fix(cliproxy): address code review feedback (attempt 2/5)

- Add tiers shape validation in variant-routes POST/PUT endpoints
- Use process.exit(1) for blocked --config on composite variants

src/cliproxy/executor/index.ts

@@ -432,10 +432,12 @@ export async function execClaudeWithCLIProxy(
       console.log(
         warn('Composite variants use per-tier config. Edit config.yaml to change tier models.')
       );
+      console.error(`    Use "ccs cliproxy edit ${provider}" to modify composite variants`);
+      process.exit(1);
     } else {
       await configureProviderModel(provider, true, cfg.customSettingsPath);
+      process.exit(0);
     }
-    process.exit(0);
   }
 
   // Handle --logout

src/web-server/routes/variant-routes.ts

@@ -75,6 +75,21 @@ router.post('/', (req: Request, res: Response): void => {
       return;
     }
 
+    // Validate tiers shape
+    const requiredTiers = ['opus', 'sonnet', 'haiku'] as const;
+    for (const tier of requiredTiers) {
+      if (
+        !tiers[tier] ||
+        typeof tiers[tier].provider !== 'string' ||
+        typeof tiers[tier].model !== 'string'
+      ) {
+        res.status(400).json({
+          error: `Invalid tier config for '${tier}': requires 'provider' and 'model' strings`,
+        });
+        return;
+      }
+    }
+
     const result = createCompositeVariant({ name, defaultTier: default_tier, tiers });
 
     if (!result.success) {
@@ -147,6 +162,23 @@ router.put('/:name', (req: Request, res: Response): void => {
         return;
       }
 
+      // Validate tiers shape if provided
+      if (tiers) {
+        const requiredTiers = ['opus', 'sonnet', 'haiku'] as const;
+        for (const tier of requiredTiers) {
+          if (
+            !tiers[tier] ||
+            typeof tiers[tier].provider !== 'string' ||
+            typeof tiers[tier].model !== 'string'
+          ) {
+            res.status(400).json({
+              error: `Invalid tier config for '${tier}': requires 'provider' and 'model' strings`,
+            });
+            return;
+          }
+        }
+      }
+
       const result = updateCompositeVariant(name, { defaultTier: default_tier, tiers });
 
       if (!result.success) {