Commit Graph
814 Commits
Author SHA1 Message Date
BeeandSaoud Rizwan 6d7e745fb7 feat(core, llms): add provider-aware web search tools (#13075)
* feat(core, llms): Cline custom provider & web search

* fix(llms): preserve reasoning model token parameter

* fix(llms): keep ClinePass provider options on the wire in the shared Cline provider

The shared Cline provider hardcoded the AI SDK provider name to "cline",
but the openai-compatible model reads request-body passthrough options from
providerOptions[<name>]. Option routing emits ClinePass options under the
"cline-pass"/"clinePass" buckets, so gateway reasoning (extended thinking
budgets) silently stopped reaching the wire for cline-pass after it moved
off the generic openai-compatible module.

Thread the gateway provider id through as the provider name, and restore
strictJsonSchema: false for the new "cline" provider-options target so the
wire format matches the previous openai-compatible behavior. Add cline-pass
coverage at both the option-routing and request-body levels.

* feat(sdk): persist provider-executed tool activity (#13077)

* feat(core, llms): Cline custom provider & web search

* fix(llms): preserve reasoning model token parameter

* feat(sdk): persist provider-executed tool activity

* fix(vscode): restore state proto and settings section reverted by merge

The merge of origin/bee/websearch into this branch resolved conflicts by
keeping this branch's pre-#13126 copies of apps/vscode files, which
deleted the auto_approve_all_toggled = 174 proto field (without reserving
the number) and dropped a formatting line in FeatureSettingsSection.tsx.
Neither file is in scope for this PR. Restore both to main's content so
the proto source matches the checked-in generated code again.

* chore(vscode): match main byte-for-byte in FeatureSettingsSection.tsx

The pre-commit biome hook strips a blank line that exists on main, which
kept this out-of-scope file in the PR diff. Commit the exact main content
with --no-verify so the PR no longer touches apps/vscode at all.

---------

Co-authored-by: Saoud Rizwan <7799382+saoudrizwan@users.noreply.github.com>

* refactor(llms): key ClinePass provider options to the shared cline bucket

Both Cline gateway ids (cline and cline-pass) are served by the same
shared "cline" AI SDK provider and hit the same Cline API, so threading
the gateway provider id through as the AI SDK provider name (78dc6f3e7)
was unnecessary indirection. Revert the name threading and instead
normalize option-routing bucket keys: buildProviderAndAliasPatch now
keys both Cline gateway ids to the shared "cline" providerOptions
bucket, which is the only bucket the openai-compatible model reads for
request-body passthrough.

Also tighten the regression coverage that motivated the original fix:
the previous effort-based test rows were vacuously satisfied through the
portable-reasoning early return (effort reasoning never reaches provider
option buckets by design). The rows now use explicit reasoning budgets,
which do flow through the gateway bucket path, and the wire-level test
composes real provider options end to end instead of hand-feeding
buckets.

* revert(llms): drop the cline strictJsonSchema special case in generic-compatible

Restores buildCompatibleProviderOptions to its pre-78dc6f3e7 state. The
strictJsonSchema passthrough is verified inert for the gateway (nothing
in @cline/llms sets a response format), so keeping a hardcoded provider
target in the generic helper bought nothing. If structured outputs are
ever added, strictness for the cline target can be decided deliberately
then.

* fix(llms): claim native web search for openai-native, not the openai alias

supportsModelTool listed "openai", but that id aliases to
openai-compatible (PROVIDER_ID_ALIASES), whose module has no native web
search. The actual native OpenAI builtin id is "openai-native", which is
served by the OpenAI Responses module that does implement
buildModelTools with provider.tools.webSearch(). Without this, the
web_search tool was never offered to native OpenAI users, and was
wrongly offered for the compatible alias.

* refactor(llms): declare model tools in provider manifests

* feat(sdk): project provider tool activity in session history

---------

Co-authored-by: Saoud Rizwan <7799382+saoudrizwan@users.noreply.github.com>
2026-08-13 18:12:10 -07:00
Saoud Rizwan 354c80df7b fix(llms): update AI SDK deps so streamed tool calls with non-zero indexes don't crash (hasFinished) (#13123)
* fix(llms): update AI SDK deps to fix streamed tool calls with non-zero indexes

LiteLLM's Anthropic passthrough emits chat-completions tool_call deltas
whose index mirrors the Anthropic content-block index (1 when a text
block precedes the tool call; see BerriAI/litellm#11580).
@ai-sdk/provider-utils 5.0.18 stored streamed tool calls in a sparse
array keyed by that index and crashed at stream flush with
"Cannot read properties of undefined (reading 'hasFinished')",
aborting the agent turn. Upstream fixed this in provider-utils 5.0.21
("Fix streamed tool calls with non-zero, non-contiguous, reused, or
missing indexes.").

Update the ai / @ai-sdk packages so every chat-completions streaming
path resolves @ai-sdk/provider-utils 5.0.25, and drop the root
">=4.0.0" override on @ai-sdk/provider-utils: with intersect semantics
it pinned the workspace to the already-locked 5.0.18 even after parents
began requiring 5.0.25, and it force-upgraded dify-ai-provider two
majors past its declared ^3 range. Each package now resolves the
version line it declares.

Fixes #13119

* test(llms): pin non-zero streamed tool_call index regression (#13119)

Wire-level regression test: an openai-compatible SSE stream whose only
tool_call delta carries index 1 (Anthropic content-block numbering via
LiteLLM) must complete and emit the tool-call part instead of throwing
at flush.

* fix: address review findings from merge-conflict resolution

- Restore apps/vscode/proto/cline/state.proto to main's version: the
  merge commit's pre-commit hook regenerated it with a stale generator,
  deleting auto_approve_all_toggled = 174 and moving a reserved line,
  creating drift against the checked-in descriptor. The deletion was
  never intended.
- Restore FeatureSettingsSection.tsx to main's version (the same hook
  reformatted main's file during the merge).
- Regenerate bun.lock narrowly from main's lockfile without --force so
  the diff contains only the @ai-sdk family and its direct transitives;
  drop the spurious webview-ui-scoped @radix-ui duplicate entries the
  previous install introduced (hoisted resolutions still satisfy
  webview-ui's unchanged ranges; verified with --frozen-lockfile).
- Align @ai-sdk/provider to ^4.0.7 in @cline/llms to match the rest of
  the AI SDK family and avoid parallel provider resolutions.

Revalidated: wire repro streams to finishReason=tool-calls, @cline/llms
suite passes incl. the index-1 regression test, all workspaces
typecheck, SDK builds clean.

* fix: restore FeatureSettingsSection.tsx to main's formatting

The branch's pre-commit biome hook (--semicolons=as-needed, --write
--staged) strips a blank line from this file whenever it is staged,
which is how the unintended diff appeared in the merge commit. Commit
with --no-verify to keep the file byte-identical to main; this PR does
not touch the VS Code webview.
2026-08-12 11:30:42 -07:00
BeeandSaoud Rizwan 400ba47387 fix(llms): switch ollama provider package (#12892)
* fix(ollama): use native AI SDK provider

* fix(ollama): patch ollama-ai-provider-v2 wire contracts and lock them with real-provider tests

The pinned ollama-ai-provider-v2@4.0.1 breaks four native Ollama wire
contracts (review findings on #12892). Patch the package via Bun
patchedDependencies:

- omit think from the request when no reasoning setting resolves,
  instead of forcing think: false (lets the server default apply)
- surface mid-stream {"error": ...} objects as error stream parts with
  an error finish reason, instead of dropping them before a clean finish
- serialize attachment-only user turns as string content (""), not []
- include the documented tool_name field on tool result messages

Add ollama.wire.test.ts exercising doStream through the vendor module
against the real (patched) package with a stubbed fetch, asserting on
the actual /api/chat request bodies and parsed stream so regressions in
the dependency's request converter or stream parser are caught.

* fix ollama model list refresh

---------

Co-authored-by: Saoud Rizwan <7799382+saoudrizwan@users.noreply.github.com>
2026-08-04 13:28:53 -07:00
3520786f4a security: hygiene sweep — docs pin lifts, example next bump, workspace overrides (closes ~153 Vanta findings) (#12749)
* security: docs/examples/tooling hygiene sweep — lift fix-blocking pins, bump example next, workspace overrides

VMP 2026-07-30 quarterly run, PR 3 of the condensed worklist (closes ~153 Vanta findings).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* chore(deps): refresh lockfiles for security updates

* fix(deps): keep Discord on patched Undici 6

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: Cline Agent <cline-agent@users.noreply.github.com>
2026-08-03 17:21:03 -07:00
Dominic CooneyandCline Agent 98024c4243 fix(cli): patch @opentui-ui/dialog for opentui 0.4.x remove() contract (#12516)
@opentui-ui/dialog@0.1.2 is built against @opentui/core ^0.1.69, whose
Renderable.remove(id) took a string id. Core 0.4.x renamed it to
remove(child) and throws when handed anything but a renderable, so the
dialog package's removeDialog()/provider teardown aborted before
detaching the panel: the React portal content unmounted but the
imperative grey box stayed on screen over the chat after every dialog
close (model picker, help, command palette, ...).

The upstream package is abandoned at 0.1.2, so pin the fix with a bun
patch that passes the renderable object on all three bindings (react,
solid, core container). A tui-test opens and dismisses the help dialog
and asserts the panel's #262626 background is fully gone, not just its
text.

Fixes #12506

Co-authored-by: Cline Agent <cline-agent@users.noreply.github.com>
2026-07-24 15:18:15 +09:00
TheRealSpencer 48d0c38f52 fix(security): bump axios to 1.18.0 to resolve multiple CVEs in axios (#12473)
* fix(security): bump axios to 1.18.0 to resolve multiple CVEs in axios

* fix(security): bump axios to 1.18.0 in docs project
2026-07-22 12:38:45 -05:00
Saoud Rizwan 22a1fa2c84 feat(cli): upgrade opentui 0.1.102 -> 0.4.3 (#12453)
* feat(cli): upgrade opentui 0.1.102 -> 0.4.3

Brings the TUI stack up from April's 0.1.102 to the current 0.4.x line
(0.4.4/0.4.5 are <7 days old and blocked by the registry release-age
gate; bump again once they age out).

- @opentui/core + @opentui/react 0.1.102 -> 0.4.3
- opentui-spinner ^0.0.6 -> ^0.0.7 (0.0.7 peers on @opentui/core ^0.3.4)
- react-reconciler pin 0.32.0 -> 0.33.0 to match @opentui/react 0.4.x

@opentui-ui/dialog stays at 0.1.2 (abandoned upstream, peers ^0.1.69 so
bun warns on install) but its runtime surface (DialogProvider,
useDialog, useDialogKeyboard) works against core 0.4.3 - the tui-test
command-palette spec renders a real dialog in a pty and passes.

Validation: tsc clean, unit 889/890 (the one failure repros on an
untouched main checkout - stale bun pm pack guard expectation), tui-test
62/62 across repeated runs.

* fix(cli): force single opentui generation via root overrides

The previous commit left @opentui-ui/dialog's ^0.1.69 peer range
unsatisfied by core/react 0.4.3, so bun recorded nested
@opentui/core@0.1.102 + @opentui/react@0.1.102 copies under the dialog
package in bun.lock. Local installs happened to link the dialog against
the hoisted 0.4.3 store variant (which is why tui-test passed), but a
fresh install from the lockfile - CI, release builds - would follow the
nested entries and run two renderer generations in one process: dialog
components extending 0.1.102 Renderable classes inside a 0.4.3 renderer
tree.

Pinning @opentui/core and @opentui/react in the root overrides block
forces every consumer, dialog included, onto 0.4.3. The nested lockfile
entries are gone and a runtime identity check confirms
DialogContainerRenderable's prototype chain reaches the same class
objects as the 0.4.3 core the app imports.

Side effect: changing overrides makes bun fully re-resolve the
lockfile. The only drift is ~108 @radix-ui entries nested under the
vscode webview-ui workspace moving to newer patch versions (~1.1.15 ->
~1.1.19); webview-ui's full build (tsc -b && vite build) passes with
them. This drift would land at the next release anyway since bun run
version deletes and re-resolves bun.lock.

Re-validated: tsc clean, tui-test 62/62, unit 889/890 (same single
pre-existing bun pm pack guard failure that repros on untouched main).
2026-07-21 14:49:26 -07:00
TheRealSpencer 0912f34286 fix(deps): bump mermaid to 11.16.0 and protobufjs to 7.6.5 (#12445)
Address mermaid CVEs (CVE-2026-41148/41149/41150/41159) and
protobufjs CVEs (CVE-2026-54269, CVE-2026-48712) by pinning
patched versions via package deps and workspace overrides.
2026-07-21 15:38:59 -05:00
Saoud RizwanandDavid Knaack 352a23a6da fix: stabilize SAP AI Core provider setup (#11833)
* fix: Filter SAP AI Core models based on mode-availibility

* chore: fix model picker test

* fix: harden SAP AI Core model filtering

* fix: pin SAP Cloud SDK to 4.6.0

* fix(vscode): simplify SAP AI Core model filtering

---------

Co-authored-by: David Knaack <david.knaack@sap.com>
2026-06-25 12:13:53 -07:00
Dominic Cooney f4a46cf8e7 fix(deps): drop global vite override so cline-hub webview keeps vite 8
The bun migration relocated apps/vscode/webview-ui overrides to the root
package.json, including vite ^7.1.11. As a workspace-wide override this
forced vite 7 onto apps/cline-hub/src/webview, which targets vite 8 and
uses rolldownOptions in its vite.config.ts. That broke `bun run -F
@cline/cli build` (cline-hub build:webview) with TS2769 on rolldownOptions.

Removing the global override lets each workspace resolve its declared
vite: webview-ui stays on vite 7.3.5, cline-hub resolves vite 8.0.16.
Both webviews build and the webview-ui vitest suite (247 tests) passes.
2026-06-24 14:36:34 +09:00
Dominic CooneyandCline Agent 82d1846a45 Migrate apps/vscode from npm/node to bun (#11632)
* chore(vscode): migrate package management & build from npm/node to bun

Fold apps/vscode (+ webview-ui, testing-platform) into the root bun
workspace so the extension consumes the local @cline/* SDK packages via
workspace symlinks instead of pinned published versions, eliminating the
SDK vendoring cycle. Node remains the runtime (extension host, standalone
cline-core, esbuild platform:node, prebuild-install ABI target).

- root: drop "!apps/vscode", add nested members, relocate overrides to
  root, add trustedDependencies [better-sqlite3, grpc-tools]
- apps/vscode: @cline/* -> workspace:*, scripts -> bun/bunx,
  npm-run-all -> bun --parallel, drop cross-env; keep esbuild + vite;
  declare previously-hoisted phantom deps (nice-grpc-common, playwright)
- package-standalone.mjs: npm install -> bun install (isolated dist dir)
- CI: setup-bun + single root bun install --frozen-lockfile, build:sdk
  before extension build, better-sqlite3 binary + zero-test guards;
  publish workflows intentionally keep setup-node for vsce/ovsx
- docs/comments: curated pass (keep-list vs rewrite-list), add
  apps/vscode/docs/bun-migration-notes.md guard doc
- delete npm lockfiles (root bun.lock authoritative)

Deferred to follow-up PRs: test-runner migration to bun test (Phase 4)
and devDep cleanup (Phase 6).

* test(vscode): add bun test foundation for the vitest-native unit suites

Phase 4a of the test-runner migration. Adds a bun test runner that
reaches full parity (582 pass / 0 fail / 50 files) with the existing
vitest SDK-adapter + model-catalog suite, without touching the
@vscode/test-cli integration tests or the webview vitest suite.

- bunfig.toml: [test] preload
- src/test/bun-test-preload.ts: mock.module() shadows `vscode` and
  `@cline/core` with their unit-test stubs (bun's onResolve plugin hook
  does not intercept host/symlinked specifiers); seeds real @cline/core
  export names as undefined to satisfy bun's strict ESM named-import
  linking; full vitest->bun:test shim (vi.fn/mocked/spyOn, describe/it/
  expect/before*/after*)
- scripts/run-bun-tests.ts: mirrors vitest.config.ts include[] exactly and
  runs with --parallel for per-file mock isolation (bun test's single-process
  default lets mock.module clobber across files)
- test:bun script

* test(vscode): migrate node-side unit suite from mocha to bun test

Phase 4b of the test-runner migration. The standalone mocha unit runner
(.mocharc spec: __tests__/* + test/services/**) was already broken under
bun (mocha was a phantom dependency — only @types/mocha/ts-node were
declared, npm hoisted mocha transitively). Migrate it to `bun test`.

- codemod 77 files: import { ... } from "mocha" -> "bun:test", renaming
  before->beforeAll / after->afterAll at imports and call-sites; chai,
  should and sinon kept as libraries (they work under bun test)
- convert sinon.stub() on ESM namespace exports to mock.module()/spyOn
  (bun loads real ESM: "ES Modules cannot be stubbed")
- scripts/run-bun-unit-tests.ts: runs the .mocharc spec set with one
  isolated `bun test` process per file (Bun.spawn + concurrency pool),
  restoring vitest-forks module-registry isolation (bun's single-process
  default lets mock.module leak across files)
- scripts/codemod-mocha-{to-bun,this}.ts: one-shot migration tooling
- test:unit now runs the bun unit runner; CI calls bun + a non-zero
  pass-count guard instead of `bunx nyc ... mocha`
- tsconfig: add root node_modules/@types to typeRoots so `bun:test`
  types resolve under tsc; cast loose os.userInfo mocks in shell.test

Result: unit suite 58 files / 880 pass / 0 fail; vitest set still
582/0. @vscode/test-cli integration tests and webview vitest unchanged.

* chore(vscode): remove dead mocha-runner deps and artifacts

Phase 6 cleanup after the bun test migration. The standalone mocha unit
runner is gone (replaced by scripts/run-bun-unit-tests.ts), so its
config and now-unused devDependencies are removed.

- remove dead files: .mocharc.json, tsconfig.unit-test.json,
  src/test/requires.ts, .nycrc.unit.json
- remove unused devDeps: @types/mocha, @types/proxyquire, ts-node,
  tsconfig-paths, cross-env, npm-run-all, nyc, proxyquire, husky
  (root owns the husky hook; chai/should/sinon stay — used as libs)
- install:all -> single root `bun install` (workspace covers webview-ui)
- drop .mocharc.json / .nycrc*.json from CI paths-filters and
  .vscodeignore; add bunfig.toml to the filters

Verified: check-types clean, unit 880/0, vitest 582/0.

* fix(vscode): import bun:test globals in tests that relied on ambient @types/mocha

CI Quality Checks (clean `bun install` without @types/mocha) surfaced
TS2582/TS2304 "Cannot find name 'describe'/'it'/'beforeEach'" in test
files that used the global mocha/jest test functions without importing
them. The Phase 4b codemod only rewrote files that imported from
"mocha"; these used ambient globals, so they were missed (and passed
locally because a stale @types/mocha lingered in node_modules).

Add explicit `bun:test` imports (before->beforeAll, after->afterAll in
TelemetryService.test.ts). chai/sinon stay as libraries.

Verified against a clean tree (no @types/mocha): check-types 0 errors,
unit suite 58 files / 880 pass / 0 fail.

* style(vscode): biome-format migrated test files + codemod scripts

The mocha->bun:test codemod and manual import edits left formatting that
didn't match biome (the CI `format` check, which validates files changed
since main, flagged them). Also narrow setup.ts's bun:test import to the
actually-used beforeEach/afterEach (describe/it only appear in a JSDoc
example), fixing a noUnusedImports lint error.

ci:check-all (check-types + lint + format) now passes locally.

* fix(webview-ui): declare phantom deps + pin React 18 types under bun workspace

Folding webview-ui into the bun workspace changed its install topology
from an isolated npm flat tree to the shared hoisted store, surfacing
two classes of pre-existing latent issues that npm hoisting had masked:

1. Phantom dependencies: src imports `marked`, `unist`, `unist-util-visit`
   and `@heroui/theme` directly but never declared them. Declared them
   (marked ^15, unist-util-visit ^5, @types/unist ^3, @heroui/theme 2.4.26).
2. React types: @testing-library/react's optional peer pulls @types/react@19
   into a resolvable location; tsc mixed it with the toolkit's React 18
   types (React 19 dropped Component.refs), breaking 452 JSX usages. Pin
   react/react-dom type resolution to webview-ui's React 18 copy via
   tsconfig paths.

build:webview (tsc -b && vite build) and ci:check-all now pass.

* fix(vscode): restore @types/mocha for integration build + add bun:test types

The @vscode/test-cli integration runner still uses mocha, and
tsconfig.test.json compiles all src/**/*.test.ts (including bun-migrated
files) to out/. So:
- restore @types/mocha (integration compile needs the mocha ambient types)
- add `bun` to tsconfig.test.json types + root @types to both tsconfig
  typeRoots so `bun:test` resolves under tsc for the migrated tests

* fix(vscode): declare glob — phantom dep used by package-standalone.mjs

scripts/package-standalone.mjs imports `glob` but it was never declared
(resolved transitively under npm's flat hoist). Under the bun workspace
store it's unresolvable, failing postcompile-standalone with
ERR_MODULE_NOT_FOUND. Declare glob ^11 (modern named-export API).

compile-standalone now produces dist-standalone/standalone.zip.

* fix(ci): strip ANSI before vitest zero-test guard grep

The vitest summary line colorizes the count ("Tests  <ansi>582 passed"),
so the count isn't adjacent to the "Tests" label in raw bytes and the
guard regex failed even though 582 tests passed. Strip ANSI escapes
before matching.

* fix(vscode): declare minimist — phantom dep in testing-platform-orchestrator

scripts/testing-platform-orchestrator.ts imports `minimist` (undeclared,
resolved transitively under npm hoist). Declare it so the testing-platform
integration job runs under the bun workspace store.

* fix(vscode): restore tsconfig-paths for integration runner; tp-orchestrator uses bun

Phase 6 over-removed tsconfig-paths: test-setup.js (loaded by the
@vscode/test-cli mocha integration runner) requires it to resolve @/
aliases in the compiled out/ tree — the extension host test runner failed
with "Cannot find module 'tsconfig-paths'". Restore it. Also switch the
testing-platform spawn from `npx ts-node index.ts` to `bun index.ts`
(bun runs TS natively; avoids the removed ts-node).

* fix(vscode): route tests by bun:test import marker; integration runner stays mocha

The mocha->bun codemod swept up tests that the Node-based @vscode/test-cli
integration runner compiles/runs, which cannot load the `bun:test` builtin
(and some need the real VSCode host). Establish a single source of truth:
a *.test.ts is bun-runner-owned IFF it imports "bun:test".

- run-bun-unit-tests.ts: discover files by the bun:test import marker
  (not fixed globs), so every migrated file runs under bun.
- build-tests.js: generate a tsconfig that excludes all bun:test files
  from the integration compile (json5-parsed), so out/ never contains
  bun:test; gitignore the generated config.
- .vscode-test.mjs: exclude the bun unit dirs from the runner globs.
- revert host-dependent tests (hostbridge/*, extension, terminal,
  FileContextTracker host bits) and 3 files with sinon-on-ESM/behavioral
  issues (ClineIgnoreController, mentions, TelemetryService) back to
  mocha; they run on @vscode/test-cli as before.

Verified: check-types 0 errors; compile-tests 0 bun:test in out/;
bun unit 65 files/962 pass/0 fail; vitest 582/0.

* fix(vscode): declare mocha — phantom dep for @vscode/test-cli integration runner

The @vscode/test-cli extension host loads `mocha` at runtime to run the
integration suite, but only @types/mocha was declared (npm hoisted the
mocha package transitively; bun's store does not expose it). The host
failed with "Cannot find module 'mocha'". Declare mocha ^11.7.4 (matches
@vscode/test-cli's own range).

* fix(vscode): robust Windows protoc-gen-ts_proto plugin resolution under bun

build-proto.mjs hardcoded node_modules/.bin/protoc-gen-ts_proto.cmd for
Windows, but bun's workspace store places/extensions the bin shim
differently (hoist + .cmd/.bunx), so Windows protos failed with
"protoc-gen-ts_proto: The system cannot find the file specified". Probe
the local + root .bin with known shim extensions instead. Also update
the testing-platform usage string (ts-node -> bun).

* fix(vscode): generate node .cmd wrapper for ts-proto plugin on Windows

The previous probe found bun's `.bunx` shim, but protoc cannot exec it
("%1 is not a valid Win32 application"). Instead, on Windows generate a
small .cmd wrapper that runs the resolved protoc-gen-ts_proto JS via
`node`, which protoc can execute regardless of package manager. POSIX
path (direct JS bin) is unchanged.

* fix(vscode): package VSIX with --no-dependencies (bundled) to stop monorepo traversal

Under the bun workspace, @cline/* are workspace:* symlinks pointing to
../../../../sdk/packages/*. vsce, walking the dependency tree, followed
them out of apps/vscode and packaged the whole monorepo (../, ~84MB incl.
root node_modules and .env), which crashed vsce's secret scanner and
failed all e2e jobs.

The extension is fully esbuild-bundled into dist/extension.js, so vsce
should not walk node_modules at all. Add --no-dependencies to every
vsce/ovsx package/publish path (e2e build, marketplace, nightly), and
tighten .vscodeignore to drop nested node_modules and dev-only inputs
(scripts, proto, testing-platform, bunfig, esbuild.mjs, etc.).

Result: VSIX is 39 files / ~7 MB and the secret scan passes.

* docs(vscode): tighten bun/node comments and consolidate into a clinerule

- add .clinerules/bun-and-node.md (eternal-now: bun=tooling, node=runtime,
  keep-list, and the bun:test-vs-mocha test routing rule); remove the
  apps/vscode/docs/bun-migration-notes.md migration doc and point
  .clinerules/general.md at the rule (single-line bullet matching the file).
- fix the hotfix-release note: there is no infra step that regenerates the
  lockfile; a CHANGELOG+version bump leaves bun.lock consistent (workspace
  versions aren't pinned) and publish runs --frozen-lockfile.
- reframe runner/preload comments to describe the code as-is (drop
  "migrated off mocha"/codemod history); add a TODO on the bun-test preload
  to migrate suites off the vitest `vi` shim to native bun:test and delete it.
- remove the one-shot mocha->bun codemod scripts.

* fix(debug-harness): pin debugee VSCode version so bundled Playwright can drive it

The harness downloaded "stable" VSCode (currently 1.125 / Electron 42),
which the bundled Playwright cannot drive — `_electron.launch()` hangs
until its 60s timeout (Electron started and a window appeared, but the
launch handshake never completed). Default to a known-good version
(1.103.0, matching the e2e CI matrix) and allow override via
VSCODE_TEST_VERSION.

* fix(webview): render under bun workspace — dedupe React, drop stale codicons link

The webview mounted but crashed before rendering (blank sidebar; e2e
"Login to Cline" never visible) with "Cannot read properties of null
(reading 'useRef')" — the classic two-React-copies / null hook dispatcher.
Under the bun workspace, sibling packages pull react@19 into the shared
store and a transitive webview dep resolved a second React instance into
the vite bundle. Add resolve.dedupe + pin react/react-dom to webview-ui's
own React 18 copy.

Also drop the separate `<link>` to node_modules/@vscode/codicons in the
webview HTML: the webview's index.css already @imports codicons, so the
font is bundled into the build assets. Under bun that node_modules path
is a symlink to the root store (outside the webview localResourceRoots)
and isn't packaged with --no-dependencies, so the link 404'd; the bundle
covers it. Re-scope the .vscodeignore nested-node_modules exclude so it
no longer shadows the codicons re-include.

* fix(debug-harness): disable GPU so the debugee renders in headless/VM envs

On headless/VM GPU stacks the debugee Electron's GPU process crash-loops
("Exiting GPU process during initialization" / CreateCommandBuffer
kTransientFailure), killing the window before Playwright finishes
attaching and tripping the 60s launch timeout. Force software rendering
(--disable-gpu and friends) for a stable harness launch.

* fix(debug-harness): survive launch failures; configurable, longer launch timeout

The harness crashed (whole bun process exited) whenever VSCode launch
failed/timed out: Playwright emits a late unhandled rejection on the dead
CDP transport after we've already handled the launch error, and the
default behavior takes the HTTP server down with it — forcing a full
restart just to retry.

- Add process-level unhandledRejection/uncaughtException guards so stray
  async errors are logged and the server keeps serving (retry via `launch`).
- On launch failure, close the orphaned Electron so a retry isn't blocked.
- Make the _electron.launch timeout configurable (--launch-timeout) and
  raise the default to 120s for cold launches; document VSCODE_TEST_VERSION.

* fix(ci): address review feedback — vsix --no-dependencies, drop stale coverage path, Windows shell

- ext-vscode-publish-stable.yml: add --no-dependencies to the release-artifact
  `vsce package` (Max's catch). Without it, vsce follows the @cline/* workspace
  symlinks out of the package and bloats the .vsix with the whole monorepo.
- ext-vscode-test.yml: drop the stale apps/vscode/coverage-unit/lcov.info upload
  path (Max's catch). That file was produced by the removed nyc unit-coverage
  step (.nycrc.unit.json); nothing generates it now.
- ext-vscode-test-e2e.yml: the better-sqlite3 assert step ran under the Windows
  runner's default pwsh and failed to parse the POSIX test. Pin it to `shell: bash`
  (Git Bash ships on windows-latest); the non-e2e job already defaults to bash.

---------

Co-authored-by: Cline Agent <cline-agent@users.noreply.github.com>
2026-06-24 14:11:34 +09:00
Saoud Rizwan a51b156383 feat(cli): add hub primitive catalogs (#11624)
* feat(cli): add hub marketplace

* chore(cli): clean up marketplace install code

* fix(cli): harden marketplace review issues

* feat(cli): add marketplace uninstall actions

* fix(cli): keep marketplace dialog actions in sync

* fix(cli): uninstall marketplace cards directly

* fix(cli): hide stale marketplace installed notice

* feat(cli): split hub marketplace pages

* fix(cli): show full marketplace descriptions

* fix(cli): avoid duplicate marketplace descriptions

* fix(cli): support marketplace deep refreshes

* fix(cli): hide marketplace placeholder icons

* fix(cli): remove marketplace card icons

* fix(cli): ignore featured marketplace entries

* chore(cli): clean marketplace follow-up code

* fix(cli): address marketplace review findings
2026-06-17 17:17:38 -07:00
Tomás Barreiro 38e5b7c26b Fix VSCode CI (#11236)
* Fix VSCode CI

* fix nightly publish

* Fix install

* Fix biome

* fix tsc

* Fix windows set-up

* Ignore .vscode-test

* Add a LICENSE to the vscode extension

* Add type roots

* Remove workspaces

* remove vscode as a bun workspace
2026-06-03 18:58:27 +02:00
Tomás BarreiroandSaoud Rizwan 220a21bdcf Move sdk/apps/ to apps/ (#11200)
* Move the apps to the root dir

* Update all references from sdk/apps/ to apps/

* Update dependencies

* Install bun types

* Fix types

* Fix types

* Fix linter

* Ingore apps from vscode

* Fix security warning

* Fix windows install

* Enable windows dev mode

* Revert "Enable windows dev mode"

This reverts commit a46c99282e.

* Revert "Ingore apps from vscode"

This reverts commit 47f7b265d2.

* Revert "Fix windows install"

This reverts commit 1dabba1556.

* update the repo root

* fix root dir

* fix path

* fix other path

* Fix unrelated changes

* fix: address apps move follow-up blockers (#11228)

* fix: update root app command paths

* fix: include moved apps in root checks

* fix: clean up moved app path references

---------

Co-authored-by: Saoud Rizwan <7799382+saoudrizwan@users.noreply.github.com>
2026-06-03 01:49:57 +02:00
Tomás Barreiro d7cc9b6155 Move bun from the sdk/ to root (#11104)
* Move bun to root

* Fix scripts and pre-commit

* Update scripts

* Update workflows

* Fix cd

* fix pre-commit

* fix cli publish
2026-06-01 22:29:41 +02:00
Tomás BarreiroandSaoud Rizwan 791d238996 Move vscode to apps (#10961)
* Move all vscode related files to /apps/vscode

* Fix launch and biome

* Ignore generated files

* Remove unused icons

* fix tsconfig

* Update workflows (#10962)

* Add default branch

* Move files to the right dir

* fix: add vscode publish README placeholder

---------

Co-authored-by: Saoud Rizwan <7799382+saoudrizwan@users.noreply.github.com>
2026-05-25 21:35:59 +02:00
Ara 9ee618111d bump version and update changelog (#11036) 2026-05-25 10:47:32 -07:00
TheRealSpencer a66c5ee973 chore(deps): pin protobuf to 7.5.8 via overrides (#10998) 2026-05-22 15:11:06 -07:00
Tomás Barreiro b601b6e623 Update diff to 8.0.4 (#10904)
* Update diff to 8.0.4

* Remove types diff
2026-05-19 21:30:18 +02:00
MaxandMax Paulus 🥪 2e8579ebec bump version and update changelog (#10898)
Co-authored-by: Max Paulus 🥪 <max@cline.bot>
2026-05-19 09:54:36 -07:00
Saoud Rizwan 1f5e2086a1 chore: remove legacy cli/ source and adjacent dead glue (#10658)
* chore: remove legacy cli/ source and direct references

The legacy React Ink CLI in cli/ has been superseded by the new SDK
CLI at sdk/apps/cli/ (published as cline@nightly today, taking over
the cline npm package on the next latest cut).

This commit deletes the cli/ source tree (~9.5MB, 142 files) and the
remaining references that point at it:
- .clinerules/cli.md (the per-area tribal-knowledge file for working
  in cli/)
- package.json workspaces: drop the "cli" entry (root no longer
  publishes a workspace from there)
- package.json coverage excludes: drop the stale **/evals/cli/**
  paths (the directory does not exist)
- tsconfig.json: drop "cli/src/**/*" from the include list so the
  root typecheck stops trying to walk into a missing tree
- .github/copilot-instructions.md: drop the CLI architecture bullet
  and the cli/src/components/ModelPicker.tsx mention from the
  add-API-provider checklist

Intentionally left alone:
- .claude/hooks/claude-code-for-web-setup.sh references
  github.com/cli/cli (the gh CLI), not our deleted cli/
- src/core/locks/SqliteLockManager.ts comments mention
  cli/pkg/common/schema.go which is the Go-based cline-core schema,
  a different component
- .github/workflows/cline-evals-regression.yml is already disabled
  pending rewire at the new SDK CLI

* chore: remove orphaned legacy CLI distribution scripts

With cli/ gone, the public-install path (curl | bash → install.sh →
download CLI binaries from cline/cline GitHub releases) and the
enterprise endpoint-bundling helpers no longer have anything to
install or bundle:

- scripts/install.sh — curl-bash installer that downloaded the old
  CLI binary from cline/cline GH releases. The new install path is
  npm i -g cline.
- scripts/test-install.sh — only tested install.sh.
- scripts/test-bundled-endpoints.sh — built a VSIX *and* CLI tgz with
  bundled staging endpoints for enterprise distribution. The CLI half
  is dead; the VSIX half can be done with vsce + add-endpoints-to-vsix.sh
  directly. The script as a whole was niche test infra, not production.
- scripts/add-endpoints-to-npm.sh — injected endpoints.json into the
  old CLI's npm tarball. Companion add-endpoints-to-vsix.sh and
  add-endpoints-to-jetbrains.sh stay (they target the extension and
  JetBrains plugin).
- package.json: drop the orphaned `test:install` root script that
  wrapped scripts/test-install.sh.

If install.cline.bot (or any public URL) was still serving
scripts/install.sh as a curl|bash target, that URL will 404 after
this lands. Worth checking and either redirecting or stubbing with
a `npm i -g cline` hint.

* chore: clean up legacy CLI references

* chore: disable legacy smoke eval workflow

* Revert "chore: disable legacy smoke eval workflow"

This reverts commit 193ee78718.

* chore: remove disabled smoke eval workflow

* docs: clarify disabled smoke eval CI
2026-05-13 22:13:58 -07:00
Tomás Barreiro 8c7617cead Update simple-git (#10720)
* Update simple-git

* Pin specific version
2026-05-13 19:55:40 +02:00
MaxandMax Paulus 🥪 80783b62cb changelog and version bump (#10727)
Co-authored-by: Max Paulus 🥪 <max@cline.bot>
2026-05-13 09:37:31 -07:00
Tomás Barreiro a88b84785e Update Axios to prevent Critical vulnerability (#10719) 2026-05-13 17:25:44 +02:00
Tomás Barreiro e6f27c70f4 Update SAP Connectivity package to fix node-forge vulnerability (#10718) 2026-05-13 17:09:40 +02:00
Saoud Rizwan 7cdaca0135 build: use README.marketplace.md for VS Code Marketplace publishes (#10663)
vsce reads README.md from the extension root at vsce package / vsce
publish time and has no flag to point it elsewhere, so to use a
different README on the VS Code Marketplace than on the GitHub repo
landing page we swap README.marketplace.md into README.md just before
packaging and put the original back afterwards.

scripts/marketplace-readme.mjs is the shared swap helper. The swap is
idempotent so the CI step in publish.yml can wrap the whole
package-and-publish block while the inner npm scripts still swap
themselves when run locally.

Wired into all three marketplace-bound paths:
  - npm run publish:marketplace and :prerelease via the new
    scripts/publish-marketplace.mjs wrapper
  - npm run publish:marketplace:nightly via publish-nightly.mjs
  - The vsce package call in publish.yml that builds the .vsix
    attached to the GitHub release, so manual installs match the
    marketplace listing

README.marketplace.md starts as a verbatim copy of README.md; future
PRs can repurpose README.md as a multi-product landing page covering
the SDK, JetBrains plugin, CLI, and VS Code extension while the
marketplace listing stays focused on the VS Code UX.
2026-05-12 12:32:07 -07:00
Saoud Rizwan 9b6fba6214 ci: move SDK publishing into cline/cline and retire legacy CLI infra (#10648)
* ci: migrate SDK publish workflows to repo root

Move publish-cli.yaml, publish-sdk.yaml, and test.yml (renamed to
sdk-test.yml) from sdk/.github/workflows/ to the repo root so GitHub
Actions actually picks them up. Adapt them to run with cwd sdk/ via
workflow-level defaults.run.working-directory, repoint repo guards
from cline/sdk to cline/cline, switch publish-sdk's nested test call
to sdk-test.yml, add path filters on sdk-test.yml so it doesn't fire
on extension-only PRs, and re-enable NPM_CONFIG_PROVENANCE now that
cline/cline is public.

Update the publish-cli skill with a cwd note so the documented
release commands keep working from sdk/.

* ci: remove legacy CLI publish workflows

The legacy publish chain (publish-cli-trusted.yaml dispatching into
npm-main.yaml + npm-nightly.yaml) publishes the old cli/ folder to
the same cline npm package the new SDK CLI is taking over. Leave
both wired up and a maintainer could accidentally publish an old
build over the handoff. Remove the dispatcher, the two callees, the
PR-preview tarball workflow (pack-cli.yml + build-cli-artifact.sh),
the TUI test workflow that only fed into them, and the npm packaging
script those workflows shared.

The cli/ source itself is left in place for a separate removal PR.

* chore: remove legacy CLI dev and eval helpers

With the legacy CLI publish workflows gone, the surrounding dev and
eval glue that only existed to feed those workflows is also dead.
Delete tests/e2e/cli/ (TUI tests), evals/smoke-tests/ (CLI smoke
evals), and the cline-evals-regression.yml workflow that drove them.

Trim the root package.json scripts that pointed at this infra:
- cli:link, cli:build, cli:run, cli:build:production, cli:watch,
  cli:test, cli:dev, cli:unlink (all delegated into cli/)
- compile-standalone-npm and postcompile-standalone-npm (only the
  removed npm-main/npm-nightly workflows called them)
- test:e2e:cli:tui (only the removed cli-tui-tests.yml called it)
- eval:smoke:*, which chained through cli:build + cli:link

Drop the trailing `cd ../cli && npx tsc --noEmit` segment from
check-types so the root typecheck stops walking into cli/.

The cli/ source itself stays in place for a separate removal PR.

* docs(evals): note removed smoke-tests layer

The evals/README.md and evals/ARCHITECTURE.md were structured around
smoke-tests as Layer 2 of the pyramid. With evals/smoke-tests/ and
the eval:smoke scripts gone, those references are stale. Add a top-
of-doc banner pointing at the removal rather than gutting both files
in this PR; a follow-up can scrub the structure when the framework
is updated for the new SDK CLI.

* chore(evals): restore smoke-tests, disable workflow pending rewire

The smoke-test scenarios in evals/smoke-tests/ are CLI-agnostic — each
scenario is just a config.json prompt plus optional template files —
so they're worth preserving across the legacy CLI sunset. Restore the
directory and the cline-evals-regression.yml workflow, but reduce the
workflow's triggers to workflow_dispatch only so it doesn't auto-run
in its current legacy-CLI-coupled form. Add a header comment pointing
at the rewire work.

Update the evals/README.md and evals/ARCHITECTURE.md banners from
"removed" to "temporarily disabled" to match reality.

Wiring the workflow at the new SDK CLI (and restoring the eval:smoke
root scripts) is left for whoever picks up the eval framework refresh.

* chore(evals): restore eval:smoke:run for ad-hoc smoke checks

The runner (`evals/smoke-tests/run-smoke-tests.ts`) shells out to
whichever `cline` is on $PATH, so it already works against the new
SDK CLI once `npm i -g cline` installs it. Add back just the single
`eval:smoke:run` script so docs and manual validation have a working
entrypoint. The build-and-link chain (`eval:smoke:build`, `eval:smoke`,
`eval:smoke:ci`) stays out — those need rewiring before they function.

Update the README/ARCHITECTURE banners accordingly.

* fix(ci): update SDK npm repository metadata

* fix(ci): tighten SDK publish workflows
2026-05-11 19:13:25 -07:00
Tomás Barreiro 6bb730ef19 Update axios (#10575)
* Update axios

* fix types
2026-05-11 21:54:19 +02:00
MaxandMax Paulus 🥪 86f463496c bump versions and changelog (#10503)
Co-authored-by: Max Paulus 🥪 <max@cline.bot>
2026-05-01 09:25:09 -07:00
Dominic Cooney beb3ad78dc Revert "Remove foreground terminal from Cline VSCode extension (#10196)" (#10477)
This reverts commit 1862f15955.
2026-04-30 09:41:52 -07:00
MaxandMax Paulus 🥪 07593bb42a version bump and changelog (#10395)
Co-authored-by: Max Paulus 🥪 <max@cline.bot>
2026-04-24 08:16:35 -07:00
TheRealSpencer 5accd88d73 fix: pin protobufjs to 7.5.5 to address CVE-2026-41242 (#10365) 2026-04-22 20:22:32 -07:00
MaxandMax Paulus 🥪 9dea336ced update changelog (#10356)
Co-authored-by: Max Paulus 🥪 <max@cline.bot>
2026-04-22 11:03:35 -07:00
CandiedUniverseandArafatkatze 1862f15955 Remove foreground terminal from Cline VSCode extension (#10196)
* Create implementation plan doc

* Remove foreground terminal UI and default task execution to background mode

* Remove terminal mode UI service endpoint

* Remove foreground terminal mode state and RPC surface

* Add terminal settings UI regression test

* Guard removed foreground terminal state keys

* Test simplified terminal command routing

* Remove dead terminal profile plumbing

* Remove stale terminal mode references

* Add terminal settings verification story

* Remove implementation plan doc once implemented

* fix e2e launch under electron-run-as-node

* address greptile terminal follow-ups

* address greptile proto and vscode terminal notes

* address greptile test follow-ups

* remove dead acp terminal stubs

* Remove VS Code integrated terminal dependencies

* docs: sync integrated terminal removal plan status

* Remove terminal settings UI

* Remove terminal settings plumbing

* Mark terminal settings removal validated

* Remove implementation plan docs once implemented

* Polish shell integration warning UI

* Remove orphaned ACP terminal setters

* Add kanban install flow implementation plan

Start kanban install task from modal

Clarify kanban install task architecture

Verify kanban install task flow

Remove implementation plan doc once implemented

Restore direct terminal install launcher

Make the kanban installer change minimal and squashable

* Changes as per PR feedback

* Further deletions as per PR feedback

* Restore standalone kanban modal copy fallback

---------

Co-authored-by: Arafatkatze <arafat.da.khan@gmail.com>
2026-04-20 18:48:11 -07:00
TheRealSpencer c5657a14bb chore: update axios to 1.15.0 across all packages (#10271)
- Update root package.json axios from 1.13.6 to 1.15.0
- Update evals/package.json axios from 1.13.6 to 1.15.0
- Update docs/package.json axios override from 1.13.5 to 1.15.0
- Regenerate all package-lock.json files
2026-04-17 10:52:28 -05:00
AraandClaude Sonnet 4.6 9405419efe v3.79.0 Release Notes (#10292)
* v3.79.0 Release Notes

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

🔮 View transcript: https://agentlogs.beatrixwoo.workers.dev/s/i90f8jfxjc88hit3bs8v2e2k

* chore(cli): bump CLI to v2.15.0

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

🔮 View transcript: https://agentlogs.beatrixwoo.workers.dev/s/i90f8jfxjc88hit3bs8v2e2k

* remove changeset

* remove changeset
2026-04-16 12:26:10 -07:00
CandiedUniverseandgreptile-apps[bot] 71d795eec8 Changelog and version bump for release (#10227)
* Update changelog files for release

* Version bump for release

* Update cli/CHANGELOG.md

Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>

---------

Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
2026-04-10 12:48:17 -07:00
CandiedUniverse 2bd21f8a45 Update changelog and release version (#10085) 2026-04-01 10:02:58 -07:00
TheRealSpencer dec10aaec3 pin axios version due to current package integrity (#10060)
* pin axios version due to current package integrity

* update axios versions
2026-03-31 11:02:20 -07:00
Max 03d2d01eed chore: bump version to 3.76.0 (#9986) 2026-03-26 07:52:28 -07:00
Dominic Cooney db1b1c45bd chore: update dependencies flagged by npm audit (#9980) 2026-03-26 21:03:35 +09:00
CandiedUniverse d40ab56aff Changelog and version bump for release (#9910) 2026-03-20 15:29:45 -07:00
Ara bde7049c01 Release v3.74.0 Notes (#9879) 2026-03-18 19:08:50 -07:00
Max ad4631c682 bump cline version (#9833) 2026-03-16 13:36:41 -07:00
MaxandMax Paulus 🥪 a27bedffb6 max/cli tui e2e tests (#9753)
* add tui UI tests

using microsoft/tui-test library, can run many headless versions of
cline and execute ui tests (requires Node <= 20)

improve brittle sleep calls

* add cli-tui-tests github action

---------

Co-authored-by: Max Paulus 🥪 <max@cline.bot>
2026-03-12 16:06:25 -07:00
CandiedUniverse 0e7e0099cd Changelog and version bump for release (#9775) 2026-03-11 17:21:04 -07:00
MaxandMax Paulus 🥪 1753d9dc15 release changelog and version bump (#9706)
Co-authored-by: Max Paulus 🥪 <max@cline.bot>
2026-03-06 09:45:20 -08:00
MaxandMax Paulus 🥪 12f5dc2e9e update changelog and bump version numbers (#9664)
Co-authored-by: Max Paulus 🥪 <max@cline.bot>
2026-03-04 13:39:15 -08:00
CandiedUniverse fc3d986d05 Release: version bump and changelog updates (#9640)
* Update changelog for release

* Version bump the package*.json files for release
2026-03-02 15:53:06 -08:00
CandiedUniverse 60485277c4 Version bump and changelog for release (#9577) 2026-02-26 15:57:14 -08:00