Merge cline/sdk into sdk/

to version 1778003433064

.agents/skills/cline-sdk/SKILL.md

@@ -1,208 +0,0 @@
----
-name: cline-sdk
-description: Comprehensive Cline SDK skill for building AI agents. Covers the Agent runtime, ClineCore sessions, custom tools, plugins, events, LLM providers, scheduling, multi-agent teams, and production deployment. Use for any task involving @cline/sdk or its sub-packages.
-metadata:
-   references: agent, clinecore
----
-
-# Cline SDK Skill
-
-Consolidated skill for building AI agents with the Cline SDK. Use the decision trees below to find the right entry point and API surface, then load detailed references.
-
-## Critical Rules
-
-Follow these rules in all Cline SDK code:
-
-1. Install with `npm install @cline/sdk`. The `@cline/sdk` package re-exports everything from `@cline/core`, `@cline/agents`, `@cline/llms`, and `@cline/shared`.
-2. Requires Node.js 22 or later.
-3. Use `createTool()` from `@cline/sdk` (or `@cline/shared`) to define tools. Tool names must be `snake_case`.
-4. Return errors as structured data from tool `execute` functions. Throwing counts as a "mistake" against the agent's mistake limit.
-5. Use `lifecycle: { completesRun: true }` on tools that should end the agent loop (e.g. a "submit answer" tool).
-6. When using `ClineCore`, always call `dispose()` when done to clean up resources.
-7. The standalone `Agent` and `ClineCore` have different event systems. For `Agent`: use `agent.subscribe()` to get `AgentRuntimeEvent` types (text streaming is `"assistant-text-delta"`, result text is `result.outputText`). For `ClineCore`: use `cline.subscribe()` to get `CoreSessionEvent` types (text streaming is `"chunk"` with `payload.type === "text"`, result text is `result.text`). There is no top-level `onEvent` field on `AgentRuntimeConfig` -- use `agent.subscribe()` or `hooks.onEvent` instead. Do not use event types like `"content_update"` or `"content_start"` with `agent.subscribe()` -- those are internal legacy types from the ClineCore adapter layer.
-
-## How to Use This Skill
-
-### Reference File Structure
-
-The two main API surfaces (`Agent` and `ClineCore`) follow a 4-file pattern. Cross-cutting concepts are single-file guides.
-
-Each main API surface in `./references/<api>/` contains:
-
-| File | Purpose | When to Read |
-|------|---------|--------------|
-| `REFERENCE.md` | Overview, when to use, quick start | Always read first |
-| `api.md` | Full API: classes, methods, config, types | Writing code |
-| `patterns.md` | Common patterns, best practices | Implementation guidance |
-| `gotchas.md` | Pitfalls, limitations, debugging | Troubleshooting |
-
-Cross-cutting concepts in `./references/<concept>/` have `REFERENCE.md` as the entry point.
-
-### Reading Order
-
-1. Start with `REFERENCE.md` for your chosen API surface
-2. Then read additional files relevant to your task:
-   - Writing agent code -> `api.md`
-   - Common patterns -> `patterns.md`
-   - Creating tools -> `tools/REFERENCE.md`
-   - Adding plugins/hooks -> `plugins/REFERENCE.md`
-   - Configuring LLM providers -> `providers/REFERENCE.md`
-   - Streaming events -> `events/REFERENCE.md`
-   - Deploying to production -> `production/REFERENCE.md`
-   - Scheduling agents -> `scheduling/REFERENCE.md`
-   - Multi-agent orchestration -> `multi-agent/REFERENCE.md`
-   - Debugging -> `gotchas.md`
-
-### Example Paths
-
-```
-./references/agent/REFERENCE.md           # Start here for lightweight agents
-./references/clinecore/REFERENCE.md       # Start here for full runtime
-./references/agent/api.md                 # Agent class, config, methods
-./references/tools/REFERENCE.md           # Creating and using tools
-./references/plugins/REFERENCE.md         # Plugin system
-./references/providers/REFERENCE.md       # LLM provider configuration
-```
-
-## Quick Decision Trees
-
-### "Which API surface should I use?"
-
-```
-Which API?
-+-- I want a simple, stateless agent with custom tools
-|   +-- agent/ (Agent class from @cline/agents)
-+-- I need session persistence, built-in tools, config discovery
-|   +-- clinecore/ (ClineCore from @cline/core)
-+-- I want built-in file/shell/search/web tools
-|   +-- clinecore/ (has built-in tools; Agent does not)
-+-- I want scheduled or recurring agents
-|   +-- clinecore/ (automation API)
-+-- I need multi-process or multi-client session sharing
-|   +-- clinecore/ (hub-backed runtime)
-+-- I'm building a browser-compatible agent
-|   +-- agent/ (no Node.js dependencies)
-```
-
-### "I need to create tools"
-
-```
-Tools?
-+-- Define a custom tool with schema -> tools/REFERENCE.md
-+-- Use built-in tools (bash, editor, read_files) -> tools/REFERENCE.md (built-in section)
-+-- Control tool approval/policies -> tools/REFERENCE.md (policies section)
-+-- Tool that ends the agent loop -> tools/REFERENCE.md (completion tools)
-+-- Package tools as a reusable plugin -> plugins/REFERENCE.md
-```
-
-### "I need to handle events"
-
-```
-Events?
-+-- Stream text/reasoning in real time -> events/REFERENCE.md
-+-- Track token usage and costs -> events/REFERENCE.md
-+-- Watch tool calls -> events/REFERENCE.md
-+-- Detect completion/errors -> events/REFERENCE.md
-+-- Hook into lifecycle stages -> plugins/REFERENCE.md
-```
-
-### "I need to configure a model provider"
-
-```
-Providers?
-+-- Anthropic (Claude) -> providers/REFERENCE.md
-+-- OpenAI (GPT) -> providers/REFERENCE.md
-+-- Google (Gemini/Vertex) -> providers/REFERENCE.md
-+-- AWS Bedrock -> providers/REFERENCE.md
-+-- Mistral -> providers/REFERENCE.md
-+-- OpenAI-compatible (vLLM, Together, etc.) -> providers/REFERENCE.md
-+-- Custom/self-hosted provider -> providers/REFERENCE.md
-```
-
-### "I need plugins or hooks"
-
-```
-Plugins?
-+-- Package tools + hooks together -> plugins/REFERENCE.md
-+-- Observe tool calls (logging, metrics) -> plugins/REFERENCE.md
-+-- Intercept lifecycle events -> plugins/REFERENCE.md
-+-- Add system prompt rules -> plugins/REFERENCE.md
-+-- Distribute via npm/git -> plugins/REFERENCE.md
-```
-
-### "I need multi-agent coordination"
-
-```
-Multi-agent?
-+-- Spawn one-off background agents -> multi-agent/REFERENCE.md (sub-agents)
-+-- Persistent cross-session teams -> multi-agent/REFERENCE.md (teams)
-+-- Parent-child delegation -> multi-agent/REFERENCE.md (sub-agents)
-+-- Peer-to-peer task board -> multi-agent/REFERENCE.md (teams)
-```
-
-### "I need scheduling or automation"
-
-```
-Scheduling?
-+-- Recurring cron jobs -> scheduling/REFERENCE.md
-+-- One-off scheduled tasks -> scheduling/REFERENCE.md
-+-- Event-driven triggers -> scheduling/REFERENCE.md
-+-- CLI schedule management -> scheduling/REFERENCE.md
-```
-
-### "I need to go to production"
-
-```
-Production?
-+-- Error handling and status checks -> production/REFERENCE.md
-+-- Cost control and token limits -> production/REFERENCE.md
-+-- Observability (OpenTelemetry) -> production/REFERENCE.md
-+-- Security and sandboxing -> production/REFERENCE.md
-+-- Deployment patterns -> production/REFERENCE.md
-```
-
-### Troubleshooting Index
-
-- Agent loop not stopping -> `tools/REFERENCE.md` (completion tools)
-- Tool errors crashing the agent -> `agent/gotchas.md` or `clinecore/gotchas.md`
-- Provider auth failures -> `providers/REFERENCE.md`
-- Session not persisting -> `clinecore/gotchas.md`
-- Token usage too high -> `production/REFERENCE.md` (cost control)
-- Hub connection issues -> `clinecore/gotchas.md`
-- Plugin not loading -> `plugins/REFERENCE.md`
-- Events not firing -> `events/REFERENCE.md`
-
-## Product Index
-
-### API Surfaces
-| API | Entry File | Description |
-|-----|------------|-------------|
-| Agent | `./references/agent/REFERENCE.md` | Lightweight stateless agent loop |
-| ClineCore | `./references/clinecore/REFERENCE.md` | Full runtime with sessions, persistence, built-in tools |
-
-### Cross-Cutting Concepts
-| Concept | Entry File | Description |
-|---------|------------|-------------|
-| Tools | `./references/tools/REFERENCE.md` | Built-in and custom tool creation |
-| Plugins | `./references/plugins/REFERENCE.md` | Extension system with hooks |
-| Events | `./references/events/REFERENCE.md` | Real-time streaming events |
-| Providers | `./references/providers/REFERENCE.md` | LLM provider configuration |
-| Production | `./references/production/REFERENCE.md` | Deployment, security, observability |
-| Scheduling | `./references/scheduling/REFERENCE.md` | Cron jobs and automation |
-| Multi-Agent | `./references/multi-agent/REFERENCE.md` | Teams and sub-agents |
-
-### Package Map
-| Package | Purpose |
-|---------|---------|
-| `@cline/sdk` | Everything you need, install this one |
-| `@cline/core` | Sessions, persistence, built-in tools, config, hub |
-| `@cline/agents` | Stateless agent loop, tool orchestration, streaming |
-| `@cline/llms` | LLM provider gateway |
-| `@cline/shared` | Types, tool helpers, hook engine |
-
-## Resources
-
-Repository: https://github.com/cline/cline
-SDK Source: https://github.com/cline/cline/tree/main/sdk
-Documentation: https://docs.cline.bot/sdk/overview
-Discord: https://discord.gg/cline

.agents/skills/cline-sdk/references/agent/REFERENCE.md

@@ -1,107 +0,0 @@
-# Agent Runtime
-
-The `Agent` class (also exported as `AgentRuntime`) is the lightweight, stateless agent loop from `@cline/agents`. It handles the core iteration cycle: send messages to an LLM, execute tool calls, collect results, and repeat until the task is done.
-
-## When to Use Agent
-
-| Use Agent when... | Use ClineCore instead when... |
-|---|---|
-| You want a simple agent with custom tools | You need built-in tools (bash, editor, etc.) |
-| You want minimal dependencies | You need session persistence |
-| You need browser compatibility | You need config discovery from `.cline/` |
-| You're building a stateless worker | You need multi-process session sharing |
-| You want full control over the runtime | You want batteries-included setup |
-
-## Quick Start
-
-```typescript
-import { Agent } from "@cline/sdk"
-
-const agent = new Agent({
-  providerId: "anthropic",
-  modelId: "claude-sonnet-4-6",
-  apiKey: process.env.ANTHROPIC_API_KEY,
-  systemPrompt: "You are a helpful assistant.",
-  tools: [],
-})
-
-const result = await agent.run("What is the capital of France?")
-console.log(result.outputText)
-```
-
-## Core Concepts
-
-The Agent operates in a loop:
-1. Accept user input (string, message, or array of messages)
-2. Build turn context (system prompt, messages, tools)
-3. Call the LLM provider
-4. If the model returns tool calls, execute them and loop back to step 3
-5. If the model returns text without tool calls, the run completes
-6. Emit events throughout for streaming
-
-The agent is stateless in the sense that it does not persist anything to disk. Conversation history is held in memory and can be accessed via `snapshot()`.
-
-## Key APIs
-
-- `new Agent(config)` or `createAgent(config)` - Create an agent
-- `agent.run(input)` - Start a run with user input
-- `agent.continue(input?)` - Continue an existing conversation
-- `agent.abort(reason?)` - Cancel an active run
-- `agent.subscribe(listener)` - Listen to streaming events
-- `agent.snapshot()` - Get current runtime state
-- `agent.restore(messages)` - Replace message history
-
-See `api.md` for full API details.
-
-## Multi-Turn Conversations
-
-```typescript
-const agent = new Agent({
-  providerId: "anthropic",
-  modelId: "claude-sonnet-4-6",
-  systemPrompt: "You are a helpful assistant.",
-  tools: [],
-})
-
-const first = await agent.run("What is 2 + 2?")
-console.log(first.outputText)
-
-const second = await agent.continue("Now multiply that by 3")
-console.log(second.outputText)
-```
-
-Use `agent.hasRun` to check if a run has already been executed, which determines whether to call `run()` or `continue()`.
-
-## Event Streaming
-
-Use `agent.subscribe()` to stream events in real time. Register the listener before calling `run()` to avoid missing early events.
-
-There is no top-level `onEvent` field on the Agent config. For an async alternative, use `hooks.onEvent` (see `api.md` and `gotchas.md`).
-
-```typescript
-const agent = new Agent({
-  providerId: "anthropic",
-  modelId: "claude-sonnet-4-6",
-  systemPrompt: "You are a helpful assistant.",
-  tools: [],
-})
-
-agent.subscribe((event) => {
-  if (event.type === "assistant-text-delta") {
-    process.stdout.write(event.text)
-  }
-})
-
-const result = await agent.run("What is the capital of France?")
-```
-
-See `events/REFERENCE.md` for the full event type catalog.
-
-## Next Steps
-
-- `api.md` - Full Agent API reference
-- `patterns.md` - Common patterns and best practices
-- `gotchas.md` - Pitfalls and debugging
-- `../tools/REFERENCE.md` - Creating custom tools
-- `../events/REFERENCE.md` - Event system details
-- `../providers/REFERENCE.md` - Provider configuration

.agents/skills/cline-sdk/references/agent/api.md

@@ -1,231 +0,0 @@
-# Agent API Reference
-
-## Constructor
-
-```typescript
-import { Agent } from "@cline/sdk"
-
-const agent = new Agent(config: AgentRuntimeConfig)
-```
-
-Also available via factory function:
-
-```typescript
-import { createAgent } from "@cline/sdk"
-
-const agent = createAgent(config)
-```
-
-## AgentRuntimeConfig
-
-Two config forms exist as a discriminated union:
-
-### With Provider ID (recommended)
-
-```typescript
-interface AgentRuntimeConfigWithProvider {
-  providerId: string          // e.g. "anthropic", "openai", "gemini"
-  modelId: string             // e.g. "claude-sonnet-4-6", "gpt-5.5"
-  apiKey?: string             // provider API key
-  baseUrl?: string            // custom endpoint
-  headers?: Record<string, string>
-
-  systemPrompt?: string
-  tools?: AgentTool[]
-  initialMessages?: AgentMessage[]
-  toolPolicies?: Record<string, ToolPolicy>
-  hooks?: Partial<AgentRuntimeHooks>
-  plugins?: AgentPlugin[]
-}
-```
-
-### With Pre-built Model
-
-```typescript
-interface AgentRuntimeConfigWithModel {
-  model: AgentModel            // pre-built model from gateway
-
-  systemPrompt?: string
-  tools?: AgentTool[]
-  initialMessages?: AgentMessage[]
-  toolPolicies?: Record<string, ToolPolicy>
-  hooks?: Partial<AgentRuntimeHooks>
-  plugins?: AgentPlugin[]
-}
-```
-
-Note: there is no top-level `onEvent` field on `AgentRuntimeConfig`. For event streaming, use `agent.subscribe()` or `hooks.onEvent` (see AgentRuntimeHooks below).
-
-## Methods
-
-### run(input)
-
-Start the agent with user input. Returns when the agent loop completes.
-
-```typescript
-const result: AgentRunResult = await agent.run("Build a REST API")
-```
-
-Input can be a string, an `AgentMessage`, or an array of `AgentMessage[]`.
-
-### continue(input?)
-
-Continue an existing conversation with optional new input.
-
-```typescript
-const result = await agent.continue("Now add authentication")
-```
-
-### abort(reason?)
-
-Cancel the currently active run.
-
-```typescript
-agent.abort("User cancelled")
-```
-
-### subscribe(listener)
-
-Register a listener for streaming events.
-
-```typescript
-const unsubscribe = agent.subscribe((event: AgentRuntimeEvent) => {
-  // handle event
-})
-
-// Later: stop listening
-unsubscribe()
-```
-
-### snapshot()
-
-Get the current runtime state including message history.
-
-```typescript
-const state: AgentRuntimeStateSnapshot = agent.snapshot()
-```
-
-### restore(messages)
-
-Replace the agent's message history.
-
-```typescript
-agent.restore(previousMessages)
-```
-
-### hasRun
-
-Boolean property indicating whether `run()` has been called at least once.
-
-```typescript
-if (agent.hasRun) {
-  await agent.continue(input)
-} else {
-  await agent.run(input)
-}
-```
-
-## AgentRunResult
-
-Returned by `run()` and `continue()`.
-
-```typescript
-interface AgentRunResult {
-  agentId: string
-  agentRole?: string
-  runId: string
-  status: "completed" | "aborted" | "failed"
-  iterations: number
-  outputText: string
-  messages: readonly AgentMessage[]
-  usage: AgentUsage
-  error?: Error
-}
-```
-
-### Status Values
-
-- `"completed"` - Agent finished normally
-- `"aborted"` - Cancelled via `abort()`
-- `"failed"` - Unrecoverable error
-
-## AgentMessage
-
-```typescript
-interface AgentMessage {
-  id: string
-  role: "user" | "assistant" | "tool"
-  content: AgentMessagePart[]
-  createdAt: number
-  metadata?: Record<string, unknown>
-  modelInfo?: { id: string; provider: string; family?: string }
-  metrics?: {
-    inputTokens: number
-    outputTokens: number
-    cacheReadTokens?: number
-    cacheWriteTokens?: number
-    cost?: number
-  }
-}
-```
-
-## AgentUsage
-
-```typescript
-interface AgentUsage {
-  inputTokens: number
-  outputTokens: number
-  cacheReadTokens: number
-  cacheWriteTokens: number
-  totalInputTokens: number
-  totalOutputTokens: number
-  totalCost?: number
-}
-```
-
-## AgentRuntimeHooks
-
-```typescript
-interface AgentRuntimeHooks {
-  beforeRun?(context): AgentStopControl | undefined
-  afterRun?(context): void
-  beforeModel?(context): AgentBeforeModelResult | undefined
-  afterModel?(context): AgentStopControl | undefined
-  beforeTool?(context): AgentBeforeToolResult | undefined
-  afterTool?(context): AgentAfterToolResult | undefined
-  onEvent?(event: AgentRuntimeEvent): void | Promise<void>
-}
-```
-
-Hooks can intercept and modify behavior at each stage. Return a stop control from `beforeRun`, `afterModel`, or `beforeTool` to halt the agent loop.
-
-`hooks.onEvent` receives the same `AgentRuntimeEvent` types as `agent.subscribe()`, but hook callbacks are awaited (can be async), while `subscribe()` listeners are called synchronously. Use `subscribe()` for UI streaming and `hooks.onEvent` for async side effects like logging to an external service.
-
-## AgentRuntimeStateSnapshot
-
-```typescript
-interface AgentRuntimeStateSnapshot {
-  messages: readonly AgentMessage[]
-  usage: AgentUsage
-  iterations: number
-  status: string
-}
-```
-
-## Factory: createAgentRuntime
-
-Lower-level factory that returns the same `Agent` class:
-
-```typescript
-import { createAgentRuntime } from "@cline/sdk"
-
-const runtime = createAgentRuntime(config)
-```
-
-## See Also
-
-- `REFERENCE.md` - Overview and quick start
-- `patterns.md` - Common patterns
-- `../tools/REFERENCE.md` - Tool creation
-- `../events/REFERENCE.md` - Event types
-- `../providers/REFERENCE.md` - Provider setup

.agents/skills/cline-sdk/references/agent/gotchas.md

@@ -1,134 +0,0 @@
-# Agent Gotchas
-
-## Agent Loop Never Stops
-
-If the agent keeps iterating without completing:
-
-- Make sure at least one tool has `lifecycle: { completesRun: true }` if you want the agent to explicitly finish.
-- Without any tools, the agent will complete after the model returns text without tool calls.
-- If using tools, ensure the system prompt guides the model toward calling the completion tool when done.
-- Check that `completesRun` tools return successfully (not throwing errors).
-
-## Tool Errors Count as Mistakes
-
-When a tool's `execute` function throws an exception, the SDK counts it as a "mistake." After too many mistakes, the agent stops with a `mistake_limit` finish reason.
-
-Instead, return errors as structured data:
-
-```typescript
-// Bad: throwing
-execute: async (input) => {
-  throw new Error("File not found")
-}
-
-// Good: returning error data
-execute: async (input) => {
-  return { error: "File not found", path: input.path }
-}
-```
-
-## run() vs continue()
-
-- Call `run()` for the first interaction. It sets up the conversation.
-- Call `continue()` for subsequent messages. It appends to the existing conversation.
-- Calling `run()` a second time resets the conversation history.
-- Use `agent.hasRun` to check which method to call.
-
-## Browser Compatibility
-
-`@cline/agents` (and by extension, the `Agent` class) is browser-safe with no Node.js dependencies. However, `@cline/core` and `ClineCore` require Node.js 22+. If you import from `@cline/sdk`, you get everything including the Node-only code. For browser usage, import directly from `@cline/agents`:
-
-```typescript
-import { Agent } from "@cline/agents"
-```
-
-## No Top-Level onEvent on Agent Config
-
-`AgentRuntimeConfig` does not have a top-level `onEvent` field. Passing `onEvent` to `new Agent({ onEvent: ... })` has no effect. There are two ways to receive events:
-
-```typescript
-// Option 1: subscribe() - synchronous, best for UI streaming
-const agent = new Agent({ ...config })
-agent.subscribe((event) => {
-  if (event.type === "assistant-text-delta") {
-    process.stdout.write(event.text)
-  }
-})
-
-// Option 2: hooks.onEvent - awaited, best for async side effects
-const agent = new Agent({
-  ...config,
-  hooks: {
-    onEvent: async (event) => {
-      if (event.type === "assistant-text-delta") {
-        await logToService(event.text)
-      }
-    },
-  },
-})
-```
-
-Both receive the same `AgentRuntimeEvent` types. Prefer `subscribe()` for streaming UI.
-
-## Event Listener Timing
-
-Register event listeners via `subscribe()` before calling `run()`:
-
-```typescript
-// Good: subscribe before run
-agent.subscribe(handler)
-const result = await agent.run(input)
-
-// Bad: subscribing after run starts loses early events
-const promise = agent.run(input)
-agent.subscribe(handler)  // may miss events
-```
-
-## Tool Input Schema Matters
-
-The model uses the tool's `inputSchema` to decide what arguments to pass. A vague or missing schema leads to incorrect tool calls.
-
-- Use `z.enum()` for fixed value sets, not free-form strings
-- Describe every property with `.describe()` in Zod or `description` in JSON Schema
-- Include constraints (rate limits, max values) in the tool description
-
-## Memory and Long Conversations
-
-The Agent holds all messages in memory. For long-running conversations, memory usage grows with each turn. Consider:
-
-- Using `ClineCore` with compaction for long sessions
-- Periodically creating a new agent with a summary of the conversation
-- Monitoring `result.usage.totalInputTokens` to track context growth
-
-## Abort Signal Handling in Tools
-
-Long-running tools should respect the abort signal:
-
-```typescript
-execute: async (input, context) => {
-  for (const item of items) {
-    if (context.abortSignal?.aborted) {
-      return { partial: results, aborted: true }
-    }
-    results.push(await process(item))
-  }
-  return { results }
-}
-```
-
-## Provider API Key
-
-If you get authentication errors, check:
-
-- `apiKey` is set in the config or via environment variables
-- The key matches the `providerId` (e.g., Anthropic key for `providerId: "anthropic"`)
-- For OpenAI-compatible providers, both `apiKey` and `baseUrl` are set
-
-See `../providers/REFERENCE.md` for provider-specific setup.
-
-## See Also
-
-- `api.md` - Full API reference
-- `patterns.md` - Common patterns
-- `../tools/REFERENCE.md` - Tool creation
-- `../clinecore/REFERENCE.md` - Use ClineCore for persistence

.agents/skills/cline-sdk/references/agent/patterns.md

@@ -1,258 +0,0 @@
-# Agent Patterns
-
-## Interactive CLI Agent
-
-A multi-turn conversational agent in the terminal with streaming output:
-
-```typescript
-import { Agent } from "@cline/sdk"
-import * as readline from "node:readline"
-
-const agent = new Agent({
-  providerId: "anthropic",
-  modelId: "claude-sonnet-4-6",
-  apiKey: process.env.ANTHROPIC_API_KEY,
-  systemPrompt: "You are a helpful assistant. Keep responses concise.",
-  tools: [],
-})
-
-agent.subscribe((event) => {
-  if (event.type === "assistant-text-delta") {
-    process.stdout.write(event.text)
-  }
-})
-
-const rl = readline.createInterface({
-  input: process.stdin,
-  output: process.stdout,
-})
-
-function prompt(): void {
-  rl.question("\nYou: ", async (input) => {
-    const trimmed = input.trim()
-    if (!trimmed || trimmed === "exit") {
-      rl.close()
-      return
-    }
-
-    process.stdout.write("\nAssistant: ")
-
-    if (agent.hasRun) {
-      await agent.continue(trimmed)
-    } else {
-      await agent.run(trimmed)
-    }
-
-    process.stdout.write("\n")
-    prompt()
-  })
-}
-
-prompt()
-```
-
-## Conversational Agent (Slack Bot, Chat App)
-
-Maintain per-thread agents with conversation memory:
-
-```typescript
-import { Agent } from "@cline/sdk"
-
-const agents = new Map<string, Agent>()
-
-async function handleMessage(threadId: string, message: string) {
-  let agent = agents.get(threadId)
-  if (!agent) {
-    agent = new Agent({
-      providerId: "anthropic",
-      modelId: "claude-sonnet-4-6",
-      systemPrompt: "You are a concise assistant.",
-      tools: [],
-    })
-    agents.set(threadId, agent)
-  }
-
-  const result = agent.hasRun
-    ? await agent.continue(message)
-    : await agent.run(message)
-
-  return result.outputText
-}
-```
-
-## Streaming UI
-
-Build a real-time UI by handling events via `subscribe()`:
-
-```typescript
-const agent = new Agent({
-  providerId: "anthropic",
-  modelId: "claude-sonnet-4-6",
-  systemPrompt: "You are a helpful assistant.",
-  tools: [myTool],
-})
-
-agent.subscribe((event) => {
-  switch (event.type) {
-    case "assistant-text-delta":
-      ui.appendText(event.text)
-      break
-    case "assistant-message":
-      ui.endText()
-      break
-    case "turn-started":
-      ui.startTurn(event.iteration)
-      break
-    case "turn-finished":
-      if (event.toolCallCount > 0) ui.showToolCount(event.toolCallCount)
-      break
-    case "usage-updated":
-      ui.updateUsage(event.usage.inputTokens, event.usage.outputTokens)
-      break
-  }
-})
-
-const result = await agent.run("Hello!")
-```
-
-## Structured Output via Completion Tool
-
-Use a tool with `completesRun: true` to extract structured data:
-
-```typescript
-import { Agent, createTool } from "@cline/sdk"
-import { z } from "zod"
-
-const submitReview = createTool({
-  name: "submit_review",
-  description: "Submit the final code review with structured feedback.",
-  inputSchema: z.object({
-    summary: z.string(),
-    issues: z.array(z.object({
-      file: z.string(),
-      line: z.number(),
-      severity: z.enum(["error", "warning", "info"]),
-      message: z.string(),
-    })),
-    approved: z.boolean(),
-  }),
-  lifecycle: { completesRun: true },
-  execute: async (input) => input,
-})
-
-const agent = new Agent({
-  providerId: "anthropic",
-  modelId: "claude-sonnet-4-6",
-  systemPrompt: "Review the code diff and submit structured feedback.",
-  tools: [submitReview],
-})
-
-const result = await agent.run(diffContent)
-const review = result.toolCalls.find(tc => tc.name === "submit_review")
-console.log(review?.output)
-```
-
-## Agent with Abort/Timeout
-
-```typescript
-const agent = new Agent({
-  providerId: "anthropic",
-  modelId: "claude-sonnet-4-6",
-  systemPrompt: "Analyze this data.",
-  tools: [],
-})
-
-const timeout = setTimeout(() => agent.abort("Timeout"), 30_000)
-
-try {
-  const result = await agent.run(data)
-  if (result.status === "aborted") {
-    console.log("Agent was aborted")
-  } else {
-    console.log(result.outputText)
-  }
-} finally {
-  clearTimeout(timeout)
-}
-```
-
-## Agent with Plugins
-
-```typescript
-import { Agent } from "@cline/sdk"
-import type { AgentPlugin } from "@cline/sdk"
-
-const loggingPlugin: AgentPlugin = {
-  name: "logging",
-  manifest: { capabilities: ["hooks"] },
-  setup() {},
-  hooks: {
-    beforeTool({ toolCall }) {
-      console.log(`Calling tool: ${toolCall.toolName}`)
-    },
-    afterRun({ result }) {
-      console.log(`Completed in ${result.iterations} iterations`)
-    },
-  },
-}
-
-const agent = new Agent({
-  providerId: "anthropic",
-  modelId: "claude-sonnet-4-6",
-  systemPrompt: "You are a helpful assistant.",
-  tools: [myTool],
-  plugins: [loggingPlugin],
-})
-```
-
-## Restoring State Across Sessions
-
-Save and restore agent state manually:
-
-```typescript
-// Save state
-const snapshot = agent.snapshot()
-const serialized = JSON.stringify(snapshot.messages)
-
-// Later: restore
-const agent2 = new Agent({ ...config })
-const messages = JSON.parse(serialized)
-agent2.restore(messages)
-const result = await agent2.continue("Continue where we left off")
-```
-
-For automatic persistence, use `ClineCore` instead.
-
-## Pre-Built Model via Gateway
-
-For advanced provider configuration:
-
-```typescript
-import { Agent } from "@cline/sdk"
-import { createGateway } from "@cline/llms"
-
-const gateway = createGateway({
-  providerConfigs: [
-    { providerId: "anthropic", apiKey: process.env.ANTHROPIC_API_KEY },
-    { providerId: "openai", apiKey: process.env.OPENAI_API_KEY },
-  ],
-})
-
-const model = gateway.createAgentModel({
-  providerId: "anthropic",
-  modelId: "claude-opus-4-7",
-})
-
-const agent = new Agent({
-  model,
-  systemPrompt: "You are a helpful assistant.",
-  tools: [],
-})
-```
-
-## See Also
-
-- `api.md` - Full API reference
-- `gotchas.md` - Common pitfalls
-- `../tools/REFERENCE.md` - Creating tools
-- `../plugins/REFERENCE.md` - Plugin system

.agents/skills/cline-sdk/references/clinecore/REFERENCE.md

@@ -1,131 +0,0 @@
-# ClineCore Runtime
-
-`ClineCore` is the full-featured runtime from `@cline/core`. It wraps the `Agent` loop with session persistence, built-in tools (bash, editor, file reading, search, web fetch), config discovery, plugin loading, and optional hub-backed multi-process support.
-
-## When to Use ClineCore
-
-| Use ClineCore when... | Use Agent instead when... |
-|---|---|
-| You need built-in tools (bash, editor, etc.) | You only need custom tools |
-| You want session persistence to disk | Stateless is fine |
-| You need config discovery from `.cline/` dirs | You handle config yourself |
-| You want scheduled/automated agents | You don't need scheduling |
-| You need multi-client session sharing | Single-process is fine |
-| You're building a full application | You want minimal dependencies |
-
-## Quick Start
-
-```typescript
-import { ClineCore } from "@cline/sdk"
-
-const cline = await ClineCore.create({ clientName: "my-app" })
-
-const session = await cline.start({
-  prompt: "Set up CI with GitHub Actions",
-  config: {
-    providerId: "anthropic",
-    modelId: "claude-sonnet-4-6",
-    apiKey: process.env.ANTHROPIC_API_KEY,
-    cwd: "/path/to/project",
-    enableTools: true,
-  },
-})
-
-console.log(session.result?.text)
-await cline.dispose()
-```
-
-## Core Concepts
-
-### Sessions
-
-Every `cline.start()` call creates a session with a unique ID. Sessions persist their messages and metadata to SQLite. You can list, read, resume, and delete sessions.
-
-### Built-in Tools
-
-ClineCore provides these tools automatically when `enableTools: true`:
-
-| Tool | Description |
-|------|-------------|
-| `bash` | Execute shell commands |
-| `editor` | Edit files |
-| `read_files` | Read file contents |
-| `apply_patch` | Apply unified diffs |
-| `search` | Search file contents and structure |
-| `fetch_web` | HTTP requests and web content |
-
-### Config Discovery
-
-ClineCore watches `.cline/` directories for:
-- Rules (system prompt additions)
-- Skills (domain knowledge)
-- Workflows (multi-step procedures)
-- Hooks (lifecycle logic)
-- Plugins (tool + hook bundles)
-- MCP servers (external tool providers)
-
-### Backend Modes
-
-| Mode | Description |
-|------|-------------|
-| `"auto"` (default) | Tries to connect to a local hub; falls back to in-process if unavailable |
-| `"local"` | In-process execution, local SQLite storage, no hub |
-| `"hub"` | Requires a compatible local WebSocket hub; fails if unavailable |
-| `"remote"` | Connects to an explicit remote hub endpoint |
-
-The default mode is `"auto"`. For simple scripts and CLI tools, `"local"` avoids hub discovery overhead. Hub mode enables multi-client session sharing (e.g., a dashboard watching a running session from another process).
-
-## Key APIs
-
-- `ClineCore.create(options)` - Create and initialize
-- `cline.start(input)` - Start a new session
-- `cline.send({ sessionId, prompt })` - Send follow-up message
-- `cline.subscribe(listener)` - Listen to session events
-- `cline.list()` - List sessions
-- `cline.get(sessionId)` - Get session metadata
-- `cline.readMessages(sessionId)` - Read persisted messages
-- `cline.getAccumulatedUsage(sessionId)` - Token/cost totals
-- `cline.abort(sessionId)` - Abort a session
-- `cline.delete(sessionId)` - Delete a session
-- `cline.dispose()` - Clean up resources
-
-See `api.md` for full API details.
-
-## Event Streaming
-
-`cline.subscribe()` emits `CoreSessionEvent` types. These are different from the `AgentRuntimeEvent` types emitted by the standalone `Agent` class -- see `../events/REFERENCE.md` for the full comparison.
-
-```typescript
-cline.subscribe((event) => {
-  switch (event.type) {
-    case "chunk":
-      if (event.payload.type === "text") {
-        process.stdout.write(event.payload.text)
-      }
-      break
-    case "ended":
-      console.log(`Session ended: ${event.payload.finishReason}`)
-      break
-  }
-})
-```
-
-ClineCore results use `AgentResult` with `.text` (not `.outputText` like the standalone Agent's `AgentRunResult`).
-
-## Session Persistence
-
-Sessions are stored at:
-```
-~/.cline/data/sessions/
-  sessions.db       # SQLite database
-  [session-id].json # Message history
-```
-
-## Next Steps
-
-- `api.md` - Full ClineCore API reference
-- `patterns.md` - Common patterns and best practices
-- `gotchas.md` - Pitfalls and debugging
-- `../tools/REFERENCE.md` - Custom tool creation
-- `../plugins/REFERENCE.md` - Plugin system
-- `../scheduling/REFERENCE.md` - Scheduled agents

.agents/skills/cline-sdk/references/clinecore/api.md

@@ -1,304 +0,0 @@
-# ClineCore API Reference
-
-## Creating ClineCore
-
-```typescript
-import { ClineCore } from "@cline/sdk"
-
-const cline = await ClineCore.create(options: ClineCoreOptions)
-```
-
-### ClineCoreOptions
-
-```typescript
-interface ClineCoreOptions {
-  clientName: string                     // identifies your app
-  distinctId?: string                    // user/instance identifier
-  backendMode?: "auto" | "local" | "hub" | "remote"
-  hub?: HubOptions
-  remote?: RemoteOptions
-  capabilities?: RuntimeCapabilities
-  toolPolicies?: Record<string, ToolPolicy>
-  automation?: boolean | ClineCoreAutomationOptions
-  fetch?: typeof fetch
-}
-```
-
-### RuntimeCapabilities
-
-```typescript
-interface RuntimeCapabilities {
-  requestToolApproval?: (request: ToolApprovalRequest) => Promise<ToolApprovalResult>
-  // ... other capability callbacks
-}
-```
-
-## Starting Sessions
-
-### start(input)
-
-```typescript
-const session = await cline.start(input: ClineCoreStartInput)
-```
-
-Returns a `StartSessionResult`:
-
-```typescript
-interface StartSessionResult {
-  sessionId: string
-  manifest: SessionManifest
-  manifestPath: string
-  messagesPath: string
-  result?: AgentResult
-}
-```
-
-### ClineCoreStartInput
-
-```typescript
-interface ClineCoreStartInput {
-  prompt: string
-  config: CoreSessionConfig
-  source?: string
-  interactive?: boolean
-  sessionMetadata?: Record<string, unknown>
-  initialMessages?: AgentMessage[]
-  toolPolicies?: Record<string, ToolPolicy>
-  capabilities?: RuntimeCapabilities
-}
-```
-
-### CoreSessionConfig
-
-```typescript
-interface CoreSessionConfig {
-  cwd?: string                          // working directory
-  providerId: string                    // LLM provider
-  modelId: string                       // model identifier
-  apiKey?: string                       // provider API key
-  systemPrompt?: string                 // custom system prompt
-  tools?: readonly AgentTool[]          // additional custom tools
-  enableTools?: boolean                 // enable built-in tools
-  hooks?: Partial<AgentRuntimeHooks>    // runtime hooks
-  extensions?: AgentPlugin[]            // plugins loaded inline
-  pluginPaths?: string[]                // paths to plugin packages
-  extensionLoading?: "isolated" | "direct"
-  extensionContext?: {                  // context passed to plugin setup()
-    workspace?: { rootPath: string; cwd: string }
-  }
-  checkpointConfig?: CoreCheckpointConfig
-  compactionConfig?: CoreCompactionConfig
-  telemetry?: ITelemetryService
-  logger?: BasicLogger
-  enableSpawnAgent?: boolean            // enable sub-agent spawning
-  enableAgentTeams?: boolean            // enable team coordination
-  teamName?: string                     // team identifier
-}
-```
-
-`extensions` passes plugin objects directly. `pluginPaths` points to directories with `package.json` containing a `cline.plugins` field. Set `extensionContext.workspace` so plugins receive `ctx.workspaceInfo` in their `setup()` call -- without it, `ctx.workspaceInfo` is undefined.
-
-## Follow-Up Messages
-
-### send({ sessionId, prompt })
-
-Send a follow-up message to an existing session:
-
-```typescript
-const result = await cline.send({
-  sessionId: session.sessionId,
-  prompt: "Now add authentication",
-})
-```
-
-Returns `AgentResult | undefined`.
-
-## Event Subscription
-
-### subscribe(listener, options?)
-
-```typescript
-const unsubscribe = cline.subscribe(
-  (event: CoreSessionEvent) => {
-    // handle events
-  },
-  { sessionId: "optional-filter" }
-)
-```
-
-### CoreSessionEvent
-
-```typescript
-type CoreSessionEvent =
-  | { type: "chunk"; payload: SessionChunkEvent }
-  | { type: "agent_event"; payload: { sessionId: string, event: AgentEvent } }
-  | { type: "ended"; payload: SessionEndedEvent }
-  | { type: "team_progress"; payload: SessionTeamProgressEvent }
-  | { type: "status"; payload: { sessionId: string, status: string } }
-  | { type: "hook"; payload: SessionToolEvent }
-```
-
-## Session Management
-
-### list(limit?, options?)
-
-```typescript
-const sessions: SessionRecord[] = await cline.list(50)
-```
-
-### get(sessionId)
-
-```typescript
-const session: SessionRecord = await cline.get(sessionId)
-```
-
-### readMessages(sessionId)
-
-```typescript
-const messages: AgentMessage[] = await cline.readMessages(sessionId)
-```
-
-### getAccumulatedUsage(sessionId)
-
-```typescript
-const usage = await cline.getAccumulatedUsage(sessionId)
-// usage.usage - root agent only
-// usage.aggregateUsage - root + subagents/teammates
-```
-
-### update(sessionId, updates)
-
-```typescript
-await cline.update(sessionId, { title: "New title" })
-```
-
-### abort(sessionId, reason?)
-
-```typescript
-await cline.abort(sessionId, "User cancelled")
-```
-
-### stop(sessionId)
-
-```typescript
-await cline.stop(sessionId)
-```
-
-### delete(sessionId)
-
-```typescript
-await cline.delete(sessionId)
-```
-
-### restore(input)
-
-Restore a session from a checkpoint:
-
-```typescript
-await cline.restore({ sessionId, checkpointId })
-```
-
-### dispose(reason?)
-
-Clean up all resources. Always call this when done:
-
-```typescript
-await cline.dispose("Shutting down")
-```
-
-## AgentResult
-
-Returned by session operations:
-
-```typescript
-interface AgentResult {
-  text: string
-  usage: LegacyAgentUsage
-  messages: MessageWithMetadata[]
-  toolCalls: ToolCallRecord[]
-  iterations: number
-  finishReason: "completed" | "max_iterations" | "aborted" | "mistake_limit" | "error"
-  model: { id: string; provider: string; info?: ModelInfo }
-  startedAt: Date
-  endedAt: Date
-  durationMs: number
-}
-```
-
-## Tool Policies
-
-Control tool access at the session level:
-
-```typescript
-const session = await cline.start({
-  prompt: "Review the code",
-  config: { ... },
-  toolPolicies: {
-    read_files: { autoApprove: true },
-    bash: { autoApprove: false },
-    editor: { enabled: false },
-  },
-})
-```
-
-### ToolPolicy
-
-```typescript
-interface ToolPolicy {
-  enabled?: boolean       // false = tool is hidden from the model
-  autoApprove?: boolean   // false = requires approval callback
-}
-```
-
-## Interactive Approval
-
-```typescript
-const cline = await ClineCore.create({
-  clientName: "my-app",
-  capabilities: {
-    requestToolApproval: async (request) => {
-      console.log(`Tool: ${request.toolName}, Input: ${JSON.stringify(request.input)}`)
-      const approved = await askUser(`Allow ${request.toolName}?`)
-      return { approved }
-    },
-  },
-})
-```
-
-## Automation API
-
-When `automation` is enabled in `ClineCore.create()`:
-
-```typescript
-const cline = await ClineCore.create({
-  clientName: "my-app",
-  automation: true,
-})
-
-// Access automation methods
-cline.automation.start()
-cline.automation.stop()
-cline.automation.reconcile(specs)
-cline.automation.ingestEvent(event)
-cline.automation.listEvents()
-cline.automation.listSpecs()
-cline.automation.listRuns()
-```
-
-## Settings API
-
-```typescript
-// Read settings
-const settings = await cline.settings.list()
-
-// Toggle tools, plugins, MCP servers
-await cline.settings.toggle({ type: "tool", name: "bash", enabled: true })
-```
-
-## See Also
-
-- `REFERENCE.md` - Overview and quick start
-- `patterns.md` - Common patterns
-- `gotchas.md` - Pitfalls
-- `../tools/REFERENCE.md` - Tool creation
-- `../plugins/REFERENCE.md` - Plugin system

.agents/skills/cline-sdk/references/clinecore/gotchas.md

@@ -1,148 +0,0 @@
-# ClineCore Gotchas
-
-## Always Call dispose()
-
-`ClineCore` holds resources (file watchers, database connections, hub connections). Failing to call `dispose()` can leave orphan processes and file locks.
-
-```typescript
-const cline = await ClineCore.create({ clientName: "my-app" })
-try {
-  // ... use cline
-} finally {
-  await cline.dispose()
-}
-```
-
-## Node.js 22 Required
-
-ClineCore and `@cline/core` require Node.js 22 or later. If you're on an older version, you'll get runtime errors. Check with `node --version`.
-
-## Session Config vs Global Config
-
-Tool policies can be set at two levels:
-- Global: in `ClineCore.create({ toolPolicies })` -- applies to all sessions
-- Per-session: in `cline.start({ toolPolicies })` -- overrides global for that session
-
-Per-session policies take precedence.
-
-## enableTools Must Be Explicit
-
-Built-in tools (bash, editor, read_files, etc.) are not available unless you set `enableTools: true` in the session config:
-
-```typescript
-await cline.start({
-  prompt: "Read package.json",
-  config: {
-    providerId: "anthropic",
-    modelId: "claude-sonnet-4-6",
-    enableTools: true,  // required for built-in tools
-  },
-})
-```
-
-Without this, the agent only has access to custom tools you provide via `config.tools`.
-
-## cwd Matters for Built-in Tools
-
-Built-in tools like `bash`, `editor`, and `read_files` operate relative to `config.cwd`. If not set, they use the process working directory. Always set it explicitly for predictable behavior:
-
-```typescript
-config: {
-  cwd: "/absolute/path/to/project",
-  // ...
-}
-```
-
-## Hub Startup Latency
-
-With `backendMode: "auto"`, the first session may be slow if a hub daemon needs to be spawned. For immediate responsiveness:
-- Use `backendMode: "local"` for in-process execution (fastest startup)
-- Pre-warm the hub with `cline hub ensure` CLI command
-- Accept the one-time startup cost and let subsequent sessions reuse the hub
-
-## Session Storage Location
-
-Sessions are stored at `~/.cline/data/sessions/`. This includes:
-- `sessions.db` - SQLite database with session metadata
-- `[session-id].json` - Individual message history files
-
-If you're running in a container or ephemeral environment, these paths may not persist across restarts.
-
-## requestToolApproval Blocks Execution
-
-When a tool policy has `autoApprove: false` and you provide a `requestToolApproval` callback, the agent loop blocks until your callback resolves. If your callback never resolves (e.g., waiting for user input that never comes), the session hangs.
-
-For automated pipelines, either:
-- Set all tools to `autoApprove: true`
-- Implement a timeout in your approval callback
-
-## Plugin Discovery Paths
-
-ClineCore discovers plugins from:
-- Global: `~/.cline/plugins/`
-- Workspace: `.cline/plugins/`
-
-For SDK consumers, pass plugins via `extensions: [plugin]` or `pluginPaths: ["./path"]` in the session config.
-
-If a plugin isn't loading, verify:
-- The file is in one of the discovery directories, or passed via `extensions`/`pluginPaths`
-- The file exports a default plugin object with a non-empty `manifest.capabilities` array
-- Every `api.register*` call in `setup()` has a matching capability declared
-- If `hooks` is present on the plugin, `"hooks"` is in `capabilities`
-
-## extensionContext.workspace Is Required for Plugins
-
-If your plugins use `ctx.workspaceInfo` (e.g., to resolve workspace paths), you must set `extensionContext.workspace` in the session config. Without it, `ctx.workspaceInfo` is undefined:
-
-```typescript
-await cline.start({
-  config: {
-    extensions: [myPlugin],
-    extensionContext: {
-      workspace: { rootPath: process.cwd(), cwd: process.cwd() },
-    },
-  },
-})
-```
-
-The CLI sets this automatically, but SDK consumers must set it explicitly.
-
-## send() Requires an Active Session
-
-`cline.send()` only works on sessions that are still active. If a session has already completed, `send()` may return `undefined` or fail. Check session status with `cline.get(sessionId)` first.
-
-## Result May Be Undefined
-
-`session.result` can be `undefined` if the session was started but hasn't completed yet (e.g., in a non-blocking hub mode). Check for this:
-
-```typescript
-const session = await cline.start({ ... })
-if (session.result) {
-  console.log(session.result.text)
-} else {
-  console.log("Session started but not yet complete")
-}
-```
-
-## Compaction and Long Sessions
-
-For long-running sessions, message history grows and eventually exceeds the model's context window. ClineCore handles this via compaction, which summarizes older messages. Configure it via `compactionConfig`:
-
-```typescript
-config: {
-  compactionConfig: {
-    strategy: "summarize",
-    // ...
-  },
-}
-```
-
-The default strategy works for most cases, but extremely long sessions may benefit from tuning.
-
-## See Also
-
-- `api.md` - Full API reference
-- `patterns.md` - Common patterns
-- `../agent/gotchas.md` - Agent-level gotchas
-- `../tools/REFERENCE.md` - Tool troubleshooting
-- `../providers/REFERENCE.md` - Provider troubleshooting

.agents/skills/cline-sdk/references/clinecore/patterns.md

@@ -1,279 +0,0 @@
-# ClineCore Patterns
-
-## Basic Session with Built-in Tools
-
-```typescript
-import { ClineCore } from "@cline/sdk"
-
-const cline = await ClineCore.create({ clientName: "my-app" })
-
-const session = await cline.start({
-  prompt: "Read package.json and summarize the dependencies",
-  config: {
-    providerId: "anthropic",
-    modelId: "claude-sonnet-4-6",
-    apiKey: process.env.ANTHROPIC_API_KEY,
-    cwd: process.cwd(),
-    enableTools: true,
-  },
-})
-
-console.log(session.result?.text)
-await cline.dispose()
-```
-
-## Streaming Session with UI Updates
-
-```typescript
-const cline = await ClineCore.create({ clientName: "my-app" })
-
-cline.subscribe((event) => {
-  switch (event.type) {
-    case "chunk":
-      if (event.payload.type === "text") {
-        ui.appendText(event.payload.text)
-      }
-      break
-    case "ended":
-      ui.showComplete(event.payload.finishReason)
-      break
-  }
-})
-
-await cline.start({
-  prompt: "Refactor the auth module",
-  config: {
-    providerId: "anthropic",
-    modelId: "claude-sonnet-4-6",
-    cwd: "/path/to/project",
-    enableTools: true,
-  },
-})
-```
-
-## Multi-Turn Session
-
-```typescript
-const cline = await ClineCore.create({ clientName: "my-app" })
-
-const session = await cline.start({
-  prompt: "Create a new Express server",
-  config: {
-    providerId: "anthropic",
-    modelId: "claude-sonnet-4-6",
-    cwd: "/path/to/project",
-    enableTools: true,
-  },
-})
-
-// Follow-up
-const result = await cline.send({
-  sessionId: session.sessionId,
-  prompt: "Now add a health check endpoint",
-})
-
-console.log(result?.text)
-await cline.dispose()
-```
-
-## Tiered Permission Model
-
-Auto-approve reads, require approval for writes:
-
-```typescript
-const cline = await ClineCore.create({
-  clientName: "my-app",
-  toolPolicies: {
-    read_files: { autoApprove: true },
-    search: { autoApprove: true },
-    fetch_web: { autoApprove: true },
-    bash: { autoApprove: false },
-    editor: { autoApprove: false },
-    apply_patch: { autoApprove: false },
-  },
-  capabilities: {
-    requestToolApproval: async (request) => {
-      const approved = await promptUser(
-        `Allow ${request.toolName}?\n${JSON.stringify(request.input, null, 2)}`
-      )
-      return { approved }
-    },
-  },
-})
-```
-
-## Custom Tools Alongside Built-ins
-
-```typescript
-import { ClineCore, createTool } from "@cline/sdk"
-import { z } from "zod"
-
-const deployTool = createTool({
-  name: "deploy",
-  description: "Deploy the application to the specified environment.",
-  inputSchema: z.object({
-    environment: z.enum(["staging", "production"]),
-  }),
-  execute: async (input) => {
-    const result = await runDeployment(input.environment)
-    return { url: result.url, status: "deployed" }
-  },
-})
-
-const cline = await ClineCore.create({ clientName: "my-app" })
-
-await cline.start({
-  prompt: "Deploy the app to staging",
-  config: {
-    providerId: "anthropic",
-    modelId: "claude-sonnet-4-6",
-    cwd: process.cwd(),
-    enableTools: true,
-    tools: [deployTool],
-  },
-})
-```
-
-## Session with Plugins
-
-Load plugins inline with `extensions` and provide workspace context so plugins can access `ctx.workspaceInfo`:
-
-```typescript
-import { ClineCore } from "@cline/sdk"
-import myPlugin from "./my-plugin"
-
-const cline = await ClineCore.create({
-  clientName: "my-app",
-  backendMode: "local",
-})
-
-await cline.start({
-  prompt: "Do the thing my plugin enables",
-  config: {
-    providerId: "anthropic",
-    modelId: "claude-sonnet-4-6",
-    cwd: process.cwd(),
-    enableTools: true,
-    extensions: [myPlugin],
-    extensionContext: {
-      workspace: { rootPath: process.cwd(), cwd: process.cwd() },
-    },
-  },
-})
-
-await cline.dispose()
-```
-
-For directory-based plugin packages, use `pluginPaths` instead:
-
-```typescript
-config: {
-  pluginPaths: ["./my-cline-plugin"],
-  extensionContext: {
-    workspace: { rootPath: process.cwd(), cwd: process.cwd() },
-  },
-}
-```
-
-See `../plugins/REFERENCE.md` for the full plugin authoring guide.
-
-## Session Listing and Replay
-
-```typescript
-const cline = await ClineCore.create({ clientName: "my-app" })
-
-// List recent sessions
-const sessions = await cline.list(10)
-for (const session of sessions) {
-  console.log(`${session.id}: ${session.title}`)
-}
-
-// Read messages from a past session
-const messages = await cline.readMessages(sessions[0].id)
-for (const msg of messages) {
-  console.log(`[${msg.role}] ${msg.content}`)
-}
-
-// Check usage
-const usage = await cline.getAccumulatedUsage(sessions[0].id)
-console.log(`Total tokens: ${usage.aggregateUsage.totalInputTokens + usage.aggregateUsage.totalOutputTokens}`)
-```
-
-## Graceful Shutdown
-
-```typescript
-const cline = await ClineCore.create({ clientName: "my-app" })
-
-process.on("SIGTERM", async () => {
-  await cline.dispose("SIGTERM received")
-  process.exit(0)
-})
-
-// Run sessions...
-```
-
-## Stateless Worker Pattern
-
-For request/response workloads (API endpoints, queue consumers):
-
-```typescript
-import { ClineCore } from "@cline/sdk"
-
-const cline = await ClineCore.create({
-  clientName: "worker",
-  backendMode: "local",
-})
-
-async function handleRequest(prompt: string, workspace: string) {
-  const session = await cline.start({
-    prompt,
-    config: {
-      providerId: "anthropic",
-      modelId: "claude-sonnet-4-6",
-      cwd: workspace,
-      enableTools: true,
-    },
-  })
-
-  return {
-    text: session.result?.text,
-    usage: session.result?.usage,
-    sessionId: session.sessionId,
-  }
-}
-```
-
-## Hub-Backed Multi-Client
-
-Multiple clients can attach to the same session:
-
-```typescript
-// Process 1: start session
-const cline = await ClineCore.create({
-  clientName: "backend",
-  backendMode: "hub",
-})
-
-const session = await cline.start({
-  prompt: "Long running refactor task",
-  config: { ... },
-})
-
-// Process 2: attach and stream events
-const viewer = await ClineCore.create({
-  clientName: "dashboard",
-  backendMode: "hub",
-})
-
-viewer.subscribe((event) => {
-  dashboard.render(event)
-}, { sessionId: session.sessionId })
-```
-
-## See Also
-
-- `api.md` - Full API reference
-- `gotchas.md` - Common pitfalls
-- `../tools/REFERENCE.md` - Tool creation
-- `../plugins/REFERENCE.md` - Plugin system
-- `../scheduling/REFERENCE.md` - Scheduled agents

.agents/skills/cline-sdk/references/events/REFERENCE.md

@@ -1,269 +0,0 @@
-# Events
-
-The Cline SDK has three event layers. Which one you use depends on whether you're working with the standalone `Agent` class or `ClineCore`.
-
-## Which Events Do I Get?
-
-| If you use... | You subscribe with... | You receive... | Text streaming event |
-|---|---|---|---|
-| Standalone `Agent` | `agent.subscribe()` | `AgentRuntimeEvent` | `assistant-text-delta` |
-| `ClineCore` | `cline.subscribe()` | `CoreSessionEvent` | `chunk` (with `payload.type === "text"`) |
-
-These are different event types with different shapes. Do not mix them up.
-
-## Layer 1: AgentRuntimeEvent (Standalone Agent)
-
-Emitted by the `Agent` class via `agent.subscribe()`. This is what you get when using `new Agent(...)` directly. Every event includes a `snapshot` field with the current `AgentRuntimeStateSnapshot`.
-
-### Run Lifecycle
-
-```typescript
-{ type: "run-started", snapshot }
-{ type: "run-finished", snapshot, result: AgentRunResult }
-{ type: "run-failed", snapshot, error: Error }
-```
-
-### Turns
-
-```typescript
-{ type: "turn-started", snapshot, iteration: number }
-{ type: "turn-finished", snapshot, iteration: number, toolCallCount: number }
-```
-
-### Text Streaming
-
-```typescript
-// Streaming text delta (arrives as chunks during generation)
-{ type: "assistant-text-delta", snapshot, iteration: number, text: string, accumulatedText: string }
-
-// Streaming reasoning delta (when model uses extended thinking)
-{ type: "assistant-reasoning-delta", snapshot, iteration: number, text: string }
-
-// Complete assistant message after model finishes
-{ type: "assistant-message", snapshot, iteration: number, message: AgentMessage, finishReason: string }
-```
-
-### Messages
-
-```typescript
-// Fired when any message (user or assistant) is added to conversation history
-{ type: "message-added", snapshot, message: AgentMessage }
-```
-
-### Tool Events
-
-```typescript
-{ type: "tool-started", snapshot, toolCall: { toolName: string, toolCallId: string, input: unknown } }
-{ type: "tool-updated", snapshot, toolCall: { toolName: string, toolCallId: string }, update: string }
-{ type: "tool-finished", snapshot, toolCall: { toolName: string, toolCallId: string }, message: AgentMessage }
-```
-
-### Usage
-
-```typescript
-{
-  type: "usage-updated",
-  snapshot,
-  usage: {
-    inputTokens: number,
-    outputTokens: number,
-    cacheReadTokens?: number,
-    cacheWriteTokens?: number,
-    totalCost?: number,
-  },
-}
-```
-
-### Notices
-
-```typescript
-{ type: "status-notice", snapshot, message: string, metadata?: Record<string, unknown> }
-```
-
-### Subscribing
-
-Use `agent.subscribe()`. Register the listener before calling `run()` to avoid missing early events.
-
-```typescript
-const agent = new Agent({
-  providerId: "anthropic",
-  modelId: "claude-sonnet-4-6",
-  apiKey: process.env.ANTHROPIC_API_KEY,
-  systemPrompt: "You are a helpful assistant.",
-  tools: [],
-})
-
-agent.subscribe((event) => {
-  switch (event.type) {
-    case "assistant-text-delta":
-      process.stdout.write(event.text)
-      break
-    case "tool-started":
-      console.log(`\nUsing tool: ${event.toolCall.toolName}`)
-      break
-    case "usage-updated":
-      console.log(`Cost: $${event.usage.totalCost?.toFixed(4)}`)
-      break
-    case "run-finished":
-      console.log(`\nDone: ${event.result.status}`)
-      break
-  }
-})
-
-const result = await agent.run("Hello!")
-```
-
-You can also receive events through hooks (these are awaited, so they can be async):
-
-```typescript
-const agent = new Agent({
-  ...config,
-  hooks: {
-    onEvent: async (event) => {
-      // Same AgentRuntimeEvent types as subscribe()
-    },
-  },
-})
-```
-
-## Layer 2: AgentEvent (ClineCore Internal)
-
-When using `ClineCore`, a `RuntimeEventAdapter` translates Layer 1 events into a legacy format called `AgentEvent`. You do not interact with this layer directly -- it is projected into `CoreSessionEvent` for subscribers. The key mappings:
-
-| AgentRuntimeEvent (Layer 1) | AgentEvent (Layer 2) |
-|---|---|
-| `turn-started` | `iteration_start` |
-| `turn-finished` | `iteration_end` |
-| `assistant-text-delta` | `content_start` (text) |
-| `assistant-message` | `content_end` (text) |
-| `tool-started` | `content_start` (tool) |
-| `tool-updated` | `content_update` (tool) |
-| `tool-finished` | `content_end` (tool) |
-| `usage-updated` | `usage` (with computed deltas) |
-| `run-finished` | `done` |
-| `run-failed` | `error` |
-| `run-started`, `message-added` | (suppressed, not emitted) |
-
-This layer exists for backwards compatibility. If you see event types like `content_update` or `iteration_start` in other documentation, they refer to this layer, not to what `agent.subscribe()` emits.
-
-## Layer 3: CoreSessionEvent (ClineCore Subscriber)
-
-Emitted by `ClineCore` via `cline.subscribe()`. These are higher-level session events.
-
-```typescript
-type CoreSessionEvent =
-  | { type: "chunk"; payload: SessionChunkEvent }
-  | { type: "agent_event"; payload: { sessionId: string, event: AgentEvent } }
-  | { type: "ended"; payload: SessionEndedEvent }
-  | { type: "team_progress"; payload: SessionTeamProgressEvent }
-  | { type: "status"; payload: { sessionId: string, status: string } }
-  | { type: "hook"; payload: SessionToolEvent }
-```
-
-### SessionChunkEvent
-
-```typescript
-interface SessionChunkEvent {
-  type: "text" | "reasoning"
-  text: string
-  sessionId: string
-}
-```
-
-### SessionEndedEvent
-
-```typescript
-interface SessionEndedEvent {
-  sessionId: string
-  finishReason: "completed" | "max_iterations" | "aborted" | "mistake_limit" | "error"
-  result?: AgentResult
-}
-```
-
-### Subscribing
-
-```typescript
-cline.subscribe((event) => {
-  switch (event.type) {
-    case "chunk":
-      if (event.payload.type === "text") {
-        process.stdout.write(event.payload.text)
-      }
-      break
-    case "ended":
-      console.log(`Finished: ${event.payload.finishReason}`)
-      break
-  }
-})
-```
-
-Filter by session:
-
-```typescript
-cline.subscribe(handler, { sessionId: "specific-session-id" })
-```
-
-## Hub Events (Layer 3b)
-
-When ClineCore runs in hub mode (via `backendMode: "hub"` or `"auto"` when a hub is available), events are projected over WebSocket using `HubEventName` types like `assistant.delta`, `iteration.started`, `tool.started`, etc. You do not interact with these directly -- `cline.subscribe()` still gives you `CoreSessionEvent` regardless of backend mode.
-
-## Result Type Differences
-
-The standalone Agent and ClineCore return different result types:
-
-| API | Result type | Text property |
-|---|---|---|
-| `agent.run()` | `AgentRunResult` | `result.outputText` |
-| `cline.start()` / `cline.send()` | `AgentResult` | `result.text` |
-
-## Common Patterns
-
-### Streaming Text (Standalone Agent)
-
-```typescript
-agent.subscribe((event) => {
-  if (event.type === "assistant-text-delta") {
-    process.stdout.write(event.text)
-  }
-})
-```
-
-### Streaming Text (ClineCore)
-
-```typescript
-cline.subscribe((event) => {
-  if (event.type === "chunk" && event.payload.type === "text") {
-    process.stdout.write(event.payload.text)
-  }
-})
-```
-
-### Usage Tracking (Standalone Agent)
-
-```typescript
-agent.subscribe((event) => {
-  if (event.type === "usage-updated" && event.usage.totalCost) {
-    console.log(`Running cost: $${event.usage.totalCost.toFixed(4)}`)
-  }
-})
-```
-
-### Tool Call Logging (Standalone Agent)
-
-```typescript
-agent.subscribe((event) => {
-  if (event.type === "tool-started") {
-    console.log(`Tool started: ${event.toolCall.toolName}`)
-  }
-  if (event.type === "tool-finished") {
-    console.log(`Tool finished: ${event.toolCall.toolName}`)
-  }
-})
-```
-
-## See Also
-
-- `../agent/REFERENCE.md` - Agent runtime overview
-- `../clinecore/REFERENCE.md` - ClineCore session management
-- `../plugins/REFERENCE.md` - Plugin hooks for lifecycle events
-- `../production/REFERENCE.md` - Observability in production

.agents/skills/cline-sdk/references/multi-agent/REFERENCE.md

@@ -1,157 +0,0 @@
-# Multi-Agent Coordination
-
-The Cline SDK supports two models for multi-agent work: sub-agents (parent-child) and teams (peer-to-peer).
-
-## Sub-Agents vs Teams
-
-| Feature | Sub-Agents | Teams |
-|---------|-----------|-------|
-| Enable with | `enableSpawnAgent: true` | `enableAgentTeams: true` |
-| Persistence | Session-scoped only | Across sessions |
-| Coordination | Parent-child hierarchy | Peer-to-peer |
-| Shared state | None | Task board, mailbox, mission log |
-| Best for | One-off delegation | Complex multi-session projects |
-
-## Sub-Agents
-
-Sub-agents are spawned by a parent agent during a run. They execute independently and report results back.
-
-### Enabling Sub-Agents
-
-```typescript
-const cline = await ClineCore.create({ clientName: "my-app" })
-
-await cline.start({
-  prompt: "Refactor the auth module and update tests",
-  config: {
-    providerId: "anthropic",
-    modelId: "claude-sonnet-4-6",
-    enableSpawnAgent: true,
-    enableTools: true,
-  },
-})
-```
-
-When `enableSpawnAgent` is true, the agent gets access to sub-agent tools:
-
-| Tool | Description |
-|------|-------------|
-| `start_subagent` | Spawn a background agent with a task |
-| `message_subagent` | Send a message to a running sub-agent |
-| `handoff_to_agent` | Delegate the current task entirely |
-| `submit_and_exit` | Signal completion |
-
-### How Sub-Agents Work
-
-1. The parent agent decides a subtask can be delegated
-2. It calls `start_subagent` with a role, task description, and optionally a preset
-3. The sub-agent runs independently in the background
-4. The parent can check status or send follow-up messages
-5. Sub-agent results are available to the parent when complete
-
-## Teams
-
-Teams provide persistent, cross-session coordination between agents.
-
-### Enabling Teams
-
-```typescript
-await cline.start({
-  config: {
-    providerId: "anthropic",
-    modelId: "claude-sonnet-4-6",
-    enableAgentTeams: true,
-    teamName: "auth-sprint",
-    enableTools: true,
-  },
-})
-```
-
-### Team Tools
-
-When `enableAgentTeams` is true, the coordinator agent gets:
-
-| Tool | Description |
-|------|-------------|
-| `team_spawn_teammate` | Create a new agent with a role and task |
-| `team_delegate_task` | Assign a task to an existing teammate |
-| `team_check_status` | Check on a delegated task's progress |
-| `team_get_result` | Get the completed result from a teammate |
-
-### Team Persistence
-
-Teams store shared state in:
-
-```
-~/.cline/data/teams/[team-name]/
-  task-board.json    # task assignments and status
-  mailbox.json       # inter-agent messages
-  mission-log.json   # coordination log
-```
-
-This state persists across sessions, so team members can pick up where they left off.
-
-### CLI Team Access
-
-```bash
-cline --team-name auth-sprint "Continue the auth refactor"
-```
-
-## Choosing Between Sub-Agents and Teams
-
-Use sub-agents when:
-- You need one-off parallel execution within a single session
-- Tasks are independent and don't need to communicate with each other
-- Results only matter to the parent agent
-
-Use teams when:
-- Work spans multiple sessions over time
-- Agents need to coordinate and share progress
-- Tasks have dependencies between them
-- You want a persistent record of multi-agent collaboration
-
-## Patterns
-
-### Parallel Research with Sub-Agents
-
-A parent agent spawns multiple sub-agents to research different topics simultaneously:
-
-```typescript
-await cline.start({
-  prompt: `Research these three topics in parallel:
-    1. Current best practices for JWT auth
-    2. OAuth 2.0 provider comparison
-    3. Session management patterns
-    Spawn a sub-agent for each topic, then synthesize the results.`,
-  config: {
-    enableSpawnAgent: true,
-    enableTools: true,
-    // ...
-  },
-})
-```
-
-### Team Sprint
-
-A coordinator manages a multi-session project:
-
-```typescript
-await cline.start({
-  prompt: `You are the coordinator for the auth-sprint team.
-    Review the task board and delegate the next highest-priority task
-    to a teammate. Check status on any in-progress tasks.`,
-  config: {
-    enableAgentTeams: true,
-    teamName: "auth-sprint",
-    enableTools: true,
-    // ...
-  },
-})
-```
-
-## See Also
-
-- `../clinecore/REFERENCE.md` - ClineCore runtime
-- `../clinecore/api.md` - Session config for teams
-- `../tools/REFERENCE.md` - Tool system
-- `../plugins/REFERENCE.md` - Plugin system

.agents/skills/cline-sdk/references/plugins/REFERENCE.md

@@ -1,649 +0,0 @@
-# Plugins
-
-A Cline plugin is a TypeScript module that extends any agent built on the Cline SDK. The same plugin runs in the Cline CLI, VS Code and JetBrains extensions, and any custom app built on `@cline/core`.
-
-A plugin can:
-
-- Register tools the model can call.
-- Hook into the agent loop before/after runs, model calls, and tool calls.
-- Rewrite provider messages before they hit the model (custom compaction, redaction, context shaping).
-- Register slash commands, prompt rules, providers, and automation event types.
-
-A plugin ships in one of two shapes:
-
-1. Single-file plugin -- one `.ts` file that exports a default plugin object. Drop it in a discovery folder and it loads.
-2. Plugin package -- a directory with `package.json`, npm dependencies, and optionally bundled assets. Installable via `cline plugin install`.
-
-Both shapes use the same plugin API.
-
-## The Mental Model
-
-When the host starts a session, it builds a registry of plugins and runs four phases:
-
-1. resolve -- collect the plugin objects.
-2. validate -- check each plugin's `manifest`. Capabilities must be non-empty; declared hook stages must have matching handlers; if `hooks` is present, `"hooks"` must be in `capabilities`.
-3. setup -- call each plugin's `setup(api, ctx)` once. This is where you `registerTool`, `registerCommand`, etc.
-4. activate -- registry is frozen, the agent loop starts, and your hooks/tools are live.
-
-Two invariants the registry enforces:
-
-- Every contribution requires a matching capability. Calling `api.registerRule(...)` without `"rules"` in `manifest.capabilities` throws.
-- Capabilities and handlers must agree. Declaring `"hooks"` without a `hooks` object, or vice versa, fails validation.
-
-After validation, registration is one-shot -- no dynamic register/unregister during the session.
-
-## The Smallest Working Plugin
-
-```typescript
-import type { AgentPlugin } from "@cline/core"
-import { createTool } from "@cline/core"
-
-const plugin: AgentPlugin = {
-  name: "hello-plugin",
-  manifest: {
-    capabilities: ["tools"],
-  },
-  setup(api, ctx) {
-    api.registerTool(
-      createTool({
-        name: "say_hello",
-        description: "Greet a person by name.",
-        inputSchema: {
-          type: "object",
-          properties: { name: { type: "string" } },
-          required: ["name"],
-        },
-        async execute({ name }: { name: string }) {
-          return { greeting: `Hello, ${name}!` }
-        },
-      }),
-    )
-  },
-}
-
-export default plugin
-```
-
-The agent will see `say_hello` as a callable tool.
-
-## The Manifest
-
-```typescript
-manifest: {
-  capabilities: ["tools", "hooks"],   // required, non-empty array
-  paths?: string[],                   // optional, multi-entry packages
-  providerIds?: string[],             // optional, provider plugins
-  modelIds?: string[],                // optional, model plugins
-}
-```
-
-### The Complete Capability List
-
-| Capability | What It Unlocks in `api` |
-|-----------|--------------------------|
-| `"tools"` | `api.registerTool()` |
-| `"commands"` | `api.registerCommand()` (slash commands in chat surfaces) |
-| `"rules"` | `api.registerRule()` (string injected into the system prompt) |
-| `"messageBuilders"` | `api.registerMessageBuilder()` (rewrites provider-bound messages) |
-| `"providers"` | `api.registerProvider()` (custom model provider) |
-| `"automationEvents"` | `api.registerAutomationEventType()` and `ctx.automation?.ingestEvent()` |
-| `"hooks"` | The runtime `hooks` object on the plugin (lifecycle callbacks) |
-
-You declare any combination -- most real plugins need 1-3 capabilities.
-
-## setup(api, ctx) -- The Registration Phase
-
-`setup()` runs once per session before the agent loop starts. Everything you register here is frozen for the lifetime of the session.
-
-### The api Object
-
-Each `register*` method requires the matching capability in your manifest:
-
-```typescript
-api.registerTool(tool)                              // requires "tools"
-api.registerCommand({ name, description, handler }) // requires "commands"
-api.registerRule({ id, content, source })            // requires "rules"
-api.registerMessageBuilder({ name, build })          // requires "messageBuilders"
-api.registerProvider({ name, description })          // requires "providers"
-api.registerAutomationEventType({ eventType, source }) // requires "automationEvents"
-```
-
-### The ctx Object -- Host-Provided Session Context
-
-The second argument carries everything the host knows about the current session. All fields are optional, so feature-detect before using them -- the same plugin must work in hosts that supply less context (unit tests, sandboxed plugin processes).
-
-```typescript
-ctx.session?.sessionId       // string, stable core session id
-ctx.client?.name             // host: "cline-cli", "cline-vscode", etc.
-ctx.user                     // authenticated user/org info, when available
-ctx.workspaceInfo            // { rootPath, hint, latestGitBranchName,
-                             //   latestGitCommitHash, associatedRemoteUrls }
-ctx.automation?.ingestEvent  // emit normalized automation events
-ctx.logger?.log              // structured logger scoped to this plugin
-ctx.telemetry                // ITelemetryService, only present in-process
-```
-
-Two rules about `ctx.workspaceInfo`:
-
-1. Always prefer `ctx.workspaceInfo?.rootPath` over `process.cwd()`. The CLI may have been launched with `--cwd` without calling `chdir`, and VS Code workspaces don't share a single CWD. `workspaceInfo` is sourced from the session config and is always correct.
-2. Don't use `import.meta.url` tricks to find "the workspace". That gives you the plugin's own location, not the user's project.
-
-### Persisting State Across Hooks
-
-`setup()` runs first; hooks fire later. The simplest way to share state is module-level variables:
-
-```typescript
-let sessionWorkspaceRoot: string | undefined
-let sessionBranch: string | undefined
-
-const plugin: AgentPlugin = {
-  name: "metrics",
-  manifest: { capabilities: ["hooks"] },
-  setup(api, ctx) {
-    sessionWorkspaceRoot = ctx.workspaceInfo?.rootPath
-    sessionBranch = ctx.workspaceInfo?.latestGitBranchName
-  },
-  hooks: {
-    beforeTool({ toolCall, input }) {
-      if (sessionBranch === "main" && toolCall.toolName === "run_commands") {
-        // inspect input, optionally block
-      }
-      return undefined
-    },
-  },
-}
-```
-
-A single Node process may host multiple sessions concurrently. If your plugin will run in a multi-session host, key your state by `ctx.session?.sessionId`:
-
-```typescript
-const stateBySession = new Map<string, MyState>()
-setup(api, ctx) {
-  const id = ctx.session?.sessionId
-  if (id) stateBySession.set(id, /* ... */)
-}
-```
-
-## Runtime Hooks
-
-Runtime hooks are typed in-process callbacks on the same hook layer the runtime uses internally. They run inside the agent loop with full type information -- no IPC, no JSON marshaling.
-
-Declare `"hooks"` in `manifest.capabilities`, then add a `hooks` property:
-
-```typescript
-const plugin: AgentPlugin = {
-  name: "metrics",
-  manifest: { capabilities: ["hooks"] },
-  hooks: {
-    beforeRun(ctx) { /* ... */ },
-    beforeTool({ toolCall, input }) { /* ... */ },
-    afterTool({ toolCall, result }) { /* ... */ },
-    afterRun({ result }) { /* ... */ },
-    onEvent(event) { /* ... */ },
-  },
-}
-```
-
-### The Seven Hooks
-
-| Hook | Fires | Can Stop the Loop? | Common Uses |
-|------|-------|--------------------|-------------|
-| `beforeRun` | Before the runtime loop starts | Yes | Greet, log, attach session metadata |
-| `afterRun` | After the runtime loop finishes (success, abort, or fail) | No | Notifications, metrics, persistent logs |
-| `beforeModel` | Before each model request | Yes (mutate req) | Inject context, last-mile prompt edits |
-| `afterModel` | After each model response, before tool execution | Yes | Block based on model output |
-| `beforeTool` | Before each tool execution | Yes (`{ stop }`) | Audit, redact, block dangerous tools |
-| `afterTool` | After each tool execution | Can replace result | Post-process, redact secrets in tool output |
-| `onEvent` | On every `AgentRuntimeEvent` emitted by the runtime | No | Streaming UIs, telemetry pipes |
-
-### Stopping the Loop from a Hook
-
-Several hooks return an optional control object. The most common pattern is `beforeTool` blocking a destructive tool call:
-
-```typescript
-beforeTool({ toolCall, input }) {
-  if (toolCall.toolName === "run_commands") {
-    const { commands } = input as { commands?: string[] }
-    if (sessionBranch === "main" && commands?.some(c => c.startsWith("git push"))) {
-      return { stop: true, reason: "Blocked git push on protected branch" }
-    }
-  }
-  return undefined  // explicit "continue"
-}
-```
-
-Returning `undefined` (or omitting `return`) lets execution continue normally.
-
-### afterRun Semantics
-
-`afterRun` fires for every terminal status -- `completed`, `aborted`, `failed`. If you only want to act on success:
-
-```typescript
-afterRun({ result }) {
-  if (result.status !== "completed") return
-  // notify, log success metrics, etc.
-}
-```
-
-### Plugin Hooks vs File Hooks
-
-The runtime supports two hook systems:
-
-- File hooks -- external scripts in `.cline/hooks/` invoked with serialized JSON. Right for user/workspace-specific scripts that don't ship with code.
-- Plugin runtime hooks -- typed in-process callbacks. Right when the behavior belongs to a reusable extension and needs typed access to the runtime.
-
-Core adapts file hooks onto the runtime hook layer, so you don't need both. If you're shipping a plugin, write it as runtime hooks.
-
-## Message Builders
-
-Message builders rewrite the provider-bound message list before the model call. They run after runtime messages are converted into SDK message blocks but before core's built-in safety builder.
-
-Use them for:
-
-- Custom compaction policies (replace middle history with a summary).
-- Redacting PII or secrets before they reach the provider.
-- Reshaping context for a specific model's strengths.
-
-```typescript
-api.registerMessageBuilder({
-  name: "summarize-middle-history",
-  build(messages) {
-    if (estimateTokens(messages) < THRESHOLD) return messages
-    return [...prefix, summary, ...recent]
-  },
-})
-```
-
-Multiple builders run in registration order; the output of one is the input of the next.
-
-When to use `beforeModel` instead: reach for the `beforeModel` hook only if you need the runtime snapshot or want to mutate the request object itself. Pure message rewrites belong in a builder.
-
-## Automation Events
-
-Plugins can declare normalized event types and emit them into Cline automation. Hosts that don't have automation enabled simply ignore both -- feature-detect `ctx.automation`.
-
-```typescript
-manifest: { capabilities: ["automationEvents"] },
-
-setup(api, ctx) {
-  api.registerAutomationEventType({
-    eventType: "github.pull_request.opened",
-    source: "github",
-    description: "A new GitHub PR was opened",
-    attributesSchema: { /* JSON Schema for envelope.attributes */ },
-  })
-
-  if (!ctx.automation) return  // host has no automation
-  ctx.automation.ingestEvent({
-    eventId: "pr-1234",
-    eventType: "github.pull_request.opened",
-    source: "github",
-    subject: "owner/repo#1234",
-    occurredAt: new Date().toISOString(),
-    attributes: { /* ... */ },
-  })
-}
-```
-
-## Loading a Plugin
-
-There are three ways a plugin gets into a session:
-
-### Auto-Discovery (CLI)
-
-The CLI scans these directories on startup:
-
-- `<workspace>/.cline/plugins/` -- project-scoped plugins.
-- `~/.cline/plugins/` -- user-scoped plugins.
-
-Drop a `.ts` or `.js` file in, run `cline`, done:
-
-```bash
-mkdir -p .cline/plugins
-cp my-plugin.ts .cline/plugins/
-cline -i "do the thing my plugin enables"
-```
-
-### Explicit extensions in SDK Config
-
-When you build your own host with `ClineCore`, pass the plugin object directly:
-
-```typescript
-import plugin from "./my-plugin"
-import { ClineCore } from "@cline/core"
-
-const host = await ClineCore.create({ backendMode: "local" })
-await host.start({
-  config: {
-    providerId: "anthropic",
-    modelId: "claude-sonnet-4-6",
-    apiKey: process.env.ANTHROPIC_API_KEY ?? "",
-    cwd: process.cwd(),
-    enableTools: true,
-    systemPrompt: "You are a helpful assistant.",
-    extensions: [plugin],
-    extensionContext: {
-      workspace: { rootPath: process.cwd(), cwd: process.cwd() },
-    },
-  },
-  prompt: "...",
-  interactive: false,
-})
-```
-
-### pluginPaths for Directory-Based Plugins
-
-When the plugin is a directory with `package.json`, point `pluginPaths` at the directory:
-
-```typescript
-config: {
-  pluginPaths: ["./path/to/my-plugin-package"],
-}
-```
-
-Or install with the CLI:
-
-```bash
-cline plugin install ./path/to/my-plugin-package
-cline plugin install @scope/my-cline-plugin       # from npm
-cline plugin install --git github.com/owner/repo  # from git
-```
-
-## Single-File Plugin Template
-
-Save as `my-plugin.ts`, drop in `.cline/plugins/`:
-
-```typescript
-import { type AgentPlugin, ClineCore, createTool } from "@cline/core"
-
-let sessionRoot: string | undefined
-
-const plugin: AgentPlugin = {
-  name: "my-plugin",
-  manifest: {
-    capabilities: ["tools", "hooks"],
-  },
-
-  setup(api, ctx) {
-    sessionRoot = ctx.workspaceInfo?.rootPath
-
-    api.registerTool(
-      createTool({
-        name: "do_thing",
-        description: "Do the thing this plugin exists for.",
-        inputSchema: {
-          type: "object",
-          properties: { target: { type: "string" } },
-          required: ["target"],
-        },
-        async execute(input) {
-          const { target } = input as { target: string }
-          return { ok: true, target, root: sessionRoot }
-        },
-      }),
-    )
-  },
-
-  hooks: {
-    beforeRun() {
-      console.log("[my-plugin] run started")
-    },
-    afterRun({ result }) {
-      if (result.status !== "completed") return
-      console.log(`[my-plugin] done in ${result.iterations} iteration(s)`)
-    },
-  },
-}
-
-async function runDemo(): Promise<void> {
-  const host = await ClineCore.create({ backendMode: "local" })
-  try {
-    const result = await host.start({
-      config: {
-        providerId: "anthropic",
-        modelId: "claude-sonnet-4-6",
-        apiKey: process.env.ANTHROPIC_API_KEY ?? "",
-        cwd: process.cwd(),
-        enableTools: true,
-        systemPrompt: "You are a helpful assistant. Use tools when needed.",
-        extensions: [plugin],
-        extensionContext: {
-          workspace: { rootPath: process.cwd(), cwd: process.cwd() },
-        },
-      },
-      prompt: "Use do_thing on the target 'world'.",
-      interactive: false,
-    })
-    console.log(result.result?.text ?? "")
-  } finally {
-    await host.dispose()
-  }
-}
-
-if (import.meta.main) {
-  await runDemo()
-}
-
-export { plugin, runDemo }
-export default plugin
-```
-
-Copy it, rename the tool, swap in your logic. The `runDemo()` function lets you test with `ANTHROPIC_API_KEY=sk-... bun run my-plugin.ts`.
-
-## Plugin Package
-
-Use a plugin package when you need npm dependencies, multiple entry points, bundled assets, or npm/git distribution.
-
-### Layout
-
-```
-my-cline-plugin/
-+-- package.json
-+-- tsconfig.json          (optional, for local typechecking)
-+-- index.ts               (the plugin entry point)
-+-- README.md
-+-- assets/                (optional, bundled content)
-    +-- templates/
-    +-- schemas/
-```
-
-### package.json -- The Discovery Contract
-
-```json
-{
-  "name": "my-cline-plugin",
-  "version": "0.1.0",
-  "private": true,
-  "description": "What this plugin does, in one sentence.",
-  "type": "module",
-  "exports": {
-    ".": "./index.ts"
-  },
-  "cline": {
-    "plugins": [
-      {
-        "paths": ["./index.ts"],
-        "capabilities": ["tools", "hooks"]
-      }
-    ]
-  },
-  "peerDependencies": {
-    "@cline/core": "*"
-  },
-  "peerDependenciesMeta": {
-    "@cline/core": { "optional": true }
-  },
-  "dependencies": {
-    "zod": "^4.1.5"
-  }
-}
-```
-
-Key fields:
-
-- `type: "module"` -- required. Cline plugins are ES modules.
-- `cline.plugins` -- the discovery contract. Array of entries, each with `paths` (entry files) and `capabilities` (pre-declared, validated before importing).
-- `peerDependencies` for `@cline/core` -- the host already provides it. Marking it optional lets you typecheck in isolation.
-
-### Bundling Assets
-
-Resolve asset paths with `import.meta.url`, not `process.cwd()`:
-
-```typescript
-import { dirname, join } from "node:path"
-import { fileURLToPath } from "node:url"
-import { readFileSync, existsSync } from "node:fs"
-
-const MODULE_DIR = dirname(fileURLToPath(import.meta.url))
-const TEMPLATES_DIR = join(MODULE_DIR, "assets", "templates")
-
-function loadTemplate(name: string): string | undefined {
-  const path = join(TEMPLATES_DIR, `${name}.md`)
-  return existsSync(path) ? readFileSync(path, "utf8") : undefined
-}
-```
-
-This is the only place `import.meta.url` is appropriate in a plugin -- locating files inside the plugin package. For workspace paths, always use `ctx.workspaceInfo?.rootPath`.
-
-### The Override Pattern (Bundled / Global / Project)
-
-A package can ship default assets and let users override them. The convention is a three-tier lookup, last write wins by `name`:
-
-1. bundled -- files inside the plugin package (defaults shipped with the plugin).
-2. global -- files under `~/.cline/data/settings/<kind>/` (user overrides).
-3. project -- files under `<workspace>/.cline/<kind>/` (project overrides).
-
-### Multiple Plugin Entries
-
-If your package exposes more than one plugin, list each in `cline.plugins`:
-
-```json
-"cline": {
-  "plugins": [
-    { "paths": ["./tools-plugin.ts"], "capabilities": ["tools"] },
-    { "paths": ["./hooks-plugin.ts"], "capabilities": ["hooks"] }
-  ]
-}
-```
-
-Each entry file should `export default` its own plugin object.
-
-## Testing Your Plugin
-
-### Unit Tests
-
-The plugin object is plain data. Drive `setup()` against a minimal context and exercise tools directly:
-
-```typescript
-import plugin from "../my-plugin"
-
-const tools: unknown[] = []
-const api = {
-  registerTool: (t: unknown) => tools.push(t),
-  registerCommand: () => {},
-  registerRule: () => {},
-  registerMessageBuilder: () => {},
-  registerProvider: () => {},
-  registerAutomationEventType: () => {},
-}
-await plugin.setup?.(api as never, {
-  workspaceInfo: { rootPath: "/tmp/fake-workspace" },
-})
-
-// Now `tools` contains the registered tools -- call tool.execute(input, ctx)
-```
-
-### End-to-End with runDemo()
-
-Add a `runDemo()` in your plugin file (see the single-file template above) that boots a real `ClineCore` session:
-
-```bash
-ANTHROPIC_API_KEY=sk-... bun run my-plugin.ts
-```
-
-### CLI Smoke Test
-
-```bash
-mkdir -p .cline/plugins
-cp my-plugin.ts .cline/plugins/
-cline -i "trigger something that exercises the plugin"
-```
-
-For packages:
-
-```bash
-cline plugin install ./my-cline-plugin
-cline -i "..."
-```
-
-If the plugin fails validation or setup, the CLI prints a clear error and continues without it.
-
-## Common Gotchas
-
-- "capabilities must be a non-empty array" -- you forgot `manifest.capabilities`, or it's `[]`.
-- "registerRule requires the 'rules' capability" -- capability/handler drift. Add `"rules"` to capabilities, or stop calling `registerRule`.
-- Tool not visible to the model -- check `enableTools: true` on the session config, and that you're declaring `"tools"` in capabilities.
-- `ctx.workspaceInfo` is undefined in SDK tests -- the host didn't pass `extensionContext.workspace`. In SDK code, set it explicitly (see the ClineCore loading example above).
-- State leaking across sessions -- module-level variables are shared across sessions in the same process. Key by `ctx.session?.sessionId` if your host runs multiple sessions concurrently.
-- `afterRun` firing on aborts -- guard with `if (result.status !== "completed") return`.
-- Heavy work in `setup()` -- `setup()` blocks session start. Defer expensive work into the first tool call or `beforeRun`.
-- Importing host internals -- only import from `@cline/core`. Reaching into host-specific packages (e.g. CLI internals) will break in non-CLI hosts.
-- Sandboxed plugins and `telemetry` -- telemetry is process-local. Feature-detect `ctx.telemetry` and expect it to be undefined in sandboxed plugin processes.
-- Resolving bundled assets -- use `import.meta.url` + `fileURLToPath` to find files inside your package; never `process.cwd()`. For workspace paths, do the opposite: use `ctx.workspaceInfo?.rootPath`, never `import.meta.url`.
-- Plugin name collisions -- `name` must be unique within a session. If two plugins share a name, validation fails. Namespace by package (`my-org-redactor`, not `redactor`).
-
-## Decision Guide -- Which Extension Point?
-
-| You want to... | Use |
-|----------------|-----|
-| Give the model a new capability | `registerTool` |
-| Add a slash command in chat surfaces | `registerCommand` |
-| Inject text into the system prompt | `registerRule` |
-| Rewrite messages before they hit the provider | `registerMessageBuilder` |
-| Add a custom model provider | `registerProvider` |
-| Emit normalized cron/webhook events | `registerAutomationEventType` + `ctx.automation` |
-| Observe or steer the agent loop | `hooks.*` |
-| Block a dangerous tool call | `hooks.beforeTool` returning `{ stop: true }` |
-| Notify on completion | `hooks.afterRun` (gate on `status === "completed"`) |
-| Tweak each model request | `hooks.beforeModel` |
-| Stream events to a UI | `hooks.onEvent` |
-| Ship reusable templates with the plugin | Bundle assets next to `index.ts`, resolve via `import.meta.url` |
-| Let users override defaults globally or per-project | Three-tier lookup: bundled / global / project |
-
-## Pre-Ship Checklist
-
-- `manifest.capabilities` is a non-empty array.
-- Every `api.register*` call has a matching capability declared.
-- If `hooks` is present, `"hooks"` is in `capabilities`.
-- `ctx.workspaceInfo?.rootPath` is used for workspace paths (not `process.cwd()`).
-- Optional `ctx` fields are feature-detected.
-- Tool names are snake_case verbs; descriptions are written for the model.
-- Tool inputs have JSON Schema with `required` set.
-- `afterRun` handlers gate on `result.status === "completed"` if they only want successes.
-- State that must not leak between concurrent sessions is keyed by `ctx.session?.sessionId`.
-- (Package) `package.json` has `type: "module"`, `cline.plugins`, and `@cline/core` as an optional peer dep.
-- (Package) Bundled assets resolved via `import.meta.url`, not `process.cwd()`.
-- Smoke test: drop the plugin into `.cline/plugins/` (or `cline plugin install`), run `cline -i "..."`, watch it work.
-
-## Plugin Examples from SDK
-
-The SDK repo includes these example plugins:
-
-| Plugin | Description |
-|--------|-------------|
-| `weather-metrics.ts` | Tool registration + lifecycle metrics |
-| `mac-notify.ts` | macOS Notification Center alerts |
-| `custom-compaction.ts` | Custom message compaction via message builders |
-| `background-terminal.ts` | Detached shell job management |
-| `automation-events.ts` | Plugin-emitted automation events |
-| `gitignore-read-files-guard.ts` | File access policy enforcement via beforeTool |
-| `web-search.ts` | Web search via Exa API |
-| `typescript-lsp/` | TypeScript Language Service tools (plugin package) |
-| `agents-squad/` | Multi-agent team orchestration (plugin package) |
-
-## See Also
-
-- `../tools/REFERENCE.md` - Tool creation
-- `../events/REFERENCE.md` - Event system
-- `../agent/REFERENCE.md` - Using plugins with Agent
-- `../clinecore/REFERENCE.md` - Using plugins with ClineCore

.agents/skills/cline-sdk/references/production/REFERENCE.md

@@ -1,253 +0,0 @@
-# Going to Production
-
-Guidelines for deploying Cline SDK agents in production environments.
-
-## Error Handling
-
-Always check the result status:
-
-```typescript
-const result = await agent.run(input)
-
-switch (result.status) {
-  case "completed":
-    console.log("Success:", result.outputText)
-    break
-  case "aborted":
-    console.log("Cancelled:", result.error?.message)
-    break
-  case "failed":
-    console.error("Failed:", result.error)
-    break
-}
-```
-
-For ClineCore, check `finishReason`:
-
-```typescript
-const session = await cline.start({ ... })
-
-switch (session.result?.finishReason) {
-  case "completed":
-    // normal completion
-    break
-  case "max_iterations":
-    // agent hit iteration limit
-    break
-  case "aborted":
-    // manually cancelled
-    break
-  case "mistake_limit":
-    // too many tool errors
-    break
-  case "error":
-    // unrecoverable error
-    break
-}
-```
-
-## Cost Control
-
-### Token Limits
-
-Set maximum tokens per turn and iteration limits:
-
-```typescript
-const agent = new Agent({
-  providerId: "anthropic",
-  modelId: "claude-sonnet-4-6",
-  maxTokensPerTurn: 4096,
-  maxIterations: 10,
-  tools: [...],
-})
-```
-
-### Model Selection
-
-Use cheaper models for simple tasks:
-
-```typescript
-// Simple classification or formatting
-{ providerId: "anthropic", modelId: "claude-haiku-4-5" }
-
-// Complex reasoning and code generation
-{ providerId: "anthropic", modelId: "claude-sonnet-4-6" }
-
-// Hardest tasks requiring deep reasoning
-{ providerId: "anthropic", modelId: "claude-opus-4-7" }
-```
-
-### Usage Tracking
-
-Monitor spending in real time:
-
-```typescript
-agent.subscribe((event) => {
-  if (event.type === "usage-updated" && event.usage.totalCost) {
-    if (event.usage.totalCost > MAX_BUDGET) {
-      agent.abort("Budget exceeded")
-    }
-  }
-})
-```
-
-## Observability
-
-### OpenTelemetry Integration
-
-The SDK supports OpenTelemetry for traces, metrics, and logs:
-
-```typescript
-import { ClineCore } from "@cline/sdk"
-
-const cline = await ClineCore.create({
-  clientName: "my-app",
-  // OpenTelemetry config is picked up from environment
-  // OTEL_EXPORTER_OTLP_ENDPOINT, OTEL_SERVICE_NAME, etc.
-})
-```
-
-### Structured Logging
-
-Use the `BasicLogger` interface for injectable logging:
-
-```typescript
-import type { BasicLogger } from "@cline/sdk"
-
-const logger: BasicLogger = {
-  debug: (msg, meta) => console.debug(msg, meta),
-  log: (msg, meta) => console.log(msg, meta),
-  error: (msg, meta) => console.error(msg, meta),
-}
-
-await cline.start({
-  config: {
-    logger,
-    // ...
-  },
-})
-```
-
-### Custom Metrics via Plugins
-
-```typescript
-const metricsPlugin: AgentPlugin = {
-  name: "metrics",
-  manifest: { capabilities: ["hooks"] },
-  setup() {},
-  hooks: {
-    beforeRun() {
-      metrics.increment("agent.runs.started")
-    },
-    afterRun({ result }) {
-      metrics.increment("agent.runs.completed")
-      metrics.histogram("agent.iterations", result.iterations)
-      metrics.histogram("agent.tokens.output", result.usage.outputTokens)
-    },
-    beforeTool({ toolCall }) {
-      metrics.increment(`agent.tools.${toolCall.toolName}`)
-    },
-  },
-}
-```
-
-## Security
-
-### Sandbox Tool Execution
-
-Validate tool inputs to prevent path traversal and injection:
-
-```typescript
-execute: async (input) => {
-  const safePath = path.resolve(WORKSPACE_ROOT, input.path)
-  if (!safePath.startsWith(WORKSPACE_ROOT)) {
-    return { error: "Path traversal attempt blocked" }
-  }
-  return await readFile(safePath, "utf-8")
-}
-```
-
-### API Key Management
-
-- Use environment variables, never hardcode keys
-- Rotate keys regularly
-- Use different keys for development and production
-
-```typescript
-{
-  providerId: "anthropic",
-  modelId: "claude-sonnet-4-6",
-  apiKey: process.env.ANTHROPIC_API_KEY, // never a literal string
-}
-```
-
-### Tool Policy Hardening
-
-Disable tools you don't need and require approval for dangerous ones:
-
-```typescript
-toolPolicies: {
-  read_files: { autoApprove: true },
-  search: { autoApprove: true },
-  bash: { autoApprove: false },     // require approval
-  editor: { autoApprove: false },
-  apply_patch: { autoApprove: false },
-  fetch_web: { enabled: false },    // disable entirely
-}
-```
-
-## Deployment Patterns
-
-### Stateless Worker
-
-For request/response workloads (API endpoints, queue consumers):
-
-```typescript
-const cline = await ClineCore.create({
-  clientName: "worker",
-  backendMode: "local",
-})
-
-app.post("/agent", async (req, res) => {
-  const session = await cline.start({
-    prompt: req.body.prompt,
-    config: { ... },
-  })
-  res.json({ text: session.result?.text, usage: session.result?.usage })
-})
-```
-
-### Persistent Service
-
-For long-running services with session management:
-
-```typescript
-const cline = await ClineCore.create({
-  clientName: "service",
-  backendMode: "hub",
-})
-
-process.on("SIGTERM", async () => {
-  await cline.dispose("SIGTERM")
-  process.exit(0)
-})
-```
-
-### Scheduled Automation
-
-See `../scheduling/REFERENCE.md` for recurring agent tasks.
-
-## Retry and Resilience
-
-- Tool `execute` functions support `retryable: true` (default) and `maxRetries: 3` (default)
-- Provider API calls are retried automatically on transient failures
-- Use `timeoutMs` on tools to prevent hanging
-- Monitor `mistake_limit` finish reason to detect systematic tool failures
-
-## See Also
-
-- `../agent/REFERENCE.md` - Agent overview
-- `../clinecore/REFERENCE.md` - ClineCore overview
-- `../tools/REFERENCE.md` - Tool configuration
-- `../plugins/REFERENCE.md` - Metrics plugins
-- `../scheduling/REFERENCE.md` - Scheduled agents

.agents/skills/cline-sdk/references/providers/REFERENCE.md

@@ -1,257 +0,0 @@
-# Model Providers
-
-The Cline SDK supports every major LLM provider out of the box via `@cline/llms`.
-
-## Supported Providers
-
-| Provider ID | Models |
-|-------------|--------|
-| `"anthropic"` | Claude Opus 4.7, Sonnet 4.6, Haiku 4.5 |
-| `"openai"` | GPT-5.5, GPT-5.3 Codex |
-| `"gemini"` | Gemini 3.1 Pro Preview, Gemini 3 Flash Preview |
-| `"vertex"` | Google models via Vertex AI |
-| `"bedrock"` | Claude, Llama via AWS Bedrock |
-| `"mistral"` | Mistral Large, Codestral |
-| `"openai-compatible"` | vLLM, Together, Fireworks, Groq, etc. |
-
-## Basic Configuration
-
-### With Agent
-
-```typescript
-import { Agent } from "@cline/sdk"
-
-const agent = new Agent({
-  providerId: "anthropic",
-  modelId: "claude-sonnet-4-6",
-  apiKey: process.env.ANTHROPIC_API_KEY,
-  systemPrompt: "You are a helpful assistant.",
-  tools: [],
-})
-```
-
-### With ClineCore
-
-```typescript
-import { ClineCore } from "@cline/sdk"
-
-const cline = await ClineCore.create({ clientName: "my-app" })
-
-await cline.start({
-  prompt: "Hello",
-  config: {
-    providerId: "anthropic",
-    modelId: "claude-sonnet-4-6",
-    apiKey: process.env.ANTHROPIC_API_KEY,
-  },
-})
-```
-
-## Provider-Specific Configuration
-
-### Anthropic
-
-```typescript
-{
-  providerId: "anthropic",
-  modelId: "claude-opus-4-7",  // or "claude-sonnet-4-6", "claude-haiku-4-5"
-  apiKey: process.env.ANTHROPIC_API_KEY,
-}
-```
-
-### OpenAI
-
-```typescript
-{
-  providerId: "openai",
-  modelId: "gpt-5.5",
-  apiKey: process.env.OPENAI_API_KEY,
-}
-```
-
-### Google (Gemini)
-
-```typescript
-{
-  providerId: "gemini",
-  modelId: "gemini-3.1-pro-preview",
-  apiKey: process.env.GOOGLE_API_KEY,
-}
-```
-
-### Google (Vertex AI)
-
-```typescript
-{
-  providerId: "vertex",
-  modelId: "gemini-3.1-pro-preview",
-  // Uses application default credentials or service account
-}
-```
-
-### AWS Bedrock
-
-```typescript
-{
-  providerId: "bedrock",
-  modelId: "anthropic.claude-sonnet-4-6",
-  // Uses AWS credential chain (env vars, config file, IAM role)
-  // Set AWS_REGION, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY
-}
-```
-
-### Mistral
-
-```typescript
-{
-  providerId: "mistral",
-  modelId: "mistral-large-latest",
-  apiKey: process.env.MISTRAL_API_KEY,
-}
-```
-
-### OpenAI-Compatible
-
-For any provider with an OpenAI-compatible API:
-
-```typescript
-{
-  providerId: "openai-compatible",
-  modelId: "my-model",
-  apiKey: process.env.API_KEY,
-  baseUrl: "https://api.together.xyz/v1",
-}
-```
-
-Works with: vLLM, Together AI, Fireworks, Groq, Ollama, LiteLLM, etc.
-
-## Custom Base URL
-
-Override the API endpoint for any provider:
-
-```typescript
-{
-  providerId: "anthropic",
-  modelId: "claude-sonnet-4-6",
-  apiKey: process.env.API_KEY,
-  baseUrl: "https://my-proxy.example.com/v1",
-}
-```
-
-## Custom Headers
-
-Pass additional headers to API requests:
-
-```typescript
-{
-  providerId: "openai",
-  modelId: "gpt-5.5",
-  apiKey: process.env.API_KEY,
-  headers: {
-    "X-Custom-Header": "value",
-  },
-}
-```
-
-## Gateway API
-
-For advanced multi-provider setups, use the Gateway directly:
-
-```typescript
-import { createGateway, DefaultGateway } from "@cline/llms"
-
-const gateway = createGateway({
-  providerConfigs: [
-    { providerId: "anthropic", apiKey: process.env.ANTHROPIC_API_KEY },
-    { providerId: "openai", apiKey: process.env.OPENAI_API_KEY },
-  ],
-})
-
-// Create a model for a specific provider
-const model = gateway.createAgentModel({
-  providerId: "anthropic",
-  modelId: "claude-opus-4-7",
-})
-
-// Use with Agent
-const agent = new Agent({ model, systemPrompt: "...", tools: [] })
-```
-
-### Gateway Methods
-
-```typescript
-gateway.registerProvider(registration)   // add a custom provider
-gateway.configureProvider(config)        // update provider settings
-gateway.listProviders()                  // list available providers
-gateway.listModels(providerId?)          // list available models
-gateway.createAgentModel(selection)      // create model for agent
-gateway.stream(request)                  // raw streaming (AsyncIterable)
-```
-
-## Provider Registry
-
-Query and register providers programmatically:
-
-```typescript
-import {
-  getAllProviders,
-  getProviderIds,
-  getProvider,
-  getModelsForProvider,
-  registerProvider,
-  registerModel,
-  createHandler,
-} from "@cline/llms"
-
-// List all registered providers
-const providers = getAllProviders()
-
-// Get models for a provider
-const models = getModelsForProvider("anthropic")
-
-// Register a custom provider
-registerProvider({
-  id: "my-provider",
-  name: "My Custom Provider",
-  handler: createHandler({ ... }),
-})
-```
-
-## Model Metadata
-
-Access model info (context window, pricing, capabilities):
-
-```typescript
-import { getModelsForProvider } from "@cline/llms"
-
-const models = getModelsForProvider("anthropic")
-for (const model of models) {
-  console.log(`${model.id}: context=${model.contextWindow}, input=$${model.inputPrice}/MTok`)
-}
-```
-
-## Cost Tracking
-
-Track per-request and cumulative costs:
-
-```typescript
-// Via events
-agent.subscribe((event) => {
-  if (event.type === "usage-updated") {
-    console.log(`Cost: $${event.usage.totalCost?.toFixed(4)}`)
-  }
-})
-
-// Via result
-const result = await agent.run("...")
-console.log(`Total cost: $${result.usage.totalCost?.toFixed(4)}`)
-
-// Via ClineCore accumulated usage
-const usage = await cline.getAccumulatedUsage(sessionId)
-```
-
-## See Also
-
-- `../agent/REFERENCE.md` - Using providers with Agent
-- `../clinecore/REFERENCE.md` - Using providers with ClineCore
-- `../production/REFERENCE.md` - Cost control in production

.agents/skills/cline-sdk/references/scheduling/REFERENCE.md

@@ -1,227 +0,0 @@
-# Scheduling and Automation
-
-The Cline SDK supports scheduled, one-off, and event-driven agent execution through the automation subsystem in `@cline/core`.
-
-## Overview
-
-Three trigger types:
-
-| Trigger | Description |
-|---------|-------------|
-| `schedule` | Recurring jobs via cron expressions |
-| `one_off` | Single execution tasks |
-| `event` | Triggered by external events (GitHub, Linear, custom) |
-
-## CLI Schedule Management
-
-```bash
-# Create a recurring schedule
-cline schedule create "Daily standup" \
-  --cron "0 9 * * MON-FRI" \
-  --prompt "Summarize open PRs and blockers" \
-  --workspace /path/to/project \
-  --model anthropic/claude-sonnet-4-6
-
-# List schedules
-cline schedule list
-
-# Trigger a schedule immediately
-cline schedule trigger <schedule-id>
-
-# Pause/resume
-cline schedule pause <schedule-id>
-cline schedule resume <schedule-id>
-
-# Delete
-cline schedule delete <schedule-id>
-
-# View past executions
-cline schedule executions <schedule-id>
-```
-
-## Cron Expressions
-
-| Expression | Meaning |
-|-----------|---------|
-| `0 9 * * MON-FRI` | 9 AM weekdays |
-| `0 */6 * * *` | Every 6 hours |
-| `0 8 * * MON` | Mondays at 8 AM |
-| `*/30 * * * *` | Every 30 minutes |
-| `0 0 1 * *` | First of every month |
-
-## File-Based Specs
-
-Create Markdown files in `~/.cline/cron/` (global) or `.cline/cron/` (workspace):
-
-### Recurring Schedule
-
-```markdown
----
-trigger: schedule
-schedule: "0 9 * * MON-FRI"
-timezone: America/New_York
-mode: exclusive
-prompt: "Check for dependency updates and create PRs for any outdated packages."
-modelSelection:
-  providerId: anthropic
-  modelId: claude-sonnet-4-6
-tools:
-  enabled: true
----
-
-Additional context or instructions for the agent go in the body.
-```
-
-### One-Off Task
-
-```markdown
----
-trigger: one_off
-prompt: "Generate a comprehensive test coverage report."
-modelSelection:
-  providerId: anthropic
-  modelId: claude-sonnet-4-6
----
-```
-
-### Event-Driven
-
-```markdown
----
-trigger: event
-eventType: github.pull_request.opened
-filters:
-  repository: myorg/myrepo
-debounceMs: 5000
-cooldownMs: 60000
-prompt: "Review the PR for security issues and code quality."
-modelSelection:
-  providerId: anthropic
-  modelId: claude-sonnet-4-6
----
-```
-
-## CronSpec Types
-
-```typescript
-interface CronScheduleSpec {
-  trigger: "schedule"
-  schedule: string              // cron expression
-  timezone?: string
-  mode?: "exclusive" | "concurrent"
-  prompt: string
-  modelSelection?: { providerId: string; modelId?: string }
-  extensionLoading?: "isolated" | "direct"
-  configExtensions?: RuntimeConfigExtensionKind[]
-  tools?: { enabled?: boolean; names?: string[] }
-}
-
-interface CronOneOffSpec {
-  trigger: "one_off"
-  prompt: string
-  modelSelection?: { providerId: string; modelId?: string }
-}
-
-interface CronEventSpec {
-  trigger: "event"
-  eventType: string             // e.g., "github.pull_request.opened"
-  filters?: Record<string, unknown>
-  debounceMs?: number
-  cooldownMs?: number
-  prompt: string
-  modelSelection?: { providerId: string; modelId?: string }
-}
-```
-
-## Programmatic Automation API
-
-```typescript
-const cline = await ClineCore.create({
-  clientName: "my-app",
-  automation: true,
-})
-
-// Start automation service
-cline.automation.start()
-
-// Ingest an external event
-cline.automation.ingestEvent({
-  eventId: "evt-123",
-  eventType: "github.pull_request.opened",
-  source: "github",
-  timestamp: Date.now(),
-  payload: { pr: { number: 42, title: "..." } },
-})
-
-// List specs, runs, events
-const specs = await cline.automation.listSpecs()
-const runs = await cline.automation.listRuns()
-const events = await cline.automation.listEvents()
-
-// Reconcile specs from directory
-await cline.automation.reconcile(specDirectory)
-
-// Stop automation
-cline.automation.stop()
-```
-
-## Event Ingestion from Plugins
-
-Plugins can declare and emit automation events:
-
-```typescript
-const webhookPlugin: AgentPlugin = {
-  name: "webhook-events",
-  manifest: { capabilities: ["automationEvents"] },
-  setup(api) {
-    api.registerAutomationEventType({
-      type: "webhook.received",
-      description: "External webhook received",
-    })
-  },
-}
-```
-
-Submit events via the plugin context:
-
-```typescript
-ctx.automation.ingestEvent({
-  eventId: "evt-456",
-  eventType: "webhook.received",
-  source: "custom",
-  timestamp: Date.now(),
-  payload: { ... },
-})
-```
-
-## Concurrency Control
-
-| Mode | Behavior |
-|------|----------|
-| `"exclusive"` | Skip if previous run still active |
-| `"concurrent"` | Allow overlapping runs |
-
-## Run Reports
-
-Each completed run writes a Markdown report to `.cline/cron/reports/<run-id>.md` with:
-- Run metadata (spec, trigger, timing)
-- Summary of agent output
-- Usage (tokens, cost)
-- Tool calls made
-- Trigger event context (for event-driven runs)
-
-## Use Cases
-
-- Daily standup summaries
-- Automated dependency update checks
-- PR review on open
-- Codebase health reports
-- Scheduled security scans
-- Event-driven CI/CD workflows
-
-## See Also
-
-- `../clinecore/REFERENCE.md` - ClineCore runtime
-- `../clinecore/api.md` - Automation API details
-- `../plugins/REFERENCE.md` - Plugin events
-- `../production/REFERENCE.md` - Production deployment

.agents/skills/cline-sdk/references/tools/REFERENCE.md

@@ -1,259 +0,0 @@
-# Tools
-
-Tools are how agents interact with the world. The Cline SDK supports both built-in tools (via ClineCore) and custom tools you define yourself.
-
-## Creating Custom Tools
-
-Use `createTool()` from `@cline/sdk` (or `@cline/shared`):
-
-```typescript
-import { createTool } from "@cline/sdk"
-
-const myTool = createTool({
-  name: "search_issues",
-  description: "Search GitHub issues by query. Returns up to 10 results.",
-  inputSchema: {
-    type: "object",
-    properties: {
-      query: { type: "string", description: "Search query" },
-      state: { type: "string", enum: ["open", "closed", "all"] },
-    },
-    required: ["query"],
-  },
-  execute: async (input) => {
-    const issues = await github.searchIssues(input.query, input.state)
-    return { issues, count: issues.length }
-  },
-})
-```
-
-### With Zod Schema
-
-```typescript
-import { createTool } from "@cline/sdk"
-import { z } from "zod"
-
-const deployTool = createTool({
-  name: "deploy",
-  description: "Deploy the app to the specified environment.",
-  inputSchema: z.object({
-    environment: z.enum(["staging", "production"]).describe("Target environment"),
-    version: z.string().optional().describe("Version tag, defaults to latest"),
-  }),
-  execute: async (input) => {
-    const result = await deploy(input.environment, input.version)
-    return { url: result.url, status: "deployed" }
-  },
-})
-```
-
-### Tool Config Options
-
-```typescript
-createTool({
-  name: string,                         // snake_case, unique per agent
-  description: string,                  // what the tool does (model reads this)
-  inputSchema: JSONSchema | ZodSchema,  // input validation
-  execute: async (input, context, onChange?) => output,
-  timeoutMs?: number,                   // default: 30000
-  retryable?: boolean,                  // default: true
-  maxRetries?: number,                  // default: 3
-  lifecycle?: {
-    completesRun?: boolean              // true = ends agent loop on success
-  },
-})
-```
-
-### AgentToolContext
-
-The second argument to `execute` provides runtime context:
-
-```typescript
-interface AgentToolContext {
-  agentId: string
-  conversationId: string
-  iteration: number
-  abortSignal?: AbortSignal
-  metadata?: Record<string, unknown>
-}
-```
-
-## Tool Naming Rules
-
-- Names must be `snake_case` (e.g., `search_issues`, `deploy_app`)
-- Names must be unique within a single agent's tool set
-- Choose descriptive names since the model uses them to decide which tool to call
-
-## Tool Descriptions Matter
-
-The model reads the tool description to decide when and how to use it. Write clear, specific descriptions:
-
-```typescript
-// Bad: vague
-description: "Does deployment stuff"
-
-// Good: specific with constraints
-description: "Deploy the application to staging or production. " +
-  "Staging deployments are immediate. Production requires a passing CI build. " +
-  "Returns the deployment URL and status."
-```
-
-Include constraints, rate limits, and expected behavior in the description.
-
-## Error Handling in Tools
-
-Return errors as structured data instead of throwing:
-
-```typescript
-// Good: return error data
-execute: async (input) => {
-  const file = await readFile(input.path).catch(() => null)
-  if (!file) {
-    return { error: "File not found", path: input.path }
-  }
-  return { content: file }
-}
-```
-
-Thrown exceptions count as "mistakes" against the agent's mistake limit. Returned error data lets the agent adjust its approach.
-
-## Completion Tools
-
-Tools with `lifecycle: { completesRun: true }` end the agent loop when they execute successfully:
-
-```typescript
-const submitAnswer = createTool({
-  name: "submit_answer",
-  description: "Submit the final answer and end the task.",
-  inputSchema: z.object({
-    answer: z.string(),
-    confidence: z.number().min(0).max(1),
-  }),
-  lifecycle: { completesRun: true },
-  execute: async (input) => input,
-})
-```
-
-The model sees the tool result and the run ends. Access the output via `result.toolCalls`.
-
-## Built-in Tools (ClineCore Only)
-
-When using `ClineCore` with `enableTools: true`, these tools are available automatically:
-
-| Tool | Name | What It Does |
-|------|------|-------------|
-| Shell | `bash` | Execute shell commands in the session workspace |
-| Editor | `editor` | Create and edit files |
-| Read | `read_files` | Read file contents |
-| Patch | `apply_patch` | Apply unified diffs to files |
-| Search | `search` | Search file contents and directory structure |
-| Web | `fetch_web` | Fetch web content via HTTP |
-
-Built-in tools respect the `cwd` setting in `CoreSessionConfig`.
-
-## Tool Policies
-
-Control which tools are available and whether they require approval:
-
-```typescript
-// In Agent config
-const agent = new Agent({
-  tools: [toolA, toolB, toolC],
-  toolPolicies: {
-    tool_a: { autoApprove: true },    // runs without asking
-    tool_b: { autoApprove: false },   // requires approval
-    tool_c: { enabled: false },       // hidden from model
-  },
-})
-
-// In ClineCore session
-await cline.start({
-  prompt: "...",
-  config: { ... },
-  toolPolicies: {
-    bash: { autoApprove: true },
-    editor: { autoApprove: false },
-  },
-})
-```
-
-### Policy Options
-
-| Policy | Effect |
-|--------|--------|
-| `{ autoApprove: true }` | Tool runs without approval |
-| `{ autoApprove: false }` | Triggers approval callback before running |
-| `{ enabled: false }` | Tool is hidden from the model entirely |
-| No policy set | Defaults to enabled and auto-approved |
-
-## Abort Signal in Long-Running Tools
-
-Respect the abort signal for tools that take a long time:
-
-```typescript
-execute: async (input, context) => {
-  const results = []
-  for (const item of input.items) {
-    if (context.abortSignal?.aborted) {
-      return { results, aborted: true, processed: results.length }
-    }
-    results.push(await processItem(item))
-  }
-  return { results, processed: results.length }
-}
-```
-
-## Streaming Tool Output
-
-Use the `onChange` callback (third argument) to stream partial results:
-
-```typescript
-execute: async (input, context, onChange) => {
-  let progress = 0
-  for (const step of steps) {
-    progress++
-    onChange?.(`Processing step ${progress}/${steps.length}...`)
-    await processStep(step)
-  }
-  return { completed: true }
-}
-```
-
-## Testing Tools
-
-Tools are plain async functions, so they're straightforward to test:
-
-```typescript
-import { describe, it, expect } from "vitest"
-
-describe("deploy tool", () => {
-  it("deploys to staging", async () => {
-    const context = { agentId: "test", conversationId: "test", iteration: 1 }
-    const result = await deployTool.execute({ environment: "staging" }, context)
-    expect(result.status).toBe("deployed")
-  })
-})
-```
-
-## MCP Tool Integration
-
-ClineCore can connect to MCP (Model Context Protocol) servers for additional tools. Configure in `.cline/mcp-servers.json`:
-
-```json
-{
-  "servers": {
-    "my-server": {
-      "command": "node",
-      "args": ["./mcp-server.js"]
-    }
-  }
-}
-```
-
-MCP tools appear alongside built-in and custom tools automatically.
-
-## See Also
-
-- `../agent/REFERENCE.md` - Using tools with Agent
-- `../clinecore/REFERENCE.md` - Using tools with ClineCore
-- `../plugins/REFERENCE.md` - Packaging tools as plugins

.agents/skills/publish-desktop

@@ -1 +0,0 @@
-../../.cline/skills/publish-desktop

.agents/skills/publish-extension

@@ -1 +0,0 @@
-../../.cline/skills/publish-extension

.agents/skills/tuistory

@@ -1 +0,0 @@
-../../.cline/skills/tuistory

.changeset/brave-moons-refuse.md

@@ -1,5 +0,0 @@
----
-"claude-dev": patch
----
-
-Remove the non-functional "Use compact prompt" toggle from LM Studio provider settings

.changeset/clear-task-settings-overlay.md

@@ -1,5 +0,0 @@
----
-"claude-dev": patch
----
-
-Fix auto-approve checkboxes freezing after "New Task": clear the task-scoped settings overlay when the task view is cleared or switched, so stale task settings no longer shadow global settings

.changeset/gold-otters-march.md

@@ -1,5 +0,0 @@
----
-"claude-dev": patch
----
-
-fix: restore workflow support regressions — expand `/workflow.md` slash commands (the legacy filename spelling the autocomplete inserts) and mid-message commands, honor workflow enable/disable toggles during expansion, refresh the slash menu's workflow list on webview launch, and bring back the Workflows management tab in the rules modal (now last in the tab list, with a deprecation notice pointing to Skills)

.changeset/hidden-mode-prompts-history.md

@@ -1,5 +0,0 @@
----
-"claude-dev": patch
----
-
-Fix hidden plan/act mode-switch and task-resumption prompts reappearing as user messages when a task is reopened from history

.changeset/lazy-pugs-cheer.md

@@ -1,5 +0,0 @@
----
-"claude-dev": patch
----
-
-fix: strip trailing slashes from the OpenAI Compatible base URL when fetching the model list, so `/models` is queried correctly and the model dropdown populates

.changeset/lucky-doors-shine.md

@@ -1,5 +0,0 @@
----
-"claude-dev": patch
----
-
-fix: center-align the sign-in verification code box shown after clicking "Sign in to Cline"

.changeset/pink-ants-glow.md

@@ -1,5 +0,0 @@
----
-"claude-dev": patch
----
-
-fix: use correct base URL for Vertex AI global endpoint with Claude models

.changeset/proud-crabs-compact.md

@@ -1,5 +0,0 @@
----
-"claude-dev": patch
----
-
-Enable Auto Compact by default so long chats automatically compress conversation history instead of failing at the model context limit. It can be disabled in Settings → Features → "Auto Compact".

.changeset/response-header-copy-button.md

@@ -1,5 +0,0 @@
----
-"claude-dev": patch
----
-
-Bring back a copy button on turn-final response rows, under a new subtle "Completed" / "Plan" header

.changeset/text-only-model-image-warning.md

@@ -1,5 +0,0 @@
----
-"claude-dev": patch
----
-
-Warn when attached images will be ignored because the selected model does not support image input: image thumbnails get a warning badge and the composer offers to switch to an image-capable model, instead of the images being silently dropped before the API call

.changeset/tidy-crabs-compact.md

@@ -1,5 +0,0 @@
----
-"claude-dev": patch
----
-
-Fix /compact UX: clear the chat input as soon as the command is submitted, wrap the compaction divider row at narrow sidebar widths, and update the context-window header even when compacting a small conversation grows the estimated context

.changeset/tidy-crabs-rest.md

@@ -1,5 +0,0 @@
----
-"claude-dev": patch
----
-
-Disable feature tips by default; they can be enabled in Settings → Features → "Feature Tips"

.changeset/tidy-owls-return.md

@@ -1,5 +0,0 @@
----
-"claude-dev": patch
----
-
-Show the edited file in a regular editor tab after the diff preview closes, restoring the legacy post-edit behavior

.changeset/view-changes-hidden-until-changes.md

@@ -1,5 +0,0 @@
----
-"claude-dev": patch
----
-
-Hide the "View Changes" button on completion rows until there are actually changes to show, instead of rendering it faded and disabled. Turns that changed nothing, non-git workspaces, and repos without commits no longer show a dead button with a misleading tooltip.

.changeset/witty-rooms-listen.md

@@ -1,5 +0,0 @@
----
-"claude-dev": patch
----
-
-Show the user's message in chat immediately when sending to a task opened from history, instead of only a thinking indicator until the session resume finishes

.claude/hooks/claude-code-for-web-setup.sh

@@ -41,11 +41,11 @@ fi
 
 # Install project dependencies
 echo "Installing dependencies..."
-bun run install:all
+npm run install:all
 
 # Generate gRPC/protobuf types (required for TypeScript)
 echo "Generating proto types..."
-bun run protos
+npm run protos
 
 echo ""
 echo "Session setup complete!"

.claude/skills/cline-sdk

@@ -1 +0,0 @@
-../../.agents/skills/cline-sdk

.claude/skills/publish-desktop

@@ -1 +0,0 @@
-../../.cline/skills/publish-desktop

.claude/skills/publish-extension

@@ -1 +0,0 @@
-../../.cline/skills/publish-extension

.claude/skills/tuistory

@@ -1 +0,0 @@
-../../.cline/skills/tuistory

.cline/skills/publish-cli/SKILL.md

@@ -1,266 +0,0 @@
----
-name: publish-cli
-description: Use when preparing, tagging, and publishing an apps/cli npm release. Guides changelog drafting, apps/cli/package.json version bumps, cli-vX.Y.Z tags, local npm publishing, and the publish-cli GitHub workflow.
----
-
-# CLI Release
-
-Use this skill when the user asks to release the CLI, publish `cline`, bump the CLI version, draft release notes, create a `cli-vX.Y.Z` tag, or trigger the CLI publish workflow.
-
-The CLI is npm-only. Do not add alternate distribution channels. Windows binaries are Authenticode-signed automatically by the publish workflow via Azure Trusted Signing (see the `.github/actions/sign-windows-cli` composite action and "Windows code signing" in `apps/cli/DISTRIBUTION.md`); if the signing secrets are not configured the workflow warns and publishes unsigned binaries. Local publishes (`bun release cli`) do not sign — prefer the GitHub Actions publish path for releases users run on Windows.
-
-> Working directory: run every command below from the repository root. Paths and scripts (e.g. `apps/cli/package.json`, `sdk/packages/`, `bun release cli`, `bun run version`) are written relative to the repo root.
-
-The skill should guide the user through one release preparation flow, then offer the publish path options. The two normal publish paths are GitHub Actions and local publishing from an authenticated machine.
-
-## Release contract
-
-- SDK prerequisite: the CLI depends on the SDK via `workspace:*` (`@cline/core`, `@cline/shared`, and friends). If the SDK changed since its last release, release the SDK first and wait for it to finish publishing before releasing the CLI. See "Step 0: Release the SDK first if it changed" below.
-- Version source: `apps/cli/package.json`.
-- Main release tag: `cli-vX.Y.Z`, where `X.Y.Z` matches `apps/cli/package.json`.
-- Nightly release version: `X.Y.Z-nightly.TIMESTAMP`.
-- Release prep includes approved release notes, a version bump, and an `apps/cli/CHANGELOG.md` update.
-- Publish paths:
-  - GitHub workflow: `.github/workflows/cli-publish.yml`.
-  - Local publish helper: `bun release cli`.
-- npm dist-tags and git tags are separate. `--tag latest` and `--tag nightly` are npm registry channels. `cli-vX.Y.Z` is a git tag for source history and GitHub releases.
-- The GitHub main release workflow runs from `main`, requires an existing `cli-vX.Y.Z` tag, checks out that tag, and publishes from it.
-- The GitHub nightly workflow publishes to npm with the `nightly` dist-tag and does not create a tag.
-- The local release helper requires a clean checkout and `cli-vX.Y.Z` to point at `HEAD` locally and on `origin` before publishing.
-- Local GitHub release creation requires `gh` to be authenticated with release permissions for the repo.
-- Always ask before pushing commits or tags.
-- Do not amend commits unless explicitly requested.
-
-## Step 0: Release the SDK first if it changed
-
-Do this before anything else in the Workflow below.
-
-The CLI builds and ships against the SDK source in the monorepo (`workspace:*` for `@cline/core`, `@cline/shared`, and the rest), so a CLI release always contains the latest SDK code whether or not the SDK was released. The build and tests use that source too, not anything from npm. Releasing the SDK alongside the CLI is still worth doing for two reasons:
-
-- Hub freshness. The hub daemon lives in `@cline/core` and stamps a `buildId` that defaults to the `@cline/core` package version (`resolveHubBuildId` in `sdk/packages/core/src/hub/discovery/index.ts`). A running hub is only retired and respawned when that `buildId` changes (`isCompatibleHubRecord` / `retireIncompatibleHub` in `sdk/packages/core/src/hub/daemon/index.ts`). So if the SDK code changed but the version did not, a user who upgrades the CLI keeps talking to their already-running hub, which is still executing the old SDK code. Bumping the SDK version makes the new CLI's `buildId` differ, so the stale hub is detected as incompatible and respawned with the fresh code.
-- Release hygiene. We want regular SDK releases; cutting one whenever we cut a CLI release keeps the published SDK in step with what the CLI ships.
-
-So when the SDK has changed, release it first (which bumps the `@cline/core` version), then cut the CLI release on top of that bump. Leave the CLI's SDK dependency as `workspace:*` — the fix is to release the SDK, not to pin the CLI.
-
-1. Check for unreleased SDK changes.
-
-```sh
-git fetch origin --tags
-git tag --list 'sdk/sdk/v*' 'sdk-v*' --sort=-v:refname | head -1
-git log <last-sdk-tag>..origin/main --oneline --no-merges -- sdk/packages
-```
-
-`sdk/<pkg>/v*` tags are created by the `sdk-publish.yml` workflow; `sdk-v*` tags are created by the local `bun release sdk` helper. Use whichever is newest as the baseline.
-
-If `git log` prints no commits, the SDK is already up to date. Skip the rest of Step 0 and continue with the Workflow below.
-
-If it prints commits, sanity-check the diff (ignore entries that are only the previous version-bump commit's lockfile or generated files), then release the SDK.
-
-2. Decide the SDK version bump.
-
-All SDK packages share one version, read from `sdk/packages/llms/package.json`. Ask whether this is patch, minor, major, or an explicit version. Patch is the default. Do not guess if the user has not made it clear.
-
-3. Draft the SDK release notes and update the changelog.
-
-Draft user-facing notes from the SDK commits found in step 1, translating commit messages into user-facing language (same approach as the CLI release notes below). Prepend a new `## <version>` section with those notes to the top of `sdk/CHANGELOG.md`, using the header format `## <version>` with no date — the same flat, newest-on-top format as `apps/cli/CHANGELOG.md`. This is the SDK changelog (all SDK packages share one version) and it is maintained by hand; the `sdk-publish.yml` workflow does not read it.
-
-4. Bump versions and regenerate.
-
-```sh
-bun run version <version>
-```
-
-This bumps every SDK `package.json` to the new version, regenerates the lockfile and the generated model catalog, formats, and builds. Review the result.
-
-5. Commit and push the bump to `main`.
-
-The `sdk-publish.yml` workflow publishes the version that is committed on `main` and tags that commit, so the bump must land on `main` before the workflow runs.
-
-```sh
-git add -A
-git commit -m "chore(sdk): release v<version>"
-```
-
-Ask before pushing:
-
-```sh
-git push origin HEAD
-```
-
-6. Trigger the SDK publish workflow on the `latest` channel.
-
-```sh
-gh workflow run sdk-publish.yml -f channel=latest -f confirm_publish=publish
-gh run list --workflow=sdk-publish.yml --limit=1 --json databaseId,url,status,createdAt --jq '.[0]'
-```
-
-The workflow runs the SDK tests, publishes `@cline/shared`, `@cline/llms`, `@cline/agents`, `@cline/core`, and `@cline/sdk` to npm with the `latest` dist-tag in dependency order, and pushes `sdk/<pkg>/v<version>` git tags.
-
-7. Wait for the SDK workflow to succeed before starting the CLI release.
-
-```sh
-gh run watch <run-id> --exit-status
-```
-
-Do not start the CLI release until this run has finished successfully. The CLI does not install the SDK from npm, but cutting the CLI release on top of a clean, completed SDK release keeps the two in step: the CLI release commit then sits on top of the `@cline/core` version bump, so the shipped CLI carries the new version that forces a running hub to respawn with the new code, and you are not building a CLI release on top of an SDK release that failed midway.
-
-After the SDK release succeeds, pull `main` so the CLI release is prepared on top of the SDK version bump:
-
-```sh
-git checkout main && git pull --ff-only
-```
-
-Then continue with the Workflow below.
-
-For a local SDK publish from an authenticated machine instead of the workflow, `bun release sdk <version>` exists, but prefer the `sdk-publish.yml` workflow for normal releases so the CLI release can gate on a single GitHub Actions run.
-
-## Workflow
-
-Complete Step 0 first. Only proceed once the SDK is released (or you confirmed no SDK release was needed).
-
-1. Gather context.
-
-```sh
-git status --short --branch
-git fetch origin --tags
-git tag --list 'cli-v*' --sort=-v:refname | head -10
-node -p "require('./apps/cli/package.json').version"
-```
-
-Find the latest CLI tag. If there is no `cli-v*` tag, use the first relevant CLI release commit as the baseline and say that the baseline is inferred.
-
-2. Collect release commits.
-
-```sh
-git log <last-cli-tag>..HEAD --oneline --no-merges -- apps/cli sdk/packages sdk/scripts .github/workflows/cli-publish.yml
-```
-
-The `sdk/packages` commits matter here even though the SDK was released separately in Step 0: the CLI bundles the SDK, so SDK changes ship in this CLI release too. Read those commits and fold anything user-relevant to the CLI into the release notes (provider/model updates, behavior changes, fixes the CLI inherits). Skip SDK changes that are purely internal or have no CLI-visible effect.
-
-3. Draft user-facing release notes.
-
-Include user-facing features, fixes, behavior changes, compatibility changes, and notable install or release changes. Exclude pure refactors, tests, style, chores, and internal file moves unless they matter to users.
-
-Write a flat bullet list. Translate commit messages into user-facing language. If a commit is unclear, read the full commit before summarizing it.
-
-Present the draft and wait for approval before editing files.
-
-4. Decide the version bump.
-
-Ask whether this should be patch, minor, major, or an explicit version. Do not guess if the user has not made it clear.
-
-5. Update release files.
-
-Update `apps/cli/package.json` to the approved version.
-
-Prepend a section to `apps/cli/CHANGELOG.md` for the approved version using the approved release notes. Use the header format `## X.Y.Z` with no date. The publish workflow extracts the top section of the changelog by matching `^## [0-9]` and pastes it verbatim into the GitHub release body and the Slack release announcement, so the section content is the release notes that get shipped.
-
-6. Verify before committing.
-
-Run focused checks first:
-
-```sh
-bun -F @cline/cli typecheck
-bun -F @cline/cli test:unit
-```
-
-For higher confidence, run:
-
-```sh
-bun run types
-bun --cwd apps/cli run build:platforms:single
-```
-
-If the user wants full release confidence before tagging, run:
-
-```sh
-bun run test
-bun --cwd apps/cli run build:platforms
-```
-
-Known local-only test failure: `src/commands/distribution-package.test.ts > rejects direct source package packing by default` will fail on machines that have `ignore-scripts=true` in `~/.npmrc` (set by the npm supply-chain hardening guide). Bun reads npm's `ignore-scripts` from `~/.npmrc`, so `bun pm pack --dry-run` skips the source-publish `prepack` guard and exits 0, which the test reads as a failure. CI does not set `ignore-scripts`, so the test passes there. Confirm by running `bun pm pack --dry-run` directly: with `~/.npmrc` in place it exits 0 with no guard output; with `~/.npmrc` moved aside it exits 1 and prints the guard message. This is not a release blocker by itself, but it does mean the local-publish path (`bun release cli`) will also bypass the source-publish guard on this machine; prefer the GitHub Actions publish path on machines with `ignore-scripts=true` set globally, or temporarily unset it (`npm config delete ignore-scripts` or `mv ~/.npmrc ~/.npmrc.bak`) for the duration of a local publish.
-
-7. Commit release changes.
-
-Only after the user approves the notes and version:
-
-```sh
-git add apps/cli/package.json apps/cli/CHANGELOG.md
-git commit -m "chore(cli): release vX.Y.Z"
-```
-
-Ask before pushing the release commit:
-
-```sh
-git push origin HEAD
-```
-
-For the GitHub main release path, ask before creating and pushing the release tag:
-
-```sh
-git tag -a cli-vX.Y.Z -m "CLI vX.Y.Z"
-git push origin refs/tags/cli-vX.Y.Z
-```
-
-8. Publish.
-
-Ask the user which path to use:
-
-- GitHub main release. Use this after the release commit is on `main` and the matching `cli-vX.Y.Z` tag has been pushed. The workflow publishes to npm from that tag, creates the GitHub release, and posts to Slack.
-- Local release. Use this when the user wants to publish from this machine. The local machine must be authenticated to npm and GitHub.
-- GitHub nightly release.
-- Stop after the version commit.
-
-For GitHub main release:
-
-```sh
-gh workflow run cli-publish.yml -f publish_target=main -f git_tag=cli-vX.Y.Z -f confirm_publish=publish
-gh run list --workflow=cli-publish.yml --limit=1 --json url,status,conclusion,createdAt --jq '.[0]'
-```
-
-For GitHub nightly release:
-
-```sh
-gh workflow run cli-publish.yml -f publish_target=nightly
-```
-
-For forced GitHub nightly release:
-
-```sh
-gh workflow run cli-publish.yml -f publish_target=nightly -f force_nightly_publish=true
-```
-
-For local publish:
-
-```sh
-gh auth status
-npm whoami
-git tag -a cli-vX.Y.Z -m "CLI vX.Y.Z"
-git push origin refs/tags/cli-vX.Y.Z
-bun release cli
-```
-
-After a successful local publish, ask before running:
-
-```sh
-gh release create cli-vX.Y.Z --verify-tag --title "CLI vX.Y.Z" --notes "Paste the approved release notes here."
-```
-
-If publishing with another npm dist-tag:
-
-```sh
-bun release cli --tag next
-```
-
-9. Final response.
-
-Report:
-
-- version
-- tag
-- changelog file updated
-- commit hash
-- whether anything was pushed
-- publish path selected
-- workflow URL or local publish result
-- tests and builds run

.cline/skills/publish-desktop/SKILL.md

@@ -1,177 +0,0 @@
----
-name: publish-desktop
-description: Use when preparing, tagging, and publishing a Cline desktop app (apps/examples/desktop-app) release — stable (desktop-vX.Y.Z from main) or beta (desktop-vX.Y.Z-beta.N from desktop-experimental, shipped as the side-by-side "Cline Beta" app). Guides changelog drafting, version bumps in package.json + tauri.conf.json, tagging, and the desktop-publish GitHub workflow that builds, signs, notarizes, and updates the per-channel auto-update feed.
----
-
-# Desktop App Release
-
-Use this skill when the user asks to release the desktop app, publish the Cline desktop app, cut a desktop beta, bump the desktop version, create a `desktop-vX.Y.Z` (or `desktop-vX.Y.Z-beta.N`) tag, or trigger the desktop publish workflow.
-
-> Working directory: run every command below from the repository root.
-
-Desktop releases ship two platforms, built entirely in GitHub Actions — there is no local publish path. macOS: a single signed + notarized universal DMG that runs natively on both Apple Silicon and Intel. Windows: an Authenticode-signed NSIS installer (`<Product>_<version>_x64-setup.exe`), signed via Azure Trusted Signing in the `build-windows` job (jsign through Tauri's `signCommand`, see `apps/examples/desktop-app/scripts/tauri-sign-windows.ps1`; requires the repo-level `AZURE_*` secrets including `AZURE_TRUSTED_SIGNING_CERTIFICATE_PROFILE_DESKTOP`, plus a `PublishDesktop`-environment federated credential on the `cline-cli-signing` Entra app). Installed apps discover new releases automatically through the Tauri updater, so publishing a release is what ships the update to every existing user **on that channel**.
-
-## Release contract
-
-- Two channels, one workflow (`channel` input on `desktop-publish.yml`):
-  - **stable** — tag `desktop-vX.Y.Z` (no suffix; the workflow rejects prerelease suffixes on this channel), cut from `main`, feeds the rolling `desktop-latest` release, ships as "Cline".
-  - **beta** — tag `desktop-vX.Y.Z-beta.N`, cut from `desktop-experimental`, feeds the rolling `desktop-beta` release, ships as "Cline Beta" (separate bundle identifier `bot.cline.app.beta`; installs side by side with stable). Built with the extra `src-tauri/tauri.beta.conf.json` overlay. Process background: `apps/examples/desktop-app/EXPERIMENTAL.md`.
-- Version sources (must match each other and the tag): `apps/examples/desktop-app/package.json` and `apps/examples/desktop-app/src-tauri/tauri.conf.json`. (`src-tauri/Cargo.toml` has its own version but `tauri.conf.json` overrides it; no need to touch it.)
-- Beta versions are prereleases of the **next** stable: stable `0.0.13` → betas `0.0.14-beta.1`, `-beta.2`, … Once a stable ≥ the beta base ships, the next beta bumps its base (`0.0.15-beta.1`).
-- Release prep includes approved release notes, the version bumps, and an `apps/examples/desktop-app/CHANGELOG.md` update — committed on `main` for stable, on `desktop-experimental` for beta.
-- Publish path: `.github/workflows/desktop-publish.yml` (workflow_dispatch, requires the tag to exist, point at the checked-out commit, and be reachable from the channel's branch — `origin/main` for stable, `origin/desktop-experimental` for beta).
-- **Both channels dispatch from `main`.** This is a security invariant, not a convenience: the run executes `main`'s workflow copy and only the checkout points at the tag, so the signing-secret gates (the `github.ref == main` check and the PublishDesktop environment's main-only deployment-branch policy) hold for beta too. Never add `desktop-experimental` to the PublishDesktop deployment-branch policy.
-- The workflow creates the tag's GitHub release (universal DMG + macOS updater artifact + Windows NSIS installer with its updater signature + `latest.json`; marked prerelease for beta) and refreshes the channel's rolling feed release, which is the static auto-update feed every installed app on that channel polls. Never delete the `desktop-latest` or `desktop-beta` release or tag.
-- The changelog's `## <version>` section (exact-match, not "topmost") is extracted verbatim into the GitHub release body, the Slack announcement, and the updater manifest notes.
-- Always ask before pushing commits or tags.
-
-## Workflow
-
-0. Ask which channel this release is for — **stable or beta** — if the user has not said. Everything below branches on it; never guess.
-
-1. Gather context.
-
-```sh
-git status --short --branch
-git fetch origin --tags
-git tag --list 'desktop-v*' --sort=-v:refname | head -10
-node -p "require('./apps/examples/desktop-app/package.json').version"
-node -p "require('./apps/examples/desktop-app/src-tauri/tauri.conf.json').version"
-```
-
-If there is no `desktop-v*` tag yet, this is the first release; use the desktop app's first commit as the baseline and say the baseline is inferred.
-
-For a **beta** release, work on `desktop-experimental` (check out `origin/desktop-experimental`; merge `origin/main` into it first if it is behind — see EXPERIMENTAL.md for the conflict policy) and read the version files from that branch. The last-tag baseline is the newest `desktop-v*` tag of either channel that is an ancestor of the branch.
-
-2. Collect release commits.
-
-```sh
-# stable (on main):
-git log <last-desktop-tag>..HEAD --oneline --no-merges -- apps/examples/desktop-app sdk/packages .github/workflows/desktop-publish.yml
-# beta (on desktop-experimental):
-git log <last-desktop-tag>..origin/desktop-experimental --oneline --no-merges -- apps/examples/desktop-app sdk/packages .github/workflows/desktop-publish.yml
-```
-
-The sidecar bundles `@cline/core` and friends from the monorepo, so SDK changes ship inside the desktop app too. Fold user-visible SDK changes (providers, models, behavior fixes) into the notes; skip purely internal ones.
-
-3. Draft user-facing release notes.
-
-Flat bullet list, user-facing language. Present the draft and wait for approval before editing files.
-
-4. Decide the version bump.
-
-Stable: ask whether this is patch, minor, major, or an explicit version. Do not guess if the user has not made it clear.
-
-Beta: apply the versioning rule — base = next stable version, increment `N` (`0.0.14-beta.1` → `0.0.14-beta.2`; after stable `0.0.14` ships, next is `0.0.15-beta.1`). Confirm the computed version with the user.
-
-5. Update release files (on `main` for stable, on `desktop-experimental` for beta).
-
-- `apps/examples/desktop-app/package.json` → new version
-- `apps/examples/desktop-app/src-tauri/tauri.conf.json` → same version
-- Prepend `## X.Y.Z` (no date; `## X.Y.Z-beta.N` for beta) to `apps/examples/desktop-app/CHANGELOG.md` with the approved notes.
-
-6. Verify before committing.
-
-```sh
-bun -F @cline/code typecheck
-bun test apps/examples/desktop-app/scripts/generate-update-manifest.test.ts
-```
-
-The full desktop bundle can only be built on macOS; the workflow's build job is the real verification. For extra local confidence on a Mac checkout, `bun run package:desktop:mac --allow-unsigned-mac` from the app directory.
-
-7. Commit release changes.
-
-```sh
-git add apps/examples/desktop-app/package.json apps/examples/desktop-app/src-tauri/tauri.conf.json apps/examples/desktop-app/CHANGELOG.md
-git commit -m "chore(desktop): release vX.Y.Z"
-```
-
-Ask before pushing the release commit, then before creating and pushing the tag:
-
-```sh
-git push origin HEAD
-git tag -a desktop-vX.Y.Z -m "Desktop vX.Y.Z"       # beta: desktop-vX.Y.Z-beta.N / "Desktop vX.Y.Z-beta.N"
-git push origin refs/tags/desktop-vX.Y.Z
-```
-
-8. Publish.
-
-The release commit must be on the channel's branch (`main` for stable, `desktop-experimental` for beta) and the tag pushed first. Dispatch from `main` for **both** channels (see the release contract for why).
-
-```sh
-# stable:
-gh workflow run desktop-publish.yml --ref main -f git_tag=desktop-vX.Y.Z -f channel=stable -f confirm_publish=publish
-# beta:
-gh workflow run desktop-publish.yml --ref main -f git_tag=desktop-vX.Y.Z-beta.N -f channel=beta -f confirm_publish=publish
-
-gh run list --workflow=desktop-publish.yml --limit=1 --json url,status,conclusion,createdAt --jq '.[0]'
-```
-
-**The run pauses for approval.** `validate` runs immediately, then the `build`
-job waits on the `PublishDesktop` environment until a required reviewer approves
-it — the run sits in `waiting`, which is expected, not a hang. Approve it in the
-run's web UI ("Review deployments"), or:
-
-```sh
-gh api repos/cline/cline/actions/runs/<run-id>/pending_deployments \
-  --method POST -f state=approved -f comment="desktop vX.Y.Z" \
-  -F 'environment_ids[]=19152605990'   # PublishDesktop
-```
-
-Nothing after `validate` runs — and no signing key is readable — until then.
-
-The workflow builds one universal macOS bundle (`tauri build --target universal-apple-darwin` lipos the aarch64 + x86_64 Rust binaries; the Bun sidecar is lipo'd by `build-sidecar-bin.ts`; beta adds the `tauri.beta.conf.json` overlay), verifies every Mach-O in the bundle carries both slices and that the compiled binary embeds exactly its own channel's feed URL, signs with the Developer ID certificate, notarizes with the App Store Connect API key, and signs the updater artifact with the Tauri updater key. In parallel, `build-windows` builds the x64 NSIS installer on a Windows runner, Authenticode-signs every binary via Azure Trusted Signing (Tauri `signCommand` -> `scripts/tauri-sign-windows.ps1`), runs the same feed-endpoint and telemetry guardrails, and verifies the shipped installer with `Get-AuthenticodeSignature`. The release job then creates the GitHub release (prerelease for beta), refreshes the channel's feed (`desktop-latest/latest.json` or `desktop-beta/latest.json`), and posts to Slack. Notarization typically adds 2–10 minutes.
-
-If the workflow fails on missing credentials, see "Publish secrets (one-time setup)" below.
-
-9. Verify the update feed after the run succeeds.
-
-```sh
-curl -sL https://github.com/cline/cline/releases/download/desktop-latest/latest.json | head -30   # stable
-curl -sL https://github.com/cline/cline/releases/download/desktop-beta/latest.json | head -30    # beta
-```
-
-The `version` field must be the new release; both `darwin-aarch64` and `darwin-x86_64` entries must point at the same new universal `.app.tar.gz` asset under the release tag (each slice of the fat binary requests its own arch key at runtime, so both keys serve the one artifact), and the `windows-x86_64` entry must point at the new `*_x64-setup.exe` asset. Installed apps on that channel — including older per-arch installs — pick the update up on next launch or within 2 hours.
-
-After a **beta** publish, also confirm the stable feed was not touched: `desktop-latest/latest.json` must still serve the previous stable version. (The workflow guards this fail-closed, but it is cheap to verify and catastrophic to miss — the updater comparator is a plain semver "newer than", so a beta manifest on `desktop-latest` would auto-update every stable install onto the beta.)
-
-10. Final response.
-
-Report: channel, version, tag, changelog updated, commit hash, what was pushed, workflow URL, and the feed verification result.
-
-## Publish secrets (one-time setup)
-
-These live on the **`PublishDesktop` environment**, not at repository level, so
-only the `build` job can read them and only after an approval. Set them under
-Settings → Environments → PublishDesktop → Environment secrets. The environment
-also restricts deployments to `main` and requires a reviewer.
-
-Adding one of these as a *repository* secret is the common mistake. The build
-would still succeed — an environment-gated job resolves repository secrets too,
-with environment values simply taking precedence — so the credential would sit
-repo-wide while everything looked fine. `validate` therefore fails the run if any
-of them resolves in a job with no environment. If you hit that, delete the
-repository-level copy rather than duplicating it.
-
-If a secret is missing everywhere, the preflight in `build` fails the run naming
-the missing entries. The Apple values come from the same Apple Developer account
-used for manual signing (see the app README's "macOS signing & notarization"
-section for how to obtain them):
-
-| Secret | Value |
-| --- | --- |
-| `APPLE_CERTIFICATE` | Base64 of the **Developer ID Application** identity exported from Keychain Access as `.p12` (must include the private key): `base64 -i certificate.p12 \| pbcopy` |
-| `APPLE_CERTIFICATE_PASSWORD` | The password chosen when exporting the `.p12` |
-| `APPLE_SIGNING_IDENTITY` | `Developer ID Application: <Team Name> (<TEAMID>)` — from `security find-identity -v -p codesigning` |
-| `APPLE_API_KEY` | App Store Connect API **Key ID** (notarization) |
-| `APPLE_API_KEY_CONTENT` | Contents of the `AuthKey_<KEYID>.p8` file |
-| `APPLE_API_ISSUER` | App Store Connect **Issuer ID** (UUID from Users and Access → Integrations) |
-| `TAURI_SIGNING_PRIVATE_KEY` | Contents of the Tauri updater private key (`tauri signer generate`). If this key is ever lost, shipped apps can no longer verify updates — guard it. |
-| `TAURI_SIGNING_PRIVATE_KEY_PASSWORD` | Password for that key |
-
-The Slack + telemetry secrets (`SLACK_RELEASE_BOT_TOKEN`, `TELEMETRY_SERVICE_API_KEY`,
-`ERROR_SERVICE_API_KEY`, OTEL settings) are shared with the CLI, SDK, and extension
-publish workflows and already configured. **Do not move these into
-`PublishDesktop`** — scoping them to this environment empties them in every other
-publish workflow, silently, with no error beyond missing telemetry and a failed
-Slack post.

.cline/skills/publish-extension/SKILL.md

@@ -1,181 +0,0 @@
----
-name: publish-extension
-description: Use when releasing the Cline VS Code extension — stable (standalone SDK build of main via ext-vscode-publish-stable), nightly (ext-vscode-publish-nightly, manual dispatch), or an emergency legacy-branch hotfix (ext-vscode-publish-legacy). Guides version selection, changelog, workflow dispatch, environment approvals, tagging, post-publish verification, and the remaining retirement of the finished A/B rollout machinery.
----
-
-# VS Code Extension Release
-
-Use this skill when the user asks to release, publish, or ship the VS Code extension — stable, nightly, or an emergency legacy hotfix — or to retire the leftover A/B rollout machinery.
-
-> Working directory: repo root. All workflows are dispatched from `main` (GitHub requires the workflow file on the default branch; each workflow checks out the refs it actually builds).
-
-## The current era: standalone SDK extension from `main`
-
-**The legacy → SDK migration is complete.** The PostHog flag `ext-sdk-bundle-rollout` reached 100% (verified empirically 2026-09-15: 200/200 `/decide` probes returned `true`), so every user on the combined VSIX runs the `next` (SDK, bun) bundle and the `legacy/` half is dead weight. Stable releases now ship a **plain build of `main`** through `ext-vscode-publish-stable.yml`. The combined A/B path (`ext-vscode-ab-package.yml`) is no longer used for releases and is pending deletion — see "Retiring the A/B machinery" at the bottom for what is still left to clean up and the one caveat (leave the flag at 100%).
-
-History, for context only: the A/B era ran `4.1.0` → `4.1.17` (Jul–Sep 2026). Design docs remain at `apps/vscode-rollout/README.md` and PR #12253 until that directory is removed.
-
-### The listings and the workflows
-
-| Channel | Marketplace ID | Workflow | Trigger | Version |
-|---|---|---|---|---|
-| **Stable** | `saoudrizwan.claude-dev` | `ext-vscode-publish-stable.yml` | dispatch, from `main` | `apps/vscode/package.json` on `main`; tag `v<version>` must match |
-| Nightly | `saoudrizwan.cline-nightly` | `ext-vscode-publish-nightly.yml` | **manual dispatch only** (cron deliberately removed) | auto `<major>.<minor>.<unix-ts>` from main's `apps/vscode/package.json` |
-| Legacy hotfix (emergency only) | `saoudrizwan.claude-dev` | `ext-vscode-publish-legacy.yml` | dispatch | `apps/vscode/package.json` on `legacy-extension` |
-
-Stable runs the reusable bun suite (`ext-vscode-test.yml`, tests `main`) before an environment-gated publish job (`publish` environment — required reviewers approve in the Actions UI). Nightly uses `PublishNightly` (branch policy only). Nightly **still builds the combined loader VSIX** (loader + `next/` + `legacy/`) until it is converted back to a plain build — that conversion is on the retirement list below.
-
-## Golden rules (read before any release)
-
-1. **One listing, one version line.** `claude-dev` has been published from multiple workflows and branches. Every stable publish must use a version **strictly above the highest version ever published to the listing from any branch** — marketplace versions are monotonic and cannot be unpublished (supersede, never delete). Check what's live first:
-
-   ```bash
-   curl -s -X POST "https://marketplace.visualstudio.com/_apis/public/gallery/extensionquery" \
-     -H "Content-Type: application/json" -H "Accept: application/json;api-version=3.0-preview.1" \
-     -d '{"filters":[{"criteria":[{"filterType":7,"value":"saoudrizwan.claude-dev"}]}],"flags":16}' \
-     | python3 -c "import json,sys; v=json.load(sys.stdin)['results'][0]['extensions'][0]['versions'][0]; print(v['version'], v['lastUpdated'])"
-   ```
-
-   **`ext-vscode-publish-stable` has no marketplace-monotonicity preflight** (that check only ever lived in the retired ab-package workflow), so this query is the only guard. The `legacy-extension` branch sits at `4.0.12`, so it cannot collide with the `4.1.x` line, but a legacy hotfix would have to be numbered above the live stable version (see the emergency section).
-
-2. **Tag == package version, enforced.** The workflow reads `apps/vscode/package.json`, requires the `tag` input to equal `v<that version>`, and hard-fails otherwise. Bump the version on `main` first.
-
-3. **Changelog lives at the repo ROOT** (`CHANGELOG.md`) — not `apps/vscode/CHANGELOG.md` (doesn't exist). The workflow hard-fails unless the first `## [` heading is exactly `## [<version>]`. The section body becomes the GitHub release notes and the Slack post (Slack copy is trimmed to 3000 chars with a link out; the release body stays whole).
-
-4. **Ask before pushing** commits or tags. **Never approve the `publish` environment gate yourself via `gh api`** — hand the maintainer the run URL to click "Review deployments".
-
-5. **Concurrency**: the workflow groups on the tag with `cancel-in-progress: false`. A publish run left `waiting` on approval blocks every later dispatch of the same tag until cancelled (`gh run cancel <id>`).
-
-## Stable release — the current path
-
-### Pre-flight
-
-```bash
-# 1. What's live (rule 1) → pick <VERSION> strictly above it (normally patch bump).
-# 2. Confirm main's package.json is at the *previous* published version, i.e. the repo
-#    reflects the live line and nothing unreleased is already bumped:
-node -p "require('./apps/vscode/package.json').version"
-# 3. What's in the release:
-git fetch origin main --tags
-git log v<PREV>..origin/main --oneline --no-merges -- apps/vscode sdk/packages
-```
-
-The CLI/SDK notes are the best starting point for the extension notes — the extension bundles `@cline/*` from source, so an SDK release in the same window ships here too. Read `sdk/CHANGELOG.md` for the matching SDK version and translate what's extension-visible; skip CLI-only and desktop-only items.
-
-### Release prep on `main` (PR, not direct push)
-
-- Bump `apps/vscode/package.json` → `<VERSION>`.
-- Prepend `## [<VERSION>]` to root `CHANGELOG.md` with the approved notes.
-- Side effect of the bump: nightly versions become `<major>.<minor>.<unix-ts>` of the new base — harmless (separate listing, still monotonic).
-
-Optional local rehearsal of the exact packaging step (the workflow has no dry-run input, and the build runs inside the gated publish job, so this is the only pre-approval check):
-
-```bash
-bun install --frozen-lockfile && bun run build:sdk
-cd apps/vscode && npx @vscode/vsce package --no-dependencies --allow-package-secrets sendgrid --out /tmp/rehearsal.vsix
-# vsce runs vscode:prepublish → `bun run package` (check-types + build:webview + lint + esbuild --production),
-# i.e. the same build the workflow performs. Telemetry env is NOT set locally, so expect
-# telemetry to be dark in this artifact — that is fine for a build rehearsal, not for shipping.
-```
-
-### Dispatch
-
-```bash
-gh workflow run ext-vscode-publish-stable.yml --ref main \
-  -f release-type=release \
-  -f auto_create_tag_from_main=true \
-  -f tag=v<VERSION>
-gh run list --workflow=ext-vscode-publish-stable.yml --limit 1 --json databaseId,url,status
-```
-
-What the run does, in order: test gate on `main` → publish job checks out `main`, **creates and pushes `v<VERSION>` at the tested SHA** (auto-create mode; refuses if the tag already exists elsewhere) → `bun install --frozen-lockfile` → `bun run build:sdk` → asserts the `better-sqlite3` native binary → verifies tag/version/changelog/PATs → `vsce package` → `bun run publish:marketplace` (vsce publish **and** `npx ovsx publish`, both `--no-dependencies`) → GitHub release with the `.vsix` attached → Slack post. The publish job waits for `publish` environment approval before any of that. Check what a run is waiting on:
-
-```bash
-gh api repos/cline/cline/actions/runs/<run-id>/pending_deployments
-```
-
-`release-type=pre-release` publishes to the pre-release channel of the same listing; it is a real publish, not a rehearsal.
-
-### Post-publish
-
-1. Verify both registries serve the new version (expect minutes-to-an-hour of Marketplace validation lag after "Published" appears in the logs):
-
-   ```bash
-   # Marketplace: query from rule 1
-   curl -s "https://open-vsx.org/api/saoudrizwan/claude-dev" | python3 -c "import json,sys; d=json.load(sys.stdin); print(d['version'], d['timestamp'])"
-   ```
-
-2. Verify the bookkeeping landed: `git fetch --tags && git tag --list 'v<VERSION>'`, `gh release view v<VERSION>`, Slack post in the release channel. Tag creation happens **before** the build in this workflow, so a tag-push failure fails the run early (no publish) rather than leaving a published-but-untagged release. Known cause: the built commit touches `.github/workflows/**` (default token cannot create such refs). Workaround: create and push the tag yourself at `origin/main` HEAD (ask first), then re-dispatch with `auto_create_tag_from_main=false` from `main` — the workflow requires the existing tag to point at the exact SHA it tested.
-
-3. Artifact check (`gh run download <run-id>` or the release asset): `package.json` inside is `saoudrizwan.claude-dev@<VERSION>`; `grep -c 'process.env.TELEMETRY_SERVICE_API_KEY' extension/dist/extension.js` must be **0** (a leftover literal means the build ran without its env and telemetry is silently dead). `CLINE_ROLLOUT_VARIANT` is defined to `""` for ordinary builds by `apps/vscode/esbuild.mjs`, so no literal is expected and telemetry carries no `extension_variant` — correct for a standalone build.
-
-4. Monitor errors on `extension_version = '<VERSION>'` in `otel.otel_logs` (stable cohort is cleanly separable — nightly versions are timestamps). Metabase dashboards 17 (task error rate) and 19 (error deep dive).
-
-## Nightly release
-
-**Manual dispatch only.** The cron was removed on purpose: the `PublishNightly` environment made scheduled runs sit `waiting`, hold the concurrency group, and silently cancel every later scheduled run behind them. A stale nightly listing is therefore expected, not a bug.
-
-```bash
-gh workflow run ext-vscode-publish-nightly.yml --ref main                 # real publish
-gh workflow run ext-vscode-publish-nightly.yml --ref main -f dry-run=true # artifact only
-```
-
-No changelog/version prep — the version is computed. Verify with the Marketplace query against `saoudrizwan.cline-nightly`. Until converted, nightly still ships the combined loader VSIX with a `legacy/` bundle built from `legacy-extension`.
-
-**Red run ≠ failed publish** on this path: its tag-push step runs *after* publishing and fails whenever main's HEAD touches `.github/workflows/**`. If "Published" appears in the logs, the release went out; push the `nightly-main-<UTC ts>-<sha12>` tag manually with user credentials.
-
-## Emergency rollback
-
-Preferred: **ship a fixed build of `main` at a higher version** through the stable workflow above. It is the same path, fully gated, and the only rollback that keeps users on the SDK extension.
-
-Last resort — the legacy hotfix path — still exists but is degraded: `legacy-extension` is the pre-SDK npm codebase, last touched 2026-08-18 at `4.0.12`, and a publish from it would move every user back onto code that is weeks behind. If it is ever needed:
-
-```bash
-# On legacy-extension: commit the fix, bump apps/vscode/package.json ABOVE the
-# live stable version (rule 1 — e.g. 4.1.18 live -> hotfix is 4.1.19, not 4.0.13),
-# add the matching `## [x.y.z]` entry to root CHANGELOG.md, push.
-gh workflow run ext-vscode-publish-legacy.yml --ref main -f release-type=release
-# (the branch is hardcoded to legacy-extension in the workflow)
-```
-
-The npm suite runs ungated, the publish job waits on the `publish` environment, the workflow tags and creates the GitHub release itself, and it publishes to Marketplace **and** Open VSX. On that branch use `npm`, never `bun`, and expect the old monolith layout (`apps/vscode/src/core/...`).
-
-## Retiring the A/B machinery (still to do)
-
-The rollout is done but the scaffolding is still in the repo. Retire it in this order, each as its own PR:
-
-1. **Nightly → plain build of `main`**: drop the loader/`legacy-src` stitching from `ext-vscode-publish-nightly.yml` so nightly matches stable. Preserve the `|| 'default'` fallbacks for `inputs.*` while editing.
-2. Delete `ext-vscode-ab-package.yml` and, once the emergency path above is judged unnecessary, `ext-vscode-publish-legacy.yml`; keep the `legacy-extension` branch for history.
-3. Remove `apps/vscode-rollout/` and the rollout-only code paths in `apps/vscode/src/services/telemetry/rollout-metadata.ts` (the `extension_variant` metadata and `extension.rollout.bundle_activated` event).
-4. Optionally port the marketplace-monotonicity preflight from the old ab-package workflow into `ext-vscode-publish-stable.yml` — the only automated guard for rule 1 was retired with it.
-5. **Archive the PostHog flag last, and not yet.** Machines still on a combined VSIX (`≤ 4.1.17`) consult `ext-sdk-bundle-rollout` on every window load and treat a *deleted* flag as `legacy`. Leave it at 100% until `extension.rollout.bundle_activated` for combined versions flatlines, then archive. Re-verify the percentage empirically before touching it (no PostHog admin needed — the key is inlined in any shipped combined loader; download the 4.1.17 VSIX from the Marketplace `vspackage` URL, `gunzip`, `unzip`, `grep -o 'phc_[A-Za-z0-9]*' extension/extension.js`):
-
-   ```bash
-   node -e '
-   const KEY = process.argv[1];
-   (async () => {
-     let t = 0, n = 200;
-     for (let i = 0; i < n; i += 20) {
-       const rs = await Promise.all(Array.from({length: 20}, (_, j) =>
-         fetch("https://data.cline.bot/decide?v=3", { method: "POST",
-           headers: {"Content-Type": "application/json"},
-           body: JSON.stringify({api_key: KEY, distinct_id: `probe-${i+j}-${Math.random()}`})
-         }).then(r => r.json())));
-       for (const r of rs) if ((r.featureFlags||{})["ext-sdk-bundle-rollout"] === true) t++;
-     }
-     console.log(`~${(100*t/n).toFixed(1)}% (${t}/${n})`);
-   })()' "$KEY"
-   ```
-
-6. Update this skill: delete this section and the combined-loader notes under Nightly.
-
-## Gotchas index
-
-- `bun run package` in `apps/vscode` does not build `@cline/*` workspace deps — fresh checkouts need `bun run build:sdk` first (the workflows handle this).
-- Every ext workflow pins `bun-version: 1.3.14` while the root `packageManager` is `bun@1.3.13`. This is consistent across all of them and has shipped fine — don't "fix" it in one workflow alone.
-- The publish job pins **Node 22** on purpose: Node 24 / npm 11 can make vsce's `npm list` detection fail with `ELSPROBLEMS` during packaging. `setup-bun` provides no Node runtime, and the publish scripts and `npx ovsx` need one.
-- `gh run watch --exit-status` has returned exit 0 on a failed run. Always confirm with `gh run view <id> --json status,conclusion` before acting on a result.
-- Job-level `if:` ref checks in workflow YAML are advisory (a dispatched branch runs its own copy of the file); the enforced boundary is each environment's deployment-branch policy in repo settings.
-- Marketplace PATs (`VSCE_PAT`/`OVSX_PAT`) are only mounted into publish steps; no publish workflow has an untrusted trigger surface.
-- Environment-approval runs left waiting don't time out quickly — they sit for days and block their tag's concurrency group.
-- Open VSX has held a first-time publish in moderation before (logs say "Published", API 404s for hours). Verify with the API query rather than the log line.

.cline/skills/publish-ui/SKILL.md

@@ -1,158 +0,0 @@
----
-name: publish-ui
-description: Prepare, validate, and publish standalone @cline/ui npm releases. Use when bumping the UI package version, publishing latest or next through ui-publish.yml, checking UI release readiness, or completing the one-time npm trusted-publishing bootstrap.
----
-
-# Publish UI
-
-Release `@cline/ui` independently from the Cline SDK runtime packages.
-
-## Release contract
-
-- Version source: `sdk/packages/ui/package.json`.
-- Workflow: `.github/workflows/ui-publish.yml`.
-- The package keeps `internal: true` only to stay out of the SDK's shared
-  version/publish scripts. It is still a public npm package because
-  `private: false` and `publishConfig.access: public` control npm publication.
-- `latest` is the production channel. `next` is an opt-in preview channel.
-- Use prerelease versions such as `0.2.0-next.0` for `next`; do not publish a
-  version intended for `latest` under the preview tag because npm versions
-  cannot be republished.
-- There is no UI Git tag, GitHub release, schedule, or Slack announcement.
-- The workflow runs only by manual dispatch. Every release attempt runs the UI
-  quality checks before publishing and requires `confirm_publish=publish` from
-  `main`.
-- The publish job and npm trust relationship use the protected `Publish`
-  environment.
-- Every npm publication needs a new semver version; npm versions are immutable.
-- Always ask before pushing commits, triggering the publish workflow, changing
-  npm trust settings, or running a local publish command.
-
-## Normal release
-
-1. Inspect the branch, current version, npm state, and UI changes.
-
-```sh
-git status --short --branch
-node -p "require('./sdk/packages/ui/package.json').version"
-npm view @cline/ui dist-tags versions --json
-git log --oneline --no-merges -- \
-  sdk/packages/ui apps/examples/desktop-app/webview/components/views/chat \
-  .github/workflows/ui-publish.yml
-```
-
-2. Ask for the npm channel and version together. For `latest`, ask for patch,
-   minor, major, or an explicit version. For `next`, require an explicit
-   prerelease version such as `0.2.0-next.0`. Do not guess. Update only
-   `sdk/packages/ui/package.json` and its workspace version in `bun.lock`. Do
-   not run the SDK version command.
-
-3. Validate the release candidate.
-
-```sh
-bun install --filter @cline/ui --filter @cline/code --frozen-lockfile
-bun -F @cline/ui typecheck
-bun -F @cline/ui test
-bun -F @cline/ui test:package
-bun -F @cline/ui build-storybook
-bun -F @cline/code test:chat-ui
-```
-
-The packed-package test installs the tarball with Bun/React 19 and with
-npm/Node/React 18.
-Inspect `bun pm pack --dry-run` when the exported file set changed.
-
-4. Commit the version bump separately from feature work. Ask before pushing.
-
-```sh
-git add sdk/packages/ui/package.json bun.lock
-git commit -m "chore(ui): release vX.Y.Z"
-git push origin HEAD
-```
-
-5. After the release commit reaches `main`, restate the selected npm tag and ask
-   for explicit publish approval. Then trigger and watch the standalone
-   workflow:
-
-```sh
-run_url=$(gh workflow run ui-publish.yml --ref main \
-  -f npm_tag=latest \
-  -f confirm_publish=publish)
-test -n "$run_url"
-run_id=${run_url##*/}
-gh run watch "$run_id" --exit-status
-```
-
-Use `npm_tag=next` only for a deliberate preview. Do not report success until
-the workflow succeeds and npm shows the exact version under the selected tag.
-
-```sh
-npm view @cline/ui dist-tags versions --json
-```
-
-## One-time npm bootstrap
-
-Use this only while `npm view @cline/ui` returns `E404`. npm requires the
-package to exist before its GitHub trusted publisher can be configured.
-
-1. Merge the package and `ui-publish.yml` to `main`. Start from a clean,
-   reviewed `main` checkout. Verify authentication, account 2FA, and write
-   access to the `@cline` npm organization. The `npm trust` command in step 4
-   requires npm CLI 11.15 or newer; the automated trusted-publishing workflow
-   itself enforces npm 11.5.1 or newer.
-
-```sh
-npm --version
-npm whoami
-npm view @cline/ui version
-```
-
-If npm is older than 11.15, ask before upgrading with
-`npm install -g npm@^11.15.0`.
-
-2. Run the normal release validation in step 3 above. Then build, pack, test,
-   and inspect the exact initial tarball. Record the absolute archive path
-   printed by the final command.
-
-```sh
-bun -F @cline/ui build
-pack_dir=$(mktemp -d)
-(cd sdk/packages/ui && bun pm pack --ignore-scripts --destination "$pack_dir" --quiet)
-tarball=$(find "$pack_dir" -maxdepth 1 -name '*.tgz' -print -quit)
-test -n "$tarball"
-bun sdk/packages/ui/scripts/smoke-package.ts "$tarball"
-tar -tzf "$tarball"
-printf 'Bootstrap archive: %s\n' "$tarball"
-```
-
-3. Ask for explicit approval, then publish the initial version publicly under
-   `latest`:
-
-```sh
-npm publish /absolute/path/from-step-2.tgz --access public --tag latest
-```
-
-4. Ask separately before configuring the standalone workflow as the trusted
-   publisher:
-
-```sh
-npm trust github @cline/ui \
-  --repo cline/cline \
-  --file ui-publish.yml \
-  --env Publish \
-  --allow-publish
-```
-
-5. Verify both package state and trust. Every later release uses the workflow;
-   do not add a long-lived npm token.
-
-```sh
-npm view @cline/ui dist-tags versions --json
-npm trust list @cline/ui
-```
-
-## Final report
-
-Report the version and npm tag, release commit, whether anything was pushed,
-workflow URL or bootstrap result, npm verification, and tests/builds run. If
-the package still returns `E404`, state that bootstrap remains required.

.cline/skills/publish-ui/agents/openai.yaml

@@ -1,4 +0,0 @@
-interface:
-  display_name: "Publish UI"
-  short_description: "Prepare and publish the Cline UI package"
-  default_prompt: "Use $publish-ui to prepare and publish a new @cline/ui npm release."

.cline/skills/tuistory/SKILL.md

@@ -1,107 +0,0 @@
----
-name: tuistory
-description: |
-  Drive and test terminal apps (especially the Cline CLI TUI in apps/cli) through tuistory — named background PTY sessions that agents can read, wait on, snapshot, screenshot, and type into. Like Playwright/tmux for terminals, with reactive waiting instead of blind `sleep`.
-
-  Use this skill when you need to:
-  - Manually test or reproduce bugs in the interactive Cline TUI (`bun run cli -i`) from a headless environment
-  - Run a dev server or any long-lived/interactive process in the background without hanging your tool call
-  - Write or extend Playwright-style e2e tests for the TUI (`bun run test:e2e:tuistory` in apps/cli)
-  - Capture text snapshots or styled PNG screenshots of a TUI screen as evidence
----
-
-# tuistory
-
-[tuistory](https://github.com/remorses/tuistory) wraps any terminal command in a named background PTY session backed by a Ghostty terminal emulator. Agents interact with the session via short CLI calls that return instantly; humans can `tuistory attach` to the same session to watch or intervene. No real terminal or display (`DISPLAY`) is needed — it works fully headless, which makes it the preferred way for cloud agents to exercise the Cline TUI.
-
-It is installed as a devDependency of `@cline/cli`, so the pinned binary resolves when you run from `apps/cli`:
-
-```bash
-cd apps/cli
-bunx tuistory --help   # source of truth for commands, options, and syntax
-```
-
-For full upstream docs: `curl -s https://raw.githubusercontent.com/remorses/tuistory/refs/heads/main/README.md`
-
-## Driving the Cline TUI headlessly
-
-Launch the TUI in an isolated environment so you don't touch real user config (`~/.cline`):
-
-```bash
-cd apps/cli
-DATA_DIR=$(mktemp -d) && HOME_DIR=$(mktemp -d)
-bunx tuistory -s cline --cols 120 --rows 36 \
-  --env HOME=$HOME_DIR --env CLINE_DATA_DIR=$DATA_DIR \
-  --env CLINE_DISABLE_CLINE_PASS_NOTICE=1 --env CLINE_TELEMETRY_DISABLED=1 \
-  -- bun src/index.ts --provider anthropic -m claude-sonnet-4-6 -k test-key
-```
-
-The dummy `-k test-key` renders the full chat UI; only an actual agent turn would fail. For recorded LLM turns, use the VCR cassettes described in `apps/cli/src/tests/helpers/env.ts` (`CLINE_VCR=playback` + `CLINE_VCR_CASSETTE`). Real turns need a provider credential (e.g. `ANTHROPIC_API_KEY`, `CLINE_API_KEY`).
-
-Then use an **observe → act → observe** loop:
-
-```bash
-# Wait reactively for the chat view — never use sleep
-bunx tuistory -s cline wait "What can I do for you?" --timeout 30000
-
-# Act, then always observe the resulting screen state
-bunx tuistory -s cline type "/settings"
-bunx tuistory -s cline snapshot --trim
-bunx tuistory -s cline press enter
-bunx tuistory -s cline snapshot --trim
-
-# Styled PNG of the current screen (prints the file path) — good for artifacts
-bunx tuistory -s cline screenshot
-
-# Full raw output stream (snapshot shows only the visible screen)
-bunx tuistory read -s cline --all
-
-# Tear down a session YOU started (double Ctrl+C exits the TUI cleanly)
-bunx tuistory -s cline press ctrl c
-bunx tuistory -s cline press ctrl c
-bunx tuistory -s cline close
-```
-
-## Background processes (instead of tmux)
-
-```bash
-bunx tuistory -s my-server -- bun run dev:sidecar   # returns immediately
-bunx tuistory -s my-server wait "/listening|ready/i" --timeout 30000
-bunx tuistory read -s my-server                     # new output since last read
-bunx tuistory -s my-server restart                  # after code changes
-```
-
-## Key rules
-
-- **Options before `--`, command after.** Everything after the first `--` is passed verbatim to the child: `tuistory -s name --cols 150 -- bun src/index.ts` is correct.
-- **Snapshot after every action.** TUIs are stateful; dialogs and errors can render over the view you expect. `snapshot` reflects what the user actually sees (occluded text does not count), unlike grepping the raw stream.
-- **Wait, never sleep.** `wait "text"` / `wait "/regex/i"` (case-sensitive by default) reacts as fast as the terminal updates; `wait-idle` when you don't know what to expect. Always pass `--timeout`.
-- **Keys land instantly.** Unlike sleep-based scripts, a queued second keypress can leak into the next view (e.g. one Enter both accepts a slash completion and submits it).
-- **Never close a session you didn't start.** Sessions are shared with humans (`tuistory attach -s name`) and other agents. Default to leaving sessions running; use `read`/`wait`/`snapshot` to inspect without disrupting.
-- `--cols`/`--rows` affect TUI layout (assertions are width-sensitive); `--pixel-ratio 2` gives sharper screenshots.
-
-## Writing e2e tests with the library API
-
-`apps/cli/src/cli.tuistory.e2e.test.ts` (run: `bun run test:e2e:tuistory`) is the reference. The programmatic API runs in-process — no daemon:
-
-```ts
-import { launchTerminal } from "tuistory";
-
-const session = await launchTerminal({
-	command: "bun",
-	args: ["src/index.ts", "--provider", "anthropic", "-k", "test-key"],
-	cwd: cliRoot,
-	env: isolatedEnv, // see createCliEnv() in the reference test
-	cols: 120,
-	rows: 36,
-	waitForDataTimeout: 30_000, // CLI cold start compiles a large TS graph
-});
-
-await session.waitForText("What can I do for you?", { timeout: 30_000 });
-const screen = await session.text({ trimEnd: true }); // emulated screen state
-await session.type("/settings");
-await session.press("enter");
-session.close(); // always close in test teardown
-```
-
-Screen-state assertions can check that stale UI is *gone* (`expect(screen).not.toContain(...)`), which stream-grepping harnesses cannot. `session.text({ only: { bold: true } })` filters by style; `session.read()` returns the raw stream since the last read.

.clinerules/bun-and-node.md

@@ -1,55 +0,0 @@
-# Bun (tooling) and Node (runtime)
-
-This repo uses **bun** for package management and task running, and **Node** as
-the execution runtime. Both are correct at the same time; the distinction is the
-source of most confusion, so keep it straight before editing scripts, configs,
-docs, or comments.
-
-## Use bun for tooling
-
-- `bun install` (never `npm install` / `npm ci`)
-- `bun run <script>` (never `npm run <script>`)
-- `bunx <bin>` (never `npx <bin>`)
-- `bun <file>.ts` to run a TS entrypoint directly (no `ts-node` / `tsx`)
-- `bun esbuild.mjs` to drive the build (esbuild/vite are still the bundlers)
-- `bun run --parallel ...` for parallel tasks
-
-The root `bun.lock` is the single lockfile for the whole workspace, including
-`apps/vscode`, `webview-ui`, and `testing-platform`. There are no per-package npm
-lockfiles.
-
-## Node is the runtime — do NOT rewrite these to bun
-
-The build product runs on Node: the VS Code extension host loads
-`dist/extension.js` as CommonJS under Node, and the standalone `cline-core` is a
-Node process. The following are Node runtime/ABI references and are correct as-is:
-
-| Reference | Why it is Node |
-|-----------|----------------|
-| esbuild `platform: "node"` / `target: "node..."` | The bundle targets the Node runtime (extension host, standalone core). |
-| `TARGET_NODE_VERSION` (`scripts/package-standalone.mjs`) | Pins the Node ABI of the bundled standalone runtime (matches the JetBrains-packaged Node). |
-| `prebuild-install --target=<node version>` | Downloads native `.node` binaries for that Node ABI. |
-| `NODE_PATH=... node cline-core.js` | The standalone core is launched by Node, not bun. |
-| `node:` import specifiers (e.g. `node:fs`) | Node builtin module scheme; unrelated to tooling. |
-| `process.versions.node`, `engines.node`, `@types/node` | Runtime version probe / declared runtime / its types. |
-| `ELECTRON_RUN_AS_NODE` | VS Code/Electron runs the extension host as Node. |
-
-When a file legitimately uses both bun and node (e.g. `package-standalone.mjs`
-does `bun install` but `prebuild-install --target=<node>`), the `node` token is
-the runtime/ABI target, not tooling. If unsure, leave it.
-
-## Tests: bun vs the VS Code host
-
-A test file's runner is decided by its import:
-
-- **`import ... from "bun:test"`** → runs under `bun test` (the node-side unit
-  suites + the SDK/model-catalog suites). `scripts/run-bun-unit-tests.ts`
-  discovers these by the `bun:test` import and runs one isolated bun process per
-  file. `build-tests.js` excludes them from the integration compile so the
-  `bun:test` builtin never reaches Node.
-- **`import ... from "mocha"`** → runs under `@vscode/test-cli` in a real VS Code
-  extension host (Node). These exercise the live `vscode` API and cannot run
-  under bun.
-
-So a file imports `bun:test` XOR `mocha`. Don't add `bun:test` to a test that
-needs the real extension host.

.clinerules/cli.md

@@ -0,0 +1,33 @@
+# CLI Development
+
+The CLI lives in `cli/` and uses React Ink for terminal UI.
+
+- If needed, look at `cli/src/constants/colors.ts` for re-used terminal colors, e.g. `COLORS.primaryBlue` highlight color (selections, spinners, success states).
+- Never use `dimColor` with gray (e.g. `<Text color="gray" dimColor>`) - it's too hard to read. Use `color="gray"` for secondary text and normal foreground (no color) for primary text.
+- When thinking about how to handle state or messages from core, look at webview for how it communicates with the vs code extension.
+- When updating the webview, consider and suggest to the user to update the CLI TUI since we want to provide a similar experience to our terminal users as we do our vs code extension users.
+
+## Adding New API Providers
+
+When adding a new API provider to the extension, you must also update the CLI:
+
+1. **Update `cli/src/components/ModelPicker.tsx`**: Add the provider to the `providerModels` map so `getDefaultModelId()` returns the correct default model. Import the models and default ID from `@shared/api`:
+   ```typescript
+   import { newProviderDefaultModelId, newProviderModels } from "@/shared/api"
+
+   export const providerModels = {
+     // ...existing providers
+     "new-provider": { models: newProviderModels, defaultId: newProviderDefaultModelId },
+   }
+   ```
+
+2. **Use `applyProviderConfig()` for auth flows**: When implementing OAuth or other auth flows for the provider, use the shared utility at `cli/src/utils/provider-config.ts`:
+   ```typescript
+   import { applyProviderConfig } from "../utils/provider-config"
+
+   // After successful auth:
+   await applyProviderConfig({ providerId: "new-provider", controller })
+   ```
+   This handles setting provider, default model, API key mapping, state persistence, and rebuilding the API handler.
+
+3. **Provider-specific auth**: If the provider uses OAuth (like `openai-codex`), add handling in `SettingsPanelContent.tsx`'s `handleProviderSelect` callback. See the existing Codex OAuth flow as a reference.

.clinerules/debug-harness.md

@@ -1,129 +0,0 @@
-# Debug Harness
-
-HTTP-controlled debugger for the VSCode extension at `src/dev/debug-harness/server.ts`.
-
-## Quick start
-
-```bash
-# Build extension first if needed (protos + esbuild):
-bun run protos && IS_DEV=true bun esbuild.mjs
-
-# Launch (skip-build if already built). Run with node, NOT bun — Playwright's
-# Electron launch times out under bun:
-node src/dev/debug-harness/server.ts --skip-build --auto-launch
-
-# In another terminal:
-curl localhost:19229/api -d '{"method":"status"}'
-```
-
-## Data Isolation
-
-The debugee runs with `CLINE_DIR=~/.cline2` by default, separate from your real `~/.cline`.
-This prevents the debugee's logout from logging out the debugger, and vice versa.
-Override with `--cline-dir /tmp/test-dir`. Check with `status()` → `clineDir`.
-
-## Browser Capture & OAuth
-
-The debugee runs with `CLINE_CAPTURE_BROWSER=1`, which intercepts `openExternal()` in
-`src/utils/env.ts`. URLs are captured instead of opening a real browser:
-
-- Logged to `$CLINE_DIR/data/debug-captured-urls.jsonl`
-- POSTed in real-time to `/captured-url` on the harness server
-- Queryable via `oauth.captured_urls`
-
-### OAuth API
-
-- **`oauth.captured_urls`** `{clear?}` — URLs the debugee tried to open
-- **`oauth.read_stored_token`** — Check auth token presence in secrets.json
-- **`oauth.simulate_callback`** `{path, code?, state?, provider?, token?}` — Build vscode:// callback URI
-- **`oauth.read_captured_urls_file`** — Read on-disk JSONL of captured URLs
-
-### OAuth testing flow
-
-For **Cline OAuth** (SDK local callback): The SDK starts a local HTTP server, the auth URL
-is captured. To complete: open the captured URL in a real browser (it redirects back to the
-SDK's callback server), OR extract the callback port and `curl http://127.0.0.1:PORT/callback?code=...`.
-
-For **MCP/Provider OAuth** (vscode:// URI): The redirect goes to a vscode:// URI.
-`oauth.simulate_callback` only *builds* the URI — it does not deliver it, and the ESM
-extension host can't `require()` the handler. To actually deliver the callback, call the
-debug-only hook via `ext.evaluate` (with `awaitPromise: true`):
-`globalThis.__clineHandleUri("vscode://saoudrizwan.claude-dev/...?code=...&state=...")`.
-It runs the same `SharedUriHandler.handleUri` as VSCode's real URI handler and exists only
-when `CLINE_CAPTURE_BROWSER` is set (the harness always sets it; never ships in prod).
-For end-to-end MCP OAuth, get a real `code` from the local MCP OAuth test server
-(`bun run dev:mcp-oauth-test-server`).
-
-## Navigating Views — Use Commands, Not Clicks
-
-Don't try to find/click small sidebar icons. Use VSCode commands via command palette.
-Registered in `src/registry.ts`:
-
-| Command | View |
-|---------|------|
-| `cline.accountButtonClicked` | Account / sign-in |
-| `cline.historyButtonClicked` | Task history |
-| `cline.settingsButtonClicked` | Settings |
-| `cline.mcpButtonClicked` | MCP servers |
-| `cline.plusButtonClicked` | New task (chat) |
-| `cline.worktreesButtonClicked` | Worktrees |
-
-```bash
-curl localhost:19229/api -d '{"method":"ui.command_palette","params":{"command":"cline.accountButtonClicked"}}'
-```
-
-## Key commands
-
-All via `POST localhost:19229/api` with `{"method":"...", "params":{...}}`:
-
-- **`launch`** / **`shutdown`** — lifecycle
-- **`ui.screenshot`** — screenshot to `/tmp/cline-debug/`; returns `{path}` — **use `read_file` on the path to examine, do NOT `open` the file** (Preview.app covers the VSCode window)
-- **`ui.open_sidebar`** — open the Cline sidebar
-- **`ext.set_breakpoint`** `{file, line, condition?}` — breakpoint by source file (sourcemap-resolved)
-- **`ext.evaluate`** `{expression, callFrameId?}` — eval in extension host
-- **`ext.resume`** / **`ext.step_over`** / **`ext.step_into`** — stepping
-- **`ext.call_stack`** — inspect when paused
-- **`web.evaluate`** `{expression}` — eval in webview
-- **`web.post_message`** `{message}` — send postMessage to extension host via exposed vsCodeApi
-- **`wait_for_pause`** `{timeout?}` — block until breakpoint hit
-- **`ui.locator`** `{role?, testId?, text?, frame?}` — Playwright locator (auto-retries on stale sidebar frame)
-- **`ui.react_input`** `{text, selector?, clear?, submit?}` — set React textarea value via `execCommand('insertText')`; works reliably across multiple tasks
-- **`ui.send_message`** `{text, images?, files?, responseType?}` — send chat message bypassing the textarea entirely (via gRPC postMessage)
-- **`ui.command_palette`** `{command}` — run VSCode command
-
-## Typical Session
-
-```bash
-# 1. Launch
-curl localhost:19229/api -d '{"method":"launch","params":{"skipBuild":true}}'
-
-# 2. Open sidebar + dismiss overlays (ALWAYS do this first)
-curl localhost:19229/api -d '{"method":"ui.open_sidebar"}'
-curl localhost:19229/api -d '{"method":"web.evaluate","params":{"expression":"document.querySelectorAll(\".sr-only\").forEach(el => el.parentElement?.click())"}}'
-
-# 3. Navigate to view
-curl localhost:19229/api -d '{"method":"ui.command_palette","params":{"command":"cline.accountButtonClicked"}}'
-
-# 4. Check captured OAuth URLs if testing auth
-curl localhost:19229/api -d '{"method":"oauth.captured_urls"}'
-
-# 5. Verify
-curl localhost:19229/api -d '{"method":"ui.screenshot"}'
-```
-
-## Caveats
-
-- **⚠️ Dismiss promotional overlays FIRST**: On fresh launches, full-screen promo overlays block the sidebar. **Dismiss immediately after `ui.open_sidebar`**, before any other interaction or screenshot. May need to run twice:
-  ```bash
-  curl localhost:19229/api -d '{"method": "ui.open_sidebar"}'
-  curl localhost:19229/api -d '{"method": "web.evaluate", "params": {"expression": "document.querySelectorAll(\".sr-only\").forEach(el => el.parentElement?.click())"}}'
-  ```
-- **Screenshots — don't open the file**: `ui.screenshot` and `ui.sidebar_screenshot` save PNGs to `/tmp/cline-debug/` and return the `{path}`. Use `read_file` on that path to examine screenshots. Running `open <path>` launches Preview.app on macOS which covers the VSCode window.
-- **Scripts count = 0 after launch**: CDP connects after extension host starts, so scripts parsed during startup aren't tracked. Breakpoints still work via sourcemap resolution.
-- **Port 9230**: Extension host inspector. If another VSCode instance uses this port, the harness will fail to connect. Kill other debug instances first.
-- **macOS only** for now (Playwright Electron launch behavior).
-- **Webview CDP**: `connect_webview` may fail depending on Electron version. `web.evaluate` still works via Playwright's `frame.evaluate()` fallback.
-- **Sourcemap paths**: esbuild outputs relative paths like `../src/extension.ts` in the sourcemap. The resolver handles this, but if a file isn't found, use `ext.source_files` to see exact paths.
-- **OAuth with fake codes**: Browser capture intercepts the URL but doesn't provide a valid auth code. For real OAuth testing, open the captured URL in a browser. For unit testing, mock the token exchange.
-
-See `src/dev/debug-harness/README.md` for full API reference.

.clinerules/general.md

@@ -13,57 +13,11 @@ This file is the secret sauce for working effectively in this codebase. It captu
 **What NOT to add:** Stuff you can figure out from reading a few files, obvious patterns, or standard practices. This file should be high-signal, not comprehensive.
 
 ## Miscellaneous
-- The whole repo (including `apps/vscode`) uses **bun** for package management and task running. Emit `bun run X` / `bun install` / `bunx <bin>` / `bun file.ts`, never npm/npx. Node remains the *runtime* (VS Code's extension host and the standalone cline-core are Node), so Node-runtime tokens are legitimate and must not be "fixed" to bun — see @.clinerules/bun-and-node.md for the keep-list vs rewrite-list.
-- Avoid provider-specific string matching / hardcoded provider branches when fixing provider/config plumbing. Prefer provider metadata, shared catalog/defaults, explicit protocol/client capabilities, or centralized normalization utilities that apply by data shape rather than `providerId === "..."`. If a provider exception seems necessary, stop and explain why instead of adding ad-hoc string matching.
-- This is a VS Code extension—check `package.json` for available scripts before trying to verify builds (e.g., `bun run compile`, not `bun run build`).
-- When reading a configuration files that users may edit, use `readFileStrippingUtf8Bom`, `readFileSyncStrippingUtf8Bom`, or `stripUtf8Bom` from `@cline/shared/node`. DON'T strip byte order marks of user files handled by tools/passed to models.
+- This is a VS Code extension—check `package.json` for available scripts before trying to verify builds (e.g., `npm run compile`, not `npm run build`).
 - When creating PRs, contributors should not create changelog-entry files. Maintainers handle release versioning and changelog curation during the release process.
 - When adding new feature flags, see this PR as a reference https://github.com/cline/cline/pull/7566
 - Additional instructions about making requests: @.clinerules/network.md
 
-## Searching the Codebase — Avoiding Build Output
-
-Several directories contain build output or generated code that produces
-noisy or unusable results with `search_files` / `grep`:
-
-| Directory | What it is | Why it's a problem |
-|-----------|-----------|-------------------|
-| `out/` | esbuild bundle output | Mirrors `src/` structure as minified JS — every search gets duplicate hits on single-line files |
-| `dist/` | Packaged extension | Entire extension bundled into one minified `extension.js` (~1 long line) |
-| `dist-standalone/` | Standalone build output | Same minification issue |
-| `src/generated/` | Generated protobuf code | Auto-generated from `proto/`; not the source of truth |
-| `src/shared/proto/` | Generated proto type defs | Auto-generated from `proto/`; not the source of truth |
-| `node_modules/` | Dependencies | Huge, not project source |
-
-### How to skip build output
-
-**`search_files`** — Point at `src/` (not the project root) and use `file_pattern`:
-```
-search_files(path="src/core", regex="myFunction", file_pattern="*.ts")
-```
-The `file_pattern` parameter is the most effective filter — e.g. `"*.ts"`,
-`"*.tsx"`, `"*.proto"`.
-
-**`grep` directly** — Exclude build dirs and restrict to source extensions:
-```bash
-grep -rn "myFunction" src/ --include="*.ts" --exclude-dir={out,dist,node_modules,generated}
-```
-
-### When you must search minified files
-
-Sometimes you need to verify what got bundled (e.g., checking if a change
-made it into the build). Minified files are typically one long line, so
-normal `grep` shows the entire file as context. Use these approaches:
-
-- **`grep -oP`** to extract just the match with limited surrounding context:
-  ```bash
-  grep -oP '.{0,40}myFunction.{0,40}' dist/extension.js
-  ```
-- **`read_file`** on files in `out/src/` — these have source maps and are
-  more readable than `dist/extension.js` (which is the fully bundled output).
-- **Source maps** — `out/src/*.js.map` and `dist/extension.js.map` can be
-  used to trace minified output back to original source locations.
-
 ## gRPC/Protobuf Communication
 The extension and webview communicate via gRPC-like protocol over VS Code message passing.
 
@@ -74,7 +28,7 @@ The extension and webview communicate via gRPC-like protocol over VS Code messag
 - Naming: Services `PascalCaseService`, RPCs `camelCase`, Messages `PascalCase`
 - For streaming responses, use `stream` keyword (see `subscribeToAuthCallback` in `account.proto`)
 
-**Run `bun run protos`** after any proto changes—generates types in:
+**Run `npm run protos`** after any proto changes—generates types in:
 - `src/shared/proto/` - Shared type definitions
 - `src/generated/grpc-js/` - Service implementations
 - `src/generated/nice-grpc/` - Promise-based clients
@@ -94,15 +48,104 @@ The extension and webview communicate via gRPC-like protocol over VS Code messag
 - `src/core/controller/task/explainChanges.ts` - Handler implementation
 - `webview-ui/src/components/chat/ChatRow.tsx` - UI rendering
 
+## Adding a New API Provider
+When adding a new provider (e.g., "openai-codex"), you must update the proto conversion layer in THREE places or the provider will silently reset to Anthropic:
+
+1. `proto/cline/models.proto` - Add to the `ApiProvider` enum (e.g., `OPENAI_CODEX = 40;`)
+2. `convertApiProviderToProto()` in `src/shared/proto-conversions/models/api-configuration-conversion.ts` - Add case mapping string to proto enum
+3. `convertProtoToApiProvider()` in the same file - Add case mapping proto enum back to string
+
+**Why this matters:** Without these, the provider string hits the `default` case and returns `ANTHROPIC`. The webview, provider list, and handler all work fine, but the state silently resets when it round-trips through proto serialization. No error is thrown.
+
+**Other files to update when adding a provider:**
+- `src/shared/api.ts` - Add to `ApiProvider` union type, define models
+- `src/shared/providers/providers.json` - Add to provider list for dropdown
+- `src/core/api/index.ts` - Register handler in `createHandlerForProvider()`
+- `webview-ui/src/components/settings/utils/providerUtils.ts` - Add cases in `getModelsForProvider()` and `normalizeApiConfiguration()`
+- `webview-ui/src/utils/validate.ts` - Add validation case
+- `webview-ui/src/components/settings/ApiOptions.tsx` - Render provider component
+
+## Responses API Providers (OpenAI Codex, OpenAI Native)
+Providers using OpenAI's Responses API require native tool calling. XML tools don't work with the Responses API.
+
+**Symptoms of broken native tool calling:**
+- Tools get called multiple times (e.g., `ask_followup_question` asks the same question twice)
+- Tool arguments get duplicated or malformed
+- The model responds but tools aren't recognized
+
+**Root causes to check:**
+1. **Provider missing from `isNextGenModelProvider()`** in `src/utils/model-utils.ts`. The native variant matchers (e.g., `native-gpt-5/config.ts`) call this function. If your provider isn't in the list, the matcher returns false and falls back to XML tools.
+
+2. **Model missing `apiFormat: ApiFormat.OPENAI_RESPONSES`** in its model info (`src/shared/api.ts`). This property signals that the model requires native tool calling. The task runner in `src/core/task/index.ts` checks this and forces `enableNativeToolCalls: true` regardless of user settings.
+
+**When adding a new Responses API provider:**
+1. Add provider to `isNextGenModelProvider()` list in `src/utils/model-utils.ts`
+2. Set `apiFormat: ApiFormat.OPENAI_RESPONSES` on all models that use the Responses API
+3. The variant matcher and task runner will handle the rest automatically
+
+## Adding Tools to System Prompt
+This is tricky—multiple prompt variants and configs. **Always search for existing similar tools first and follow their pattern.** Look at the full chain from prompt definition → variant configs → handler → UI before implementing.
+
+1. **Add to `ClineDefaultTool` enum** in `src/shared/tools.ts`
+2. **Tool definition** in `src/core/prompts/system-prompt/tools/` (create file like `generate_explanation.ts`)
+   - Define variants for each `ModelFamily` (generic, next-gen, xs, etc.)
+   - Export variants array (e.g., `export const my_tool_variants = [GENERIC, NATIVE_NEXT_GEN, XS]`)
+   - **Fallback behavior**: If a variant isn't defined for a model family, `ClineToolSet.getToolByNameWithFallback()` automatically falls back to GENERIC. So you only need to export `[GENERIC]` unless the tool needs model-specific behavior.
+3. **Register in `src/core/prompts/system-prompt/tools/init.ts`** - Import and spread into `allToolVariants`
+4. **Add to variant configs** - Each model family has its own config in `src/core/prompts/system-prompt/variants/*/config.ts`. Add your tool's enum to the `.tools()` list:
+   - `generic/config.ts`, `next-gen/config.ts`, `gpt-5/config.ts`, `native-gpt-5/config.ts`, `native-gpt-5-1/config.ts`, `native-next-gen/config.ts`, `gemini-3/config.ts`, `glm/config.ts`, `hermes/config.ts`, `xs/config.ts`
+   - **Important**: If you add to a variant's config, make sure the tool spec exports a variant for that ModelFamily (or relies on GENERIC fallback)
+5. **Create handler** in `src/core/task/tools/handlers/`
+6. **Wire up in `ToolExecutor.ts`** if needed for execution flow
+7. **Add to tool parsing** in `src/core/assistant-message/index.ts` if needed
+8. **If tool has UI feedback**: add `ClineSay` enum in proto, update `src/shared/ExtensionMessage.ts`, update `src/shared/proto-conversions/cline-message.ts`, update `webview-ui/src/components/chat/ChatRow.tsx`
+
+## Modifying System Prompt
+**Read these first:** `src/core/prompts/system-prompt/README.md`, `tools/README.md`, `__tests__/README.md`
+
+System prompt is modular: **components** (reusable sections) + **variants** (model-specific configs) + **templates** (with `{{PLACEHOLDER}}` resolution).
+
+**Key directories:**
+- `components/` - Shared sections: `rules.ts`, `capabilities.ts`, `editing_files.ts`, etc.
+- `variants/` - Model-specific: `generic/`, `next-gen/`, `xs/`, `gpt-5/`, `gemini-3/`, `hermes/`, `glm/`, etc.
+- `templates/` - Template engine and placeholder definitions
+
+**Variant tiers (ask user which to modify):**
+- **Next-gen** (Claude 4, GPT-5, Gemini 2.5): `next-gen/`, `native-next-gen/`, `native-gpt-5/`, `native-gpt-5-1/`, `gemini-3/`, `gpt-5/`
+- **Standard** (default fallback): `generic/`
+- **Local/small models**: `xs/`, `hermes/`, `glm/`
+
+**How overrides work:** Variants can override components via `componentOverrides` in their `config.ts`, or provide a custom template in `template.ts` (e.g., `next-gen/template.ts` exports `rules_template`). If no override, the shared component from `components/` is used.
+
+**Example: Adding a rule to RULES section**
+1. Check if variant overrides rules: look for `rules_template` in `variants/*/template.ts` or `componentOverrides.RULES` in `config.ts`
+2. If shared: modify `components/rules.ts`
+3. If overridden: modify that variant's template
+4. XS variant is special—has heavily condensed inline content in `template.ts`
+
+**After any changes, regenerate snapshots:**
+```bash
+UPDATE_SNAPSHOTS=true npm run test:unit
+```
+Snapshots live in `__tests__/__snapshots__/`. Tests validate across model families and context variations (browser, MCP, focus chain).
+
+## Modifying Default Slash Commands
+Three places need updates:
+- `src/core/slash-commands/index.ts` - Command definitions
+- `src/core/prompts/commands.ts` - System prompt integration
+- `webview-ui/src/utils/slash-commands.ts` - Webview autocomplete
+
 ## Adding New Global State Keys
 Adding a new key to global state requires updates in multiple places. Missing any step causes silent failures.
 
 Required steps:
 1. Type definition in `src/shared/storage/state-keys.ts` - Add to `GlobalState` or `Settings` interface
-2. Add any default value or transform in `src/shared/storage/state-keys.ts` if the key needs one
-3. Read and write the value through `StateManager` (`setGlobalState()` / `getGlobalStateKey()`) after initialization
+2. Read from globalState in `src/core/storage/utils/state-helpers.ts`:
+   - Add `const myKey = context.globalState.get<GlobalStateAndSettings["myKey"]>("myKey")` in `readGlobalStateFromDisk()`
+   - Add to the return object: `myKey: myKey ?? defaultValue,`
+3. StateManager handles read/write via `setGlobalState()`/`getGlobalStateKey()` after initialization
 
-Persistent state is file-backed through `StateManager`; do not add new runtime reads or writes against VS Code `ExtensionContext` storage. That storage is only a legacy migration source.
+Common mistake: Adding only the return value without the `context.globalState.get()` call. This compiles but the value is always `undefined` on load.
 
 Settings plumbing gotcha: if a key is user-toggleable from settings, wire both controller update paths:
 - `src/core/controller/state/updateSettings.ts` for webview `updateSetting(...)`
@@ -110,26 +153,28 @@ Settings plumbing gotcha: if a key is user-toggleable from settings, wire both c
 Missing one path causes a toggle to appear to change in one surface while the backend state stays unchanged.
 
 Webview toggle gotcha: settings changes must also round-trip back in state payloads.
-- Add the field to `UpdateSettingsRequest` in `proto/cline/state.proto` (for webview update requests), then run `bun run protos`
+- Add the field to `UpdateSettingsRequest` in `proto/cline/state.proto` (for webview update requests), then run `npm run protos`
 - Include the key in `Controller.getStateToPostToWebview()` (`src/core/controller/index.ts`)
 - Ensure `ExtensionState` and webview defaults include the key (`src/shared/ExtensionMessage.ts`, `webview-ui/src/context/ExtensionStateContext.tsx`)
 If this round-trip wiring is missing, the backend value can update but the toggle in webview appears stuck or reverts.
 
 ## StateManager Cache vs Direct globalState Access
-StateManager uses an in-memory cache populated during `StateManager.initialize()` from file-backed storage. For most state, use `controller.stateManager.setGlobalState()`/`getGlobalStateKey()`.
+StateManager uses an in-memory cache populated during `StateManager.initialize(context)` in `common.ts`. For most state, use `controller.stateManager.setGlobalState()`/`getGlobalStateKey()`.
 
-Exception: host migration code may read legacy VS Code storage before file-backed storage is initialized.
+Exception: State needed immediately at extension startup (before cache is ready)
 
-Example pattern:
+When Window A sets state and immediately opens Window B, the new window's StateManager cache is populated from `context.globalState` during initialization. If you need to read state in Window B right at startup (e.g., in `common.ts` during `initialize()`), read directly from `context.globalState.get()` instead of StateManager's cache.
+
+Example pattern (see `lastShownAnnouncementId` and `worktreeAutoOpenPath`):
 ```typescript
 // Writing (normal pattern)
 controller.stateManager.setGlobalState("myKey", value)
 
-// Reading after initialization
-const value = controller.stateManager.getGlobalStateKey("myKey")
+// Reading at startup in common.ts (bypass cache)
+const value = context.globalState.get<string>("myKey")
 ```
 
-Use `context.globalState` only in VS Code migration code that copies legacy ExtensionContext values into the shared file-backed stores.
+This is only needed for cross-window state read during the brief startup window before StateManager cache is fully usable. Normal state access after initialization should use StateManager.
 
 ## ChatRow Cancelled/Interrupted States
 When a ChatRow displays a loading/in-progress state (spinner), you must handle what happens when the task is cancelled. This is non-obvious because cancellation doesn't update the message content—you have to infer it from context.
@@ -158,48 +203,3 @@ const isGenerating = explanationInfo.status === "generating" && !wasCancelled
 **See also:** `BrowserSessionRow.tsx` uses similar pattern with `isLastApiReqInterrupted` and `isLastMessageResume`.
 
 **Backend side:** When streaming is cancelled, clean up properly (close tabs, clear comments, etc.) by checking `taskState.abort` after the streaming function returns.
-
-## Debug Harness: clear inherited VSCode/Electron env vars before launching
-
-The debug harness (`apps/vscode/src/dev/debug-harness/server.ts`) launches a child
-VSCode via Playwright's `_electron.launch({ env: { ...process.env, ... } })`. If you
-run the harness from a process that was itself spawned by VSCode (e.g. the Cline
-extension host, an integrated terminal, or an agent running inside VSCode), the
-parent's VSCode/Electron env vars leak into the child and break the launch.
-
-The fatal one is **`ELECTRON_RUN_AS_NODE=1`**: it makes the child VSCode binary run
-as plain Node, so it rejects every VSCode CLI flag. Symptom:
-
-```
-.../Visual Studio Code.app/Contents/MacOS/Code: bad option: --extensionDevelopmentPath=...
-Error: Process failed to launch!   (Playwright _electron.launch)
-```
-
-This is NOT the macOS Playwright flakiness mentioned in the harness README — it's
-env inheritance. Fix: strip the inherited vars before starting the harness:
-
-```bash
-env -u ELECTRON_RUN_AS_NODE -u ELECTRON_NO_ATTACH_CONSOLE \
-    -u VSCODE_CLI -u VSCODE_CODE_CACHE_PATH -u VSCODE_CRASH_REPORTER_PROCESS_TYPE \
-    -u VSCODE_CWD -u VSCODE_ESM_ENTRYPOINT -u VSCODE_HANDLES_UNCAUGHT_ERRORS \
-    -u VSCODE_IPC_HOOK -u VSCODE_NLS_CONFIG -u VSCODE_PID -u VSCODE_L10N_BUNDLE_LOCATION \
-    bun src/dev/debug-harness/server.ts --auto-launch --skip-build
-```
-
-Check your own env with `env | grep -iE 'electron|vscode_'` first; `ELECTRON_RUN_AS_NODE=1`
-present means you must scrub before launching.
-
-Other harness notes confirmed in practice:
-- The extension host is **ESM** (`VSCODE_ESM_ENTRYPOINT`), so `ext.evaluate` has no
-  `require` and module-internal functions aren't reachable as globals. To inspect
-  internal builders (e.g. `buildBedrockProviderConfig`), set a breakpoint with
-  `ext.set_breakpoint` and read locals via `ext.evaluate` with the paused `callFrameId`
-  — don't try to `require()` the bundle.
-- `web.evaluate` wraps the expression as a single returned expression; multi-statement
-  snippets must be an IIFE `(() => { ...; return x; })()`, otherwise you get
-  `SyntaxError: Unexpected token ';'`.
-- Webview settings inputs are `vscode-text-field` web components with debounced React
-  onChange. Setting `.value` + dispatching events via `web.evaluate` is unreliable for
-  some fields; focus the inner shadow `input` then use real keystrokes (`ui.type` +
-  `ui.press Tab`, or click the dropdown option) to make the value persist.
-

.clinerules/protobuf-development.md

@@ -42,7 +42,7 @@ Here, we use the common `StringRequest` and `KeyValuePair` types.
 
 After editing a `.proto` file, regenerate the TypeScript code. From the project root, run:
 ```bash
-bun run protos
+npm run protos
 ```
 This command compiles all `.proto` files and outputs the generated code to `src/generated/` and `src/shared/`. Do not edit these generated files manually.
 

.clinerules/sdk-migration.md

@@ -1,26 +0,0 @@
-# SDK Adapter
-
-The VSCode extension runs on the Cline SDK (`@cline/core`, `@cline/llms`,
-`@cline/shared`) through an adapter layer in `apps/vscode/src/sdk/`. The
-webview still talks gRPC; the adapter translates between gRPC handlers and SDK
-calls. See `apps/vscode/src/dev/debug-harness/README.md` for the debug harness.
-
-## Conventions
-
-1. **Look up SDK APIs, don't guess.** Use `kb_search(name="sdk", query="...")`
-   before implementing against an SDK surface.
-2. **Reference the pre-SDK implementation when replacing a module.** Add a
-   `// Replaces classic src/core/... (see origin/main)` header and use
-   `kb_search(name="cline", commit="origin/main")` or
-   `git show origin/main:path` to consult the prior implementation.
-3. **Single entry point.** There is one codepath — the SDK adapter. No
-   `CLINE_SDK` env flag.
-4. **Use `{appBaseUrl}`**, never hardcode `app.cline.bot`.
-5. **Avoid `as` casts.** Use explicit conversion functions with tests. The
-   branded types in `apps/vscode/src/sdk/model-catalog/contracts.ts` exist so
-   casts are unnecessary outside parse/compute boundaries.
-
-## Debug harness
-
-- **Dismiss the Kanban/promo overlay** before any debug harness interaction.
-- **Use the command palette** to navigate tabs in the debug harness.

.clinerules/workflows/hotfix-release.md

@@ -91,7 +91,7 @@ On the main branch, create a commit that updates:
 
 3. No changelog-entry file cleanup is needed. Contributors do not create changelog-entry files in this repo.
 
-**No dependency install is needed.** A CHANGELOG + `version` bump does not change any dependency, and `bun.lock` does not pin workspace-package versions, so the lockfile stays consistent. The publish workflow runs `bun install --frozen-lockfile`, which would *fail* on an out-of-sync lock — so only run `bun install` here if you actually change dependencies (then commit the updated `bun.lock`).
+**Skip running `npm run install:all`** - release automation handles lockfile consistency as needed.
 
 Commit with message format: `v{VERSION} Release Notes (hotfix)`
 
@@ -176,7 +176,7 @@ Present a final summary:
 - Slack message copied to clipboard: yes
 
 Remind the user to:
-1. Manually trigger the publish release GitHub Action at: https://github.com/cline/cline/actions/workflows/ext-vscode-publish-stable.yml (paste `v{VERSION}` as the tag)
+1. Manually trigger the publish release GitHub Action at: https://github.com/cline/cline/actions/workflows/publish.yml (paste `v{VERSION}` as the tag)
 2. Post the Slack message to announce the hotfix
 
 ## Important Notes

.clinerules/workflows/release.md

@@ -43,7 +43,7 @@ git push origin v<version>
 ### 4) Trigger publish workflow
 
 Tell the maintainer to run:
-https://github.com/cline/cline/actions/workflows/ext-vscode-publish-stable.yml
+https://github.com/cline/cline/actions/workflows/publish.yml
 
 Use `v<version>` as the release tag.
 

.codex/environments/environment.toml

@@ -20,9 +20,8 @@ command = "chmod +x ./scripts/run-extension-host.sh && ./scripts/run-extension-h
 name = "CLI"
 icon = "run"
 command = '''
-cd sdk
-bun install
-bun run cli
+npm run cli:build
+npm run cli:run
 '''
 
 [[actions]]

.gitattributes

@@ -1,4 +1,6 @@
 demo.gif filter=lfs diff=lfs merge=lfs -text
 assets/docs/demo.gif filter=lfs diff=lfs merge=lfs -text
+webview-ui/src/assets/cline_kanban_demo.mp4 filter=lfs diff=lfs merge=lfs -text
+webview-ui/src/assets/cline_kanban_demo.webm filter=lfs diff=lfs merge=lfs -text
 
 * text=auto eol=lf

.github/CODEOWNERS

@@ -1,2 +1,2 @@
-/.github/   @saoudrizwan @arafatkatze @maxpaulus43 @dominiccooney
+/.github/   @saoudrizwan @arafatkatze @maxpaulus43 @candieduniverse
 /README.md  @saoudrizwan @juanpflores

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -7,16 +7,14 @@ body:
       value: |
         **Important:** All bug reports must be reproducible using Claude Sonnet 4.5. Cline uses complex prompts so less capable models may not work as expected.
   - type: dropdown
-    id: cline-surface
+    id: plugin-type
     attributes:
-      label: Cline Surface
-      description: Which Cline surface are you reporting a bug for?
+      label: Plugin Type
+      description: Which plugin are you reporting a bug for?
       options:
         - VSCode Extension
         - JetBrains Plugin
         - CLI
-        - Desktop App
-        - Cloud Platform
       default: 0
     validations:
       required: true
@@ -61,20 +59,6 @@ body:
       placeholder: 'e.g., cline:anthropic/claude-sonnet-4.5, gemini:gemini-2.5-pro-exp-03-25'
     validations:
       required: false
-  - type: textarea
-    id: ide-diagnostics
-    attributes:
-      label: Diagnostics
-      description: |
-        Paste the diagnostics for your Cline surface. This captures the build, runtime, and host details we need.
-        - VSCode Extension: open `Help → About` (Windows/Linux) or `Code → About Visual Studio Code` (macOS), then copy the info.
-        - JetBrains Plugin: open `Help → About` (Windows/Linux) or `<IDE name> → About` (macOS), then click `Copy` to grab build, runtime, OS, memory, and cores.
-        - CLI: there is no About dialog. Run `cline --version` and paste the output.
-        - Desktop App: paste the app version from the Settings view.
-        - Cloud Platform: paste your browser name and version, plus the page URL where the issue occurred.
-      placeholder: Paste the copied About info, `cline --version` output, or browser/app details here.
-    validations:
-      required: false
   - type: textarea
     id: system-info
     attributes:

.github/actions/sign-windows-cli/action.yml

@@ -1,155 +0,0 @@
-name: Sign Windows CLI binaries
-description: >
-  Authenticode-signs the compiled Windows CLI executables with Azure Trusted
-  Signing (via jsign, so it runs on Linux runners) and verifies the resulting
-  signatures. If the Azure Trusted Signing secrets are not configured, the
-  action logs a warning and exits successfully so releases keep working while
-  signing infrastructure is being provisioned.
-
-inputs:
-  azure-client-id:
-    description: Client ID of the Entra app with the Trusted Signing Certificate Profile Signer role (OIDC federated credential, no client secret).
-    required: false
-    default: ""
-  azure-tenant-id:
-    description: Entra tenant ID.
-    required: false
-    default: ""
-  azure-subscription-id:
-    description: Azure subscription ID containing the Trusted Signing account.
-    required: false
-    default: ""
-  endpoint:
-    description: Trusted Signing account endpoint, for example https://eus.codesigning.azure.net.
-    required: false
-    default: ""
-  account:
-    description: Trusted Signing account name.
-    required: false
-    default: ""
-  certificate-profile:
-    description: Trusted Signing certificate profile name.
-    required: false
-    default: ""
-  files:
-    description: Newline-separated list of PE files to sign.
-    required: true
-
-runs:
-  using: composite
-  steps:
-    - name: Check signing configuration
-      id: check
-      shell: bash
-      env:
-        AZURE_CLIENT_ID: ${{ inputs.azure-client-id }}
-        AZURE_TENANT_ID: ${{ inputs.azure-tenant-id }}
-        AZURE_SUBSCRIPTION_ID: ${{ inputs.azure-subscription-id }}
-        SIGNING_ENDPOINT: ${{ inputs.endpoint }}
-        SIGNING_ACCOUNT: ${{ inputs.account }}
-        SIGNING_PROFILE: ${{ inputs.certificate-profile }}
-      run: |
-        missing=()
-        set_count=0
-        for var in AZURE_CLIENT_ID AZURE_TENANT_ID AZURE_SUBSCRIPTION_ID SIGNING_ENDPOINT SIGNING_ACCOUNT SIGNING_PROFILE; do
-          if [ -z "${!var}" ]; then
-            missing+=("$var")
-          else
-            set_count=$((set_count + 1))
-          fi
-        done
-
-        if [ "${#missing[@]}" -eq 0 ]; then
-          echo "Azure Trusted Signing is configured; Windows binaries will be signed."
-          echo "enabled=true" >> "$GITHUB_OUTPUT"
-        elif [ "$set_count" -eq 0 ]; then
-          echo "::warning::Azure Trusted Signing is not configured; publishing UNSIGNED Windows binaries. Set the AZURE_* and AZURE_TRUSTED_SIGNING_* repository secrets to enable signing."
-          echo "enabled=false" >> "$GITHUB_OUTPUT"
-        else
-          # Partial configuration is almost certainly a typo'd or renamed
-          # secret. Fail loudly instead of silently publishing unsigned.
-          echo "::error::Azure Trusted Signing is PARTIALLY configured; refusing to publish. Missing: ${missing[*]}"
-          exit 1
-        fi
-
-    - name: Azure login (OIDC)
-      if: steps.check.outputs.enabled == 'true'
-      uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
-      with:
-        client-id: ${{ inputs.azure-client-id }}
-        tenant-id: ${{ inputs.azure-tenant-id }}
-        subscription-id: ${{ inputs.azure-subscription-id }}
-
-    - name: Sign Windows binaries
-      if: steps.check.outputs.enabled == 'true'
-      shell: bash
-      env:
-        SIGNING_ENDPOINT: ${{ inputs.endpoint }}
-        SIGNING_ACCOUNT: ${{ inputs.account }}
-        SIGNING_PROFILE: ${{ inputs.certificate-profile }}
-        FILES: ${{ inputs.files }}
-        JSIGN_VERSION: "7.5"
-        JSIGN_SHA256: "602a51c3545a6dc4fb99bd2ea7152b26d1345916d0c93ddfbd5936cb735af91c"
-      run: |
-        set -euo pipefail
-
-        JSIGN_JAR="${RUNNER_TEMP}/jsign-${JSIGN_VERSION}.jar"
-        curl -fsSL -o "$JSIGN_JAR" "https://github.com/ebourg/jsign/releases/download/${JSIGN_VERSION}/jsign-${JSIGN_VERSION}.jar"
-        echo "${JSIGN_SHA256}  ${JSIGN_JAR}" | sha256sum --check --strict
-
-        JSIGN_STOREPASS=$(az account get-access-token --resource https://codesigning.azure.net --query accessToken --output tsv)
-        echo "::add-mask::${JSIGN_STOREPASS}"
-        export JSIGN_STOREPASS
-
-        # jsign expects the endpoint host, not the URL. Tolerate both the
-        # portal's display form (trailing slash) and the bare form.
-        KEYSTORE="${SIGNING_ENDPOINT#https://}"
-        KEYSTORE="${KEYSTORE%/}"
-
-        while IFS= read -r file; do
-          [ -z "$file" ] && continue
-          echo "Signing ${file}"
-          java -jar "$JSIGN_JAR" \
-            --storetype TRUSTEDSIGNING \
-            --keystore "$KEYSTORE" \
-            --storepass env:JSIGN_STOREPASS \
-            --alias "${SIGNING_ACCOUNT}/${SIGNING_PROFILE}" \
-            --alg SHA-256 \
-            --tsaurl http://timestamp.acs.microsoft.com \
-            --tsmode RFC3161 \
-            --replace \
-            "$file"
-        done <<< "$FILES"
-
-    - name: Verify signatures
-      if: steps.check.outputs.enabled == 'true'
-      shell: bash
-      env:
-        FILES: ${{ inputs.files }}
-        # Authenticode chains anchor to the Microsoft Identity Verification
-        # Root CA 2020, which is not in the Mozilla TLS bundle, so fetch it
-        # explicitly (pinned) for osslsigncode chain validation.
-        MS_ROOT_URL: "https://www.microsoft.com/pkiops/certs/Microsoft%20Identity%20Verification%20Root%20Certificate%20Authority%202020.crt"
-        MS_ROOT_SHA256: "5367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e1270"
-      run: |
-        set -euo pipefail
-
-        if ! command -v osslsigncode >/dev/null; then
-          sudo apt-get update -qq
-          sudo apt-get install -y -qq osslsigncode
-        fi
-
-        MS_ROOT_DER="${RUNNER_TEMP}/ms-identity-root-2020.crt"
-        MS_ROOT_PEM="${RUNNER_TEMP}/ms-identity-root-2020.pem"
-        curl -fsSL -o "$MS_ROOT_DER" "$MS_ROOT_URL"
-        echo "${MS_ROOT_SHA256}  ${MS_ROOT_DER}" | sha256sum --check --strict
-        openssl x509 -inform DER -in "$MS_ROOT_DER" -out "$MS_ROOT_PEM"
-
-        while IFS= read -r file; do
-          [ -z "$file" ] && continue
-          echo "Verifying signature on ${file}"
-          # Timestamp countersignature chain is checked separately by Windows;
-          # -ignore-timestamp only skips TSA chain validation here, not the
-          # Authenticode chain itself.
-          osslsigncode verify -in "$file" -CAfile "$MS_ROOT_PEM" -ignore-timestamp
-        done <<< "$FILES"

.github/copilot-instructions.md

@@ -5,18 +5,19 @@ This is a VS Code extension. Read `.clinerules/general.md` for tribal knowledge
 ## Architecture
 - **Core** (`src/`): `extension.ts` → `WebviewProvider` → `Controller` (single source of truth) → `Task` (agent loop).
 - **Webview** (`webview-ui/`): React/Vite app. State via `ExtensionStateContext.tsx`, synced through message passing.
+- **CLI** (`cli/`): React Ink terminal UI sharing core logic. Update CLI when changing webview features.
 - **Communication**: Protobuf-defined gRPC-like protocol over VS Code message passing. Schemas in `proto/`.
 - **MCP**: `src/services/mcp/McpHub.ts`.
 
 ## Build & Test (Critical — non-obvious commands)
-- **Build**: `bun run compile` — NOT `bun run build`.
-- **Watch**: `bun run watch` (extension + webview).
-- **Protos**: `bun run protos` — run **immediately** after any `.proto` change. Generates into `src/shared/proto/`, `src/generated/`.
-- **Tests**: `bun run test:unit`. After prompt/tool changes: `UPDATE_SNAPSHOTS=true bun run test:unit`.
+- **Build**: `npm run compile` — NOT `npm run build`.
+- **Watch**: `npm run watch` (extension + webview).
+- **Protos**: `npm run protos` — run **immediately** after any `.proto` change. Generates into `src/shared/proto/`, `src/generated/`.
+- **Tests**: `npm run test:unit`. After prompt/tool changes: `UPDATE_SNAPSHOTS=true npm run test:unit`.
 
 ## Protobuf RPC Workflow (4 steps)
 1. **Define** in `proto/cline/*.proto`. Naming: `PascalCaseService`, `camelCase` RPCs, `PascalCase` Messages. Use `common.proto` shared types for simple data.
-2. **Generate**: `bun run protos`.
+2. **Generate**: `npm run protos`.
 3. **Backend handler**: `src/core/controller/<domain>/`. 
 4. **Frontend call**: `UiServiceClient.myMethod(Request.create({...}))`.
 - Adding enums (e.g. `ClineSay`) → also update `src/shared/proto-conversions/cline-message.ts`.
@@ -27,7 +28,7 @@ Three proto conversion updates are **required** or the provider silently resets
 2. `convertApiProviderToProto()` in `src/shared/proto-conversions/models/api-configuration-conversion.ts`.
 3. `convertProtoToApiProvider()` in the same file.
 
-Also update: `src/shared/api.ts`, `src/shared/providers/providers.json`, `src/core/api/index.ts`, `webview-ui/.../providerUtils.ts`, `webview-ui/.../validate.ts`, `webview-ui/.../ApiOptions.tsx`.
+Also update: `src/shared/api.ts`, `src/shared/providers/providers.json`, `src/core/api/index.ts`, `webview-ui/.../providerUtils.ts`, `webview-ui/.../validate.ts`, `webview-ui/.../ApiOptions.tsx`, and `cli/src/components/ModelPicker.tsx`.
 
 For Responses API providers: add to `isNextGenModelProvider()` in `src/utils/model-utils.ts` and set `apiFormat: ApiFormat.OPENAI_RESPONSES` on models.
 
@@ -38,13 +39,13 @@ For Responses API providers: add to `isNextGenModelProvider()` in `src/utils/mod
 4. Whitelist in `src/core/prompts/system-prompt/variants/*/config.ts` for each model family.
 5. Handler in `src/core/task/tools/handlers/`, wire in `ToolExecutor.ts`.
 6. If tool has UI: add `ClineSay` enum in proto → `ExtensionMessage.ts` → `cline-message.ts` → `ChatRow.tsx`.
-7. Regenerate snapshots: `UPDATE_SNAPSHOTS=true bun run test:unit`.
+7. Regenerate snapshots: `UPDATE_SNAPSHOTS=true npm run test:unit`.
 
 ## Modifying System Prompt
 Modular: `components/` (shared) + `variants/` (model-specific) + `templates/` (`{{PLACEHOLDER}}`). Variants override components via `componentOverrides` in `config.ts` or custom `template.ts`. XS variant is heavily condensed inline. Always regenerate snapshots after changes.
 
 ## Global State Keys (silent failure risk)
-Adding a key requires updating the typed storage definitions in `src/shared/storage/state-keys.ts`; runtime reads and writes should go through `StateManager`, not VS Code `ExtensionContext` storage. Persistent state is file-backed so it works across VS Code, CLI, and JetBrains hosts.
+Adding a key requires: type in `src/shared/storage/state-keys.ts`, read via `context.globalState.get()` in `src/core/storage/utils/state-helpers.ts` `readGlobalStateFromDisk()`, and add to return object. Missing the `.get()` call compiles fine but value is always `undefined`.
 
 ## Slash Commands (3 places)
 - `src/core/slash-commands/index.ts` — definitions.

.github/dependabot.yml

@@ -2,7 +2,7 @@ version: 2
 updates:
     # Main extension dependencies
     - package-ecosystem: "npm"
-      directory: "/apps/vscode"
+      directory: "/"
       schedule:
           interval: "weekly"
       # Group all updates into a single PR
@@ -20,7 +20,7 @@ updates:
 
     # Webview UI dependencies
     - package-ecosystem: "npm"
-      directory: "/apps/vscode/webview-ui"
+      directory: "/webview-ui"
       schedule:
           interval: "weekly"
       groups:

.github/pull_request_template.md

@@ -59,7 +59,7 @@ We're not looking for exhaustive documentation - just evidence that you've thoug
 <!-- Put an 'x' in all boxes that apply -->
 
 -   [ ] Changes are limited to a single feature, bugfix or chore (split larger changes into separate PRs)
--   [ ] Tests are passing (`bun test`) and code is formatted and linted (`bun run format && bun run lint`)
+-   [ ] Tests are passing (`npm test`) and code is formatted and linted (`npm run format && npm run lint`)
 -   [ ] I have reviewed [contributor guidelines](https://github.com/cline/cline/blob/main/CONTRIBUTING.md)
 
 ### Screenshots

.github/workflows/cli-publish.yml

@@ -1,490 +0,0 @@
-name: cli-publish
-
-on:
-  schedule:
-    - cron: "0 12 * * *"
-  workflow_dispatch:
-    inputs:
-      publish_target:
-        description: "Which publish flow to run"
-        required: true
-        default: "main"
-        type: choice
-        options:
-          - main
-          - nightly
-      git_tag:
-        description: "Existing release tag to publish when publish_target=main, for example cli-v0.1.0"
-        required: false
-        type: string
-      confirm_publish:
-        description: 'Required when publish_target=main. Type "publish" to confirm release publish.'
-        required: false
-        type: string
-      force_nightly_publish:
-        description: "Force nightly publish even with no commits in last 24h"
-        required: false
-        type: boolean
-        default: false
-
-permissions:
-  contents: read
-  id-token: write
-
-defaults:
-  run:
-    working-directory: .
-
-jobs:
-  publish-main:
-    name: Publish cline
-    permissions:
-      contents: write
-      id-token: write
-    if: |
-      github.repository == 'cline/cline' &&
-      github.ref == 'refs/heads/main' &&
-      github.event_name == 'workflow_dispatch' &&
-      github.event.inputs.publish_target == 'main' &&
-      github.event.inputs.confirm_publish == 'publish' &&
-      !endsWith(github.actor, '[bot]')
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.inputs.git_tag }}
-          fetch-depth: 0
-          fetch-tags: true
-
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: "1.3.13"
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: "24.x"
-          registry-url: "https://registry.npmjs.org"
-
-      - name: Verify publish tooling
-        run: |
-          NPM_VERSION=$(npm --version)
-          echo "npm ${NPM_VERSION}"
-          IFS=. read -r major minor patch <<EOF
-          ${NPM_VERSION}
-          EOF
-          if [ "$major" -lt 11 ] || { [ "$major" -eq 11 ] && [ "$minor" -lt 5 ]; } || { [ "$major" -eq 11 ] && [ "$minor" -eq 5 ] && [ "$patch" -lt 1 ]; }; then
-            echo "npm 11.5.1 or newer is required for trusted publishing"
-            exit 1
-          fi
-
-      - name: Install dependencies
-        run: bun install
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Validate release tag
-        id: version
-        env:
-          TAG: ${{ github.event.inputs.git_tag }}
-        run: |
-          if [ -z "$TAG" ]; then
-            echo "git_tag is required when publish_target=main"
-            exit 1
-          fi
-
-          if ! printf "%s\n" "$TAG" | grep -Eq '^cli-v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$'; then
-            echo "git_tag must look like cli-vX.Y.Z, got: ${TAG}"
-            exit 1
-          fi
-
-          VERSION="${TAG#cli-v}"
-          PACKAGE_VERSION=$(node -p "require('./apps/cli/package.json').version")
-
-          if [ "$PACKAGE_VERSION" != "$VERSION" ]; then
-            echo "apps/cli/package.json version ${PACKAGE_VERSION} does not match ${TAG}"
-            exit 1
-          fi
-
-          if ! printf "%s\n" "$VERSION" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$'; then
-            echo "apps/cli/package.json has invalid version: ${VERSION}"
-            exit 1
-          fi
-
-          TAG_COMMIT=$(git rev-parse "${TAG}^{commit}")
-          HEAD_COMMIT=$(git rev-parse HEAD)
-          if [ "$TAG_COMMIT" != "$HEAD_COMMIT" ]; then
-            echo "${TAG} does not point at the checked out commit"
-            exit 1
-          fi
-
-          git fetch origin +main:refs/remotes/origin/main
-          if ! git merge-base --is-ancestor "$HEAD_COMMIT" origin/main; then
-            echo "${TAG} is not reachable from origin/main"
-            exit 1
-          fi
-
-          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
-          echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
-
-      - name: Build SDK packages
-        run: bun run build:sdk
-        env:
-          TELEMETRY_SERVICE_API_KEY: ${{ secrets.TELEMETRY_SERVICE_API_KEY }}
-          ERROR_SERVICE_API_KEY: ${{ secrets.ERROR_SERVICE_API_KEY }}
-          OTEL_TELEMETRY_ENABLED: ${{ secrets.OTEL_TELEMETRY_ENABLED }}
-          OTEL_LOGS_EXPORTER: otlp
-          OTEL_METRICS_EXPORTER: otlp
-          OTEL_EXPORTER_OTLP_PROTOCOL: ${{ secrets.OTEL_EXPORTER_OTLP_PROTOCOL }}
-          OTEL_EXPORTER_OTLP_ENDPOINT: ${{ secrets.OTEL_EXPORTER_OTLP_ENDPOINT }}
-          OTEL_EXPORTER_OTLP_HEADERS: ${{ secrets.OTEL_EXPORTER_OTLP_HEADERS }}
-
-      - name: Run tests
-        run: bun run test
-
-      - name: Build platform binaries
-        run: bun script/build.ts --install-native-variants --skip-sdk-build
-        working-directory: apps/cli
-        env:
-          TELEMETRY_SERVICE_API_KEY: ${{ secrets.TELEMETRY_SERVICE_API_KEY }}
-          ERROR_SERVICE_API_KEY: ${{ secrets.ERROR_SERVICE_API_KEY }}
-          OTEL_TELEMETRY_ENABLED: ${{ secrets.OTEL_TELEMETRY_ENABLED }}
-          OTEL_LOGS_EXPORTER: otlp
-          OTEL_METRICS_EXPORTER: otlp
-          OTEL_EXPORTER_OTLP_PROTOCOL: ${{ secrets.OTEL_EXPORTER_OTLP_PROTOCOL }}
-          OTEL_EXPORTER_OTLP_ENDPOINT: ${{ secrets.OTEL_EXPORTER_OTLP_ENDPOINT }}
-          OTEL_EXPORTER_OTLP_HEADERS: ${{ secrets.OTEL_EXPORTER_OTLP_HEADERS }}
-
-      - name: Verify build output
-        env:
-          VERSION: ${{ steps.version.outputs.version }}
-        run: |
-          EXPECTED=(
-            "@cline/cli-darwin-arm64"
-            "@cline/cli-darwin-x64"
-            "@cline/cli-linux-arm64"
-            "@cline/cli-linux-x64"
-            "@cline/cli-windows-arm64"
-            "@cline/cli-windows-x64"
-          )
-
-          for package_name in "${EXPECTED[@]}"; do
-            dir="apps/cli/dist/${package_name#@cline/}"
-            if [ ! -f "$dir/package.json" ]; then
-              echo "Missing package manifest: $dir/package.json"
-              exit 1
-            fi
-            actual_name=$(node -p "require('./$dir/package.json').name")
-            actual_version=$(node -p "require('./$dir/package.json').version")
-            if [ "$actual_name" != "$package_name" ]; then
-              echo "Expected $package_name, got $actual_name"
-              exit 1
-            fi
-            if [ "$actual_version" != "$VERSION" ]; then
-              echo "Expected $package_name@$VERSION, got $actual_version"
-              exit 1
-            fi
-            ls -lh "$dir/bin/"
-          done
-
-      - name: Sign Windows binaries
-        uses: ./.github/actions/sign-windows-cli
-        with:
-          azure-client-id: ${{ secrets.AZURE_CLIENT_ID }}
-          azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
-          azure-subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
-          endpoint: ${{ secrets.AZURE_TRUSTED_SIGNING_ENDPOINT }}
-          account: ${{ secrets.AZURE_TRUSTED_SIGNING_ACCOUNT_NAME }}
-          certificate-profile: ${{ secrets.AZURE_TRUSTED_SIGNING_CERTIFICATE_PROFILE_CLI }}
-          files: |
-            apps/cli/dist/cli-windows-x64/bin/cline.exe
-            apps/cli/dist/cli-windows-arm64/bin/cline.exe
-
-      - name: Publish to NPM with latest tag
-        env:
-          NPM_CONFIG_PROVENANCE: "true"
-        run: bun script/publish-npm.ts --tag latest
-        working-directory: apps/cli
-
-      - name: Get Previous CLI Tag
-        id: prev_tag
-        env:
-          CURRENT_TAG: ${{ steps.version.outputs.tag }}
-        run: |
-          PREV_TAG=$(git describe --tags --abbrev=0 --match 'cli-v*' "$CURRENT_TAG^" 2>/dev/null || echo "")
-          echo "prev_tag=$PREV_TAG" >> $GITHUB_OUTPUT
-
-      - name: Get Changelog Entry
-        id: changelog
-        env:
-          RELEASE_URL: https://github.com/${{ github.repository }}/releases/tag/${{ steps.version.outputs.tag }}
-        run: |
-          # Grab content between the first "## " header and the next one in apps/cli/CHANGELOG.md
-          CONTENT=$(awk '/^## [0-9]/{if(found) exit; found=1; next} found{print}' apps/cli/CHANGELOG.md)
-          echo "content<<EOF" >> $GITHUB_OUTPUT
-          echo "$CONTENT" >> $GITHUB_OUTPUT
-          echo "EOF" >> $GITHUB_OUTPUT
-
-          # Slack section blocks reject text longer than 3000 characters, and the
-          # Slack action logs that rejection WITHOUT failing the step - so an
-          # over-long changelog silently drops the release announcement while the
-          # run stays green (cline@3.0.50 hit this). Post a trimmed copy to Slack
-          # and link out to the full notes. The GitHub release body stays whole.
-          SLACK_CONTENT=$(CONTENT="$CONTENT" RELEASE_URL="$RELEASE_URL" python3 -c '
-          import os
-          content = os.environ["CONTENT"]
-          more = "\n\n… <%s|Read the full release notes>" % os.environ["RELEASE_URL"]
-          if len(content) <= 3000:
-              print(content, end="")
-          else:
-              budget = 3000 - len(more)
-              kept, used = [], 0
-              for line in content.splitlines(keepends=True):
-                  if used + len(line) > budget:
-                      break
-                  kept.append(line)
-                  used += len(line)
-              body = "".join(kept).rstrip() if kept else content[:budget].rstrip()
-              print(body + more, end="")
-          ')
-          echo "slack_content<<SLACK_EOF" >> $GITHUB_OUTPUT
-          echo "$SLACK_CONTENT" >> $GITHUB_OUTPUT
-          echo "SLACK_EOF" >> $GITHUB_OUTPUT
-
-      - name: Create GitHub Release
-        uses: softprops/action-gh-release@v1
-        with:
-          tag_name: ${{ steps.version.outputs.tag }}
-          name: "CLI v${{ steps.version.outputs.version }}"
-          body: |
-            ${{ steps.changelog.outputs.content }}
-
-            ${{ steps.prev_tag.outputs.prev_tag != '' && format('**Full Changelog**: https://github.com/{0}/compare/{1}...{2}', github.repository, steps.prev_tag.outputs.prev_tag, steps.version.outputs.tag) || '' }}
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Summary
-        env:
-          VERSION: ${{ steps.version.outputs.version }}
-        run: |
-          echo "Published cline@${VERSION} to npm with dist-tag 'latest'"
-          echo "Install with: npm install -g cline"
-
-      - name: Post release to Slack
-        uses: slackapi/slack-github-action@v3.0.1
-        with:
-          method: chat.postMessage
-          token: ${{ secrets.SLACK_RELEASE_BOT_TOKEN }}
-          payload: |
-            channel: "C0APVKGGZFC"
-            text: "Cline CLI v${{ steps.version.outputs.version }}"
-            blocks:
-              - type: "section"
-                text:
-                  type: "mrkdwn"
-                  text: "Cline CLI v${{ steps.version.outputs.version }}"
-              - type: "section"
-                text:
-                  type: "mrkdwn"
-                  text: ${{ toJSON(steps.changelog.outputs.slack_content) }}
-              - type: "context"
-                elements:
-                  - type: "mrkdwn"
-                    text: "<https://www.npmjs.com/package/cline/v/${{ steps.version.outputs.version }}|View on npm>${{ steps.prev_tag.outputs.prev_tag != '' && format(' | Full Changelog: https://github.com/{0}/compare/{1}...{2}', github.repository, steps.prev_tag.outputs.prev_tag, steps.version.outputs.tag) || '' }}"
-
-  publish-nightly:
-    name: Publish cline nightly
-    permissions:
-      contents: read
-      id-token: write
-    if: |
-      github.repository == 'cline/cline' &&
-      github.ref == 'refs/heads/main' &&
-      (
-        github.event_name == 'schedule' ||
-        (
-          github.event_name == 'workflow_dispatch' &&
-          github.event.inputs.publish_target == 'nightly'
-        )
-      )
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Check for recent commits
-        id: check_commits
-        env:
-          FORCE_PUBLISH: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.force_nightly_publish == 'true' }}
-        run: |
-          if [ "$FORCE_PUBLISH" = "true" ]; then
-            echo "force_nightly_publish enabled, proceeding with publish"
-            echo "skip=false" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          if [ "$(git rev-list --count HEAD --since='24 hours ago')" -eq 0 ]; then
-            echo "No commits in last 24 hours, skipping publish"
-            echo "skip=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "Found recent commits, proceeding with publish"
-            echo "skip=false" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Setup Bun
-        if: steps.check_commits.outputs.skip != 'true'
-        uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: "1.3.13"
-
-      - name: Setup Node.js
-        if: steps.check_commits.outputs.skip != 'true'
-        uses: actions/setup-node@v4
-        with:
-          node-version: "24.x"
-          registry-url: "https://registry.npmjs.org"
-
-      - name: Verify publish tooling
-        if: steps.check_commits.outputs.skip != 'true'
-        run: |
-          NPM_VERSION=$(npm --version)
-          echo "npm ${NPM_VERSION}"
-          IFS=. read -r major minor patch <<EOF
-          ${NPM_VERSION}
-          EOF
-          if [ "$major" -lt 11 ] || { [ "$major" -eq 11 ] && [ "$minor" -lt 5 ]; } || { [ "$major" -eq 11 ] && [ "$minor" -eq 5 ] && [ "$patch" -lt 1 ]; }; then
-            echo "npm 11.5.1 or newer is required for trusted publishing"
-            exit 1
-          fi
-
-      - name: Install dependencies
-        if: steps.check_commits.outputs.skip != 'true'
-        run: bun install
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Build SDK packages
-        if: steps.check_commits.outputs.skip != 'true'
-        run: bun run build:sdk
-        env:
-          TELEMETRY_SERVICE_API_KEY: ${{ secrets.TELEMETRY_SERVICE_API_KEY }}
-          ERROR_SERVICE_API_KEY: ${{ secrets.ERROR_SERVICE_API_KEY }}
-          OTEL_TELEMETRY_ENABLED: ${{ secrets.OTEL_TELEMETRY_ENABLED }}
-          OTEL_LOGS_EXPORTER: otlp
-          OTEL_METRICS_EXPORTER: otlp
-          OTEL_EXPORTER_OTLP_PROTOCOL: ${{ secrets.OTEL_EXPORTER_OTLP_PROTOCOL }}
-          OTEL_EXPORTER_OTLP_ENDPOINT: ${{ secrets.OTEL_EXPORTER_OTLP_ENDPOINT }}
-          OTEL_EXPORTER_OTLP_HEADERS: ${{ secrets.OTEL_EXPORTER_OTLP_HEADERS }}
-
-      - name: Run tests
-        if: steps.check_commits.outputs.skip != 'true'
-        run: bun run test
-
-      - name: Generate nightly version
-        if: steps.check_commits.outputs.skip != 'true'
-        id: version
-        run: |
-          BASE_VERSION=$(node -p "require('./apps/cli/package.json').version")
-          TIMESTAMP=$(date +%s)
-          VERSION="${BASE_VERSION}-nightly.${TIMESTAMP}"
-
-          echo "Base version: ${BASE_VERSION}"
-          echo "Generated nightly version: ${VERSION}"
-          echo "base_version=${BASE_VERSION}" >> "$GITHUB_OUTPUT"
-          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
-
-      - name: Update nightly package version
-        if: steps.check_commits.outputs.skip != 'true'
-        env:
-          VERSION: ${{ steps.version.outputs.version }}
-        run: |
-          node -e '
-            const fs = require("node:fs");
-            const path = "apps/cli/package.json";
-            const pkg = JSON.parse(fs.readFileSync(path, "utf8"));
-            pkg.version = process.env.VERSION;
-            fs.writeFileSync(path, `${JSON.stringify(pkg, null, "\t")}\n`);
-          '
-          cat apps/cli/package.json | grep '"version"'
-
-      - name: Build platform binaries
-        if: steps.check_commits.outputs.skip != 'true'
-        run: bun script/build.ts --install-native-variants --skip-sdk-build
-        working-directory: apps/cli
-        env:
-          TELEMETRY_SERVICE_API_KEY: ${{ secrets.TELEMETRY_SERVICE_API_KEY }}
-          ERROR_SERVICE_API_KEY: ${{ secrets.ERROR_SERVICE_API_KEY }}
-          OTEL_TELEMETRY_ENABLED: ${{ secrets.OTEL_TELEMETRY_ENABLED }}
-          OTEL_LOGS_EXPORTER: otlp
-          OTEL_METRICS_EXPORTER: otlp
-          OTEL_EXPORTER_OTLP_PROTOCOL: ${{ secrets.OTEL_EXPORTER_OTLP_PROTOCOL }}
-          OTEL_EXPORTER_OTLP_ENDPOINT: ${{ secrets.OTEL_EXPORTER_OTLP_ENDPOINT }}
-          OTEL_EXPORTER_OTLP_HEADERS: ${{ secrets.OTEL_EXPORTER_OTLP_HEADERS }}
-
-      - name: Verify build output
-        if: steps.check_commits.outputs.skip != 'true'
-        env:
-          VERSION: ${{ steps.version.outputs.version }}
-        run: |
-          EXPECTED=(
-            "@cline/cli-darwin-arm64"
-            "@cline/cli-darwin-x64"
-            "@cline/cli-linux-arm64"
-            "@cline/cli-linux-x64"
-            "@cline/cli-windows-arm64"
-            "@cline/cli-windows-x64"
-          )
-
-          for package_name in "${EXPECTED[@]}"; do
-            dir="apps/cli/dist/${package_name#@cline/}"
-            if [ ! -f "$dir/package.json" ]; then
-              echo "Missing package manifest: $dir/package.json"
-              exit 1
-            fi
-            actual_name=$(node -p "require('./$dir/package.json').name")
-            actual_version=$(node -p "require('./$dir/package.json').version")
-            if [ "$actual_name" != "$package_name" ]; then
-              echo "Expected $package_name, got $actual_name"
-              exit 1
-            fi
-            if [ "$actual_version" != "$VERSION" ]; then
-              echo "Expected $package_name@$VERSION, got $actual_version"
-              exit 1
-            fi
-            ls -lh "$dir/bin/"
-          done
-
-      - name: Sign Windows binaries
-        if: steps.check_commits.outputs.skip != 'true'
-        uses: ./.github/actions/sign-windows-cli
-        with:
-          azure-client-id: ${{ secrets.AZURE_CLIENT_ID }}
-          azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
-          azure-subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
-          endpoint: ${{ secrets.AZURE_TRUSTED_SIGNING_ENDPOINT }}
-          account: ${{ secrets.AZURE_TRUSTED_SIGNING_ACCOUNT_NAME }}
-          certificate-profile: ${{ secrets.AZURE_TRUSTED_SIGNING_CERTIFICATE_PROFILE_CLI }}
-          files: |
-            apps/cli/dist/cli-windows-x64/bin/cline.exe
-            apps/cli/dist/cli-windows-arm64/bin/cline.exe
-
-      - name: Publish to NPM with nightly tag
-        if: steps.check_commits.outputs.skip != 'true'
-        env:
-          NPM_CONFIG_PROVENANCE: "true"
-        run: bun script/publish-npm.ts --tag nightly
-        working-directory: apps/cli
-
-      - name: Summary
-        if: steps.check_commits.outputs.skip != 'true'
-        env:
-          VERSION: ${{ steps.version.outputs.version }}
-        run: |
-          echo "Published cline@${VERSION} to npm with dist-tag 'nightly'"
-          echo "Install with: npm install -g cline@nightly"

.github/workflows/cli-tui-tests.yml

@@ -0,0 +1,83 @@
+name: CLI TUI Tests
+
+on:
+  pull_request:
+    branches:
+      - main
+  workflow_dispatch:
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  cli-tui-tests:
+    name: CLI TUI Tests
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - name: Install dependencies
+        run: npm ci
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build CLI
+        run: npm run cli:build
+
+      - name: Run TUI Tests
+        id: tui_tests
+        run: |
+          npm run test:e2e:cli:tui 2>&1 | tee tui-test-output.log
+          exit_code=${PIPESTATUS[0]}
+          echo "tui_exit_code=$exit_code" >> $GITHUB_OUTPUT
+          exit $exit_code
+
+      - name: Write failure summary
+        if: always() && steps.tui_tests.outcome != 'success' && steps.tui_tests.outcome != 'skipped'
+        run: |
+          echo "## ❌ CLI TUI Tests Failed" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "**Step outcome:** \`${{ steps.tui_tests.outcome }}\`" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "### Test Output" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo '```' >> $GITHUB_STEP_SUMMARY
+          if [ -f tui-test-output.log ]; then
+            cat tui-test-output.log >> $GITHUB_STEP_SUMMARY
+          else
+            echo "(no test output captured — process may have been killed before output was flushed)" >> $GITHUB_STEP_SUMMARY
+          fi
+          echo '```' >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "### Debugging" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "- **TUI traces** are attached as artifacts below — download and inspect them to see terminal state at the point of failure." >> $GITHUB_STEP_SUMMARY
+          echo "- **To view a trace replay/Run a TUI Trace: ** run \`npx tui-test show-trace path/to/trace/file\` in your terminal" >> $GITHUB_STEP_SUMMARY
+          echo "- **Full test log** is also attached as an artifact." >> $GITHUB_STEP_SUMMARY
+          echo "- Tests run with \`retries: 2\` so any failure shown is a consistent failure, not a flake." >> $GITHUB_STEP_SUMMARY
+
+      - name: Upload TUI traces
+        if: always() && steps.tui_tests.outcome != 'success' && steps.tui_tests.outcome != 'skipped'
+        uses: actions/upload-artifact@v4
+        with:
+          name: tui-test-traces
+          path: tests/e2e/cli/tui-traces/
+          retention-days: 14
+          if-no-files-found: warn
+
+      - name: Upload test log
+        if: always() && steps.tui_tests.outcome != 'success' && steps.tui_tests.outcome != 'skipped'
+        uses: actions/upload-artifact@v4
+        with:
+          name: tui-test-log
+          path: tui-test-output.log
+          retention-days: 14
+          if-no-files-found: warn

.github/workflows/cline-evals-regression.yml

@@ -0,0 +1,85 @@
+name: Smoke Tests
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'src/core/**'
+      - 'src/shared/**'
+      - 'proto/**'
+      - 'evals/**'
+      - '.github/workflows/cline-evals-regression.yml'
+  pull_request:
+    paths:
+      - 'src/core/**'
+      - 'src/shared/**'
+      - 'proto/**'
+      - 'evals/**'
+      - '.github/workflows/cline-evals-regression.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: smoke-tests-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  smoke-tests:
+    name: Smoke Tests
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build and install CLI
+        run: |
+          npm run protos
+          cd cli && npm install && npm run build && npm link
+          echo "$(npm config get prefix)/bin" >> $GITHUB_PATH
+
+      - name: Verify CLI
+        run: cline --version
+
+      - name: Run smoke tests
+        env:
+          CLINE_API_KEY: ${{ secrets.CLINE_API_KEY }}
+        run: |
+          cline auth -p cline -k "$CLINE_API_KEY" -m "anthropic/claude-sonnet-4.5"
+          max_attempts=3
+          for attempt in $(seq 1 $max_attempts); do
+            echo "::group::Attempt $attempt of $max_attempts"
+            if npx tsx evals/smoke-tests/run-smoke-tests.ts --trials 1 --parallel; then
+              echo "::endgroup::"
+              echo "Smoke tests passed on attempt $attempt"
+              exit 0
+            fi
+            echo "::endgroup::"
+            if [ $attempt -lt $max_attempts ]; then
+              echo "::warning::Smoke tests failed on attempt $attempt, retrying..."
+              sleep 10
+            fi
+          done
+          echo "::error::Smoke tests failed after $max_attempts attempts"
+          exit 1
+
+      - name: Generate summary
+        if: always()
+        run: cat evals/smoke-tests/results/latest/summary.md >> $GITHUB_STEP_SUMMARY
+
+      - name: Upload results
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: smoke-test-results-${{ github.run_id }}
+          path: evals/smoke-tests/results/latest/
+          retention-days: 30

.github/workflows/desktop-publish.yml

@@ -1,934 +0,0 @@
-name: desktop-publish
-
-on:
-  workflow_dispatch:
-    inputs:
-      git_tag:
-        description: "Existing release tag to publish, for example desktop-v0.1.0"
-        required: true
-        type: string
-      confirm_publish:
-        description: 'Type "publish" to confirm the desktop release.'
-        required: true
-        type: string
-      channel:
-        description: "Release channel"
-        required: true
-        type: choice
-        options:
-          - stable
-          - beta
-        default: stable
-
-permissions:
-  contents: read
-
-defaults:
-  run:
-    working-directory: .
-
-jobs:
-  validate:
-    name: Validate release tag
-    if: |
-      github.repository == 'cline/cline' &&
-      github.event.inputs.confirm_publish == 'publish' &&
-      !endsWith(github.actor, '[bot]')
-    runs-on: ubuntu-latest
-    outputs:
-      version: ${{ steps.version.outputs.version }}
-      tag: ${{ steps.version.outputs.tag }}
-      channel: ${{ steps.version.outputs.channel }}
-      feed: ${{ steps.version.outputs.feed }}
-      product: ${{ steps.version.outputs.product }}
-    steps:
-      # Companion to the presence check in `build`, and the half that actually
-      # establishes scope. This job declares no environment, so a signing secret
-      # that resolves here can only be a repository or organization secret —
-      # meaning it is still readable by every workflow in the repo, which is the
-      # thing the PublishDesktop environment exists to prevent. Neither check
-      # proves provenance alone (an environment-gated job resolves repository
-      # secrets too, with environment values merely taking precedence), but
-      # together they do: empty here plus present in `build` means the value came
-      # from the environment.
-      - name: Verify signing secrets are not repository-scoped
-        env:
-          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
-          APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
-          APPLE_API_KEY_CONTENT: ${{ secrets.APPLE_API_KEY_CONTENT }}
-          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
-          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
-          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
-          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
-          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
-        run: |
-          unscoped=()
-          for name in APPLE_API_ISSUER APPLE_API_KEY APPLE_API_KEY_CONTENT \
-                      APPLE_CERTIFICATE APPLE_CERTIFICATE_PASSWORD APPLE_SIGNING_IDENTITY \
-                      TAURI_SIGNING_PRIVATE_KEY TAURI_SIGNING_PRIVATE_KEY_PASSWORD; do
-            [ -z "${!name}" ] || unscoped+=("$name")
-          done
-
-          if [ ${#unscoped[@]} -gt 0 ]; then
-            echo "These signing secrets resolve in a job with no environment:"
-            printf '  - %s\n' "${unscoped[@]}"
-            echo
-            echo "That means they are still repository or organization secrets and"
-            echo "are readable by any workflow in this repo. Delete them at that"
-            echo "level and add them to the PublishDesktop environment instead."
-            exit 1
-          fi
-
-          echo "No signing secret resolves outside the PublishDesktop environment."
-
-      - name: Checkout code
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.inputs.git_tag }}
-          fetch-depth: 0
-          fetch-tags: true
-
-      - name: Validate release tag
-        id: version
-        env:
-          TAG: ${{ github.event.inputs.git_tag }}
-          # inputs.* (not github.event.inputs.*) so the declared default
-          # applies when an API dispatch omits the channel input entirely.
-          CHANNEL: ${{ inputs.channel }}
-        run: |
-          # Fail-closed channel mapping: every channel defines its tag shape,
-          # its ancestry source, its feed, and its product name, and an unknown
-          # channel dies here. The feed assignment is the load-bearing one —
-          # the updater comparator is a plain semver "newer than", so a beta
-          # manifest landing on desktop-latest would auto-update every stable
-          # install onto the beta. The stable regex rejects prerelease
-          # suffixes for the same reason.
-          case "$CHANNEL" in
-            stable)
-              if ! printf "%s\n" "$TAG" | grep -Eq '^desktop-v[0-9]+\.[0-9]+\.[0-9]+$'; then
-                echo "stable git_tag must look like desktop-vX.Y.Z with no suffix, got: ${TAG}"
-                exit 1
-              fi
-              ANCESTOR_REF=main
-              FEED=desktop-latest
-              PRODUCT="Cline"
-              ;;
-            beta)
-              if ! printf "%s\n" "$TAG" | grep -Eq '^desktop-v[0-9]+\.[0-9]+\.[0-9]+-beta\.[0-9]+$'; then
-                echo "beta git_tag must look like desktop-vX.Y.Z-beta.N, got: ${TAG}"
-                exit 1
-              fi
-              ANCESTOR_REF=desktop-experimental
-              FEED=desktop-beta
-              PRODUCT="Cline Beta"
-              ;;
-            *)
-              echo "unknown channel: ${CHANNEL}"
-              exit 1
-              ;;
-          esac
-
-          VERSION="${TAG#desktop-v}"
-          PACKAGE_VERSION=$(node -p "require('./apps/examples/desktop-app/package.json').version")
-          TAURI_VERSION=$(node -p "require('./apps/examples/desktop-app/src-tauri/tauri.conf.json').version")
-
-          if [ "$PACKAGE_VERSION" != "$VERSION" ]; then
-            echo "apps/examples/desktop-app/package.json version ${PACKAGE_VERSION} does not match ${TAG}"
-            exit 1
-          fi
-
-          if [ "$TAURI_VERSION" != "$VERSION" ]; then
-            echo "apps/examples/desktop-app/src-tauri/tauri.conf.json version ${TAURI_VERSION} does not match ${TAG}"
-            exit 1
-          fi
-
-          TAG_COMMIT=$(git rev-parse "${TAG}^{commit}")
-          HEAD_COMMIT=$(git rev-parse HEAD)
-          if [ "$TAG_COMMIT" != "$HEAD_COMMIT" ]; then
-            echo "${TAG} does not point at the checked out commit"
-            exit 1
-          fi
-
-          git fetch origin "+${ANCESTOR_REF}:refs/remotes/origin/${ANCESTOR_REF}"
-          if ! git merge-base --is-ancestor "$HEAD_COMMIT" "origin/${ANCESTOR_REF}"; then
-            echo "${TAG} is not reachable from origin/${ANCESTOR_REF}"
-            exit 1
-          fi
-
-          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
-          echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
-          echo "channel=${CHANNEL}" >> "$GITHUB_OUTPUT"
-          echo "feed=${FEED}" >> "$GITHUB_OUTPUT"
-          echo "product=${PRODUCT}" >> "$GITHUB_OUTPUT"
-
-  build:
-    name: Build macOS (universal)
-    needs: validate
-    # The Apple signing/notarization and Tauri updater secrets live in the
-    # PublishDesktop environment rather than at repository level, so they are
-    # readable only by this job and only once a required reviewer approves the
-    # run. Defense in depth: this `if` is advisory because a dispatched branch
-    # runs its own copy of this file; the enforced gate is the PublishDesktop
-    # environment's deployment-branch policy, which must also allow only main.
-    #
-    # Beta releases do not weaken this: a beta publish is ALSO dispatched from
-    # main (so this gate, the branch policy, and the workflow file executed all
-    # stay main's) — only the checked-out tag points into desktop-experimental,
-    # which validate pins via the ancestry check. A workflow copy edited on
-    # desktop-experimental can therefore never reach the signing secrets.
-    #
-    # What dispatch-from-main does NOT protect: the checked-out tag's own
-    # build scripts (bun install hooks, build:sdk, Tauri's beforeBuildCommand,
-    # build.rs) run inside this job with the signing secrets in scope, for
-    # stable and beta alike. The control for that is this environment's
-    # required-reviewer approval — the approver is vouching for the code the
-    # tag points at, not just for "a release happening". Two consequences:
-    # desktop-experimental must keep main-grade merge controls (branch
-    # protection, maintainer-only pushes), and an approval should only follow
-    # a look at what the tag actually contains. Building betas without these
-    # secrets is not an option: unsigned bundles fail Gatekeeper and updater
-    # artifacts must be signed with the same key or beta installs cannot
-    # verify their updates.
-    if: github.ref == 'refs/heads/main'
-    environment: PublishDesktop
-    runs-on: macos-latest
-    timeout-minutes: 90
-    steps:
-      # A secret missing here is dangerous rather than merely broken: Tauri skips
-      # code signing when APPLE_CERTIFICATE is empty and skips notarization when
-      # APPLE_API_KEY is empty, both silently, so the build would still succeed
-      # and publish an unsigned, un-notarized bundle. Only the missing updater
-      # key is caught later (by the .sig check in "Collect artifacts"). Fail up
-      # front instead, before any build work, if the environment is misconfigured.
-      - name: Verify PublishDesktop secrets are present
-        env:
-          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
-          APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
-          APPLE_API_KEY_CONTENT: ${{ secrets.APPLE_API_KEY_CONTENT }}
-          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
-          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
-          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
-          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
-          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
-        run: |
-          missing=()
-          for name in APPLE_API_ISSUER APPLE_API_KEY APPLE_API_KEY_CONTENT \
-                      APPLE_CERTIFICATE APPLE_CERTIFICATE_PASSWORD APPLE_SIGNING_IDENTITY \
-                      TAURI_SIGNING_PRIVATE_KEY TAURI_SIGNING_PRIVATE_KEY_PASSWORD; do
-            [ -n "${!name}" ] || missing+=("$name")
-          done
-
-          if [ ${#missing[@]} -gt 0 ]; then
-            echo "Missing from the PublishDesktop environment:"
-            printf '  - %s\n' "${missing[@]}"
-            echo
-            echo "Check that every secret above is set on the PublishDesktop"
-            echo "environment and that this job still declares"
-            echo "'environment: PublishDesktop'."
-            exit 1
-          fi
-
-          # Deliberately not phrased as "resolved from PublishDesktop": a
-          # non-empty value here could also be a repository or organization
-          # secret. The repository-scope check in `validate` is what rules that
-          # out.
-          echo "All 8 signing secrets are present."
-
-      - name: Checkout code
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ needs.validate.outputs.tag }}
-
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: "1.3.13"
-
-      # A universal (fat) macOS bundle needs both architecture slices, so
-      # install both Rust targets; `tauri build --target universal-apple-darwin`
-      # compiles each and lipos the results into one binary.
-      - name: Setup Rust
-        uses: dtolnay/rust-toolchain@stable
-        with:
-          targets: aarch64-apple-darwin,x86_64-apple-darwin
-
-      # No Rust build cache here, deliberately. This is the only job that can
-      # read the Apple signing certificate and the Tauri updater key, and a
-      # restored cache archive is attacker-controlled the moment the Actions
-      # cache is poisoned.
-
-      - name: Install dependencies
-        run: bun install
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Build SDK packages
-        run: bun run build:sdk
-        env:
-          TELEMETRY_SERVICE_API_KEY: ${{ secrets.TELEMETRY_SERVICE_API_KEY }}
-          ERROR_SERVICE_API_KEY: ${{ secrets.ERROR_SERVICE_API_KEY }}
-          OTEL_TELEMETRY_ENABLED: ${{ secrets.OTEL_TELEMETRY_ENABLED }}
-          OTEL_LOGS_EXPORTER: otlp
-          OTEL_METRICS_EXPORTER: otlp
-          OTEL_EXPORTER_OTLP_PROTOCOL: ${{ secrets.OTEL_EXPORTER_OTLP_PROTOCOL }}
-          OTEL_EXPORTER_OTLP_ENDPOINT: ${{ secrets.OTEL_EXPORTER_OTLP_ENDPOINT }}
-          OTEL_EXPORTER_OTLP_HEADERS: ${{ secrets.OTEL_EXPORTER_OTLP_HEADERS }}
-
-      - name: Write App Store Connect API key
-        env:
-          APPLE_API_KEY_CONTENT: ${{ secrets.APPLE_API_KEY_CONTENT }}
-        run: |
-          if [ -z "$APPLE_API_KEY_CONTENT" ]; then
-            echo "APPLE_API_KEY_CONTENT secret is not configured"
-            exit 1
-          fi
-          printf "%s" "$APPLE_API_KEY_CONTENT" > "$RUNNER_TEMP/AuthKey.p8"
-
-      - name: Build, sign, and notarize desktop bundle
-        working-directory: apps/examples/desktop-app
-        # Tauri merges repeated --config flags in order, so the beta overlay
-        # (product name, bundle identifier, beta update feed) layers on top of
-        # the release overlay without duplicating it. $CONFIG_ARGS is
-        # deliberately unquoted: it must word-split into separate flags.
-        run: bunx tauri build --target universal-apple-darwin $CONFIG_ARGS
-        env:
-          CONFIG_ARGS: ${{ needs.validate.outputs.channel == 'beta' && '--config src-tauri/tauri.release.conf.json --config src-tauri/tauri.beta.conf.json' || '--config src-tauri/tauri.release.conf.json' }}
-          # Telemetry config for the sidecar binary. Tauri's beforeBuildCommand
-          # (`bun run build` -> build:sidecar:bin) compiles the sidecar during
-          # this step and inlines these values into the binary via `--define`
-          # (scripts/telemetry-define-args.ts); a packaged app launched from
-          # Finder/the Dock has no runtime env, so build-time inlining is the
-          # only way the shipped sidecar can ever report telemetry.
-          TELEMETRY_SERVICE_API_KEY: ${{ secrets.TELEMETRY_SERVICE_API_KEY }}
-          ERROR_SERVICE_API_KEY: ${{ secrets.ERROR_SERVICE_API_KEY }}
-          OTEL_TELEMETRY_ENABLED: ${{ secrets.OTEL_TELEMETRY_ENABLED }}
-          OTEL_LOGS_EXPORTER: otlp
-          OTEL_METRICS_EXPORTER: otlp
-          OTEL_EXPORTER_OTLP_PROTOCOL: ${{ secrets.OTEL_EXPORTER_OTLP_PROTOCOL }}
-          OTEL_EXPORTER_OTLP_ENDPOINT: ${{ secrets.OTEL_EXPORTER_OTLP_ENDPOINT }}
-          OTEL_EXPORTER_OTLP_HEADERS: ${{ secrets.OTEL_EXPORTER_OTLP_HEADERS }}
-          # Developer ID signing (Tauri imports the cert into a temp keychain)
-          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
-          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
-          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
-          # Notarization via App Store Connect API key. Tauri reads the Key ID
-          # from APPLE_API_KEY; APPLE_API_KEY_ID alone silently skips notarization.
-          APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
-          APPLE_API_KEY_PATH: ${{ runner.temp }}/AuthKey.p8
-          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
-          # Updater artifact signing (minisign keypair, independent of Apple)
-          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
-          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
-          # The DMG background, window size, and icon positions from
-          # tauri.conf.json are applied by a Finder AppleScript in Tauri's
-          # bundle_dmg.sh. When CI=true (always set on Actions) the bundler
-          # passes --skip-jenkins and silently skips that script, shipping a
-          # bare DMG. macOS runners have a GUI session, so opt out of the skip.
-          TAURI_BUNDLER_DMG_IGNORE_CI: "true"
-
-      # Tauri lipos the main binary itself but sidecars are merged by our own
-      # build-sidecar-bin.ts, so assert every Mach-O in the bundle really
-      # carries both slices before anything is published. A single-arch
-      # sidecar would otherwise ship fine and only crash on the other arch.
-      - name: Verify bundle is a universal binary
-        working-directory: apps/examples/desktop-app
-        env:
-          PRODUCT: ${{ needs.validate.outputs.product }}
-        run: |
-          APP="src-tauri/target/universal-apple-darwin/release/bundle/macos/${PRODUCT}.app"
-          if [ ! -d "$APP" ]; then
-            echo "app bundle not found at $APP"
-            exit 1
-          fi
-          for bin in "$APP/Contents/MacOS/"*; do
-            archs=$(lipo -archs "$bin")
-            echo "$bin: $archs"
-            case "$archs" in
-              *arm64*x86_64*|*x86_64*arm64*) ;;
-              *)
-                echo "$bin is not a universal binary (archs: $archs)"
-                exit 1
-                ;;
-            esac
-          done
-
-      # Guardrail: the updater endpoint is compiled into the main binary as a
-      # string literal (tauri-build embeds the merged config via codegen), so
-      # assert the bundle carries this channel's feed URL and not the other
-      # channel's, before anything gets signed into a release. This catches a
-      # --config overlay that silently failed to apply: a beta bundle polling
-      # desktop-latest would pull its users onto stable builds, and a stable
-      # bundle polling desktop-beta would push betas to every stable install.
-      - name: Verify updater feed endpoint
-        working-directory: apps/examples/desktop-app
-        env:
-          CHANNEL: ${{ needs.validate.outputs.channel }}
-          PRODUCT: ${{ needs.validate.outputs.product }}
-        run: |
-          APP="src-tauri/target/universal-apple-darwin/release/bundle/macos/${PRODUCT}.app"
-          case "$CHANNEL" in
-            stable)
-              WANT="releases/download/desktop-latest/latest.json"
-              FORBID="releases/download/desktop-beta/latest.json"
-              ;;
-            beta)
-              WANT="releases/download/desktop-beta/latest.json"
-              FORBID="releases/download/desktop-latest/latest.json"
-              ;;
-            *)
-              echo "unknown channel: ${CHANNEL}"
-              exit 1
-              ;;
-          esac
-
-          # Plain grep >/dev/null rather than grep -q: -q exits at the first
-          # match, SIGPIPEs strings, and would read as a failed pipeline under
-          # pipefail.
-          found=0
-          for bin in "$APP/Contents/MacOS/"*; do
-            if strings -a "$bin" | grep "$FORBID" >/dev/null; then
-              echo "$bin embeds the other channel's feed URL (${FORBID})"
-              exit 1
-            fi
-            if strings -a "$bin" | grep "$WANT" >/dev/null; then
-              found=1
-            fi
-          done
-
-          if [ "$found" -ne 1 ]; then
-            echo "No binary in ${APP}/Contents/MacOS embeds ${WANT}."
-            echo "The updater endpoint overlay did not apply; check the"
-            echo "--config flags on the build step and tauri.beta.conf.json."
-            exit 1
-          fi
-          echo "Updater endpoint verified: ${WANT}"
-
-      # Guardrail: assert the telemetry config actually made it into the
-      # compiled sidecar. Missing env on the build step (or a regression in
-      # the --define inlining) would otherwise ship a release with telemetry
-      # silently disabled — exactly what happened for every release before
-      # this check existed. Being enabled is not enough on its own: an empty,
-      # malformed, or non-http(s) OTLP endpoint would still drop every event
-      # at runtime (the SDK exporters speak OTLP http/json only), so the
-      # selfcheck must also report a usable endpoint host.
-      - name: Verify sidecar telemetry config was inlined
-        working-directory: apps/examples/desktop-app
-        run: |
-          SELFCHECK=$(./src-tauri/bin/code-sidecar-universal-apple-darwin --telemetry-selfcheck)
-          echo "$SELFCHECK"
-          if ! printf '%s' "$SELFCHECK" | grep -q '"enabled":true'; then
-            echo "Packaged sidecar reports telemetry disabled."
-            echo "Check the OTEL_* / TELEMETRY_SERVICE_API_KEY env on the"
-            echo "'Build, sign, and notarize desktop bundle' step and the"
-            echo "--define inlining in scripts/build-sidecar-bin.ts."
-            exit 1
-          fi
-          if printf '%s' "$SELFCHECK" | grep -Eq '"otlp_endpoint_host":"(invalid-endpoint-url)?"'; then
-            echo "Packaged sidecar reports telemetry enabled but its OTLP"
-            echo "endpoint is missing, unparseable, or not an http(s) URL, so"
-            echo "every event would be dropped at runtime. Check the"
-            echo "OTEL_EXPORTER_OTLP_ENDPOINT secret."
-            exit 1
-          fi
-
-      - name: Collect artifacts
-        working-directory: apps/examples/desktop-app
-        env:
-          VERSION: ${{ needs.validate.outputs.version }}
-          PRODUCT: ${{ needs.validate.outputs.product }}
-        run: |
-          BUNDLE_DIR="src-tauri/target/universal-apple-darwin/release/bundle"
-          OUT="dist/publish"
-          mkdir -p "$OUT"
-
-          # "Cline" -> Cline, "Cline Beta" -> Cline-Beta
-          PREFIX="${PRODUCT// /-}"
-
-          DMG=$(find "$BUNDLE_DIR/dmg" -name '*.dmg' -print -quit)
-          if [ -z "$DMG" ]; then
-            echo "no DMG produced under $BUNDLE_DIR/dmg"
-            exit 1
-          fi
-          cp "$DMG" "$OUT/${PREFIX}_${VERSION}_universal.dmg"
-
-          TARBALL=$(find "$BUNDLE_DIR/macos" -name '*.app.tar.gz' -print -quit)
-          if [ -z "$TARBALL" ] || [ ! -f "${TARBALL}.sig" ]; then
-            echo "updater artifact or signature missing under $BUNDLE_DIR/macos"
-            exit 1
-          fi
-          cp "$TARBALL" "$OUT/${PREFIX}_${VERSION}_universal.app.tar.gz"
-          cp "${TARBALL}.sig" "$OUT/${PREFIX}_${VERSION}_universal.app.tar.gz.sig"
-
-          ls -lh "$OUT"
-
-      - name: Upload artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: desktop-universal
-          path: apps/examples/desktop-app/dist/publish/*
-          if-no-files-found: error
-
-  build-windows:
-    name: Build Windows (x64)
-    needs: validate
-    # Same gate rationale as the macOS build job above. This job additionally
-    # needs id-token: write for Azure OIDC: Windows binaries are
-    # Authenticode-signed with Azure Trusted Signing, authenticated through the
-    # PublishDesktop-environment federated credential on the cline-cli-signing
-    # Entra app (subject repo:cline/cline:environment:PublishDesktop).
-    if: github.ref == 'refs/heads/main'
-    environment: PublishDesktop
-    runs-on: windows-latest
-    timeout-minutes: 90
-    permissions:
-      contents: read
-      id-token: write
-    steps:
-      # All-or-nothing: an unsigned Windows desktop build is never acceptable
-      # (Smart App Control / WDAC block unsigned exes and SmartScreen flags
-      # unsigned installers), and Tauri would skip updater-artifact signing
-      # silently if the updater key were missing. Unlike the CLI pipeline
-      # there is no unsigned fallback here.
-      - name: Verify signing secrets are present
-        shell: bash
-        env:
-          AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
-          AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
-          AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
-          AZURE_TRUSTED_SIGNING_ENDPOINT: ${{ secrets.AZURE_TRUSTED_SIGNING_ENDPOINT }}
-          AZURE_TRUSTED_SIGNING_ACCOUNT_NAME: ${{ secrets.AZURE_TRUSTED_SIGNING_ACCOUNT_NAME }}
-          AZURE_TRUSTED_SIGNING_CERTIFICATE_PROFILE_DESKTOP: ${{ secrets.AZURE_TRUSTED_SIGNING_CERTIFICATE_PROFILE_DESKTOP }}
-          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
-          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
-        run: |
-          missing=()
-          for name in AZURE_CLIENT_ID AZURE_TENANT_ID AZURE_SUBSCRIPTION_ID \
-                      AZURE_TRUSTED_SIGNING_ENDPOINT AZURE_TRUSTED_SIGNING_ACCOUNT_NAME \
-                      AZURE_TRUSTED_SIGNING_CERTIFICATE_PROFILE_DESKTOP \
-                      TAURI_SIGNING_PRIVATE_KEY TAURI_SIGNING_PRIVATE_KEY_PASSWORD; do
-            [ -n "${!name}" ] || missing+=("$name")
-          done
-
-          if [ ${#missing[@]} -gt 0 ]; then
-            echo "Missing signing secrets for the Windows desktop build:"
-            printf '  - %s\n' "${missing[@]}"
-            echo
-            echo "The AZURE_* names are repository secrets; the TAURI_* names"
-            echo "live in the PublishDesktop environment. Refusing to build an"
-            echo "unsigned Windows desktop release."
-            exit 1
-          fi
-
-          echo "All Windows signing secrets are present."
-
-      # Every action in this job is SHA-pinned (unlike elsewhere in this
-      # file): they run with id-token: write and the updater signing key in
-      # scope, so a hijacked upstream tag must not be able to reach the
-      # signing identity or tamper with what gets signed and uploaded.
-      - name: Checkout code
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-        with:
-          ref: ${{ needs.validate.outputs.tag }}
-
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
-        with:
-          bun-version: "1.3.13"
-
-      - name: Setup Rust
-        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable branch
-        with:
-          # With a SHA-pinned action the toolchain no longer comes from the
-          # ref name, so it must be set explicitly.
-          toolchain: stable
-
-      # No Rust build cache, mirroring the macOS job: this job holds the
-      # updater signing key and an Azure signing session, and a restored cache
-      # archive is attacker-controlled if the Actions cache is poisoned.
-
-      - name: Install dependencies
-        run: bun install
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Build SDK packages
-        run: bun run build:sdk
-        env:
-          TELEMETRY_SERVICE_API_KEY: ${{ secrets.TELEMETRY_SERVICE_API_KEY }}
-          ERROR_SERVICE_API_KEY: ${{ secrets.ERROR_SERVICE_API_KEY }}
-          OTEL_TELEMETRY_ENABLED: ${{ secrets.OTEL_TELEMETRY_ENABLED }}
-          OTEL_LOGS_EXPORTER: otlp
-          OTEL_METRICS_EXPORTER: otlp
-          OTEL_EXPORTER_OTLP_PROTOCOL: ${{ secrets.OTEL_EXPORTER_OTLP_PROTOCOL }}
-          OTEL_EXPORTER_OTLP_ENDPOINT: ${{ secrets.OTEL_EXPORTER_OTLP_ENDPOINT }}
-          OTEL_EXPORTER_OTLP_HEADERS: ${{ secrets.OTEL_EXPORTER_OTLP_HEADERS }}
-
-      - name: Azure login (OIDC)
-        uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
-        with:
-          client-id: ${{ secrets.AZURE_CLIENT_ID }}
-          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
-          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
-
-      # Tauri invokes signCommand once per staged binary (main exe, sidecar,
-      # NSIS uninstaller, and the installer itself). The overlay is generated
-      # here rather than committed because signCommand needs an absolute path
-      # to the signing script on this runner.
-      - name: Write signing config overlay
-        shell: bash
-        run: |
-          SCRIPT_PATH="${GITHUB_WORKSPACE//\\//}/apps/examples/desktop-app/scripts/tauri-sign-windows.ps1"
-          SIGN_CONF="${RUNNER_TEMP//\\//}/tauri-windows-sign.conf.json"
-          cat > "$SIGN_CONF" <<EOF
-          {
-            "\$schema": "https://schema.tauri.app/config/2",
-            "bundle": {
-              "windows": {
-                "signCommand": "pwsh -NoLogo -NoProfile -ExecutionPolicy Bypass -File ${SCRIPT_PATH} %1"
-              }
-            }
-          }
-          EOF
-          cat "$SIGN_CONF"
-          echo "SIGN_CONF=${SIGN_CONF}" >> "$GITHUB_ENV"
-
-      - name: Build and sign desktop bundle
-        shell: bash
-        working-directory: apps/examples/desktop-app
-        # NSIS only: the MSI (WiX) target adds nothing for direct-download
-        # distribution and the updater uses the NSIS artifact. $CONFIG_ARGS is
-        # deliberately unquoted: it must word-split into separate flags.
-        run: bunx tauri build --bundles nsis $CONFIG_ARGS --config "$SIGN_CONF"
-        env:
-          CONFIG_ARGS: ${{ needs.validate.outputs.channel == 'beta' && '--config src-tauri/tauri.release.conf.json --config src-tauri/tauri.beta.conf.json' || '--config src-tauri/tauri.release.conf.json' }}
-          # Telemetry inlined into the sidecar at compile time, same as macOS.
-          TELEMETRY_SERVICE_API_KEY: ${{ secrets.TELEMETRY_SERVICE_API_KEY }}
-          ERROR_SERVICE_API_KEY: ${{ secrets.ERROR_SERVICE_API_KEY }}
-          OTEL_TELEMETRY_ENABLED: ${{ secrets.OTEL_TELEMETRY_ENABLED }}
-          OTEL_LOGS_EXPORTER: otlp
-          OTEL_METRICS_EXPORTER: otlp
-          OTEL_EXPORTER_OTLP_PROTOCOL: ${{ secrets.OTEL_EXPORTER_OTLP_PROTOCOL }}
-          OTEL_EXPORTER_OTLP_ENDPOINT: ${{ secrets.OTEL_EXPORTER_OTLP_ENDPOINT }}
-          OTEL_EXPORTER_OTLP_HEADERS: ${{ secrets.OTEL_EXPORTER_OTLP_HEADERS }}
-          # Authenticode signing via scripts/tauri-sign-windows.ps1 (jsign +
-          # Azure Trusted Signing; the token comes from the azure/login session)
-          AZURE_TRUSTED_SIGNING_ENDPOINT: ${{ secrets.AZURE_TRUSTED_SIGNING_ENDPOINT }}
-          AZURE_TRUSTED_SIGNING_ACCOUNT_NAME: ${{ secrets.AZURE_TRUSTED_SIGNING_ACCOUNT_NAME }}
-          AZURE_TRUSTED_SIGNING_CERTIFICATE_PROFILE: ${{ secrets.AZURE_TRUSTED_SIGNING_CERTIFICATE_PROFILE_DESKTOP }}
-          # Updater artifact signing (minisign keypair, same key as macOS)
-          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
-          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
-
-      # Same guardrail as the macOS job: assert the compiled binary embeds
-      # this channel's updater feed URL and not the other channel's. Checked
-      # on the unbundled main exe because NSIS compresses the installer
-      # contents, which defeats a string search on the installer itself.
-      - name: Verify updater feed endpoint
-        shell: bash
-        working-directory: apps/examples/desktop-app
-        env:
-          CHANNEL: ${{ needs.validate.outputs.channel }}
-        run: |
-          case "$CHANNEL" in
-            stable)
-              WANT="releases/download/desktop-latest/latest.json"
-              FORBID="releases/download/desktop-beta/latest.json"
-              ;;
-            beta)
-              WANT="releases/download/desktop-beta/latest.json"
-              FORBID="releases/download/desktop-latest/latest.json"
-              ;;
-            *)
-              echo "unknown channel: ${CHANNEL}"
-              exit 1
-              ;;
-          esac
-
-          found=0
-          for bin in src-tauri/target/release/*.exe; do
-            if grep -a "$FORBID" "$bin" >/dev/null; then
-              echo "$bin embeds the other channel's feed URL (${FORBID})"
-              exit 1
-            fi
-            if grep -a "$WANT" "$bin" >/dev/null; then
-              found=1
-            fi
-          done
-
-          if [ "$found" -ne 1 ]; then
-            echo "No exe in src-tauri/target/release embeds ${WANT}."
-            echo "The updater endpoint overlay did not apply; check the"
-            echo "--config flags on the build step and tauri.beta.conf.json."
-            exit 1
-          fi
-          echo "Updater endpoint verified: ${WANT}"
-
-      # Same guardrail as the macOS job, run natively on the Windows sidecar.
-      - name: Verify sidecar telemetry config was inlined
-        shell: bash
-        working-directory: apps/examples/desktop-app
-        run: |
-          SELFCHECK=$(./src-tauri/bin/code-sidecar-x86_64-pc-windows-msvc.exe --telemetry-selfcheck)
-          echo "$SELFCHECK"
-          if ! printf '%s' "$SELFCHECK" | grep -q '"enabled":true'; then
-            echo "Packaged sidecar reports telemetry disabled."
-            echo "Check the OTEL_* / TELEMETRY_SERVICE_API_KEY env on the"
-            echo "'Build and sign desktop bundle' step and the --define"
-            echo "inlining in scripts/build-sidecar-bin.ts."
-            exit 1
-          fi
-          if printf '%s' "$SELFCHECK" | grep -Eq '"otlp_endpoint_host":"(invalid-endpoint-url)?"'; then
-            echo "Packaged sidecar reports telemetry enabled but its OTLP"
-            echo "endpoint is missing, unparseable, or not an http(s) URL."
-            echo "Check the OTEL_EXPORTER_OTLP_ENDPOINT secret."
-            exit 1
-          fi
-
-      - name: Collect artifacts
-        shell: bash
-        working-directory: apps/examples/desktop-app
-        env:
-          VERSION: ${{ needs.validate.outputs.version }}
-          PRODUCT: ${{ needs.validate.outputs.product }}
-        run: |
-          BUNDLE_DIR="src-tauri/target/release/bundle"
-          OUT="dist/publish"
-          mkdir -p "$OUT"
-
-          # "Cline" -> Cline, "Cline Beta" -> Cline-Beta
-          PREFIX="${PRODUCT// /-}"
-
-          SETUP=$(find "$BUNDLE_DIR/nsis" -name '*-setup.exe' -print -quit)
-          if [ -z "$SETUP" ]; then
-            echo "no NSIS installer produced under $BUNDLE_DIR/nsis"
-            exit 1
-          fi
-          # The .sig is the updater (minisign) signature; without it the
-          # manifest generator cannot publish a windows-x86_64 entry.
-          if [ ! -f "${SETUP}.sig" ]; then
-            echo "updater signature missing next to $SETUP"
-            exit 1
-          fi
-          cp "$SETUP" "$OUT/${PREFIX}_${VERSION}_x64-setup.exe"
-          cp "${SETUP}.sig" "$OUT/${PREFIX}_${VERSION}_x64-setup.exe.sig"
-
-          ls -lh "$OUT"
-
-      # Independent Authenticode gate on the exact artifact users download.
-      # The signing script already verifies each file it signs, but this step
-      # would still catch an installer that skipped signCommand entirely.
-      - name: Verify Authenticode signatures
-        shell: pwsh
-        working-directory: apps/examples/desktop-app
-        run: |
-          # The Tauri bundler signs the sidecar in place, so check it here too;
-          # a WDAC-locked machine blocks the app at runtime if the sidecar it
-          # spawns is unsigned, even when the installer itself is fine.
-          $files = @(Get-ChildItem dist/publish/*.exe) + @(Get-Item src-tauri/bin/code-sidecar-x86_64-pc-windows-msvc.exe)
-          if ($files.Count -lt 2) { throw "expected at least the installer and the sidecar to verify" }
-          foreach ($file in $files) {
-            $sig = Get-AuthenticodeSignature $file.FullName
-            if ($sig.Status -ne "Valid") {
-              throw "Invalid Authenticode signature for $($file.Name): $($sig.Status) - $($sig.StatusMessage)"
-            }
-            Write-Host "$($file.Name): Valid ($($sig.SignerCertificate.Subject))"
-          }
-
-      - name: Upload artifacts
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
-        with:
-          name: desktop-windows-x64
-          path: apps/examples/desktop-app/dist/publish/*
-          if-no-files-found: error
-
-  release:
-    name: Create GitHub release
-    needs: [validate, build, build-windows]
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ needs.validate.outputs.tag }}
-          fetch-depth: 0
-          fetch-tags: true
-
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: "1.3.13"
-
-      - name: Download artifacts
-        uses: actions/download-artifact@v4
-        with:
-          path: dist/desktop
-          merge-multiple: true
-
-      - name: Get Changelog Entry
-        id: changelog
-        env:
-          VERSION: ${{ needs.validate.outputs.version }}
-        run: |
-          # Grab content between this release's "## <version>" header and the
-          # next one. Exact match, not "first section": once main and
-          # desktop-experimental cross-merge, stable and beta sections
-          # interleave and the top section may belong to the other channel.
-          CONTENT=$(awk -v ver="$VERSION" '$0 == "## " ver {found=1; next} /^## [0-9]/ {if (found) exit} found {print}' apps/examples/desktop-app/CHANGELOG.md)
-          if [ -z "$CONTENT" ]; then
-            echo "No '## ${VERSION}' section found in apps/examples/desktop-app/CHANGELOG.md"
-            exit 1
-          fi
-          echo "content<<EOF" >> $GITHUB_OUTPUT
-          echo "$CONTENT" >> $GITHUB_OUTPUT
-          echo "EOF" >> $GITHUB_OUTPUT
-          printf "%s\n" "$CONTENT" > "$RUNNER_TEMP/release-notes.md"
-
-          # Slack section blocks reject text longer than 3000 characters, and the
-          # Slack action logs that rejection WITHOUT failing the step - so an
-          # over-long changelog silently drops the release announcement while the
-          # run stays green. Post a trimmed copy to Slack and link out to the full
-          # notes. The GitHub release body and updater manifest stay whole.
-          RELEASE_URL="https://github.com/${GITHUB_REPOSITORY}/releases/tag/${{ needs.validate.outputs.tag }}"
-          SLACK_CONTENT=$(CONTENT="$CONTENT" RELEASE_URL="$RELEASE_URL" python3 -c '
-          import os
-          content = os.environ["CONTENT"]
-          more = "\n\n… <%s|Read the full release notes>" % os.environ["RELEASE_URL"]
-          if len(content) <= 3000:
-              print(content, end="")
-          else:
-              budget = 3000 - len(more)
-              kept, used = [], 0
-              for line in content.splitlines(keepends=True):
-                  if used + len(line) > budget:
-                      break
-                  kept.append(line)
-                  used += len(line)
-              body = "".join(kept).rstrip() if kept else content[:budget].rstrip()
-              print(body + more, end="")
-          ')
-          echo "slack_content<<SLACK_EOF" >> $GITHUB_OUTPUT
-          echo "$SLACK_CONTENT" >> $GITHUB_OUTPUT
-          echo "SLACK_EOF" >> $GITHUB_OUTPUT
-
-      - name: Generate updater manifest
-        env:
-          VERSION: ${{ needs.validate.outputs.version }}
-          TAG: ${{ needs.validate.outputs.tag }}
-        run: |
-          bun apps/examples/desktop-app/scripts/generate-update-manifest.ts \
-            --version "$VERSION" \
-            --tag "$TAG" \
-            --dir dist/desktop \
-            --out dist/desktop/latest.json \
-            --repo "$GITHUB_REPOSITORY" \
-            --notes-file "$RUNNER_TEMP/release-notes.md"
-          cat dist/desktop/latest.json
-
-      - name: Get Previous Desktop Tag
-        id: prev_tag
-        env:
-          CURRENT_TAG: ${{ needs.validate.outputs.tag }}
-          CHANNEL: ${{ needs.validate.outputs.channel }}
-        run: |
-          # Stable compare links skip beta tags so they read stable -> stable;
-          # beta compares against whatever shipped last on either channel.
-          if [ "$CHANNEL" = "stable" ]; then
-            PREV_TAG=$(git describe --tags --abbrev=0 --match 'desktop-v*' --exclude 'desktop-v*-beta*' "$CURRENT_TAG^" 2>/dev/null || echo "")
-          else
-            PREV_TAG=$(git describe --tags --abbrev=0 --match 'desktop-v*' "$CURRENT_TAG^" 2>/dev/null || echo "")
-          fi
-          echo "prev_tag=$PREV_TAG" >> $GITHUB_OUTPUT
-
-      - name: Create GitHub Release
-        uses: softprops/action-gh-release@v1
-        with:
-          tag_name: ${{ needs.validate.outputs.tag }}
-          name: "Desktop v${{ needs.validate.outputs.version }}"
-          # The repo-wide "latest" release stays owned by CLI releases; the
-          # desktop auto-update feed is the rolling desktop-latest release.
-          make_latest: "false"
-          prerelease: ${{ needs.validate.outputs.channel == 'beta' }}
-          files: dist/desktop/*
-          body: |
-            ${{ steps.changelog.outputs.content }}
-
-            ${{ steps.prev_tag.outputs.prev_tag != '' && format('**Full Changelog**: https://github.com/{0}/compare/{1}...{2}', github.repository, steps.prev_tag.outputs.prev_tag, needs.validate.outputs.tag) || '' }}
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Update auto-update feed
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          CHANNEL: ${{ needs.validate.outputs.channel }}
-          FEED: ${{ needs.validate.outputs.feed }}
-        run: |
-          # Belt and braces: recompute the feed from the channel and require it
-          # to agree with validate's output, so no single threading bug can
-          # point a publish at the other channel's feed. Stable installs poll
-          # desktop-latest and beta installs poll desktop-beta; crossing the
-          # streams either pushes betas to every stable user or strands beta
-          # users on stale builds.
-          case "$CHANNEL" in
-            stable) EXPECTED_FEED=desktop-latest ;;
-            beta) EXPECTED_FEED=desktop-beta ;;
-            *)
-              echo "unknown channel: ${CHANNEL}"
-              exit 1
-              ;;
-          esac
-          if [ "$FEED" != "$EXPECTED_FEED" ]; then
-            echo "feed mismatch: validate says '${FEED}' but channel '${CHANNEL}' expects '${EXPECTED_FEED}'"
-            exit 1
-          fi
-
-          if ! gh release view "$FEED" >/dev/null 2>&1; then
-            if [ "$CHANNEL" = "beta" ]; then
-              gh release create "$FEED" \
-                --title "Cline desktop beta (auto-update feed)" \
-                --notes "Rolling release backing the beta desktop app auto-updater. The latest.json asset points at the newest desktop-vX.Y.Z-beta.N release. Only beta installs poll this feed; stable installs use desktop-latest. Do not delete." \
-                --latest=false \
-                --prerelease \
-                --target "$(git rev-parse HEAD)"
-            else
-              gh release create "$FEED" \
-                --title "Cline desktop (auto-update feed)" \
-                --notes "Rolling release backing the desktop app auto-updater. The latest.json asset points at the newest desktop-vX.Y.Z release. Do not delete." \
-                --latest=false \
-                --target "$(git rev-parse HEAD)"
-            fi
-          fi
-          gh release upload "$FEED" dist/desktop/latest.json --clobber
-
-      - name: Summary
-        env:
-          VERSION: ${{ needs.validate.outputs.version }}
-          TAG: ${{ needs.validate.outputs.tag }}
-          FEED: ${{ needs.validate.outputs.feed }}
-        run: |
-          echo "Published Cline desktop v${VERSION}"
-          echo "Release: https://github.com/${GITHUB_REPOSITORY}/releases/tag/${TAG}"
-          echo "Auto-update feed refreshed: https://github.com/${GITHUB_REPOSITORY}/releases/download/${FEED}/latest.json"
-
-      - name: Post release to Slack
-        uses: slackapi/slack-github-action@v3.0.1
-        with:
-          method: chat.postMessage
-          token: ${{ secrets.SLACK_RELEASE_BOT_TOKEN }}
-          payload: |
-            channel: "C0APVKGGZFC"
-            text: "Cline desktop v${{ needs.validate.outputs.version }}${{ needs.validate.outputs.channel == 'beta' && ' (beta)' || '' }}"
-            blocks:
-              - type: "section"
-                text:
-                  type: "mrkdwn"
-                  text: "Cline desktop v${{ needs.validate.outputs.version }}${{ needs.validate.outputs.channel == 'beta' && ' (beta)' || '' }}"
-              - type: "section"
-                text:
-                  type: "mrkdwn"
-                  text: ${{ toJSON(steps.changelog.outputs.slack_content) }}
-              - type: "context"
-                elements:
-                  - type: "mrkdwn"
-                    text: "<https://github.com/${{ github.repository }}/releases/tag/${{ needs.validate.outputs.tag }}|Download DMG> — ${{ needs.validate.outputs.channel == 'beta' && 'beta channel: installs side by side with the stable app and only beta installs auto-update; stable users are unaffected' || 'installed apps auto-update on next launch' }}${{ steps.prev_tag.outputs.prev_tag != '' && format(' | Full Changelog: https://github.com/{0}/compare/{1}...{2}', github.repository, steps.prev_tag.outputs.prev_tag, needs.validate.outputs.tag) || '' }}"

.github/workflows/desktop-test.yml

@@ -1,50 +0,0 @@
-name: desktop-test
-
-on:
-  push:
-    branches:
-      - main
-      - desktop-experimental
-    paths:
-      - "apps/examples/desktop-app/package.json"
-      - "apps/examples/desktop-app/scripts/dmg-background.ts"
-      - "apps/examples/desktop-app/scripts/dmg-background.test.ts"
-      - "apps/examples/desktop-app/src-tauri/dmg/background.png"
-      - "apps/examples/desktop-app/src-tauri/dmg/background@2x.png"
-      - ".github/workflows/desktop-test.yml"
-  pull_request:
-    branches:
-      - main
-      - desktop-experimental
-    paths:
-      - "apps/examples/desktop-app/package.json"
-      - "apps/examples/desktop-app/scripts/dmg-background.ts"
-      - "apps/examples/desktop-app/scripts/dmg-background.test.ts"
-      - "apps/examples/desktop-app/src-tauri/dmg/background.png"
-      - "apps/examples/desktop-app/src-tauri/dmg/background@2x.png"
-      - ".github/workflows/desktop-test.yml"
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  dmg-background:
-    name: Test DMG background tooling
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: apps/examples/desktop-app
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: "1.3.13"
-
-      # The suite only uses Bun/Node built-ins and committed artwork, so it does
-      # not need a workspace dependency install or macOS runner.
-      - name: Test DMG background tooling
-        run: bun run test:dmg-background

.github/workflows/e2e.yml

@@ -0,0 +1,111 @@
+name: E2E Tests
+
+on:
+    push:
+        branches:
+            - main
+    pull_request:
+        types: [opened, reopened, synchronize, ready_for_review]
+    workflow_dispatch:
+
+concurrency:
+    group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+    cancel-in-progress: true
+
+jobs:
+    matrix_prep:
+        runs-on: ubuntu-latest
+        outputs:
+            matrix: ${{ steps.set-matrix.outputs.matrix }}
+        steps:
+            - id: set-matrix
+              run: |
+                  echo 'matrix=[{"runner":"ubuntu"},{"runner":"windows"},{"runner":"macos"}]' >> $GITHUB_OUTPUT
+
+    e2e:
+        needs: matrix_prep
+        strategy:
+            fail-fast: false
+            matrix:
+                include: ${{ fromJson(needs.matrix_prep.outputs.matrix) }}
+        runs-on: ${{ matrix.runner }}-latest
+        timeout-minutes: 20
+        permissions:
+            id-token: write
+            contents: read
+        steps:
+            - uses: actions/checkout@v4
+            - name: Setup Node.js environment
+              uses: actions/setup-node@v4
+              with:
+                  node-version: 22
+
+            # Cache root dependencies - only reuse if package-lock.json exactly matches
+            - name: Cache root dependencies
+              uses: actions/cache@v4
+              id: root-cache
+              with:
+                  path: node_modules
+                  key: ${{ runner.os }}-npm-${{ hashFiles('package-lock.json') }}
+
+            # Cache webview-ui dependencies - only reuse if package-lock.json exactly matches
+            - name: Cache webview-ui dependencies
+              uses: actions/cache@v4
+              id: webview-cache
+              with:
+                  path: webview-ui/node_modules
+                  key: ${{ runner.os }}-npm-webview-${{ hashFiles('webview-ui/package-lock.json') }}
+
+            # Cache VS Code installation
+            - name: Cache VS Code
+              uses: actions/cache@v4
+              id: vscode-cache
+              with:
+                  path: .vscode-test
+                  key: vscode-${{ runner.os }}-stable-${{ hashFiles('.vscode-test.mjs', 'package.json') }}
+                  restore-keys: |
+                      vscode-${{ runner.os }}-stable-
+
+            # Cache Playwright browsers
+            - name: Cache Playwright browsers
+              uses: actions/cache@v4
+              id: playwright-cache
+              with:
+                  path: |
+                      ~/.cache/ms-playwright
+                      ~/Library/Caches/ms-playwright
+                      ~/AppData/Local/ms-playwright
+                  key: playwright-browsers-${{ runner.os }}-${{ hashFiles('package-lock.json') }}
+                  restore-keys: |
+                      playwright-browsers-${{ runner.os }}-
+
+            - name: Install root dependencies
+              run: npm ci
+              env:
+                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+            - name: Install webview-ui dependencies
+              run: cd webview-ui && npm ci
+
+            - name: Install vsce
+              run: npm install -g @vscode/vsce
+
+            - name: Install xvfb on Linux
+              if: matrix.runner == 'ubuntu'
+              run: sudo apt-get update && sudo apt-get install -y xvfb
+
+            # Run optimized E2E tests (eliminates redundant builds)
+            - name: Run E2E tests - Linux
+              if: matrix.runner == 'ubuntu'
+              run: xvfb-run -a npm run test:e2e:optimal
+
+            - name: Run E2E tests - Non-Linux
+              if: matrix.runner != 'ubuntu'
+              run: npm run test:e2e:optimal
+
+            - uses: actions/upload-artifact@v4
+              if: ${{ failure() }}
+              with:
+                  name: playwright-recordings-${{ matrix.runner }}
+                  path: |
+                      test-results/playwright/

.github/workflows/ext-jb-test-integration.yml

@@ -1,100 +0,0 @@
-name: ext-jb-test-integration
-on:
-  pull_request_target:
-    types: [opened, reopened]
-  issue_comment:
-    types: [created]
-permissions:
-  contents: read
-  pull-requests: read
-concurrency:
-  group: jetbrains-trigger-${{ github.event.pull_request.number || github.event.issue.number }}
-  cancel-in-progress: true
-
-jobs:
-  trigger-integration-test:
-    name: Run Tests
-    runs-on: ubuntu-latest
-    # Auto-run only for trusted PR authors. Anyone else needs a maintainer
-    # to opt their PR in by commenting /test-jetbrains.
-    if: |
-      (github.event_name == 'pull_request_target' &&
-       contains(fromJSON('["MEMBER","OWNER","COLLABORATOR"]'), github.event.pull_request.author_association)) ||
-      (github.event_name == 'issue_comment' &&
-       github.event.issue.pull_request &&
-       contains(github.event.comment.body, '/test-jetbrains') &&
-       contains(fromJSON('["MEMBER","OWNER","COLLABORATOR"]'), github.event.comment.author_association))
-    steps:
-      - name: Generate GitHub App Token
-        id: app-token
-        uses: actions/create-github-app-token@v1
-        with:
-          app-id: ${{ vars.CLINE_JETBRAINS_APP_ID }}
-          private-key: ${{ secrets.CLINE_JETBRAINS_APP_KEY }}
-          owner: cline
-          repositories: intellij-plugin
-
-      - name: Get PR details (for issue_comment trigger)
-        id: pr-details
-        if: github.event_name == 'issue_comment'
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          PR_DATA=$(gh api repos/${{ github.repository }}/pulls/${{ github.event.issue.number }})
-          echo "head_ref=$(echo "$PR_DATA" | jq -r '.head.ref')" >> $GITHUB_OUTPUT
-          echo "head_sha=$(echo "$PR_DATA" | jq -r '.head.sha')" >> $GITHUB_OUTPUT
-          echo "title=$(echo "$PR_DATA" | jq -r '.title')" >> $GITHUB_OUTPUT
-          echo "html_url=$(echo "$PR_DATA" | jq -r '.html_url')" >> $GITHUB_OUTPUT
-
-      - name: Sanitize untrusted inputs
-        id: sanitize
-        env:
-          RAW_BRANCH_NAME: ${{ github.event_name == 'pull_request_target' && github.head_ref || steps.pr-details.outputs.head_ref }}
-          RAW_PR_TITLE: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.title || steps.pr-details.outputs.title }}
-        run: |
-          # Sanitize branch name for JSON
-          BRANCH_NAME_JSON=$(jq -n --arg b "$RAW_BRANCH_NAME" '$b')
-          echo "branch_name=$BRANCH_NAME_JSON" >> $GITHUB_OUTPUT
-
-          # Sanitize PR title for JSON
-          PR_TITLE_JSON=$(jq -n --arg t "$RAW_PR_TITLE" '$t')
-          echo "pr_title=$PR_TITLE_JSON" >> $GITHUB_OUTPUT
-
-      - name: Trigger IntelliJ Plugin Integration Test
-        env:
-          BRANCH_NAME: ${{ steps.sanitize.outputs.branch_name }}
-          PR_TITLE: ${{ steps.sanitize.outputs.pr_title }}
-          PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
-          PR_SHA: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.sha || steps.pr-details.outputs.head_sha }}
-          PR_URL: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.html_url || steps.pr-details.outputs.html_url }}
-        run: |
-          curl -X POST \
-            -H "Authorization: Bearer ${{ steps.app-token.outputs.token }}" \
-            -H "Accept: application/vnd.github.v3+json" \
-            -H "User-Agent: cline-pr-trigger" \
-            -H "Content-Type: application/json" \
-            https://api.github.com/repos/cline/intellij-plugin/dispatches \
-            -d @- <<EOF
-          {
-            "event_type": "cline-pr-check",
-            "client_payload": {
-              "pr_number": "$PR_NUMBER",
-              "branch_name": $BRANCH_NAME,
-              "action": "${{ github.event.action }}",
-              "sha": "$PR_SHA",
-              "pr_title": $PR_TITLE,
-              "pr_url": "$PR_URL"
-            }
-          }
-          EOF
-
-      - name: Log trigger details
-        env:
-          PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
-          PR_SHA: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.sha || steps.pr-details.outputs.head_sha }}
-        run: |
-          echo "Triggered IntelliJ Plugin integration test for:"
-          echo "  PR #$PR_NUMBER"
-          echo "  Trigger: ${{ github.event_name }}"
-          echo "  Action: ${{ github.event.action }}"
-          echo "  SHA: $PR_SHA"

.github/workflows/ext-vscode-ab-package.yml

@@ -1,581 +0,0 @@
-name: ext-vscode-ab-package
-
-# Build (and optionally publish) the combined A/B VSIX: a tiny loader plus two
-# complete extension bundles — `next/` from the SDK-based apps/vscode on main,
-# `legacy/` from the legacy-extension branch. Cohort selection happens at
-# runtime via PostHog flags; see apps/vscode-rollout/README.md for the design
-# and the rollout runbook.
-#
-# Job layout: cheap input gates (preflight) and the two bundle test suites run
-# ungated; the build job packages the VSIX with no environment attached, so
-# publish=false rehearsals complete without any approval; only the publish job
-# — Marketplace + Open VSX + bookkeeping — waits on the `publish` environment.
-
-on:
-    workflow_dispatch:
-        inputs:
-            version:
-                description: "Combined VSIX version — must exceed every previously published version (e.g. 4.1.0)"
-                required: true
-                type: string
-            next-ref:
-                description: "Ref to build the next (SDK) bundle from"
-                required: true
-                default: "main"
-                type: string
-            publish:
-                description: "Publish to the VS Code Marketplace and Open VSX (unchecked: just build the .vsix artifact)"
-                required: true
-                default: false
-                type: boolean
-
-permissions:
-    contents: read
-
-concurrency:
-    group: ext-vscode-ab-package-${{ github.event.inputs.version }}
-    cancel-in-progress: false
-
-jobs:
-    # Input gates that need no checkout: fail in seconds — before the test
-    # suites, the ~20-minute build, and the environment approval — instead of
-    # at publish time.
-    preflight:
-        name: Validate inputs
-        runs-on: ubuntu-latest
-        steps:
-            # The input reaches the shell ONLY via env here (never inline
-            # expression interpolation, which is evaluated before bash runs and
-            # would allow script injection from the dispatch form). Because
-            # every later job `needs` preflight, passing this regex is what
-            # makes the plain-string `${{ inputs.version }}` interpolations
-            # downstream safe.
-            - name: Validate version format
-              env:
-                  VERSION: ${{ github.event.inputs.version }}
-              run: |
-                  if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-                    echo "Error: version must be plain X.Y.Z with no leading 'v' and no suffix (got '$VERSION')."
-                    echo "It is stamped verbatim into the union manifest and both bundle manifests."
-                    exit 1
-                  fi
-                  echo "Version format ok: $VERSION"
-
-            # The reusable bun suite tests the dispatch revision (main), so
-            # publishing any other next-ref would ship an untested bundle.
-            # Build-only runs (publish=false) may still use arbitrary next-refs
-            # for artifact rehearsals.
-            - name: Refuse to publish an untested next-ref
-              if: ${{ github.event.inputs.publish == 'true' && github.event.inputs.next-ref != 'main' }}
-              run: |
-                  echo "Error: publish=true requires next-ref=main — the test gate only covers main."
-                  exit 1
-
-            # Marketplace versions are monotonic and cannot be unpublished:
-            # every publish must exceed the highest version ever published to
-            # the claude-dev listing FROM ANY BRANCH (combined stable or legacy
-            # hotfix). The publish job re-checks right before publishing — the
-            # environment-approval wait can last days and a legacy hotfix can
-            # land in between. Keep both copies of this check in sync.
-            - name: Verify version exceeds the live Marketplace version
-              if: ${{ github.event.inputs.publish == 'true' }}
-              env:
-                  VERSION: ${{ github.event.inputs.version }}
-              run: |
-                  LIVE=$(curl -sf --retry 3 -X POST "https://marketplace.visualstudio.com/_apis/public/gallery/extensionquery" \
-                    -H "Content-Type: application/json" -H "Accept: application/json;api-version=3.0-preview.1" \
-                    --data '{"filters":[{"criteria":[{"filterType":7,"value":"saoudrizwan.claude-dev"}]}],"flags":16}' \
-                    | node -e 'let d="";process.stdin.on("data",c=>d+=c);process.stdin.on("end",()=>{process.stdout.write(JSON.parse(d).results[0].extensions[0].versions[0].version)})')
-                  if [[ -z "$LIVE" ]]; then
-                    echo "Error: could not resolve the live Marketplace version for saoudrizwan.claude-dev."
-                    exit 1
-                  fi
-                  node -e '
-                    const [next, live] = process.argv.slice(1).map((v) => v.split(".").map(Number));
-                    for (let i = 0; i < 3; i++) {
-                      if (next[i] > live[i]) process.exit(0);
-                      if (next[i] < live[i]) break;
-                    }
-                    console.error(`Error: version ${process.argv[1]} does not exceed the live Marketplace version ${process.argv[2]}.`);
-                    process.exit(1);
-                  ' "$VERSION" "$LIVE"
-                  echo "Version ok: $VERSION exceeds live Marketplace version $LIVE"
-
-    # Gate the build/publish on BOTH bundles' own test suites, mirroring the two
-    # standalone publish paths (nightly gates on the bun suite via the same
-    # reusable workflow; the legacy publish inlines the npm suite).
-    #
-    # Caveat (shared with the nightly workflow): the reusable bun suite tests the
-    # DISPATCH revision — main's tip at dispatch, since this workflow is only
-    # dispatched from main — not `next-ref`. The build job therefore pins the
-    # default next-ref checkout to that same revision (tested == built) and
-    # preflight refuses publish=true for any other next-ref; build-only artifact
-    # runs may still build untested refs.
-    test-next:
-        name: Test next (SDK) bundle
-        permissions:
-            contents: read
-            pull-requests: read
-        uses: ./.github/workflows/ext-vscode-test.yml
-
-    # The legacy branch is the npm codebase, so the bun-based reusable workflow
-    # cannot test it. Inlined npm steps, kept in sync with the `test` job in
-    # ext-vscode-publish-legacy.yml (same suite, different ref input name).
-    test-legacy:
-        name: Test legacy bundle
-        runs-on: ubuntu-latest
-        # The tested revision, exported so the build job builds EXACTLY what
-        # this suite ran against. legacy-extension is a mutable branch name and
-        # the build job starts later — re-resolving the name there could pick
-        # up commits this gate never saw.
-        outputs:
-            tested-sha: ${{ steps.rev.outputs.sha }}
-        defaults:
-            run:
-                working-directory: apps/vscode
-        steps:
-            # Always the protected legacy-extension branch — deliberately not
-            # an input. An arbitrary ref here would be built into the published
-            # VSIX by the environment-less build job, and the publish
-            # environment approver only ever sees an opaque prebuilt artifact:
-            # the approval would protect the marketplace PAT but not the
-            # shipped bytes. Hardcoding the branch makes its protection rules
-            # load-bearing for releases. Legacy hotfix testing has its own
-            # workflow (ext-vscode-publish-legacy.yml).
-            - uses: actions/checkout@v4
-              with:
-                  ref: legacy-extension
-
-            - name: Record tested revision
-              id: rev
-              run: echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
-
-            # Deliberately no dependency cache here: publish workflows do clean
-            # installs and should not restore actions caches.
-            - name: Setup Node.js
-              uses: actions/setup-node@v4
-              with:
-                  node-version: 22
-
-            - name: Install extension dependencies
-              working-directory: ${{ github.workspace }}
-              run: npm --prefix apps/vscode ci
-              env:
-                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-            - name: Install webview-ui dependencies
-              working-directory: ${{ github.workspace }}
-              run: npm --prefix apps/vscode/webview-ui ci
-
-            - name: Run Quality Checks (lint + typecheck)
-              run: npm run ci:check-all
-
-            - name: Build Tests and Extension
-              id: build_step
-              run: npm run ci:build
-
-            - name: Unit Tests
-              if: ${{ !cancelled() && steps.build_step.outcome == 'success' }}
-              run: npm run test:unit
-
-            - name: Extension Integration Tests
-              if: ${{ !cancelled() && steps.build_step.outcome == 'success' }}
-              run: xvfb-run -a npm run test:coverage
-
-            - name: Webview Tests
-              if: ${{ !cancelled() && steps.build_step.outcome == 'success' }}
-              run: |
-                  cd webview-ui
-                  npm run test:coverage
-
-    build:
-        name: Build combined (legacy + next) VSIX
-        needs: [preflight, test-next, test-legacy]
-        runs-on: ubuntu-latest
-        steps:
-            # For the default next-ref (main), pin the checkout to the exact
-            # revision the test-next gate ran against: a moving branch name could
-            # otherwise drift past the tested commit during the test phase.
-            - name: Checkout next (SDK) source
-              uses: actions/checkout@v4
-              with:
-                  ref: ${{ github.event.inputs.next-ref == 'main' && github.sha || github.event.inputs.next-ref }}
-                  path: next-src
-                  lfs: true
-
-            # Fail fast (before the ~20-min build) if a real publish is missing
-            # its changelog entry — same contract the standalone publish
-            # workflows enforce. Build-only rehearsals are exempt.
-            - name: Verify changelog entry
-              if: ${{ github.event.inputs.publish == 'true' }}
-              working-directory: next-src
-              run: |
-                  EXPECTED_HEADING="## [${{ github.event.inputs.version }}]"
-                  FIRST_HEADING=$(grep -m 1 '^## \[' CHANGELOG.md || true)
-                  if [[ "$FIRST_HEADING" != "$EXPECTED_HEADING" ]]; then
-                    echo "Error: CHANGELOG.md must start with '$EXPECTED_HEADING' before publishing (found '$FIRST_HEADING')."
-                    exit 1
-                  fi
-                  echo "Found changelog entry for ${{ github.event.inputs.version }}"
-
-            # Pin to the revision test-legacy actually tested (see that job's
-            # outputs comment) — never re-resolve the mutable branch name here.
-            - name: Checkout legacy source
-              uses: actions/checkout@v4
-              with:
-                  ref: ${{ needs.test-legacy.outputs.tested-sha }}
-                  path: legacy-src
-                  lfs: true
-
-            - uses: oven-sh/setup-bun@v2
-              with:
-                  bun-version: 1.3.14
-
-            - name: Setup Node.js
-              uses: actions/setup-node@v4
-              with:
-                  node-version: 22
-
-            # --frozen-lockfile so the built bundle resolves the exact
-            # dependency set the test-next gate ran against (the reusable suite
-            # installs frozen too) — a bare install could silently re-resolve.
-            - name: Install next workspace dependencies
-              working-directory: next-src
-              run: bun install --frozen-lockfile
-
-            # @cline/* are local workspace symlinks to source packages; apps/vscode's
-            # `package` script does NOT build them, so without this the esbuild step
-            # fails on a fresh checkout. (The nightly workflow already does this.)
-            - name: Build SDK packages
-              working-directory: next-src
-              run: bun run build:sdk
-
-            - name: Assert better-sqlite3 native binary present
-              working-directory: next-src/apps/vscode
-              run: |
-                  NODE_FILE="node_modules/better-sqlite3/build/Release/better_sqlite3.node"
-                  if [ ! -f "$NODE_FILE" ]; then
-                    echo "ERROR: better-sqlite3 native binary missing at apps/vscode/$NODE_FILE"
-                    echo "(bun trustedDependencies postinstall likely did not run)"
-                    exit 1
-                  fi
-                  echo "Found better-sqlite3 native binary: $NODE_FILE"
-
-            # Stamp the combined version into each bundle's package.json AFTER
-            # install and BEFORE its build: the About tab and telemetry
-            # extension_version read the bundle's own manifest, so without this
-            # the VSIX reports three different versions depending on where you
-            # look. (The nightly workflow gets the same alignment via nightlify.mjs.)
-            - name: Align next bundle version
-              working-directory: next-src/apps/vscode-rollout
-              run: node scripts/set-version.mjs --dir "$GITHUB_WORKSPACE/next-src/apps/vscode" --version "${{ github.event.inputs.version }}"
-
-            - name: Build next bundle
-              working-directory: next-src/apps/vscode
-              env:
-                  CLINE_ENVIRONMENT: production
-                  TELEMETRY_SERVICE_API_KEY: ${{ secrets.TELEMETRY_SERVICE_API_KEY }}
-                  ERROR_SERVICE_API_KEY: ${{ secrets.ERROR_SERVICE_API_KEY }}
-                  # Inlined by esbuild: attributes every telemetry event with
-                  # extension_variant and unlocks the bundle's authoritative
-                  # extension.rollout.bundle_activated capture. Rollout builds only.
-                  CLINE_ROLLOUT_VARIANT: next
-                  # Match the stable publish workflow's OpenTelemetry production defaults.
-                  OTEL_TELEMETRY_ENABLED: ${{ secrets.OTEL_TELEMETRY_ENABLED }}
-                  OTEL_LOGS_EXPORTER: otlp
-                  OTEL_METRICS_EXPORTER: otlp
-                  OTEL_EXPORTER_OTLP_PROTOCOL: ${{ secrets.OTEL_EXPORTER_OTLP_PROTOCOL }}
-                  OTEL_EXPORTER_OTLP_ENDPOINT: ${{ secrets.OTEL_EXPORTER_OTLP_ENDPOINT }}
-                  OTEL_EXPORTER_OTLP_HEADERS: ${{ secrets.OTEL_EXPORTER_OTLP_HEADERS }}
-              run: bun run package
-
-            - name: Install legacy dependencies
-              working-directory: legacy-src
-              run: |
-                  npm --prefix apps/vscode install --include=optional
-                  npm --prefix apps/vscode/webview-ui install --include=optional
-
-            - name: Align legacy bundle version
-              working-directory: next-src/apps/vscode-rollout
-              run: node scripts/set-version.mjs --dir "$GITHUB_WORKSPACE/legacy-src/apps/vscode" --version "${{ github.event.inputs.version }}"
-
-            - name: Build legacy bundle
-              working-directory: legacy-src/apps/vscode
-              env:
-                  CLINE_ENVIRONMENT: production
-                  TELEMETRY_SERVICE_API_KEY: ${{ secrets.TELEMETRY_SERVICE_API_KEY }}
-                  ERROR_SERVICE_API_KEY: ${{ secrets.ERROR_SERVICE_API_KEY }}
-                  CLINE_ROLLOUT_VARIANT: legacy
-                  # Match the stable publish workflow's OpenTelemetry production defaults.
-                  OTEL_TELEMETRY_ENABLED: ${{ secrets.OTEL_TELEMETRY_ENABLED }}
-                  OTEL_LOGS_EXPORTER: otlp
-                  OTEL_METRICS_EXPORTER: otlp
-                  OTEL_EXPORTER_OTLP_PROTOCOL: ${{ secrets.OTEL_EXPORTER_OTLP_PROTOCOL }}
-                  OTEL_EXPORTER_OTLP_ENDPOINT: ${{ secrets.OTEL_EXPORTER_OTLP_ENDPOINT }}
-                  OTEL_EXPORTER_OTLP_HEADERS: ${{ secrets.OTEL_EXPORTER_OTLP_HEADERS }}
-              run: npm run package
-
-            - name: Build loader and run rollout tests
-              working-directory: next-src/apps/vscode-rollout
-              env:
-                  TELEMETRY_SERVICE_API_KEY: ${{ secrets.TELEMETRY_SERVICE_API_KEY }}
-              run: |
-                  bun run typecheck
-                  bun run test
-                  bun run build:production
-
-            - name: Stitch combined VSIX staging
-              working-directory: next-src/apps/vscode-rollout
-              run: |
-                  node scripts/stitch.mjs \
-                    --next "$GITHUB_WORKSPACE/next-src/apps/vscode" \
-                    --legacy "$GITHUB_WORKSPACE/legacy-src/apps/vscode" \
-                    --loader dist/extension.js \
-                    --version "${{ github.event.inputs.version }}" \
-                    --out "$GITHUB_WORKSPACE/staging"
-
-            - name: Smoke-test loader against staging
-              working-directory: next-src/apps/vscode-rollout
-              run: node scripts/smoke-loader.mjs "$GITHUB_WORKSPACE/staging"
-
-            # This workflow publishes the STABLE identity. If nightlify ever leaks
-            # into this path the union manifest would ship under the wrong name.
-            # The bundle sub-manifest checks guard the set-version.mjs stamping:
-            # the About tab and telemetry extension_version read those files.
-            - name: Assert stable manifest identity
-              working-directory: staging
-              env:
-                  EXPECTED_VERSION: ${{ github.event.inputs.version }}
-              run: |
-                  node -e '
-                    const assert = require("node:assert");
-                    const expected = process.env.EXPECTED_VERSION;
-                    const pkg = require("./package.json");
-                    assert.equal(pkg.name, "claude-dev", `unexpected name ${pkg.name}`);
-                    assert.equal(pkg.publisher, "saoudrizwan", `unexpected publisher ${pkg.publisher}`);
-                    assert.equal(pkg.version, expected, `unexpected union version ${pkg.version}`);
-                    for (const bundle of ["next", "legacy"]) {
-                      const sub = require(`./${bundle}/package.json`);
-                      assert.equal(sub.version, expected, `unexpected ${bundle} bundle version ${sub.version}`);
-                    }
-                    console.log(`stable identity ok: ${pkg.publisher}.${pkg.name}@${pkg.version} (bundle versions aligned)`);
-                  '
-
-            - name: Package VSIX
-              working-directory: staging
-              run: |
-                  npm install -g @vscode/vsce
-                  # Preserve the narrowly scoped VSCE `sendgrid` scanner exemption used by
-                  # both standalone bundle workflows. No SendGrid credential is intentionally
-                  # supplied here; inspect the reported artifact before widening the exemption.
-                  vsce package --no-dependencies --allow-package-secrets sendgrid --out "claude-dev-${{ github.event.inputs.version }}.vsix"
-
-            - name: Upload VSIX artifact
-              uses: actions/upload-artifact@v4
-              with:
-                  name: claude-dev-${{ github.event.inputs.version }}
-                  path: staging/claude-dev-${{ github.event.inputs.version }}.vsix
-                  if-no-files-found: error
-
-    publish:
-        name: Publish to Marketplace and Open VSX
-        needs: build
-        if: ${{ github.event.inputs.publish == 'true' }}
-        runs-on: ubuntu-latest
-        environment: publish
-        # contents: write is required by the post-publish bookkeeping (tag +
-        # GitHub Release), mirroring the standalone publish workflows.
-        permissions:
-            contents: write
-        steps:
-            # The built next revision: preflight refused publish=true for any
-            # next-ref other than main, and the build job pinned main to the
-            # dispatch SHA — so github.sha IS the published commit. Used for the
-            # changelog, the release tag, and the previous-tag lookup.
-            - uses: actions/checkout@v4
-              with:
-                  ref: ${{ github.sha }}
-
-            - name: Setup Node.js
-              uses: actions/setup-node@v4
-              with:
-                  node-version: 22
-
-            - name: Download VSIX artifact
-              uses: actions/download-artifact@v4
-              with:
-                  name: claude-dev-${{ github.event.inputs.version }}
-                  path: staging
-
-            - name: Install Publishing Tools
-              run: npm install -g @vscode/vsce ovsx
-
-            # Re-check monotonicity at the last moment: the environment-approval
-            # wait can last days, and a legacy hotfix published in the meantime
-            # would otherwise be silently superseded by this older code line.
-            # Keep in sync with the preflight copy of this check.
-            - name: Re-verify version exceeds the live Marketplace version
-              env:
-                  VERSION: ${{ github.event.inputs.version }}
-              run: |
-                  LIVE=$(curl -sf --retry 3 -X POST "https://marketplace.visualstudio.com/_apis/public/gallery/extensionquery" \
-                    -H "Content-Type: application/json" -H "Accept: application/json;api-version=3.0-preview.1" \
-                    --data '{"filters":[{"criteria":[{"filterType":7,"value":"saoudrizwan.claude-dev"}]}],"flags":16}' \
-                    | node -e 'let d="";process.stdin.on("data",c=>d+=c);process.stdin.on("end",()=>{process.stdout.write(JSON.parse(d).results[0].extensions[0].versions[0].version)})')
-                  if [[ -z "$LIVE" ]]; then
-                    echo "Error: could not resolve the live Marketplace version for saoudrizwan.claude-dev."
-                    exit 1
-                  fi
-                  node -e '
-                    const [next, live] = process.argv.slice(1).map((v) => v.split(".").map(Number));
-                    for (let i = 0; i < 3; i++) {
-                      if (next[i] > live[i]) process.exit(0);
-                      if (next[i] < live[i]) break;
-                    }
-                    console.error(`Error: version ${process.argv[1]} does not exceed the live Marketplace version ${process.argv[2]}.`);
-                    process.exit(1);
-                  ' "$VERSION" "$LIVE"
-                  echo "Version ok: $VERSION exceeds live Marketplace version $LIVE"
-
-            # Both PATs are verified BEFORE the first irreversible publish so a
-            # missing Open VSX token can't strand us half-published. The two
-            # registries are separate steps: if Open VSX fails after the
-            # Marketplace accepted the VSIX, the run goes red (so the operator
-            # notices Open VSX lagged) but the bookkeeping below still runs —
-            # it is keyed off the Marketplace outcome, which is what "shipped"
-            # means for this listing.
-            - name: Publish to Marketplace
-              id: publish_marketplace
-              working-directory: staging
-              env:
-                  VSCE_PAT: ${{ secrets.VSCE_PAT }}
-                  OVSX_PAT: ${{ secrets.OVSX_PAT }}
-              run: |
-                  if [[ -z "$VSCE_PAT" ]]; then
-                    echo "Error: VSCE_PAT is required to publish."
-                    exit 1
-                  fi
-                  if [[ -z "$OVSX_PAT" ]]; then
-                    echo "Error: OVSX_PAT is required to publish to Open VSX."
-                    exit 1
-                  fi
-                  vsce publish --no-dependencies --packagePath "claude-dev-${{ github.event.inputs.version }}.vsix"
-
-            - name: Publish to Open VSX
-              working-directory: staging
-              env:
-                  OVSX_PAT: ${{ secrets.OVSX_PAT }}
-              run: npx ovsx publish --packagePath "claude-dev-${{ github.event.inputs.version }}.vsix" --pat "$OVSX_PAT"
-
-            # ---- Post-publish bookkeeping (tag / GitHub Release / Slack) ----
-            # Mirrors the standalone publish workflows. Every step here is
-            # continue-on-error, and gated on the MARKETPLACE outcome rather
-            # than plain step ordering: the Marketplace publish already
-            # happened, so bookkeeping must still run when only the Open VSX
-            # step failed, and a red run after a successful publish is exactly
-            # the confusion the nightly workflow taught us to avoid (tag pushes
-            # fail whenever the built commit touches .github/workflows/** — no
-            # grantable permission fixes that; push the tag manually in that
-            # case, see the publish-extension skill).
-
-            - name: Extract changelog entry
-              id: changelog
-              if: ${{ !cancelled() && steps.publish_marketplace.outcome == 'success' }}
-              continue-on-error: true
-              run: |
-                  CONTENT=$(awk '/^## \[/{if(found) exit; found=1; next} found{print}' CHANGELOG.md)
-                  {
-                    echo "content<<CHANGELOG_EOF"
-                    echo "$CONTENT"
-                    echo "CHANGELOG_EOF"
-                  } >> "$GITHUB_OUTPUT"
-
-                  # Slack section blocks reject text longer than 3000 characters, and
-                  # the Slack action logs that rejection WITHOUT failing the step - so
-                  # an over-long changelog silently drops the release announcement
-                  # while the run stays green. Post a trimmed copy to Slack and link
-                  # out to the full notes. The GitHub release body stays whole.
-                  RELEASE_URL="https://github.com/${GITHUB_REPOSITORY}/releases/tag/v${{ github.event.inputs.version }}"
-                  SLACK_CONTENT=$(CONTENT="$CONTENT" RELEASE_URL="$RELEASE_URL" python3 -c '
-                  import os
-                  content = os.environ["CONTENT"]
-                  more = "\n\n… <%s|Read the full release notes>" % os.environ["RELEASE_URL"]
-                  if len(content) <= 3000:
-                      print(content, end="")
-                  else:
-                      budget = 3000 - len(more)
-                      kept, used = [], 0
-                      for line in content.splitlines(keepends=True):
-                          if used + len(line) > budget:
-                              break
-                          kept.append(line)
-                          used += len(line)
-                      body = "".join(kept).rstrip() if kept else content[:budget].rstrip()
-                      print(body + more, end="")
-                  ')
-                  {
-                    echo "slack_content<<CHANGELOG_EOF"
-                    echo "$SLACK_CONTENT"
-                    echo "CHANGELOG_EOF"
-                  } >> "$GITHUB_OUTPUT"
-
-            - name: Resolve previous release tag
-              id: prev_tag
-              if: ${{ !cancelled() && steps.publish_marketplace.outcome == 'success' }}
-              continue-on-error: true
-              run: |
-                  # ls-remote needs no local tag objects; take the highest v* tag
-                  # below the one being released.
-                  PREV=$(git ls-remote --tags origin 'v*' \
-                    | awk -F/ '{print $NF}' | grep -v '\^{}' \
-                    | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' \
-                    | grep -vx "v${{ github.event.inputs.version }}" \
-                    | sort -V | tail -1)
-                  echo "prev_tag=$PREV" >> "$GITHUB_OUTPUT"
-
-            - name: Create and push release tag
-              if: ${{ !cancelled() && steps.publish_marketplace.outcome == 'success' }}
-              continue-on-error: true
-              run: |
-                  TAG="v${{ github.event.inputs.version }}"
-                  git tag "$TAG" HEAD
-                  git push origin "refs/tags/$TAG"
-                  echo "Pushed $TAG at $(git rev-parse HEAD)"
-
-            - name: Create GitHub Release
-              if: ${{ !cancelled() && steps.publish_marketplace.outcome == 'success' }}
-              continue-on-error: true
-              uses: softprops/action-gh-release@v1
-              with:
-                  tag_name: v${{ github.event.inputs.version }}
-                  files: staging/claude-dev-${{ github.event.inputs.version }}.vsix
-                  body: |
-                      ${{ steps.changelog.outputs.content }}
-
-                      **Full Changelog**: https://github.com/${{ github.repository }}/compare/${{ steps.prev_tag.outputs.prev_tag }}...v${{ github.event.inputs.version }}
-              env:
-                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-            - name: Post release to Slack
-              if: ${{ !cancelled() && steps.publish_marketplace.outcome == 'success' }}
-              continue-on-error: true
-              uses: slackapi/slack-github-action@v3.0.1
-              with:
-                  method: chat.postMessage
-                  token: ${{ secrets.SLACK_RELEASE_BOT_TOKEN }}
-                  payload: |
-                    channel: "C0APVKGGZFC"
-                    text: "Cline v${{ github.event.inputs.version }}"
-                    blocks:
-                      - type: "section"
-                        text:
-                          type: "mrkdwn"
-                          text: "*Cline v${{ github.event.inputs.version }}*"
-                      - type: "section"
-                        text:
-                          type: "mrkdwn"
-                          text: ${{ toJSON(steps.changelog.outputs.slack_content) }}
-                      - type: "context"
-                        elements:
-                          - type: "mrkdwn"
-                            text: "Full Changelog: https://github.com/${{ github.repository }}/compare/${{ steps.prev_tag.outputs.prev_tag }}...v${{ github.event.inputs.version }}"

.github/workflows/ext-vscode-publish-legacy.yml

@@ -1,327 +0,0 @@
-name: ext-vscode-publish-legacy
-
-# Publishes the legacy (pre-SDK-migration) VS Code extension from the
-# `legacy-extension` branch. This branch holds the npm-based 3.89.x codebase,
-# rolled forward under a 4.0.x version so existing 4.0.0 users still receive
-# the update. The main `ext-vscode-publish-stable.yml` workflow (bun-based)
-# stays the path for releasing main once the SDK migration is solid.
-#
-# This workflow lives on and is dispatched from `main` (so it satisfies the
-# default-branch dispatch requirement), but it checks out and builds the
-# `legacy-extension` branch.
-
-on:
-    workflow_dispatch:
-        inputs:
-            release-type:
-                description: "Choose release type (release or pre-release)"
-                required: true
-                default: "release"
-                type: choice
-                options:
-                    - pre-release
-                    - release
-
-# Read-only by default. The publish job elevates itself to contents: write for
-# the tag push and GitHub release; nothing here needs packages/checks/PR
-# write. Keeping the default minimal matters doubly in this workflow because
-# the test job runs BEFORE any environment approval — it must never hold a
-# write token while executing checked-out code.
-permissions:
-    contents: read
-
-concurrency:
-    group: ext-vscode-publish-legacy
-    cancel-in-progress: false
-
-jobs:
-    # Gate the publish on the legacy branch's own npm-based test suite. We can't
-    # reuse ./.github/workflows/ext-vscode-test.yml here — on main that's the
-    # bun-based suite and it would test main, not the legacy branch — so the
-    # essential quality + test steps are inlined against the checked-out legacy
-    # branch.
-    test:
-        name: Test Legacy Extension
-        runs-on: ubuntu-latest
-        defaults:
-          run:
-            working-directory: apps/vscode
-        steps:
-            # Always the protected legacy-extension branch — deliberately not
-            # an input. This job runs full npm lifecycle scripts from the
-            # checked-out code with no environment approval, and the publish
-            # job below does the same next to the marketplace PATs; an
-            # arbitrary ref here would hand both of them attacker-controlled
-            # code. Hardcoding the branch makes its protection rules
-            # load-bearing for releases.
-            - uses: actions/checkout@v4
-              with:
-                  ref: legacy-extension
-
-            # Deliberately no dependency cache here: publish workflows do clean
-            # installs and should not restore actions caches.
-            - name: Setup Node.js
-              uses: actions/setup-node@v4
-              with:
-                  node-version: 22
-
-            - name: Install extension dependencies
-              working-directory: ${{ github.workspace }}
-              run: npm --prefix apps/vscode ci
-              env:
-                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-            - name: Install webview-ui dependencies
-              working-directory: ${{ github.workspace }}
-              run: npm --prefix apps/vscode/webview-ui ci
-
-            - name: Run Quality Checks (lint + typecheck)
-              run: npm run ci:check-all
-
-            - name: Build Tests and Extension
-              id: build_step
-              run: npm run ci:build
-
-            - name: Unit Tests
-              if: ${{ !cancelled() && steps.build_step.outcome == 'success' }}
-              run: npm run test:unit
-
-            - name: Extension Integration Tests
-              if: ${{ !cancelled() && steps.build_step.outcome == 'success' }}
-              run: xvfb-run -a npm run test:coverage
-
-            - name: Webview Tests
-              if: ${{ !cancelled() && steps.build_step.outcome == 'success' }}
-              run: |
-                  cd webview-ui
-                  npm run test:coverage
-
-    publish:
-        needs: test
-        name: Publish Legacy Extension
-        runs-on: ubuntu-latest
-        environment: publish
-        # For the tag push in Resolve Release Tag and the GitHub release.
-        permissions:
-            contents: write
-        defaults:
-          run:
-            working-directory: apps/vscode
-
-        steps:
-            # Check out the legacy branch (NOT main; hardcoded — see the test
-            # job's checkout comment). fetch-depth: 0 + tags so we can
-            # create/push the release tag and compute the previous tag.
-            - uses: actions/checkout@v4
-              with:
-                  ref: legacy-extension
-                  fetch-depth: 0
-                  fetch-tags: true
-                  lfs: true
-
-            - name: Resolve Release Tag
-              id: resolve_tag
-              working-directory: ${{ github.workspace }}
-              env:
-                  BRANCH: legacy-extension
-              run: |
-                  # Tag is derived from the package version on the legacy branch.
-                  VERSION=$(node -p "require('./apps/vscode/package.json').version")
-                  TAG="v$VERSION"
-
-                  if [[ ! "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+([-.][0-9A-Za-z.]+)?$ ]]; then
-                    echo "Error: derived tag '$TAG' does not match vX.Y.Z"
-                    exit 1
-                  fi
-                  TAG_REF="refs/tags/$TAG"
-                  HEAD_SHA=$(git rev-parse HEAD)
-
-                  if git show-ref --verify --quiet "$TAG_REF"; then
-                    TAG_SHA=$(git rev-list -n 1 "$TAG_REF^{commit}")
-                    if [[ "$TAG_SHA" != "$HEAD_SHA" ]]; then
-                      echo "Error: tag '$TAG' already exists at $TAG_SHA, not at branch head ($HEAD_SHA)"
-                      exit 1
-                    fi
-                    echo "Tag '$TAG' already exists at branch head. Continuing."
-                  else
-                    git config user.name "github-actions[bot]"
-                    git config user.email "github-actions[bot]@users.noreply.github.com"
-                    git tag "$TAG" "$HEAD_SHA"
-                    git push origin "$TAG_REF"
-                    echo "Created and pushed tag '$TAG' from $BRANCH head $HEAD_SHA."
-                  fi
-
-                  echo "tag=$TAG" >> $GITHUB_OUTPUT
-
-            - name: Setup Node.js
-              uses: actions/setup-node@v4
-              with:
-                  node-version: 22
-
-            - name: Install extension dependencies
-              working-directory: ${{ github.workspace }}
-              run: npm --prefix apps/vscode install --include=optional
-
-            - name: Install webview-ui dependencies
-              working-directory: ${{ github.workspace }}
-              run: npm --prefix apps/vscode/webview-ui install --include=optional
-
-            - name: Install Publishing Tools
-              run: npm install -g @vscode/vsce ovsx
-
-            - name: Get Version
-              id: get_version
-              run: |
-                  VERSION=$(node -p "require('./package.json').version")
-                  echo "version=$VERSION" >> $GITHUB_OUTPUT
-
-            - name: Verify Tag Matches Package Version
-              run: |
-                  TAG="${{ steps.resolve_tag.outputs.tag }}"
-                  VERSION="v${{ steps.get_version.outputs.version }}"
-                  if [[ "$TAG" != "$VERSION" ]]; then
-                    echo "Error: tag '$TAG' does not match package version '$VERSION'"
-                    exit 1
-                  fi
-                  echo "Tag and package version match: $TAG"
-
-            - name: Verify Changelog Entry
-              working-directory: ${{ github.workspace }}
-              run: |
-                  EXPECTED_HEADING="## [${{ steps.get_version.outputs.version }}]"
-                  FIRST_HEADING=$(grep -m 1 '^## \[' CHANGELOG.md || true)
-                  if [[ "$FIRST_HEADING" != "$EXPECTED_HEADING" ]]; then
-                    echo "Error: CHANGELOG.md must start with '$EXPECTED_HEADING' before publishing."
-                    echo "Current first release heading: ${FIRST_HEADING:-<none>}"
-                    exit 1
-                  fi
-                  echo "Found changelog entry for ${{ steps.get_version.outputs.version }}"
-
-            - name: Verify Marketplace Tokens
-              env:
-                  VSCE_PAT: ${{ secrets.VSCE_PAT }}
-                  OVSX_PAT: ${{ secrets.OVSX_PAT }}
-              run: |
-                  if [[ -z "$VSCE_PAT" ]]; then
-                    echo "Error: VSCE_PAT is required to publish the stable VS Code extension."
-                    exit 1
-                  fi
-                  if [[ -z "$OVSX_PAT" ]]; then
-                    echo "Error: OVSX_PAT is required to publish the stable Open VSX extension."
-                    exit 1
-                  fi
-                  echo "Marketplace publish tokens are configured."
-
-            - name: Package and Publish Extension
-              env:
-                  VSCE_PAT: ${{ secrets.VSCE_PAT }}
-                  OVSX_PAT: ${{ secrets.OVSX_PAT }}
-                  CLINE_ENVIRONMENT: production
-                  TELEMETRY_SERVICE_API_KEY: ${{ secrets.TELEMETRY_SERVICE_API_KEY }}
-                  ERROR_SERVICE_API_KEY: ${{ secrets.ERROR_SERVICE_API_KEY }}
-                  # OpenTelemetry production defaults (can be overridden at runtime)
-                  OTEL_TELEMETRY_ENABLED: ${{ secrets.OTEL_TELEMETRY_ENABLED }}
-                  OTEL_LOGS_EXPORTER: otlp
-                  OTEL_METRICS_EXPORTER: otlp
-                  OTEL_EXPORTER_OTLP_PROTOCOL: ${{ secrets.OTEL_EXPORTER_OTLP_PROTOCOL }}
-                  OTEL_EXPORTER_OTLP_ENDPOINT: ${{ secrets.OTEL_EXPORTER_OTLP_ENDPOINT }}
-                  OTEL_EXPORTER_OTLP_HEADERS: ${{ secrets.OTEL_EXPORTER_OTLP_HEADERS }}
-                  RELEASE_TYPE: ${{ github.event.inputs.release-type }}
-              run: |
-                  # Swap README.marketplace.md into README.md so both the GitHub
-                  # release artifact (vsce package below) and the marketplace
-                  # publish (npm run publish:marketplace below, which swaps
-                  # internally as an idempotent no-op) ship the same README.
-                  node scripts/marketplace-readme.mjs swap-in
-                  trap 'node scripts/marketplace-readme.mjs restore' EXIT
-
-                  # Required to generate the .vsix
-                  vsce package --allow-package-secrets sendgrid --out "cline-${{ steps.get_version.outputs.version }}.vsix"
-
-                  if [ "$RELEASE_TYPE" = "pre-release" ]; then
-                    npm run publish:marketplace:prerelease
-                    echo "Successfully published pre-release version ${{ steps.get_version.outputs.version }} to VS Code Marketplace and Open VSX Registry"
-                  else
-                    npm run publish:marketplace
-                    echo "Successfully published release version ${{ steps.get_version.outputs.version }} to VS Code Marketplace and Open VSX Registry"
-                  fi
-
-            - name: Get Previous Tag
-              id: prev_tag
-              working-directory: ${{ github.workspace }}
-              run: |
-                  CURRENT_TAG="${{ steps.resolve_tag.outputs.tag }}"
-                  PREV_TAG=$(git describe --tags --abbrev=0 "$CURRENT_TAG^" 2>/dev/null || echo "")
-                  echo "prev_tag=$PREV_TAG" >> $GITHUB_OUTPUT
-
-            - name: Get Changelog Entry
-              id: changelog
-              working-directory: ${{ github.workspace }}
-              run: |
-                  # Get content between first ## [ and second ## [
-                  CONTENT=$(awk '/^## \[/{if(found) exit; found=1; next} found{print}' CHANGELOG.md)
-                  echo "content<<EOF" >> $GITHUB_OUTPUT
-                  echo "$CONTENT" >> $GITHUB_OUTPUT
-                  echo "EOF" >> $GITHUB_OUTPUT
-
-                  # Slack section blocks reject text longer than 3000 characters, and
-                  # the Slack action logs that rejection WITHOUT failing the step - so
-                  # an over-long changelog silently drops the release announcement
-                  # while the run stays green. Post a trimmed copy to Slack and link
-                  # out to the full notes. The GitHub release body stays whole.
-                  RELEASE_URL="https://github.com/${GITHUB_REPOSITORY}/releases/tag/${{ steps.resolve_tag.outputs.tag }}"
-                  SLACK_CONTENT=$(CONTENT="$CONTENT" RELEASE_URL="$RELEASE_URL" python3 -c '
-                  import os
-                  content = os.environ["CONTENT"]
-                  more = "\n\n… <%s|Read the full release notes>" % os.environ["RELEASE_URL"]
-                  if len(content) <= 3000:
-                      print(content, end="")
-                  else:
-                      budget = 3000 - len(more)
-                      kept, used = [], 0
-                      for line in content.splitlines(keepends=True):
-                          if used + len(line) > budget:
-                              break
-                          kept.append(line)
-                          used += len(line)
-                      body = "".join(kept).rstrip() if kept else content[:budget].rstrip()
-                      print(body + more, end="")
-                  ')
-                  echo "slack_content<<SLACK_EOF" >> $GITHUB_OUTPUT
-                  echo "$SLACK_CONTENT" >> $GITHUB_OUTPUT
-                  echo "SLACK_EOF" >> $GITHUB_OUTPUT
-
-            - name: Create GitHub Release
-              uses: softprops/action-gh-release@v1
-              with:
-                  tag_name: ${{ steps.resolve_tag.outputs.tag }}
-                  files: "apps/vscode/*.vsix"
-                  body: |
-                      ${{ steps.changelog.outputs.content }}
-
-                      **Full Changelog**: https://github.com/${{ github.repository }}/compare/${{ steps.prev_tag.outputs.prev_tag }}...${{ steps.resolve_tag.outputs.tag }}
-                  prerelease: ${{ github.event.inputs.release-type == 'pre-release' }}
-              env:
-                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-            - name: Post release to Slack
-              uses: slackapi/slack-github-action@v3.0.1
-              with:
-                  method: chat.postMessage
-                  token: ${{ secrets.SLACK_RELEASE_BOT_TOKEN }}
-                  payload: |
-                    channel: "C0APVKGGZFC"
-                    text: "Cline ${{ steps.resolve_tag.outputs.tag }} (legacy)"
-                    blocks:
-                      - type: "section"
-                        text:
-                          type: "mrkdwn"
-                          text: "*Cline ${{ steps.resolve_tag.outputs.tag }} (legacy)*"
-                      - type: "section"
-                        text:
-                          type: "mrkdwn"
-                          text: ${{ toJSON(steps.changelog.outputs.slack_content) }}
-                      - type: "context"
-                        elements:
-                          - type: "mrkdwn"
-                            text: "Full Changelog: https://github.com/${{ github.repository }}/compare/${{ steps.prev_tag.outputs.prev_tag }}...${{ steps.resolve_tag.outputs.tag }}"

.github/workflows/ext-vscode-publish-nightly.yml

@@ -1,306 +0,0 @@
-name: ext-vscode-publish-nightly
-
-# Publishes saoudrizwan.cline-nightly as the COMBINED A/B VSIX: the rollout
-# loader plus two complete extension bundles — `next/` from this ref's
-# apps/vscode (SDK-based) and `legacy/` from the legacy-extension branch.
-# Cohort selection happens at runtime via PostHog flags; see
-# apps/vscode-rollout/README.md for the design and rollout runbook.
-#
-# The stable-identity equivalent of this pipeline is ext-vscode-ab-package.yml
-# (manual dispatch, publishes claude-dev). Shared logic lives in
-# apps/vscode-rollout/scripts (nightlify/gen-manifest/stitch/smoke) so both
-# workflows stay thin. The single-bundle nightly path this replaced
-# (apps/vscode/scripts/publish-nightly.mjs) remains for manual feature-branch
-# pre-release publishes.
-
-on:
-  # Manual dispatch only. The nightly cron was removed deliberately: the
-  # PublishNightly environment gained required reviewers, and an unattended
-  # cron run would just sit `waiting` on that approval, hold this workflow's
-  # concurrency group, and silently cancel every later scheduled run behind it
-  # (that is exactly what happened between 2026-07-31 and 2026-08-21, killing
-  # 20 consecutive nightlies). Cut a nightly by dispatching this workflow.
-  workflow_dispatch:
-    inputs:
-      legacy-ref:
-        description: "Ref to build the legacy bundle from"
-        required: false
-        default: "legacy-extension"
-        type: string
-      dry-run:
-        description: "Build and upload the .vsix artifact without publishing or tagging"
-        required: false
-        default: false
-        type: boolean
-
-run-name: "Publish Combined Nightly from ${{ github.ref_name }} @ ${{ github.sha }}"
-
-# Prevent concurrent publish runs on the same branch: the version is generated
-# from a seconds-resolution timestamp, so parallel runs on the same ref can
-# collide on the same version and cause publish failures or inconsistent tagging.
-concurrency:
-  group: ext-vscode-publish-nightly-${{ github.ref }}
-  cancel-in-progress: false
-
-permissions: {}
-
-jobs:
-  test:
-    if: github.repository == 'cline/cline'
-    permissions:
-      contents: read
-      pull-requests: read
-    uses: ./.github/workflows/ext-vscode-test.yml
-
-  publish:
-    needs: test
-    permissions:
-      contents: write
-    name: Publish Cline (Nightly) Combined Extension
-    # Defense in depth: only protected main may enter the publishing environment.
-    # This `if` is advisory because a dispatched branch runs its own copy of this
-    # file; the enforced gate is the PublishNightly environment's deployment-branch
-    # policy, which must also allow only main.
-    if: github.repository == 'cline/cline' && github.ref == 'refs/heads/main'
-    runs-on: ubuntu-latest
-    environment: PublishNightly
-
-    steps:
-      - name: Checkout next (SDK) source
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.sha }}
-          path: next-src
-          lfs: true
-          persist-credentials: false
-
-      - name: Checkout legacy source
-        uses: actions/checkout@v4
-        with:
-          # NOTE: the || fallback is retained so this stays correct if a
-          # non-dispatch trigger is ever added back (inputs are empty strings
-          # on e.g. `schedule` events, where the declared default does not apply).
-          ref: ${{ inputs.legacy-ref || 'legacy-extension' }}
-          path: legacy-src
-          lfs: true
-          persist-credentials: false
-
-      - name: Show build sources
-        env:
-          # Routed through env rather than interpolated into the script body so
-          # a crafted dispatch input can't inject shell (hygiene: dispatchers
-          # need write access anyway, but keep the pattern clean).
-          LEGACY_REF: ${{ inputs.legacy-ref || 'legacy-extension' }}
-        run: |
-          echo "next:   $(git -C next-src rev-parse HEAD)"
-          echo "legacy: $(git -C legacy-src rev-parse HEAD) ($LEGACY_REF)"
-
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: 1.3.14
-
-      # Node is required beyond install: the rollout scripts run under node and
-      # publishing shells out to vsce/ovsx. Pinned to Node 22 because newer LTS
-      # (Node 24 / npm 11) can make vsce's dependency detection fail.
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 22
-
-      # ONE version for the next bundle, the legacy bundle, and the union
-      # manifest: gen-manifest hard-fails if the bundle identities diverge.
-      # Same scheme as the standalone nightly: <major>.<minor>.<unix-seconds>
-      # from next's base version, so it keeps outranking earlier nightlies.
-      - name: Compute nightly version
-        id: version
-        run: |
-          BASE=$(node -p "require('./next-src/apps/vscode/package.json').version")
-          VERSION="$(echo "$BASE" | cut -d. -f1,2).$(date +%s)"
-          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
-          echo "Combined nightly version: $VERSION (base $BASE)"
-
-      - name: Install next workspace dependencies
-        working-directory: next-src
-        run: bun install --frozen-lockfile
-
-      - name: Build SDK packages
-        working-directory: next-src
-        run: bun run build:sdk
-
-      - name: Assert better-sqlite3 native binary present
-        working-directory: next-src/apps/vscode
-        run: |
-          NODE_FILE="node_modules/better-sqlite3/build/Release/better_sqlite3.node"
-          if [ ! -f "$NODE_FILE" ]; then
-            echo "ERROR: better-sqlite3 native binary missing at apps/vscode/$NODE_FILE"
-            echo "(bun trustedDependencies postinstall likely did not run)"
-            exit 1
-          fi
-          echo "Found better-sqlite3 native binary: $NODE_FILE"
-
-      # Rewrite each bundle's package.json to the cline-nightly identity BEFORE
-      # its build (runtime command/config IDs derive from the manifest) and
-      # AFTER dependency install (workspace self-links key off the original
-      # package name).
-      - name: Nightlify next bundle manifest
-        working-directory: next-src/apps/vscode-rollout
-        run: node scripts/nightlify.mjs --dir "$GITHUB_WORKSPACE/next-src/apps/vscode" --version "${{ steps.version.outputs.version }}"
-
-      - name: Build next bundle
-        working-directory: next-src/apps/vscode
-        env:
-          CLINE_ENVIRONMENT: production
-          TELEMETRY_SERVICE_API_KEY: ${{ secrets.TELEMETRY_SERVICE_API_KEY }}
-          ERROR_SERVICE_API_KEY: ${{ secrets.ERROR_SERVICE_API_KEY }}
-          # Inlined by esbuild: attributes every telemetry event with
-          # extension_variant and unlocks the bundle's authoritative
-          # extension.rollout.bundle_activated capture. Rollout builds only.
-          CLINE_ROLLOUT_VARIANT: next
-          # OpenTelemetry production defaults (can be overridden at runtime)
-          OTEL_TELEMETRY_ENABLED: ${{ secrets.OTEL_TELEMETRY_ENABLED }}
-          OTEL_LOGS_EXPORTER: otlp
-          OTEL_METRICS_EXPORTER: otlp
-          OTEL_EXPORTER_OTLP_PROTOCOL: ${{ secrets.OTEL_EXPORTER_OTLP_PROTOCOL }}
-          OTEL_EXPORTER_OTLP_ENDPOINT: ${{ secrets.OTEL_EXPORTER_OTLP_ENDPOINT }}
-          OTEL_EXPORTER_OTLP_HEADERS: ${{ secrets.OTEL_EXPORTER_OTLP_HEADERS }}
-        run: bun run package
-
-      - name: Install legacy dependencies
-        working-directory: legacy-src
-        run: |
-          npm --prefix apps/vscode install --include=optional
-          npm --prefix apps/vscode/webview-ui install --include=optional
-
-      - name: Nightlify legacy bundle manifest
-        working-directory: next-src/apps/vscode-rollout
-        run: node scripts/nightlify.mjs --dir "$GITHUB_WORKSPACE/legacy-src/apps/vscode" --version "${{ steps.version.outputs.version }}"
-
-      - name: Build legacy bundle
-        working-directory: legacy-src/apps/vscode
-        env:
-          CLINE_ENVIRONMENT: production
-          TELEMETRY_SERVICE_API_KEY: ${{ secrets.TELEMETRY_SERVICE_API_KEY }}
-          ERROR_SERVICE_API_KEY: ${{ secrets.ERROR_SERVICE_API_KEY }}
-          CLINE_ROLLOUT_VARIANT: legacy
-          # Legacy's esbuild inlines these too (its own publish workflow passes
-          # them) — omitting them here would ship the legacy bundle with the
-          # OTel pipeline dead, unlike what legacy users get today.
-          OTEL_TELEMETRY_ENABLED: ${{ secrets.OTEL_TELEMETRY_ENABLED }}
-          OTEL_LOGS_EXPORTER: otlp
-          OTEL_METRICS_EXPORTER: otlp
-          OTEL_EXPORTER_OTLP_PROTOCOL: ${{ secrets.OTEL_EXPORTER_OTLP_PROTOCOL }}
-          OTEL_EXPORTER_OTLP_ENDPOINT: ${{ secrets.OTEL_EXPORTER_OTLP_ENDPOINT }}
-          OTEL_EXPORTER_OTLP_HEADERS: ${{ secrets.OTEL_EXPORTER_OTLP_HEADERS }}
-        run: npm run package
-
-      - name: Build loader and run rollout tests
-        working-directory: next-src/apps/vscode-rollout
-        env:
-          TELEMETRY_SERVICE_API_KEY: ${{ secrets.TELEMETRY_SERVICE_API_KEY }}
-        run: |
-          bun run typecheck
-          bun run test
-          bun run build:production
-
-      - name: Stitch combined VSIX staging
-        working-directory: next-src/apps/vscode-rollout
-        run: |
-          node scripts/stitch.mjs \
-            --next "$GITHUB_WORKSPACE/next-src/apps/vscode" \
-            --legacy "$GITHUB_WORKSPACE/legacy-src/apps/vscode" \
-            --loader dist/extension.js \
-            --version "${{ steps.version.outputs.version }}" \
-            --out "$GITHUB_WORKSPACE/staging"
-
-      - name: Smoke-test loader against staging
-        working-directory: next-src/apps/vscode-rollout
-        run: node scripts/smoke-loader.mjs "$GITHUB_WORKSPACE/staging"
-
-      # The nightly identity must have fully propagated (nightlify -> both
-      # bundle manifests -> union manifest) or we'd publish over the stable
-      # extension ID. The bundle sub-manifest checks guard the version
-      # stamping: the About tab and telemetry extension_version read those.
-      - name: Assert nightly manifest identity
-        working-directory: staging
-        env:
-          EXPECTED_VERSION: ${{ steps.version.outputs.version }}
-        run: |
-          node -e '
-            const assert = require("node:assert");
-            const expected = process.env.EXPECTED_VERSION;
-            const pkg = require("./package.json");
-            assert.equal(pkg.name, "cline-nightly", `unexpected name ${pkg.name}`);
-            assert.equal(pkg.publisher, "saoudrizwan", `unexpected publisher ${pkg.publisher}`);
-            assert.equal(pkg.version, expected, `unexpected union version ${pkg.version}`);
-            for (const bundle of ["next", "legacy"]) {
-              const sub = require(`./${bundle}/package.json`);
-              assert.equal(sub.name, "cline-nightly", `unexpected ${bundle} bundle name ${sub.name}`);
-              assert.equal(sub.version, expected, `unexpected ${bundle} bundle version ${sub.version}`);
-            }
-            console.log(`nightly identity ok: ${pkg.publisher}.${pkg.name}@${pkg.version} (bundle identities aligned)`);
-          '
-
-      - name: Install Publishing Tools
-        run: npm install -g @vscode/vsce ovsx
-
-      - name: Package VSIX
-        working-directory: staging
-        # Preserve the narrowly scoped VSCE `sendgrid` scanner exemption used by
-        # both standalone bundle workflows. No SendGrid credential is intentionally
-        # supplied here; inspect the reported artifact before widening the exemption.
-        run: vsce package --no-dependencies --allow-package-secrets sendgrid --out "cline-nightly-${{ steps.version.outputs.version }}.vsix"
-
-      - name: Upload VSIX artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: cline-nightly-${{ steps.version.outputs.version }}
-          path: staging/cline-nightly-${{ steps.version.outputs.version }}.vsix
-          if-no-files-found: error
-
-      # The job is main-only; step-level dry-run gating still permits a build-only
-      # rehearsal without publishing or tagging.
-      - name: Publish to VS Code Marketplace and Open VSX
-        if: github.ref == 'refs/heads/main' && inputs.dry-run != true
-        working-directory: staging
-        env:
-          VSCE_PAT: ${{ secrets.VSCE_PAT }}
-          OVSX_PAT: ${{ secrets.OVSX_PAT }}
-        run: |
-          if [[ -z "$VSCE_PAT" ]]; then
-            echo "Error: VSCE_PAT is required to publish."
-            exit 1
-          fi
-          vsce publish --no-dependencies --packagePath "cline-nightly-${{ steps.version.outputs.version }}.vsix"
-          if [[ -n "$OVSX_PAT" ]]; then
-            npx ovsx publish --packagePath "cline-nightly-${{ steps.version.outputs.version }}.vsix" --pat "$OVSX_PAT"
-          else
-            echo "WARNING: OVSX_PAT not set; skipping Open VSX publish."
-          fi
-
-      - name: Tag published commit
-        if: github.ref == 'refs/heads/main' && inputs.dry-run != true
-        # Best-effort bookkeeping: the default GITHUB_TOKEN cannot create a ref
-        # whose commit modifies workflow files (no workflows permission exists
-        # for it), so this step fails whenever HEAD touched .github/workflows.
-        # The publish already succeeded by this point — don't mark the run red;
-        # push the tag manually with user credentials when it matters.
-        continue-on-error: true
-        working-directory: next-src
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          SAFE_REF=$(echo "$GITHUB_REF_NAME" | tr '/[:upper:]' '-[:lower:]' | tr -cd 'a-z0-9._-')
-          SHORT_SHA=$(git rev-parse --short=12 HEAD)
-          TIMESTAMP=$(date -u +"%Y%m%d%H%M%S")
-          TAG="nightly-${SAFE_REF}-${TIMESTAMP}-${SHORT_SHA}"
-          LEGACY_SHA=$(git -C "$GITHUB_WORKSPACE/legacy-src" rev-parse HEAD)
-
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-          git tag -a "$TAG" -m "Cline Nightly (combined A/B) published from ${GITHUB_REF_NAME} at ${GITHUB_SHA} (legacy bundle: ${LEGACY_SHA})"
-          # Use an explicit HTTPS remote with GH_TOKEN because checkout was run with
-          # persist-credentials: false, so actions/checkout did not persist a git credential helper.
-          git push "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" "refs/tags/${TAG}"
-
-          echo "Tagged published commit: $TAG"

.github/workflows/ext-vscode-publish-stable.yml

@@ -1,337 +0,0 @@
-name: ext-vscode-publish-stable
-
-on:
-    workflow_dispatch:
-        inputs:
-            release-type:
-                description: "Choose release type (release or pre-release)"
-                required: true
-                default: "release"
-                type: choice
-                options:
-                    - pre-release
-                    - release
-            auto_create_tag_from_main:
-                description: "Auto-create and push the provided tag from the tested main commit (recommended)"
-                required: true
-                default: true
-                type: boolean
-            tag:
-                description: "Tag to publish (required in both modes, e.g., v3.1.2)"
-                required: true
-                type: string
-
-permissions:
-    contents: write
-    packages: write
-    checks: write
-    pull-requests: write
-
-concurrency:
-    group: ext-vscode-publish-stable-${{ github.event.inputs.tag }}
-    cancel-in-progress: false
-
-jobs:
-    test:
-        uses: ./.github/workflows/ext-vscode-test.yml
-
-    publish:
-        needs: test
-        name: Publish Extension
-        runs-on: ubuntu-latest
-        environment: publish
-        defaults:
-          run:
-            working-directory: apps/vscode
-
-        steps:
-            - uses: actions/checkout@v4
-              with:
-                  ref: main
-                  fetch-depth: 0
-                  fetch-tags: true
-                  lfs: true
-
-            - name: Resolve Release Tag
-              id: resolve_tag
-              working-directory: ${{ github.workspace }}
-              env:
-                  TAG: ${{ github.event.inputs.tag }}
-                  AUTO_CREATE: ${{ github.event.inputs.auto_create_tag_from_main }}
-              run: |
-                  TESTED_SHA="${{ github.sha }}"
-                  WORKFLOW_REF="${{ github.ref }}"
-
-                  if [[ -z "$TAG" ]]; then
-                    echo "Error: tag input is required"
-                    exit 1
-                  fi
-
-                  if [[ ! "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+([-.][0-9A-Za-z.]+)?$ ]]; then
-                    echo "Error: tag must match vX.Y.Z (optionally with -suffix or .suffix)"
-                    exit 1
-                  fi
-                  TAG_REF="refs/tags/$TAG"
-
-                  git fetch origin main --tags
-
-                  if [[ "$AUTO_CREATE" == "true" ]]; then
-                    if [[ "$WORKFLOW_REF" != "refs/heads/main" ]]; then
-                      echo "Error: auto-create mode requires dispatching from main (current ref: $WORKFLOW_REF)"
-                      exit 1
-                    fi
-                    echo "Auto-create enabled. Using tested workflow SHA: $TESTED_SHA"
-
-                    if ! git merge-base --is-ancestor "$TESTED_SHA" origin/main; then
-                      echo "Error: tested SHA $TESTED_SHA is not on origin/main"
-                      exit 1
-                    fi
-
-                    if git show-ref --verify --quiet "$TAG_REF"; then
-                      TAG_SHA=$(git rev-list -n 1 "$TAG_REF^{commit}")
-                      if [[ "$TAG_SHA" != "$TESTED_SHA" ]]; then
-                        echo "Error: tag '$TAG' already exists at $TAG_SHA, not at tested SHA ($TESTED_SHA)"
-                        exit 1
-                      fi
-                      echo "Tag '$TAG' already exists at tested SHA. Continuing."
-                    else
-                      git config user.name "github-actions[bot]"
-                      git config user.email "github-actions[bot]@users.noreply.github.com"
-                      git tag "$TAG" "$TESTED_SHA"
-                      git push origin "$TAG_REF"
-                      echo "Created and pushed tag '$TAG' from tested SHA $TESTED_SHA."
-                    fi
-                  else
-                    if ! git show-ref --verify --quiet "$TAG_REF"; then
-                      echo "Error: tag '$TAG' does not exist in the repository"
-                      exit 1
-                    fi
-                    TAG_SHA=$(git rev-list -n 1 "$TAG_REF^{commit}")
-                    if [[ "$TAG_SHA" != "$TESTED_SHA" ]]; then
-                      echo "Error: existing tag '$TAG' points to $TAG_SHA, but this workflow tested $TESTED_SHA"
-                      echo "Dispatch from the tag ref, or from the exact main commit the tag points to."
-                      exit 1
-                    fi
-                    echo "Using existing tag '$TAG' at tested SHA $TESTED_SHA."
-                  fi
-
-                  git checkout --detach "$TAG_REF^{commit}"
-                  echo "tag=$TAG" >> $GITHUB_OUTPUT
-                  echo "resolved_sha=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
-
-            - name: Setup Bun
-              uses: oven-sh/setup-bun@v2
-              with:
-                  bun-version: 1.3.14
-
-            # Node is still REQUIRED in the publish job (not just for install): the
-            # publish scripts run as `node scripts/publish-*.mjs`, the version step uses
-            # `node -p`, and `npx ovsx` needs npm. setup-bun does not provide a Node
-            # runtime, so keep setup-node. Pinned to Node 22 because newer LTS
-            # (Node 24 / npm 11) can make vsce's `npm list` detection fail with
-            # ELSPROBLEMS during packaging.
-            - name: Setup Node.js
-              uses: actions/setup-node@v4
-              with:
-                  node-version: 22
-
-            # Single root install resolves the whole bun workspace at once (replaces the
-            # per-package `npm install` steps for apps/vscode + webview-ui).
-            - name: Install workspace dependencies
-              working-directory: ${{ github.workspace }}
-              run: bun install --frozen-lockfile
-
-            # @cline/* are local workspace symlinks to source packages; build dist/ before
-            # packaging/publishing the extension.
-            - name: Build SDK packages
-              working-directory: ${{ github.workspace }}
-              run: bun run build:sdk
-
-            - name: Assert better-sqlite3 native binary present
-              run: |
-                  NODE_FILE="node_modules/better-sqlite3/build/Release/better_sqlite3.node"
-                  if [ ! -f "$NODE_FILE" ]; then
-                    echo "ERROR: better-sqlite3 native binary missing at apps/vscode/$NODE_FILE"
-                    echo "(bun trustedDependencies postinstall likely did not run)"
-                    exit 1
-                  fi
-                  echo "Found better-sqlite3 native binary: $NODE_FILE"
-
-            # vsce is a workspace devDependency (on node_modules/.bin), but ovsx is not
-            # vendored and the publish script invokes it via `npx ovsx`, so install ovsx
-            # globally (npm is available via setup-node). vsce is installed globally too
-            # to preserve the script's existing PATH expectations.
-            - name: Install Publishing Tools
-              run: npm install -g @vscode/vsce ovsx
-
-            - name: Get Version
-              id: get_version
-              run: |
-                  VERSION=$(node -p "require('./package.json').version")
-                  echo "version=$VERSION" >> $GITHUB_OUTPUT
-
-            - name: Verify Tag Matches Package Version
-              run: |
-                  TAG="${{ steps.resolve_tag.outputs.tag }}"
-                  VERSION="v${{ steps.get_version.outputs.version }}"
-                  if [[ "$TAG" != "$VERSION" ]]; then
-                    echo "Error: tag '$TAG' does not match package version '$VERSION'"
-                    exit 1
-                  fi
-                  echo "Tag and package version match: $TAG"
-
-            - name: Verify Changelog Entry
-              working-directory: ${{ github.workspace }}
-              run: |
-                  EXPECTED_HEADING="## [${{ steps.get_version.outputs.version }}]"
-                  FIRST_HEADING=$(grep -m 1 '^## \[' CHANGELOG.md || true)
-                  if [[ "$FIRST_HEADING" != "$EXPECTED_HEADING" ]]; then
-                    echo "Error: CHANGELOG.md must start with '$EXPECTED_HEADING' before publishing."
-                    echo "Current first release heading: ${FIRST_HEADING:-<none>}"
-                    exit 1
-                  fi
-                  echo "Found changelog entry for ${{ steps.get_version.outputs.version }}"
-
-            - name: Verify Marketplace Tokens
-              env:
-                  VSCE_PAT: ${{ secrets.VSCE_PAT }}
-                  OVSX_PAT: ${{ secrets.OVSX_PAT }}
-              run: |
-                  if [[ -z "$VSCE_PAT" ]]; then
-                    echo "Error: VSCE_PAT is required to publish the stable VS Code extension."
-                    exit 1
-                  fi
-                  if [[ -z "$OVSX_PAT" ]]; then
-                    echo "Error: OVSX_PAT is required to publish the stable Open VSX extension."
-                    exit 1
-                  fi
-                  echo "Marketplace publish tokens are configured."
-
-            - name: Get Previous Tag
-              id: prev_tag
-              working-directory: ${{ github.workspace }}
-              run: |
-                  CURRENT_TAG="${{ steps.resolve_tag.outputs.tag }}"
-                  PREV_TAG=$(
-                    git tag --merged "$CURRENT_TAG^" --list 'v[0-9]*.[0-9]*.[0-9]*' --sort=-v:refname \
-                      | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+([-.][0-9A-Za-z.]+)?$' \
-                      | head -n 1 || true
-                  )
-                  echo "prev_tag=$PREV_TAG" >> $GITHUB_OUTPUT
-
-            - name: Get Changelog Entry
-              id: changelog
-              working-directory: ${{ github.workspace }}
-              run: |
-                  # Get content between the matching version heading and the next release heading.
-                  CONTENT=$(awk -v version="${{ steps.get_version.outputs.version }}" '
-                    $0 == "## [" version "]" { found=1; next }
-                    found && /^## \[/ { exit }
-                    found { print }
-                    END { if (!found) exit 1 }
-                  ' CHANGELOG.md)
-                  echo "content<<EOF" >> $GITHUB_OUTPUT
-                  echo "$CONTENT" >> $GITHUB_OUTPUT
-                  echo "EOF" >> $GITHUB_OUTPUT
-
-                  # Slack section blocks reject text longer than 3000 characters, and
-                  # the Slack action logs that rejection WITHOUT failing the step - so
-                  # an over-long changelog silently drops the release announcement
-                  # while the run stays green. Post a trimmed copy to Slack and link
-                  # out to the full notes. The GitHub release body stays whole.
-                  RELEASE_URL="https://github.com/${GITHUB_REPOSITORY}/releases/tag/${{ steps.resolve_tag.outputs.tag }}"
-                  SLACK_CONTENT=$(CONTENT="$CONTENT" RELEASE_URL="$RELEASE_URL" python3 -c '
-                  import os
-                  content = os.environ["CONTENT"]
-                  more = "\n\n… <%s|Read the full release notes>" % os.environ["RELEASE_URL"]
-                  if len(content) <= 3000:
-                      print(content, end="")
-                  else:
-                      budget = 3000 - len(more)
-                      kept, used = [], 0
-                      for line in content.splitlines(keepends=True):
-                          if used + len(line) > budget:
-                              break
-                          kept.append(line)
-                          used += len(line)
-                      body = "".join(kept).rstrip() if kept else content[:budget].rstrip()
-                      print(body + more, end="")
-                  ')
-                  echo "slack_content<<SLACK_EOF" >> $GITHUB_OUTPUT
-                  echo "$SLACK_CONTENT" >> $GITHUB_OUTPUT
-                  echo "SLACK_EOF" >> $GITHUB_OUTPUT
-
-            - name: Package and Publish Extension
-              env:
-                  VSCE_PAT: ${{ secrets.VSCE_PAT }}
-                  OVSX_PAT: ${{ secrets.OVSX_PAT }}
-                  CLINE_ENVIRONMENT: production
-                  TELEMETRY_SERVICE_API_KEY: ${{ secrets.TELEMETRY_SERVICE_API_KEY }}
-                  ERROR_SERVICE_API_KEY: ${{ secrets.ERROR_SERVICE_API_KEY }}
-                  # OpenTelemetry production defaults (can be overridden at runtime)
-                  OTEL_TELEMETRY_ENABLED: ${{ secrets.OTEL_TELEMETRY_ENABLED }}
-                  OTEL_LOGS_EXPORTER: otlp
-                  OTEL_METRICS_EXPORTER: otlp
-                  OTEL_EXPORTER_OTLP_PROTOCOL: ${{ secrets.OTEL_EXPORTER_OTLP_PROTOCOL }}
-                  OTEL_EXPORTER_OTLP_ENDPOINT: ${{ secrets.OTEL_EXPORTER_OTLP_ENDPOINT }}
-                  OTEL_EXPORTER_OTLP_HEADERS: ${{ secrets.OTEL_EXPORTER_OTLP_HEADERS }}
-                  RELEASE_TYPE: ${{ github.event.inputs.release-type }}
-              run: |
-                  # Swap README.marketplace.md into README.md so both the GitHub
-                  # release artifact (vsce package below) and the marketplace
-                  # publish (npm run publish:marketplace below, which swaps
-                  # internally as an idempotent no-op) ship the same README.
-                  node scripts/marketplace-readme.mjs swap-in
-                  trap 'node scripts/marketplace-readme.mjs restore' EXIT
-
-                  # Required to generate the .vsix. --no-dependencies: the extension
-                  # is fully esbuild-bundled, and under the bun workspace the @cline/*
-                  # deps are symlinks pointing outside the package, so without this vsce
-                  # would walk them and pull the whole monorepo into the .vsix.
-                  vsce package --no-dependencies --allow-package-secrets sendgrid --out "cline-${{ steps.get_version.outputs.version }}.vsix"
-
-                  # These scripts run under `node scripts/publish-marketplace.mjs`;
-                  # bun run just launches them. Node + npm (for `npx ovsx`) come from
-                  # setup-node above.
-                  if [ "$RELEASE_TYPE" = "pre-release" ]; then
-                    bun run publish:marketplace:prerelease
-                    echo "Successfully published pre-release version ${{ steps.get_version.outputs.version }} to VS Code Marketplace and Open VSX Registry"
-                  else
-                    bun run publish:marketplace
-                    echo "Successfully published release version ${{ steps.get_version.outputs.version }} to VS Code Marketplace and Open VSX Registry"
-                  fi
-
-            - name: Create GitHub Release
-              uses: softprops/action-gh-release@v1
-              with:
-                  tag_name: ${{ steps.resolve_tag.outputs.tag }}
-                  files: "apps/vscode/*.vsix"
-                  body: |
-                      ${{ steps.changelog.outputs.content }}
-
-                      **Full Changelog**: https://github.com/${{ github.repository }}/compare/${{ steps.prev_tag.outputs.prev_tag }}...${{ steps.resolve_tag.outputs.tag }}
-                  prerelease: ${{ github.event.inputs.release-type == 'pre-release' }}
-              env:
-                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-            - name: Post release to Slack
-              uses: slackapi/slack-github-action@v3.0.1
-              with:
-                  method: chat.postMessage
-                  token: ${{ secrets.SLACK_RELEASE_BOT_TOKEN }}
-                  payload: |
-                    channel: "C0APVKGGZFC"
-                    text: "Cline ${{ steps.resolve_tag.outputs.tag }}"
-                    blocks:
-                      - type: "section"
-                        text:
-                          type: "mrkdwn"
-                          text: "*Cline ${{ steps.resolve_tag.outputs.tag }}*"
-                      - type: "section"
-                        text:
-                          type: "mrkdwn"
-                          text: ${{ toJSON(steps.changelog.outputs.slack_content) }}
-                      - type: "context"
-                        elements:
-                          - type: "mrkdwn"
-                            text: "Full Changelog: https://github.com/${{ github.repository }}/compare/${{ steps.prev_tag.outputs.prev_tag }}...${{ steps.resolve_tag.outputs.tag }}"

.github/workflows/ext-vscode-test-e2e.yml

@@ -1,180 +0,0 @@
-name: ext-vscode-test-e2e
-
-on:
-    push:
-        branches:
-            - main
-    pull_request:
-        types: [opened, reopened, synchronize, ready_for_review]
-    workflow_dispatch:
-
-concurrency:
-    group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-    cancel-in-progress: true
-
-permissions:
-    contents: read
-    pull-requests: read
-
-jobs:
-    detect-changes:
-        runs-on: ubuntu-latest
-        name: Detect Changes
-        outputs:
-            e2e: ${{ steps.force.outputs.run_all == 'true' || steps.filter.outputs.e2e == 'true' }}
-        steps:
-            - id: force
-              if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
-              run: echo "run_all=true" >> "$GITHUB_OUTPUT"
-
-            - uses: actions/checkout@v4
-              if: steps.force.outputs.run_all != 'true'
-
-            - uses: dorny/paths-filter@v3
-              if: steps.force.outputs.run_all != 'true'
-              id: filter
-              with:
-                  filters: |
-                      e2e:
-                          - 'apps/vscode/src/**'
-                          - 'apps/vscode/webview-ui/**'
-                          - 'apps/vscode/proto/**'
-                          - 'apps/vscode/tests/**'
-                          - 'apps/vscode/scripts/**'
-                          - 'apps/vscode/standalone/**'
-                          - 'apps/vscode/assets/**'
-                          - 'apps/vscode/walkthrough/**'
-                          - 'apps/vscode/package.json'
-                          - 'apps/vscode/webview-ui/package.json'
-                          # Root bun lockfile is authoritative for the whole workspace (incl. apps/vscode).
-                          - 'bun.lock'
-                          # SDK source packages are local workspace symlinks (@cline/*), so SDK changes affect the build.
-                          - 'sdk/packages/**'
-                          - 'apps/vscode/buf.yaml'
-                          - 'apps/vscode/tsconfig*.json'
-                          - 'apps/vscode/biome.jsonc'
-                          - 'apps/vscode/esbuild.mjs'
-                          - 'apps/vscode/bunfig.toml'
-                          - 'apps/vscode/.vscode-test.mjs'
-                          - 'apps/vscode/.vscodeignore'
-                          - 'apps/vscode/playwright*.ts'
-                          - '.github/workflows/ext-vscode-test-e2e.yml'
-
-    matrix_prep:
-        needs: detect-changes
-        if: needs.detect-changes.outputs.e2e == 'true'
-        runs-on: ubuntu-latest
-        outputs:
-            matrix: ${{ steps.set-matrix.outputs.matrix }}
-        steps:
-            - id: set-matrix
-              run: |
-                  echo 'matrix=[{"runner":"ubuntu"},{"runner":"windows"},{"runner":"macos"}]' >> $GITHUB_OUTPUT
-
-    e2e:
-        needs: [detect-changes, matrix_prep]
-        if: needs.detect-changes.outputs.e2e == 'true'
-        strategy:
-            fail-fast: false
-            matrix:
-                include: ${{ fromJson(needs.matrix_prep.outputs.matrix) }}
-        runs-on: ${{ matrix.runner }}-latest
-        timeout-minutes: 20
-        # Nothing in this job uses OIDC, so it does not need an id-token
-        # permission.
-        permissions:
-            contents: read
-        defaults:
-            run:
-                working-directory: apps/vscode
-        steps:
-            - uses: actions/checkout@v4
-            - name: Setup Bun
-              uses: oven-sh/setup-bun@v2
-              with:
-                  bun-version: 1.3.14
-
-            # Cache keys below are exact-match only (no restore-keys prefix
-            # fallbacks); a miss just means a cold install, which is acceptable.
-
-            # Cache Bun's global install cache - keyed on the authoritative root bun.lock.
-            - name: Cache Bun install cache
-              uses: actions/cache@v4
-              id: bun-cache
-              with:
-                  path: ~/.bun/install/cache
-                  key: ${{ runner.os }}-bun-${{ hashFiles('bun.lock') }}
-
-            # Cache VS Code installation
-            - name: Cache VS Code
-              uses: actions/cache@v4
-              id: vscode-cache
-              with:
-                  path: apps/vscode/.vscode-test
-                  key: vscode-${{ runner.os }}-stable-${{ hashFiles('apps/vscode/.vscode-test.mjs', 'apps/vscode/package.json') }}
-
-            # Cache Playwright browsers
-            - name: Cache Playwright browsers
-              uses: actions/cache@v4
-              id: playwright-cache
-              with:
-                  path: |
-                      ~/.cache/ms-playwright
-                      ~/Library/Caches/ms-playwright
-                      ~/AppData/Local/ms-playwright
-                  key: playwright-browsers-${{ runner.os }}-${{ hashFiles('bun.lock') }}
-
-            # Single root install resolves the entire bun workspace at once (replaces
-            # the per-package `npm ci` steps for apps/vscode + webview-ui).
-            - name: Install workspace dependencies
-              working-directory: ${{ github.workspace }}
-              run: bun install --frozen-lockfile
-              env:
-                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-            # @cline/* are local workspace symlinks to source packages; build dist/
-            # before building/packaging the extension for E2E.
-            - name: Build SDK packages
-              working-directory: ${{ github.workspace }}
-              run: bun run build:sdk
-
-            - name: Assert better-sqlite3 native binary present
-              # Force bash: the Windows runner defaults to pwsh, which can't parse this
-              # POSIX test. Git Bash ships on GitHub's windows-latest images.
-              shell: bash
-              run: |
-                  NODE_FILE="node_modules/better-sqlite3/build/Release/better_sqlite3.node"
-                  if [ ! -f "$NODE_FILE" ]; then
-                    echo "ERROR: better-sqlite3 native binary missing at apps/vscode/$NODE_FILE"
-                    echo "(bun trustedDependencies postinstall likely did not run)"
-                    exit 1
-                  fi
-                  echo "Found better-sqlite3 native binary: $NODE_FILE"
-
-            # NOTE: vsce is no longer installed globally. @vscode/vsce is a workspace
-            # devDependency of apps/vscode (resolved into node_modules/.bin), and the
-            # `test:e2e:build` script invokes `vsce` via `bun run`, which puts the local
-            # .bin on PATH. No global install needed.
-
-            - name: Install xvfb on Linux
-              if: matrix.runner == 'ubuntu'
-              run: sudo apt-get update && sudo apt-get install -y xvfb
-
-            # Run optimized E2E tests (eliminates redundant builds)
-            - name: Run E2E tests - Linux
-              if: matrix.runner == 'ubuntu'
-              run: xvfb-run -a bun run test:e2e:optimal
-
-            - name: Run E2E tests - Non-Linux
-              if: matrix.runner != 'ubuntu'
-              run: bun run test:e2e:optimal
-
-            # Repo-root relative: the job's `working-directory` default applies to `run`
-            # steps only, so an apps/vscode-relative path here silently matches nothing
-            # and every failing run uploads no recordings at all.
-            - uses: actions/upload-artifact@v4
-              if: ${{ failure() }}
-              with:
-                  name: playwright-recordings-${{ matrix.runner }}
-                  path: |
-                      apps/vscode/test-results/

.github/workflows/ext-vscode-test.yml

@@ -1,428 +0,0 @@
-name: ext-vscode-test
-
-on:
-    push:
-        branches:
-            - main
-    workflow_dispatch:
-    pull_request:
-        branches:
-            - main
-    workflow_call:
-
-# Set default permissions for all jobs
-permissions:
-    contents: read # Needed to check out code
-    pull-requests: read # Needed for changed-file detection on pull requests
-
-jobs:
-    detect-changes:
-        runs-on: ubuntu-latest
-        name: Detect Changes
-        outputs:
-            vscode: ${{ steps.force.outputs.run_all == 'true' || steps.filter.outputs.vscode == 'true' }}
-            testing_platform: ${{ steps.force.outputs.run_all == 'true' || steps.filter.outputs.testing_platform == 'true' }}
-        steps:
-            - id: force
-              if: github.event_name == 'push' || github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call'
-              run: echo "run_all=true" >> "$GITHUB_OUTPUT"
-
-            - uses: actions/checkout@v4
-              if: steps.force.outputs.run_all != 'true'
-
-            - uses: dorny/paths-filter@v3
-              if: steps.force.outputs.run_all != 'true'
-              id: filter
-              with:
-                  filters: |
-                      vscode:
-                          - 'apps/vscode/src/**'
-                          - 'apps/vscode/webview-ui/**'
-                          - 'apps/vscode/proto/**'
-                          - 'apps/vscode/tests/**'
-                          - 'apps/vscode/scripts/**'
-                          - 'apps/vscode/standalone/**'
-                          - 'apps/vscode/assets/**'
-                          - 'apps/vscode/walkthrough/**'
-                          - 'apps/vscode/package.json'
-                          - 'apps/vscode/webview-ui/package.json'
-                          # Root bun lockfile is authoritative for the whole workspace (incl. apps/vscode).
-                          - 'bun.lock'
-                          # SDK source packages are local workspace symlinks (@cline/*), so SDK changes affect the build.
-                          - 'sdk/packages/**'
-                          - 'apps/vscode/buf.yaml'
-                          - 'apps/vscode/tsconfig*.json'
-                          - 'apps/vscode/biome.jsonc'
-                          - 'apps/vscode/esbuild.mjs'
-                          - 'apps/vscode/bunfig.toml'
-                          - 'apps/vscode/.vscode-test.mjs'
-                          - 'apps/vscode/test-setup.js'
-                          - '.github/workflows/ext-vscode-test.yml'
-                      testing_platform:
-                          - 'apps/vscode/src/**'
-                          - 'apps/vscode/proto/**'
-                          - 'apps/vscode/standalone/**'
-                          - 'apps/vscode/testing-platform/**'
-                          - 'apps/vscode/testing-platform/package.json'
-                          - 'apps/vscode/tests/specs/**'
-                          - 'apps/vscode/package.json'
-                          # Root bun lockfile is authoritative for the whole workspace (incl. apps/vscode).
-                          - 'bun.lock'
-                          # SDK source packages are local workspace symlinks (@cline/*), so SDK changes affect the build.
-                          - 'sdk/packages/**'
-                          - 'apps/vscode/buf.yaml'
-                          - 'apps/vscode/tsconfig*.json'
-                          - 'apps/vscode/esbuild.mjs'
-                          - 'apps/vscode/.vscodeignore'
-                          - 'apps/vscode/scripts/**'
-                          - '.github/workflows/ext-vscode-test.yml'
-
-    quality-checks:
-        needs: detect-changes
-        if: needs.detect-changes.outputs.vscode == 'true' || needs.detect-changes.outputs.testing_platform == 'true'
-        runs-on: ubuntu-latest
-        name: Quality Checks
-        defaults:
-          run:
-            working-directory: apps/vscode
-        steps:
-            - name: Checkout code
-              uses: actions/checkout@v4
-
-            - name: Setup Bun
-              uses: oven-sh/setup-bun@v2
-              with:
-                  bun-version: 1.3.14
-
-            # Single root install resolves the entire bun workspace (apps/vscode,
-            # webview-ui, testing-platform and the @cline/* SDK symlinks) at once,
-            # so the previous per-package `npm ci` steps collapse into one.
-            - name: Install workspace dependencies
-              working-directory: ${{ github.workspace }}
-              run: bun install --frozen-lockfile
-              env:
-                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-            # @cline/* are local workspace symlinks to source packages; their dist/
-            # output must be built before the extension can type-check/compile.
-            - name: Build SDK packages
-              working-directory: ${{ github.workspace }}
-              run: bun run build:sdk
-
-            - name: Assert better-sqlite3 native binary present
-              run: |
-                  NODE_FILE="node_modules/better-sqlite3/build/Release/better_sqlite3.node"
-                  if [ ! -f "$NODE_FILE" ]; then
-                    echo "ERROR: better-sqlite3 native binary missing at apps/vscode/$NODE_FILE"
-                    echo "(bun trustedDependencies postinstall likely did not run)"
-                    exit 1
-                  fi
-                  echo "Found better-sqlite3 native binary: $NODE_FILE"
-
-            - name: Run Quality Checks (Parallel)
-              run: bun run ci:check-all
-
-    vscode-test:
-        needs: [detect-changes, quality-checks]
-        if: needs.detect-changes.outputs.vscode == 'true'
-        env:
-            VSCODE_TEST_VERSION: 1.101.0
-        strategy:
-            fail-fast: false
-            matrix:
-                os: [ubuntu-latest, windows-latest]
-        runs-on: ${{ matrix.os }}
-        name: ${{ matrix.os == 'ubuntu-latest' && 'vscode test' || format('vscode test ({0})', matrix.os) }}
-        defaults:
-            run:
-                shell: bash
-                working-directory: apps/vscode
-        steps:
-            - name: Checkout code
-              uses: actions/checkout@v4
-
-            - name: Setup Bun
-              uses: oven-sh/setup-bun@v2
-              with:
-                  bun-version: 1.3.14
-
-            # Single root install resolves the entire bun workspace at once (replaces
-            # the per-package `npm ci` steps for apps/vscode + webview-ui).
-            - name: Install workspace dependencies
-              working-directory: ${{ github.workspace }}
-              run: bun install --frozen-lockfile
-              env:
-                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-            # @cline/* are local workspace symlinks to source packages; build dist/
-            # before compiling/testing the extension.
-            - name: Build SDK packages
-              working-directory: ${{ github.workspace }}
-              run: bun run build:sdk
-
-            - name: Assert better-sqlite3 native binary present
-              run: |
-                  NODE_FILE="node_modules/better-sqlite3/build/Release/better_sqlite3.node"
-                  if [ ! -f "$NODE_FILE" ]; then
-                    echo "ERROR: better-sqlite3 native binary missing at apps/vscode/$NODE_FILE"
-                    echo "(bun trustedDependencies postinstall likely did not run)"
-                    exit 1
-                  fi
-                  echo "Found better-sqlite3 native binary: $NODE_FILE"
-
-            # NOTE: The old `npm config set script-shell bash` step is intentionally
-            # removed. Scripts are now launched with `bun run`, which uses Bun's own
-            # built-in cross-platform shell rather than npm's configured script-shell,
-            # so that npm-specific Windows workaround no longer applies. Bash-dependent
-            # scripts (e.g. scripts/proto-lint.sh, standalone/runclinecore.sh) are
-            # invoked explicitly via `bash ...` from within the package scripts, and
-            # this job's `defaults.run.shell: bash` (Git Bash on Windows) still covers
-            # the workflow `run:` blocks below.
-
-            - name: Cache VS Code test runtime
-              if: runner.os == 'Windows'
-              uses: actions/cache@v4
-              with:
-                  path: .vscode-test
-                  key: vscode-test-runtime-${{ runner.os }}-${{ env.VSCODE_TEST_VERSION }}
-
-            # Build the extension and tests (without redundant checks)
-            - name: Build Tests and Extension
-              id: build_step
-              run: bun run ci:build
-
-            - name: Vitest Suites (SDK adapter + model catalog)
-              id: vitest_tests
-              if: ${{ !cancelled() && steps.build_step.outcome == 'success' }}
-              # The vitest config sets passWithNoTests: true, so a broken glob/alias
-              # would "pass" with zero tests. Capture output and assert a non-zero
-              # test count to guard against silent skips.
-              run: |
-                  set -o pipefail
-                  bun run test:vitest 2>&1 | tee vitest-output.log
-                  # Strip ANSI color codes before matching — vitest colorizes the
-                  # "Tests  N passed" summary, so the count is not adjacent to the
-                  # "Tests" label in the raw bytes.
-                  if ! sed -r 's/\x1b\[[0-9;]*m//g' vitest-output.log | grep -Eq 'Tests[[:space:]]+[0-9]*[1-9][0-9]* (passed|failed)'; then
-                    echo "ERROR: vitest reported zero tests (possible silent skip)."
-                    exit 1
-                  fi
-
-            - name: Unit Tests (bun) - Linux
-              id: unit_tests_linux
-              if: ${{ !cancelled() && steps.build_step.outcome == 'success' && runner.os == 'Linux' }}
-              # The node-side unit suite (.mocharc spec set) now runs under `bun test`
-              # via scripts/run-bun-unit-tests.ts (one isolated bun process per file).
-              # The runner exits non-zero on any failure and prints a final
-              # "Files: N  Pass: P  Fail: F" summary; assert a non-zero pass count to
-              # guard against an empty glob silently "passing".
-              run: |
-                  set -o pipefail
-                  bun run test:unit 2>&1 | tee unit-output.log
-                  if ! grep -Eq 'Pass:[[:space:]]+[0-9]*[1-9][0-9]*' unit-output.log; then
-                    echo "ERROR: bun unit runner reported zero passing tests (possible silent skip)."
-                    exit 1
-                  fi
-
-            - name: Unit Tests (bun) - Non-Linux
-              id: unit_tests_non_linux
-              if: ${{ !cancelled() && steps.build_step.outcome == 'success' && runner.os != 'Linux' }}
-              run: |
-                  bun run test:unit
-
-            - name: Extension Integration Tests - Linux
-              id: integration_tests_linux
-              if: ${{ !cancelled() && steps.build_step.outcome == 'success' && runner.os == 'Linux' }}
-              run: xvfb-run -a bun run test:coverage
-
-            - name: Extension Integration Tests - Non-Linux
-              id: integration_tests_non_linux
-              if: ${{ !cancelled() && steps.build_step.outcome == 'success' && runner.os != 'Linux' }}
-              run: |
-                  for attempt in 1 2 3; do
-                    echo "Running extension integration tests (attempt ${attempt}/3)"
-                    if bun run test:integration; then
-                      exit 0
-                    fi
-
-                    if [ "$attempt" -eq 3 ]; then
-                      echo "Extension integration tests failed after 3 attempts"
-                      exit 1
-                    fi
-
-                    echo "Extension integration tests failed; retrying after short delay"
-                    sleep 5
-                  done
-
-            - name: Webview Tests with Coverage
-              id: webview_tests
-              if: ${{ !cancelled() && steps.build_step.outcome == 'success' }}
-              run: |
-                  cd webview-ui
-                  bun run test:coverage
-
-            - name: Save Coverage Reports
-              uses: actions/upload-artifact@v4
-              # Only upload artifacts on Linux - We only need coverage from one OS
-              if: runner.os == 'Linux'
-              with:
-                  name: pr-coverage-reports
-                  path: |
-                      apps/vscode/webview-ui/coverage/lcov.info
-
-    test-platform-integration:
-        needs: [detect-changes, quality-checks]
-        if: needs.detect-changes.outputs.testing_platform == 'true'
-        runs-on: ubuntu-latest
-        defaults:
-          run:
-            working-directory: apps/vscode
-        steps:
-            - name: Checkout code
-              uses: actions/checkout@v4
-
-            - name: Setup Bun
-              uses: oven-sh/setup-bun@v2
-              with:
-                  bun-version: 1.3.14
-
-            # Single root install resolves the whole bun workspace, including the
-            # testing-platform package, so the separate per-package `npm ci` steps
-            # (extension + webview-ui + testing-platform) collapse into one.
-            - name: Install workspace dependencies
-              working-directory: ${{ github.workspace }}
-              run: bun install --frozen-lockfile
-              env:
-                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-            # @cline/* are local workspace symlinks to source packages; build dist/
-            # before compiling the standalone core.
-            - name: Build SDK packages
-              working-directory: ${{ github.workspace }}
-              run: bun run build:sdk
-
-            - name: Assert better-sqlite3 native binary present
-              run: |
-                  NODE_FILE="node_modules/better-sqlite3/build/Release/better_sqlite3.node"
-                  if [ ! -f "$NODE_FILE" ]; then
-                    echo "ERROR: better-sqlite3 native binary missing at apps/vscode/$NODE_FILE"
-                    echo "(bun trustedDependencies postinstall likely did not run)"
-                    exit 1
-                  fi
-                  echo "Found better-sqlite3 native binary: $NODE_FILE"
-
-            - name: Download ripgrep binaries
-              run: bun run download-ripgrep
-
-            - name: Compile Standalone
-              run: bun run compile-standalone
-
-            - name: Running testing platform integration spec tests
-              timeout-minutes: 7
-              run: bun run test:tp-orchestrator -- tests/specs/ --count=1 --coverage
-
-            - name: Save Coverage Reports
-              uses: actions/upload-artifact@v4
-              with:
-                name: test-platform-integration-core-coverage
-                path: apps/vscode/coverage/**/lcov.info
-
-    # Keep the required "test" check as a tiny aggregate gate instead of the conditional
-    # VS Code matrix. GitHub treats conditionally skipped jobs as successful required
-    # checks, so the gate below preserves the old required check name while making sure
-    # whichever filtered test jobs were selected actually passed.
-    test:
-        needs: [detect-changes, quality-checks, vscode-test, test-platform-integration]
-        if: ${{ !cancelled() }}
-        runs-on: ubuntu-latest
-        name: test
-        steps:
-            - name: Verify selected test jobs
-              env:
-                  DETECT_CHANGES_RESULT: ${{ needs.detect-changes.result }}
-                  QUALITY_CHECKS_RESULT: ${{ needs.quality-checks.result }}
-                  VSCODE_CHANGED: ${{ needs.detect-changes.outputs.vscode }}
-                  TESTING_PLATFORM_CHANGED: ${{ needs.detect-changes.outputs.testing_platform }}
-                  VSCODE_TEST_RESULT: ${{ needs.vscode-test.result }}
-                  TEST_PLATFORM_RESULT: ${{ needs.test-platform-integration.result }}
-              run: |
-                  if [ "$DETECT_CHANGES_RESULT" != "success" ]; then
-                    echo "detect-changes did not succeed: $DETECT_CHANGES_RESULT"
-                    exit 1
-                  fi
-
-                  if [ "$VSCODE_CHANGED" != "true" ] && [ "$TESTING_PLATFORM_CHANGED" != "true" ]; then
-                    echo "No root test paths changed; skipping root test requirements."
-                    exit 0
-                  fi
-
-                  if [ "$QUALITY_CHECKS_RESULT" != "success" ]; then
-                    echo "quality-checks did not succeed: $QUALITY_CHECKS_RESULT"
-                    exit 1
-                  fi
-
-                  if [ "$VSCODE_CHANGED" = "true" ] && [ "$VSCODE_TEST_RESULT" != "success" ]; then
-                    echo "vscode-test did not succeed: $VSCODE_TEST_RESULT"
-                    exit 1
-                  fi
-
-                  if [ "$TESTING_PLATFORM_CHANGED" = "true" ] && [ "$TEST_PLATFORM_RESULT" != "success" ]; then
-                    echo "test-platform-integration did not succeed: $TEST_PLATFORM_RESULT"
-                    exit 1
-                  fi
-
-                  echo "Selected root test jobs passed."
-
-    qlty:
-        needs: [detect-changes, quality-checks, vscode-test, test-platform-integration]
-        if: ${{ !cancelled() && needs.quality-checks.result == 'success' && (needs.vscode-test.result == 'success' || needs.vscode-test.result == 'skipped') && (needs.test-platform-integration.result == 'success' || needs.test-platform-integration.result == 'skipped') && (needs.detect-changes.outputs.vscode == 'true' || needs.detect-changes.outputs.testing_platform == 'true') }}
-        runs-on: ubuntu-latest
-        # Run on PRs to main, pushes to main, and manual dispatches
-        steps:
-            - name: Checkout code
-              uses: actions/checkout@v4
-
-            - name: Download unit tests coverage reports
-              if: needs.detect-changes.outputs.vscode == 'true'
-              uses: actions/download-artifact@v4
-              with:
-                  name: pr-coverage-reports
-                  path: apps/vscode
-
-            - name: Upload core unit tests coverage to Qlty
-              if: needs.detect-changes.outputs.vscode == 'true'
-              uses: qltysh/qlty-action/coverage@v2
-              with:
-                  token: ${{ secrets.QLTY_COVERAGE_TOKEN }}
-                  # we can merge multiple files if necessary
-                  files: |
-                    apps/vscode/coverage-unit/lcov.info
-                  tag: unit:core
-
-            - name: Upload webview-ui unit tests coverage to Qlty
-              if: needs.detect-changes.outputs.vscode == 'true'
-              uses: qltysh/qlty-action/coverage@v2
-              with:
-                  token: ${{ secrets.QLTY_COVERAGE_TOKEN }}
-                  # we can merge multiple files if necessary
-                  files: |
-                    apps/vscode/webview-ui/coverage/lcov.info
-                  tag: unit:webview-ui
-                  add-prefix: webview-ui/
-
-            - name: Download test platform integration core coverage artifact
-              if: needs.detect-changes.outputs.testing_platform == 'true'
-              uses: actions/download-artifact@v4
-              continue-on-error: true
-              id: download-integration-coverage
-              with:
-                name: test-platform-integration-core-coverage
-                path: apps/vscode/integration-core-coverage-reports
-
-            - name: Upload core integration tests coverage to Qlty
-              if: needs.detect-changes.outputs.testing_platform == 'true' && steps.download-integration-coverage.outcome == 'success'
-              uses: qltysh/qlty-action/coverage@v2
-              with:
-                token: ${{ secrets.QLTY_COVERAGE_TOKEN }}
-                files: apps/vscode/integration-core-coverage-reports/**/lcov.info
-                tag: integration:core

.github/workflows/label-jetbrains-issues.yml

@@ -0,0 +1,65 @@
+name: Auto-label Issues
+
+on:
+  issues:
+    types: [opened, edited]
+
+jobs:
+  label:
+    runs-on: ubuntu-latest
+    permissions:
+      issues: write
+    steps:
+      - uses: actions/github-script@v7
+        with:
+          script: |
+            const body = context.payload.issue.body || '';
+            const labels = context.payload.issue.labels.map(l => l.name);
+            
+            // Check if JetBrains Plugin is selected
+            if (body.match(/###\s*Plugin Type\s*\n+JetBrains Plugin/i)) {
+              if (!labels.includes('JetBrains')) {
+                await github.rest.issues.addLabels({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  issue_number: context.issue.number,
+                  labels: ['JetBrains']
+                });
+              }
+            }
+
+            // Check if VSCode Extension is selected
+            if (body.match(/###\s*Plugin Type\s*\n+VSCode Extension/i)) {
+              if (!labels.includes('VS Code')) {
+                await github.rest.issues.addLabels({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  issue_number: context.issue.number,
+                  labels: ['VS Code']
+                });
+              }
+            }
+
+            // Check if CLI is selected
+            if (body.match(/###\s*Plugin Type\s*\n+CLI/i)) {
+              if (!labels.includes('CLI')) {
+                await github.rest.issues.addLabels({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  issue_number: context.issue.number,
+                  labels: ['CLI']
+                });
+              }
+            }
+
+            // Check if beta version checkbox is checked
+            if (body.includes('- [X] I am using a beta version of Cline') || body.includes('- [x] I am using a beta version of Cline')) {
+              if (!labels.includes('beta')) {
+                await github.rest.issues.addLabels({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  issue_number: context.issue.number,
+                  labels: ['beta']
+                });
+              }
+            }

.github/workflows/npm-main.yaml

@@ -0,0 +1,111 @@
+name: Publish NPM Release
+
+on:
+  workflow_call:
+    inputs:
+      confirm_publish:
+        description: 'Type "publish" to confirm you want to publish to NPM'
+        required: true
+        type: string
+
+permissions:
+  contents: write # Required for pushing tags
+  id-token: write # Required for npm trusted publishing (OIDC)
+  checks: write # Required by test workflow
+  pull-requests: write # Required by test workflow
+
+jobs:
+  test:
+    uses: ./.github/workflows/test.yml
+
+  publish-npm-release:
+    needs: test
+    name: Publish Cline CLI to NPM
+    if: github.repository == 'cline/cline' && github.ref == 'refs/heads/main' && inputs.confirm_publish == 'publish'
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "24.x"
+          registry-url: "https://registry.npmjs.org"
+
+      - name: Install root dependencies and CLI dependencies
+        run: npm ci --include=optional # this will also install cli deps because "cli" in included in root package.json workspaces field
+
+      - name: Generate Protos
+        run: npm run protos
+
+      - name: Read release version
+        id: version
+        run: |
+          # Read version from cli/package.json
+          VERSION=$(node -p "require('./cli/package.json').version")
+          echo "Release version: $VERSION"
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+
+      - name: Build standalone NPM package
+        env:
+          TELEMETRY_SERVICE_API_KEY: ${{ secrets.TELEMETRY_SERVICE_API_KEY }}
+          ERROR_SERVICE_API_KEY: ${{ secrets.ERROR_SERVICE_API_KEY }}
+          CLINE_ENVIRONMENT: production
+          OTEL_TELEMETRY_ENABLED: "1"
+          OTEL_METRICS_EXPORTER: otlp
+          OTEL_LOGS_EXPORTER: otlp
+          OTEL_EXPORTER_OTLP_PROTOCOL: ${{ secrets.OTEL_EXPORTER_OTLP_PROTOCOL }}
+          OTEL_EXPORTER_OTLP_ENDPOINT: ${{ secrets.OTEL_EXPORTER_OTLP_ENDPOINT }}
+          OTEL_EXPORTER_OTLP_HEADERS: ${{ secrets.OTEL_EXPORTER_OTLP_HEADERS }}
+        run: node scripts/package-npm.mjs
+
+      - name: Verify build output
+        run: |
+          echo "Checking dist-standalone directory..."
+          ls -la dist-standalone/
+
+          echo "Verifying CLI binaries..."
+          ls -lh cli/bin/cline-* || echo "Warning: CLI binaries not found"
+
+          echo "Checking package.json in dist-standalone..."
+          cat dist-standalone/package.json | grep version
+
+      - name: Publish to NPM with latest tag
+        run: |
+          echo "Publishing version ${{ steps.version.outputs.version }} to NPM with tag 'latest'..."
+          cd dist-standalone
+          npm publish --tag latest --access public
+
+      - name: Tag release
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git tag "v${{ steps.version.outputs.version }}-cli"
+          git push origin "v${{ steps.version.outputs.version }}-cli"
+
+      - name: Summary
+        run: |
+          echo "✅ Successfully published cline@${{ steps.version.outputs.version }} to NPM with tag 'latest'"
+          echo ""
+          echo "📦 Install with: npm install -g cline"
+          echo "🔗 NPM: https://www.npmjs.com/package/cline/v/${{ steps.version.outputs.version }}"
+
+      - name: Post release to Slack
+        uses: slackapi/slack-github-action@v3.0.1
+        with:
+          method: chat.postMessage
+          token: ${{ secrets.SLACK_RELEASE_BOT_TOKEN }}
+          payload: |
+            channel: "C0APVKGGZFC"
+            text: "Cline CLI v${{ steps.version.outputs.version }}"
+            blocks:
+              - type: "section"
+                text:
+                  type: "mrkdwn"
+                  text: "*Cline CLI v${{ steps.version.outputs.version }}*"
+              - type: "context"
+                elements:
+                  - type: "mrkdwn"
+                    text: "<https://www.npmjs.com/package/cline/v/${{ steps.version.outputs.version }}|View on npm>"

.github/workflows/npm-nightly.yaml

@@ -0,0 +1,136 @@
+name: Publish NPM Nightly
+
+on:
+  workflow_call:
+    inputs:
+      force_publish:
+        description: "Force publish even if there are no commits in the last 24 hours"
+        required: false
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+  id-token: write # Required for npm trusted publishing (OIDC)
+  checks: write # Required by test workflow
+  pull-requests: write # Required by test workflow
+
+jobs:
+  test:
+    uses: ./.github/workflows/test.yml
+
+  publish-npm-nightly:
+    needs: test
+    name: Publish Cline CLI (Nightly) to NPM
+    if: github.repository == 'cline/cline' && github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Check for recent commits
+        id: check_commits
+        env:
+          FORCE_PUBLISH: ${{ inputs.force_publish }}
+        run: |
+          if [ "$FORCE_PUBLISH" = "true" ]; then
+            echo "force_publish enabled, proceeding with publish"
+            echo "skip=false" >> $GITHUB_OUTPUT
+            exit 0
+          fi
+
+          if [ $(git rev-list --count HEAD --since="24 hours ago") -eq 0 ]; then
+            echo "No commits in last 24 hours, skipping publish"
+            echo "skip=true" >> $GITHUB_OUTPUT
+          else
+            echo "Found recent commits, proceeding with publish"
+            echo "skip=false" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Setup Node.js
+        if: steps.check_commits.outputs.skip != 'true'
+        uses: actions/setup-node@v4
+        with:
+          node-version: "24.x"
+          registry-url: "https://registry.npmjs.org"
+
+      - name: Install root dependencies and CLI dependencies
+        if: steps.check_commits.outputs.skip != 'true'
+        run: npm ci --include=optional # this will also install cli deps because "cli" in included in root package.json workspaces field
+
+      - name: Generate Protos
+        if: steps.check_commits.outputs.skip != 'true'
+        run: npm run protos
+
+      - name: Generate nightly version with timestamp
+        if: steps.check_commits.outputs.skip != 'true'
+        id: version
+        run: |
+          # Read base version from cli/package.json (e.g., "2.0.0")
+          BASE_VERSION=$(node -p "require('./cli/package.json').version")
+
+          # Generate timestamp (Unix epoch seconds)
+          TIMESTAMP=$(date +%s)
+
+          # Create unique nightly version: 1.0.9-nightly.1736365200
+          VERSION="${BASE_VERSION}-nightly.${TIMESTAMP}"
+
+          echo "Base version: $BASE_VERSION"
+          echo "Generated nightly version: $VERSION"
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+
+      - name: Update cli/package.json with nightly version
+        if: steps.check_commits.outputs.skip != 'true'
+        run: |
+          # Update version with timestamp-based nightly version
+          node -e "
+            const fs = require('fs');
+            const pkg = JSON.parse(fs.readFileSync('cli/package.json', 'utf8'));
+            pkg.version = '${{ steps.version.outputs.version }}';
+            fs.writeFileSync('cli/package.json', JSON.stringify(pkg, null, '\t'));
+          "
+
+          echo "Using version ${{ steps.version.outputs.version }} for build"
+          cat cli/package.json | grep '"version"'
+
+      - name: Build and package CLI
+        if: steps.check_commits.outputs.skip != 'true'
+        env:
+          TELEMETRY_SERVICE_API_KEY: ${{ secrets.TELEMETRY_SERVICE_API_KEY }}
+          ERROR_SERVICE_API_KEY: ${{ secrets.ERROR_SERVICE_API_KEY }}
+          CLINE_ENVIRONMENT: production
+          OTEL_TELEMETRY_ENABLED: "1"
+          OTEL_METRICS_EXPORTER: otlp
+          OTEL_LOGS_EXPORTER: otlp
+          OTEL_EXPORTER_OTLP_PROTOCOL: ${{ secrets.OTEL_EXPORTER_OTLP_PROTOCOL }}
+          OTEL_EXPORTER_OTLP_ENDPOINT: ${{ secrets.OTEL_EXPORTER_OTLP_ENDPOINT }}
+          OTEL_EXPORTER_OTLP_HEADERS: ${{ secrets.OTEL_EXPORTER_OTLP_HEADERS }}
+        run: node scripts/package-npm.mjs
+
+      - name: Verify build output
+        if: steps.check_commits.outputs.skip != 'true'
+        run: |
+          echo "Checking dist-standalone directory..."
+          ls -la dist-standalone/
+
+          echo "Verifying CLI binaries..."
+          ls -lh cli/bin/cline-* || echo "Warning: CLI binaries not found"
+
+          echo "Checking package.json in dist-standalone..."
+          cat dist-standalone/package.json | grep version
+
+      - name: Publish to NPM with nightly tag
+        if: steps.check_commits.outputs.skip != 'true'
+        run: |
+          echo "Publishing version ${{ steps.version.outputs.version }} to NPM with tag 'nightly'..."
+          cd dist-standalone
+          npm publish --tag nightly --access public
+
+      - name: Summary
+        if: steps.check_commits.outputs.skip != 'true'
+        run: |
+          echo "✅ Successfully published cline@${{ steps.version.outputs.version }} to NPM with tag 'nightly'"
+          echo ""
+          echo "📦 Install with: npm install -g cline@nightly"
+          echo "🔗 NPM: https://www.npmjs.com/package/cline/v/${{ steps.version.outputs.version }}"

.github/workflows/pack-cli.yml

@@ -0,0 +1,215 @@
+# Build and Pack CLI
+#
+# Builds a CLI tarball from any branch/commit and publishes it as a GitHub Release.
+# Requires write access to the repository (maintainers/collaborators only).
+#
+# Security: Split into two jobs to isolate untrusted build code from write tokens.
+# The build job runs arbitrary ref code with zero permissions. The release job
+# only runs trusted GitHub Actions with write scope.
+#
+# Usage (helper script, auto-detects current branch):
+#   ./scripts/build-cli-artifact.sh
+#   ./scripts/build-cli-artifact.sh feature/my-changes
+#   ./scripts/build-cli-artifact.sh feature/my-changes 1234  # comments on PR
+#
+# Usage (gh CLI directly):
+#   gh workflow run pack-cli.yml -f ref=main
+#   gh workflow run pack-cli.yml -f ref=abc123 -f pr_number=1234
+#
+# Install the built CLI (no auth required):
+#   npm install -g https://github.com/cline/cline/releases/download/cli-build-<sha>/cline-<ver>.tgz
+#
+# Find releases:
+#   gh release list --limit 10
+
+name: Build and Pack CLI
+
+permissions:
+  contents: read
+
+on:
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: 'Branch, tag, or commit SHA to build (leave empty for default branch)'
+        required: false
+        type: string
+      pr_number:
+        description: 'PR number to comment on with install instructions (optional)'
+        required: false
+        type: number
+
+jobs:
+  # ── Build job: runs untrusted ref code with ZERO permissions ──
+  build:
+    name: Build CLI
+    runs-on: ubuntu-latest
+    permissions: {}
+    outputs:
+      commit_sha: ${{ steps.commit.outputs.sha }}
+      tarball: ${{ steps.pack.outputs.tarball }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref || github.ref }}
+          persist-credentials: false
+
+      - name: Get commit SHA
+        id: commit
+        run: |
+          COMMIT_SHA=$(git rev-parse --short HEAD)
+          echo "sha=$COMMIT_SHA" >> $GITHUB_OUTPUT
+          echo "Building from commit: $COMMIT_SHA"
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "20.x"
+
+      - name: Install dependencies
+        run: npm ci --include=optional
+
+      - name: Generate Protos
+        run: npm run protos
+
+      - name: Build standalone package
+        run: node scripts/package-npm.mjs
+
+      - name: Create Tarball
+        id: pack
+        run: |
+          cd dist-standalone
+          TARBALL=$(npm pack)
+          echo "tarball=$TARBALL" >> $GITHUB_OUTPUT
+          echo "Created tarball: $TARBALL"
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: cli-tarball
+          path: dist-standalone/*.tgz
+
+  # ── Release job: only trusted Actions code, with write permissions ──
+  release:
+    name: Release CLI
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+      issues: write
+    steps:
+      - name: Download artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: cli-tarball
+          path: dist-standalone
+
+      - name: Create GitHub Release
+        id: create_release
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const fs = require('fs');
+            const path = require('path');
+            const commit = '${{ needs.build.outputs.commit_sha }}';
+            const tarball = '${{ needs.build.outputs.tarball }}';
+
+            // Delete existing release/tag if re-running for the same commit
+            const tagName = `cli-build-${commit}`;
+            try {
+              const existing = await github.rest.repos.getReleaseByTag({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                tag: tagName
+              });
+              await github.rest.repos.deleteRelease({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                release_id: existing.data.id
+              });
+              await github.rest.git.deleteRef({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                ref: `tags/${tagName}`
+              });
+              core.info(`Deleted existing release for ${tagName}`);
+            } catch (e) {
+              // Release doesn't exist yet, that's fine
+            }
+
+            // Create a release
+            const release = await github.rest.repos.createRelease({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              tag_name: tagName,
+              name: `CLI Build (${commit})`,
+              body: `Automated CLI build from commit ${commit}\n\nInstall with:\n\`\`\`bash\nnpm install -g https://github.com/${context.repo.owner}/${context.repo.repo}/releases/download/${tagName}/${tarball}\n\`\`\``,
+              draft: false,
+              prerelease: true
+            });
+
+            // Upload the tarball as a release asset
+            const tarballPath = path.join('dist-standalone', tarball);
+            const tarballData = fs.readFileSync(tarballPath);
+
+            await github.rest.repos.uploadReleaseAsset({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              release_id: release.data.id,
+              name: tarball,
+              data: tarballData
+            });
+
+            const downloadUrl = `https://github.com/${context.repo.owner}/${context.repo.repo}/releases/download/${tagName}/${tarball}`;
+            core.setOutput('release_url', release.data.html_url);
+            core.setOutput('download_url', downloadUrl);
+
+      - name: Comment on PR with download instructions
+        if: inputs.pr_number != ''
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const commit = '${{ needs.build.outputs.commit_sha }}';
+            const releaseUrl = '${{ steps.create_release.outputs.release_url }}';
+            const downloadUrl = '${{ steps.create_release.outputs.download_url }}';
+            const prNumber = ${{ inputs.pr_number || 0 }};
+            if (!prNumber) return;
+
+            const comment = `## 📦 CLI Build Ready
+
+            A CLI build has been created for commit \`${commit}\`.
+
+            ### Install Directly from URL (No Authentication Required!)
+
+            \`\`\`bash
+            npm install -g ${downloadUrl}
+            \`\`\`
+
+            ### Alternative: Download and Install
+
+            \`\`\`bash
+            curl -L ${downloadUrl} -o cline.tgz
+            npm install -g ./cline.tgz
+            \`\`\`
+
+            📦 [View Release](${releaseUrl})
+            `;
+
+            await github.rest.issues.createComment({
+              issue_number: prNumber,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              body: comment
+            });
+
+      - name: Summary
+        run: |
+          echo "✅ CLI build complete!"
+          echo ""
+          echo "📦 Release: ${{ steps.create_release.outputs.release_url }}"
+          echo "🔗 Download URL: ${{ steps.create_release.outputs.download_url }}"
+          echo ""
+          echo "Install from anywhere (no authentication required):"
+          echo "  npm install -g ${{ steps.create_release.outputs.download_url }}"

.github/workflows/publish-cli-trusted.yaml

@@ -0,0 +1,60 @@
+name: Publish CLI (Trusted)
+
+on:
+  schedule:
+    - cron: "0 12 * * *" # 4 AM PST (UTC-8) = 12 UTC
+  workflow_dispatch:
+    inputs:
+      publish_target:
+        description: "Which publish flow to run"
+        required: true
+        default: "main"
+        type: choice
+        options:
+          - main
+          - nightly
+      confirm_publish:
+        description: 'Required when publish_target=main. Type "publish" to confirm release publish.'
+        required: false
+        type: string
+      force_nightly_publish:
+        description: "Force nightly publish even with no commits in last 24h"
+        required: false
+        type: boolean
+        default: false
+
+permissions:
+  id-token: write # Required for npm trusted publishing (OIDC)
+  contents: write # Required because npm-main creates/pushes git tags
+  checks: write # Required by nested reusable test workflow
+  pull-requests: write # Required by nested reusable test workflow
+
+jobs:
+  cli-tui-tests:
+    uses: ./.github/workflows/cli-tui-tests.yml
+
+  publish-main:
+    needs: cli-tui-tests
+    if: |
+      github.repository == 'cline/cline' && (
+        github.event_name == 'workflow_dispatch' &&
+        github.event.inputs.publish_target == 'main' &&
+        github.event.inputs.confirm_publish == 'publish' &&
+        !endsWith(github.actor, '[bot]')
+      )
+    uses: ./.github/workflows/npm-main.yaml
+    secrets: inherit
+    with:
+      confirm_publish: ${{ github.event.inputs.confirm_publish }}
+
+  publish-nightly:
+    needs: cli-tui-tests
+    if: |
+      github.repository == 'cline/cline' && (
+        github.event_name == 'schedule' ||
+        (github.event_name == 'workflow_dispatch' && github.event.inputs.publish_target == 'nightly')
+      )
+    uses: ./.github/workflows/npm-nightly.yaml
+    secrets: inherit
+    with:
+      force_publish: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.force_nightly_publish == 'true' }}

.github/workflows/publish-nightly-sdk.yml

@@ -0,0 +1,72 @@
+name: "Publish SDK Nightly Release"
+
+on:
+    schedule:
+        - cron: '0 12 * * *' # 4 AM PST (UTC-8) = 12 UTC
+    workflow_dispatch:
+
+permissions:
+    contents: read
+    packages: write
+    checks: write
+    pull-requests: write
+
+env:
+    # Keep the publish source pinned to one reviewed branch instead of accepting arbitrary refs.
+    SDK_NIGHTLY_REF: dpc/sdk-migration-simpler-login
+
+jobs:
+    publish:
+        name: Publish Cline (Nightly SDK) Extension
+        if: github.repository == 'cline/cline' && github.ref == 'refs/heads/main'
+        runs-on: ubuntu-latest
+        environment: PublishNightly
+
+        steps:
+            - name: Checkout trusted SDK nightly branch
+              uses: actions/checkout@v4
+              with:
+                  ref: ${{ env.SDK_NIGHTLY_REF }}
+                  lfs: true
+                  persist-credentials: false
+
+            - name: Setup Node.js
+              uses: actions/setup-node@v4
+              with:
+                  # Keep publish environment aligned with test workflow/tooling lockfile expectations.
+                  # Newer LTS (Node 24 / npm 11) can make `npm list` fail with ELSPROBLEMS during vsce packaging.
+                  node-version: 22
+
+            - name: Install root dependencies
+              run: npm ci --include=optional
+
+            - name: Install webview-ui dependencies
+              run: cd webview-ui && npm ci --include=optional
+
+            - name: Install Publishing Tools
+              run: npm install -g @vscode/vsce ovsx
+
+            - name: Verify LFS media assets are resolved
+              run: |
+                  for FILE in webview-ui/src/assets/cline_kanban_demo.mp4 webview-ui/src/assets/cline_kanban_demo.webm; do
+                    if grep -q "git-lfs.github.com/spec/v1" "$FILE"; then
+                      echo "Error: $FILE is still a Git LFS pointer in CI checkout"
+                      exit 1
+                    fi
+                  done
+
+            - name: Publish SDK nightly extension
+              env:
+                  VSCE_PAT: ${{ secrets.VSCE_PAT }}
+                  OVSX_PAT: ${{ secrets.OVSX_PAT }}
+                  TELEMETRY_SERVICE_API_KEY: ${{ secrets.TELEMETRY_SERVICE_API_KEY }}
+                  ERROR_SERVICE_API_KEY: ${{ secrets.ERROR_SERVICE_API_KEY }}
+                  CLINE_ENVIRONMENT: production
+                  # OpenTelemetry production defaults (can be overridden at runtime)
+                  OTEL_TELEMETRY_ENABLED: ${{ secrets.OTEL_TELEMETRY_ENABLED }}
+                  OTEL_LOGS_EXPORTER: otlp
+                  OTEL_METRICS_EXPORTER: otlp
+                  OTEL_EXPORTER_OTLP_PROTOCOL: ${{ secrets.OTEL_EXPORTER_OTLP_PROTOCOL }}
+                  OTEL_EXPORTER_OTLP_ENDPOINT: ${{ secrets.OTEL_EXPORTER_OTLP_ENDPOINT }}
+                  OTEL_EXPORTER_OTLP_HEADERS: ${{ secrets.OTEL_EXPORTER_OTLP_HEADERS }}
+              run: npm run publish:marketplace:nightly

.github/workflows/publish-nightly.yml

@@ -0,0 +1,75 @@
+name: "Publish Nightly Release"
+
+on:
+  workflow_dispatch:
+
+permissions:
+    contents: write
+    packages: write
+    checks: write
+    pull-requests: write
+
+jobs:
+    test:
+        uses: ./.github/workflows/test.yml
+
+    publish:
+        needs: test
+        name: Publish Cline (Nightly) Extension
+        if: github.repository == 'cline/cline'
+        runs-on: ubuntu-latest
+        environment: PublishNightly
+
+        steps:
+            - uses: actions/checkout@v4
+              with:
+                  lfs: true
+
+            - name: Check for recent commits
+              run: |
+                if [ $(git rev-list --count HEAD --since="24 hours ago") -eq 0 ]; then
+                  echo "No commits in last 24 hours, exiting"
+                  exit 0
+                fi
+                echo "Found recent commits, proceeding with build"
+                
+            - name: Setup Node.js
+              uses: actions/setup-node@v4
+              with:
+                  # Keep publish environment aligned with test workflow/tooling lockfile expectations.
+                  # Newer LTS (Node 24 / npm 11) can make `npm list` fail with ELSPROBLEMS during vsce packaging.
+                  node-version: 22
+
+            - name: Install root dependencies
+              run: npm ci --include=optional
+
+            - name: Install webview-ui dependencies
+              run: cd webview-ui && npm ci --include=optional
+
+            - name: Install Publishing Tools
+              run: npm install -g @vscode/vsce ovsx
+
+            - name: Verify LFS media assets are resolved
+              run: |
+                  for FILE in webview-ui/src/assets/cline_kanban_demo.mp4 webview-ui/src/assets/cline_kanban_demo.webm; do
+                    if grep -q "git-lfs.github.com/spec/v1" "$FILE"; then
+                      echo "Error: $FILE is still a Git LFS pointer in CI checkout"
+                      exit 1
+                    fi
+                  done
+
+            - name: Publish Nightly Extension
+              env:
+                  VSCE_PAT: ${{ secrets.VSCE_PAT }}
+                  OVSX_PAT: ${{ secrets.OVSX_PAT }}
+                  TELEMETRY_SERVICE_API_KEY: ${{ secrets.TELEMETRY_SERVICE_API_KEY }}
+                  ERROR_SERVICE_API_KEY: ${{ secrets.ERROR_SERVICE_API_KEY }}
+                  CLINE_ENVIRONMENT: production
+                  # OpenTelemetry production defaults (can be overridden at runtime)
+                  OTEL_TELEMETRY_ENABLED: ${{ secrets.OTEL_TELEMETRY_ENABLED }}
+                  OTEL_LOGS_EXPORTER: otlp
+                  OTEL_METRICS_EXPORTER: otlp
+                  OTEL_EXPORTER_OTLP_PROTOCOL: ${{ secrets.OTEL_EXPORTER_OTLP_PROTOCOL }}
+                  OTEL_EXPORTER_OTLP_ENDPOINT: ${{ secrets.OTEL_EXPORTER_OTLP_ENDPOINT }}
+                  OTEL_EXPORTER_OTLP_HEADERS: ${{ secrets.OTEL_EXPORTER_OTLP_HEADERS }}
+              run: npm run publish:marketplace:nightly

.github/workflows/publish.yml

@@ -0,0 +1,223 @@
+name: "Publish Release"
+
+on:
+    workflow_dispatch:
+        inputs:
+            release-type:
+                description: "Choose release type (release or pre-release)"
+                required: true
+                default: "release"
+                type: choice
+                options:
+                    - pre-release
+                    - release
+            auto_create_tag_from_main:
+                description: "Auto-create and push the provided tag from the tested main commit (recommended)"
+                required: true
+                default: true
+                type: boolean
+            tag:
+                description: "Tag to publish (required in both modes, e.g., v3.1.2)"
+                required: true
+                type: string
+
+permissions:
+    contents: write
+    packages: write
+    checks: write
+    pull-requests: write
+
+jobs:
+    test:
+        uses: ./.github/workflows/test.yml
+
+    publish:
+        needs: test
+        name: Publish Extension
+        runs-on: ubuntu-latest
+        environment: publish
+
+        steps:
+            - uses: actions/checkout@v4
+              with:
+                  ref: main
+                  fetch-depth: 0
+                  fetch-tags: true
+                  lfs: true
+
+            - name: Resolve Release Tag
+              id: resolve_tag
+              env:
+                  TAG: ${{ github.event.inputs.tag }}
+                  AUTO_CREATE: ${{ github.event.inputs.auto_create_tag_from_main }}
+              run: |
+                  TESTED_SHA="${{ github.sha }}"
+                  WORKFLOW_REF="${{ github.ref }}"
+
+                  if [[ -z "$TAG" ]]; then
+                    echo "Error: tag input is required"
+                    exit 1
+                  fi
+
+                  if [[ ! "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+([-.][0-9A-Za-z.]+)?$ ]]; then
+                    echo "Error: tag must match vX.Y.Z (optionally with -suffix or .suffix)"
+                    exit 1
+                  fi
+                  TAG_REF="refs/tags/$TAG"
+
+                  git fetch origin main --tags
+
+                  if [[ "$AUTO_CREATE" == "true" ]]; then
+                    if [[ "$WORKFLOW_REF" != "refs/heads/main" ]]; then
+                      echo "Error: auto-create mode requires dispatching from main (current ref: $WORKFLOW_REF)"
+                      exit 1
+                    fi
+                    echo "Auto-create enabled. Using tested workflow SHA: $TESTED_SHA"
+
+                    if ! git merge-base --is-ancestor "$TESTED_SHA" origin/main; then
+                      echo "Error: tested SHA $TESTED_SHA is not on origin/main"
+                      exit 1
+                    fi
+
+                    if git show-ref --verify --quiet "$TAG_REF"; then
+                      TAG_SHA=$(git rev-list -n 1 "$TAG_REF^{commit}")
+                      if [[ "$TAG_SHA" != "$TESTED_SHA" ]]; then
+                        echo "Error: tag '$TAG' already exists at $TAG_SHA, not at tested SHA ($TESTED_SHA)"
+                        exit 1
+                      fi
+                      echo "Tag '$TAG' already exists at tested SHA. Continuing."
+                    else
+                      git config user.name "github-actions[bot]"
+                      git config user.email "github-actions[bot]@users.noreply.github.com"
+                      git tag "$TAG" "$TESTED_SHA"
+                      git push origin "$TAG_REF"
+                      echo "Created and pushed tag '$TAG' from tested SHA $TESTED_SHA."
+                    fi
+                  else
+                    if ! git show-ref --verify --quiet "$TAG_REF"; then
+                      echo "Error: tag '$TAG' does not exist in the repository"
+                      exit 1
+                    fi
+                    echo "Using existing tag '$TAG'."
+                  fi
+
+                  git checkout --detach "$TAG_REF^{commit}"
+                  echo "tag=$TAG" >> $GITHUB_OUTPUT
+                  echo "resolved_sha=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
+
+            - name: Setup Node.js
+              uses: actions/setup-node@v4
+              with:
+                  node-version: 22
+
+            - name: Install root dependencies
+              run: npm install --include=optional
+
+            - name: Install webview-ui dependencies
+              run: cd webview-ui && npm install --include=optional
+
+            - name: Install Publishing Tools
+              run: npm install -g @vscode/vsce ovsx
+
+            - name: Get Version
+              id: get_version
+              run: |
+                  VERSION=$(node -p "require('./package.json').version")
+                  echo "version=$VERSION" >> $GITHUB_OUTPUT
+
+            - name: Verify Tag Matches Package Version
+              run: |
+                  TAG="${{ steps.resolve_tag.outputs.tag }}"
+                  VERSION="v${{ steps.get_version.outputs.version }}"
+                  if [[ "$TAG" != "$VERSION" ]]; then
+                    echo "Error: tag '$TAG' does not match package version '$VERSION'"
+                    exit 1
+                  fi
+                  echo "Tag and package version match: $TAG"
+
+            - name: Verify LFS media assets are resolved
+              run: |
+                  for FILE in webview-ui/src/assets/cline_kanban_demo.mp4 webview-ui/src/assets/cline_kanban_demo.webm; do
+                    if grep -q "git-lfs.github.com/spec/v1" "$FILE"; then
+                      echo "Error: $FILE is still a Git LFS pointer in CI checkout"
+                      exit 1
+                    fi
+                  done
+
+            - name: Package and Publish Extension
+              env:
+                  VSCE_PAT: ${{ secrets.VSCE_PAT }}
+                  OVSX_PAT: ${{ secrets.OVSX_PAT }}
+                  CLINE_ENVIRONMENT: production
+                  TELEMETRY_SERVICE_API_KEY: ${{ secrets.TELEMETRY_SERVICE_API_KEY }}
+                  ERROR_SERVICE_API_KEY: ${{ secrets.ERROR_SERVICE_API_KEY }}
+                  # OpenTelemetry production defaults (can be overridden at runtime)
+                  OTEL_TELEMETRY_ENABLED: ${{ secrets.OTEL_TELEMETRY_ENABLED }}
+                  OTEL_LOGS_EXPORTER: otlp
+                  OTEL_METRICS_EXPORTER: otlp
+                  OTEL_EXPORTER_OTLP_PROTOCOL: ${{ secrets.OTEL_EXPORTER_OTLP_PROTOCOL }}
+                  OTEL_EXPORTER_OTLP_ENDPOINT: ${{ secrets.OTEL_EXPORTER_OTLP_ENDPOINT }}
+                  OTEL_EXPORTER_OTLP_HEADERS: ${{ secrets.OTEL_EXPORTER_OTLP_HEADERS }}
+                  RELEASE_TYPE: ${{ github.event.inputs.release-type }}
+              run: |
+                  # Required to generate the .vsix
+                  vsce package  --allow-package-secrets sendgrid --out "cline-${{ steps.get_version.outputs.version }}.vsix"
+
+                  if [ "$RELEASE_TYPE" = "pre-release" ]; then
+                    npm run publish:marketplace:prerelease
+                    echo "Successfully published pre-release version ${{ steps.get_version.outputs.version }} to VS Code Marketplace and Open VSX Registry"
+                  else
+                    npm run publish:marketplace
+                    echo "Successfully published release version ${{ steps.get_version.outputs.version }} to VS Code Marketplace and Open VSX Registry"
+                  fi
+
+            - name: Get Previous Tag
+              id: prev_tag
+              run: |
+                  CURRENT_TAG="${{ steps.resolve_tag.outputs.tag }}"
+                  PREV_TAG=$(git describe --tags --abbrev=0 "$CURRENT_TAG^" 2>/dev/null || echo "")
+                  echo "prev_tag=$PREV_TAG" >> $GITHUB_OUTPUT
+
+            - name: Get Changelog Entry
+              id: changelog
+              run: |
+                  # Get content between first ## [ and second ## [
+                  CONTENT=$(awk '/^## \[/{if(found) exit; found=1; next} found{print}' CHANGELOG.md)
+                  echo "content<<EOF" >> $GITHUB_OUTPUT
+                  echo "$CONTENT" >> $GITHUB_OUTPUT
+                  echo "EOF" >> $GITHUB_OUTPUT
+
+            - name: Create GitHub Release
+              uses: softprops/action-gh-release@v1
+              with:
+                  tag_name: ${{ steps.resolve_tag.outputs.tag }}
+                  files: "*.vsix"
+                  body: |
+                      ${{ steps.changelog.outputs.content }}
+
+                      **Full Changelog**: https://github.com/${{ github.repository }}/compare/${{ steps.prev_tag.outputs.prev_tag }}...${{ steps.resolve_tag.outputs.tag }}
+                  prerelease: ${{ github.event.inputs.release-type == 'pre-release' }}
+              env:
+                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+            - name: Post release to Slack
+              uses: slackapi/slack-github-action@v3.0.1
+              with:
+                  method: chat.postMessage
+                  token: ${{ secrets.SLACK_RELEASE_BOT_TOKEN }}
+                  payload: |
+                    channel: "C0APVKGGZFC"
+                    text: "Cline ${{ steps.resolve_tag.outputs.tag }}"
+                    blocks:
+                      - type: "section"
+                        text:
+                          type: "mrkdwn"
+                          text: "*Cline ${{ steps.resolve_tag.outputs.tag }}*"
+                      - type: "section"
+                        text:
+                          type: "mrkdwn"
+                          text: ${{ toJSON(steps.changelog.outputs.content) }}
+                      - type: "context"
+                        elements:
+                          - type: "mrkdwn"
+                            text: "Full Changelog: https://github.com/${{ github.repository }}/compare/${{ steps.prev_tag.outputs.prev_tag }}...${{ steps.resolve_tag.outputs.tag }}"

.github/workflows/repo-delete-agent-promo-comments.yml

@@ -1,60 +0,0 @@
-# Some coding-agent GitHub Apps advertise themselves by auto-commenting on every
-# new PR ("<Tool> Agent can help with this pull request. Just @<tool> ..."). The
-# app needs pull_requests:write for its real job (pushing branches, opening PRs),
-# and GitHub offers no per-behavior control over an installed App, so the ad
-# cannot be disabled at the source. This deletes those promo comments as they
-# appear. Genuine agent output comments (work results, reviews) don't match the
-# promo pattern and are left alone.
-#
-# No checkout, API-calls-only — comment text is only ever handled as data inside
-# the script, never interpolated into the workflow definition.
-name: repo-delete-agent-promo-comments
-on:
-    issue_comment:
-        types: [created]
-
-jobs:
-    delete:
-        runs-on: ubuntu-latest
-        timeout-minutes: 2
-        # Prefilter so a runner only spins up for bot comments that look like the
-        # ad; the script re-verifies before deleting.
-        if: >-
-            github.event.issue.pull_request &&
-            endsWith(github.event.comment.user.login, '[bot]') &&
-            contains(github.event.comment.body, 'can help with this pull request')
-        # Comment deletion goes through the issues API, but GitHub gates the
-        # endpoint by where the comment lives: issue comments need `issues`,
-        # PR-conversation comments need `pull-requests`. The prefilter restricts
-        # this job to PR comments, so pull-requests is the one that matters;
-        # issues is kept in case the prefilter is ever widened.
-        permissions:
-            issues: write
-            pull-requests: write
-        steps:
-            # Pinned to a commit SHA (not the mutable v7 tag) because this job holds
-            # write permissions and fires on attacker-postable events.
-            - uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
-              with:
-                  script: |
-                      const comment = context.payload.comment
-
-                      // Belt and suspenders on top of the job-level prefilter: only
-                      // delete when the author is a real GitHub App bot AND the body
-                      // matches the self-promotion shape ("... can help with this
-                      // pull request. Just @<handle> ..."). A human quoting the ad
-                      // text is not a Bot; a bot posting real work output doesn't
-                      // match the promo shape.
-                      const isBot = comment.user.type === "Bot"
-                      const isPromo = /\bcan help with this pull request\b[\s\S]*@\w/i.test(comment.body || "")
-
-                      if (!isBot || !isPromo) {
-                          core.info("not an agent promo comment, leaving it alone")
-                          return
-                      }
-
-                      await github.rest.issues.deleteComment({
-                          ...context.repo,
-                          comment_id: comment.id,
-                      })
-                      core.info(`deleted promo comment ${comment.id} by ${comment.user.login} on #${context.payload.issue.number}`)

.github/workflows/repo-label-issues.yml

@@ -1,65 +0,0 @@
-name: repo-label-issues
-
-on:
-  issues:
-    types: [opened, edited]
-
-jobs:
-  label:
-    runs-on: ubuntu-latest
-    permissions:
-      issues: write
-    steps:
-      - uses: actions/github-script@v7
-        with:
-          script: |
-            const body = context.payload.issue.body || '';
-            const labels = context.payload.issue.labels.map(l => l.name);
-
-            // Check if JetBrains Plugin is selected
-            if (body.match(/###\s*Cline Surface\s*\n+JetBrains Plugin/i)) {
-              if (!labels.includes('JetBrains')) {
-                await github.rest.issues.addLabels({
-                  owner: context.repo.owner,
-                  repo: context.repo.repo,
-                  issue_number: context.issue.number,
-                  labels: ['JetBrains']
-                });
-              }
-            }
-
-            // Check if VSCode Extension is selected
-            if (body.match(/###\s*Cline Surface\s*\n+VSCode Extension/i)) {
-              if (!labels.includes('VS Code')) {
-                await github.rest.issues.addLabels({
-                  owner: context.repo.owner,
-                  repo: context.repo.repo,
-                  issue_number: context.issue.number,
-                  labels: ['VS Code']
-                });
-              }
-            }
-
-            // Check if CLI is selected
-            if (body.match(/###\s*Cline Surface\s*\n+CLI/i)) {
-              if (!labels.includes('CLI')) {
-                await github.rest.issues.addLabels({
-                  owner: context.repo.owner,
-                  repo: context.repo.repo,
-                  issue_number: context.issue.number,
-                  labels: ['CLI']
-                });
-              }
-            }
-
-            // Check if beta version checkbox is checked
-            if (body.includes('- [X] I am using a beta version of Cline') || body.includes('- [x] I am using a beta version of Cline')) {
-              if (!labels.includes('beta')) {
-                await github.rest.issues.addLabels({
-                  owner: context.repo.owner,
-                  repo: context.repo.repo,
-                  issue_number: context.issue.number,
-                  labels: ['beta']
-                });
-              }
-            }

.github/workflows/repo-stale-issues.yml

@@ -1,25 +0,0 @@
-# This workflow will only label and/or close 30 issues at a time in order to avoid exceeding a rate limit.
-# More info: https://docs.github.com/en/actions/use-cases-and-examples/project-management/closing-inactive-issues
-name: repo-stale-issues
-on:
-    schedule:
-        - cron: "30 1 * * *"
-
-jobs:
-    close-issues:
-        runs-on: ubuntu-latest
-        permissions:
-            issues: write
-            pull-requests: write
-        steps:
-            - uses: actions/stale@v9
-              with:
-                  days-before-issue-stale: 60
-                  days-before-issue-close: 14
-                  stale-issue-label: "stale"
-                  stale-issue-message: "This issue is stale because it has been open for 60 days with no activity."
-                  close-issue-message: "This issue was closed because it has been inactive for 14 days since being marked as stale."
-                  days-before-pr-stale: -1
-                  days-before-pr-close: -1
-                  exempt-issue-labels: "pinned,security"
-                  repo-token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/repo-strip-agent-badges.yml

@@ -1,65 +0,0 @@
-# Cloud coding agents append promotional badge blocks to PR bodies after the
-# agent's final turn, wrapped around <!-- <VENDOR>_AGENT_PR_BODY_BEGIN/END -->
-# marker comments. The agent itself never sees that content, so no repo rule or
-# agent instruction can prevent it. This strips it from the PR description on
-# open/edit, keeping only the agent-authored content between the markers.
-#
-# Uses pull_request_target so the token has write access on PRs from forks. That
-# trigger is only unsafe when a job checks out and executes PR code — this one
-# never checks out the repository, it only calls the REST API.
-name: repo-strip-agent-badges
-on:
-    pull_request_target:
-        types: [opened, edited]
-
-concurrency:
-    group: strip-agent-badges-${{ github.event.pull_request.number }}
-    cancel-in-progress: true
-
-jobs:
-    strip:
-        runs-on: ubuntu-latest
-        if: contains(github.event.pull_request.body, '_AGENT_PR_BODY')
-        permissions:
-            pull-requests: write
-        steps:
-            # Pinned to a commit SHA (not the mutable v7 tag) because this job holds
-            # write permissions under pull_request_target.
-            - uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
-              with:
-                  script: |
-                      // Re-fetch instead of trusting the event payload: the body may have
-                      // been edited again between the event firing and this run (agent
-                      // harnesses edit PR bodies post-open), and updating from the stale
-                      // snapshot would clobber the newer content.
-                      const { data: pr } = await github.rest.pulls.get({
-                          ...context.repo,
-                          pull_number: context.payload.pull_request.number,
-                      })
-                      const body = pr.body || ""
-
-                      // The BEGIN/END comments wrap the agent-authored content; everything
-                      // outside them (vendor promo badges, "open in <tool>" links) is
-                      // appended by the harness. Keep only what's between the markers.
-                      // The backreference requires BEGIN and END to name the same vendor.
-                      // No markers -> no match -> body passes through unchanged.
-                      const cleaned = body
-                          .replace(
-                              /^[\s\S]*?<!--\s*([A-Z][A-Z0-9_]*?)_AGENT_PR_BODY_BEGIN\s*-->\r?\n?([\s\S]*?)<!--\s*\1_AGENT_PR_BODY_END\s*-->[\s\S]*$/,
-                              "$2",
-                          )
-                          .trimEnd()
-
-                      // No change means a previous run already cleaned this body. Returning
-                      // without an update is what stops `edited` from retriggering forever.
-                      if (cleaned === body) {
-                          core.info("nothing to strip")
-                          return
-                      }
-
-                      await github.rest.pulls.update({
-                          ...context.repo,
-                          pull_number: pr.number,
-                          body: cleaned,
-                      })
-                      core.info(`stripped ${body.length - cleaned.length} chars from PR #${pr.number}`)

.github/workflows/sdk-publish.yml

@@ -1,367 +0,0 @@
-name: sdk-publish
-
-on:
-  workflow_dispatch:
-    inputs:
-      channel:
-        description: "Publish channel"
-        required: true
-        type: choice
-        options:
-          - nightly
-          - latest
-        default: nightly
-      force_publish:
-        description: "Force publish even if there are no commits in the last 24 hours"
-        required: false
-        type: boolean
-        default: false
-      confirm_publish:
-        description: 'Required when channel=latest. Type "publish" to confirm release publish.'
-        required: false
-        type: string
-  schedule:
-    # Run nightly at 2:00 AM UTC
-    - cron: "0 2 * * *"
-
-defaults:
-  run:
-    working-directory: .
-
-jobs:
-  test:
-    permissions:
-      contents: read
-    uses: ./.github/workflows/sdk-test.yml
-
-  publish-sdk:
-    needs: test
-    name: Publish SDK Packages
-    permissions:
-      contents: write
-      id-token: write
-    if: |
-      github.repository == 'cline/cline' &&
-      github.ref == 'refs/heads/main' &&
-      (
-        github.event_name != 'workflow_dispatch' ||
-        inputs.channel != 'latest' ||
-        (
-          inputs.confirm_publish == 'publish' &&
-          !endsWith(github.actor, '[bot]')
-        )
-      )
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Determine publish channel
-        id: channel
-        env:
-          EVENT_NAME: ${{ github.event_name }}
-          INPUT_CHANNEL: ${{ inputs.channel }}
-        run: |
-          # Default to nightly for scheduled runs
-          if [ "$EVENT_NAME" = "schedule" ]; then
-            echo "channel=nightly" >> $GITHUB_OUTPUT
-          else
-            echo "channel=$INPUT_CHANNEL" >> $GITHUB_OUTPUT
-          fi
-
-      - name: Check for recent commits
-        id: check_commits
-        env:
-          CHANNEL: ${{ steps.channel.outputs.channel }}
-          FORCE_PUBLISH: ${{ inputs.force_publish }}
-        run: |
-          # Always publish for latest (production) releases
-          if [ "$CHANNEL" = "latest" ]; then
-            echo "Production release requested, proceeding with publish"
-            echo "skip=false" >> $GITHUB_OUTPUT
-            exit 0
-          fi
-
-          if [ "$FORCE_PUBLISH" = "true" ]; then
-            echo "force_publish enabled, proceeding with publish"
-            echo "skip=false" >> $GITHUB_OUTPUT
-            exit 0
-          fi
-
-          if [ "$(git rev-list --count HEAD --since="24 hours ago")" -eq 0 ]; then
-            echo "No commits in last 24 hours, skipping publish"
-            echo "skip=true" >> $GITHUB_OUTPUT
-          else
-            echo "Found recent commits, proceeding with publish"
-            echo "skip=false" >> $GITHUB_OUTPUT
-          fi
-
-      - name: Verify trusted publishing context
-        if: steps.check_commits.outputs.skip != 'true'
-        run: |
-          if [ -z "${ACTIONS_ID_TOKEN_REQUEST_TOKEN:-}" ] || [ -z "${ACTIONS_ID_TOKEN_REQUEST_URL:-}" ]; then
-            echo "GitHub OIDC request environment is unavailable. Ensure this job has id-token: write for npm trusted publishing."
-            exit 1
-          fi
-          echo "GitHub OIDC request environment is available for npm trusted publishing."
-
-      - name: Setup Bun
-        if: steps.check_commits.outputs.skip != 'true'
-        uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: "1.3.13"
-
-      - name: Setup Node.js
-        if: steps.check_commits.outputs.skip != 'true'
-        uses: actions/setup-node@v4
-        with:
-          node-version: "24.x"
-          registry-url: "https://registry.npmjs.org"
-
-      - name: Verify publish tooling
-        if: steps.check_commits.outputs.skip != 'true'
-        run: |
-          NPM_VERSION=$(npm --version)
-          echo "npm ${NPM_VERSION}"
-          IFS=. read -r major minor patch <<EOF
-          ${NPM_VERSION}
-          EOF
-          if [ "$major" -lt 11 ] || { [ "$major" -eq 11 ] && [ "$minor" -lt 5 ]; } || { [ "$major" -eq 11 ] && [ "$minor" -eq 5 ] && [ "$patch" -lt 1 ]; }; then
-            echo "npm 11.5.1 or newer is required for trusted publishing"
-            exit 1
-          fi
-
-      - name: Install dependencies
-        if: steps.check_commits.outputs.skip != 'true'
-        run: bun install
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Build SDK
-        if: steps.check_commits.outputs.skip != 'true'
-        run: bun run build:sdk
-
-      - name: Generate shared version
-        if: steps.check_commits.outputs.skip != 'true'
-        id: version
-        env:
-          CHANNEL: ${{ steps.channel.outputs.channel }}
-        run: |
-          BASE_VERSION=$(node -p "require('./sdk/packages/llms/package.json').version")
-
-          if [ "$CHANNEL" = "nightly" ]; then
-            TIMESTAMP=$(date +%s)
-            VERSION="${BASE_VERSION}-nightly.${TIMESTAMP}"
-          else
-            VERSION="$BASE_VERSION"
-          fi
-
-          echo "Base version: $BASE_VERSION"
-          echo "Channel: $CHANNEL"
-          echo "Publish version: $VERSION"
-          echo "version=$VERSION" >> $GITHUB_OUTPUT
-
-      - name: Update all package versions and lockfile
-        if: steps.check_commits.outputs.skip != 'true'
-        env:
-          VERSION: ${{ steps.version.outputs.version }}
-        run: bun sdk/scripts/version.ts "$VERSION"
-
-      - name: Verify publishability
-        if: steps.check_commits.outputs.skip != 'true'
-        run: bun sdk/scripts/check-publish.ts
-
-      - name: Prepare package tarball directory
-        if: steps.check_commits.outputs.skip != 'true'
-        run: mkdir -p "$RUNNER_TEMP/sdk-npm-packs"
-
-      # Pack with Bun so workspace/catalog protocols are resolved in the tarball,
-      # then publish that tarball with npm so npm trusted publishing can use GitHub OIDC.
-      # Publish sequentially in dependency order: shared → llms → agents → core → sdk
-      - name: Publish @cline/shared
-        if: steps.check_commits.outputs.skip != 'true'
-        env:
-          NPM_CONFIG_PROVENANCE: "true"
-          CHANNEL: ${{ steps.channel.outputs.channel }}
-          VERSION: ${{ steps.version.outputs.version }}
-        run: |
-          echo "Publishing @cline/shared@${VERSION} with tag '${CHANNEL}'..."
-          cd sdk/packages/shared
-          TARBALL=$(bun pm pack --destination "$RUNNER_TEMP/sdk-npm-packs" --quiet)
-          npm publish "$RUNNER_TEMP/sdk-npm-packs/$(basename "$TARBALL")" --tag "$CHANNEL" --access public
-
-      - name: Publish @cline/llms
-        if: steps.check_commits.outputs.skip != 'true'
-        env:
-          NPM_CONFIG_PROVENANCE: "true"
-          CHANNEL: ${{ steps.channel.outputs.channel }}
-          VERSION: ${{ steps.version.outputs.version }}
-        run: |
-          echo "Publishing @cline/llms@${VERSION} with tag '${CHANNEL}'..."
-          cd sdk/packages/llms
-          TARBALL=$(bun pm pack --destination "$RUNNER_TEMP/sdk-npm-packs" --quiet)
-          npm publish "$RUNNER_TEMP/sdk-npm-packs/$(basename "$TARBALL")" --tag "$CHANNEL" --access public
-
-      - name: Publish @cline/agents
-        if: steps.check_commits.outputs.skip != 'true'
-        env:
-          NPM_CONFIG_PROVENANCE: "true"
-          CHANNEL: ${{ steps.channel.outputs.channel }}
-          VERSION: ${{ steps.version.outputs.version }}
-        run: |
-          echo "Publishing @cline/agents@${VERSION} with tag '${CHANNEL}'..."
-          cd sdk/packages/agents
-          TARBALL=$(bun pm pack --destination "$RUNNER_TEMP/sdk-npm-packs" --quiet)
-          npm publish "$RUNNER_TEMP/sdk-npm-packs/$(basename "$TARBALL")" --tag "$CHANNEL" --access public
-
-      - name: Publish @cline/core
-        if: steps.check_commits.outputs.skip != 'true'
-        env:
-          NPM_CONFIG_PROVENANCE: "true"
-          CHANNEL: ${{ steps.channel.outputs.channel }}
-          VERSION: ${{ steps.version.outputs.version }}
-        run: |
-          echo "Publishing @cline/core@${VERSION} with tag '${CHANNEL}'..."
-          cd sdk/packages/core
-          TARBALL=$(bun pm pack --destination "$RUNNER_TEMP/sdk-npm-packs" --quiet)
-          npm publish "$RUNNER_TEMP/sdk-npm-packs/$(basename "$TARBALL")" --tag "$CHANNEL" --access public
-
-      - name: Publish @cline/sdk
-        if: steps.check_commits.outputs.skip != 'true'
-        env:
-          NPM_CONFIG_PROVENANCE: "true"
-          CHANNEL: ${{ steps.channel.outputs.channel }}
-          VERSION: ${{ steps.version.outputs.version }}
-        run: |
-          echo "Publishing @cline/sdk@${VERSION} with tag '${CHANNEL}'..."
-          cd sdk/packages/sdk
-          TARBALL=$(bun pm pack --destination "$RUNNER_TEMP/sdk-npm-packs" --quiet)
-          npm publish "$RUNNER_TEMP/sdk-npm-packs/$(basename "$TARBALL")" --tag "$CHANNEL" --access public
-
-      - name: Create package tags for production publish
-        if: steps.check_commits.outputs.skip != 'true' && steps.channel.outputs.channel == 'latest'
-        env:
-          VERSION: ${{ steps.version.outputs.version }}
-        run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-
-          for PKG in shared llms agents core sdk; do
-            TAG="sdk/${PKG}/v${VERSION}"
-            if git rev-parse -q --verify "refs/tags/${TAG}" >/dev/null; then
-              echo "Tag already exists locally: ${TAG}"
-            else
-              git tag -a "${TAG}" -m "@cline/${PKG}@${VERSION}"
-              echo "Created tag: ${TAG}"
-            fi
-
-            # Ensure remote has the tag; this is idempotent if tag already exists remotely.
-            git push origin "refs/tags/${TAG}"
-          done
-
-      - name: Get Previous SDK Tag
-        if: steps.check_commits.outputs.skip != 'true' && steps.channel.outputs.channel == 'latest'
-        id: prev_tag
-        env:
-          VERSION: ${{ steps.version.outputs.version }}
-        run: |
-          # The checkout is shallow and tagless, so fetch the release tags explicitly.
-          git fetch origin "+refs/tags/sdk/sdk/v*:refs/tags/sdk/sdk/v*"
-          PREV_TAG=$(git tag -l 'sdk/sdk/v*' | grep -vx "sdk/sdk/v${VERSION}" | sort -V | tail -1 || echo "")
-          echo "prev_tag=$PREV_TAG" >> $GITHUB_OUTPUT
-
-      - name: Get Changelog Entry
-        if: steps.check_commits.outputs.skip != 'true' && steps.channel.outputs.channel == 'latest'
-        id: changelog
-        run: |
-          # Grab content between the first "## " header and the next one in sdk/CHANGELOG.md
-          CONTENT=$(awk '/^## [0-9]/{if(found) exit; found=1; next} found{print}' sdk/CHANGELOG.md)
-          DELIMITER=$(openssl rand -hex 8)
-          echo "content<<${DELIMITER}" >> $GITHUB_OUTPUT
-          echo "$CONTENT" >> $GITHUB_OUTPUT
-          echo "${DELIMITER}" >> $GITHUB_OUTPUT
-
-          # Slack section blocks reject text longer than 3000 characters, and the
-          # Slack action logs that rejection WITHOUT failing the step - so an
-          # over-long changelog silently drops the release announcement while the
-          # run stays green. Post a trimmed copy to Slack and link out to the full
-          # notes. The GitHub release body stays whole.
-          RELEASE_URL="https://github.com/${GITHUB_REPOSITORY}/releases/tag/sdk/sdk/v${{ steps.version.outputs.version }}"
-          SLACK_CONTENT=$(CONTENT="$CONTENT" RELEASE_URL="$RELEASE_URL" python3 -c '
-          import os
-          content = os.environ["CONTENT"]
-          more = "\n\n… <%s|Read the full release notes>" % os.environ["RELEASE_URL"]
-          if len(content) <= 3000:
-              print(content, end="")
-          else:
-              budget = 3000 - len(more)
-              kept, used = [], 0
-              for line in content.splitlines(keepends=True):
-                  if used + len(line) > budget:
-                      break
-                  kept.append(line)
-                  used += len(line)
-              body = "".join(kept).rstrip() if kept else content[:budget].rstrip()
-              print(body + more, end="")
-          ')
-          echo "slack_content<<${DELIMITER}" >> $GITHUB_OUTPUT
-          echo "$SLACK_CONTENT" >> $GITHUB_OUTPUT
-          echo "${DELIMITER}" >> $GITHUB_OUTPUT
-
-      - name: Create GitHub Release
-        if: steps.check_commits.outputs.skip != 'true' && steps.channel.outputs.channel == 'latest'
-        uses: softprops/action-gh-release@v1
-        with:
-          tag_name: sdk/sdk/v${{ steps.version.outputs.version }}
-          name: "SDK v${{ steps.version.outputs.version }}"
-          body: |
-            ${{ steps.changelog.outputs.content }}
-
-            ${{ steps.prev_tag.outputs.prev_tag != '' && format('**Full Changelog**: https://github.com/{0}/compare/{1}...sdk/sdk/v{2}', github.repository, steps.prev_tag.outputs.prev_tag, steps.version.outputs.version) || '' }}
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Summary
-        if: steps.check_commits.outputs.skip != 'true'
-        env:
-          VERSION: ${{ steps.version.outputs.version }}
-          CHANNEL: ${{ steps.channel.outputs.channel }}
-        run: |
-          echo "Published SDK packages with tag '${CHANNEL}':"
-          echo "  - @cline/shared@${VERSION}"
-          echo "  - @cline/llms@${VERSION}"
-          echo "  - @cline/agents@${VERSION}"
-          echo "  - @cline/core@${VERSION}"
-          echo "  - @cline/sdk@${VERSION}"
-          if [ "$CHANNEL" = "latest" ]; then
-            echo "Created git tags:"
-            echo "  - sdk/shared/v${VERSION}"
-            echo "  - sdk/llms/v${VERSION}"
-            echo "  - sdk/agents/v${VERSION}"
-            echo "  - sdk/core/v${VERSION}"
-            echo "  - sdk/sdk/v${VERSION}"
-          fi
-
-      - name: Post release to Slack
-        if: steps.check_commits.outputs.skip != 'true' && steps.channel.outputs.channel == 'latest'
-        uses: slackapi/slack-github-action@v3.0.1
-        with:
-          method: chat.postMessage
-          token: ${{ secrets.SLACK_RELEASE_BOT_TOKEN }}
-          payload: |
-            channel: "C0APVKGGZFC"
-            text: "Cline SDK v${{ steps.version.outputs.version }}"
-            blocks:
-              - type: "section"
-                text:
-                  type: "mrkdwn"
-                  text: "Cline SDK v${{ steps.version.outputs.version }}"
-              - type: "section"
-                text:
-                  type: "mrkdwn"
-                  text: ${{ toJSON(steps.changelog.outputs.slack_content) }}
-              - type: "context"
-                elements:
-                  - type: "mrkdwn"
-                    text: "<https://www.npmjs.com/package/@cline/sdk/v/${{ steps.version.outputs.version }}|View on npm>${{ steps.prev_tag.outputs.prev_tag != '' && format(' | Full Changelog: https://github.com/{0}/compare/{1}...sdk/sdk/v{2}', github.repository, steps.prev_tag.outputs.prev_tag, steps.version.outputs.version) || '' }}"

.github/workflows/sdk-test.yml

@@ -1,120 +0,0 @@
-name: sdk-test
-
-on:
-    push:
-        branches:
-            - main
-        paths:
-            - "sdk/**"
-            - "apps/examples/desktop-app/**"
-            - ".github/workflows/sdk-test.yml"
-    workflow_dispatch:
-    pull_request:
-        paths:
-            - "sdk/**"
-            - "apps/examples/desktop-app/**"
-            - ".github/workflows/sdk-test.yml"
-    workflow_call:
-
-permissions:
-    contents: read
-
-defaults:
-    run:
-        working-directory: .
-
-jobs:
-    quality-checks:
-        runs-on: ubuntu-latest
-        name: Quality Checks
-        steps:
-            - name: Checkout code
-              uses: actions/checkout@v4
-
-            - name: Setup Bun
-              uses: oven-sh/setup-bun@v2
-              with:
-                  bun-version: "1.3.13"
-
-            - name: Install dependencies
-              run: bun install
-              env:
-                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-            - name: Typecheck
-              run: |
-                  bun run build:sdk
-                  bun run -F @cline/cli build
-                  bun run types
-
-            - name: Lint & Format
-              run: bun run lint
-
-    test:
-        needs: quality-checks
-        strategy:
-            fail-fast: false
-            matrix:
-                include:
-                    - os: ubuntu-latest
-                      node-version: "24.x"
-                    - os: windows-latest
-                      node-version: "24.x"
-        runs-on: ${{ matrix.os }}
-        name: Test (${{ matrix.os }}, Node ${{ matrix.node-version }})
-        steps:
-            - name: Checkout code
-              uses: actions/checkout@v4
-
-            - name: Setup Bun
-              uses: oven-sh/setup-bun@v2
-              with:
-                  bun-version: "1.3.13"
-
-            - name: Setup Node.js
-              uses: actions/setup-node@v4
-              with:
-                  node-version: ${{ matrix.node-version }}
-
-            - name: Install dependencies
-              run: bun install
-              env:
-                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-            - name: Build SDK
-              id: build_sdk_step
-              run: bun run build:sdk
-
-            - name: Build CLI
-              id: build_cli_step
-              if: ${{ !cancelled() && steps.build_sdk_step.outcome == 'success' }}
-              run: bun -F @cline/cli build
-
-            - name: Run Tests
-              if: ${{ !cancelled() && steps.build_sdk_step.outcome == 'success' && steps.build_cli_step.outcome == 'success' && matrix.os != 'windows-latest' }}
-              run: bun run test
-
-            - name: Run SDK Tests (Windows)
-              if: ${{ !cancelled() && steps.build_sdk_step.outcome == 'success' && steps.build_cli_step.outcome == 'success' && matrix.os == 'windows-latest' }}
-              run: bun -F './sdk/packages/**' test
-
-            - name: Run Desktop Sidecar Tests
-              if: ${{ !cancelled() && steps.build_sdk_step.outcome == 'success' && matrix.os == 'ubuntu-latest' }}
-              run: bun -F @cline/code test:sidecar
-
-            - name: Run Desktop Settings UI Tests
-              if: ${{ !cancelled() && steps.build_sdk_step.outcome == 'success' }}
-              run: bun -F @cline/code test:settings-ui
-
-            - name: Smoke test SQLite under Node
-              if: ${{ !cancelled() && steps.build_sdk_step.outcome == 'success' && matrix.os != 'windows-latest' }}
-              timeout-minutes: 10
-              run: bun sdk/scripts/ci-node-smoke.ts
-
-            - name: Run TUI e2e tests
-              if: ${{ !cancelled() && steps.build_sdk_step.outcome == 'success' && steps.build_cli_step.outcome == 'success' && matrix.os == 'ubuntu-latest' && matrix.node-version == '24.x' }}
-              run: bun -F @cline/cli test:e2e:cli:tui
-
-            - name: Verify packages are publishable
-              if: ${{ !cancelled() && steps.build_sdk_step.outcome == 'success' && steps.build_cli_step.outcome == 'success' && matrix.os == 'ubuntu-latest' && matrix.node-version == '24.x' }}
-              run: bun sdk/scripts/check-publish.ts

.github/workflows/stale.yml

@@ -0,0 +1,25 @@
+# This workflow will only label and/or close 30 issues at a time in order to avoid exceeding a rate limit.
+# More info: https://docs.github.com/en/actions/use-cases-and-examples/project-management/closing-inactive-issues
+name: Close inactive issues
+on:
+    schedule:
+        - cron: "30 1 * * *"
+
+jobs:
+    close-issues:
+        runs-on: ubuntu-latest
+        permissions:
+            issues: write
+            pull-requests: write
+        steps:
+            - uses: actions/stale@v9
+              with:
+                  days-before-issue-stale: 60
+                  days-before-issue-close: 14
+                  stale-issue-label: "stale"
+                  stale-issue-message: "This issue is stale because it has been open for 60 days with no activity."
+                  close-issue-message: "This issue was closed because it has been inactive for 14 days since being marked as stale."
+                  days-before-pr-stale: -1
+                  days-before-pr-close: -1
+                  exempt-issue-labels: "pinned,security"
+                  repo-token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/test-stale.yml

@@ -0,0 +1,32 @@
+name: Test Stale Issues Workflow
+on:
+    workflow_dispatch:
+        inputs:
+            days-before-stale:
+                description: "Days before an issue becomes stale"
+                required: true
+                default: "1"
+            days-before-close:
+                description: "Days before a stale issue is closed"
+                required: true
+                default: "1"
+
+jobs:
+    test-stale:
+        runs-on: ubuntu-latest
+        permissions:
+            issues: write
+            pull-requests: write
+        steps:
+            - uses: actions/stale@28ca103
+              with:
+                  days-before-issue-stale: ${{ github.event.inputs.days-before-stale }}
+                  days-before-issue-close: ${{ github.event.inputs.days-before-close }}
+                  stale-issue-label: "stale"
+                  stale-issue-message: "This issue is stale because it has been open for ${{ github.event.inputs.days-before-stale }} days with no activity."
+                  close-issue-message: "This issue was closed because it has been inactive for ${{ github.event.inputs.days-before-close }} days since being marked as stale."
+                  days-before-pr-stale: -1
+                  days-before-pr-close: -1
+                  exempt-issue-labels: "pinned,security"
+                  repo-token: ${{ secrets.GITHUB_TOKEN }}
+                  debug-only: true

.github/workflows/test.yml

@@ -0,0 +1,247 @@
+name: Tests
+
+on:
+    push:
+        branches:
+            - main
+    workflow_dispatch:
+    pull_request:
+        branches:
+            - main
+    workflow_call:
+
+# Set default permissions for all jobs
+permissions:
+    contents: read # Needed to check out code
+    checks: write # Needed to report test results
+    pull-requests: write # Needed to add comments/annotations to PRs
+
+jobs:
+    quality-checks:
+        runs-on: ubuntu-latest
+        name: Quality Checks
+        steps:
+            - name: Checkout code
+              uses: actions/checkout@v4
+
+            - name: Setup Node.js environment
+              uses: actions/setup-node@v4
+              with:
+                  node-version: 22
+                  cache: 'npm'
+                  cache-dependency-path: |
+                      package-lock.json
+                      webview-ui/package-lock.json
+
+            - name: Install root dependencies
+              run: npm ci
+              env:
+                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+            - name: Install webview-ui dependencies
+              run: cd webview-ui && npm ci
+
+            - name: Run Quality Checks (Parallel)
+              run: npm run ci:check-all
+
+    test:
+        needs: quality-checks
+        env:
+            VSCODE_TEST_VERSION: 1.103.0
+        strategy:
+            fail-fast: false
+            matrix:
+                os: [ubuntu-latest, windows-latest]
+        runs-on: ${{ matrix.os }}
+        name: ${{ matrix.os == 'ubuntu-latest' && 'test' || format('test ({0})', matrix.os) }}
+        defaults:
+            run:
+                shell: bash
+        steps:
+            - name: Checkout code
+              uses: actions/checkout@v4
+
+            - name: Setup Node.js environment
+              uses: actions/setup-node@v4
+              with:
+                  node-version: 22
+                  cache: 'npm'
+                  cache-dependency-path: |
+                      package-lock.json
+                      webview-ui/package-lock.json
+
+            - name: Install root dependencies
+              run: npm ci
+              env:
+                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+            - name: Install webview-ui dependencies
+              run: cd webview-ui && npm ci
+
+            - name: Set up NPM on Windows
+              if: runner.os == 'Windows'
+              run: |
+                  npm config set script-shell "C:\\Program Files\\Git\\bin\\bash.exe"
+
+            - name: Cache VS Code test runtime
+              if: runner.os == 'Windows'
+              uses: actions/cache@v4
+              with:
+                  path: .vscode-test
+                  key: vscode-test-runtime-${{ runner.os }}-${{ env.VSCODE_TEST_VERSION }}
+
+            # Build the extension and tests (without redundant checks)
+            - name: Build Tests and Extension
+              id: build_step
+              run: npm run ci:build
+
+            - name: Unit Tests with coverage - Linux
+              id: unit_tests_linux
+              if: ${{ !cancelled() && steps.build_step.outcome == 'success' && runner.os == 'Linux' }}
+              run: |
+                  npx nyc --nycrc-path .nycrc.unit.json --reporter=lcov npm run test:unit
+
+            - name: Unit Tests - Non-Linux
+              id: unit_tests_non_linux
+              if: ${{ !cancelled() && steps.build_step.outcome == 'success' && runner.os != 'Linux' }}
+              run: |
+                  npm run test:unit
+
+            - name: Extension Integration Tests - Linux
+              id: integration_tests_linux
+              if: ${{ !cancelled() && steps.build_step.outcome == 'success' && runner.os == 'Linux' }}
+              run: xvfb-run -a npm run test:coverage
+
+            - name: Extension Integration Tests - Non-Linux
+              id: integration_tests_non_linux
+              if: ${{ !cancelled() && steps.build_step.outcome == 'success' && runner.os != 'Linux' }}
+              run: |
+                  for attempt in 1 2 3; do
+                    echo "Running extension integration tests (attempt ${attempt}/3)"
+                    if npm run test:integration; then
+                      exit 0
+                    fi
+
+                    if [ "$attempt" -eq 3 ]; then
+                      echo "Extension integration tests failed after 3 attempts"
+                      exit 1
+                    fi
+
+                    echo "Extension integration tests failed; retrying after short delay"
+                    sleep 5
+                  done
+
+            - name: Webview Tests with Coverage
+              id: webview_tests
+              if: ${{ !cancelled() && steps.build_step.outcome == 'success' }}
+              run: |
+                  cd webview-ui
+                  npm run test:coverage
+
+            - name: CLI Tests
+              id: cli_tests
+              if: ${{ !cancelled() && steps.build_step.outcome == 'success' }}
+              run: cd cli && npm run test:run
+
+            - name: Save Coverage Reports
+              uses: actions/upload-artifact@v4
+              # Only upload artifacts on Linux - We only need coverage from one OS
+              if: runner.os == 'Linux'
+              with:
+                  name: pr-coverage-reports
+                  path: |
+                      coverage-unit/lcov.info
+                      webview-ui/coverage/lcov.info
+
+    test-platform-integration:
+        needs: quality-checks
+        runs-on: ubuntu-latest
+        steps:
+            - name: Checkout code
+              uses: actions/checkout@v4
+
+            - name: Setup Node.js environment
+              uses: actions/setup-node@v4
+              with:
+                  node-version: 22
+                  cache: 'npm'
+                  cache-dependency-path: |
+                      package-lock.json
+                      webview-ui/package-lock.json
+                      testing-platform/package-lock.json
+
+            - name: Install root dependencies
+              run: npm ci
+              env:
+                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+            - name: Install webview-ui dependencies
+              run: cd webview-ui && npm ci
+
+            - name: Download ripgrep binaries
+              run: npm run download-ripgrep
+
+            - name: Compile Standalone
+              run: npm run compile-standalone
+
+            - name: Install testing platform dependencies
+              run: cd testing-platform && npm ci
+
+            - name: Running testing platform integration spec tests
+              timeout-minutes: 7
+              run: npm run test:tp-orchestrator -- tests/specs/ --count=1 --coverage
+
+            - name: Save Coverage Reports
+              uses: actions/upload-artifact@v4
+              with:
+                name: test-platform-integration-core-coverage
+                path: coverage/**/lcov.info
+
+    qlty:
+        needs: [test, test-platform-integration]
+        runs-on: ubuntu-latest
+        # Run on PRs to main, pushes to main, and manual dispatches
+        steps:
+            - name: Checkout code
+              uses: actions/checkout@v4
+
+            - name: Download unit tests coverage reports
+              uses: actions/download-artifact@v4
+              with:
+                  name: pr-coverage-reports
+                  path: .
+
+            - name: Upload core unit tests coverage to Qlty
+              uses: qltysh/qlty-action/coverage@v2
+              with:
+                  token: ${{ secrets.QLTY_COVERAGE_TOKEN }}
+                  # we can merge multiple files if necessary
+                  files: |
+                    coverage-unit/lcov.info
+                  tag: unit:core
+
+            - name: Upload webview-ui unit tests coverage to Qlty
+              uses: qltysh/qlty-action/coverage@v2
+              with:
+                  token: ${{ secrets.QLTY_COVERAGE_TOKEN }}
+                  # we can merge multiple files if necessary
+                  files: |
+                    webview-ui/coverage/lcov.info
+                  tag: unit:webview-ui
+                  add-prefix: webview-ui/
+
+            - name: Download test platform integration core coverage artifact
+              uses: actions/download-artifact@v4
+              continue-on-error: true
+              id: download-integration-coverage
+              with:
+                name: test-platform-integration-core-coverage
+                path: integration-core-coverage-reports
+
+            - name: Upload core integration tests coverage to Qlty
+              if: steps.download-integration-coverage.outcome == 'success'
+              uses: qltysh/qlty-action/coverage@v2
+              with:
+                token: ${{ secrets.QLTY_COVERAGE_TOKEN }}
+                files: integration-core-coverage-reports/**/lcov.info
+                tag: integration:core

.github/workflows/trigger-jetbrains-tests.yml

@@ -0,0 +1,98 @@
+name: Trigger Jetbrains Plugin <-> Cline Tests
+on:
+  pull_request_target:
+    types: [opened, reopened]
+  issue_comment:
+    types: [created]
+permissions:
+  contents: read
+  pull-requests: read
+concurrency:
+  group: jetbrains-trigger-${{ github.event.pull_request.number || github.event.issue.number }}
+  cancel-in-progress: true
+
+jobs:
+  trigger-integration-test:
+    name: Run Tests
+    runs-on: ubuntu-latest
+    # Run on PR open/reopen, or when someone comments /test-jetbrains on a PR
+    if: |
+      github.event_name == 'pull_request_target' ||
+      (github.event_name == 'issue_comment' &&
+       github.event.issue.pull_request &&
+       contains(github.event.comment.body, '/test-jetbrains') &&
+       contains(fromJSON('["MEMBER","OWNER","COLLABORATOR"]'), github.event.comment.author_association))
+    steps:
+      - name: Generate GitHub App Token
+        id: app-token
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: 1998650
+          private-key: ${{ secrets.CLINE_JETBRAINS_WORKFLOW_KEY }}
+          owner: cline
+          repositories: intellij-plugin
+
+      - name: Get PR details (for issue_comment trigger)
+        id: pr-details
+        if: github.event_name == 'issue_comment'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          PR_DATA=$(gh api repos/${{ github.repository }}/pulls/${{ github.event.issue.number }})
+          echo "head_ref=$(echo "$PR_DATA" | jq -r '.head.ref')" >> $GITHUB_OUTPUT
+          echo "head_sha=$(echo "$PR_DATA" | jq -r '.head.sha')" >> $GITHUB_OUTPUT
+          echo "title=$(echo "$PR_DATA" | jq -r '.title')" >> $GITHUB_OUTPUT
+          echo "html_url=$(echo "$PR_DATA" | jq -r '.html_url')" >> $GITHUB_OUTPUT
+
+      - name: Sanitize untrusted inputs
+        id: sanitize
+        env:
+          RAW_BRANCH_NAME: ${{ github.event_name == 'pull_request_target' && github.head_ref || steps.pr-details.outputs.head_ref }}
+          RAW_PR_TITLE: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.title || steps.pr-details.outputs.title }}
+        run: |
+          # Sanitize branch name for JSON
+          BRANCH_NAME_JSON=$(jq -n --arg b "$RAW_BRANCH_NAME" '$b')
+          echo "branch_name=$BRANCH_NAME_JSON" >> $GITHUB_OUTPUT
+
+          # Sanitize PR title for JSON
+          PR_TITLE_JSON=$(jq -n --arg t "$RAW_PR_TITLE" '$t')
+          echo "pr_title=$PR_TITLE_JSON" >> $GITHUB_OUTPUT
+
+      - name: Trigger IntelliJ Plugin Integration Test
+        env:
+          BRANCH_NAME: ${{ steps.sanitize.outputs.branch_name }}
+          PR_TITLE: ${{ steps.sanitize.outputs.pr_title }}
+          PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
+          PR_SHA: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.sha || steps.pr-details.outputs.head_sha }}
+          PR_URL: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.html_url || steps.pr-details.outputs.html_url }}
+        run: |
+          curl -X POST \
+            -H "Authorization: Bearer ${{ steps.app-token.outputs.token }}" \
+            -H "Accept: application/vnd.github.v3+json" \
+            -H "User-Agent: cline-pr-trigger" \
+            -H "Content-Type: application/json" \
+            https://api.github.com/repos/cline/intellij-plugin/dispatches \
+            -d @- <<EOF
+          {
+            "event_type": "cline-pr-check",
+            "client_payload": {
+              "pr_number": "$PR_NUMBER",
+              "branch_name": $BRANCH_NAME,
+              "action": "${{ github.event.action }}",
+              "sha": "$PR_SHA",
+              "pr_title": $PR_TITLE,
+              "pr_url": "$PR_URL"
+            }
+          }
+          EOF
+
+      - name: Log trigger details
+        env:
+          PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
+          PR_SHA: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.sha || steps.pr-details.outputs.head_sha }}
+        run: |
+          echo "Triggered IntelliJ Plugin integration test for:"
+          echo "  PR #$PR_NUMBER"
+          echo "  Trigger: ${{ github.event_name }}"
+          echo "  Action: ${{ github.event.action }}"
+          echo "  SHA: $PR_SHA"

.github/workflows/ui-publish.yml

@@ -1,150 +0,0 @@
-name: ui-publish
-
-on:
-  workflow_dispatch:
-    inputs:
-      npm_tag:
-        description: "npm distribution tag"
-        required: true
-        type: choice
-        options:
-          - next
-          - latest
-        default: next
-      confirm_publish:
-        description: 'Type "publish" to publish @cline/ui to npm'
-        required: true
-        type: string
-
-permissions:
-  contents: read
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: false
-
-jobs:
-  quality:
-    name: UI quality and package checks
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: "1.3.13"
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: "24.x"
-
-      - name: Install dependencies
-        run: bun install --frozen-lockfile
-
-      # @cline/ui imports @cline/shared/browser (generated-media), which
-      # resolves to dist output — build it before anything typechecks or
-      # builds the ui package.
-      - name: Build shared package
-        run: bun -F @cline/shared build
-
-      - name: Typecheck UI
-        run: bun -F @cline/ui typecheck
-
-      - name: Test UI
-        run: bun -F @cline/ui test
-
-      - name: Build Storybook
-        run: bun -F @cline/ui build-storybook
-
-      - name: Build UI package
-        run: bun -F @cline/ui build
-
-      - name: Test desktop chat integration
-        run: bun -F @cline/code test:chat-ui
-
-      - name: Pack publish artifact
-        id: pack
-        shell: bash
-        run: |
-          set -euo pipefail
-          pack_dir="$RUNNER_TEMP/ui-npm-pack"
-          mkdir -p "$pack_dir"
-          cd sdk/packages/ui
-          bun pm pack --ignore-scripts --destination "$pack_dir" --quiet
-          archive=$(find "$pack_dir" -maxdepth 1 -name '*.tgz' -print -quit)
-          test -n "$archive"
-          echo "archive=$archive" >> "$GITHUB_OUTPUT"
-
-      - name: Test packed package
-        env:
-          UI_PACKAGE_ARCHIVE: ${{ steps.pack.outputs.archive }}
-        run: bun sdk/packages/ui/scripts/smoke-package.ts "$UI_PACKAGE_ARCHIVE"
-
-      - name: Upload publish artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: ui-npm-package
-          path: ${{ runner.temp }}/ui-npm-pack/*.tgz
-          if-no-files-found: error
-          retention-days: 7
-
-  publish:
-    name: Publish @cline/ui
-    if: >-
-      github.event_name == 'workflow_dispatch' &&
-      github.repository == 'cline/cline' &&
-      github.ref == 'refs/heads/main' &&
-      inputs.confirm_publish == 'publish' &&
-      !endsWith(github.actor, '[bot]')
-    needs: quality
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      id-token: write
-    steps:
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: "24.x"
-          registry-url: "https://registry.npmjs.org"
-
-      - name: Download publish artifact
-        uses: actions/download-artifact@v4
-        with:
-          name: ui-npm-package
-          path: ${{ runner.temp }}/ui-npm-pack
-
-      - name: Verify publish tooling
-        shell: bash
-        run: |
-          set -euo pipefail
-          npm_version=$(npm --version)
-          echo "npm ${npm_version}"
-          node -e 'const [major, minor, patch] = process.argv[1].split(".").map(Number); if (major < 11 || (major === 11 && (minor < 5 || (minor === 5 && patch < 1)))) { console.error("npm 11.5.1 or newer is required for trusted publishing"); process.exit(1); }' "$npm_version"
-
-      - name: Publish package
-        shell: bash
-        env:
-          NPM_CONFIG_PROVENANCE: "true"
-          NPM_TAG: ${{ inputs.npm_tag }}
-        run: |
-          set -euo pipefail
-          archive=$(find "$RUNNER_TEMP/ui-npm-pack" -maxdepth 1 -name '*.tgz' -print -quit)
-          if [ -z "$archive" ]; then
-            echo "UI package archive was not downloaded"
-            exit 1
-          fi
-
-          version=$(tar -xOf "$archive" package/package.json | node -e 'let input=""; process.stdin.on("data", chunk => input += chunk); process.stdin.on("end", () => process.stdout.write(JSON.parse(input).version))')
-          if npm view "@cline/ui@${version}" version >/dev/null 2>&1; then
-            echo "@cline/ui@${version} already exists; bump sdk/packages/ui/package.json before publishing"
-            exit 1
-          fi
-
-          npm publish "$archive" --tag "$NPM_TAG" --access public
-          echo "Published @cline/ui@${version} with npm tag '${NPM_TAG}'"

.gitignore

@@ -13,15 +13,12 @@ tmp
 pnpm-lock.yaml
 
 .clineignore
-.cline/enterprise
-.cline/remote-config
-**/.cline/remote-config
 .venv
 .actrc
 CLAUDE.local.md
 
-apps/vscode/webview-ui/src/**/*.js
-apps/vscode/webview-ui/src/**/*.js.map
+webview-ui/src/**/*.js
+webview-ui/src/**/*.js.map
 
 # Ignore coverage directories and files
 coverage
@@ -38,9 +35,9 @@ coverage-unit
 .worktrees
 
 ## Generated files ##
-apps/vscode/src/generated/
-apps/vscode/src/shared/proto/
-apps/vscode/webview-ui/src/services/grpc-client.ts
+src/generated/
+src/shared/proto/
+webview-ui/src/services/grpc-client.ts
 *.tsbuildinfo
 
 # E2E Tests
@@ -59,38 +56,3 @@ evals/smoke-tests/results/
 secrets.json
 tui-traces
 tests/**/cache
-
-# Backup created by scripts/marketplace-readme.mjs while publishing.
-# Should never be committed: only exists if a publish aborts mid-swap.
-.README.github.bak
-
-# Tauri generated code
-apps/*/src-tauri/gen
-apps/*/src-tauri/bin
-apps/examples/*/src-tauri/gen
-apps/examples/*/src-tauri/bin
-# Tauri UI test snapshots
-apps/*/src/tests/.tui-test
-apps/*/src/tests/tui-traces
-apps/vscode/webview-ui/src/**/*.js
-apps/vscode/webview-ui/src/**/*.js.map
-
-
-# SDK Session files / User data
-.cline/data
-.cline/tmp
-*.db
-*.db-shm
-*.db-wal
-.cline/**/managed.json
-.cline/**/bundle.json
-apps/vscode/tsconfig.test.generated.json
-.next/dev/static
-**/src-tauri/target/debug/.fingerprint
-apps/examples/desktop-app/src-tauri/target
-apps/examples/desktop-app/src-tauri/dmg/background.gen.tiff
-apps/examples/desktop-app/webview/.next
-
-# Next.js generated type shim (churns between dev and build)
-apps/examples/desktop-app/webview/next-env.d.ts
-apps/examples/desktop-app/.cursor/settings.json

.greptile/config.json

@@ -1,44 +0,0 @@
-{
-	"strictness": 2,
-	"triggerOnUpdates": true,
-	"statusCheck": true,
-	"rules": [
-		{
-			"id": "sdk-tool-handler-telemetry",
-			"rule": "Any new tool handler added to packages/agents/src or packages/core/src that performs a user-visible action (writes files, executes commands, modifies state, calls external APIs) must include a call to captureToolUsage() from packages/core/src/services/telemetry/core-events.ts, or emit a task.tool_used event via telemetry.capture(). Pure read-only helpers and getters are exempt. When in doubt, prefer instrumentation.",
-			"scope": [
-				"sdk/packages/agents/src/**",
-				"sdk/packages/core/src/**"
-			],
-			"severity": "high"
-		},
-		{
-			"id": "sdk-session-lifecycle-telemetry",
-			"rule": "New session start, end, or state-transition code paths in packages/core/src must call the appropriate typed helper from packages/core/src/services/telemetry/core-events.ts (captureTaskCreated, captureTaskCompleted, captureConversationTurnEvent, captureTokenUsage, etc.). Do not inline raw telemetry.capture() calls for session lifecycle events — always use the typed helper, which guarantees a consistent payload shape.",
-			"scope": [
-				"sdk/packages/core/src/cline-core/**",
-				"sdk/packages/core/src/runtime/**"
-			],
-			"severity": "high"
-		},
-		{
-			"id": "sdk-no-raw-event-strings",
-			"rule": "All telemetry event name strings must be sourced from CORE_TELEMETRY_EVENTS in packages/core/src/services/telemetry/core-events.ts. If a PR introduces a string literal in a telemetry.capture(), telemetry.captureRequired(), or recordCounter()/recordHistogram()/recordGauge() call that does not reference CORE_TELEMETRY_EVENTS, flag it. New events must be added to CORE_TELEMETRY_EVENTS first, with a typed capture helper created alongside them.",
-			"scope": [
-				"sdk/packages/core/src/**",
-				"sdk/packages/agents/src/**",
-				"apps/cli/src/**",
-				"apps/vscode/src/**"
-			],
-			"severity": "medium"
-		},
-		{
-			"id": "sdk-auth-telemetry-completeness",
-			"rule": "Any new OAuth or authentication provider added under packages/core/src/auth must emit all four lifecycle events using the typed helpers from core-events.ts: captureAuthStarted (at flow entry), captureAuthSucceeded + identifyAccount (on token success), captureAuthFailed (on error), and captureAuthLoggedOut (on token invalidation or explicit logout). Flag PRs that introduce a new auth flow file without all four. Cross-reference packages/core/src/auth/cline.ts and packages/core/src/auth/codex.ts as canonical examples.",
-			"scope": [
-				"sdk/packages/core/src/auth/**"
-			],
-			"severity": "high"
-		}
-	]
-}

.greptile/files.json

@@ -1,28 +0,0 @@
-{
-	"files": [
-		{
-			"path": "sdk/packages/core/src/services/telemetry/core-events.ts",
-			"description": "Single source of truth for all telemetry event names (CORE_TELEMETRY_EVENTS) and their typed capture helper functions. Every PR touching telemetry must be evaluated against this catalog. New events must be defined here first."
-		},
-		{
-			"path": "sdk/packages/shared/src/services/telemetry.ts",
-			"description": "ITelemetryService interface definition. Defines the contract all telemetry implementations must satisfy (capture, captureRequired, recordCounter, recordHistogram, recordGauge, flush, dispose)."
-		},
-		{
-			"path": "sdk/packages/core/src/services/telemetry/TelemetryService.ts",
-			"description": "Reference implementation of ITelemetryService used by all hosts. Multi-adapter fan-out service that forwards events to OpenTelemetry."
-		},
-		{
-			"path": "sdk/packages/core/src/services/telemetry/OpenTelemetryProvider.ts",
-			"description": "OpenTelemetry-backed provider that wires logs/metrics/traces exporters. Contains createConfiguredTelemetryService and createConfiguredTelemetryHandle, the canonical factories every host should use."
-		},
-		{
-			"path": "sdk/ARCHITECTURE.md",
-			"description": "Architecture reference. Telemetry design decisions and completion semantics (submit_and_exit anchoring) are documented here. Use as ground truth for design intent."
-		},
-		{
-			"path": "sdk/AGENTS.md",
-			"description": "Package boundary rules. Telemetry runtime services live in @cline/core; @cline/agents must not own stateful telemetry. Use to evaluate whether a telemetry change is being made in the correct package."
-		}
-	]
-}

.greptile/rules.md

@@ -1,161 +0,0 @@
-# SDK Telemetry Standards
-
-These rules supplement `config.json`. The structured rules describe **what** to enforce; this
-document explains **why**, so Greptile has the context to avoid false positives.
-
-## Telemetry Stack
-
-The SDK uses OpenTelemetry (OTEL) as its sole telemetry transport. Events flow through:
-
-```
-core-events.ts (event catalog + typed helpers)
-       ↓
-ITelemetryService (sdk/packages/shared)             ← interface contract
-       ↓
-TelemetryService (sdk/packages/core)                ← multi-adapter fan-out
-       ↓
-OpenTelemetryAdapter → OpenTelemetryProvider    ← OTLP transport
-       ↓
-OTLP endpoint (collector or vendor)
-```
-
-The SDK does **not** depend on the original `cline/cline` repo for telemetry. The two have
-parallel-but-independent stacks; this `.greptile/` config covers only the SDK.
-
-## The Single Source of Truth
-
-`sdk/packages/core/src/services/telemetry/core-events.ts` is the single source of truth for all
-event names. It exports:
-
-- `CORE_TELEMETRY_EVENTS` — a frozen const object grouped by family
-  (`CLIENT`, `SESSION`, `USER`, `TASK`, `HOOKS`, `WORKSPACE`)
-- A typed `capture*()` helper for every event family
-  (`captureExtensionActivated`, `captureTaskCreated`, `captureToolUsage`, etc.)
-
-**Never use raw string literals for event names at call sites.** A new event always means:
-
-1. Add the constant to `CORE_TELEMETRY_EVENTS`
-2. Add a typed `capture*()` helper alongside it (with a typed `properties` parameter)
-3. Add a unit test in `core-events.test.ts` asserting the event flows through the
-   opt-out-respecting `capture` path and never `captureRequired` (opt-out is enforced by
-   `OptedOutTelemetryService`, whose `capture` is a no-op — the test convention is
-   "emits X as a normal opt-out-respecting event"). Events that intentionally bypass
-   opt-out must use `captureRequired` and assert that explicitly.
-
-**All events should be named using snake_case and so should their properties**
-
-## The Activation Funnel
-
-The canonical funnel that downstream analytics depends on:
-
-```
-user.extension_activated
-  → workspace.initialized
-  → workspace.path_resolved (gated on multi-root)
-  → task.created
-  → task.conversation_turn (one per turn, source: "user" | "assistant")
-  → task.completed (source: "submit_and_exit" | "shutdown")
-```
-
-Emission ownership:
-
-- `user.extension_activated`: emitted **once per host process** by host-specific helpers
-  (`captureCliExtensionActivated` for the CLI, `captureExtensionActivated` for VS Code).
-- `workspace.initialized` / `workspace.init_error`: emitted by a de-duplicated emitter in
-  `prepareLocalRuntimeBootstrap`. A dedicated host emits once per workspace; a shared Hub emits
-  once per client surface and workspace. Hosts must NOT re-emit these.
-- `workspace.path_resolved`: emitted from default tool executors **only when**
-  `WorkspaceManager` exposes more than one root.
-- `task.*`: emitted by core session lifecycle code in `sdk/packages/core/src/cline-core/` and
-  `sdk/packages/core/src/runtime/`. Hosts must not duplicate this emission.
-
-## `task.completed` Semantics
-
-`task.completed` marks the moment the **assistant declared the task done**, not the moment
-the SDK session record was finalized. The local runtime emits it when it observes a successful
-`submit_and_exit` tool call (the SDK analog of original Cline's `attempt_completion`). For
-non-interactive runs that finish without invoking the explicit completion tool,
-`shutdownSession` emits it as a fallback with `source: "shutdown"`.
-
-Each session is guaranteed at most one `task.completed` emission. The `source` field
-(`"submit_and_exit" | "shutdown"`) is required for analytics attribution.
-
-## CLI Directory-Ordering Rule
-
-The CLI accepts `--config <dir>`. The CLI **must** apply `setClineDir(...)` and
-`setHomeDir(...)` from `@cline/shared/storage` **before** calling
-`captureCliExtensionActivated()`. Otherwise the telemetry singleton's persisted distinct-id
-and any other on-disk telemetry state lands under `~/.cline` instead of the user's chosen
-config dir.
-
-The canonical pattern is in `apps/cli/src/main.ts`:
-
-```ts
-if (configDir) setClineDir(configDir);
-setHomeDir(homedir());
-captureCliExtensionActivated();   // <-- after dir overrides
-```
-
-## Hub Daemon Telemetry
-
-The detached hub daemon (`sdk/packages/core/src/hub/daemon/entry.ts`) hosts the
-`LocalRuntimeHost` that emits `task.conversation_turn` and `task.tokens` for every
-hub-backed session, so the daemon must own its own `ITelemetryService`. It builds one via
-`createHubDaemonTelemetry()` (`sdk/packages/core/src/hub/daemon/telemetry.ts`), which
-identifies from the cached cline account (re-resolved periodically, since the daemon often
-starts before login) and flushes on every shutdown path, including startup failure.
-
-The Hub transport forwards the serializable `ExtensionContext.client` and
-`ExtensionContext.user` values with session create/restore requests. The daemon wraps its
-process-owned service with `createClientScopedTelemetryService()` so lifecycle events use the
-originating client's `cline_type`, platform/version, and current account/organization without
-mutating the singleton shared by concurrent clients. Keep canonical task fields named
-`provider` and `model`; do not reintroduce host-specific aliases such as `apiProvider` or
-`modelId` for `task.created`, `task.restarted`, or `task.completed`.
-
-`UserContext.distinctId` may be an anonymous machine ID. Set `UserContext.accountId` to the
-authenticated account ID (or `null` for an explicitly signed-out client) whenever a client
-forwards user context; this prevents machine IDs and stale daemon identity from becoming
-`user_id` / `organization_id` on task events.
-
-Flag changes that remove this wiring, construct runtime hosts inside the daemon without
-passing its telemetry handle, or add daemon exit paths that skip the flush — hub-backed
-sessions would silently drop their lifecycle telemetry (this exact bug shipped once).
-
-## Auth Lifecycle Completeness
-
-Every authentication provider in `sdk/packages/core/src/auth/` must emit all four auth lifecycle
-events using the typed helpers:
-
-| Phase | Helper | Where it fires |
-|---|---|---|
-| Flow entry | `captureAuthStarted(provider)` | Top of the OAuth flow function |
-| Token success | `captureAuthSucceeded(provider)` + `identifyAccount(...)` | After successful token exchange |
-| Token error | `captureAuthFailed(provider, errorMessage)` | In the catch block |
-| Token invalidation | `captureAuthLoggedOut(provider, reason)` | On invalid_grant or explicit logout |
-
-Cross-reference `sdk/packages/core/src/auth/cline.ts` and `sdk/packages/core/src/auth/codex.ts` as
-canonical examples of all four phases.
-
-## Single Telemetry Service Per Host
-
-On VS Code, all callers go through the lazy `telemetryService` proxy in
-`apps/vscode/src/services/telemetry/index.ts`, which constructs the service once on first
-use. Do not let individual controllers construct their own `ITelemetryService` — that
-fragments distinct-id state, opt-out tracking, and flush ownership.
-
-The CLI follows the same pattern via the `getCliTelemetryService()` singleton in
-`apps/cli/src/utils/telemetry.ts`, which is memoized by the activation gate in
-`telemetry.activation-gate.ts`.
-
-## Common False-Positive Adjustments
-
-If Greptile flags one of the following, the rule is **not** violated:
-
-- A telemetry call that is wrapped in a host-specific helper (e.g.
-  `captureCliExtensionActivated` wrapping `captureExtensionActivated`) — the inner helper
-  is the typed call.
-- `enterprise.*` events emitted from `apps/cli/src/utils/enterprise.ts` — these are
-  enterprise-side events not yet in `CORE_TELEMETRY_EVENTS`; they are tracked separately.
-- A new test file that uses raw event name strings inside `expect(...)` assertions — tests
-  may reference event names as strings to assert what was emitted.

.husky/pre-commit

@@ -1,11 +1 @@
-if ! command -v gitleaks >/dev/null 2>&1; then
-	echo "gitleaks is required for the pre-commit secret scan."
-	echo "Install it with: brew install gitleaks"
-	echo "Other install options: https://github.com/gitleaks/gitleaks#installing"
-	exit 1
-fi
-
-gitleaks git --pre-commit --redact --staged --verbose || exit 1
-
-cd apps/vscode && bunx lint-staged
-
+lint-staged

.kanban/config.json

@@ -1,9 +0,0 @@
-{
-	"shortcuts": [
-		{
-			"label": "Build & Link CLI",
-			"command": "bun -F @cline/cli build && bun -F @cline/cli link",
-			"icon": "play"
-		}
-	]
-}