fix(cli): document gitlab shortcut flags and harden cursor routing

tests/npm/cli.test.js

@@ -99,6 +99,20 @@ describe('npm CLI', () => {
         assert(output.includes('Cursor Live Probe'), 'Should render the cursor probe command output');
       }
     });
+
+    it('routes gitlab --help to provider shortcut help instead of starting auth', function() {
+      const output = execSync(`bun "${srcCcsPath}" gitlab --help`, {
+        encoding: 'utf8',
+        timeout: 3000,
+        env: { ...process.env, CCS_HOME: testCcsHome }
+      });
+
+      assert(output.includes('CCS gitlab Shortcut Help'), 'Should render provider shortcut help');
+      assert(output.includes('--gitlab-token-login'), 'Should document canonical GitLab PAT flag');
+      assert(output.includes('--token-login'), 'Should document legacy GitLab PAT alias');
+      assert(output.includes('--gitlab-url <url>'), 'Should document self-hosted GitLab URL flag');
+      assert(!output.includes('Starting GitLab Duo OAuth'), 'Should not start OAuth when help is requested');
+    });
   });
 
   describe('Profile handling', () => {

tests/unit/commands/help-command-parity.test.ts

@@ -53,6 +53,9 @@ describe('help command parity', () => {
     expect(rendered.includes('gitlab')).toBe(true);
     expect(rendered.includes('codebuddy')).toBe(true);
     expect(rendered.includes('kilo')).toBe(true);
+    expect(rendered.includes('--gitlab-token-login')).toBe(true);
+    expect(rendered.includes('--token-login')).toBe(true);
+    expect(rendered.includes('--gitlab-url <url>')).toBe(true);
   });
 
   test('kiro topic documents IDC and callback flags', async () => {

tests/unit/cursor/cursor-shortcut-routing.test.ts

@@ -0,0 +1,15 @@
+import { describe, expect, it } from 'bun:test';
+import { shouldUseCursorCliproxyShortcut } from '../../../src/cursor/constants';
+
+describe('cursor CLIProxy shortcut routing', () => {
+  it('accepts shortcut flags after leading generic flags', () => {
+    expect(shouldUseCursorCliproxyShortcut(['cursor', '--auth'])).toBe(true);
+    expect(shouldUseCursorCliproxyShortcut(['cursor', '--verbose', '--auth'])).toBe(true);
+    expect(shouldUseCursorCliproxyShortcut(['cursor', '-v', '--accounts'])).toBe(true);
+  });
+
+  it('stops scanning once a positional legacy runtime argument appears', () => {
+    expect(shouldUseCursorCliproxyShortcut(['cursor', 'write', '--auth'])).toBe(false);
+    expect(shouldUseCursorCliproxyShortcut(['cursor', 'status'])).toBe(false);
+  });
+});