLegacyConfig;
+// ---------------------------------------------------------------------------
+// Phase 1 re-exports: io-locks
+// ---------------------------------------------------------------------------
+var io_locks_1 = require("./loader/io-locks");
+Object.defineProperty(exports, "CONFIG_YAML", { enumerable: true, get: function () { return io_locks_1.CONFIG_YAML; } });
+Object.defineProperty(exports, "CONFIG_JSON", { enumerable: true, get: function () { return io_locks_1.CONFIG_JSON; } });
+Object.defineProperty(exports, "CONFIG_LOCK", { enumerable: true, get: function () { return io_locks_1.CONFIG_LOCK; } });
+Object.defineProperty(exports, "LOCK_STALE_MS", { enumerable: true, get: function () { return io_locks_1.LOCK_STALE_MS; } });
+Object.defineProperty(exports, "GO_DURATION_SEGMENT", { enumerable: true, get: function () { return io_locks_1.GO_DURATION_SEGMENT; } });
+Object.defineProperty(exports, "GO_DURATION_PATTERN", { enumerable: true, get: function () { return io_locks_1.GO_DURATION_PATTERN; } });
+Object.defineProperty(exports, "getConfigYamlPath", { enumerable: true, get: function () { return io_locks_1.getConfigYamlPath; } });
+Object.defineProperty(exports, "getConfigJsonPath", { enumerable: true, get: function () { return io_locks_1.getConfigJsonPath; } });
+Object.defineProperty(exports, "acquireLock", { enumerable: true, get: function () { return io_locks_1.acquireLock; } });
+Object.defineProperty(exports, "releaseLock", { enumerable: true, get: function () { return io_locks_1.releaseLock; } });
+Object.defineProperty(exports, "hasUnifiedConfig", { enumerable: true, get: function () { return io_locks_1.hasUnifiedConfig; } });
+Object.defineProperty(exports, "hasLegacyConfig", { enumerable: true, get: function () { return io_locks_1.hasLegacyConfig; } });
+Object.defineProperty(exports, "sleepSync", { enumerable: true, get: function () { return io_locks_1.sleepSync; } });
+Object.defineProperty(exports, "withConfigWriteLock", { enumerable: true, get: function () { return io_locks_1.withConfigWriteLock; } });
+const io_locks_2 = require("./loader/io-locks");
+// ---------------------------------------------------------------------------
+// Phase 2 re-exports: normalizers
+// ---------------------------------------------------------------------------
+var normalizers_1 = require("./loader/normalizers");
+Object.defineProperty(exports, "normalizeBrowserDevtoolsPort", { enumerable: true, get: function () { return normalizers_1.normalizeBrowserDevtoolsPort; } });
+Object.defineProperty(exports, "normalizeBrowserPolicy", { enumerable: true, get: function () { return normalizers_1.normalizeBrowserPolicy; } });
+Object.defineProperty(exports, "normalizeBrowserEvalMode", { enumerable: true, get: function () { return normalizers_1.normalizeBrowserEvalMode; } });
+Object.defineProperty(exports, "canonicalizeBrowserConfig", { enumerable: true, get: function () { return normalizers_1.canonicalizeBrowserConfig; } });
+Object.defineProperty(exports, "normalizeSessionAffinityTtl", { enumerable: true, get: function () { return normalizers_1.normalizeSessionAffinityTtl; } });
+Object.defineProperty(exports, "hasPositiveDuration", { enumerable: true, get: function () { return normalizers_1.hasPositiveDuration; } });
+Object.defineProperty(exports, "validateCompositeVariants", { enumerable: true, get: function () { return normalizers_1.validateCompositeVariants; } });
+Object.defineProperty(exports, "normalizeContinuityInheritanceMap", { enumerable: true, get: function () { return normalizers_1.normalizeContinuityInheritanceMap; } });
+Object.defineProperty(exports, "normalizeContinuityConfig", { enumerable: true, get: function () { return normalizers_1.normalizeContinuityConfig; } });
+Object.defineProperty(exports, "normalizeOfficialChannelsConfig", { enumerable: true, get: function () { return normalizers_1.normalizeOfficialChannelsConfig; } });
+const normalizers_2 = require("./loader/normalizers");
+// ---------------------------------------------------------------------------
+// Phase 3 re-exports: yaml-serializer
+// ---------------------------------------------------------------------------
+var yaml_serializer_1 = require("./loader/yaml-serializer");
+Object.defineProperty(exports, "generateYamlHeader", { enumerable: true, get: function () { return yaml_serializer_1.generateYamlHeader; } });
+Object.defineProperty(exports, "generateYamlWithComments", { enumerable: true, get: function () { return yaml_serializer_1.generateYamlWithComments; } });
+const yaml_serializer_2 = require("./loader/yaml-serializer");
+// ---------------------------------------------------------------------------
+// Phase 4 re-exports: defaults-merger
+// ---------------------------------------------------------------------------
+var defaults_merger_1 = require("./loader/defaults-merger");
+Object.defineProperty(exports, "mergeWithDefaults", { enumerable: true, get: function () { return defaults_merger_1.mergeWithDefaults; } });
+const defaults_merger_2 = require("./loader/defaults-merger");
+var config_getters_1 = require("./loader/config-getters");
+Object.defineProperty(exports, "getWebSearchConfig", { enumerable: true, get: function () { return config_getters_1.getWebSearchConfig; } });
+Object.defineProperty(exports, "getGlobalEnvConfig", { enumerable: true, get: function () { return config_getters_1.getGlobalEnvConfig; } });
+Object.defineProperty(exports, "getContinuityInheritanceMap", { enumerable: true, get: function () { return config_getters_1.getContinuityInheritanceMap; } });
+Object.defineProperty(exports, "getCliproxySafetyConfig", { enumerable: true, get: function () { return config_getters_1.getCliproxySafetyConfig; } });
+Object.defineProperty(exports, "getThinkingConfig", { enumerable: true, get: function () { return config_getters_1.getThinkingConfig; } });
+Object.defineProperty(exports, "getOfficialChannelsConfig", { enumerable: true, get: function () { return config_getters_1.getOfficialChannelsConfig; } });
+Object.defineProperty(exports, "isDashboardAuthEnabled", { enumerable: true, get: function () { return config_getters_1.isDashboardAuthEnabled; } });
+Object.defineProperty(exports, "getDashboardAuthConfig", { enumerable: true, get: function () { return config_getters_1.getDashboardAuthConfig; } });
+Object.defineProperty(exports, "getBrowserConfig", { enumerable: true, get: function () { return config_getters_1.getBrowserConfig; } });
+Object.defineProperty(exports, "getImageAnalysisConfig", { enumerable: true, get: function () { return config_getters_1.getImageAnalysisConfig; } });
+Object.defineProperty(exports, "getLoggingConfig", { enumerable: true, get: function () { return config_getters_1.getLoggingConfig; } });
+Object.defineProperty(exports, "getCursorConfig", { enumerable: true, get: function () { return config_getters_1.getCursorConfig; } });
+// ---------------------------------------------------------------------------
+// getConfigFormat
+// ---------------------------------------------------------------------------
 /**
  * Determine which config format is active.
  * Returns 'yaml' if unified config exists or is enabled,
@@ -215,23 +114,25 @@ exports.hasLegacyConfig = hasLegacyConfig;
  * 'none' if no config exists.
  */
 function getConfigFormat() {
-    if (hasUnifiedConfig())
+    if ((0, io_locks_2.hasUnifiedConfig)())
         return 'yaml';
     if ((0, feature_flags_1.isUnifiedConfigEnabled)())
         return 'yaml';
-    if (hasLegacyConfig())
+    if ((0, io_locks_2.hasLegacyConfig)())
         return 'json';
     return 'none';
 }
 exports.getConfigFormat = getConfigFormat;
+// ---------------------------------------------------------------------------
+// Core load / save / mutate
+// ---------------------------------------------------------------------------
 /**
  * Load unified config from YAML file.
  * Returns null if file doesn't exist.
  * Auto-upgrades config if version is outdated (regenerates comments).
  */
 function loadUnifiedConfig() {
-    const yamlPath = getConfigYamlPath();
-    // If file doesn't exist, return null
+    const yamlPath = (0, io_locks_2.getConfigYamlPath)();
     if (!fs.existsSync(yamlPath)) {
         return null;
     }
@@ -243,8 +144,7 @@ function loadUnifiedConfig() {
         }
         // Auto-upgrade if version is outdated (regenerates YAML with new comments and fields)
         if ((parsed.version ?? 1) < unified_config_types_1.UNIFIED_CONFIG_VERSION) {
-            // Merge with defaults to add new fields (e.g., model for websearch providers)
-            const upgraded = mergeWithDefaults(parsed);
+            const upgraded = (0, defaults_merger_2.mergeWithDefaults)(parsed);
             upgraded.version = unified_config_types_1.UNIFIED_CONFIG_VERSION;
             try {
                 saveUnifiedConfig(upgraded);
@@ -279,322 +179,6 @@ function loadUnifiedConfig() {
     }
 }
 exports.loadUnifiedConfig = loadUnifiedConfig;
-/**
- * Validate composite variant provider strings.
- * Warns about invalid providers in composite variant configurations.
- */
-function validateCompositeVariants(config) {
-    const variants = config.cliproxy?.variants;
-    if (!variants)
-        return;
-    for (const [name, variant] of Object.entries(variants)) {
-        if ('type' in variant && variant.type === 'composite') {
-            const error = (0, composite_validator_1.validateCompositeTiers)(variant.tiers, {
-                defaultTier: variant.default_tier,
-                requireAllTiers: true,
-            });
-            if (error) {
-                console.warn(`[!] Variant '${name}': invalid composite config (${error})`);
-            }
-        }
-    }
-}
-/**
- * Normalize continuity inheritance mapping payload.
- * Keeps only non-empty string keys and values.
- */
-function normalizeContinuityInheritanceMap(value) {
-    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
-        return undefined;
-    }
-    const normalized = {};
-    for (const [profileName, accountName] of Object.entries(value)) {
-        const normalizedProfile = profileName.trim();
-        const normalizedAccount = typeof accountName === 'string' ? accountName.trim() : '';
-        if (!normalizedProfile || !normalizedAccount) {
-            continue;
-        }
-        normalized[normalizedProfile] = normalizedAccount;
-    }
-    return Object.keys(normalized).length > 0 ? normalized : undefined;
-}
-/**
- * Normalize continuity section.
- * Supports legacy root key: continuity_inherit_from_account.
- */
-function normalizeContinuityConfig(partial) {
-    const legacyMap = normalizeContinuityInheritanceMap(partial
-        .continuity_inherit_from_account);
-    const continuityMap = normalizeContinuityInheritanceMap(partial.continuity?.inherit_from_account);
-    if (!legacyMap && !continuityMap) {
-        return undefined;
-    }
-    return {
-        inherit_from_account: {
-            ...(legacyMap ?? {}),
-            ...(continuityMap ?? {}),
-        },
-    };
-}
-function normalizeOfficialChannelsConfig(partial) {
-    const hasCanonicalChannelsSection = partial.channels !== undefined;
-    const hasExplicitSelectedField = hasCanonicalChannelsSection &&
-        Object.prototype.hasOwnProperty.call(partial.channels, 'selected');
-    const rawSelected = hasExplicitSelectedField && Array.isArray(partial.channels?.selected)
-        ? partial.channels.selected.filter((value) => (0, official_channels_runtime_1.isOfficialChannelId)(value))
-        : [];
-    return {
-        selected: hasCanonicalChannelsSection
-            ? (0, official_channels_runtime_1.normalizeOfficialChannelIds)(rawSelected)
-            : (0, official_channels_runtime_1.resolveLegacyDiscordSelection)(partial.discord_channels?.enabled),
-        unattended: partial.channels?.unattended ??
-            partial.discord_channels?.unattended ??
-            unified_config_types_1.DEFAULT_OFFICIAL_CHANNELS_CONFIG.unattended,
-    };
-}
-/**
- * Merge partial config with defaults.
- * Preserves existing data while filling in missing sections.
- */
-function mergeWithDefaults(partial) {
-    const defaults = (0, unified_config_types_1.createEmptyUnifiedConfig)();
-    const continuity = normalizeContinuityConfig(partial);
-    return {
-        version: partial.version ?? defaults.version,
-        setup_completed: partial.setup_completed,
-        default: partial.default ?? defaults.default,
-        accounts: partial.accounts ?? defaults.accounts,
-        profiles: partial.profiles ?? defaults.profiles,
-        cliproxy: {
-            ...partial.cliproxy,
-            oauth_accounts: partial.cliproxy?.oauth_accounts ?? defaults.cliproxy.oauth_accounts,
-            providers: defaults.cliproxy.providers, // Always use defaults for providers
-            variants: partial.cliproxy?.variants ?? defaults.cliproxy.variants,
-            logging: {
-                enabled: partial.cliproxy?.logging?.enabled ?? defaults.cliproxy.logging?.enabled ?? false,
-                request_log: partial.cliproxy?.logging?.request_log ?? defaults.cliproxy.logging?.request_log ?? false,
-            },
-            safety: {
-                antigravity_ack_bypass: partial.cliproxy?.safety?.antigravity_ack_bypass ??
-                    unified_config_types_1.DEFAULT_CLIPROXY_SAFETY_CONFIG.antigravity_ack_bypass,
-            },
-            // Kiro browser behavior setting (optional)
-            kiro_no_incognito: partial.cliproxy?.kiro_no_incognito,
-            // Auth config - preserve user values, no defaults (uses constants as fallback)
-            auth: partial.cliproxy?.auth,
-            // Background token refresh config (optional)
-            token_refresh: partial.cliproxy?.token_refresh,
-            // Backend selection - validate and preserve user choice (original vs plus)
-            backend: partial.cliproxy?.backend === 'original' || partial.cliproxy?.backend === 'plus'
-                ? partial.cliproxy.backend
-                : undefined, // Invalid values become undefined (defaults to 'original' at runtime)
-            // Auto-sync - default to true
-            auto_sync: partial.cliproxy?.auto_sync ?? defaults.cliproxy.auto_sync ?? true,
-            routing: {
-                strategy: partial.cliproxy?.routing?.strategy === 'fill-first' ||
-                    partial.cliproxy?.routing?.strategy === 'round-robin'
-                    ? partial.cliproxy.routing.strategy
-                    : defaults.cliproxy.routing?.strategy,
-                session_affinity: typeof partial.cliproxy?.routing?.session_affinity === 'boolean'
-                    ? partial.cliproxy.routing.session_affinity
-                    : defaults.cliproxy.routing?.session_affinity,
-                session_affinity_ttl: normalizeSessionAffinityTtl(partial.cliproxy?.routing?.session_affinity_ttl, defaults.cliproxy.routing?.session_affinity_ttl ?? '1h'),
-            },
-        },
-        proxy: {
-            port: partial.proxy?.port ?? unified_config_types_1.DEFAULT_OPENAI_COMPAT_PROXY_CONFIG.port,
-            profile_ports: partial.proxy?.profile_ports ?? {
-                ...unified_config_types_1.DEFAULT_OPENAI_COMPAT_PROXY_CONFIG.profile_ports,
-            },
-            routing: {
-                default: partial.proxy?.routing?.default ?? defaults.proxy?.routing?.default,
-                background: partial.proxy?.routing?.background ?? defaults.proxy?.routing?.background,
-                think: partial.proxy?.routing?.think ?? defaults.proxy?.routing?.think,
-                longContext: partial.proxy?.routing?.longContext ?? defaults.proxy?.routing?.longContext,
-                webSearch: partial.proxy?.routing?.webSearch ?? defaults.proxy?.routing?.webSearch,
-                longContextThreshold: partial.proxy?.routing?.longContextThreshold ??
-                    defaults.proxy?.routing?.longContextThreshold,
-            },
-        },
-        logging: {
-            enabled: partial.logging?.enabled ?? unified_config_types_1.DEFAULT_LOGGING_CONFIG.enabled,
-            level: partial.logging?.level ?? unified_config_types_1.DEFAULT_LOGGING_CONFIG.level,
-            rotate_mb: partial.logging?.rotate_mb ?? unified_config_types_1.DEFAULT_LOGGING_CONFIG.rotate_mb,
-            retain_days: partial.logging?.retain_days ?? unified_config_types_1.DEFAULT_LOGGING_CONFIG.retain_days,
-            redact: partial.logging?.redact ?? unified_config_types_1.DEFAULT_LOGGING_CONFIG.redact,
-            live_buffer_size: partial.logging?.live_buffer_size ?? unified_config_types_1.DEFAULT_LOGGING_CONFIG.live_buffer_size,
-        },
-        preferences: {
-            ...defaults.preferences,
-            ...partial.preferences,
-        },
-        websearch: {
-            enabled: partial.websearch?.enabled ?? defaults.websearch?.enabled ?? true,
-            providers: {
-                exa: {
-                    enabled: partial.websearch?.providers?.exa?.enabled ?? false,
-                    max_results: partial.websearch?.providers?.exa?.max_results ?? 5,
-                },
-                tavily: {
-                    enabled: partial.websearch?.providers?.tavily?.enabled ?? false,
-                    max_results: partial.websearch?.providers?.tavily?.max_results ?? 5,
-                },
-                brave: {
-                    enabled: partial.websearch?.providers?.brave?.enabled ?? false,
-                    max_results: partial.websearch?.providers?.brave?.max_results ?? 5,
-                },
-                searxng: {
-                    enabled: partial.websearch?.providers?.searxng?.enabled ?? false,
-                    url: (0, types_1.normalizeSearxngBaseUrl)(partial.websearch?.providers?.searxng?.url) ?? '',
-                    max_results: partial.websearch?.providers?.searxng?.max_results ?? 5,
-                },
-                duckduckgo: {
-                    enabled: partial.websearch?.providers?.duckduckgo?.enabled ?? true,
-                    max_results: partial.websearch?.providers?.duckduckgo?.max_results ?? 5,
-                },
-                gemini: {
-                    enabled: partial.websearch?.providers?.gemini?.enabled ??
-                        partial.websearch?.gemini?.enabled ?? // Legacy fallback
-                        false,
-                    model: partial.websearch?.providers?.gemini?.model ?? 'gemini-2.5-flash',
-                    timeout: partial.websearch?.providers?.gemini?.timeout ??
-                        partial.websearch?.gemini?.timeout ?? // Legacy fallback
-                        55,
-                },
-                opencode: {
-                    enabled: partial.websearch?.providers?.opencode?.enabled ?? false,
-                    model: partial.websearch?.providers?.opencode?.model ?? 'opencode/grok-code',
-                    timeout: partial.websearch?.providers?.opencode?.timeout ?? 90,
-                },
-                grok: {
-                    enabled: partial.websearch?.providers?.grok?.enabled ?? false,
-                    timeout: partial.websearch?.providers?.grok?.timeout ?? 55,
-                },
-            },
-            // Legacy fields (keep for backwards compatibility during read)
-            gemini: partial.websearch?.gemini,
-        },
-        // Copilot config - strictly opt-in, merge with defaults
-        copilot: {
-            enabled: partial.copilot?.enabled ?? unified_config_types_1.DEFAULT_COPILOT_CONFIG.enabled,
-            auto_start: partial.copilot?.auto_start ?? unified_config_types_1.DEFAULT_COPILOT_CONFIG.auto_start,
-            port: partial.copilot?.port ?? unified_config_types_1.DEFAULT_COPILOT_CONFIG.port,
-            account_type: partial.copilot?.account_type ?? unified_config_types_1.DEFAULT_COPILOT_CONFIG.account_type,
-            rate_limit: partial.copilot?.rate_limit ?? unified_config_types_1.DEFAULT_COPILOT_CONFIG.rate_limit,
-            wait_on_limit: partial.copilot?.wait_on_limit ?? unified_config_types_1.DEFAULT_COPILOT_CONFIG.wait_on_limit,
-            model: partial.copilot?.model ?? unified_config_types_1.DEFAULT_COPILOT_CONFIG.model,
-        },
-        // Cursor config - disabled by default, merge with defaults
-        cursor: {
-            enabled: partial.cursor?.enabled ?? unified_config_types_1.DEFAULT_CURSOR_CONFIG.enabled,
-            port: partial.cursor?.port ?? unified_config_types_1.DEFAULT_CURSOR_CONFIG.port,
-            auto_start: partial.cursor?.auto_start ?? unified_config_types_1.DEFAULT_CURSOR_CONFIG.auto_start,
-            ghost_mode: partial.cursor?.ghost_mode ?? unified_config_types_1.DEFAULT_CURSOR_CONFIG.ghost_mode,
-            model: partial.cursor?.model ?? unified_config_types_1.DEFAULT_CURSOR_CONFIG.model,
-            opus_model: partial.cursor?.opus_model,
-            sonnet_model: partial.cursor?.sonnet_model,
-            haiku_model: partial.cursor?.haiku_model,
-        },
-        // Global env - injected into all non-Claude subscription profiles
-        global_env: {
-            enabled: partial.global_env?.enabled ?? true,
-            env: partial.global_env?.env ?? { ...unified_config_types_1.DEFAULT_GLOBAL_ENV },
-        },
-        continuity,
-        // CLIProxy server config - remote/local CLIProxyAPI settings
-        cliproxy_server: {
-            remote: {
-                enabled: partial.cliproxy_server?.remote?.enabled ?? unified_config_types_1.DEFAULT_CLIPROXY_SERVER_CONFIG.remote.enabled,
-                host: partial.cliproxy_server?.remote?.host ?? unified_config_types_1.DEFAULT_CLIPROXY_SERVER_CONFIG.remote.host,
-                // Port is optional - undefined means use protocol default (443 for HTTPS, 8317 for HTTP)
-                port: partial.cliproxy_server?.remote?.port,
-                protocol: partial.cliproxy_server?.remote?.protocol ??
-                    unified_config_types_1.DEFAULT_CLIPROXY_SERVER_CONFIG.remote.protocol,
-                auth_token: partial.cliproxy_server?.remote?.auth_token ??
-                    unified_config_types_1.DEFAULT_CLIPROXY_SERVER_CONFIG.remote.auth_token,
-                // management_key is optional - falls back to auth_token when not set
-                management_key: partial.cliproxy_server?.remote?.management_key,
-            },
-            fallback: {
-                enabled: partial.cliproxy_server?.fallback?.enabled ??
-                    unified_config_types_1.DEFAULT_CLIPROXY_SERVER_CONFIG.fallback.enabled,
-                auto_start: partial.cliproxy_server?.fallback?.auto_start ??
-                    unified_config_types_1.DEFAULT_CLIPROXY_SERVER_CONFIG.fallback.auto_start,
-            },
-            local: {
-                port: partial.cliproxy_server?.local?.port ?? unified_config_types_1.DEFAULT_CLIPROXY_SERVER_CONFIG.local.port,
-                auto_start: partial.cliproxy_server?.local?.auto_start ??
-                    unified_config_types_1.DEFAULT_CLIPROXY_SERVER_CONFIG.local.auto_start,
-            },
-        },
-        // Quota management config - hybrid auto+manual account selection
-        quota_management: {
-            mode: partial.quota_management?.mode ?? unified_config_types_1.DEFAULT_QUOTA_MANAGEMENT_CONFIG.mode,
-            auto: {
-                preflight_check: partial.quota_management?.auto?.preflight_check ??
-                    unified_config_types_1.DEFAULT_QUOTA_MANAGEMENT_CONFIG.auto.preflight_check,
-                exhaustion_threshold: partial.quota_management?.auto?.exhaustion_threshold ??
-                    unified_config_types_1.DEFAULT_QUOTA_MANAGEMENT_CONFIG.auto.exhaustion_threshold,
-                tier_priority: partial.quota_management?.auto?.tier_priority ??
-                    unified_config_types_1.DEFAULT_QUOTA_MANAGEMENT_CONFIG.auto.tier_priority,
-                cooldown_minutes: partial.quota_management?.auto?.cooldown_minutes ??
-                    unified_config_types_1.DEFAULT_QUOTA_MANAGEMENT_CONFIG.auto.cooldown_minutes,
-            },
-            manual: {
-                paused_accounts: partial.quota_management?.manual?.paused_accounts ??
-                    unified_config_types_1.DEFAULT_QUOTA_MANAGEMENT_CONFIG.manual.paused_accounts,
-                forced_default: partial.quota_management?.manual?.forced_default ??
-                    unified_config_types_1.DEFAULT_QUOTA_MANAGEMENT_CONFIG.manual.forced_default,
-                tier_lock: partial.quota_management?.manual?.tier_lock ??
-                    unified_config_types_1.DEFAULT_QUOTA_MANAGEMENT_CONFIG.manual.tier_lock,
-            },
-            runtime_monitor: {
-                enabled: partial.quota_management?.runtime_monitor?.enabled ??
-                    unified_config_types_1.DEFAULT_QUOTA_MANAGEMENT_CONFIG.runtime_monitor.enabled,
-                normal_interval_seconds: partial.quota_management?.runtime_monitor?.normal_interval_seconds ??
-                    unified_config_types_1.DEFAULT_QUOTA_MANAGEMENT_CONFIG.runtime_monitor.normal_interval_seconds,
-                critical_interval_seconds: partial.quota_management?.runtime_monitor?.critical_interval_seconds ??
-                    unified_config_types_1.DEFAULT_QUOTA_MANAGEMENT_CONFIG.runtime_monitor.critical_interval_seconds,
-                warn_threshold: partial.quota_management?.runtime_monitor?.warn_threshold ??
-                    unified_config_types_1.DEFAULT_QUOTA_MANAGEMENT_CONFIG.runtime_monitor.warn_threshold,
-                exhaustion_threshold: partial.quota_management?.runtime_monitor?.exhaustion_threshold ??
-                    unified_config_types_1.DEFAULT_QUOTA_MANAGEMENT_CONFIG.runtime_monitor.exhaustion_threshold,
-                cooldown_minutes: partial.quota_management?.runtime_monitor?.cooldown_minutes ??
-                    unified_config_types_1.DEFAULT_QUOTA_MANAGEMENT_CONFIG.runtime_monitor.cooldown_minutes,
-            },
-        },
-        // Thinking config - auto/manual/off control for reasoning budget
-        thinking: {
-            mode: partial.thinking?.mode ?? unified_config_types_1.DEFAULT_THINKING_CONFIG.mode,
-            override: partial.thinking?.override,
-            tier_defaults: {
-                opus: partial.thinking?.tier_defaults?.opus ?? unified_config_types_1.DEFAULT_THINKING_CONFIG.tier_defaults.opus,
-                sonnet: partial.thinking?.tier_defaults?.sonnet ?? unified_config_types_1.DEFAULT_THINKING_CONFIG.tier_defaults.sonnet,
-                haiku: partial.thinking?.tier_defaults?.haiku ?? unified_config_types_1.DEFAULT_THINKING_CONFIG.tier_defaults.haiku,
-            },
-            provider_overrides: partial.thinking?.provider_overrides,
-            show_warnings: partial.thinking?.show_warnings ?? unified_config_types_1.DEFAULT_THINKING_CONFIG.show_warnings,
-        },
-        channels: normalizeOfficialChannelsConfig(partial),
-        // Dashboard auth config - disabled by default
-        dashboard_auth: {
-            enabled: partial.dashboard_auth?.enabled ?? unified_config_types_1.DEFAULT_DASHBOARD_AUTH_CONFIG.enabled,
-            username: partial.dashboard_auth?.username ?? unified_config_types_1.DEFAULT_DASHBOARD_AUTH_CONFIG.username,
-            password_hash: partial.dashboard_auth?.password_hash ?? unified_config_types_1.DEFAULT_DASHBOARD_AUTH_CONFIG.password_hash,
-            session_timeout_hours: partial.dashboard_auth?.session_timeout_hours ??
-                unified_config_types_1.DEFAULT_DASHBOARD_AUTH_CONFIG.session_timeout_hours,
-        },
-        browser: canonicalizeBrowserConfig(partial.browser),
-        // Image analysis config - enabled by default for CLIProxy providers
-        image_analysis: (0, image_analysis_backend_resolver_1.canonicalizeImageAnalysisConfig)({
-            enabled: partial.image_analysis?.enabled ?? unified_config_types_1.DEFAULT_IMAGE_ANALYSIS_CONFIG.enabled,
-            timeout: partial.image_analysis?.timeout ?? unified_config_types_1.DEFAULT_IMAGE_ANALYSIS_CONFIG.timeout,
-            provider_models: partial.image_analysis?.provider_models ?? unified_config_types_1.DEFAULT_IMAGE_ANALYSIS_CONFIG.provider_models,
-            fallback_backend: partial.image_analysis?.fallback_backend ?? unified_config_types_1.DEFAULT_IMAGE_ANALYSIS_CONFIG.fallback_backend,
-            profile_backends: partial.image_analysis?.profile_backends ?? unified_config_types_1.DEFAULT_IMAGE_ANALYSIS_CONFIG.profile_backends,
-        }),
-    };
-}
 /**
  * Load config, preferring YAML if available, falling back to creating empty config.
  * Merges with defaults to ensure all sections exist.
@@ -602,387 +186,21 @@ function mergeWithDefaults(partial) {
 function loadOrCreateUnifiedConfig() {
     const existing = loadUnifiedConfig();
     if (existing) {
-        // Merge with defaults to fill any missing sections
-        const merged = mergeWithDefaults(existing);
-        // Validate composite variant provider strings
-        validateCompositeVariants(merged);
+        const merged = (0, defaults_merger_2.mergeWithDefaults)(existing);
+        (0, normalizers_2.validateCompositeVariants)(merged);
         return merged;
     }
-    // Create empty config
-    const config = (0, unified_config_types_1.createEmptyUnifiedConfig)();
-    return config;
+    return (0, unified_config_types_1.createEmptyUnifiedConfig)();
 }
 exports.loadOrCreateUnifiedConfig = loadOrCreateUnifiedConfig;
-/**
- * Generate YAML header with helpful comments.
- */
-function generateYamlHeader() {
-    return `# CCS Unified Configuration
-# Docs: https://github.com/kaitranntt/ccs
-`;
-}
-/**
- * Generate YAML content with section comments for better readability.
- */
-function generateYamlWithComments(config) {
-    const lines = [];
-    // Version
-    lines.push(`version: ${config.version}`);
-    if (config.setup_completed !== undefined) {
-        lines.push(`setup_completed: ${config.setup_completed}`);
-    }
-    lines.push('');
-    // Default
-    if (config.default) {
-        lines.push(`# Default profile used when running 'ccs' without arguments`);
-        lines.push(`default: "${config.default}"`);
-        lines.push('');
-    }
-    // Accounts section
-    lines.push('# ----------------------------------------------------------------------------');
-    lines.push('# Accounts: Isolated Claude instances (each with separate auth/sessions)');
-    lines.push('# Manage with: ccs auth add <name>, ccs auth list, ccs auth remove <name>');
-    lines.push('# ----------------------------------------------------------------------------');
-    lines.push(yaml.dump({ accounts: config.accounts }, { indent: 2, lineWidth: -1, quotingType: '"' }).trim());
-    lines.push('');
-    // Profiles section
-    lines.push('# ----------------------------------------------------------------------------');
-    lines.push('# Profiles: API-based providers (GLM, Kimi, custom endpoints)');
-    lines.push('# Each profile points to a *.settings.json file containing env vars.');
-    lines.push('# Edit the settings file directly to customize (ANTHROPIC_MAX_TOKENS, etc.)');
-    lines.push('# ----------------------------------------------------------------------------');
-    lines.push(yaml.dump({ profiles: config.profiles }, { indent: 2, lineWidth: -1, quotingType: '"' }).trim());
-    lines.push('');
-    // CLIProxy section
-    lines.push('# ----------------------------------------------------------------------------');
-    lines.push('# CLIProxy: OAuth-based providers (gemini, codex, agy, qwen, iflow)');
-    lines.push('# Each variant can reference a *.settings.json file for custom env vars.');
-    lines.push('# Edit the settings file directly to customize model or other settings.');
-    lines.push('# ----------------------------------------------------------------------------');
-    lines.push(yaml.dump({ cliproxy: config.cliproxy }, { indent: 2, lineWidth: -1, quotingType: '"' }).trim());
-    lines.push('');
-    if (config.proxy?.routing) {
-        lines.push('# ----------------------------------------------------------------------------');
-        lines.push('# Proxy Routing: OpenAI-compatible local proxy model selection rules');
-        lines.push('# Use profile:model selectors to force a target profile and upstream model.');
-        lines.push('# ----------------------------------------------------------------------------');
-        lines.push(yaml.dump({ proxy: config.proxy }, { indent: 2, lineWidth: -1, quotingType: '"' }).trim());
-        lines.push('');
-    }
-    if (config.logging) {
-        lines.push('# ----------------------------------------------------------------------------');
-        lines.push('# Logging: CCS-owned structured runtime logs');
-        lines.push('# Current file: ~/.ccs/logs/current.jsonl');
-        lines.push('# Archives rotate automatically and are pruned by retain_days.');
-        lines.push('# This is separate from cliproxy.logging, which controls CLIProxy runtime files.');
-        lines.push('# ----------------------------------------------------------------------------');
-        lines.push(yaml.dump({ logging: config.logging }, { indent: 2, lineWidth: -1, quotingType: '"' }).trim());
-        lines.push('');
-    }
-    // CLIProxy Server section (remote proxy configuration) - placed right after cliproxy
-    if (config.cliproxy_server) {
-        lines.push('# ----------------------------------------------------------------------------');
-        lines.push('# CLIProxy Server: Remote proxy connection settings');
-        lines.push('# Configure via Dashboard (`ccs config`) > Proxy tab.');
-        lines.push('#');
-        lines.push('# remote: Connect to a remote CLIProxyAPI instance');
-        lines.push('# fallback: Use local proxy if remote is unreachable');
-        lines.push('# local: Local proxy settings (port, auto-start)');
-        lines.push('# ----------------------------------------------------------------------------');
-        lines.push(yaml
-            .dump({ cliproxy_server: config.cliproxy_server }, { indent: 2, lineWidth: -1, quotingType: '"' })
-            .trim());
-        lines.push('');
-    }
-    // Preferences section
-    lines.push('# ----------------------------------------------------------------------------');
-    lines.push('# Preferences: User settings');
-    lines.push('# ----------------------------------------------------------------------------');
-    lines.push(yaml
-        .dump({ preferences: config.preferences }, { indent: 2, lineWidth: -1, quotingType: '"' })
-        .trim());
-    lines.push('');
-    // WebSearch section
-    if (config.websearch) {
-        lines.push('# ----------------------------------------------------------------------------');
-        lines.push('# WebSearch: real search backends for third-party profiles');
-        lines.push('# Dashboard (`ccs config`) is the source of truth for provider selection.');
-        lines.push('#');
-        lines.push('# Third-party providers (gemini, codex, agy, etc.) do not have access to');
-        lines.push("# Anthropic's WebSearch tool. CCS intercepts that tool and runs local search.");
-        lines.push('#');
-        lines.push('# Priority: Exa -> Tavily -> Brave -> DuckDuckGo -> optional legacy AI CLI fallbacks');
-        lines.push('#');
-        lines.push('# Exa requires EXA_API_KEY in your environment.');
-        lines.push('# Tavily requires TAVILY_API_KEY in your environment.');
-        lines.push('# Brave requires BRAVE_API_KEY in your environment.');
-        lines.push('# DuckDuckGo works with zero extra setup and is enabled by default.');
-        lines.push('#');
-        lines.push('# Legacy LLM fallbacks remain optional if you still want them:');
-        lines.push('#   gemini: npm i -g @google/gemini-cli');
-        lines.push('#   opencode: curl -fsSL https://opencode.ai/install | bash');
-        lines.push('#   grok: npm i -g @vibe-kit/grok-cli');
-        lines.push('# ----------------------------------------------------------------------------');
-        lines.push(yaml
-            .dump({ websearch: config.websearch }, { indent: 2, lineWidth: -1, quotingType: '"' })
-            .trim());
-        lines.push('');
-    }
-    // Copilot section (GitHub Copilot proxy)
-    if (config.copilot) {
-        lines.push('# ----------------------------------------------------------------------------');
-        lines.push('# Copilot: GitHub Copilot API proxy (via copilot-api)');
-        lines.push('# Uses your existing GitHub Copilot subscription with Claude Code.');
-        lines.push('#');
-        lines.push('# !! DISCLAIMER - USE AT YOUR OWN RISK !!');
-        lines.push('# This uses an UNOFFICIAL reverse-engineered API.');
-        lines.push('# Excessive usage may trigger GitHub account restrictions.');
-        lines.push('# CCS provides NO WARRANTY and accepts NO RESPONSIBILITY for consequences.');
-        lines.push('#');
-        lines.push('# Setup: npx copilot-api auth (authenticate with GitHub)');
-        lines.push('# Usage: ccs copilot (switch to copilot profile)');
-        lines.push('#');
-        lines.push('# Models: claude-sonnet-4.5, claude-opus-4.5, gpt-5.1, gemini-2.5-pro');
-        lines.push('# Account types: individual, business, enterprise');
-        lines.push('# ----------------------------------------------------------------------------');
-        lines.push(yaml.dump({ copilot: config.copilot }, { indent: 2, lineWidth: -1, quotingType: '"' }).trim());
-        lines.push('');
-    }
-    // Cursor section (Cursor IDE proxy daemon)
-    if (config.cursor) {
-        lines.push('# ----------------------------------------------------------------------------');
-        lines.push('# Cursor: Cursor IDE proxy daemon');
-        lines.push('# Enables Cursor IDE integration via local proxy daemon.');
-        lines.push('#');
-        lines.push('# enabled: Enable/disable Cursor integration (default: false)');
-        lines.push('# port: Port for cursor proxy daemon (default: 20129)');
-        lines.push('# auto_start: Auto-start daemon when CCS starts (default: false)');
-        lines.push('# ghost_mode: Disable telemetry for privacy (default: true)');
-        lines.push('# model: Default model ID (used for ANTHROPIC_MODEL)');
-        lines.push('# opus_model/sonnet_model/haiku_model: Optional tier model mapping');
-        lines.push('# ----------------------------------------------------------------------------');
-        lines.push(yaml.dump({ cursor: config.cursor }, { indent: 2, lineWidth: -1, quotingType: '"' }).trim());
-        lines.push('');
-    }
-    // Global env section
-    if (config.global_env) {
-        lines.push('# ----------------------------------------------------------------------------');
-        lines.push('# Global Environment Variables: Injected into all non-Claude subscription profiles');
-        lines.push('# These env vars disable telemetry/reporting for third-party providers.');
-        lines.push('# Configure via Dashboard (`ccs config`) > Global Env tab.');
-        lines.push('#');
-        lines.push('# Default variables:');
-        lines.push('#   DISABLE_BUG_COMMAND: Disables /bug command (not supported by proxy)');
-        lines.push('#   DISABLE_ERROR_REPORTING: Disables error reporting to Anthropic');
-        lines.push('#   DISABLE_TELEMETRY: Disables usage telemetry');
-        lines.push('# ----------------------------------------------------------------------------');
-        lines.push(yaml
-            .dump({ global_env: config.global_env }, { indent: 2, lineWidth: -1, quotingType: '"' })
-            .trim());
-        lines.push('');
-    }
-    // Continuity inheritance section
-    if (config.continuity?.inherit_from_account) {
-        lines.push('# ----------------------------------------------------------------------------');
-        lines.push('# Continuity Inheritance: Reuse account continuity artifacts across profiles');
-        lines.push('# Map execution profile names to source account profiles (CLAUDE_CONFIG_DIR).');
-        lines.push('# Applies to Claude target only; credentials remain profile-specific.');
-        lines.push('# Example: continuity.inherit_from_account.glm: pro');
-        lines.push('# ----------------------------------------------------------------------------');
-        lines.push(yaml
-            .dump({ continuity: config.continuity }, { indent: 2, lineWidth: -1, quotingType: '"' })
-            .trim());
-        lines.push('');
-    }
-    // Thinking section (extended thinking/reasoning configuration)
-    if (config.thinking) {
-        lines.push('# ----------------------------------------------------------------------------');
-        lines.push('# Thinking: Extended thinking/reasoning budget configuration');
-        lines.push('# Controls reasoning depth for supported providers (agy, gemini, codex).');
-        lines.push('#');
-        lines.push('# Modes: auto (use tier_defaults), off (disable), manual (--thinking/--effort flags)');
-        lines.push('# Levels: minimal (512), low (1K), medium (8K), high (24K), xhigh (32K), max (adaptive ceiling), auto');
-        lines.push('# Override: Set global override value (number or level name)');
-        lines.push('# Provider overrides: Per-provider tier defaults');
-        lines.push('# ----------------------------------------------------------------------------');
-        lines.push(yaml
-            .dump({ thinking: config.thinking }, { indent: 2, lineWidth: -1, quotingType: '"' })
-            .trim());
-        lines.push('');
-    }
-    // Official Channels section
-    if (config.channels) {
-        lines.push('# ----------------------------------------------------------------------------');
-        lines.push('# Official Channels: Runtime auto-enable for Anthropic official channel plugins');
-        lines.push('# Supported channels: telegram, discord, imessage');
-        lines.push('# Runtime-only: CCS injects --channels at launch for compatible Claude sessions.');
-        lines.push('# Bot tokens live in Claude channel env files, not in config.yaml.');
-        lines.push('# Use selected: [telegram, discord, imessage] to choose channels.');
-        lines.push('# unattended adds --dangerously-skip-permissions only when channel auto-enable is active.');
-        lines.push('# Compatible sessions: native Claude default/account profiles only.');
-        lines.push('# Configure via: ccs config channels or the Settings > Channels dashboard tab.');
-        lines.push('# ----------------------------------------------------------------------------');
-        lines.push(yaml
-            .dump({ channels: config.channels }, { indent: 2, lineWidth: -1, quotingType: '"' })
-            .trim());
-        lines.push('');
-    }
-    // Dashboard auth section (only if configured)
-    if (config.dashboard_auth?.enabled) {
-        lines.push('# ----------------------------------------------------------------------------');
-        lines.push('# Dashboard Auth: Optional login protection for CCS dashboard');
-        lines.push('# Generate password hash: npx bcrypt-cli hash "your-password"');
-        lines.push('# ENV override: CCS_DASHBOARD_AUTH_ENABLED, CCS_DASHBOARD_USERNAME, CCS_DASHBOARD_PASSWORD_HASH');
-        lines.push('# ----------------------------------------------------------------------------');
-        lines.push(yaml
-            .dump({ dashboard_auth: config.dashboard_auth }, { indent: 2, lineWidth: -1, quotingType: '"' })
-            .trim());
-        lines.push('');
-    }
-    // Browser automation section
-    if (config.browser) {
-        lines.push('# ----------------------------------------------------------------------------');
-        lines.push('# Browser Automation: Claude browser attach and Codex browser tooling');
-        lines.push('# Claude attach reuses a running Chrome/Chromium session with remote debugging.');
-        lines.push('# Codex tooling controls whether CCS injects Playwright MCP overrides.');
-        lines.push('#');
-        lines.push('# claude.user_data_dir should point at the Chrome user-data directory for the');
-        lines.push('# dedicated attach session. claude.devtools_port is the expected debugging port.');
-        lines.push('# Configure via: Settings > Browser or `ccs browser ...`.');
-        lines.push('# ----------------------------------------------------------------------------');
-        lines.push(yaml.dump({ browser: config.browser }, { indent: 2, lineWidth: -1, quotingType: '"' }).trim());
-        lines.push('');
-    }
-    // Image analysis section
-    if (config.image_analysis) {
-        lines.push('# ----------------------------------------------------------------------------');
-        lines.push('# Image Analysis: Vision-based analysis for images and PDFs');
-        lines.push('# Routes Read tool requests for images/PDFs through CLIProxy vision API.');
-        lines.push('#');
-        lines.push('# When enabled: Image files trigger vision analysis instead of raw file read');
-        lines.push('# Provider models: Vision model used for each CLIProxy provider');
-        lines.push('# Timeout: Maximum seconds to wait for analysis (10-600)');
-        lines.push('#');
-        lines.push('# Supported formats: .jpg, .jpeg, .png, .gif, .webp, .heic, .bmp, .tiff, .pdf');
-        lines.push('# Configure via: ccs config image-analysis');
-        lines.push('# ----------------------------------------------------------------------------');
-        lines.push(yaml
-            .dump({ image_analysis: config.image_analysis }, { indent: 2, lineWidth: -1, quotingType: '"' })
-            .trim());
-        lines.push('');
-    }
-    return lines.join('\n');
-}
-/**
- * Sync sleep helper for lock retry loops.
- * Uses Atomics.wait when available to avoid CPU-intensive busy-wait.
- */
-function sleepSync(ms) {
-    try {
-        Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
-    }
-    catch {
-        const end = Date.now() + ms;
-        while (Date.now() < end) {
-            /* busy-wait */
-        }
-    }
-}
-/**
- * Execute a callback while holding the config lock.
- */
-function withConfigWriteLock(callback) {
-    // Acquire lock (retry for up to 1 second)
-    const maxRetries = 10;
-    const retryDelayMs = 100;
-    let lockToken = null;
-    for (let i = 0; i < maxRetries; i++) {
-        const acquiredToken = acquireLock();
-        if (acquiredToken) {
-            lockToken = acquiredToken;
-            break;
-        }
-        sleepSync(retryDelayMs);
-    }
-    if (!lockToken) {
-        throw new Error('Config file is locked by another process. Wait a moment and try again.');
-    }
-    try {
-        return callback();
-    }
-    finally {
-        // Always release lock
-        releaseLock(lockToken);
-    }
-}
-/**
- * Load unified config directly from disk while lock is already held.
- * Falls back to empty config when file doesn't exist.
- */
-function loadUnifiedConfigWithLockHeld() {
-    const yamlPath = getConfigYamlPath();
-    if (!fs.existsSync(yamlPath)) {
-        return (0, unified_config_types_1.createEmptyUnifiedConfig)();
-    }
-    const content = fs.readFileSync(yamlPath, 'utf8');
-    const parsed = yaml.load(content);
-    if (!(0, unified_config_types_1.isUnifiedConfig)(parsed)) {
-        throw new Error(`Invalid config format in ${yamlPath}`);
-    }
-    const merged = mergeWithDefaults(parsed);
-    validateCompositeVariants(merged);
-    return merged;
-}
-/**
- * Write unified config to disk while lock is already held.
- */
-function writeUnifiedConfigWithLockHeld(config) {
-    const yamlPath = getConfigYamlPath();
-    const dir = path.dirname(yamlPath);
-    // Ensure directory exists
-    if (!fs.existsSync(dir)) {
-        fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
-    }
-    // Ensure version is set
-    config.version = unified_config_types_1.UNIFIED_CONFIG_VERSION;
-    // Generate YAML with section comments
-    const yamlContent = generateYamlWithComments(config);
-    const content = generateYamlHeader() + yamlContent;
-    // Atomic write: write to temp file, then rename
-    const tempPath = `${yamlPath}.tmp.${process.pid}`;
-    try {
-        fs.writeFileSync(tempPath, content, { mode: 0o600 });
-        fs.renameSync(tempPath, yamlPath);
-    }
-    catch (error) {
-        // Clean up temp file on error
-        if (fs.existsSync(tempPath)) {
-            try {
-                fs.unlinkSync(tempPath);
-            }
-            catch {
-                // Ignore cleanup errors
-            }
-        }
-        // Classify filesystem errors
-        const err = error;
-        if (err.code === 'ENOSPC') {
-            throw new Error('Disk full - cannot save config. Free up space and try again.');
-        }
-        else if (err.code === 'EROFS' || err.code === 'EACCES') {
-            throw new Error(`Cannot write config - check file permissions: ${err.message}`);
-        }
-        throw error;
-    }
-}
 /**
  * Save unified config to YAML file.
  * Uses atomic write (temp file + rename) to prevent corruption.
  * Uses lockfile to prevent concurrent writes.
  */
 function saveUnifiedConfig(config) {
-    withConfigWriteLock(() => {
-        writeUnifiedConfigWithLockHeld(config);
+    (0, io_locks_2.withConfigWriteLock)(() => {
+        (0, io_locks_2.writeUnifiedConfigWithLockHeld)(config, yaml_serializer_2.generateYamlHeader, yaml_serializer_2.generateYamlWithComments);
     });
 }
 exports.saveUnifiedConfig = saveUnifiedConfig;
@@ -991,16 +209,16 @@ exports.saveUnifiedConfig = saveUnifiedConfig;
  * Prevents stale writes from overwriting concurrent updates.
  */
 function mutateUnifiedConfig(mutator) {
-    return withConfigWriteLock(() => {
-        const current = loadUnifiedConfigWithLockHeld();
+    return (0, io_locks_2.withConfigWriteLock)(() => {
+        const current = (0, io_locks_2.loadUnifiedConfigWithLockHeld)(defaults_merger_2.mergeWithDefaults, normalizers_2.validateCompositeVariants);
         const previousBrowser = current.browser
-            ? canonicalizeBrowserConfig(current.browser)
+            ? (0, normalizers_2.canonicalizeBrowserConfig)(current.browser)
             : undefined;
         mutator(current);
         if (current.browser) {
-            current.browser = canonicalizeBrowserConfig(current.browser, previousBrowser);
+            current.browser = (0, normalizers_2.canonicalizeBrowserConfig)(current.browser, previousBrowser);
         }
-        writeUnifiedConfigWithLockHeld(current);
+        (0, io_locks_2.writeUnifiedConfigWithLockHeld)(current, yaml_serializer_2.generateYamlHeader, yaml_serializer_2.generateYamlWithComments);
         return current;
     });
 }
@@ -1015,246 +233,30 @@ function updateUnifiedConfig(updates) {
     });
 }
 exports.updateUnifiedConfig = updateUnifiedConfig;
+// ---------------------------------------------------------------------------
+// Derived helpers
+// ---------------------------------------------------------------------------
 /**
  * Check if unified config mode is active.
  * Returns true if config.yaml exists OR CCS_UNIFIED_CONFIG=1.
- *
- * Use this centralized function instead of duplicating the logic.
  */
 function isUnifiedMode() {
-    return hasUnifiedConfig() || (0, feature_flags_1.isUnifiedConfigEnabled)();
+    return (0, io_locks_2.hasUnifiedConfig)() || (0, feature_flags_1.isUnifiedConfigEnabled)();
 }
 exports.isUnifiedMode = isUnifiedMode;
 /**
- * Get or set default profile name.
+ * Get default profile name from config.
  */
 function getDefaultProfile() {
     const config = loadUnifiedConfig();
     return config?.default;
 }
 exports.getDefaultProfile = getDefaultProfile;
+/**
+ * Set default profile name in config.
+ */
 function setDefaultProfile(name) {
     updateUnifiedConfig({ default: name });
 }
 exports.setDefaultProfile = setDefaultProfile;
-/**
- * Get websearch configuration.
- * Returns defaults if not configured.
- * Supports deterministic providers and optional Gemini/OpenCode/Grok CLI fallbacks.
- */
-function getWebSearchConfig() {
-    const config = loadOrCreateUnifiedConfig();
-    // Build provider configs
-    const exaConfig = {
-        enabled: config.websearch?.providers?.exa?.enabled ?? false,
-        max_results: config.websearch?.providers?.exa?.max_results ?? 5,
-    };
-    const tavilyConfig = {
-        enabled: config.websearch?.providers?.tavily?.enabled ?? false,
-        max_results: config.websearch?.providers?.tavily?.max_results ?? 5,
-    };
-    const duckDuckGoConfig = {
-        enabled: config.websearch?.providers?.duckduckgo?.enabled ?? true,
-        max_results: config.websearch?.providers?.duckduckgo?.max_results ?? 5,
-    };
-    const braveConfig = {
-        enabled: config.websearch?.providers?.brave?.enabled ?? false,
-        max_results: config.websearch?.providers?.brave?.max_results ?? 5,
-    };
-    const searxngConfig = {
-        enabled: config.websearch?.providers?.searxng?.enabled ?? false,
-        url: (0, types_1.normalizeSearxngBaseUrl)(config.websearch?.providers?.searxng?.url) ?? '',
-        max_results: config.websearch?.providers?.searxng?.max_results ?? 5,
-    };
-    const geminiConfig = {
-        enabled: config.websearch?.providers?.gemini?.enabled ?? config.websearch?.gemini?.enabled ?? false,
-        model: config.websearch?.providers?.gemini?.model ?? 'gemini-2.5-flash',
-        timeout: config.websearch?.providers?.gemini?.timeout ?? config.websearch?.gemini?.timeout ?? 55,
-    };
-    const opencodeConfig = {
-        enabled: config.websearch?.providers?.opencode?.enabled ?? false,
-        model: config.websearch?.providers?.opencode?.model ?? 'opencode/grok-code',
-        timeout: config.websearch?.providers?.opencode?.timeout ?? 90,
-    };
-    const grokConfig = {
-        enabled: config.websearch?.providers?.grok?.enabled ?? false,
-        timeout: config.websearch?.providers?.grok?.timeout ?? 55,
-    };
-    // Auto-enable master switch if ANY provider is enabled
-    const anyProviderEnabled = exaConfig.enabled ||
-        tavilyConfig.enabled ||
-        braveConfig.enabled ||
-        searxngConfig.enabled ||
-        duckDuckGoConfig.enabled ||
-        geminiConfig.enabled ||
-        opencodeConfig.enabled ||
-        grokConfig.enabled;
-    const enabled = anyProviderEnabled && (config.websearch?.enabled ?? true);
-    return {
-        enabled,
-        providers: {
-            exa: exaConfig,
-            tavily: tavilyConfig,
-            brave: braveConfig,
-            searxng: searxngConfig,
-            duckduckgo: duckDuckGoConfig,
-            gemini: geminiConfig,
-            opencode: opencodeConfig,
-            grok: grokConfig,
-        },
-        // Legacy field for backwards compatibility
-        gemini: config.websearch?.gemini,
-    };
-}
-exports.getWebSearchConfig = getWebSearchConfig;
-/**
- * Get global_env configuration.
- * Returns defaults if not configured.
- */
-function getGlobalEnvConfig() {
-    const config = loadOrCreateUnifiedConfig();
-    return {
-        enabled: config.global_env?.enabled ?? true,
-        env: config.global_env?.env ?? { ...unified_config_types_1.DEFAULT_GLOBAL_ENV },
-    };
-}
-exports.getGlobalEnvConfig = getGlobalEnvConfig;
-/**
- * Get continuity inheritance mapping.
- * Returns empty mapping when not configured.
- */
-function getContinuityInheritanceMap() {
-    const config = loadOrCreateUnifiedConfig();
-    return config.continuity?.inherit_from_account ?? {};
-}
-exports.getContinuityInheritanceMap = getContinuityInheritanceMap;
-/**
- * Get cliproxy safety configuration.
- * Returns defaults if not configured.
- */
-function getCliproxySafetyConfig() {
-    const config = loadOrCreateUnifiedConfig();
-    return {
-        antigravity_ack_bypass: config.cliproxy?.safety?.antigravity_ack_bypass ??
-            unified_config_types_1.DEFAULT_CLIPROXY_SAFETY_CONFIG.antigravity_ack_bypass,
-    };
-}
-exports.getCliproxySafetyConfig = getCliproxySafetyConfig;
-/**
- * Get thinking configuration.
- * Returns defaults if not configured.
- */
-function getThinkingConfig() {
-    const config = loadOrCreateUnifiedConfig();
-    // W2: Check for invalid thinking config (e.g., thinking: true instead of object)
-    if (config.thinking !== undefined && typeof config.thinking !== 'object') {
-        console.warn(`[!] Invalid thinking config: expected object, got ${typeof config.thinking}. Using defaults.`);
-        console.warn(`    Tip: Use 'thinking: { mode: auto }' instead of 'thinking: true'`);
-        return unified_config_types_1.DEFAULT_THINKING_CONFIG;
-    }
-    return {
-        mode: config.thinking?.mode ?? unified_config_types_1.DEFAULT_THINKING_CONFIG.mode,
-        override: config.thinking?.override,
-        tier_defaults: {
-            opus: config.thinking?.tier_defaults?.opus ?? unified_config_types_1.DEFAULT_THINKING_CONFIG.tier_defaults.opus,
-            sonnet: config.thinking?.tier_defaults?.sonnet ?? unified_config_types_1.DEFAULT_THINKING_CONFIG.tier_defaults.sonnet,
-            haiku: config.thinking?.tier_defaults?.haiku ?? unified_config_types_1.DEFAULT_THINKING_CONFIG.tier_defaults.haiku,
-        },
-        provider_overrides: config.thinking?.provider_overrides,
-        show_warnings: config.thinking?.show_warnings ?? unified_config_types_1.DEFAULT_THINKING_CONFIG.show_warnings,
-    };
-}
-exports.getThinkingConfig = getThinkingConfig;
-/**
- * Get Official Channels configuration.
- * Returns defaults if not configured.
- */
-function getOfficialChannelsConfig() {
-    const config = loadOrCreateUnifiedConfig();
-    return {
-        selected: config.channels?.selected && config.channels.selected.length > 0
-            ? (0, official_channels_runtime_1.normalizeOfficialChannelIds)(config.channels.selected)
-            : unified_config_types_1.DEFAULT_OFFICIAL_CHANNELS_CONFIG.selected,
-        unattended: config.channels?.unattended ?? unified_config_types_1.DEFAULT_OFFICIAL_CHANNELS_CONFIG.unattended,
-    };
-}
-exports.getOfficialChannelsConfig = getOfficialChannelsConfig;
-/**
- * Get dashboard_auth configuration with ENV var override.
- * Priority: ENV vars > config.yaml > defaults
- */
-function isDashboardAuthEnabled() {
-    const envEnabled = process.env.CCS_DASHBOARD_AUTH_ENABLED;
-    if (envEnabled !== undefined) {
-        return envEnabled === 'true' || envEnabled === '1';
-    }
-    const config = loadOrCreateUnifiedConfig();
-    return config.dashboard_auth?.enabled ?? false;
-}
-exports.isDashboardAuthEnabled = isDashboardAuthEnabled;
-/**
- * Get dashboard_auth configuration with ENV var override.
- * Priority: ENV vars > config.yaml > defaults
- */
-function getDashboardAuthConfig() {
-    const config = loadOrCreateUnifiedConfig();
-    // ENV vars take precedence
-    const envEnabled = process.env.CCS_DASHBOARD_AUTH_ENABLED;
-    const envUsername = process.env.CCS_DASHBOARD_USERNAME;
-    const envPasswordHash = process.env.CCS_DASHBOARD_PASSWORD_HASH;
-    return {
-        enabled: envEnabled !== undefined
-            ? envEnabled === 'true' || envEnabled === '1'
-            : (config.dashboard_auth?.enabled ?? false),
-        username: envUsername ?? config.dashboard_auth?.username ?? '',
-        password_hash: envPasswordHash ?? config.dashboard_auth?.password_hash ?? '',
-        session_timeout_hours: config.dashboard_auth?.session_timeout_hours ?? 24,
-    };
-}
-exports.getDashboardAuthConfig = getDashboardAuthConfig;
-/**
- * Get browser automation configuration.
- * Returns canonicalized defaults if not configured.
- */
-function getBrowserConfig() {
-    const config = loadOrCreateUnifiedConfig();
-    return canonicalizeBrowserConfig(config.browser);
-}
-exports.getBrowserConfig = getBrowserConfig;
-/**
- * Get image_analysis configuration.
- * Returns defaults if not configured.
- */
-function getImageAnalysisConfig() {
-    const config = loadOrCreateUnifiedConfig();
-    return (0, image_analysis_backend_resolver_1.canonicalizeImageAnalysisConfig)({
-        enabled: config.image_analysis?.enabled ?? unified_config_types_1.DEFAULT_IMAGE_ANALYSIS_CONFIG.enabled,
-        timeout: config.image_analysis?.timeout ?? unified_config_types_1.DEFAULT_IMAGE_ANALYSIS_CONFIG.timeout,
-        provider_models: config.image_analysis?.provider_models ?? unified_config_types_1.DEFAULT_IMAGE_ANALYSIS_CONFIG.provider_models,
-        fallback_backend: config.image_analysis?.fallback_backend ?? unified_config_types_1.DEFAULT_IMAGE_ANALYSIS_CONFIG.fallback_backend,
-        profile_backends: config.image_analysis?.profile_backends ?? unified_config_types_1.DEFAULT_IMAGE_ANALYSIS_CONFIG.profile_backends,
-    });
-}
-exports.getImageAnalysisConfig = getImageAnalysisConfig;
-function getLoggingConfig() {
-    const config = loadOrCreateUnifiedConfig();
-    return {
-        enabled: config.logging?.enabled ?? unified_config_types_1.DEFAULT_LOGGING_CONFIG.enabled,
-        level: config.logging?.level ?? unified_config_types_1.DEFAULT_LOGGING_CONFIG.level,
-        rotate_mb: config.logging?.rotate_mb ?? unified_config_types_1.DEFAULT_LOGGING_CONFIG.rotate_mb,
-        retain_days: config.logging?.retain_days ?? unified_config_types_1.DEFAULT_LOGGING_CONFIG.retain_days,
-        redact: config.logging?.redact ?? unified_config_types_1.DEFAULT_LOGGING_CONFIG.redact,
-        live_buffer_size: config.logging?.live_buffer_size ?? unified_config_types_1.DEFAULT_LOGGING_CONFIG.live_buffer_size,
-    };
-}
-exports.getLoggingConfig = getLoggingConfig;
-/**
- * Get cursor configuration.
- * Returns defaults if not configured.
- */
-function getCursorConfig() {
-    const config = loadOrCreateUnifiedConfig();
-    return config.cursor ?? { ...unified_config_types_1.DEFAULT_CURSOR_CONFIG };
-}
-exports.getCursorConfig = getCursorConfig;
 //# sourceMappingURL=unified-config-loader.js.map