fix(vscode): preserve slashy VS Code LM selectors

Point @cline/{shared,llms,agents,core} at 0.0.42-nightly.1780514867, the first
published SDK build that includes the custom-registered-handler routing the
vscode-lm provider needs. Replaces the temporary local-workspace vendoring.

.clinerules/debug-harness.md

@@ -0,0 +1,128 @@
+# Debug Harness
+
+HTTP-controlled debugger for the VSCode extension at `src/dev/debug-harness/server.ts`.
+
+## Quick start
+
+```bash
+# Build extension first if needed (protos + esbuild):
+npm run protos && IS_DEV=true node esbuild.mjs
+
+# Launch (skip-build if already built):
+npx tsx src/dev/debug-harness/server.ts --skip-build --auto-launch
+
+# In another terminal:
+curl localhost:19229/api -d '{"method":"status"}'
+```
+
+## Data Isolation
+
+The debugee runs with `CLINE_DIR=~/.cline2` by default, separate from your real `~/.cline`.
+This prevents the debugee's logout from logging out the debugger, and vice versa.
+Override with `--cline-dir /tmp/test-dir`. Check with `status()` → `clineDir`.
+
+## Browser Capture & OAuth
+
+The debugee runs with `CLINE_CAPTURE_BROWSER=1`, which intercepts `openExternal()` in
+`src/utils/env.ts`. URLs are captured instead of opening a real browser:
+
+- Logged to `$CLINE_DIR/data/debug-captured-urls.jsonl`
+- POSTed in real-time to `/captured-url` on the harness server
+- Queryable via `oauth.captured_urls`
+
+### OAuth API
+
+- **`oauth.captured_urls`** `{clear?}` — URLs the debugee tried to open
+- **`oauth.read_stored_token`** — Check auth token presence in secrets.json
+- **`oauth.simulate_callback`** `{path, code?, state?, provider?, token?}` — Build vscode:// callback URI
+- **`oauth.read_captured_urls_file`** — Read on-disk JSONL of captured URLs
+
+### OAuth testing flow
+
+For **Cline OAuth** (SDK local callback): The SDK starts a local HTTP server, the auth URL
+is captured. To complete: open the captured URL in a real browser (it redirects back to the
+SDK's callback server), OR extract the callback port and `curl http://127.0.0.1:PORT/callback?code=...`.
+
+For **MCP/Provider OAuth** (vscode:// URI): The redirect goes to a vscode:// URI.
+`oauth.simulate_callback` only *builds* the URI — it does not deliver it, and the ESM
+extension host can't `require()` the handler. To actually deliver the callback, call the
+debug-only hook via `ext.evaluate` (with `awaitPromise: true`):
+`globalThis.__clineHandleUri("vscode://saoudrizwan.claude-dev/...?code=...&state=...")`.
+It runs the same `SharedUriHandler.handleUri` as VSCode's real URI handler and exists only
+when `CLINE_CAPTURE_BROWSER` is set (the harness always sets it; never ships in prod).
+For end-to-end MCP OAuth, get a real `code` from the local MCP OAuth test server
+(`npm run dev:mcp-oauth-test-server`).
+
+## Navigating Views — Use Commands, Not Clicks
+
+Don't try to find/click small sidebar icons. Use VSCode commands via command palette.
+Registered in `src/registry.ts`:
+
+| Command | View |
+|---------|------|
+| `cline.accountButtonClicked` | Account / sign-in |
+| `cline.historyButtonClicked` | Task history |
+| `cline.settingsButtonClicked` | Settings |
+| `cline.mcpButtonClicked` | MCP servers |
+| `cline.plusButtonClicked` | New task (chat) |
+| `cline.worktreesButtonClicked` | Worktrees |
+
+```bash
+curl localhost:19229/api -d '{"method":"ui.command_palette","params":{"command":"cline.accountButtonClicked"}}'
+```
+
+## Key commands
+
+All via `POST localhost:19229/api` with `{"method":"...", "params":{...}}`:
+
+- **`launch`** / **`shutdown`** — lifecycle
+- **`ui.screenshot`** — screenshot to `/tmp/cline-debug/`; returns `{path}` — **use `read_file` on the path to examine, do NOT `open` the file** (Preview.app covers the VSCode window)
+- **`ui.open_sidebar`** — open the Cline sidebar
+- **`ext.set_breakpoint`** `{file, line, condition?}` — breakpoint by source file (sourcemap-resolved)
+- **`ext.evaluate`** `{expression, callFrameId?}` — eval in extension host
+- **`ext.resume`** / **`ext.step_over`** / **`ext.step_into`** — stepping
+- **`ext.call_stack`** — inspect when paused
+- **`web.evaluate`** `{expression}` — eval in webview
+- **`web.post_message`** `{message}` — send postMessage to extension host via exposed vsCodeApi
+- **`wait_for_pause`** `{timeout?}` — block until breakpoint hit
+- **`ui.locator`** `{role?, testId?, text?, frame?}` — Playwright locator (auto-retries on stale sidebar frame)
+- **`ui.react_input`** `{text, selector?, clear?, submit?}` — set React textarea value via `execCommand('insertText')`; works reliably across multiple tasks
+- **`ui.send_message`** `{text, images?, files?, responseType?}` — send chat message bypassing the textarea entirely (via gRPC postMessage)
+- **`ui.command_palette`** `{command}` — run VSCode command
+
+## Typical Session
+
+```bash
+# 1. Launch
+curl localhost:19229/api -d '{"method":"launch","params":{"skipBuild":true}}'
+
+# 2. Open sidebar + dismiss overlays (ALWAYS do this first)
+curl localhost:19229/api -d '{"method":"ui.open_sidebar"}'
+curl localhost:19229/api -d '{"method":"web.evaluate","params":{"expression":"document.querySelectorAll(\".sr-only\").forEach(el => el.parentElement?.click())"}}'
+
+# 3. Navigate to view
+curl localhost:19229/api -d '{"method":"ui.command_palette","params":{"command":"cline.accountButtonClicked"}}'
+
+# 4. Check captured OAuth URLs if testing auth
+curl localhost:19229/api -d '{"method":"oauth.captured_urls"}'
+
+# 5. Verify
+curl localhost:19229/api -d '{"method":"ui.screenshot"}'
+```
+
+## Caveats
+
+- **⚠️ Dismiss promotional overlays FIRST**: On fresh launches, full-screen promo overlays block the sidebar. **Dismiss immediately after `ui.open_sidebar`**, before any other interaction or screenshot. May need to run twice:
+  ```bash
+  curl localhost:19229/api -d '{"method": "ui.open_sidebar"}'
+  curl localhost:19229/api -d '{"method": "web.evaluate", "params": {"expression": "document.querySelectorAll(\".sr-only\").forEach(el => el.parentElement?.click())"}}'
+  ```
+- **Screenshots — don't open the file**: `ui.screenshot` and `ui.sidebar_screenshot` save PNGs to `/tmp/cline-debug/` and return the `{path}`. Use `read_file` on that path to examine screenshots. Running `open <path>` launches Preview.app on macOS which covers the VSCode window.
+- **Scripts count = 0 after launch**: CDP connects after extension host starts, so scripts parsed during startup aren't tracked. Breakpoints still work via sourcemap resolution.
+- **Port 9230**: Extension host inspector. If another VSCode instance uses this port, the harness will fail to connect. Kill other debug instances first.
+- **macOS only** for now (Playwright Electron launch behavior).
+- **Webview CDP**: `connect_webview` may fail depending on Electron version. `web.evaluate` still works via Playwright's `frame.evaluate()` fallback.
+- **Sourcemap paths**: esbuild outputs relative paths like `../src/extension.ts` in the sourcemap. The resolver handles this, but if a file isn't found, use `ext.source_files` to see exact paths.
+- **OAuth with fake codes**: Browser capture intercepts the URL but doesn't provide a valid auth code. For real OAuth testing, open the captured URL in a browser. For unit testing, mock the token exchange.
+
+See `src/dev/debug-harness/README.md` for full API reference.

.clinerules/general.md

@@ -13,11 +13,55 @@ This file is the secret sauce for working effectively in this codebase. It captu
 **What NOT to add:** Stuff you can figure out from reading a few files, obvious patterns, or standard practices. This file should be high-signal, not comprehensive.
 
 ## Miscellaneous
+- Avoid provider-specific string matching / hardcoded provider branches when fixing provider/config plumbing. Prefer provider metadata, shared catalog/defaults, explicit protocol/client capabilities, or centralized normalization utilities that apply by data shape rather than `providerId === "..."`. If a provider exception seems necessary, stop and explain why instead of adding ad-hoc string matching.
 - This is a VS Code extension—check `package.json` for available scripts before trying to verify builds (e.g., `npm run compile`, not `npm run build`).
 - When creating PRs, contributors should not create changelog-entry files. Maintainers handle release versioning and changelog curation during the release process.
 - When adding new feature flags, see this PR as a reference https://github.com/cline/cline/pull/7566
 - Additional instructions about making requests: @.clinerules/network.md
 
+## Searching the Codebase — Avoiding Build Output
+
+Several directories contain build output or generated code that produces
+noisy or unusable results with `search_files` / `grep`:
+
+| Directory | What it is | Why it's a problem |
+|-----------|-----------|-------------------|
+| `out/` | esbuild bundle output | Mirrors `src/` structure as minified JS — every search gets duplicate hits on single-line files |
+| `dist/` | Packaged extension | Entire extension bundled into one minified `extension.js` (~1 long line) |
+| `dist-standalone/` | Standalone build output | Same minification issue |
+| `src/generated/` | Generated protobuf code | Auto-generated from `proto/`; not the source of truth |
+| `src/shared/proto/` | Generated proto type defs | Auto-generated from `proto/`; not the source of truth |
+| `node_modules/` | Dependencies | Huge, not project source |
+
+### How to skip build output
+
+**`search_files`** — Point at `src/` (not the project root) and use `file_pattern`:
+```
+search_files(path="src/core", regex="myFunction", file_pattern="*.ts")
+```
+The `file_pattern` parameter is the most effective filter — e.g. `"*.ts"`,
+`"*.tsx"`, `"*.proto"`.
+
+**`grep` directly** — Exclude build dirs and restrict to source extensions:
+```bash
+grep -rn "myFunction" src/ --include="*.ts" --exclude-dir={out,dist,node_modules,generated}
+```
+
+### When you must search minified files
+
+Sometimes you need to verify what got bundled (e.g., checking if a change
+made it into the build). Minified files are typically one long line, so
+normal `grep` shows the entire file as context. Use these approaches:
+
+- **`grep -oP`** to extract just the match with limited surrounding context:
+  ```bash
+  grep -oP '.{0,40}myFunction.{0,40}' dist/extension.js
+  ```
+- **`read_file`** on files in `out/src/` — these have source maps and are
+  more readable than `dist/extension.js` (which is the fully bundled output).
+- **Source maps** — `out/src/*.js.map` and `dist/extension.js.map` can be
+  used to trace minified output back to original source locations.
+
 ## gRPC/Protobuf Communication
 The extension and webview communicate via gRPC-like protocol over VS Code message passing.
 
@@ -48,102 +92,17 @@ The extension and webview communicate via gRPC-like protocol over VS Code messag
 - `src/core/controller/task/explainChanges.ts` - Handler implementation
 - `webview-ui/src/components/chat/ChatRow.tsx` - UI rendering
 
-## Adding a New API Provider
-When adding a new provider (e.g., "openai-codex"), you must update the proto conversion layer in THREE places or the provider will silently reset to Anthropic:
-
-1. `proto/cline/models.proto` - Add to the `ApiProvider` enum (e.g., `OPENAI_CODEX = 40;`)
-2. `convertApiProviderToProto()` in `src/shared/proto-conversions/models/api-configuration-conversion.ts` - Add case mapping string to proto enum
-3. `convertProtoToApiProvider()` in the same file - Add case mapping proto enum back to string
-
-**Why this matters:** Without these, the provider string hits the `default` case and returns `ANTHROPIC`. The webview, provider list, and handler all work fine, but the state silently resets when it round-trips through proto serialization. No error is thrown.
-
-**Other files to update when adding a provider:**
-- `src/shared/api.ts` - Add to `ApiProvider` union type, define models
-- `src/shared/providers/providers.json` - Add to provider list for dropdown
-- `src/core/api/index.ts` - Register handler in `createHandlerForProvider()`
-- `webview-ui/src/components/settings/utils/providerUtils.ts` - Add cases in `getModelsForProvider()` and `normalizeApiConfiguration()`
-- `webview-ui/src/utils/validate.ts` - Add validation case
-- `webview-ui/src/components/settings/ApiOptions.tsx` - Render provider component
-
-## Responses API Providers (OpenAI Codex, OpenAI Native)
-Providers using OpenAI's Responses API require native tool calling. XML tools don't work with the Responses API.
-
-**Symptoms of broken native tool calling:**
-- Tools get called multiple times (e.g., `ask_followup_question` asks the same question twice)
-- Tool arguments get duplicated or malformed
-- The model responds but tools aren't recognized
-
-**Root causes to check:**
-1. **Provider missing from `isNextGenModelProvider()`** in `src/utils/model-utils.ts`. The native variant matchers (e.g., `native-gpt-5/config.ts`) call this function. If your provider isn't in the list, the matcher returns false and falls back to XML tools.
-
-2. **Model missing `apiFormat: ApiFormat.OPENAI_RESPONSES`** in its model info (`src/shared/api.ts`). This property signals that the model requires native tool calling. The task runner in `src/core/task/index.ts` checks this and forces `enableNativeToolCalls: true` regardless of user settings.
-
-**When adding a new Responses API provider:**
-1. Add provider to `isNextGenModelProvider()` list in `src/utils/model-utils.ts`
-2. Set `apiFormat: ApiFormat.OPENAI_RESPONSES` on all models that use the Responses API
-3. The variant matcher and task runner will handle the rest automatically
-
-## Adding Tools to System Prompt
-This is tricky—multiple prompt variants and configs. **Always search for existing similar tools first and follow their pattern.** Look at the full chain from prompt definition → variant configs → handler → UI before implementing.
-
-1. **Add to `ClineDefaultTool` enum** in `src/shared/tools.ts`
-2. **Tool definition** in `src/core/prompts/system-prompt/tools/` (create file like `generate_explanation.ts`)
-   - Define variants for each `ModelFamily` (generic, next-gen, xs, etc.)
-   - Export variants array (e.g., `export const my_tool_variants = [GENERIC, NATIVE_NEXT_GEN, XS]`)
-   - **Fallback behavior**: If a variant isn't defined for a model family, `ClineToolSet.getToolByNameWithFallback()` automatically falls back to GENERIC. So you only need to export `[GENERIC]` unless the tool needs model-specific behavior.
-3. **Register in `src/core/prompts/system-prompt/tools/init.ts`** - Import and spread into `allToolVariants`
-4. **Add to variant configs** - Each model family has its own config in `src/core/prompts/system-prompt/variants/*/config.ts`. Add your tool's enum to the `.tools()` list:
-   - `generic/config.ts`, `next-gen/config.ts`, `gpt-5/config.ts`, `native-gpt-5/config.ts`, `native-gpt-5-1/config.ts`, `native-next-gen/config.ts`, `gemini-3/config.ts`, `glm/config.ts`, `hermes/config.ts`, `xs/config.ts`
-   - **Important**: If you add to a variant's config, make sure the tool spec exports a variant for that ModelFamily (or relies on GENERIC fallback)
-5. **Create handler** in `src/core/task/tools/handlers/`
-6. **Wire up in `ToolExecutor.ts`** if needed for execution flow
-7. **Add to tool parsing** in `src/core/assistant-message/index.ts` if needed
-8. **If tool has UI feedback**: add `ClineSay` enum in proto, update `src/shared/ExtensionMessage.ts`, update `src/shared/proto-conversions/cline-message.ts`, update `webview-ui/src/components/chat/ChatRow.tsx`
-
-## Modifying System Prompt
-**Read these first:** `src/core/prompts/system-prompt/README.md`, `tools/README.md`, `__tests__/README.md`
-
-System prompt is modular: **components** (reusable sections) + **variants** (model-specific configs) + **templates** (with `{{PLACEHOLDER}}` resolution).
-
-**Key directories:**
-- `components/` - Shared sections: `rules.ts`, `capabilities.ts`, `editing_files.ts`, etc.
-- `variants/` - Model-specific: `generic/`, `next-gen/`, `xs/`, `gpt-5/`, `gemini-3/`, `hermes/`, `glm/`, etc.
-- `templates/` - Template engine and placeholder definitions
-
-**Variant tiers (ask user which to modify):**
-- **Next-gen** (Claude 4, GPT-5, Gemini 2.5): `next-gen/`, `native-next-gen/`, `native-gpt-5/`, `native-gpt-5-1/`, `gemini-3/`, `gpt-5/`
-- **Standard** (default fallback): `generic/`
-- **Local/small models**: `xs/`, `hermes/`, `glm/`
-
-**How overrides work:** Variants can override components via `componentOverrides` in their `config.ts`, or provide a custom template in `template.ts` (e.g., `next-gen/template.ts` exports `rules_template`). If no override, the shared component from `components/` is used.
-
-**Example: Adding a rule to RULES section**
-1. Check if variant overrides rules: look for `rules_template` in `variants/*/template.ts` or `componentOverrides.RULES` in `config.ts`
-2. If shared: modify `components/rules.ts`
-3. If overridden: modify that variant's template
-4. XS variant is special—has heavily condensed inline content in `template.ts`
-
-**After any changes, regenerate snapshots:**
-```bash
-UPDATE_SNAPSHOTS=true npm run test:unit
-```
-Snapshots live in `__tests__/__snapshots__/`. Tests validate across model families and context variations (browser, MCP, focus chain).
-
-## Modifying Default Slash Commands
-Three places need updates:
-- `src/core/slash-commands/index.ts` - Command definitions
-- `src/core/prompts/commands.ts` - System prompt integration
-- `webview-ui/src/utils/slash-commands.ts` - Webview autocomplete
-
 ## Adding New Global State Keys
 Adding a new key to global state requires updates in multiple places. Missing any step causes silent failures.
 
 Required steps:
 1. Type definition in `src/shared/storage/state-keys.ts` - Add to `GlobalState` or `Settings` interface
-2. Add any default value or transform in `src/shared/storage/state-keys.ts` if the key needs one
-3. Read and write the value through `StateManager` (`setGlobalState()` / `getGlobalStateKey()`) after initialization
+2. Read from globalState in `src/core/storage/utils/state-helpers.ts`:
+   - Add `const myKey = context.globalState.get<GlobalStateAndSettings["myKey"]>("myKey")` in `readGlobalStateFromDisk()`
+   - Add to the return object: `myKey: myKey ?? defaultValue,`
+3. StateManager handles read/write via `setGlobalState()`/`getGlobalStateKey()` after initialization
 
-Persistent state is file-backed through `StateManager`; do not add new runtime reads or writes against VS Code `ExtensionContext` storage. That storage is only a legacy migration source.
+Common mistake: Adding only the return value without the `context.globalState.get()` call. This compiles but the value is always `undefined` on load.
 
 Settings plumbing gotcha: if a key is user-toggleable from settings, wire both controller update paths:
 - `src/core/controller/state/updateSettings.ts` for webview `updateSetting(...)`
@@ -157,20 +116,22 @@ Webview toggle gotcha: settings changes must also round-trip back in state paylo
 If this round-trip wiring is missing, the backend value can update but the toggle in webview appears stuck or reverts.
 
 ## StateManager Cache vs Direct globalState Access
-StateManager uses an in-memory cache populated during `StateManager.initialize()` from file-backed storage. For most state, use `controller.stateManager.setGlobalState()`/`getGlobalStateKey()`.
+StateManager uses an in-memory cache populated during `StateManager.initialize(context)` in `common.ts`. For most state, use `controller.stateManager.setGlobalState()`/`getGlobalStateKey()`.
 
-Exception: host migration code may read legacy VS Code storage before file-backed storage is initialized.
+Exception: State needed immediately at extension startup (before cache is ready)
 
-Example pattern:
+When Window A sets state and immediately opens Window B, the new window's StateManager cache is populated from `context.globalState` during initialization. If you need to read state in Window B right at startup (e.g., in `common.ts` during `initialize()`), read directly from `context.globalState.get()` instead of StateManager's cache.
+
+Example pattern (see `lastShownAnnouncementId` and `worktreeAutoOpenPath`):
 ```typescript
 // Writing (normal pattern)
 controller.stateManager.setGlobalState("myKey", value)
 
-// Reading after initialization
-const value = controller.stateManager.getGlobalStateKey("myKey")
+// Reading at startup in common.ts (bypass cache)
+const value = context.globalState.get<string>("myKey")
 ```
 
-Use `context.globalState` only in VS Code migration code that copies legacy ExtensionContext values into the shared file-backed stores.
+This is only needed for cross-window state read during the brief startup window before StateManager cache is fully usable. Normal state access after initialization should use StateManager.
 
 ## ChatRow Cancelled/Interrupted States
 When a ChatRow displays a loading/in-progress state (spinner), you must handle what happens when the task is cancelled. This is non-obvious because cancellation doesn't update the message content—you have to infer it from context.
@@ -199,3 +160,48 @@ const isGenerating = explanationInfo.status === "generating" && !wasCancelled
 **See also:** `BrowserSessionRow.tsx` uses similar pattern with `isLastApiReqInterrupted` and `isLastMessageResume`.
 
 **Backend side:** When streaming is cancelled, clean up properly (close tabs, clear comments, etc.) by checking `taskState.abort` after the streaming function returns.
+
+## Debug Harness: clear inherited VSCode/Electron env vars before launching
+
+The debug harness (`apps/vscode/src/dev/debug-harness/server.ts`) launches a child
+VSCode via Playwright's `_electron.launch({ env: { ...process.env, ... } })`. If you
+run the harness from a process that was itself spawned by VSCode (e.g. the Cline
+extension host, an integrated terminal, or an agent running inside VSCode), the
+parent's VSCode/Electron env vars leak into the child and break the launch.
+
+The fatal one is **`ELECTRON_RUN_AS_NODE=1`**: it makes the child VSCode binary run
+as plain Node, so it rejects every VSCode CLI flag. Symptom:
+
+```
+.../Visual Studio Code.app/Contents/MacOS/Code: bad option: --extensionDevelopmentPath=...
+Error: Process failed to launch!   (Playwright _electron.launch)
+```
+
+This is NOT the macOS Playwright flakiness mentioned in the harness README — it's
+env inheritance. Fix: strip the inherited vars before starting the harness:
+
+```bash
+env -u ELECTRON_RUN_AS_NODE -u ELECTRON_NO_ATTACH_CONSOLE \
+    -u VSCODE_CLI -u VSCODE_CODE_CACHE_PATH -u VSCODE_CRASH_REPORTER_PROCESS_TYPE \
+    -u VSCODE_CWD -u VSCODE_ESM_ENTRYPOINT -u VSCODE_HANDLES_UNCAUGHT_ERRORS \
+    -u VSCODE_IPC_HOOK -u VSCODE_NLS_CONFIG -u VSCODE_PID -u VSCODE_L10N_BUNDLE_LOCATION \
+    npx tsx src/dev/debug-harness/server.ts --auto-launch --skip-build
+```
+
+Check your own env with `env | grep -iE 'electron|vscode_'` first; `ELECTRON_RUN_AS_NODE=1`
+present means you must scrub before launching.
+
+Other harness notes confirmed in practice:
+- The extension host is **ESM** (`VSCODE_ESM_ENTRYPOINT`), so `ext.evaluate` has no
+  `require` and module-internal functions aren't reachable as globals. To inspect
+  internal builders (e.g. `buildBedrockProviderConfig`), set a breakpoint with
+  `ext.set_breakpoint` and read locals via `ext.evaluate` with the paused `callFrameId`
+  — don't try to `require()` the bundle.
+- `web.evaluate` wraps the expression as a single returned expression; multi-statement
+  snippets must be an IIFE `(() => { ...; return x; })()`, otherwise you get
+  `SyntaxError: Unexpected token ';'`.
+- Webview settings inputs are `vscode-text-field` web components with debounced React
+  onChange. Setting `.value` + dispatching events via `web.evaluate` is unreliable for
+  some fields; focus the inner shadow `input` then use real keystrokes (`ui.type` +
+  `ui.press Tab`, or click the dropdown option) to make the value persist.
+

.clinerules/sdk-migration.md

@@ -0,0 +1,26 @@
+# SDK Adapter
+
+The VSCode extension runs on the Cline SDK (`@cline/core`, `@cline/llms`,
+`@cline/shared`) through an adapter layer in `apps/vscode/src/sdk/`. The
+webview still talks gRPC; the adapter translates between gRPC handlers and SDK
+calls. See `apps/vscode/src/dev/debug-harness/README.md` for the debug harness.
+
+## Conventions
+
+1. **Look up SDK APIs, don't guess.** Use `kb_search(name="sdk", query="...")`
+   before implementing against an SDK surface.
+2. **Reference the pre-SDK implementation when replacing a module.** Add a
+   `// Replaces classic src/core/... (see origin/main)` header and use
+   `kb_search(name="cline", commit="origin/main")` or
+   `git show origin/main:path` to consult the prior implementation.
+3. **Single entry point.** There is one codepath — the SDK adapter. No
+   `CLINE_SDK` env flag.
+4. **Use `{appBaseUrl}`**, never hardcode `app.cline.bot`.
+5. **Avoid `as` casts.** Use explicit conversion functions with tests. The
+   branded types in `apps/vscode/src/sdk/model-catalog/contracts.ts` exist so
+   casts are unnecessary outside parse/compute boundaries.
+
+## Debug harness
+
+- **Dismiss the Kanban/promo overlay** before any debug harness interaction.
+- **Use the command palette** to navigate tabs in the debug harness.

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -7,10 +7,10 @@ body:
       value: |
         **Important:** All bug reports must be reproducible using Claude Sonnet 4.5. Cline uses complex prompts so less capable models may not work as expected.
   - type: dropdown
-    id: cline-surface
+    id: plugin-type
     attributes:
-      label: Cline Surface
-      description: Which Cline surface are you reporting a bug for?
+      label: Plugin Type
+      description: Which plugin are you reporting a bug for?
       options:
         - VSCode Extension
         - JetBrains Plugin
@@ -59,18 +59,6 @@ body:
       placeholder: 'e.g., cline:anthropic/claude-sonnet-4.5, gemini:gemini-2.5-pro-exp-03-25'
     validations:
       required: false
-  - type: textarea
-    id: ide-diagnostics
-    attributes:
-      label: IDE / CLI Diagnostics
-      description: |
-        Paste the "About" diagnostics for your Cline surface. This captures the IDE build, runtime, and host details we need.
-        - VSCode Extension: open `Help → About` (Windows/Linux) or `Code → About Visual Studio Code` (macOS), then copy the info.
-        - JetBrains Plugin: open `Help → About` (Windows/Linux) or `<IDE name> → About` (macOS), then click `Copy` to grab build, runtime, OS, memory, and cores.
-        - CLI: there is no About dialog. Run `cline --version` and paste the output.
-      placeholder: Paste the copied About info or `cline --version` output here.
-    validations:
-      required: false
   - type: textarea
     id: system-info
     attributes:

.github/copilot-instructions.md

@@ -44,7 +44,7 @@ For Responses API providers: add to `isNextGenModelProvider()` in `src/utils/mod
 Modular: `components/` (shared) + `variants/` (model-specific) + `templates/` (`{{PLACEHOLDER}}`). Variants override components via `componentOverrides` in `config.ts` or custom `template.ts`. XS variant is heavily condensed inline. Always regenerate snapshots after changes.
 
 ## Global State Keys (silent failure risk)
-Adding a key requires updating the typed storage definitions in `src/shared/storage/state-keys.ts`; runtime reads and writes should go through `StateManager`, not VS Code `ExtensionContext` storage. Persistent state is file-backed so it works across VS Code, CLI, and JetBrains hosts.
+Adding a key requires: type in `src/shared/storage/state-keys.ts`, read via `context.globalState.get()` in `src/core/storage/utils/state-helpers.ts` `readGlobalStateFromDisk()`, and add to return object. Missing the `.get()` call compiles fine but value is always `undefined`.
 
 ## Slash Commands (3 places)
 - `src/core/slash-commands/index.ts` — definitions.

.github/workflows/ext-vscode-publish-nightly.yml

@@ -31,6 +31,9 @@ jobs:
     if: github.repository == 'cline/cline' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/dpc/sdk-migration-simpler-login')
     runs-on: ubuntu-latest
     environment: PublishNightly
+    # The VS Code extension's package.json and lockfiles live under apps/vscode/
+    # (the repo root has no package.json). Mirror ext-vscode-test.yml so install
+    # and publish steps run in the correct workspace.
     defaults:
       run:
         working-directory: apps/vscode
@@ -56,14 +59,16 @@ jobs:
           # Keep publish environment aligned with test workflow/tooling lockfile expectations.
           # Newer LTS (Node 24 / npm 11) can make `npm list` fail with ELSPROBLEMS during vsce packaging.
           node-version: 22
+          cache: 'npm'
+          cache-dependency-path: |
+            apps/vscode/package-lock.json
+            apps/vscode/webview-ui/package-lock.json
 
-      - name: Install extension dependencies
-        working-directory: ${{ github.workspace }}
-        run: npm --prefix apps/vscode ci --include=optional
+      - name: Install root dependencies
+        run: npm ci --include=optional
 
       - name: Install webview-ui dependencies
-        working-directory: ${{ github.workspace }}
-        run: npm --prefix apps/vscode/webview-ui ci --include=optional
+        run: cd webview-ui && npm ci --include=optional
 
       - name: Install Publishing Tools
         run: npm install -g @vscode/vsce ovsx

.github/workflows/ext-vscode-publish-stable.yml

@@ -114,13 +114,11 @@ jobs:
               with:
                   node-version: 22
 
-            - name: Install extension dependencies
-              working-directory: ${{ github.workspace }}
-              run: npm --prefix apps/vscode install --include=optional
+            - name: Install root dependencies
+              run: npm install --include=optional
 
             - name: Install webview-ui dependencies
-              working-directory: ${{ github.workspace }}
-              run: npm --prefix apps/vscode/webview-ui install --include=optional
+              run: cd webview-ui && npm install --include=optional
 
             - name: Install Publishing Tools
               run: npm install -g @vscode/vsce ovsx

.github/workflows/ext-vscode-test-e2e.yml

@@ -128,15 +128,13 @@ jobs:
                   restore-keys: |
                       playwright-browsers-${{ runner.os }}-
 
-            - name: Install extension dependencies
-              working-directory: ${{ github.workspace }}
-              run: npm --prefix apps/vscode ci
+            - name: Install root dependencies
+              run: npm ci
               env:
                   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
             - name: Install webview-ui dependencies
-              working-directory: ${{ github.workspace }}
-              run: npm --prefix apps/vscode/webview-ui ci
+              run: cd webview-ui && npm ci
 
             - name: Install vsce
               run: npm install -g @vscode/vsce

.github/workflows/ext-vscode-test.yml

@@ -8,7 +8,6 @@ on:
     pull_request:
         branches:
             - main
-            - legacy-extension
     workflow_call:
 
 # Set default permissions for all jobs
@@ -92,15 +91,13 @@ jobs:
                       apps/vscode/package-lock.json
                       apps/vscode/webview-ui/package-lock.json
 
-            - name: Install extension dependencies
-              working-directory: ${{ github.workspace }}
-              run: npm --prefix apps/vscode ci
+            - name: Install root dependencies
+              run: npm ci --include=optional
               env:
                   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
             - name: Install webview-ui dependencies
-              working-directory: ${{ github.workspace }}
-              run: npm --prefix apps/vscode/webview-ui ci
+              run: cd webview-ui && npm ci --include=optional
 
             - name: Run Quality Checks (Parallel)
               run: npm run ci:check-all
@@ -133,19 +130,16 @@ jobs:
                       apps/vscode/package-lock.json
                       apps/vscode/webview-ui/package-lock.json
 
-            - name: Install extension dependencies
-              working-directory: ${{ github.workspace }}
-              run: npm --prefix apps/vscode ci
+            - name: Install root dependencies
+              run: npm ci --include=optional
               env:
                   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
             - name: Install webview-ui dependencies
-              working-directory: ${{ github.workspace }}
-              run: npm --prefix apps/vscode/webview-ui ci
+              run: cd webview-ui && npm ci --include=optional
 
             - name: Set up NPM on Windows
               if: runner.os == 'Windows'
-              working-directory: ${{ github.workspace }}
               run: |
                   npm config set script-shell "C:\\Program Files\\Git\\bin\\bash.exe"
 
@@ -161,6 +155,11 @@ jobs:
               id: build_step
               run: npm run ci:build
 
+            - name: Vitest Suites (SDK adapter + model catalog)
+              id: vitest_tests
+              if: ${{ !cancelled() && steps.build_step.outcome == 'success' }}
+              run: npm run test:vitest
+
             - name: Unit Tests with coverage - Linux
               id: unit_tests_linux
               if: ${{ !cancelled() && steps.build_step.outcome == 'success' && runner.os == 'Linux' }}
@@ -235,15 +234,13 @@ jobs:
                       apps/vscode/webview-ui/package-lock.json
                       apps/vscode/testing-platform/package-lock.json
 
-            - name: Install extension dependencies
-              working-directory: ${{ github.workspace }}
-              run: npm --prefix apps/vscode ci
+            - name: Install root dependencies
+              run: npm ci --include=optional
               env:
                   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
             - name: Install webview-ui dependencies
-              working-directory: ${{ github.workspace }}
-              run: npm --prefix apps/vscode/webview-ui ci
+              run: cd webview-ui && npm ci --include=optional
 
             - name: Download ripgrep binaries
               run: npm run download-ripgrep
@@ -252,8 +249,7 @@ jobs:
               run: npm run compile-standalone
 
             - name: Install testing platform dependencies
-              working-directory: ${{ github.workspace }}
-              run: npm --prefix apps/vscode/testing-platform ci
+              run: cd testing-platform && npm ci --include=optional
 
             - name: Running testing platform integration spec tests
               timeout-minutes: 7

.github/workflows/repo-label-issues.yml

@@ -17,7 +17,7 @@ jobs:
             const labels = context.payload.issue.labels.map(l => l.name);
 
             // Check if JetBrains Plugin is selected
-            if (body.match(/###\s*Cline Surface\s*\n+JetBrains Plugin/i)) {
+            if (body.match(/###\s*Plugin Type\s*\n+JetBrains Plugin/i)) {
               if (!labels.includes('JetBrains')) {
                 await github.rest.issues.addLabels({
                   owner: context.repo.owner,
@@ -29,7 +29,7 @@ jobs:
             }
 
             // Check if VSCode Extension is selected
-            if (body.match(/###\s*Cline Surface\s*\n+VSCode Extension/i)) {
+            if (body.match(/###\s*Plugin Type\s*\n+VSCode Extension/i)) {
               if (!labels.includes('VS Code')) {
                 await github.rest.issues.addLabels({
                   owner: context.repo.owner,
@@ -41,7 +41,7 @@ jobs:
             }
 
             // Check if CLI is selected
-            if (body.match(/###\s*Cline Surface\s*\n+CLI/i)) {
+            if (body.match(/###\s*Plugin Type\s*\n+CLI/i)) {
               if (!labels.includes('CLI')) {
                 await github.rest.issues.addLabels({
                   owner: context.repo.owner,

.gitignore

@@ -13,6 +13,9 @@ tmp
 pnpm-lock.yaml
 
 .clineignore
+.cline/enterprise
+.cline/remote-config
+**/.cline/remote-config
 .venv
 .actrc
 CLAUDE.local.md

.husky/pre-commit

@@ -7,4 +7,5 @@ fi
 
 gitleaks git --pre-commit --redact --staged --verbose || exit 1
 
-lint-staged
+cd apps/vscode && lint-staged
+

CHANGELOG.md

@@ -1,139 +1,5 @@
 # Changelog
 
-## [4.0.9]
-
-### Added
-
-- Add GPT-5.6 ChatGPT subscription models.
-
-### Changed
-
-- Soften and shorten the message shown when Cline hits the consecutive mistake limit.
-
-### Fixed
-
-- Handle cumulative usage snapshots from OpenAI-compatible providers so token counts are no longer over-reported.
-- Load skills from files saved as UTF-8 with a byte-order mark (BOM).
-
-## [4.0.8]
-
-### Added
-
-- Add more models to the GCP Vertex provider, plus a free-form entry option in the model dropdown for specifying custom Vertex models.
-
-## [4.0.7]
-
-### Added
-
-- Add a ClinePass limit-reached error with a one-click option to switch to Cline usage-based billing.
-- Allow selecting Cline free models on the ClinePass provider, organized into Subscribed and Free tabs with model descriptions.
-
-### Changed
-
-- Refine ClinePass onboarding and provider settings copy, and open the "learn more" link via the in-app URL handler.
-- Remove the Cline model picker recommendation copy.
-
-### Removed
-
-- Remove all references to GLM 5.1.
-
-## [4.0.6]
-
-### Fixed
-
-- Generalize the model capability warning so it applies more broadly.
-
-## [4.0.5]
-
-### Added
-
-- Add support for Claude Sonnet 5 across the Anthropic, Bedrock, Vertex, Claude Code, SAP AI Core, OpenRouter, and Vercel AI Gateway providers, including model picker and recommended-model updates.
-
-## [4.0.4]
-
-### Changed
-
-- Fully remove the ClinePass feature flag so ClinePass is available everywhere in the UI — onboarding, settings, the welcome promo banner, and the credit-limit "Switch to ClinePass" action.
-
-## [4.0.3]
-
-### Changed
-
-- Enable the ClinePass provider for all users by removing the feature-flag gate that previously fell back to the standard Cline provider.
-
-## [4.0.2]
-
-### Added
-
-- Add reasoning effort support (including `xhigh`) for DeepSeek thinking models.
-- Improve the ClinePass provider experience with clearer reasoning controls and model selection.
-
-### Fixed
-
-- Show reasoning effort controls for ClinePass models and align ClinePass model resolution with the rest of the provider.
-- Prefer canonical Cline Z.ai model ids and polish ClinePass and Z.ai model metadata.
-- Fix environment variable replacement in the webview.
-- Default focus chain settings in webview state so the toggle reflects the correct value on load.
-
-## [4.0.1]
-
-### Changed
-
-- Roll the stable VS Code extension back to the pre-SDK-migration codebase to resolve regressions reported in 4.0.0. This release ships the 3.89.2 extension code under a higher version number so existing 4.0.0 users receive the update. SDK-migration work continues separately on `main`.
-
-## [3.89.2]
-
-### Fixed
-
-- Complete the fix for the Anthropic provider on VS Code 1.123 and later by upgrading the bundled Anthropic SDK to a release compatible with the Node 24 runtime.
-- Update the Vertex AI provider to a compatible Anthropic Vertex SDK release so it works with the upgraded Anthropic SDK.
-
-## [3.89.1]
-
-### Fixed
-
-- Restore the Anthropic provider on VS Code 1.123 and later, where the updated Node 24 runtime broke the bundled Anthropic SDK.
-- Handle the DeepSeek V4 reasoning format.
-
-## [3.89.0]
-
-### Added
-
-- Add Claude Fable 5 model support.
-
-### Fixed
-
-- Fix MiniMax M3 thinking controls across gateways.
-
-### Changed
-
-- Clean up the Codex model list.
-
-## [3.88.1]
-
-### Added
-
-- Add a debug section in settings for Cline testers.
-
-### Fixed
-
-- Include the walkthrough markdown files in the VS Code extension package so the first-run walkthrough steps load correctly.
-
-## [3.88.0]
-
-### Added
-
-- Add the latest Fireworks AI serverless models and update the default Fireworks model to Kimi K2.6.
-
-### Fixed
-
-- Fix MCP server delete/add flows so settings writes do not cause the MCP server list to be emptied by the file watcher.
-- Remove stale Fireworks AI models and correct Fireworks model metadata and cache pricing.
-
-### Changed
-
-- Always use the upstream Cline recommended models endpoint instead of gating it behind a feature flag.
-
 ## [3.87.0]
 
 ### Added

CLAUDE.md

@@ -1,2 +1 @@
 @.clinerules/general.md
-@.clinerules/network.md

README.md

@@ -212,12 +212,8 @@ cline schedule create "PR summary" \
 Chat with your agent from any messaging platform: Telegram, Slack, Discord, Google Chat, WhatsApp, and Linear. Each conversation thread maps to an agent session with full context. Set up access control to restrict who can interact with your agent.
 
 ```bash
-# Connect to Telegram
 cline connect telegram -k $BOT_TOKEN
-# Connect to Slack through webhook
-cline connect slack --bot-token $SLACK_TOKEN --signing-secret $SECRET --base-url $URL
-# Connect to Slack using socket mode
-cline connect slack --bot-token $SLACK_TOKEN --app-token $SLACK_APP_TOKEN
+cline connect slack --token $SLACK_TOKEN --signing-secret $SECRET --base-url $URL
 ```
 
 ## Headless CLI for CI/CD

apps/biome.json

@@ -1,9 +1,7 @@
 {
 	"$schema": "https://biomejs.dev/schemas/2.4.5/schema.json",
 	"root": false,
-	"extends": [
-		"../sdk/biome.json"
-	],
+	"extends": ["../sdk/biome.json"],
 	"linter": {
 		"rules": {
 			"a11y": {

apps/cli/.cline/skills/publish-cli/SKILL.md

@@ -9,13 +9,12 @@ Use this skill when the user asks to release the CLI, publish `cline`, bump the
 
 The CLI is npm-only. Do not add alternate distribution or signing steps.
 
-> Working directory: run every command below from the repository root. Paths and scripts (e.g. `apps/cli/package.json`, `sdk/packages/`, `bun release cli`, `bun run version`) are written relative to the repo root.
+> Working directory: this skill lives in the SDK sub-monorepo. Run `cd sdk` (from the repo root) before any of the shell commands below. Paths in commands and instructions (e.g. `apps/cli/package.json`, `bun release cli`) are written relative to `sdk/`.
 
 The skill should guide the user through one release preparation flow, then offer the publish path options. The two normal publish paths are GitHub Actions and local publishing from an authenticated machine.
 
 ## Release contract
 
-- SDK prerequisite: the CLI depends on the SDK via `workspace:*` (`@cline/core`, `@cline/shared`, and friends). If the SDK changed since its last release, release the SDK first and wait for it to finish publishing before releasing the CLI. See "Step 0: Release the SDK first if it changed" below.
 - Version source: `apps/cli/package.json`.
 - Main release tag: `cli-vX.Y.Z`, where `X.Y.Z` matches `apps/cli/package.json`.
 - Nightly release version: `X.Y.Z-nightly.TIMESTAMP`.
@@ -31,93 +30,8 @@ The skill should guide the user through one release preparation flow, then offer
 - Always ask before pushing commits or tags.
 - Do not amend commits unless explicitly requested.
 
-## Step 0: Release the SDK first if it changed
-
-Do this before anything else in the Workflow below.
-
-The CLI builds and ships against the SDK source in the monorepo (`workspace:*` for `@cline/core`, `@cline/shared`, and the rest), so a CLI release always contains the latest SDK code whether or not the SDK was released. The build and tests use that source too, not anything from npm. Releasing the SDK alongside the CLI is still worth doing for two reasons:
-
-- Hub freshness. The hub daemon lives in `@cline/core` and stamps a `buildId` that defaults to the `@cline/core` package version (`resolveHubBuildId` in `sdk/packages/core/src/hub/discovery/index.ts`). A running hub is only retired and respawned when that `buildId` changes (`isCompatibleHubRecord` / `retireIncompatibleHub` in `sdk/packages/core/src/hub/daemon/index.ts`). So if the SDK code changed but the version did not, a user who upgrades the CLI keeps talking to their already-running hub, which is still executing the old SDK code. Bumping the SDK version makes the new CLI's `buildId` differ, so the stale hub is detected as incompatible and respawned with the fresh code.
-- Release hygiene. We want regular SDK releases; cutting one whenever we cut a CLI release keeps the published SDK in step with what the CLI ships.
-
-So when the SDK has changed, release it first (which bumps the `@cline/core` version), then cut the CLI release on top of that bump. Leave the CLI's SDK dependency as `workspace:*` — the fix is to release the SDK, not to pin the CLI.
-
-1. Check for unreleased SDK changes.
-
-```sh
-git fetch origin --tags
-git tag --list 'sdk/sdk/v*' 'sdk-v*' --sort=-v:refname | head -1
-git log <last-sdk-tag>..origin/main --oneline --no-merges -- sdk/packages
-```
-
-`sdk/<pkg>/v*` tags are created by the `sdk-publish.yml` workflow; `sdk-v*` tags are created by the local `bun release sdk` helper. Use whichever is newest as the baseline.
-
-If `git log` prints no commits, the SDK is already up to date. Skip the rest of Step 0 and continue with the Workflow below.
-
-If it prints commits, sanity-check the diff (ignore entries that are only the previous version-bump commit's lockfile or generated files), then release the SDK.
-
-2. Decide the SDK version bump.
-
-All SDK packages share one version, read from `sdk/packages/llms/package.json`. Ask whether this is patch, minor, major, or an explicit version. Patch is the default. Do not guess if the user has not made it clear.
-
-3. Draft the SDK release notes and update the changelog.
-
-Draft user-facing notes from the SDK commits found in step 1, translating commit messages into user-facing language (same approach as the CLI release notes below). Prepend a new `## <version>` section with those notes to the top of `sdk/CHANGELOG.md`, using the header format `## <version>` with no date — the same flat, newest-on-top format as `apps/cli/CHANGELOG.md`. This is the SDK changelog (all SDK packages share one version) and it is maintained by hand; the `sdk-publish.yml` workflow does not read it.
-
-4. Bump versions and regenerate.
-
-```sh
-bun run version <version>
-```
-
-This bumps every SDK `package.json` to the new version, regenerates the lockfile and the generated model catalog, formats, and builds. Review the result.
-
-5. Commit and push the bump to `main`.
-
-The `sdk-publish.yml` workflow publishes the version that is committed on `main` and tags that commit, so the bump must land on `main` before the workflow runs.
-
-```sh
-git add -A
-git commit -m "chore(sdk): release v<version>"
-```
-
-Ask before pushing:
-
-```sh
-git push origin HEAD
-```
-
-6. Trigger the SDK publish workflow on the `latest` channel.
-
-```sh
-gh workflow run sdk-publish.yml -f channel=latest -f confirm_publish=publish
-gh run list --workflow=sdk-publish.yml --limit=1 --json databaseId,url,status,createdAt --jq '.[0]'
-```
-
-The workflow runs the SDK tests, publishes `@cline/shared`, `@cline/llms`, `@cline/agents`, `@cline/core`, and `@cline/sdk` to npm with the `latest` dist-tag in dependency order, and pushes `sdk/<pkg>/v<version>` git tags.
-
-7. Wait for the SDK workflow to succeed before starting the CLI release.
-
-```sh
-gh run watch <run-id> --exit-status
-```
-
-Do not start the CLI release until this run has finished successfully. The CLI does not install the SDK from npm, but cutting the CLI release on top of a clean, completed SDK release keeps the two in step: the CLI release commit then sits on top of the `@cline/core` version bump, so the shipped CLI carries the new version that forces a running hub to respawn with the new code, and you are not building a CLI release on top of an SDK release that failed midway.
-
-After the SDK release succeeds, pull `main` so the CLI release is prepared on top of the SDK version bump:
-
-```sh
-git checkout main && git pull --ff-only
-```
-
-Then continue with the Workflow below.
-
-For a local SDK publish from an authenticated machine instead of the workflow, `bun release sdk <version>` exists, but prefer the `sdk-publish.yml` workflow for normal releases so the CLI release can gate on a single GitHub Actions run.
-
 ## Workflow
 
-Complete Step 0 first. Only proceed once the SDK is released (or you confirmed no SDK release was needed).
-
 1. Gather context.
 
 ```sh
@@ -132,10 +46,10 @@ Find the latest CLI tag. If there is no `cli-v*` tag, use the first relevant CLI
 2. Collect release commits.
 
 ```sh
-git log <last-cli-tag>..HEAD --oneline --no-merges -- apps/cli sdk/packages sdk/scripts .github/workflows/cli-publish.yml
+git log <last-cli-tag>..HEAD --oneline --no-merges -- apps/cli packages scripts .github/workflows/cli-publish.yml
 ```
 
-The `sdk/packages` commits matter here even though the SDK was released separately in Step 0: the CLI bundles the SDK, so SDK changes ship in this CLI release too. Read those commits and fold anything user-relevant to the CLI into the release notes (provider/model updates, behavior changes, fixes the CLI inherits). Skip SDK changes that are purely internal or have no CLI-visible effect.
+If the release includes broader SDK changes that affect the CLI, also inspect commits outside `apps/cli`.
 
 3. Draft user-facing release notes.
 

apps/cli/CHANGELOG.md

@@ -1,114 +1,5 @@
 # Cline CLI Changelog
 
-## 3.0.29
-
-- Costs are now hidden for Cline free models
-- Fixed Z.ai model metadata resolution for Z.ai models accessed through the Cline provider
-- Reverted the model-name-only display change from v3.0.28; the model picker, selector, and status bar return to their previous display behavior
-
-## 3.0.28
-
-- Added a ClinePass onboarding flow with selectable ClinePass models, plus improved ClinePass error handling
-- Added hub primitive catalogs and refreshed the hub dashboard design with a dedicated customizations breakout
-- Auto-approve toggles now apply immediately when changed
-- Feature flags now resolve using your user ID on startup
-- Fixed Cline model display names so they resolve by model name
-- Truncate large tool results by default (including MCP and custom tool output) to keep requests within context budget
-- Hardened parallel tool-call guidance for faster, more reliable multi-tool execution
-
-## 3.0.27
-
-- Added a `cline skill` command to install and manage skills, matching `cline plugin install` and `cline mcp` (installs default to the Cline agent directory)
-- Added a prefilled MCP install wizard command for quicker MCP server setup
-- Improved error handling and messaging when plugin MCP OAuth authorization fails
-- The CLI now rejects unknown commands and unquoted multi-word input with a clear error instead of silently treating bad arguments as a prompt
-
-## 3.0.26
-
-- Reverted the expandable model picker sections and ClinePass models, restoring the previous model-selection UI
-
-## 3.0.25
-
-- Added ClinePass support, with selectable ClinePass models in the model picker
-- Made model picker sections expandable
-- Added MCP server support to plugins, including authorizing plugin MCP OAuth during install
-- Encouraged parallel tool calls for faster task execution
-- Capped tool output for bash commands and file reads to keep large output within context limits
-- Allowed ranged reads on large files
-- Fixed apply_patch to fail when a hunk is skipped
-- Fixed run_commands to return captured stdout on failure and handle split heredocs
-- Fixed search tools to treat zero results as success
-- Fixed disabled-reasoning handling for StepFun flash
-- Fixed history resume rendering isolation
-- Fixed the Hugging Face URL
-- Fixed Cline OAuth token formatting in provider config
-
-## 3.0.24
-
-- Plugin commands can now submit prompts to the agent
-- Added support for overriding the API base URL
-- Open the verification URL automatically when starting device authentication
-- Enforced a single shared Cline Hub, so a stale hub is respawned after an upgrade
-- Suppressed flickering console windows on Windows
-- Fixed truncation of structured tool operation result strings so oversized tool output stays within limits
-- Stopped echoing the full command text in run_commands tool results
-
-## 3.0.23
-
-- Fixed Vertex AI GCP settings configuration
-- Fixed the Azure Foundry API version
-- Added support for configured agents as subagent tools
-- Centralized OAuth management into the SDK
-- Fixed an error caused by disabled reasoning on Fable 5
-
-## 3.0.22
-
-- Added support for the Claude Fable 5 model
-- Fixed MiniMax M3 thinking controls so they route correctly across gateways
-
-## 3.0.21
-
-- Added a global auto-update setting that controls automatic updates on CLI startup
-- Added a Cline credits refill link
-- Fixed scrolling for inline ask-question responses
-- Fixed connector thread session routing and stale hub session handling
-- Added support for Vertex AI Application Default Credentials (ADC) with tool use
-- Fixed empty message content replay for Bedrock
-- Cleaned up the OpenAI Codex model list
-
-## 3.0.20
-
-- Installed plugin wrappers are now named from their source (npm package name, git repo, remote filename, official slug, or local directory) instead of an opaque hash, making installed plugins easier to identify.
-
-## 3.0.19
-
-- Fixed CLI auto-update to use `npm update` so updates apply reliably, while preserving the installed release channel (e.g. nightly).
-
-## 3.0.18
-
-- Fix Slack channel mentions so replies post in the original message's thread.
-- Fix the abort indicator to clear immediately when a task is cancelled.
-- Sync the Fireworks AI model registry and refresh the bundled model catalog with current platform offerings.
-- Bump the bundled SDK to v0.0.43, which forces a running Cline Hub to restart so it picks up the latest SDK code.
-
-## 3.0.17
-
-- Fix a regression introduced in 3.0.15 where the interactive CLI could get stuck after stopping and restarting Cline Hub and then pressing Escape to cancel a request. The CLI now detects stale or missing sessions, recovers any pending messages, and starts a fresh session instead of failing with "session not found".
-- Fix Ctrl+C and Hub shutdown races that surfaced as "hook dispatch failed" and WebSocket connection errors from late hook events racing against Hub shutdown.
-- Fix the Hub daemon being shut down prematurely when a runtime request was aborted, so the daemon now stays alive.
-- Improve the Telegram connector with a new `--allowed-user-id` flag to restrict which Telegram users are authorized to interact with the agent.
-
-## 3.0.16
-
-- Install official Cline plugins by slug off the new github.com/cline/plugins collection.
-- Uninstall plugins using `cline plugin uninstall <plugin>` or in the TUI.
-- Plugins can now bundle skills, and plugin skills are grouped together in settings.
-- Add Slack socket mode support.
-- Allow a custom base URL for Anthropic vendor-type providers.
-- Fix OAuth token migration for users signed in through the old extension.
-- Use a union schema for read-files tool input validation.
-- Add a `CLINE_PLUGIN_IMPORT_TIMEOUT_MS` env override to control the plugin import timeout.
-
 ## 3.0.15
 
 - Add Cline Hub, a web app for monitoring connected clients, viewing and driving sessions, streaming assistant output, and restarting the local hub, with local, LAN, and tunnel usage gated by a room secret.

apps/cli/DEVELOPMENT.md

@@ -416,7 +416,7 @@ Then attach VS Code or Chrome DevTools to `ws://127.0.0.1:6499`.
 
 ## Publishing
 
-The CLI is published as the `cline` wrapper package on npm with platform-specific binaries under `@cline/cli-*`. The release flow lives in the `publish-cli` skill (`.cline/skills/publish-cli/SKILL.md` at the repo root).
+The CLI is published as the `cline` wrapper package on npm with platform-specific binaries under `@cline/cli-*`. The release flow lives in the `publish-cli` skill (`apps/cli/.cline/skills/publish-cli/SKILL.md`).
 
 From the `apps/cli` workspace:
 

apps/cli/README.md

@@ -163,30 +163,6 @@ cline auth --provider anthropic --apikey sk-... --modelid claude-sonnet-4-6
 cline auth --provider openai-native --apikey sk-... --modelid gpt-5 --baseurl https://api.example.com/v1
 ```
 
-### MCP servers
-
-Manage MCP servers with the interactive wizard:
-
-```sh
-cline mcp
-cline config mcp
-```
-
-Open the add-server wizard with the name, transport, and command or URL already filled in with `cline mcp install` (`cline mcp add` also works). Stdio servers use everything after `--` as the command and arguments:
-
-```sh
-cline mcp install fs -- npx -y @modelcontextprotocol/server-filesystem /tmp
-```
-
-Remote HTTP and SSE servers take a name, transport, and URL. The wizard still asks for auth details before saving:
-
-```sh
-cline mcp install ctx7 --transport http https://mcp.context7.com/mcp
-cline mcp install events --transport sse https://example.com/sse
-```
-
-Because this command opens the wizard, it requires a TTY.
-
 ### Connectors
 
 Bridge a chat surface into RPC-backed Cline sessions. Each conversation thread maps to a session with full context. Supported platforms: Telegram, Slack, Google Chat, WhatsApp, and Linear.
@@ -198,9 +174,6 @@ cline connect telegram -k 123456:ABCDEF...
 # Slack (webhook mode)
 cline connect slack --bot-token $SLACK_BOT_TOKEN --signing-secret $SLACK_SIGNING_SECRET --base-url https://your-domain.com
 
-# Slack (socket mode)
-cline connect slack --bot-token $SLACK_BOT_TOKEN --app-token $SLACK_APP_TOKEN
-
 # Google Chat (webhook mode)
 cline connect gchat --base-url https://your-domain.com
 

apps/cli/bun.mts

@@ -85,20 +85,6 @@ const result = await Bun.build({
 	],
 	define: {
 		"process.env.NODE_ENV": '"production"',
-		...(process.env.TELEMETRY_SERVICE_API_KEY
-			? {
-					"process.env.TELEMETRY_SERVICE_API_KEY": defineProcessEnv(
-						"TELEMETRY_SERVICE_API_KEY",
-					),
-				}
-			: {}),
-		...(process.env.ERROR_SERVICE_API_KEY
-			? {
-					"process.env.ERROR_SERVICE_API_KEY": defineProcessEnv(
-						"ERROR_SERVICE_API_KEY",
-					),
-				}
-			: {}),
 		"process.env.OTEL_TELEMETRY_ENABLED": defineProcessEnv(
 			"OTEL_TELEMETRY_ENABLED",
 		),

apps/cli/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "@cline/cli",
 	"displayName": "cline",
-	"version": "3.0.29",
+	"version": "3.0.15",
 	"description": "Autonomous coding agent CLI - capable of creating/editing files, running commands, using the browser, and more",
 	"type": "module",
 	"publishConfig": {
@@ -87,7 +87,6 @@
 		"open": "^10.2.0",
 		"opentui-spinner": "^0.0.6",
 		"pino": "^10.3.1",
-		"posthog-node": "^5.8.0",
 		"react": "19.2.4",
 		"react-devtools-core": "^7.0.1",
 		"react-reconciler": "0.32.0",

apps/cli/src/acp/auth.ts

@@ -1,6 +1,11 @@
-import type { ProviderSettingsManager } from "@cline/core";
-import { loginAndSaveProviderOAuthCredentials } from "@cline/core";
-import { getPersistedProviderApiKey } from "../commands/auth";
+import type { ProviderSettings, ProviderSettingsManager } from "@cline/core";
+import { getClineEnvironmentConfig } from "@cline/shared";
+import type { OAuthCredentials } from "../commands/auth";
+import {
+	getPersistedProviderApiKey,
+	saveOAuthProviderSettings,
+	toProviderApiKey,
+} from "../commands/auth";
 import { writeDiagnostic } from "../utils/output";
 
 /**
@@ -25,13 +30,37 @@ export function isAcpAuthMethodId(id: string): id is AcpAuthMethodId {
  * If the OAuth flow requires interactive prompts (rare), defaults are used
  * when available; otherwise an error is thrown.
  */
-async function performOAuthLogin(input: {
-	providerId: AcpAuthMethodId;
-	providerSettingsManager: ProviderSettingsManager;
-}): Promise<string> {
-	const [{ createOAuthClientCallbacks }, { default: open }] = await Promise.all(
-		[import("@cline/core"), import("open")],
-	);
+async function performOAuthLogin(
+	providerId: AcpAuthMethodId,
+	existingSettings: ProviderSettings | undefined,
+): Promise<OAuthCredentials> {
+	const [{ createOAuthClientCallbacks }, { default: open }, coreOAuth] =
+		await Promise.all([
+			import("@cline/core"),
+			import("open"),
+			import("@cline/core").then((m) => ({
+				loginClineOAuth: m.loginClineOAuth as (input: {
+					useWorkOSDeviceAuth?: boolean;
+					apiBaseUrl: string;
+					callbacks: {
+						onAuth: (info: { url: string; instructions?: string }) => void;
+						onPrompt: (prompt: {
+							message: string;
+							defaultValue?: string;
+						}) => Promise<string>;
+						onManualCodeInput?: () => Promise<string>;
+					};
+				}) => Promise<OAuthCredentials>,
+				loginOpenAICodex: m.loginOpenAICodex as (input: {
+					onAuth: (info: { url: string; instructions?: string }) => void;
+					onPrompt: (prompt: {
+						message: string;
+						defaultValue?: string;
+					}) => Promise<string>;
+					onManualCodeInput?: () => Promise<string>;
+				}) => Promise<OAuthCredentials>,
+			})),
+		]);
 
 	const callbacks = createOAuthClientCallbacks({
 		onPrompt: ({ defaultValue }) => {
@@ -53,18 +82,18 @@ async function performOAuthLogin(input: {
 		},
 	});
 
-	const settings = await loginAndSaveProviderOAuthCredentials(
-		input.providerSettingsManager,
-		input.providerId,
-		{ callbacks },
-	);
-	const apiKey = getPersistedProviderApiKey(input.providerId, settings);
-	if (!apiKey) {
-		throw new Error(
-			`OAuth login did not persist credentials for ${input.providerId}`,
-		);
+	if (providerId === "cline") {
+		return coreOAuth.loginClineOAuth({
+			apiBaseUrl:
+				existingSettings?.baseUrl?.trim() ||
+				getClineEnvironmentConfig().apiBaseUrl,
+			callbacks,
+			useWorkOSDeviceAuth: true,
+		});
 	}
-	return apiKey;
+
+	// openai-codex
+	return coreOAuth.loginOpenAICodex(callbacks);
 }
 
 export interface AcpAuthResult {
@@ -93,10 +122,16 @@ export async function authenticateAcpProvider(
 
 	// Perform a fresh OAuth login.
 	writeDiagnostic(`[acp/auth] Starting OAuth login for ${methodId}…`);
-	const apiKey = await performOAuthLogin({
-		providerId: methodId,
+	const credentials = await performOAuthLogin(methodId, existing);
+
+	saveOAuthProviderSettings(
 		providerSettingsManager,
-	});
+		methodId,
+		existing,
+		credentials,
+	);
+
+	const apiKey = toProviderApiKey(methodId, credentials);
 	writeDiagnostic(`[acp/auth] Successfully authenticated with ${methodId}`);
 	return { providerId: methodId, apiKey };
 }

apps/cli/src/cli.e2e.test.ts

@@ -746,27 +746,6 @@ Break work into clear steps.`,
 		).toBe(true);
 	});
 
-	it("routes mcp install and requires a TTY for the prefilled wizard", () => {
-		const result = runCli(
-			[
-				"mcp",
-				"install",
-				"fs",
-				"--",
-				"npx",
-				"-y",
-				"@modelcontextprotocol/server-filesystem",
-				"/tmp",
-			],
-			{ env: createIsolatedEnv() },
-		);
-
-		expect(result.status).toBe(1);
-		expect(asText(result.stderr)).toContain(
-			"cline mcp install opens the MCP wizard and requires a TTY.",
-		);
-	});
-
 	it("lists available tools", () => {
 		const homeDir = mkdtempSync(path.join(os.tmpdir(), "cli-e2e-home-"));
 		const dataDir = mkdtempSync(path.join(os.tmpdir(), "cli-e2e-data-"));

apps/cli/src/cli.interactive.e2e.test.ts

@@ -18,8 +18,6 @@ interface KeyStep {
 const INITIAL_RENDER_DELAY_SECONDS = 2.5;
 const POST_ACTION_SETTLE_SECONDS = 1.0;
 const INTERACTIVE_TEST_TIMEOUT_MS = 40_000;
-const HISTORY_PICKER_READY_DELAY_SECONDS = 8.0;
-const HISTORY_RESUME_READY_DELAY_SECONDS = 15.0;
 
 function normalizeTerminalOutput(output: string): string {
 	// biome-ignore lint/suspicious/noControlCharactersInRegex: this regex intentionally strips ANSI escape sequences
@@ -53,40 +51,16 @@ function buildScriptCommand(scriptedInput: string, launchArgs: string): string {
 	return `(${scriptedInput}) | script ${quietFlag} /dev/null ${toShellSingleQuotedLiteral(bunExec)} ${launchArgs}`;
 }
 
-function createCliEnv(): NodeJS.ProcessEnv {
+function runInteractiveCli(
+	steps: KeyStep[],
+	options?: { launchConfigView?: boolean },
+): CliResult {
 	const homeDir = mkdtempSync(path.join(os.tmpdir(), "cli-int-home-"));
 	const dataDir = mkdtempSync(path.join(os.tmpdir(), "cli-int-data-"));
 	const sessionDir = mkdtempSync(path.join(os.tmpdir(), "cli-int-sessions-"));
 	const teamDir = mkdtempSync(path.join(os.tmpdir(), "cli-int-teams-"));
 	tempDirs.push(homeDir, dataDir, sessionDir, teamDir);
 
-	return {
-		...process.env,
-		HOME: homeDir,
-		CLINE_DATA_DIR: dataDir,
-		CLINE_DB_DATA_DIR: path.join(dataDir, "db"),
-		CLINE_SESSION_DATA_DIR: sessionDir,
-		CLINE_TEAM_DATA_DIR: teamDir,
-		CLINE_SESSION_BACKEND_MODE: "local",
-		CLINE_PROVIDER_SETTINGS_PATH: path.join(
-			dataDir,
-			"settings",
-			"providers.json",
-		),
-		CLINE_HOOKS_LOG_PATH: path.join(dataDir, "logs", "hooks.jsonl"),
-	};
-}
-
-function runInteractiveCli(
-	steps: KeyStep[],
-	options?: {
-		launchConfigView?: boolean;
-		launchArgs?: string[];
-		env?: NodeJS.ProcessEnv;
-	},
-): CliResult {
-	const env = options?.env ?? createCliEnv();
-
 	const scriptedInput = [
 		...steps,
 		// Exit each interactive run explicitly so tests do not idle until timeout.
@@ -106,13 +80,9 @@ function runInteractiveCli(
 		"-k",
 		"test-key",
 	];
-	const launchArgs = (
-		options?.launchArgs
-			? [cliEntry, ...options.launchArgs]
-			: options?.launchConfigView
-				? [...baseArgs, "config"]
-				: baseArgs
-	)
+	const launchArgs = [
+		...(options?.launchConfigView ? [...baseArgs, "config"] : baseArgs),
+	]
 		.map((arg) => toShellSingleQuotedLiteral(arg))
 		.join(" ");
 	const command = buildScriptCommand(scriptedInput, launchArgs);
@@ -120,7 +90,21 @@ function runInteractiveCli(
 	return spawnSync("bash", ["-lc", command], {
 		cwd: cliRoot,
 		encoding: "utf8",
-		env,
+		env: {
+			...process.env,
+			HOME: homeDir,
+			CLINE_DATA_DIR: dataDir,
+			CLINE_DB_DATA_DIR: path.join(dataDir, "db"),
+			CLINE_SESSION_DATA_DIR: sessionDir,
+			CLINE_TEAM_DATA_DIR: teamDir,
+			CLINE_SESSION_BACKEND_MODE: "local",
+			CLINE_PROVIDER_SETTINGS_PATH: path.join(
+				dataDir,
+				"settings",
+				"providers.json",
+			),
+			CLINE_HOOKS_LOG_PATH: path.join(dataDir, "logs", "hooks.jsonl"),
+		},
 		timeout: INTERACTIVE_TEST_TIMEOUT_MS,
 		maxBuffer: 10 * 1024 * 1024,
 	});
@@ -204,62 +188,6 @@ describe("cli interactive e2e", () => {
 		expect(output).toContain("/ for commands · @ for files");
 	});
 
-	it("resumes a history-picked session and survives Ctrl+C without a native crash", {
-		timeout: 120_000,
-	}, () => {
-		const env = createCliEnv();
-		// Seed one session; the invalid key makes the run fail fast while
-		// still persisting a resumable session record.
-		const seed = spawnSync(
-			bunExec,
-			[
-				cliEntry,
-				"--provider",
-				"anthropic",
-				"-m",
-				"claude-sonnet-4-6",
-				"-k",
-				"test-key",
-				"hello",
-			],
-			{ cwd: cliRoot, encoding: "utf8", env, timeout: 60_000 },
-		);
-		expect(seed.error).toBeUndefined();
-		const history = spawnSync(bunExec, [cliEntry, "history", "--json"], {
-			cwd: cliRoot,
-			encoding: "utf8",
-			env,
-			timeout: 60_000,
-		});
-		expect(history.error).toBeUndefined();
-		expect(history.status).toBe(0);
-		const historyRows = JSON.parse(history.stdout) as unknown[];
-		expect(historyRows.length).toBeGreaterThan(0);
-
-		// history picker -> Enter resumes the seeded session in the
-		// interactive TUI -> double Ctrl+C exits it. Regression guard for
-		// the Bun "panic(main thread): Segmentation fault" that occurred
-		// when the resumed TUI shared the picker's process (a second
-		// OpenTUI renderer in one process crashes natively on teardown).
-		const result = runInteractiveCli(
-			[
-				// Select the seeded session in the picker.
-				{ delaySeconds: HISTORY_PICKER_READY_DELAY_SECONDS, input: "\r" },
-				// Give the resumed TUI time to start, then double-press
-				// Ctrl+C; the harness appends the final press 0.2s later.
-				{ delaySeconds: HISTORY_RESUME_READY_DELAY_SECONDS, input: "\u0003" },
-			],
-			{ launchArgs: ["history"], env },
-		);
-		const output = outputOf(result);
-		// The exit summary only prints after the resumed interactive TUI ran
-		// and shut down cleanly; the history picker alone never prints it.
-		expect(output).toContain("Session Summary");
-		expect(output).not.toContain("panic(");
-		expect(output).not.toContain("Segmentation fault");
-		expect(result.status).toBe(0);
-	});
-
 	it("launches config view directly with `cline config`", () => {
 		const result = runInteractiveCli(
 			[{ delaySeconds: INITIAL_RENDER_DELAY_SECONDS, input: "" }],

apps/cli/src/commands/auth.test.ts

@@ -2,37 +2,7 @@ import { spawnSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
 import type { ProviderSettingsManager } from "@cline/core";
 import { describe, expect, it, vi } from "vitest";
-import {
-	getPersistedProviderApiKey,
-	normalizeAuthProviderId,
-	parseAuthCommandArgs,
-	saveOAuthProviderSettings,
-} from "./auth";
-
-describe("parseAuthCommandArgs", () => {
-	it("parses Azure API version quick setup option", () => {
-		expect(
-			parseAuthCommandArgs([
-				"--provider",
-				"openai-compatible",
-				"--apikey",
-				"key",
-				"--modelid",
-				"gpt-4.1",
-				"--baseurl",
-				"https://example.openai.azure.com/openai/deployments/gpt-4.1",
-				"--azure-api-version",
-				"2025-01-01-preview",
-			]),
-		).toMatchObject({
-			explicitProvider: "openai-compatible",
-			apikey: "key",
-			modelid: "gpt-4.1",
-			baseurl: "https://example.openai.azure.com/openai/deployments/gpt-4.1",
-			azureApiVersion: "2025-01-01-preview",
-		});
-	});
-});
+import { getPersistedProviderApiKey, saveOAuthProviderSettings } from "./auth";
 
 describe("saveOAuthProviderSettings", () => {
 	it("preserves existing manual apiKey while updating OAuth tokens", () => {
@@ -97,12 +67,6 @@ describe("getPersistedProviderApiKey", () => {
 	});
 });
 
-describe("normalizeAuthProviderId", () => {
-	it("keeps CLI-only codex shorthand in CLI parsing", () => {
-		expect(normalizeAuthProviderId("codex")).toBe("openai-codex");
-	});
-});
-
 describe("loadAuthTuiRuntime", () => {
 	it("loads OpenTUI React after provider catalog initialization", async () => {
 		const cliRoot = fileURLToPath(new URL("../..", import.meta.url));

apps/cli/src/commands/auth.ts

@@ -3,12 +3,11 @@ import {
 	BUILT_IN_PROVIDER,
 	createOAuthClientCallbacks,
 	ensureCustomProvidersLoaded,
-	getProviderAuthHandler,
-	loginAndSaveProviderOAuthCredentials,
+	listLocalProviders,
 	type ProviderSettings,
 	type ProviderSettingsManager,
-	saveProviderOAuthCredentials,
 } from "@cline/core";
+import { getClineEnvironmentConfig } from "@cline/shared";
 import { Command } from "commander";
 import open from "open";
 import React from "react";
@@ -21,8 +20,6 @@ import {
 	type OAuthCredentials,
 	toProviderApiKey,
 } from "../utils/provider-auth";
-import { listLocalProviders } from "../utils/provider-catalog";
-import { identifyTelemetryAccount } from "../utils/telemetry";
 
 export {
 	getPersistedProviderApiKey,
@@ -40,6 +37,40 @@ const c = {
 	green: "\x1b[32m",
 };
 
+type CoreOAuthApi = {
+	loginClineOAuth: (input: {
+		apiBaseUrl: string;
+		useWorkOSDeviceAuth?: boolean;
+		callbacks: {
+			onAuth: (info: { url: string; instructions?: string }) => void;
+			onPrompt: (prompt: {
+				message: string;
+				defaultValue?: string;
+			}) => Promise<string>;
+			onManualCodeInput?: () => Promise<string>;
+		};
+	}) => Promise<OAuthCredentials>;
+	loginOcaOAuth: (input: {
+		mode?: "internal" | "external";
+		callbacks: {
+			onAuth: (info: { url: string; instructions?: string }) => void;
+			onPrompt: (prompt: {
+				message: string;
+				defaultValue?: string;
+			}) => Promise<string>;
+			onManualCodeInput?: () => Promise<string>;
+		};
+	}) => Promise<OAuthCredentials>;
+	loginOpenAICodex: (input: {
+		onAuth: (info: { url: string; instructions?: string }) => void;
+		onPrompt: (prompt: {
+			message: string;
+			defaultValue?: string;
+		}) => Promise<string>;
+		onManualCodeInput?: () => Promise<string>;
+	}) => Promise<OAuthCredentials>;
+};
+
 type AuthIo = {
 	writeln: (text?: string) => void;
 	writeErr: (text: string) => void;
@@ -50,7 +81,6 @@ type AuthQuickSetupInput = {
 	apikey: string;
 	modelid: string;
 	baseurl?: string;
-	azureApiVersion?: string;
 };
 
 type AuthCommandInput = {
@@ -60,7 +90,6 @@ type AuthCommandInput = {
 	apikey?: string;
 	modelid?: string;
 	baseurl?: string;
-	azureApiVersion?: string;
 };
 
 type ParsedAuthCommandArgs = {
@@ -68,10 +97,30 @@ type ParsedAuthCommandArgs = {
 	apikey?: string;
 	modelid?: string;
 	baseurl?: string;
-	azureApiVersion?: string;
 	parseError?: string;
 };
 
+let cachedCoreOAuthApi: Promise<CoreOAuthApi> | undefined;
+
+async function getCoreOAuthApi(): Promise<CoreOAuthApi> {
+	if (!cachedCoreOAuthApi) {
+		cachedCoreOAuthApi = import("@cline/core").then((module) => {
+			const runtimeApi = module as Partial<CoreOAuthApi>;
+			if (
+				typeof runtimeApi.loginClineOAuth !== "function" ||
+				typeof runtimeApi.loginOcaOAuth !== "function" ||
+				typeof runtimeApi.loginOpenAICodex !== "function"
+			) {
+				throw new Error(
+					"Installed @cline/core does not expose OAuth login helpers required by the CLI",
+				);
+			}
+			return runtimeApi as CoreOAuthApi;
+		});
+	}
+	return cachedCoreOAuthApi;
+}
+
 /**
  * Create the `auth` subcommand for Commander.
  *
@@ -88,8 +137,7 @@ export function createAuthCommand(): Command {
 		.option("-p, --provider <id>", "provider id")
 		.option("-k, --apikey <key>", "API key")
 		.option("-m, --modelid <id>", "model id")
-		.option("-b, --baseurl <url>", "base URL")
-		.option("--azure-api-version <version>", "Azure API version");
+		.option("-b, --baseurl <url>", "base URL");
 	return cmd;
 }
 
@@ -106,7 +154,6 @@ export function parseAuthCommandArgs(args: string[]): ParsedAuthCommandArgs {
 		apikey?: string;
 		modelid?: string;
 		baseurl?: string;
-		azureApiVersion?: string;
 	}>();
 	const positionalProvider = cmd.args[0];
 	return {
@@ -114,7 +161,6 @@ export function parseAuthCommandArgs(args: string[]): ParsedAuthCommandArgs {
 		apikey: opts.apikey,
 		modelid: opts.modelid,
 		baseurl: opts.baseurl,
-		azureApiVersion: opts.azureApiVersion,
 	};
 }
 
@@ -154,12 +200,6 @@ async function ensureQuickSetupInputValid(
 	) {
 		return "base URL is only supported for OpenAI and OpenAI-compatible providers";
 	}
-	if (
-		input.azureApiVersion?.trim() &&
-		normalizedProvider !== BUILT_IN_PROVIDER.OPENAI_COMPATIBLE
-	) {
-		return "Azure API version is only supported for OpenAI-compatible providers";
-	}
 	return undefined;
 }
 
@@ -169,7 +209,6 @@ function saveQuickAuthProviderSettings(input: {
 	apikey: string;
 	modelid: string;
 	baseurl?: string;
-	azureApiVersion?: string;
 }): void {
 	const existing = input.providerSettingsManager.getProviderSettings(
 		input.providerId,
@@ -185,12 +224,6 @@ function saveQuickAuthProviderSettings(input: {
 	if (input.baseurl?.trim()) {
 		nextSettings.baseUrl = input.baseurl.trim();
 	}
-	if (input.azureApiVersion?.trim()) {
-		nextSettings.azure = {
-			...(nextSettings.azure ?? {}),
-			apiVersion: input.azureApiVersion.trim(),
-		};
-	}
 	input.providerSettingsManager.saveProviderSettings(nextSettings);
 }
 
@@ -239,18 +272,64 @@ function createOAuthCallbacks(io: AuthIo): {
 	});
 }
 
+async function loginWithOAuthProvider(
+	providerId: string,
+	existing: ProviderSettings | undefined,
+	io: AuthIo,
+): Promise<OAuthCredentials> {
+	const oauthApi = await getCoreOAuthApi();
+	const callbacks = createOAuthCallbacks(io);
+
+	if (providerId === "cline") {
+		return oauthApi.loginClineOAuth({
+			apiBaseUrl:
+				existing?.baseUrl?.trim() || getClineEnvironmentConfig().apiBaseUrl,
+			useWorkOSDeviceAuth: true,
+			callbacks,
+		});
+	}
+
+	if (providerId === "oca") {
+		const mode = existing?.oca?.mode;
+		return oauthApi.loginOcaOAuth({
+			mode,
+			callbacks,
+		});
+	}
+
+	if (providerId === "openai-codex") {
+		return oauthApi.loginOpenAICodex(callbacks);
+	}
+
+	throw new Error(
+		`Provider "${providerId}" does not support CLI OAuth flow (supported: cline, openai-codex, oca)`,
+	);
+}
+
 export function saveOAuthProviderSettings(
 	providerSettingsManager: ProviderSettingsManager,
 	providerId: string,
 	existing: ProviderSettings | undefined,
 	credentials: OAuthCredentials,
 ): ProviderSettings {
-	return saveProviderOAuthCredentials({
-		manager: providerSettingsManager,
-		providerId,
-		settings: existing,
-		credentials,
+	const auth = {
+		...(existing?.auth ?? {}),
+		accessToken: toProviderApiKey(providerId, credentials),
+		refreshToken: credentials.refresh,
+		accountId: credentials.accountId,
+	} as ProviderSettings["auth"] & { expiresAt?: number };
+	auth.expiresAt = credentials.expires;
+	const merged: ProviderSettings = {
+		...(existing ?? {
+			provider: providerId as ProviderSettings["provider"],
+		}),
+		provider: providerId as ProviderSettings["provider"],
+		auth,
+	};
+	providerSettingsManager.saveProviderSettings(merged, {
+		tokenSource: "oauth",
 	});
+	return merged;
 }
 
 export async function ensureOAuthProviderApiKey(input: {
@@ -269,14 +348,19 @@ export async function ensureOAuthProviderApiKey(input: {
 			selectedProviderSettings: input.existingSettings,
 		};
 	}
-	const selectedProviderSettings = await loginAndSaveProviderOAuthCredentials(
+	const credentials = await loginWithOAuthProvider(
+		input.providerId,
+		input.existingSettings,
+		input.io,
+	);
+	const selectedProviderSettings = saveOAuthProviderSettings(
 		input.providerSettingsManager,
 		input.providerId,
-		{ callbacks: createOAuthCallbacks(input.io) },
+		input.existingSettings,
+		credentials,
 	);
-	const handler = getProviderAuthHandler(input.providerId);
 	return {
-		apiKey: handler?.getApiKey(selectedProviderSettings),
+		apiKey: toProviderApiKey(input.providerId, credentials),
 		selectedProviderSettings,
 	};
 }
@@ -286,14 +370,12 @@ async function runQuickAuthSetup(input: AuthCommandInput): Promise<number> {
 	const apikey = input.apikey?.trim() ?? "";
 	const modelid = input.modelid?.trim() ?? "";
 	const baseurl = input.baseurl?.trim();
-	const azureApiVersion = input.azureApiVersion?.trim();
 	const validationError = await ensureQuickSetupInputValid(
 		{
 			provider: providerId,
 			apikey,
 			modelid,
 			baseurl,
-			azureApiVersion,
 		},
 		input.providerSettingsManager,
 	);
@@ -307,7 +389,6 @@ async function runQuickAuthSetup(input: AuthCommandInput): Promise<number> {
 		apikey,
 		modelid,
 		baseurl,
-		azureApiVersion,
 	});
 	input.io.writeln(
 		`${c.green}Provider configured:${c.reset} ${c.cyan}${providerId}${c.reset} (${modelid})`,
@@ -392,13 +473,12 @@ export async function runAuthCommand(input: AuthCommandInput): Promise<number> {
 	const hasQuickSetupFlags =
 		typeof input.apikey === "string" ||
 		typeof input.modelid === "string" ||
-		typeof input.baseurl === "string" ||
-		typeof input.azureApiVersion === "string";
+		typeof input.baseurl === "string";
 
 	if (hasQuickSetupFlags) {
 		if (!input.explicitProvider?.trim()) {
 			input.io.writeErr(
-				"auth quick setup requires --provider <id> when using --apikey/--modelid/--baseurl/--azure-api-version",
+				"auth quick setup requires --provider <id> when using --apikey/--modelid/--baseurl",
 			);
 			return 1;
 		}
@@ -435,15 +515,14 @@ export async function runAuthProviderCommand(
 		return 1;
 	}
 	try {
-		const settings = await loginAndSaveProviderOAuthCredentials(
+		const existing = providerSettingsManager.getProviderSettings(providerId);
+		const credentials = await loginWithOAuthProvider(providerId, existing, io);
+		saveOAuthProviderSettings(
 			providerSettingsManager,
 			providerId,
-			{ callbacks: createOAuthCallbacks(io) },
+			existing,
+			credentials,
 		);
-		identifyTelemetryAccount({
-			id: settings.auth?.accountId,
-			provider: providerId,
-		});
 		io.writeln(
 			`${c.green}You are now logged in to ${c.cyan}${providerId}${c.reset}`,
 		);

apps/cli/src/commands/dashboard.test.ts

@@ -6,15 +6,6 @@ import { runDashboardCommand, waitForProcessShutdown } from "./dashboard";
 
 const ENV_KEYS = [
 	"WORKSPACE_ROOT",
-	"CLINE_DIR",
-	"CLINE_SANDBOX",
-	"CLINE_SANDBOX_DATA_DIR",
-	"CLINE_DATA_DIR",
-	"CLINE_DB_DATA_DIR",
-	"CLINE_SESSION_DATA_DIR",
-	"CLINE_TEAM_DATA_DIR",
-	"CLINE_PROVIDER_SETTINGS_PATH",
-	"CLINE_HOOKS_LOG_PATH",
 	"HOST",
 	"CLINE_HUB_DASHBOARD_PORT",
 	"PUBLIC_URL",
@@ -47,9 +38,6 @@ describe("runDashboardCommand", () => {
 		let observedEnv:
 			| {
 					workspaceRoot: string | undefined;
-					clineDir: string | undefined;
-					clineDataDir: string | undefined;
-					providerSettingsPath: string | undefined;
 					host: string | undefined;
 					port: string | undefined;
 					publicUrl: string | undefined;
@@ -62,9 +50,7 @@ describe("runDashboardCommand", () => {
 		process.env.CLINE_HUB_WEBVIEW_DIST_DIR = webviewDistDir;
 
 		const exitCode = await runDashboardCommand({
-			configDir: "/tmp/cline-config",
 			cwd: "sdk",
-			dataDir: ".cline-dashboard-data",
 			host: "127.0.0.1",
 			port: "9090",
 			publicUrl: "http://127.0.0.1:9090",
@@ -76,9 +62,6 @@ describe("runDashboardCommand", () => {
 			startServer: async () => {
 				observedEnv = {
 					workspaceRoot: process.env.WORKSPACE_ROOT,
-					clineDir: process.env.CLINE_DIR,
-					clineDataDir: process.env.CLINE_DATA_DIR,
-					providerSettingsPath: process.env.CLINE_PROVIDER_SETTINGS_PATH,
 					host: process.env.HOST,
 					port: process.env.CLINE_HUB_DASHBOARD_PORT,
 					publicUrl: process.env.PUBLIC_URL,
@@ -104,13 +87,6 @@ describe("runDashboardCommand", () => {
 		expect(exitCode).toBe(0);
 		expect(observedEnv).toEqual({
 			workspaceRoot: resolve("sdk"),
-			clineDir: "/tmp/cline-config",
-			clineDataDir: resolve("sdk", ".cline-dashboard-data"),
-			providerSettingsPath: join(
-				resolve("sdk", ".cline-dashboard-data"),
-				"settings",
-				"providers.json",
-			),
 			host: "127.0.0.1",
 			port: "9090",
 			publicUrl: "http://127.0.0.1:9090",

apps/cli/src/commands/dashboard.ts

@@ -3,7 +3,6 @@ import { arch, platform } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import open from "open";
-import { configureSandboxEnvironment } from "../utils/helpers";
 import { c } from "../utils/output";
 
 export interface DashboardServerHandle {
@@ -20,9 +19,7 @@ interface DashboardCommandIo {
 }
 
 export interface RunDashboardCommandOptions {
-	configDir?: string;
 	cwd?: string;
-	dataDir?: string;
 	host?: string;
 	port?: string;
 	publicUrl?: string;
@@ -39,9 +36,10 @@ const WEBVIEW_DIST_ENV = "CLINE_HUB_WEBVIEW_DIST_DIR";
 
 function setEnvValue(name: string, value: string | undefined): () => void {
 	const previous = process.env[name];
-	if (value !== undefined) {
-		process.env[name] = value;
+	if (value === undefined) {
+		return () => {};
 	}
+	process.env[name] = value;
 	return () => {
 		if (previous === undefined) {
 			delete process.env[name];
@@ -51,39 +49,21 @@ function setEnvValue(name: string, value: string | undefined): () => void {
 	};
 }
 
-const SANDBOX_ENV_KEYS = [
-	"CLINE_SANDBOX",
-	"CLINE_SANDBOX_DATA_DIR",
-	"CLINE_DATA_DIR",
-	"CLINE_DB_DATA_DIR",
-	"CLINE_SESSION_DATA_DIR",
-	"CLINE_TEAM_DATA_DIR",
-	"CLINE_PROVIDER_SETTINGS_PATH",
-	"CLINE_HOOKS_LOG_PATH",
-] as const;
-
 async function withDashboardEnvironment<T>(
 	options: RunDashboardCommandOptions,
 	fn: () => Promise<T>,
 ): Promise<T> {
-	const cwd = options.cwd ? resolve(options.cwd) : process.cwd();
 	const restore = [
-		setEnvValue("WORKSPACE_ROOT", options.cwd ? cwd : undefined),
-		setEnvValue("CLINE_DIR", options.configDir?.trim() || undefined),
+		setEnvValue(
+			"WORKSPACE_ROOT",
+			options.cwd ? resolve(options.cwd) : undefined,
+		),
 		setEnvValue("HOST", options.host),
 		setEnvValue(DASHBOARD_PORT_ENV, options.port),
 		setEnvValue("PUBLIC_URL", options.publicUrl),
 		setEnvValue("ROOM_SECRET", options.roomSecret),
 		setEnvValue(WEBVIEW_DIST_ENV, resolveDefaultWebviewDistDir()),
-		...SANDBOX_ENV_KEYS.map((key) => setEnvValue(key, undefined)),
 	];
-	if (options.dataDir || process.env.CLINE_SANDBOX?.trim() === "1") {
-		configureSandboxEnvironment({
-			enabled: true,
-			cwd,
-			explicitDir: options.dataDir,
-		});
-	}
 	try {
 		return await fn();
 	} finally {

apps/cli/src/commands/doctor.test.ts

@@ -14,7 +14,6 @@ import { getCliBuildInfo } from "../utils/common";
 const {
 	mockSpawnSync,
 	mockResolveClineDataDir,
-	mockResolveProductionHubOwnerContext,
 	mockResolveSharedHubOwnerContext,
 	mockReadHubDiscovery,
 	mockProbeHubServer,
@@ -25,15 +24,6 @@ const {
 } = vi.hoisted(() => ({
 	mockSpawnSync: vi.fn(),
 	mockResolveClineDataDir: vi.fn(() => "/tmp/cline-data"),
-	mockResolveProductionHubOwnerContext: vi.fn(() => ({
-		ownerId: "hub-production",
-		discoveryPath: path.join(
-			"/tmp/cline-data",
-			"locks",
-			"hub",
-			"production.json",
-		),
-	})),
 	mockResolveSharedHubOwnerContext: vi.fn(() => ({
 		ownerId: "hub-owner",
 		discoveryPath: path.join(
@@ -62,7 +52,6 @@ vi.mock("node:child_process", () => ({
 
 vi.mock("@cline/core", () => ({
 	resolveClineDataDir: mockResolveClineDataDir,
-	resolveProductionHubOwnerContext: mockResolveProductionHubOwnerContext,
 	resolveSharedHubOwnerContext: mockResolveSharedHubOwnerContext,
 	clearHubDiscovery: mockClearHubDiscovery,
 	probeHubServer: mockProbeHubServer,
@@ -87,15 +76,6 @@ describe("runDoctorCommand", () => {
 	afterEach(() => {
 		vi.clearAllMocks();
 		mockResolveClineDataDir.mockReturnValue("/tmp/cline-data");
-		mockResolveProductionHubOwnerContext.mockReturnValue({
-			ownerId: "hub-production",
-			discoveryPath: path.join(
-				"/tmp/cline-data",
-				"locks",
-				"hub",
-				"production.json",
-			),
-		});
 		mockStopLocalHubServerGracefully.mockResolvedValue(false);
 		mockStopAllConnectors.mockResolvedValue({
 			stoppedProcesses: 0,
@@ -130,8 +110,7 @@ describe("runDoctorCommand", () => {
 				command === "pgrep" &&
 				Array.isArray(args) &&
 				args[0] === "-fal" &&
-				args[1] === "--" &&
-				args[2] === "/apps/cli/src/index.ts"
+				args[1] === "/apps/cli/src/index.ts"
 			) {
 				return {
 					status: 0,
@@ -282,8 +261,7 @@ describe("runDoctorCommand", () => {
 				command === "pgrep" &&
 				Array.isArray(args) &&
 				args[0] === "-fal" &&
-				args[1] === "--" &&
-				args[2] === "/src-tauri/bin/code-sidecar"
+				args[1] === "/src-tauri/bin/code-sidecar"
 			) {
 				return {
 					status: 0,

apps/cli/src/commands/doctor.ts

@@ -7,11 +7,10 @@ import {
 	probeHubServer,
 	readHubDiscovery,
 	resolveClineDataDir,
-	resolveProductionHubOwnerContext,
 	resolveSharedHubOwnerContext,
 	stopLocalHubServerGracefully,
 } from "@cline/core";
-import { formatUptime, resolveClineBuildEnv } from "@cline/shared";
+import { formatUptime } from "@cline/shared";
 import { Command } from "commander";
 import open from "open";
 import { isProcessRunning } from "../connectors/common";
@@ -55,7 +54,6 @@ type DoctorStatus = {
 	hubStartedAt?: string;
 	hubUptime?: string;
 	listeningPids: number[];
-	staleHubPids: number[];
 	hubStartupLocks: StartupArtifact[];
 	staleCliPids: number[];
 	staleSidecarPids: number[];
@@ -79,11 +77,7 @@ function listMatchingProcesses(pattern: string): ProcessRecord[] {
 	if (process.platform === "win32") {
 		return [];
 	}
-	// "--" stops pgrep's option parsing so patterns that start with dashes
-	// (e.g. the "--cline-hub-daemon" marker) are treated as patterns.
-	const result = spawnSync("pgrep", ["-fal", "--", pattern], {
-		encoding: "utf8",
-	});
+	const result = spawnSync("pgrep", ["-fal", pattern], { encoding: "utf8" });
 	if (result.status !== 0 && result.status !== 1) {
 		return [];
 	}
@@ -154,25 +148,6 @@ function listStaleCliPids(): number[] {
 		.map((record) => record.pid);
 }
 
-function listStaleHubPids(currentHubPids: number[]): number[] {
-	const current = new Set(currentHubPids.filter((pid) => pid > 0));
-	const patterns = [
-		"/sdk/packages/core/src/hub/daemon/entry.ts",
-		"/sdk/packages/core/dist/hub/daemon/entry.js",
-		"--cline-hub-daemon",
-	];
-	const records = new Map<number, ProcessRecord>();
-	for (const pattern of patterns) {
-		for (const record of listMatchingProcesses(pattern)) {
-			if (current.has(record.pid) || /\bpgrep\s+-fal\b/.test(record.command)) {
-				continue;
-			}
-			records.set(record.pid, record);
-		}
-	}
-	return [...records.values()].map((record) => record.pid);
-}
-
 function listStaleSidecarPids(): number[] {
 	const patterns = [
 		"/apps/examples/desktop-app/sidecar/index.ts",
@@ -260,7 +235,7 @@ function readStartupArtifact(path: string): StartupArtifact | undefined {
 }
 
 function listHubStartupLocks(_cwd: string): StartupArtifact[] {
-	const owner = resolveCliHubOwnerContext();
+	const owner = resolveSharedHubOwnerContext();
 	const ownerPath = join(`${owner.discoveryPath}.lock`, "owner.json");
 	if (!existsSync(ownerPath)) {
 		return [];
@@ -284,7 +259,7 @@ async function clearHubStartupArtifacts(
 	_cwd: string,
 	options?: { clearDiscovery?: boolean },
 ): Promise<{ startupLocks: number; discovery: number }> {
-	const owner = resolveCliHubOwnerContext();
+	const owner = resolveSharedHubOwnerContext();
 	const startupLocks = listHubStartupLocks(_cwd);
 	let clearedStartupLocks = 0;
 	for (const artifact of startupLocks) {
@@ -316,25 +291,14 @@ function formatHubUptimeFromStartedAt(
 	return formatUptime(Date.now() - timestamp);
 }
 
-function resolveCliHubOwnerContext() {
-	return resolveClineBuildEnv() === "production"
-		? resolveProductionHubOwnerContext()
-		: resolveSharedHubOwnerContext();
-}
-
 async function collectDoctorStatus(cwd: string): Promise<DoctorStatus> {
-	const owner = resolveCliHubOwnerContext();
+	const owner = resolveSharedHubOwnerContext();
 	const discovery = await readHubDiscovery(owner.discoveryPath);
 	const health = discovery?.url
-		? await probeHubServer(discovery.url, { authToken: discovery.authToken })
+		? await probeHubServer(discovery.url)
 		: undefined;
 	const current = health ?? discovery;
 	const hubUptime = formatHubUptimeFromStartedAt(health?.startedAt);
-	const listeningPids = listListeningPids(current?.port);
-	const currentHubPids = [
-		...(current?.pid ? [current.pid] : []),
-		...listeningPids,
-	];
 	return {
 		cwd,
 		hubUrl: current?.url,
@@ -342,8 +306,7 @@ async function collectDoctorStatus(cwd: string): Promise<DoctorStatus> {
 		hubPid: current?.pid,
 		hubStartedAt: health?.startedAt,
 		hubUptime,
-		listeningPids,
-		staleHubPids: listStaleHubPids(currentHubPids),
+		listeningPids: listListeningPids(current?.port),
 		hubStartupLocks: listHubStartupLocks(cwd),
 		staleCliPids: listStaleCliPids(),
 		staleSidecarPids: listStaleSidecarPids(),
@@ -425,7 +388,6 @@ export async function runDoctorCommand(
 		);
 		writeln(`hub uptime ${c.dim}${before.hubUptime ?? "n/a"}${c.reset}`);
 		writeln(formatPidList("hub listeners", before.listeningPids));
-		writeln(formatPidList("stale hub daemons", before.staleHubPids));
 		writeln(
 			formatPidList(
 				"hub startup locks",
@@ -450,7 +412,6 @@ export async function runDoctorCommand(
 		}
 		if (
 			before.listeningPids.length > 0 ||
-			before.staleHubPids.length > 0 ||
 			before.staleCliPids.length > 0 ||
 			before.staleSidecarPids.length > 0
 		) {
@@ -462,9 +423,7 @@ export async function runDoctorCommand(
 	}
 
 	const gracefullyStoppedHub = before.hubHealthy
-		? await stopLocalHubServerGracefully(resolveCliHubOwnerContext()).catch(
-				() => false,
-			)
+		? await stopLocalHubServerGracefully().catch(() => false)
 		: false;
 	const refreshedAfterGracefulStop = gracefullyStoppedHub
 		? await collectDoctorStatus(opts.cwd)
@@ -472,20 +431,13 @@ export async function runDoctorCommand(
 	const killedHub = gracefullyStoppedHub
 		? 0
 		: killPids(refreshedAfterGracefulStop.listeningPids);
-	const staleHubTargets = before.staleHubPids.filter(
-		(pid) => !refreshedAfterGracefulStop.listeningPids.includes(pid),
-	);
-	const killedStaleHubs = killPids(staleHubTargets);
 	const staleCliTargets = before.staleCliPids.filter(
-		(pid) =>
-			!refreshedAfterGracefulStop.listeningPids.includes(pid) &&
-			!staleHubTargets.includes(pid),
+		(pid) => !refreshedAfterGracefulStop.listeningPids.includes(pid),
 	);
 	const killedCli = killPids(staleCliTargets);
 	const staleSidecarTargets = before.staleSidecarPids.filter(
 		(pid) =>
 			!refreshedAfterGracefulStop.listeningPids.includes(pid) &&
-			!staleHubTargets.includes(pid) &&
 			!staleCliTargets.includes(pid),
 	);
 	const killedSidecars = killPids(staleSidecarTargets);
@@ -507,7 +459,6 @@ export async function runDoctorCommand(
 				after,
 				killed: {
 					hubListeners: killedHub,
-					staleHubDaemons: killedStaleHubs,
 					cliProcesses: killedCli,
 					sidecarProcesses: killedSidecars,
 					connectorProcesses: stoppedConnectors.stoppedProcesses,
@@ -520,7 +471,6 @@ export async function runDoctorCommand(
 		return 0;
 	}
 	writeln(`killed hub listeners ${c.dim}${killedHub}${c.reset}`);
-	writeln(`killed stale hub daemons ${c.dim}${killedStaleHubs}${c.reset}`);
 	writeln(`killed cli processes ${c.dim}${killedCli}${c.reset}`);
 	writeln(`killed sidecar processes ${c.dim}${killedSidecars}${c.reset}`);
 	writeln(
@@ -537,7 +487,6 @@ export async function runDoctorCommand(
 	);
 	writeln(`hub healthy after fix: ${after.hubHealthy ? "yes" : "no"}`);
 	writeln(formatPidList("remaining hub listeners", after.listeningPids));
-	writeln(formatPidList("remaining stale hub daemons", after.staleHubPids));
 	writeln(
 		formatPidList(
 			"remaining hub startup locks",

apps/cli/src/commands/hub.test.ts

@@ -1,11 +1,10 @@
-import { afterEach, describe, expect, it, vi } from "vitest";
+import { describe, expect, it, vi } from "vitest";
 
 const {
 	mockClearHubDiscovery,
 	mockEnsureDetachedHubServer,
 	mockProbeHubServer,
 	mockReadHubDiscovery,
-	mockResolveProductionHubOwnerContext,
 	mockResolveSharedHubOwnerContext,
 	mockStopLocalHubServerGracefully,
 } = vi.hoisted(() => ({
@@ -13,10 +12,6 @@ const {
 	mockEnsureDetachedHubServer: vi.fn(),
 	mockProbeHubServer: vi.fn(),
 	mockReadHubDiscovery: vi.fn(),
-	mockResolveProductionHubOwnerContext: vi.fn(() => ({
-		ownerId: "hub-production",
-		discoveryPath: "/tmp/cline-data/locks/hub/production.json",
-	})),
 	mockResolveSharedHubOwnerContext: vi.fn(() => ({
 		ownerId: "hub-owner",
 		discoveryPath: "/tmp/cline-data/locks/hub/owners/hub-owner.json",
@@ -29,25 +24,13 @@ vi.mock("@cline/core", () => ({
 	ensureDetachedHubServer: mockEnsureDetachedHubServer,
 	probeHubServer: mockProbeHubServer,
 	readHubDiscovery: mockReadHubDiscovery,
-	resolveProductionHubOwnerContext: mockResolveProductionHubOwnerContext,
 	resolveSharedHubOwnerContext: mockResolveSharedHubOwnerContext,
 	stopLocalHubServerGracefully: mockStopLocalHubServerGracefully,
 }));
 
 import { createHubCommand } from "./hub";
 
-const originalBuildEnv = process.env.CLINE_BUILD_ENV;
-
 describe("createHubCommand", () => {
-	afterEach(() => {
-		vi.clearAllMocks();
-		if (originalBuildEnv === undefined) {
-			delete process.env.CLINE_BUILD_ENV;
-		} else {
-			process.env.CLINE_BUILD_ENV = originalBuildEnv;
-		}
-	});
-
 	it("includes uptime in hub status output", async () => {
 		vi.spyOn(Date, "now").mockReturnValue(
 			new Date("2026-01-01T00:01:05.000Z").getTime(),
@@ -90,37 +73,4 @@ describe("createHubCommand", () => {
 			uptime: "1m 5s",
 		});
 	});
-
-	it("passes the selected owner to graceful stop", async () => {
-		process.env.CLINE_BUILD_ENV = "development";
-		mockReadHubDiscovery.mockResolvedValue({
-			url: "ws://127.0.0.1:25466/hub",
-			port: 25466,
-			pid: 50174,
-		});
-		mockStopLocalHubServerGracefully.mockResolvedValue(true);
-
-		const output: string[] = [];
-		let exitCode = 0;
-		const cmd = createHubCommand(
-			{
-				writeln: (text) => {
-					output.push(text ?? "");
-				},
-				writeErr: () => {},
-			},
-			(code) => {
-				exitCode = code;
-			},
-		);
-
-		await cmd.parseAsync(["stop"], { from: "user" });
-
-		expect(exitCode).toBe(0);
-		expect(mockStopLocalHubServerGracefully).toHaveBeenCalledWith({
-			ownerId: "hub-owner",
-			discoveryPath: "/tmp/cline-data/locks/hub/owners/hub-owner.json",
-		});
-		expect(JSON.parse(output[0] || "")).toEqual({ stopped: true });
-	});
 });

apps/cli/src/commands/hub.ts

@@ -3,11 +3,10 @@ import {
 	ensureDetachedHubServer,
 	probeHubServer,
 	readHubDiscovery,
-	resolveProductionHubOwnerContext,
 	resolveSharedHubOwnerContext,
 	stopLocalHubServerGracefully,
 } from "@cline/core";
-import { formatUptime, resolveClineBuildEnv } from "@cline/shared";
+import { formatUptime } from "@cline/shared";
 import { Command } from "commander";
 
 interface HubCommandIo {
@@ -16,9 +15,9 @@ interface HubCommandIo {
 }
 
 async function stopHubServer(_workspaceRoot: string): Promise<boolean> {
-	const owner = resolveCliHubOwnerContext();
+	const owner = resolveSharedHubOwnerContext();
 	const discovery = await readHubDiscovery(owner.discoveryPath);
-	if (await stopLocalHubServerGracefully(owner)) {
+	if (await stopLocalHubServerGracefully()) {
 		await clearHubDiscovery(owner.discoveryPath);
 		return true;
 	}
@@ -47,12 +46,6 @@ function formatHubUptimeFromStartedAt(
 	return formatUptime(Date.now() - timestamp);
 }
 
-function resolveCliHubOwnerContext() {
-	return resolveClineBuildEnv() === "production"
-		? resolveProductionHubOwnerContext()
-		: resolveSharedHubOwnerContext();
-}
-
 export function createHubCommand(
 	io: HubCommandIo,
 	setExitCode: (code: number) => void,
@@ -119,12 +112,10 @@ export function createHubCommand(
 
 	hub.command("status").action(
 		action(async () => {
-			const owner = resolveCliHubOwnerContext();
+			const owner = resolveSharedHubOwnerContext();
 			const discovery = await readHubDiscovery(owner.discoveryPath);
 			const health = discovery?.url
-				? await probeHubServer(discovery.url, {
-						authToken: discovery.authToken,
-					})
+				? await probeHubServer(discovery.url)
 				: undefined;
 			const uptime = formatHubUptimeFromStartedAt(health?.startedAt);
 			io.writeln(

apps/cli/src/commands/kanban.ts

@@ -168,8 +168,6 @@ export function buildKanbanSpawnOptions(
 		detached: shouldDetachKanbanProcess(platform),
 		...(platform === "win32" ? { shell: true } : {}),
 		...options,
-		// Prevent a console window from flashing on Windows.
-		windowsHide: true,
 	};
 }
 
@@ -180,8 +178,6 @@ function buildKanbanInstallSpawnOptions(
 	return {
 		detached: false,
 		stdio: "inherit",
-		// Prevent a console window from flashing on Windows.
-		windowsHide: true,
 		...(platform === "win32" ? { shell: true } : {}),
 		...options,
 	};
@@ -207,8 +203,6 @@ export function getInstalledKanbanVersion(): string | null {
 		const result = spawnSync(getKanbanCommand(), ["--version"], {
 			encoding: "utf8",
 			shell: process.platform === "win32",
-			// Prevent a console window from flashing on Windows.
-			windowsHide: true,
 		});
 		if (result.status !== 0) {
 			return null;

apps/cli/src/commands/mcp.test.ts

@@ -1,145 +0,0 @@
-import { describe, expect, it, vi } from "vitest";
-import { buildMcpInstallDefaults, runMcpInstallCommand } from "./mcp";
-
-describe("mcp install command", () => {
-	it("builds stdio wizard defaults from command args", () => {
-		expect(
-			buildMcpInstallDefaults({
-				name: "fs",
-				targetArgs: [
-					"npx",
-					"-y",
-					"@modelcontextprotocol/server-filesystem",
-					"/tmp/my dir",
-				],
-			}),
-		).toEqual({
-			name: "fs",
-			type: "stdio",
-			command: 'npx -y @modelcontextprotocol/server-filesystem "/tmp/my dir"',
-		});
-	});
-
-	it("builds remote wizard defaults and normalizes http transport", () => {
-		expect(
-			buildMcpInstallDefaults({
-				name: "ctx7",
-				transport: "http",
-				targetArgs: ["https://mcp.context7.com/mcp"],
-			}),
-		).toEqual({
-			name: "ctx7",
-			type: "streamableHttp",
-			url: "https://mcp.context7.com/mcp",
-		});
-	});
-
-	it("normalizes streamable-http transport", () => {
-		expect(
-			buildMcpInstallDefaults({
-				name: "docs",
-				transport: "streamable-http",
-				targetArgs: ["https://example.com/mcp"],
-			}),
-		).toEqual({
-			name: "docs",
-			type: "streamableHttp",
-			url: "https://example.com/mcp",
-		});
-	});
-
-	it("builds SSE wizard defaults", () => {
-		expect(
-			buildMcpInstallDefaults({
-				name: "events",
-				transport: "sse",
-				targetArgs: ["https://example.com/sse"],
-			}),
-		).toEqual({
-			name: "events",
-			type: "sse",
-			url: "https://example.com/sse",
-		});
-	});
-
-	it("rejects missing stdio command and invalid remote URL", () => {
-		expect(() =>
-			buildMcpInstallDefaults({
-				name: "fs",
-			}),
-		).toThrow(/requires a command/);
-
-		expect(() =>
-			buildMcpInstallDefaults({
-				name: "bad",
-				transport: "http",
-				targetArgs: ["not-a-url"],
-			}),
-		).toThrow(/Invalid MCP server URL/);
-	});
-
-	it("rejects remote URL schemes other than http and https", () => {
-		expect(() =>
-			buildMcpInstallDefaults({
-				name: "bad",
-				transport: "http",
-				targetArgs: ["file:///etc/passwd"],
-			}),
-		).toThrow(/only http and https are supported/);
-	});
-
-	it("opens the add wizard with prefilled defaults", async () => {
-		const runWizard = vi.fn(async () => 0);
-
-		const code = await runMcpInstallCommand({
-			name: "ctx7",
-			transport: "http",
-			targetArgs: ["https://mcp.context7.com/mcp"],
-			isTty: true,
-			runWizard,
-			io: { writeErr: vi.fn() },
-		});
-
-		expect(code).toBe(0);
-		expect(runWizard).toHaveBeenCalledWith({
-			name: "ctx7",
-			type: "streamableHttp",
-			url: "https://mcp.context7.com/mcp",
-		});
-	});
-
-	it("requires a TTY because it opens the wizard", async () => {
-		const writeErr = vi.fn();
-		const runWizard = vi.fn(async () => 0);
-
-		const code = await runMcpInstallCommand({
-			name: "ctx7",
-			transport: "http",
-			targetArgs: ["https://mcp.context7.com/mcp"],
-			isTty: false,
-			runWizard,
-			io: { writeErr },
-		});
-
-		expect(code).toBe(1);
-		expect(runWizard).not.toHaveBeenCalled();
-		expect(writeErr).toHaveBeenCalledWith(
-			"cline mcp install opens the MCP wizard and requires a TTY.",
-		);
-	});
-
-	it("checks for TTY before validating install arguments", async () => {
-		const writeErr = vi.fn();
-
-		const code = await runMcpInstallCommand({
-			name: "fs",
-			isTty: false,
-			io: { writeErr },
-		});
-
-		expect(code).toBe(1);
-		expect(writeErr).toHaveBeenCalledWith(
-			"cline mcp install opens the MCP wizard and requires a TTY.",
-		);
-	});
-});

apps/cli/src/commands/mcp.ts

@@ -1,121 +0,0 @@
-import type { McpAddDefaults } from "../wizards/mcp";
-
-export interface McpCommandIo {
-	writeErr: (text: string) => void;
-}
-
-export interface McpInstallOptions {
-	name: string;
-	targetArgs?: string[];
-	transport?: string;
-	io?: McpCommandIo;
-	isTty?: boolean;
-	runWizard?: (defaults: McpAddDefaults) => Promise<number>;
-}
-
-function normalizeTransportType(
-	value: string | undefined,
-): McpAddDefaults["type"] {
-	const normalized = (value ?? "stdio").trim();
-	if (normalized === "http" || normalized === "streamable-http") {
-		return "streamableHttp";
-	}
-	if (
-		normalized === "stdio" ||
-		normalized === "sse" ||
-		normalized === "streamableHttp"
-	) {
-		return normalized;
-	}
-	throw new Error(
-		`Unsupported MCP transport "${normalized}". Expected stdio, sse, http, streamable-http, or streamableHttp.`,
-	);
-}
-
-function assertValidUrl(url: string): void {
-	let parsed: URL;
-	try {
-		parsed = new URL(url);
-	} catch {
-		throw new Error(`Invalid MCP server URL: ${url}`);
-	}
-	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-		throw new Error(
-			`Invalid MCP server URL: ${url} (only http and https are supported)`,
-		);
-	}
-}
-
-function quoteCommandArg(arg: string): string {
-	if (/^[^\s"'\\]+$/.test(arg)) {
-		return arg;
-	}
-	return `"${arg.replace(/(["\\])/g, "\\$1")}"`;
-}
-
-export function buildMcpInstallDefaults(options: {
-	name: string;
-	targetArgs?: string[];
-	transport?: string;
-}): McpAddDefaults {
-	const name = options.name.trim();
-	if (!name) {
-		throw new Error("MCP server name is required");
-	}
-	const type = normalizeTransportType(options.transport);
-	const targetArgs = options.targetArgs ?? [];
-	if (type === "stdio") {
-		if (targetArgs.length === 0) {
-			throw new Error(
-				"Stdio MCP install requires a command after the server name, for example: cline mcp install fs -- npx -y @modelcontextprotocol/server-filesystem /tmp",
-			);
-		}
-		return {
-			name,
-			type,
-			command: targetArgs.map(quoteCommandArg).join(" "),
-		};
-	}
-
-	if (targetArgs.length !== 1) {
-		throw new Error(
-			"Remote MCP install requires exactly one URL argument after the server name.",
-		);
-	}
-	const url = targetArgs[0]?.trim() ?? "";
-	assertValidUrl(url);
-	return {
-		name,
-		type,
-		url,
-	};
-}
-
-async function runPrefilledWizard(defaults: McpAddDefaults): Promise<number> {
-	const { runMcpWizard } = await import("../wizards/mcp");
-	return runMcpWizard({
-		initialAction: "add",
-		addDefaults: defaults,
-		exitAfterInitialAction: true,
-	});
-}
-
-export async function runMcpInstallCommand(
-	options: McpInstallOptions,
-): Promise<number> {
-	try {
-		const isTty =
-			options.isTty ?? (process.stdin.isTTY && process.stdout.isTTY);
-		if (!isTty) {
-			throw new Error(
-				"cline mcp install opens the MCP wizard and requires a TTY.",
-			);
-		}
-		const defaults = buildMcpInstallDefaults(options);
-		return await (options.runWizard ?? runPrefilledWizard)(defaults);
-	} catch (error) {
-		const message = error instanceof Error ? error.message : String(error);
-		options.io?.writeErr(message);
-		return 1;
-	}
-}

apps/cli/src/commands/plugin.test.ts

@@ -17,12 +17,10 @@ import {
 } from "@cline/shared/storage";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import {
-	collectPluginMcpOAuthCandidates,
 	installPlugin,
 	isOfficialPluginSlug,
 	parsePluginSource,
 	runPluginInstallCommand,
-	runPluginUninstallCommand,
 } from "./plugin";
 
 type FetchCall = (
@@ -36,7 +34,6 @@ describe("plugin install command", () => {
 	let originalHome: string | undefined;
 	let originalClineDir: string | undefined;
 	let originalClineDataDir: string | undefined;
-	let originalMcpSettingsPath: string | undefined;
 
 	beforeEach(() => {
 		root = mkdtempSync(join(tmpdir(), "cli-plugin-install-"));
@@ -45,7 +42,6 @@ describe("plugin install command", () => {
 		originalHome = process.env.HOME;
 		originalClineDir = process.env.CLINE_DIR;
 		originalClineDataDir = process.env.CLINE_DATA_DIR;
-		originalMcpSettingsPath = process.env.CLINE_MCP_SETTINGS_PATH;
 		process.env.HOME = home;
 		process.env.CLINE_DIR = join(home, ".cline");
 		process.env.CLINE_DATA_DIR = join(home, ".cline", "data");
@@ -94,11 +90,6 @@ describe("plugin install command", () => {
 		} else {
 			process.env.CLINE_DATA_DIR = originalClineDataDir;
 		}
-		if (originalMcpSettingsPath === undefined) {
-			delete process.env.CLINE_MCP_SETTINGS_PATH;
-		} else {
-			process.env.CLINE_MCP_SETTINGS_PATH = originalMcpSettingsPath;
-		}
 		rmSync(root, { recursive: true, force: true });
 	});
 
@@ -247,10 +238,6 @@ describe("plugin install command", () => {
 		expect(readFileSync(result.entryPaths[0] ?? "", "utf8")).toContain(
 			"official-web-search",
 		);
-		const wrapperManifest = JSON.parse(
-			readFileSync(join(result.installPath, "package.json"), "utf8"),
-		) as { name?: string };
-		expect(wrapperManifest.name).toBe("web-search");
 		expect(existsSync(join(result.installPath, "repo"))).toBe(false);
 		expect(
 			existsSync(join(result.installPath, "package", "other-plugin")),
@@ -340,10 +327,6 @@ describe("plugin install command", () => {
 		expect(result.installPath).toContain(
 			join(workspace, ".cline", "plugins", "_installed", "local"),
 		);
-		const wrapperManifest = JSON.parse(
-			readFileSync(join(result.installPath, "package.json"), "utf8"),
-		) as { name?: string };
-		expect(wrapperManifest.name).toBe("web-search");
 		expect(readFileSync(result.entryPaths[0] ?? "", "utf8")).toContain(
 			"local-web-search",
 		);
@@ -472,8 +455,7 @@ describe("plugin install command", () => {
 
 		const wrapperManifest = JSON.parse(
 			readFileSync(join(result.installPath, "package.json"), "utf8"),
-		) as { name?: string; cline?: { plugins?: Array<{ paths?: string[] }> } };
-		expect(wrapperManifest.name).toBe("plugin-package");
+		) as { cline?: { plugins?: Array<{ paths?: string[] }> } };
 		expect(wrapperManifest.cline?.plugins?.[0]?.paths).toHaveLength(1);
 		expect(wrapperManifest.cline?.plugins?.[0]?.paths?.[0]).toContain(
 			"package/index.ts",
@@ -611,54 +593,6 @@ describe("plugin install command", () => {
 		).toContain("installed-v1");
 	});
 
-	it("uninstalls a package plugin by package name", async () => {
-		const source = join(root, "uninstall-package");
-		const npmCommandPath = join(root, "fake-npm.sh");
-		await mkdir(source, { recursive: true });
-		await writeFile(
-			join(source, "package.json"),
-			JSON.stringify(
-				{
-					name: "cli-uninstall-plugin",
-					cline: {
-						plugins: [{ paths: ["./index.ts"], capabilities: ["tools"] }],
-					},
-				},
-				null,
-				2,
-			),
-			"utf8",
-		);
-		await writeFile(
-			join(source, "index.ts"),
-			"export default { name: 'cli-uninstall-plugin', manifest: { capabilities: ['tools'] } };",
-			"utf8",
-		);
-		writeFileSync(npmCommandPath, "#!/bin/sh\nexit 0\n", {
-			encoding: "utf8",
-			mode: 0o755,
-		});
-
-		const installed = await installPlugin({
-			source,
-			npmCommand: npmCommandPath,
-		});
-		const output: string[] = [];
-		const code = await runPluginUninstallCommand({
-			name: "cli-uninstall-plugin",
-			io: {
-				writeln: (text = "") => output.push(text),
-				writeErr: (text) => output.push(text),
-			},
-		});
-
-		expect(code).toBe(0);
-		expect(existsSync(installed.installPath)).toBe(false);
-		expect(output.join("\n")).toContain(
-			"Uninstalled plugin cli-uninstall-plugin",
-		);
-	});
-
 	it("prints JSON output for command callers", async () => {
 		const source = join(root, "json.ts");
 		writeFileSync(
@@ -684,341 +618,11 @@ describe("plugin install command", () => {
 			expect(code).toBe(0);
 			const parsed = JSON.parse(stdout.join("")) as { installPath: string };
 			expect(parsed.installPath).toContain(join(home, ".cline", "plugins"));
-			expect("mcpOAuthCandidates" in parsed).toBe(false);
 		} finally {
 			process.stdout.write = originalWrite;
 		}
 	});
 
-	it("does not run MCP OAuth follow-up for JSON plugin installs", async () => {
-		process.env.CLINE_MCP_SETTINGS_PATH = join(root, "mcp-settings.json");
-		const source = join(root, "json-oauth-mcp-plugin.js");
-		writeFileSync(
-			source,
-			`
-export default {
-  name: "json-oauth-mcp-plugin",
-  manifest: { capabilities: ["mcp"] },
-  setup(api) {
-    api.registerMcpServer({
-      name: "json-oauth-docs",
-      transport: { type: "streamableHttp", url: "https://example.com/mcp" },
-    })
-  },
-}
-`,
-			"utf8",
-		);
-		const stdout: string[] = [];
-		const originalWrite = process.stdout.write;
-		const authorize = vi.fn();
-		process.stdout.write = ((chunk: string | Uint8Array) => {
-			stdout.push(String(chunk));
-			return true;
-		}) as typeof process.stdout.write;
-		try {
-			const code = await runPluginInstallCommand({
-				source,
-				json: true,
-				io: {
-					writeln: () => {},
-					writeErr: () => {},
-				},
-				mcpOAuth: {
-					interactive: true,
-					selectCandidates: async (candidates) => candidates,
-					authorize,
-				},
-			});
-			expect(code).toBe(0);
-			expect(authorize).not.toHaveBeenCalled();
-			const parsed = JSON.parse(stdout.join("")) as {
-				installPath: string;
-				mcpOAuthCandidates?: unknown;
-			};
-			expect(parsed.installPath).toContain(join(home, ".cline", "plugins"));
-			expect(parsed.mcpOAuthCandidates).toBeUndefined();
-		} finally {
-			process.stdout.write = originalWrite;
-		}
-	});
-
-	it("warns when plugin MCP settings sync fails after install", async () => {
-		const source = join(root, "mcp-plugin.js");
-		writeFileSync(
-			source,
-			`
-export default {
-  name: "mcp-plugin",
-  manifest: { capabilities: ["mcp"] },
-  setup(api) {
-    api.registerMcpServer({
-      name: "mcp-plugin",
-      transport: { type: "streamableHttp", url: "https://example.com/mcp" },
-    })
-  },
-}
-`,
-			"utf8",
-		);
-		const blockedDirectory = join(root, "not-a-directory");
-		writeFileSync(blockedDirectory, "file", "utf8");
-		const originalSettingsPath = process.env.CLINE_MCP_SETTINGS_PATH;
-		process.env.CLINE_MCP_SETTINGS_PATH = join(
-			blockedDirectory,
-			"cline_mcp_settings.json",
-		);
-		const output: string[] = [];
-		try {
-			const code = await runPluginInstallCommand({
-				source,
-				io: {
-					writeln: (text = "") => output.push(text),
-					writeErr: (text) => output.push(text),
-				},
-			});
-
-			expect(code).toBe(0);
-			expect(output.join("\n")).toContain("Installed plugin from");
-			expect(output.join("\n")).toContain(
-				"Warning: failed to sync plugin MCP servers",
-			);
-			expect(output.join("\n")).toContain("mcp-plugin");
-		} finally {
-			if (originalSettingsPath === undefined) {
-				delete process.env.CLINE_MCP_SETTINGS_PATH;
-			} else {
-				process.env.CLINE_MCP_SETTINGS_PATH = originalSettingsPath;
-			}
-		}
-	});
-
-	it("detects plugin-owned remote MCP servers as OAuth candidates", async () => {
-		process.env.CLINE_MCP_SETTINGS_PATH = join(root, "mcp-settings.json");
-		const source = join(root, "oauth-mcp-plugin.js");
-		writeFileSync(
-			source,
-			`
-export default {
-  name: "oauth-mcp-plugin",
-  manifest: { capabilities: ["mcp"] },
-  setup(api) {
-    api.registerMcpServer({
-      name: "oauth-docs",
-      transport: { type: "streamableHttp", url: "https://example.com/mcp" },
-    })
-  },
-}
-`,
-			"utf8",
-		);
-
-		const result = await installPlugin({ source });
-
-		expect(result.mcpOAuthCandidates).toEqual([
-			expect.objectContaining({
-				name: "oauth-docs",
-				pluginName: "oauth-mcp-plugin",
-				transportType: "streamableHttp",
-			}),
-		]);
-	});
-
-	it("does not treat remote MCP servers with static headers as OAuth candidates", async () => {
-		process.env.CLINE_MCP_SETTINGS_PATH = join(root, "mcp-settings.json");
-		const source = join(root, "headers-mcp-plugin.js");
-		writeFileSync(
-			source,
-			`
-export default {
-  name: "headers-mcp-plugin",
-  manifest: { capabilities: ["mcp"] },
-  setup(api) {
-    api.registerMcpServer({
-      name: "headers-docs",
-      transport: {
-        type: "streamableHttp",
-        url: "https://example.com/mcp",
-        headers: { Authorization: "Bearer token" },
-      },
-    })
-  },
-}
-`,
-			"utf8",
-		);
-
-		const result = await installPlugin({ source });
-
-		expect(result.mcpOAuthCandidates).toEqual([]);
-	});
-
-	it("skips plugin MCP OAuth candidates that already have tokens", async () => {
-		const settingsPath = join(root, "mcp-settings.json");
-		process.env.CLINE_MCP_SETTINGS_PATH = settingsPath;
-		const source = join(root, "authorized-mcp-plugin.js");
-		writeFileSync(
-			source,
-			`
-export default {
-  name: "authorized-mcp-plugin",
-  manifest: { capabilities: ["mcp"] },
-  setup(api) {
-    api.registerMcpServer({
-      name: "authorized-docs",
-      transport: { type: "streamableHttp", url: "https://example.com/mcp" },
-    })
-  },
-}
-`,
-			"utf8",
-		);
-		const result = await installPlugin({ source });
-		const settings = JSON.parse(readFileSync(settingsPath, "utf8")) as {
-			mcpServers?: Record<string, { oauth?: unknown }>;
-		};
-		const server = settings.mcpServers?.["authorized-docs"];
-		if (!server) {
-			throw new Error("Expected authorized-docs MCP server to be written");
-		}
-		server.oauth = { tokens: { access_token: "oauth-token" } };
-		writeFileSync(settingsPath, JSON.stringify(settings, null, 2), "utf8");
-
-		expect(
-			collectPluginMcpOAuthCandidates({
-				pluginPaths: result.entryPaths,
-				settingsPath,
-			}),
-		).toEqual([]);
-	});
-
-	it("authorizes selected plugin MCP OAuth candidates during interactive installs", async () => {
-		process.env.CLINE_MCP_SETTINGS_PATH = join(root, "mcp-settings.json");
-		const source = join(root, "interactive-mcp-plugin.js");
-		writeFileSync(
-			source,
-			`
-export default {
-  name: "interactive-mcp-plugin",
-  manifest: { capabilities: ["mcp"] },
-  setup(api) {
-    api.registerMcpServer({
-      name: "interactive-docs",
-      transport: { type: "streamableHttp", url: "https://example.com/mcp" },
-    })
-  },
-}
-`,
-			"utf8",
-		);
-		const authorized: string[] = [];
-		const output: string[] = [];
-
-		const code = await runPluginInstallCommand({
-			source,
-			io: {
-				writeln: (text = "") => output.push(text),
-				writeErr: (text) => output.push(text),
-			},
-			mcpOAuth: {
-				interactive: true,
-				selectCandidates: async (candidates) => candidates,
-				authorize: async (candidate) => {
-					authorized.push(candidate.name);
-				},
-			},
-		});
-
-		expect(code).toBe(0);
-		expect(authorized).toEqual(["interactive-docs"]);
-		expect(output.join("\n")).toContain("Installed plugin from");
-	});
-
-	it("keeps plugin install successful when MCP OAuth authorization fails", async () => {
-		process.env.CLINE_MCP_SETTINGS_PATH = join(root, "mcp-settings.json");
-		const source = join(root, "failing-oauth-mcp-plugin.js");
-		writeFileSync(
-			source,
-			`
-export default {
-  name: "failing-oauth-mcp-plugin",
-  manifest: { capabilities: ["mcp"] },
-  setup(api) {
-    api.registerMcpServer({
-      name: "failing-docs",
-      transport: { type: "streamableHttp", url: "https://example.com/mcp" },
-    })
-  },
-}
-`,
-			"utf8",
-		);
-		const output: string[] = [];
-
-		const code = await runPluginInstallCommand({
-			source,
-			io: {
-				writeln: (text = "") => output.push(text),
-				writeErr: (text) => output.push(text),
-			},
-			mcpOAuth: {
-				interactive: true,
-				selectCandidates: async (candidates) => candidates,
-				authorize: async () => {
-					throw new Error("oauth unavailable");
-				},
-			},
-		});
-
-		expect(code).toBe(0);
-		expect(output.join("\n")).toContain(
-			"Warning: failed to authorize MCP server failing-docs: oauth unavailable",
-		);
-	});
-
-	it("prints guidance for plugin MCP OAuth candidates in non-interactive installs", async () => {
-		process.env.CLINE_MCP_SETTINGS_PATH = join(root, "mcp-settings.json");
-		const source = join(root, "non-interactive-mcp-plugin.js");
-		writeFileSync(
-			source,
-			`
-export default {
-  name: "non-interactive-mcp-plugin",
-  manifest: { capabilities: ["mcp"] },
-  setup(api) {
-    api.registerMcpServer({
-      name: "non-interactive-docs",
-      transport: { type: "streamableHttp", url: "https://example.com/mcp" },
-    })
-  },
-}
-`,
-			"utf8",
-		);
-		const output: string[] = [];
-		const authorize = vi.fn();
-
-		const code = await runPluginInstallCommand({
-			source,
-			io: {
-				writeln: (text = "") => output.push(text),
-				writeErr: (text) => output.push(text),
-			},
-			mcpOAuth: {
-				interactive: false,
-				authorize,
-			},
-		});
-
-		expect(code).toBe(0);
-		expect(authorize).not.toHaveBeenCalled();
-		expect(output.join("\n")).toContain(
-			"Plugin MCP servers may require OAuth authorization",
-		);
-		expect(output.join("\n")).toContain("non-interactive-docs");
-		expect(output.join("\n")).toContain('Run "cline mcp"');
-	});
-
 	it("prints JSON output for official plugin installs", async () => {
 		const officialPluginsRepo = await createOfficialPluginsRepo({
 			"json-plugin": {

apps/cli/src/commands/plugin.ts

@@ -12,24 +12,7 @@ import {
 } from "node:fs";
 import { cp, mkdir, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
-import {
-	basename,
-	dirname,
-	extname,
-	join,
-	relative,
-	resolve,
-	sep,
-} from "node:path";
-import {
-	type McpServerRegistration,
-	type PluginMcpSettingsSyncResult,
-	type PluginUninstallOptions,
-	resolveDefaultMcpSettingsPath,
-	resolveMcpServerRegistrations,
-	syncPluginMcpServersToSettings,
-	uninstallPlugin,
-} from "@cline/core";
+import { basename, dirname, join, relative, resolve, sep } from "node:path";
 import {
 	isPluginModulePath,
 	resolveClineDir,
@@ -44,31 +27,12 @@ export interface PluginInstallOptions {
 	npmCommand?: string;
 	officialPluginsRepo?: string;
 	io?: PluginInstallIo;
-	mcpOAuth?: PluginInstallMcpOAuthOptions;
 }
 
 export interface PluginInstallResult {
 	source: string;
 	installPath: string;
 	entryPaths: string[];
-	mcpSyncFailures: PluginMcpSettingsSyncResult["failures"];
-	mcpOAuthCandidates: PluginMcpOAuthCandidate[];
-}
-
-export interface PluginMcpOAuthCandidate {
-	name: string;
-	pluginName: string;
-	pluginPath: string;
-	transportType: "sse" | "streamableHttp";
-	lastError?: string;
-}
-
-export interface PluginInstallMcpOAuthOptions {
-	interactive?: boolean;
-	selectCandidates?: (
-		candidates: PluginMcpOAuthCandidate[],
-	) => Promise<PluginMcpOAuthCandidate[]>;
-	authorize?: (candidate: PluginMcpOAuthCandidate) => Promise<void>;
 }
 
 export interface PluginInstallIo {
@@ -504,25 +468,6 @@ function getInstallSourceKey(
 	return `local:${resolve(cwd, resolveHomePath(parsed.path))}`;
 }
 
-function getWrapperPackageName(
-	parsed: ParsedPluginSource,
-	cwd: string,
-): string {
-	if (parsed.type === "npm") {
-		return parsed.name;
-	}
-	if (parsed.type === "git") {
-		return sanitizeSegment(basename(parsed.path));
-	}
-	if (parsed.type === "remote") {
-		return sanitizeSegment(basename(parsed.filename, extname(parsed.filename)));
-	}
-	if (parsed.type === "official") {
-		return parsed.slug;
-	}
-	return sanitizeSegment(basename(resolve(cwd, resolveHomePath(parsed.path))));
-}
-
 async function runCommand(
 	command: string,
 	args: string[],
@@ -533,8 +478,6 @@ async function runCommand(
 			cwd: options.cwd,
 			stdio: ["ignore", "ignore", "pipe"],
 			env: process.env,
-			// Prevent a console window from flashing on Windows.
-			windowsHide: true,
 		});
 		let stderr = "";
 		child.stderr.on("data", (chunk) => {
@@ -721,7 +664,6 @@ function toWrapperEntryPaths(
 async function writeWrapperManifest(
 	wrapperRoot: string,
 	packageRoot: string,
-	packageName: string,
 ): Promise<string[]> {
 	const entryPaths = toWrapperEntryPaths(wrapperRoot, packageRoot);
 	await writeFile(
@@ -729,7 +671,7 @@ async function writeWrapperManifest(
 		JSON.stringify(
 			{
 				...WRAPPER_PACKAGE_JSON,
-				name: packageName,
+				name: `cline-installed-plugin-${hashSource(wrapperRoot)}`,
 				cline: {
 					plugins: [{ paths: entryPaths }],
 				},
@@ -1032,81 +974,6 @@ function replaceInstallPath(
 	}
 }
 
-function hasStaticHeaders(registration: McpServerRegistration): boolean {
-	const transport = registration.transport;
-	if (transport.type === "stdio") {
-		return false;
-	}
-	return (
-		transport.headers !== undefined && Object.keys(transport.headers).length > 0
-	);
-}
-
-function hasOAuthAccessToken(registration: McpServerRegistration): boolean {
-	const accessToken = registration.oauth?.tokens?.access_token;
-	return typeof accessToken === "string" && accessToken.trim().length > 0;
-}
-
-function getPluginOwner(
-	registration: McpServerRegistration,
-): { pluginName: string; pluginPath: string } | undefined {
-	const metadata = registration.metadata;
-	if (
-		!metadata ||
-		metadata.source !== "plugin" ||
-		typeof metadata.pluginName !== "string" ||
-		typeof metadata.pluginPath !== "string"
-	) {
-		return undefined;
-	}
-	return {
-		pluginName: metadata.pluginName,
-		pluginPath: metadata.pluginPath,
-	};
-}
-
-export function collectPluginMcpOAuthCandidates(input: {
-	pluginPaths: readonly string[];
-	settingsPath?: string;
-}): PluginMcpOAuthCandidate[] {
-	const pluginPaths = new Set(input.pluginPaths.map((path) => resolve(path)));
-	if (pluginPaths.size === 0) {
-		return [];
-	}
-
-	let registrations: McpServerRegistration[];
-	try {
-		registrations = resolveMcpServerRegistrations({
-			filePath: input.settingsPath ?? resolveDefaultMcpSettingsPath(),
-		});
-	} catch {
-		return [];
-	}
-
-	const candidates: PluginMcpOAuthCandidate[] = [];
-	for (const registration of registrations) {
-		const owner = getPluginOwner(registration);
-		if (!owner || !pluginPaths.has(resolve(owner.pluginPath))) {
-			continue;
-		}
-		const transportType = registration.transport.type;
-		if (transportType === "stdio") {
-			continue;
-		}
-		if (hasStaticHeaders(registration) || hasOAuthAccessToken(registration)) {
-			continue;
-		}
-		candidates.push({
-			name: registration.name,
-			pluginName: owner.pluginName,
-			pluginPath: owner.pluginPath,
-			transportType,
-			lastError: registration.oauth?.lastError,
-		});
-	}
-	return candidates.sort((left, right) => left.name.localeCompare(right.name));
-}
-
 export async function installPlugin(
 	options: PluginInstallOptions,
 ): Promise<PluginInstallResult> {
@@ -1120,7 +987,6 @@ export async function installPlugin(
 	);
 	const sourceKey = getInstallSourceKey(parsed, cwd, officialPluginsRepo);
 	const installPath = getInstallPath(pluginRoot, parsed, sourceKey);
-	const wrapperPackageName = getWrapperPackageName(parsed, cwd);
 	const stagingParent = join(pluginRoot, INSTALLS_DIRECTORY_NAME, ".tmp");
 	const stagingRoot = join(
 		stagingParent,
@@ -1163,190 +1029,34 @@ export async function installPlugin(
 				? collectPluginEntries(stagingRoot).map(
 						(entry) => `./${toPosixPath(relative(stagingRoot, entry))}`,
 					)
-				: await writeWrapperManifest(
-						stagingRoot,
-						packageRoot,
-						wrapperPackageName,
-					);
+				: await writeWrapperManifest(stagingRoot, packageRoot);
 		if (entryPaths.length === 0) {
 			throw new Error(`No plugin entry files found for ${source}`);
 		}
 
 		replaceInstallPath(stagingRoot, installPath, force);
-		const result = {
+		return {
 			source,
 			installPath,
 			entryPaths: entryPaths.map((entry) => resolve(installPath, entry)),
-			mcpSyncFailures: [] as PluginMcpSettingsSyncResult["failures"],
-			mcpOAuthCandidates: [] as PluginMcpOAuthCandidate[],
 		};
-		const syncResult = await syncPluginMcpServersToSettings({
-			pluginPaths: result.entryPaths,
-			cwd,
-			workspacePath: cwd,
-		});
-		result.mcpSyncFailures = syncResult.failures;
-		result.mcpOAuthCandidates = collectPluginMcpOAuthCandidates({
-			pluginPaths: result.entryPaths,
-		});
-		return result;
 	} catch (error) {
 		rmSync(stagingRoot, { recursive: true, force: true });
 		throw error;
 	}
 }
 
-function serializePluginInstallResult(
-	result: PluginInstallResult,
-): Omit<PluginInstallResult, "mcpOAuthCandidates"> {
-	return {
-		source: result.source,
-		installPath: result.installPath,
-		entryPaths: result.entryPaths,
-		mcpSyncFailures: result.mcpSyncFailures,
-	};
-}
-
-function isInteractivePluginInstall(options: PluginInstallOptions): boolean {
-	return (
-		options.mcpOAuth?.interactive ??
-		(process.stdin.isTTY && process.stdout.isTTY)
-	);
-}
-
-async function selectMcpOAuthCandidatesWithClack(
-	candidates: PluginMcpOAuthCandidate[],
-): Promise<PluginMcpOAuthCandidate[]> {
-	const p = await import("@clack/prompts");
-	const action = await p.select({
-		message: "Authorize plugin MCP servers now?",
-		options: [
-			{
-				value: "all",
-				label: "Authorize all",
-				hint: "open browser authorization for each server",
-			},
-			{
-				value: "choose",
-				label: "Choose servers",
-				hint: "select which servers to authorize",
-			},
-			{
-				value: "skip",
-				label: "Skip",
-			},
-		],
-	});
-	if (p.isCancel(action) || action === "skip") {
-		return [];
-	}
-	if (action === "all") {
-		return candidates;
-	}
-
-	const selectedNames = await p.multiselect({
-		message: "Select MCP servers to authorize",
-		options: candidates.map((candidate) => ({
-			value: candidate.name,
-			label: candidate.name,
-			hint: `${candidate.transportType} [${candidate.pluginName}]`,
-		})),
-		required: false,
-	});
-	if (p.isCancel(selectedNames) || !Array.isArray(selectedNames)) {
-		return [];
-	}
-	const selected = new Set(selectedNames);
-	return candidates.filter((candidate) => selected.has(candidate.name));
-}
-
-async function authorizeMcpOAuthCandidate(
-	candidate: PluginMcpOAuthCandidate,
-): Promise<void> {
-	const { authorizeMcpServerOAuthWithBrowser } = await import(
-		"../wizards/mcp/oauth"
-	);
-	await authorizeMcpServerOAuthWithBrowser(candidate.name, {
-		throwOnError: true,
-	});
-}
-
-async function runPluginMcpOAuthFollowup(
-	candidates: PluginMcpOAuthCandidate[],
-	options: PluginInstallOptions,
-): Promise<void> {
-	if (candidates.length === 0) {
-		return;
-	}
-
-	if (!isInteractivePluginInstall(options)) {
-		options.io?.writeln("Plugin MCP servers may require OAuth authorization:");
-		for (const candidate of candidates) {
-			options.io?.writeln(
-				`  ${candidate.name} (${candidate.transportType}, plugin: ${candidate.pluginName})`,
-			);
-		}
-		options.io?.writeln(
-			'Run "cline mcp" and choose "Authorize OAuth" to authorize them.',
-		);
-		return;
-	}
-
-	const selected =
-		options.mcpOAuth?.selectCandidates !== undefined
-			? await options.mcpOAuth.selectCandidates(candidates)
-			: await selectMcpOAuthCandidatesWithClack(candidates);
-	const authorize = options.mcpOAuth?.authorize ?? authorizeMcpOAuthCandidate;
-	for (const candidate of selected) {
-		try {
-			await authorize(candidate);
-		} catch (error) {
-			const message = error instanceof Error ? error.message : String(error);
-			options.io?.writeErr(
-				`Warning: failed to authorize MCP server ${candidate.name}: ${message}. Run "cline mcp" and choose "Authorize OAuth" to retry.`,
-			);
-		}
-	}
-}
-
 export async function runPluginInstallCommand(
 	options: PluginInstallOptions & { json?: boolean },
 ): Promise<number> {
 	try {
 		const result = await installPlugin(options);
 		if (options.json) {
-			process.stdout.write(
-				JSON.stringify(serializePluginInstallResult(result)),
-			);
+			process.stdout.write(JSON.stringify(result));
 			return 0;
 		}
 		options.io?.writeln(`Installed plugin from ${result.source}`);
 		options.io?.writeln(`  Path: ${result.installPath}`);
-		for (const failure of result.mcpSyncFailures) {
-			options.io?.writeErr(
-				`Warning: failed to sync plugin MCP servers for ${failure.pluginName ?? failure.pluginPath}: ${failure.message}`,
-			);
-		}
-		await runPluginMcpOAuthFollowup(result.mcpOAuthCandidates, options);
-		return 0;
-	} catch (error) {
-		const message = error instanceof Error ? error.message : String(error);
-		options.io?.writeErr(message);
-		return 1;
-	}
-}
-
-export async function runPluginUninstallCommand(
-	options: PluginUninstallOptions & { json?: boolean; io?: PluginInstallIo },
-): Promise<number> {
-	try {
-		const result = await uninstallPlugin(options);
-		if (options.json) {
-			process.stdout.write(JSON.stringify(result));
-			return 0;
-		}
-		options.io?.writeln(`Uninstalled plugin ${result.name}`);
-		options.io?.writeln(`  Removed: ${result.installPath}`);
 		return 0;
 	} catch (error) {
 		const message = error instanceof Error ? error.message : String(error);

apps/cli/src/commands/program.ts

@@ -116,6 +116,7 @@ export function createProgram(): Command {
 			writeOut: () => {}, // suppress by default; main.ts re-enables for routing
 			writeErr: () => {},
 		})
+		.allowUnknownOption()
 		.allowExcessArguments()
 		.enablePositionalOptions()
 		.argument(

apps/cli/src/commands/rpc-runtime/provider-registry.test.ts

@@ -78,74 +78,6 @@ describe("saveLocalProviderSettings", () => {
 		);
 	});
 
-	it("merges and clears Azure provider settings", () => {
-		const save = vi.fn();
-		const manager = {
-			read: vi.fn().mockReturnValue({
-				providers: {},
-			}),
-			write: vi.fn(),
-			getFilePath: vi.fn().mockReturnValue("/tmp/providers.json"),
-			getProviderSettings: vi.fn().mockReturnValue({
-				provider: "openai-compatible",
-				azure: {
-					apiVersion: "2024-10-21",
-					useIdentity: true,
-				},
-			}),
-			saveProviderSettings: save,
-		};
-
-		saveLocalProviderSettings(
-			manager as unknown as ProviderSettingsManager,
-			{
-				action: "saveProviderSettings",
-				providerId: "openai-compatible",
-				azure: {
-					apiVersion: "2025-01-01-preview",
-				},
-			} as SaveProviderSettingsActionRequest,
-		);
-
-		expect(save).toHaveBeenCalledTimes(1);
-		expect(save).toHaveBeenCalledWith(
-			{
-				provider: "openai-compatible",
-				azure: {
-					apiVersion: "2025-01-01-preview",
-					useIdentity: true,
-				},
-			},
-			{ setLastUsed: false },
-		);
-
-		save.mockClear();
-		manager.getProviderSettings.mockReturnValue({
-			provider: "openai-compatible",
-			azure: {
-				apiVersion: "2025-01-01-preview",
-			},
-		});
-
-		saveLocalProviderSettings(
-			manager as unknown as ProviderSettingsManager,
-			{
-				action: "saveProviderSettings",
-				providerId: "openai-compatible",
-				azure: {
-					apiVersion: "",
-				},
-			} as SaveProviderSettingsActionRequest,
-		);
-
-		expect(save).toHaveBeenCalledWith(
-			{
-				provider: "openai-compatible",
-			},
-			{ setLastUsed: false },
-		);
-	});
-
 	it("keeps OAuth auth fields when updating manual apiKey", () => {
 		const save = vi.fn();
 		const manager = {

apps/cli/src/commands/skill.test.ts

@@ -1,88 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { buildSkillsArgs } from "./skill";
-
-describe("buildSkillsArgs", () => {
-	it("runs the skills package through npx with -y", () => {
-		expect(buildSkillsArgs(["list"])).toEqual(["-y", "skills@latest", "list"]);
-	});
-
-	it("injects --agent cline for install-style subcommands", () => {
-		expect(buildSkillsArgs(["install", "owner/repo"])).toEqual([
-			"-y",
-			"skills@latest",
-			"add",
-			"owner/repo",
-			"--agent",
-			"cline",
-		]);
-		expect(buildSkillsArgs(["add", "owner/repo"])).toContain("cline");
-		expect(buildSkillsArgs(["i", "owner/repo"])).toContain("cline");
-		expect(buildSkillsArgs(["update", "owner/repo"])).toContain("cline");
-	});
-
-	it("aliases uninstall to the skills remove subcommand", () => {
-		expect(buildSkillsArgs(["uninstall", "my-skill"])).toEqual([
-			"-y",
-			"skills@latest",
-			"remove",
-			"my-skill",
-			"--agent",
-			"cline",
-		]);
-	});
-
-	it("does not inject when the user already targeted an agent", () => {
-		expect(
-			buildSkillsArgs(["install", "owner/repo", "--agent", "cursor"]),
-		).not.toContain("cline");
-		expect(
-			buildSkillsArgs(["install", "owner/repo", "-a", "cursor"]),
-		).not.toContain("cline");
-		expect(
-			buildSkillsArgs(["install", "owner/repo", "--agent=cursor"]),
-		).not.toContain("cline");
-	});
-
-	it("aliases install and uninstall when agent options come before the subcommand", () => {
-		expect(
-			buildSkillsArgs(["--agent", "cursor", "install", "owner/repo"]),
-		).toEqual([
-			"-y",
-			"skills@latest",
-			"--agent",
-			"cursor",
-			"add",
-			"owner/repo",
-		]);
-		expect(
-			buildSkillsArgs(["--agent=cursor", "uninstall", "my-skill"]),
-		).toEqual(["-y", "skills@latest", "--agent=cursor", "remove", "my-skill"]);
-	});
-
-	it("does not scope non-install subcommands to cline", () => {
-		expect(buildSkillsArgs(["use", "owner/repo"])).not.toContain("--agent");
-		expect(buildSkillsArgs(["list"])).not.toContain("--agent");
-	});
-
-	it("scopes remove-style subcommands to cline", () => {
-		expect(buildSkillsArgs(["remove"])).toEqual([
-			"-y",
-			"skills@latest",
-			"remove",
-			"--agent",
-			"cline",
-		]);
-		expect(buildSkillsArgs(["rm", "my-skill"])).toContain("cline");
-		expect(buildSkillsArgs(["r", "my-skill"])).toContain("cline");
-	});
-
-	it("ignores leading flags when detecting the subcommand", () => {
-		expect(buildSkillsArgs(["--global", "install", "owner/repo"])).toContain(
-			"cline",
-		);
-	});
-
-	it("forwards an empty arg list unchanged", () => {
-		expect(buildSkillsArgs([])).toEqual(["-y", "skills@latest"]);
-	});
-});

apps/cli/src/commands/skill.ts

@@ -1,160 +0,0 @@
-import { type SpawnOptions, spawn } from "node:child_process";
-
-export interface SkillCommandIo {
-	writeln: (text?: string) => void;
-	writeErr: (text: string) => void;
-}
-
-// `cline skill` is a thin wrapper around the open skills CLI
-// (https://www.npmjs.com/package/skills). We run it through `npx` so users
-// don't need a separate global install. Pin the version here if we ever need to
-// lock behavior to a known-good release.
-const SKILLS_PACKAGE = "skills@latest";
-
-// Subcommands that write skill files into an agent's skills directory. For a
-// `cline skill` command we default these to Cline unless the user picked their
-// own agent. `use` is intentionally excluded: without --agent it prints the
-// generated prompt to stdout, whereas adding --agent would launch that agent
-// interactively instead — not what someone scoping to Cline would expect.
-const CLINE_SCOPED_SUBCOMMANDS = new Set([
-	"add",
-	"install",
-	"i",
-	"update",
-	"remove",
-	"rm",
-	"r",
-	"uninstall",
-]);
-
-const SKILLS_SUBCOMMAND_ALIASES = new Map([
-	["install", "add"],
-	["uninstall", "remove"],
-]);
-
-function hasAgentFlag(args: readonly string[]): boolean {
-	return args.some(
-		(arg) => arg === "-a" || arg === "--agent" || arg.startsWith("--agent="),
-	);
-}
-
-function optionConsumesNextValue(arg: string): boolean {
-	return arg === "-a" || arg === "--agent";
-}
-
-function findSubcommandIndex(args: readonly string[]): number {
-	for (let index = 0; index < args.length; index++) {
-		const arg = args[index];
-		if (arg.startsWith("-")) {
-			if (optionConsumesNextValue(arg)) {
-				index++;
-			}
-			continue;
-		}
-		return index;
-	}
-	return -1;
-}
-
-function findSubcommand(args: readonly string[]): string | undefined {
-	const index = findSubcommandIndex(args);
-	return index >= 0 ? args[index] : undefined;
-}
-
-function normalizeSkillsSubcommandAliases(args: string[]): void {
-	const index = findSubcommandIndex(args);
-	if (index < 0) return;
-	const alias = SKILLS_SUBCOMMAND_ALIASES.get(args[index]);
-	if (alias) {
-		args[index] = alias;
-	}
-}
-
-/**
- * Build the argument list passed to `npx`, injecting `--agent cline` for
- * install-style subcommands unless the user already targeted an agent.
- */
-export function buildSkillsArgs(userArgs: readonly string[]): string[] {
-	const args = [...userArgs];
-	const subcommand = findSubcommand(args);
-	normalizeSkillsSubcommandAliases(args);
-	if (
-		subcommand &&
-		CLINE_SCOPED_SUBCOMMANDS.has(subcommand) &&
-		!hasAgentFlag(args)
-	) {
-		args.push("--agent", "cline");
-	}
-	return ["-y", SKILLS_PACKAGE, ...args];
-}
-
-function resolveExitCode(
-	code: number | null,
-	signal: NodeJS.Signals | null,
-): number {
-	if (code !== null) {
-		return code;
-	}
-	switch (signal) {
-		case "SIGINT":
-			return 130;
-		case "SIGTERM":
-			return 143;
-		default:
-			return 1;
-	}
-}
-
-/**
- * Forward all arguments to the open skills CLI via `npx skills`.
- *
- * Returns the child process exit code, or 1 if npx is unavailable or fails to
- * spawn. stdio is inherited so the skills CLI's interactive prompts and output
- * pass straight through to the user's terminal.
- */
-export async function runSkillCommand(
-	userArgs: readonly string[],
-	io: SkillCommandIo,
-): Promise<number> {
-	const args = buildSkillsArgs(userArgs);
-	const isWindows = process.platform === "win32";
-	const options: SpawnOptions = {
-		stdio: "inherit",
-		env: process.env,
-		// Prevent a console window from flashing on Windows.
-		windowsHide: true,
-		...(isWindows ? { shell: true } : {}),
-	};
-
-	return new Promise<number>((resolve) => {
-		const child = spawn("npx", args, options);
-
-		const forward = (signal: NodeJS.Signals) => {
-			child.kill(signal);
-		};
-		const handleSigint = () => forward("SIGINT");
-		const handleSigterm = () => forward("SIGTERM");
-		process.on("SIGINT", handleSigint);
-		process.on("SIGTERM", handleSigterm);
-		const cleanup = () => {
-			process.off("SIGINT", handleSigint);
-			process.off("SIGTERM", handleSigterm);
-		};
-
-		child.once("error", (error: NodeJS.ErrnoException) => {
-			cleanup();
-			if (error.code === "ENOENT") {
-				io.writeErr(
-					'npx was not found. Install Node.js (which includes npx) to use "cline skill".',
-				);
-			} else {
-				io.writeErr(`Failed to run npx ${SKILLS_PACKAGE}: ${error.message}`);
-			}
-			resolve(1);
-		});
-		child.once("close", (code, signal) => {
-			cleanup();
-			resolve(resolveExitCode(code, signal));
-		});
-	});
-}

apps/cli/src/commands/update.test.ts

@@ -1,24 +1,15 @@
 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
-import { afterEach, describe, expect, it, vi } from "vitest";
+import { afterEach, describe, expect, it } from "vitest";
 import {
-	autoUpdateOnStartup,
-	checkForUpdates,
 	getInstallationInfo,
 	PackageManager,
-	resolveCliHubOwnerContext,
 	withMinimumReleaseAgeBypass,
 } from "./update";
 
 const originalArgv = [...process.argv];
-const originalBuildEnv = process.env.CLINE_BUILD_ENV;
-const originalDataDir = process.env.CLINE_DATA_DIR;
-const originalHubDiscoveryPath = process.env.CLINE_HUB_DISCOVERY_PATH;
 const originalWrapperPath = process.env.CLINE_WRAPPER_PATH;
-const originalGlobalSettingsPath = process.env.CLINE_GLOBAL_SETTINGS_PATH;
-const originalIsDev = process.env.IS_DEV;
-const originalNoAutoUpdate = process.env.CLINE_NO_AUTO_UPDATE;
 const tempDirs: string[] = [];
 
 function createFile(path: string): string {
@@ -36,42 +27,11 @@ function createTempFile(pathSuffix: string): string {
 describe("getInstallationInfo", () => {
 	afterEach(() => {
 		process.argv = [...originalArgv];
-		if (originalBuildEnv === undefined) {
-			delete process.env.CLINE_BUILD_ENV;
-		} else {
-			process.env.CLINE_BUILD_ENV = originalBuildEnv;
-		}
-		if (originalDataDir === undefined) {
-			delete process.env.CLINE_DATA_DIR;
-		} else {
-			process.env.CLINE_DATA_DIR = originalDataDir;
-		}
-		if (originalHubDiscoveryPath === undefined) {
-			delete process.env.CLINE_HUB_DISCOVERY_PATH;
-		} else {
-			process.env.CLINE_HUB_DISCOVERY_PATH = originalHubDiscoveryPath;
-		}
 		if (originalWrapperPath === undefined) {
 			delete process.env.CLINE_WRAPPER_PATH;
 		} else {
 			process.env.CLINE_WRAPPER_PATH = originalWrapperPath;
 		}
-		if (originalGlobalSettingsPath === undefined) {
-			delete process.env.CLINE_GLOBAL_SETTINGS_PATH;
-		} else {
-			process.env.CLINE_GLOBAL_SETTINGS_PATH = originalGlobalSettingsPath;
-		}
-		if (originalIsDev === undefined) {
-			delete process.env.IS_DEV;
-		} else {
-			process.env.IS_DEV = originalIsDev;
-		}
-		if (originalNoAutoUpdate === undefined) {
-			delete process.env.CLINE_NO_AUTO_UPDATE;
-		} else {
-			process.env.CLINE_NO_AUTO_UPDATE = originalNoAutoUpdate;
-		}
-		vi.restoreAllMocks();
 		for (const dir of tempDirs.splice(0)) {
 			rmSync(dir, { recursive: true, force: true });
 		}
@@ -85,7 +45,7 @@ describe("getInstallationInfo", () => {
 		expect(getInstallationInfo("1.2.3")).toEqual({
 			packageManager: PackageManager.NPM,
 			packageName: "cline",
-			updateCommand: "npm update -g cline --tag latest",
+			updateCommand: "npm install -g cline@latest",
 		});
 	});
 
@@ -97,7 +57,7 @@ describe("getInstallationInfo", () => {
 		expect(getInstallationInfo("1.2.3-nightly.456")).toEqual({
 			packageManager: PackageManager.NPM,
 			packageName: "cline",
-			updateCommand: "npm update -g cline --tag nightly",
+			updateCommand: "npm install -g cline@nightly",
 		});
 	});
 
@@ -112,122 +72,14 @@ describe("getInstallationInfo", () => {
 	});
 });
 
-describe("auto update settings", () => {
-	afterEach(() => {
-		process.argv = [...originalArgv];
-		if (originalBuildEnv === undefined) {
-			delete process.env.CLINE_BUILD_ENV;
-		} else {
-			process.env.CLINE_BUILD_ENV = originalBuildEnv;
-		}
-		if (originalDataDir === undefined) {
-			delete process.env.CLINE_DATA_DIR;
-		} else {
-			process.env.CLINE_DATA_DIR = originalDataDir;
-		}
-		if (originalHubDiscoveryPath === undefined) {
-			delete process.env.CLINE_HUB_DISCOVERY_PATH;
-		} else {
-			process.env.CLINE_HUB_DISCOVERY_PATH = originalHubDiscoveryPath;
-		}
-		if (originalWrapperPath === undefined) {
-			delete process.env.CLINE_WRAPPER_PATH;
-		} else {
-			process.env.CLINE_WRAPPER_PATH = originalWrapperPath;
-		}
-		if (originalGlobalSettingsPath === undefined) {
-			delete process.env.CLINE_GLOBAL_SETTINGS_PATH;
-		} else {
-			process.env.CLINE_GLOBAL_SETTINGS_PATH = originalGlobalSettingsPath;
-		}
-		if (originalIsDev === undefined) {
-			delete process.env.IS_DEV;
-		} else {
-			process.env.IS_DEV = originalIsDev;
-		}
-		if (originalNoAutoUpdate === undefined) {
-			delete process.env.CLINE_NO_AUTO_UPDATE;
-		} else {
-			process.env.CLINE_NO_AUTO_UPDATE = originalNoAutoUpdate;
-		}
-		vi.restoreAllMocks();
-		for (const dir of tempDirs.splice(0)) {
-			rmSync(dir, { recursive: true, force: true });
-		}
-	});
-
-	it("skips startup auto update when disabled globally", () => {
-		const settingsPath = createTempFile("data/global-settings.json");
-		writeFileSync(settingsPath, JSON.stringify({ autoUpdateEnabled: false }));
-		process.env.CLINE_GLOBAL_SETTINGS_PATH = settingsPath;
-		delete process.env.IS_DEV;
-		delete process.env.CLINE_NO_AUTO_UPDATE;
-		const fetchSpy = vi
-			.spyOn(globalThis, "fetch")
-			.mockRejectedValue(new Error("should not fetch"));
-
-		autoUpdateOnStartup();
-
-		expect(fetchSpy).not.toHaveBeenCalled();
-	});
-
-	it("still lets manual update checks run when startup auto update is disabled", async () => {
-		const settingsPath = createTempFile("data/global-settings.json");
-		writeFileSync(settingsPath, JSON.stringify({ autoUpdateEnabled: false }));
-		process.env.CLINE_GLOBAL_SETTINGS_PATH = settingsPath;
-		delete process.env.CLINE_NO_AUTO_UPDATE;
-		const fetchSpy = vi.spyOn(globalThis, "fetch").mockResolvedValue({
-			ok: true,
-			json: async () => ({ version: "0.0.0" }),
-		} as Response);
-
-		await checkForUpdates({ includeKanban: false });
-
-		expect(fetchSpy).toHaveBeenCalled();
-	});
-});
-
-describe("hub restart owner selection", () => {
-	afterEach(() => {
-		if (originalBuildEnv === undefined) {
-			delete process.env.CLINE_BUILD_ENV;
-		} else {
-			process.env.CLINE_BUILD_ENV = originalBuildEnv;
-		}
-		if (originalDataDir === undefined) {
-			delete process.env.CLINE_DATA_DIR;
-		} else {
-			process.env.CLINE_DATA_DIR = originalDataDir;
-		}
-		if (originalHubDiscoveryPath === undefined) {
-			delete process.env.CLINE_HUB_DISCOVERY_PATH;
-		} else {
-			process.env.CLINE_HUB_DISCOVERY_PATH = originalHubDiscoveryPath;
-		}
-	});
-
-	it("uses the shared hub owner outside production builds", () => {
-		process.env.CLINE_BUILD_ENV = "development";
-		process.env.CLINE_DATA_DIR = "/tmp/cline-update-test-data";
-		delete process.env.CLINE_HUB_DISCOVERY_PATH;
-
-		const owner = resolveCliHubOwnerContext();
-
-		expect(owner.discoveryPath).toContain("/locks/hub/owners/");
-		expect(owner.discoveryPath).not.toBe(
-			"/tmp/cline-update-test-data/locks/hub/production.json",
-		);
-	});
-});
-
 describe("withMinimumReleaseAgeBypass", () => {
 	it("adds the package-manager-specific cooldown bypass", () => {
 		expect(
 			withMinimumReleaseAgeBypass(
-				"npm update -g cline --tag latest",
+				"npm install -g cline@latest",
 				PackageManager.NPM,
 			).command,
-		).toBe("npm update -g cline --tag latest --min-release-age=0");
+		).toBe("npm install -g cline@latest --min-release-age=0");
 		expect(
 			withMinimumReleaseAgeBypass("bun add -g cline@latest", PackageManager.BUN)
 				.command,

apps/cli/src/commands/update.ts

@@ -2,14 +2,11 @@ import { type ChildProcess, spawn } from "node:child_process";
 import { realpathSync } from "node:fs";
 import {
 	clearHubDiscovery,
-	isAutoUpdateEnabledGlobally,
 	probeHubServer,
 	readHubDiscovery,
-	resolveProductionHubOwnerContext,
 	resolveSharedHubOwnerContext,
 	stopLocalHubServerGracefully,
 } from "@cline/core";
-import { resolveClineBuildEnv } from "@cline/shared";
 import { version } from "../../package.json";
 import { ensureCliHubServer } from "../utils/hub-runtime";
 import { c, writeErr, writeln } from "../utils/output";
@@ -129,7 +126,7 @@ export function getInstallationInfo(currentVersion: string): InstallationInfo {
 			return {
 				packageManager: PackageManager.NPM,
 				packageName: DEFAULT_PACKAGE_NAME,
-				updateCommand: `npm update -g ${DEFAULT_PACKAGE_NAME} --tag ${tag}`,
+				updateCommand: `npm install -g ${DEFAULT_PACKAGE_NAME}@${tag}`,
 			};
 		}
 	} catch {
@@ -271,22 +268,13 @@ export function getPreferredKanbanInstaller(
 
 const sleep = (ms: number) => new Promise<void>((r) => setTimeout(r, ms));
 
-export function resolveCliHubOwnerContext() {
-	return resolveClineBuildEnv() === "production"
-		? resolveProductionHubOwnerContext()
-		: resolveSharedHubOwnerContext();
-}
-
 async function waitForHubToStop(
 	url: string,
-	authToken: string | undefined,
 	timeoutMs: number,
 ): Promise<boolean> {
 	const deadline = Date.now() + timeoutMs;
 	while (Date.now() < deadline) {
-		const check = await probeHubServer(url, { authToken }).catch(
-			() => undefined,
-		);
+		const check = await probeHubServer(url).catch(() => undefined);
 		if (!check?.url) return true;
 		await sleep(100);
 	}
@@ -299,22 +287,20 @@ async function waitForHubToStop(
  * clears stale discovery, then re-ensures a fresh instance is spawned.
  */
 async function restartHubServerIfRunning(): Promise<void> {
-	const owner = resolveCliHubOwnerContext();
+	const owner = resolveSharedHubOwnerContext();
 	const discovery = await readHubDiscovery(owner.discoveryPath).catch(
 		() => undefined,
 	);
 
 	const health = discovery?.url
-		? await probeHubServer(discovery.url, {
-				authToken: discovery.authToken,
-			}).catch(() => undefined)
+		? await probeHubServer(discovery.url).catch(() => undefined)
 		: undefined;
-	if (!discovery || !health?.url) return;
+	if (!health?.url) return;
 
 	const pid = discovery?.pid;
 	writeln(`${c.dim}[hub] restarting server…${c.reset}`);
 
-	let stopped = await stopLocalHubServerGracefully(owner).catch(() => false);
+	let stopped = await stopLocalHubServerGracefully().catch(() => false);
 	if (!stopped && pid) {
 		try {
 			process.kill(pid, "SIGTERM");
@@ -323,14 +309,14 @@ async function restartHubServerIfRunning(): Promise<void> {
 		}
 	}
 
-	stopped = await waitForHubToStop(health.url, discovery.authToken, 3_000);
+	stopped = await waitForHubToStop(health.url, 3_000);
 	if (!stopped && pid) {
 		try {
 			process.kill(pid, "SIGKILL");
 		} catch {
 			// best-effort
 		}
-		stopped = await waitForHubToStop(health.url, discovery.authToken, 2_000);
+		stopped = await waitForHubToStop(health.url, 2_000);
 	}
 
 	await clearHubDiscovery(owner.discoveryPath).catch(() => undefined);
@@ -354,30 +340,19 @@ async function restartHubServerIfRunning(): Promise<void> {
 export function autoUpdateOnStartup(): void {
 	if (process.env.IS_DEV === "true") return;
 	if (process.env.CLINE_NO_AUTO_UPDATE === "1") return;
-	if (!isAutoUpdateEnabledGlobally()) return;
 
-	const { packageName, packageManager, updateCommand } =
-		getInstallationInfo(version);
+	const { packageName, updateCommand } = getInstallationInfo(version);
 	if (!updateCommand) return;
 
 	void (async () => {
 		try {
 			const latest = await getLatestVersion(packageName, version);
 			if (!latest || compareVersions(version, latest) >= 0) return;
-			const autoUpdateCommand = withMinimumReleaseAgeBypass(
-				updateCommand,
-				packageManager,
-			);
-			const child = spawn(autoUpdateCommand.command, {
+			const child = spawn(updateCommand, {
 				shell: true,
 				detached: true,
 				stdio: "ignore",
-				env: autoUpdateCommand.env
-					? { ...process.env, ...autoUpdateCommand.env }
-					: process.env,
-				// Prevent a console window from flashing on Windows; detached
-				// processes otherwise allocate a new visible console.
-				windowsHide: true,
+				env: process.env,
 			});
 			const exitCode = await waitForProcessExit(child);
 			if (exitCode === 0) {

apps/cli/src/connectors/adapters/discord.test.ts

@@ -228,7 +228,7 @@ describe("discordConnector", () => {
 		});
 	});
 
-	it("updates Discord participant metadata without changing the thread session", async () => {
+	it("switches Discord thread state to the incoming participant without reusing the previous participant session", async () => {
 		const dir = await mkdtemp(join(tmpdir(), "discord-participants-"));
 		const bindingsPath = join(dir, "threads.json");
 		const thread = createThread({
@@ -278,13 +278,11 @@ describe("discordConnector", () => {
 			errorLabel: "Discord",
 		});
 
-		const binding =
-			readBindings<TestDiscordState>(bindingsPath)[
-				"discord:guild:channel:thread"
-			];
-		expect(binding?.state?.participantKey).toBe("discord:user:bob");
-		expect(binding?.state?.participantLabel).toBe("Bob");
-		expect(binding?.state?.sessionId).toBe("session-alice");
+		const bob =
+			readBindings<TestDiscordState>(bindingsPath)["discord:user:bob"];
+		expect(bob?.state?.participantKey).toBe("discord:user:bob");
+		expect(bob?.state?.participantLabel).toBe("Bob");
+		expect(bob?.state?.sessionId).toBeUndefined();
 		expect(
 			readBindings<TestDiscordState>(bindingsPath)["discord:user:alice"]?.state
 				?.sessionId,

apps/cli/src/connectors/adapters/discord.ts

@@ -50,9 +50,10 @@ import {
 	type ConnectorMuteTarget,
 	type ConnectorThreadState,
 	clearBindingSessionIds,
-	findBindingForDeliveryTarget,
+	findBindingForParticipantKey,
 	findBindingForThread,
 	loadThreadState,
+	mergeThreadState,
 	persistMergedThreadState,
 	readBindings,
 } from "../thread-bindings";
@@ -563,17 +564,45 @@ async function postDiscordResolvedText(input: {
 	});
 }
 
-function resolveCurrentStateWithParticipant(input: {
-	currentState: DiscordThreadState;
+function resolveParticipantState(input: {
+	bindingsPath: string;
+	baseStartRequest: ChatStartSessionRequest;
 	participant: DiscordParticipant;
 }): DiscordThreadState {
+	const existing = findBindingForParticipantKey(
+		readBindings<DiscordThreadState>(input.bindingsPath),
+		input.participant.key,
+	)?.binding.state;
 	return {
-		...input.currentState,
+		...mergeThreadState<DiscordThreadState>(
+			undefined,
+			existing,
+			input.baseStartRequest,
+		),
 		participantKey: input.participant.key,
 		participantLabel: input.participant.label,
 	};
 }
 
+function resolveCurrentStateWithParticipant(input: {
+	currentState: DiscordThreadState;
+	bindingsPath: string;
+	baseStartRequest: ChatStartSessionRequest;
+	participant: DiscordParticipant;
+}): DiscordThreadState {
+	if (input.currentState.participantKey === input.participant.key) {
+		return {
+			...input.currentState,
+			participantLabel: input.participant.label,
+		};
+	}
+	return resolveParticipantState({
+		bindingsPath: input.bindingsPath,
+		baseStartRequest: input.baseStartRequest,
+		participant: input.participant,
+	});
+}
+
 async function persistDiscordThreadContext(input: {
 	thread: Thread<DiscordThreadState>;
 	bindingsPath: string;
@@ -595,6 +624,8 @@ async function persistDiscordThreadContext(input: {
 	);
 	const nextState = resolveCurrentStateWithParticipant({
 		currentState,
+		bindingsPath: input.bindingsPath,
+		baseStartRequest: input.baseStartRequest,
 		participant,
 	});
 	if (
@@ -638,20 +669,20 @@ async function deliverScheduledResult(input: {
 	const threadId =
 		typeof delivery.threadId === "string" ? delivery.threadId.trim() : "";
 	const bindingKey =
-		typeof delivery.bindingKey === "string" ? delivery.bindingKey.trim() : "";
-	const participantKey =
-		typeof delivery.participantKey === "string"
-			? delivery.participantKey.trim()
-			: "";
-	if (!threadId && !bindingKey && !participantKey) {
+		typeof delivery.bindingKey === "string"
+			? delivery.bindingKey.trim()
+			: typeof delivery.participantKey === "string"
+				? delivery.participantKey.trim()
+				: "";
+	if (!threadId && !bindingKey) {
 		return;
 	}
 	const bindings = readBindings<DiscordThreadState>(input.bindingsPath);
-	const match = findBindingForDeliveryTarget(bindings, {
-		bindingKey,
-		threadId,
-		participantKey,
-	});
+	const match = bindingKey
+		? findBindingForParticipantKey(bindings, bindingKey)
+		: threadId
+			? { key: threadId, binding: bindings[threadId] }
+			: undefined;
 	const binding = match?.binding;
 	if (!binding?.serializedThread) {
 		return;
@@ -1102,7 +1133,9 @@ class DiscordConnector extends ConnectorBase<
 				isSubscribedThreadMessage?: boolean;
 			},
 		) => {
-			const queueKey = thread.id;
+			const queueKey =
+				(await loadThreadState(thread, bindingsPath, startRequest))
+					.participantKey || thread.id;
 			const runTurn = async () => {
 				try {
 					await handleConnectorUserTurn({

apps/cli/src/connectors/adapters/gchat.test.ts

@@ -2,7 +2,7 @@ import { describe, expect, it } from "vitest";
 import { __test__ } from "./gchat";
 
 describe("gchat binding lookup", () => {
-	it("does not fall back to channel identity for a different space thread id", () => {
+	it("falls back to channel identity when a restarted connector gets a new thread id", () => {
 		const result = __test__.findBindingForThread(
 			{
 				legacy_thread_id: {
@@ -21,7 +21,17 @@ describe("gchat binding lookup", () => {
 			},
 		);
 
-		expect(result).toBeUndefined();
+		expect(result).toEqual({
+			key: "legacy_thread_id",
+			binding: {
+				channelId: "space-123",
+				isDM: false,
+				serializedThread: "{}",
+				sessionId: "sess-1",
+				state: { sessionId: "sess-1", cwd: "/tmp/work" },
+				updatedAt: "2026-03-17T00:00:00.000Z",
+			},
+		});
 	});
 
 	it("prefers an exact thread id match over a channel fallback", () => {
@@ -55,7 +65,7 @@ describe("gchat binding lookup", () => {
 		expect(result?.binding.sessionId).toBe("sess-2");
 	});
 
-	it("does not reuse a binding by participant key across different spaces", () => {
+	it("reuses a binding by participant key across different spaces", () => {
 		const result = __test__.findBindingForThread(
 			{
 				"gchat:email:alice@example.com": {
@@ -81,6 +91,7 @@ describe("gchat binding lookup", () => {
 			},
 		);
 
-		expect(result).toBeUndefined();
+		expect(result?.key).toBe("gchat:email:alice@example.com");
+		expect(result?.binding.sessionId).toBe("sess-1");
 	});
 });

apps/cli/src/connectors/adapters/gchat.ts

@@ -46,7 +46,7 @@ import {
 	type ConnectorBindingStore,
 	type ConnectorThreadState,
 	clearBindingSessionIds,
-	findBindingForDeliveryTarget,
+	findBindingForParticipantKey,
 	findBindingForThread,
 	loadThreadState,
 	persistMergedThreadState,
@@ -191,20 +191,20 @@ async function deliverScheduledResult(input: {
 	const threadId =
 		typeof delivery.threadId === "string" ? delivery.threadId.trim() : "";
 	const bindingKey =
-		typeof delivery.bindingKey === "string" ? delivery.bindingKey.trim() : "";
-	const participantKey =
-		typeof delivery.participantKey === "string"
-			? delivery.participantKey.trim()
-			: "";
-	if (!threadId && !bindingKey && !participantKey) {
+		typeof delivery.bindingKey === "string"
+			? delivery.bindingKey.trim()
+			: typeof delivery.participantKey === "string"
+				? delivery.participantKey.trim()
+				: "";
+	if (!threadId && !bindingKey) {
 		return;
 	}
 	const bindings = readBindings<GoogleChatThreadState>(input.bindingsPath);
-	const match = findBindingForDeliveryTarget(bindings, {
-		bindingKey,
-		threadId,
-		participantKey,
-	});
+	const match = bindingKey
+		? findBindingForParticipantKey(bindings, bindingKey)
+		: threadId
+			? { key: threadId, binding: bindings[threadId] }
+			: undefined;
 	const binding = match?.binding;
 	if (!binding?.serializedThread) {
 		return;
@@ -590,7 +590,9 @@ class GoogleChatConnector extends ConnectorBase<
 			thread: Thread<GoogleChatThreadState>,
 			text: string,
 		) => {
-			const queueKey = thread.id;
+			const queueKey =
+				(await loadThreadState(thread, bindingsPath, startRequest))
+					.participantKey || thread.id;
 			const runTurn = async () => {
 				try {
 					await handleConnectorUserTurn({

apps/cli/src/connectors/adapters/linear.test.ts

@@ -2,7 +2,7 @@ import { describe, expect, it } from "vitest";
 import { __test__ } from "./linear";
 
 describe("linear binding lookup", () => {
-	it("does not fall back to channel identity for a different issue thread id", () => {
+	it("falls back to channel identity when a restarted connector gets a new thread id", () => {
 		const result = __test__.findBindingForThread(
 			{
 				legacy_thread_id: {
@@ -21,7 +21,17 @@ describe("linear binding lookup", () => {
 			},
 		);
 
-		expect(result).toBeUndefined();
+		expect(result).toEqual({
+			key: "legacy_thread_id",
+			binding: {
+				channelId: "linear:issue:ISS-123",
+				isDM: false,
+				serializedThread: "{}",
+				sessionId: "sess-1",
+				state: { sessionId: "sess-1", cwd: "/tmp/work" },
+				updatedAt: "2026-03-17T00:00:00.000Z",
+			},
+		});
 	});
 
 	it("prefers an exact thread id match over a channel fallback", () => {
@@ -55,7 +65,7 @@ describe("linear binding lookup", () => {
 		expect(result?.binding.sessionId).toBe("sess-2");
 	});
 
-	it("does not reuse a binding by participant key across different issue threads", () => {
+	it("reuses a binding by participant key across different issue threads", () => {
 		const result = __test__.findBindingForThread(
 			{
 				"linear:user:user_123": {
@@ -81,6 +91,7 @@ describe("linear binding lookup", () => {
 			},
 		);
 
-		expect(result).toBeUndefined();
+		expect(result?.key).toBe("linear:user:user_123");
+		expect(result?.binding.sessionId).toBe("sess-1");
 	});
 });

apps/cli/src/connectors/adapters/linear.ts

@@ -42,7 +42,7 @@ import {
 	type ConnectorBindingStore,
 	type ConnectorThreadState,
 	clearBindingSessionIds,
-	findBindingForDeliveryTarget,
+	findBindingForParticipantKey,
 	findBindingForThread,
 	loadThreadState,
 	persistMergedThreadState,
@@ -229,20 +229,20 @@ async function deliverScheduledResult(input: {
 	const threadId =
 		typeof delivery.threadId === "string" ? delivery.threadId.trim() : "";
 	const bindingKey =
-		typeof delivery.bindingKey === "string" ? delivery.bindingKey.trim() : "";
-	const participantKey =
-		typeof delivery.participantKey === "string"
-			? delivery.participantKey.trim()
-			: "";
-	if (!threadId && !bindingKey && !participantKey) {
+		typeof delivery.bindingKey === "string"
+			? delivery.bindingKey.trim()
+			: typeof delivery.participantKey === "string"
+				? delivery.participantKey.trim()
+				: "";
+	if (!threadId && !bindingKey) {
 		return;
 	}
 	const bindings = readBindings<LinearThreadState>(input.bindingsPath);
-	const match = findBindingForDeliveryTarget(bindings, {
-		bindingKey,
-		threadId,
-		participantKey,
-	});
+	const match = bindingKey
+		? findBindingForParticipantKey(bindings, bindingKey)
+		: threadId
+			? { key: threadId, binding: bindings[threadId] }
+			: undefined;
 	const binding = match?.binding;
 	if (!binding?.serializedThread) {
 		return;
@@ -625,7 +625,9 @@ class LinearConnector extends ConnectorBase<
 			thread: Thread<LinearThreadState>,
 			text: string,
 		) => {
-			const queueKey = thread.id;
+			const queueKey =
+				(await loadThreadState(thread, bindingsPath, startRequest))
+					.participantKey || thread.id;
 			const runTurn = async () => {
 				try {
 					await handleConnectorUserTurn({

apps/cli/src/connectors/adapters/prompts.ts

@@ -29,7 +29,7 @@ export function getConnectorSystemRules(
 }
 
 const CONNECTOR_FIRST_CONTACT_MESSAGE = [
-	"Connected to Cline.",
+	"Connected.",
 	"Your chat history is kept separately for your account.",
 	"Send /new to start a fresh session or /whereami for thread details.",
 ].join("\n");

apps/cli/src/connectors/adapters/slack.test.ts

@@ -1,74 +1,15 @@
-import type { ConnectSlackOptions } from "@cline/shared";
-import { type Message, ThreadImpl } from "chat";
 import { describe, expect, it } from "vitest";
-import { __test__, slackConnector } from "./slack";
-
-const parseSlackArgs = (rawArgs: string[]): ConnectSlackOptions =>
-	(
-		slackConnector as unknown as {
-			parseArgs(rawArgs: string[]): ConnectSlackOptions;
-		}
-	).parseArgs(rawArgs);
+import { __test__ } from "./slack";
 
 describe("slack binding lookup", () => {
 	const participantKey = __test__.buildSlackParticipantKey("T123", "U123");
 
-	it("infers Slack webhook mode from a base URL", () => {
-		expect(__test__.inferSlackConnectionMode("https://example.test")).toBe(
-			"webhook",
-		);
-		expect(__test__.inferSlackConnectionMode("  ")).toBe("socket");
-		expect(__test__.inferSlackConnectionMode(undefined)).toBe("socket");
-	});
-
-	it("uses webhook mode when Slack args include a base URL", () => {
-		const options = parseSlackArgs([
-			"--bot-token",
-			"xoxb-token",
-			"--signing-secret",
-			"secret",
-			"--app-token",
-			"xapp-ignored",
-			"--base-url",
-			"https://example.test",
-		]);
-
-		expect(options.connectionMode).toBe("webhook");
-		expect(options.baseUrl).toBe("https://example.test");
-		expect(options.signingSecret).toBe("secret");
-		expect(options.appToken).toBeUndefined();
-	});
-
-	it("uses socket mode when Slack args omit a base URL", () => {
-		const previousBaseUrl = process.env.BASE_URL;
-		delete process.env.BASE_URL;
-		let options: ConnectSlackOptions;
-		try {
-			options = parseSlackArgs([
-				"--bot-token",
-				"xoxb-token",
-				"--app-token",
-				"xapp-token",
-			]);
-		} finally {
-			if (previousBaseUrl === undefined) {
-				delete process.env.BASE_URL;
-			} else {
-				process.env.BASE_URL = previousBaseUrl;
-			}
-		}
-
-		expect(options.connectionMode).toBe("socket");
-		expect(options.baseUrl).toBeUndefined();
-		expect(options.appToken).toBe("xapp-token");
-	});
-
-	it("falls back to DM channel identity when a restarted connector gets a new thread id", () => {
+	it("falls back to channel identity when a restarted connector gets a new thread id", () => {
 		const result = __test__.findBindingForThread(
 			{
 				legacy_thread_id: {
 					channelId: "slack:C123",
-					isDM: true,
+					isDM: false,
 					serializedThread: "{}",
 					sessionId: "sess-1",
 					state: { sessionId: "sess-1", cwd: "/tmp/work", teamId: "T123" },
@@ -78,7 +19,7 @@ describe("slack binding lookup", () => {
 			{
 				id: "new_thread_id",
 				channelId: "slack:C123",
-				isDM: true,
+				isDM: false,
 			},
 		);
 
@@ -86,7 +27,7 @@ describe("slack binding lookup", () => {
 			key: "legacy_thread_id",
 			binding: {
 				channelId: "slack:C123",
-				isDM: true,
+				isDM: false,
 				serializedThread: "{}",
 				sessionId: "sess-1",
 				state: { sessionId: "sess-1", cwd: "/tmp/work", teamId: "T123" },
@@ -126,7 +67,7 @@ describe("slack binding lookup", () => {
 		expect(result?.binding.sessionId).toBe("sess-2");
 	});
 
-	it("does not reuse a binding by participant key across different threads", () => {
+	it("reuses a binding by participant key across different threads", () => {
 		const result = __test__.findBindingForThread(
 			{
 				[participantKey]: {
@@ -153,7 +94,8 @@ describe("slack binding lookup", () => {
 			},
 		);
 
-		expect(result).toBeUndefined();
+		expect(result?.key).toBe(participantKey);
+		expect(result?.binding.sessionId).toBe("sess-1");
 	});
 
 	it("builds Slack participant keys with a team scope", () => {
@@ -215,105 +157,6 @@ describe("slack binding lookup", () => {
 		);
 	});
 
-	it("normalizes top-level channel mentions to the original Slack post thread", () => {
-		const original = new ThreadImpl({
-			adapterName: "slack",
-			channelId: "slack:C123",
-			id: "slack:C123:",
-			isDM: false,
-		});
-		const message = {
-			raw: {
-				channel: "C123",
-				text: "<@U999> help",
-				ts: "1710000000.123456",
-				type: "app_mention",
-				user: "U123",
-			},
-		} as Message;
-
-		const normalized = __test__.resolveSlackChannelMentionThread(
-			original,
-			message,
-		);
-
-		expect(normalized.id).toBe("slack:C123:1710000000.123456");
-		expect(normalized.channelId).toBe("slack:C123");
-		expect(normalized.isDM).toBe(false);
-	});
-
-	it("uses Slack thread_ts instead of reply ts for in-thread mentions", () => {
-		const original = new ThreadImpl({
-			adapterName: "slack",
-			channelId: "slack:C123",
-			id: "slack:C123:1710000001.654321",
-			isDM: false,
-		});
-		const message = {
-			raw: {
-				channel: "C123",
-				text: "<@U999> follow up",
-				thread_ts: "1710000000.123456",
-				ts: "1710000001.654321",
-				type: "app_mention",
-				user: "U123",
-			},
-		} as Message;
-
-		const normalized = __test__.resolveSlackChannelMentionThread(
-			original,
-			message,
-		);
-
-		expect(normalized.id).toBe("slack:C123:1710000000.123456");
-		expect(normalized.channelId).toBe("slack:C123");
-		expect(normalized.isDM).toBe(false);
-	});
-
-	it("keeps Slack mention threads that already target the original post", () => {
-		const original = new ThreadImpl({
-			adapterName: "slack",
-			channelId: "slack:C123",
-			id: "slack:C123:1710000000.123456",
-			isDM: false,
-		});
-		const message = {
-			raw: {
-				channel: "C123",
-				text: "<@U999> help",
-				ts: "1710000000.123456",
-				type: "app_mention",
-				user: "U123",
-			},
-		} as Message;
-
-		expect(__test__.resolveSlackChannelMentionThread(original, message)).toBe(
-			original,
-		);
-	});
-
-	it("does not rewrite Slack DM mention threads", () => {
-		const original = new ThreadImpl({
-			adapterName: "slack",
-			channelId: "slack:D123",
-			id: "slack:D123:",
-			isDM: true,
-		});
-		const message = {
-			raw: {
-				channel: "D123",
-				text: "help",
-				ts: "1710000000.123456",
-				type: "message",
-				user: "U123",
-			},
-		} as Message;
-
-		expect(__test__.resolveSlackChannelMentionThread(original, message)).toBe(
-			original,
-		);
-	});
-
 	it("routes Slack posts through the installation bot token for a team", async () => {
 		const calls: string[] = [];
 		const result = await __test__.withSlackTeamBotToken({

apps/cli/src/connectors/adapters/slack.ts

@@ -9,7 +9,6 @@ import {
 	type Adapter,
 	Chat,
 	ConsoleLogger,
-	type Message,
 	type Thread,
 	ThreadImpl,
 } from "chat";
@@ -51,7 +50,7 @@ import {
 	type ConnectorThreadBinding,
 	type ConnectorThreadState,
 	clearBindingSessionIds,
-	findBindingForDeliveryTarget,
+	findBindingForParticipantKey,
 	findBindingForThread,
 	loadThreadState,
 	persistMergedThreadState,
@@ -80,14 +79,6 @@ type SlackThreadState = ConnectorThreadState & {
 	teamId?: string;
 };
 
-type SlackConnectionMode = ConnectSlackOptions["connectionMode"];
-
-function inferSlackConnectionMode(
-	baseUrl: string | undefined,
-): SlackConnectionMode {
-	return baseUrl?.trim() ? "webhook" : "socket";
-}
-
 function truncateText(value: string, maxLength = 160): string {
 	return truncateConnectorText(value, maxLength);
 }
@@ -193,56 +184,6 @@ function extractSlackTeamId(raw: unknown): string | undefined {
 	return value?.trim() || undefined;
 }
 
-function extractSlackMessageRecord(
-	raw: unknown,
-): Record<string, unknown> | undefined {
-	const record = asRecord(raw);
-	return asRecord(record?.event) ?? asRecord(record?.message) ?? record;
-}
-
-function extractSlackChannelFromId(id: string): string | undefined {
-	const parts = id.split(":");
-	return parts[0] === "slack" ? readString(parts[1]) : undefined;
-}
-
-function resolveSlackChannelMentionThread(
-	thread: Thread<SlackThreadState>,
-	message: Message,
-): Thread<SlackThreadState> {
-	if (thread.isDM) {
-		return thread;
-	}
-	const event = extractSlackMessageRecord(message.raw);
-	const threadTs = readString(event?.thread_ts) ?? readString(event?.ts);
-	if (!threadTs) {
-		return thread;
-	}
-	const channel =
-		readString(event?.channel) ??
-		extractSlackChannelFromId(thread.id) ??
-		extractSlackChannelFromId(thread.channelId);
-	if (!channel) {
-		return thread;
-	}
-	const threadId = `slack:${channel}:${threadTs}`;
-	const channelId = `slack:${channel}`;
-	if (thread.id === threadId && thread.channelId === channelId) {
-		return thread;
-	}
-	return new ThreadImpl<SlackThreadState>({
-		adapterName: "slack",
-		channelId,
-		channelVisibility: thread.channelVisibility,
-		currentMessage: message,
-		fallbackStreamingPlaceholderText: null,
-		id: threadId,
-		initialMessage: message,
-		isDM: false,
-		isSubscribedContext: false,
-		streamingUpdateIntervalMs: 500,
-	});
-}
-
 async function withSlackBindingBotToken<T>(input: {
 	slack: Pick<SlackAdapter, "getInstallation" | "withBotToken">;
 	binding: ConnectorThreadBinding<SlackThreadState>;
@@ -376,20 +317,20 @@ async function deliverScheduledResult(input: {
 	const threadId =
 		typeof delivery.threadId === "string" ? delivery.threadId.trim() : "";
 	const bindingKey =
-		typeof delivery.bindingKey === "string" ? delivery.bindingKey.trim() : "";
-	const participantKey =
-		typeof delivery.participantKey === "string"
-			? delivery.participantKey.trim()
-			: "";
-	if (!threadId && !bindingKey && !participantKey) {
+		typeof delivery.bindingKey === "string"
+			? delivery.bindingKey.trim()
+			: typeof delivery.participantKey === "string"
+				? delivery.participantKey.trim()
+				: "";
+	if (!threadId && !bindingKey) {
 		return;
 	}
 	const bindings = readBindings<SlackThreadState>(input.bindingsPath);
-	const match = findBindingForDeliveryTarget(bindings, {
-		bindingKey,
-		threadId,
-		participantKey,
-	});
+	const match = bindingKey
+		? findBindingForParticipantKey(bindings, bindingKey)
+		: threadId
+			? { key: threadId, binding: bindings[threadId] }
+			: undefined;
 	const binding = match?.binding;
 	const deliveryThreadId = match?.key || threadId || bindingKey;
 	if (!binding?.serializedThread) {
@@ -439,10 +380,7 @@ class SlackConnector extends ConnectorBase<
 	SlackConnectorState
 > {
 	constructor() {
-		super(
-			"slack",
-			"Slack webhook/socket bridge backed by RPC runtime sessions",
-		);
+		super("slack", "Slack webhook bridge backed by RPC runtime sessions");
 	}
 
 	protected override createCommand(): Command {
@@ -455,7 +393,6 @@ class SlackConnector extends ConnectorBase<
 				"Slack bot token for single-workspace mode",
 			)
 			.option("--signing-secret <secret>", "Slack signing secret")
-			.option("--app-token <token>", "Slack app-level token for socket mode")
 			.option("--client-id <id>", "Slack OAuth client id")
 			.option("--client-secret <secret>", "Slack OAuth client secret")
 			.option(
@@ -496,7 +433,6 @@ class SlackConnector extends ConnectorBase<
 					"Environment:",
 					"  SLACK_BOT_TOKEN             Single-workspace bot token",
 					"  SLACK_SIGNING_SECRET        Slack signing secret",
-					"  SLACK_APP_TOKEN             App-level token for socket mode",
 					"  SLACK_CLIENT_ID             OAuth client id",
 					"  SLACK_CLIENT_SECRET         OAuth client secret",
 					"  SLACK_ENCRYPTION_KEY        Optional installation encryption key",
@@ -509,7 +445,6 @@ class SlackConnector extends ConnectorBase<
 			userName?: string;
 			botToken?: string;
 			signingSecret?: string;
-			appToken?: string;
 			clientId?: string;
 			clientSecret?: string;
 			encryptionKey?: string;
@@ -532,50 +467,17 @@ class SlackConnector extends ConnectorBase<
 			this.parseOptionalInteger(opts.port, "port") ??
 			Number.parseInt(process.env.PORT ?? "8787", 10);
 		const port = Number.isFinite(parsedPort) ? parsedPort : 8787;
-		const baseUrl = opts.baseUrl?.trim() || process.env.BASE_URL?.trim();
-		const connectionMode = inferSlackConnectionMode(baseUrl);
-		const isSocketMode = connectionMode === "socket";
-		if (isSocketMode && (opts.clientId?.trim() || opts.clientSecret?.trim())) {
-			throw new Error(
-				"Slack socket mode does not support --client-id or --client-secret",
-			);
-		}
-		const botToken =
-			opts.botToken?.trim() || process.env.SLACK_BOT_TOKEN?.trim();
-		const appToken = isSocketMode
-			? opts.appToken?.trim() || process.env.SLACK_APP_TOKEN?.trim()
-			: undefined;
-		if (isSocketMode && !appToken) {
-			throw new Error(
-				"Slack socket mode requires --app-token or SLACK_APP_TOKEN",
-			);
-		}
-		if (isSocketMode && !botToken) {
-			throw new Error(
-				"Slack socket mode requires --bot-token or SLACK_BOT_TOKEN",
-			);
-		}
 		return {
 			userName:
 				opts.userName?.trim() ||
 				process.env.SLACK_BOT_USERNAME?.trim() ||
 				"cline-slack",
-			connectionMode,
-			botToken,
+			botToken: opts.botToken?.trim() || process.env.SLACK_BOT_TOKEN?.trim(),
 			signingSecret:
-				connectionMode === "webhook"
-					? opts.signingSecret?.trim() ||
-						process.env.SLACK_SIGNING_SECRET?.trim()
-					: opts.signingSecret?.trim(),
-			appToken,
-			clientId:
-				connectionMode === "webhook"
-					? opts.clientId?.trim() || process.env.SLACK_CLIENT_ID?.trim()
-					: undefined,
+				opts.signingSecret?.trim() || process.env.SLACK_SIGNING_SECRET?.trim(),
+			clientId: opts.clientId?.trim() || process.env.SLACK_CLIENT_ID?.trim(),
 			clientSecret:
-				connectionMode === "webhook"
-					? opts.clientSecret?.trim() || process.env.SLACK_CLIENT_SECRET?.trim()
-					: undefined,
+				opts.clientSecret?.trim() || process.env.SLACK_CLIENT_SECRET?.trim(),
 			encryptionKey:
 				opts.encryptionKey?.trim() || process.env.SLACK_ENCRYPTION_KEY?.trim(),
 			installationKeyPrefix:
@@ -598,7 +500,10 @@ class SlackConnector extends ConnectorBase<
 				process.env.CLINE_CONNECT_HOOK_COMMAND?.trim(),
 			port,
 			host: opts.host?.trim() || process.env.HOST?.trim() || "0.0.0.0",
-			baseUrl,
+			baseUrl:
+				opts.baseUrl?.trim() ||
+				process.env.BASE_URL?.trim() ||
+				`http://127.0.0.1:${port}`,
 		};
 	}
 
@@ -694,11 +599,9 @@ class SlackConnector extends ConnectorBase<
 				readState: (path) => this.readConnectorState(path),
 				isRunning: (state) => isProcessRunning(state.pid),
 				formatAlreadyRunningMessage: (state) =>
-					state.connectionMode === "socket"
-						? `[slack] connector already running pid=${state.pid} rpc=${state.rpcAddress} mode=socket`
-						: `[slack] connector already running pid=${state.pid} rpc=${state.rpcAddress} url=${state.baseUrl}`,
+					`[slack] connector already running pid=${state.pid} rpc=${state.rpcAddress} url=${state.baseUrl}`,
 				formatBackgroundStartMessage: (pid) =>
-					`[slack] starting background connector pid=${pid} user=${options.userName} mode=${options.connectionMode}`,
+					`[slack] starting background connector pid=${pid} user=${options.userName}`,
 				foregroundHint:
 					"[slack] use `cline connect slack -i ...` to run in the foreground",
 				launchFailureMessage: "failed to launch Slack connector in background",
@@ -715,7 +618,6 @@ class SlackConnector extends ConnectorBase<
 		const consoleLogger = new ConsoleLogger("info", "slack-connect");
 		const slackConfig: Record<string, unknown> = {
 			logger: consoleLogger,
-			mode: options.connectionMode,
 			userName: options.userName,
 		};
 		if (options.botToken?.trim()) {
@@ -724,9 +626,6 @@ class SlackConnector extends ConnectorBase<
 		if (options.signingSecret?.trim()) {
 			slackConfig.signingSecret = options.signingSecret.trim();
 		}
-		if (options.appToken?.trim()) {
-			slackConfig.appToken = options.appToken.trim();
-		}
 		if (options.clientId?.trim()) {
 			slackConfig.clientId = options.clientId.trim();
 		}
@@ -795,12 +694,10 @@ class SlackConnector extends ConnectorBase<
 		await client.connect();
 		this.writeConnectorState(statePath, {
 			userName: options.userName,
-			connectionMode: options.connectionMode,
 			pid: process.pid,
 			rpcAddress,
-			...(options.connectionMode === "webhook"
-				? { port: options.port, baseUrl: options.baseUrl }
-				: {}),
+			port: options.port,
+			baseUrl: options.baseUrl,
 			startedAt: new Date().toISOString(),
 		});
 
@@ -826,7 +723,7 @@ class SlackConnector extends ConnectorBase<
 				bindingsPath,
 				startRequest,
 			);
-			const queueKey = thread.id;
+			const queueKey = currentState.participantKey || thread.id;
 			const runTurn = async () => {
 				try {
 					await withSlackTeamBotToken({
@@ -945,10 +842,9 @@ class SlackConnector extends ConnectorBase<
 		};
 
 		bot.onNewMention(async (thread, message) => {
-			const mentionThread = resolveSlackChannelMentionThread(thread, message);
-			await mentionThread.subscribe();
+			await thread.subscribe();
 			await persistSlackThreadContext({
-				thread: mentionThread,
+				thread,
 				bindingsPath,
 				baseStartRequest: startRequest,
 				rawMessage: message.raw,
@@ -956,7 +852,7 @@ class SlackConnector extends ConnectorBase<
 			});
 			if (
 				await maybeHandleConnectorApprovalReply({
-					thread: mentionThread,
+					thread,
 					text: message.text,
 					client,
 					clientId,
@@ -966,7 +862,7 @@ class SlackConnector extends ConnectorBase<
 			) {
 				return;
 			}
-			await handleTurn(mentionThread, message.text);
+			await handleTurn(thread, message.text);
 		});
 
 		bot.onSubscribedMessage(async (thread, message) => {
@@ -1052,64 +948,48 @@ class SlackConnector extends ConnectorBase<
 				},
 			});
 
-		let webhookUrl: string | undefined;
-		let oauthCallbackUrl: string | undefined;
-		const server =
-			options.connectionMode === "webhook"
-				? await (async () => {
-						const baseUrl = options.baseUrl?.trim();
-						if (!baseUrl) {
-							throw new Error(
-								"Slack webhook mode requires --base-url or BASE_URL",
-							);
-						}
-						webhookUrl = `${baseUrl.replace(/\/$/, "")}/api/webhooks/slack`;
-						oauthCallbackUrl = `${baseUrl.replace(/\/$/, "")}/api/oauth/slack/callback`;
-						return startConnectorWebhookServer({
-							host: options.host,
-							port: options.port,
-							routes: {
-								"/api/webhooks/slack": async (request) =>
-									bot.webhooks.slack(request),
-								"/api/oauth/slack/callback": async (request) => {
-									try {
-										const result = await slack.handleOAuthCallback(request);
-										return new Response(
-											`Slack installation stored for team ${result.teamId}. You can return to Slack.`,
-										);
-									} catch (error) {
-										const message =
-											error instanceof Error ? error.message : String(error);
-										loggerAdapter.core.log("Slack OAuth callback failed", {
-											severity: "warn",
-											transport: "slack",
-											error: message,
-										});
-										return new Response(`Slack OAuth error: ${message}`, {
-											status: 500,
-										});
-									}
-								},
-								"/health": () => new Response("ok"),
-								"/": () =>
-									new Response(
-										[
-											"Slack connector is running.",
-											"Connection mode: webhook",
-											`Webhook URL: ${webhookUrl}`,
-											`OAuth callback URL: ${oauthCallbackUrl}`,
-											options.botToken?.trim()
-												? "Auth mode: single workspace"
-												: options.clientId?.trim() &&
-														options.clientSecret?.trim()
-													? "Auth mode: multi-workspace OAuth"
-													: "Auth mode: incomplete (set bot token or OAuth credentials)",
-										].join("\n"),
-									),
-							},
+		const webhookUrl = `${options.baseUrl.replace(/\/$/, "")}/api/webhooks/slack`;
+		const oauthCallbackUrl = `${options.baseUrl.replace(/\/$/, "")}/api/oauth/slack/callback`;
+		const server = await startConnectorWebhookServer({
+			host: options.host,
+			port: options.port,
+			routes: {
+				"/api/webhooks/slack": async (request) => bot.webhooks.slack(request),
+				"/api/oauth/slack/callback": async (request) => {
+					try {
+						const result = await slack.handleOAuthCallback(request);
+						return new Response(
+							`Slack installation stored for team ${result.teamId}. You can return to Slack.`,
+						);
+					} catch (error) {
+						const message =
+							error instanceof Error ? error.message : String(error);
+						loggerAdapter.core.log("Slack OAuth callback failed", {
+							severity: "warn",
+							transport: "slack",
+							error: message,
 						});
-					})()
-				: undefined;
+						return new Response(`Slack OAuth error: ${message}`, {
+							status: 500,
+						});
+					}
+				},
+				"/health": () => new Response("ok"),
+				"/": () =>
+					new Response(
+						[
+							"Slack connector is running.",
+							`Webhook URL: ${webhookUrl}`,
+							`OAuth callback URL: ${oauthCallbackUrl}`,
+							options.botToken?.trim()
+								? "Auth mode: single workspace"
+								: options.clientId?.trim() && options.clientSecret?.trim()
+									? "Auth mode: multi-workspace OAuth"
+									: "Auth mode: incomplete (set bot token or OAuth credentials)",
+						].join("\n"),
+					),
+			},
+		});
 
 		const stopEventStream = client.streamEvents(
 			{ clientId: `${clientId}-server-events` },
@@ -1172,22 +1052,17 @@ class SlackConnector extends ConnectorBase<
 		process.once("SIGINT", () => requestStop("sigint"));
 		process.once("SIGTERM", () => requestStop("sigterm"));
 
-		if (options.connectionMode === "webhook") {
-			io.writeln(`[slack] listening on ${options.host}:${options.port}`);
-			io.writeln(`[slack] configure Slack webhook URL: ${webhookUrl}`);
-			io.writeln(
-				`[slack] configure Slack OAuth callback URL: ${oauthCallbackUrl}`,
-			);
-		} else {
-			io.writeln("[slack] socket mode connected");
-		}
+		io.writeln(`[slack] listening on ${options.host}:${options.port}`);
+		io.writeln(`[slack] configure Slack webhook URL: ${webhookUrl}`);
+		io.writeln(
+			`[slack] configure Slack OAuth callback URL: ${oauthCallbackUrl}`,
+		);
 
 		await stopPromise;
 		clearBindingSessionIds<SlackThreadState>(bindingsPath);
 		stopTaskUpdateStream();
 		stopEventStream();
-		await server?.close();
-		await bot.shutdown();
+		await server.close();
 		userInstructionService.stop();
 		client.close();
 		this.removeStateFile(statePath);
@@ -1198,11 +1073,9 @@ class SlackConnector extends ConnectorBase<
 export const slackConnector: ConnectCommandDefinition = new SlackConnector();
 
 export const __test__ = {
-	inferSlackConnectionMode,
 	buildSlackParticipantKey,
 	resolveSlackParticipant,
 	normalizeSlackMessageEventChannelType,
-	resolveSlackChannelMentionThread,
 	withSlackTeamBotToken,
 	isSlackInvalidThreadTsError,
 	findBindingForThread: (

apps/cli/src/connectors/adapters/telegram.md

@@ -76,15 +76,7 @@ cline connect telegram -k "$TELEGRAM_BOT_TOKEN" --no-tools
 
 When the connector starts with `--no-tools`, chat commands such as `/tools on` and `/yolo on` cannot re-enable tools for that connector run.
 
-For participant restrictions, run the interactive connector wizard with `cline connect`. The Telegram wizard asks whether to restrict access, points you to `@userinfobot`, and configures your numeric Telegram user ID.
-
-You can also pass the user ID directly:
-
-```bash
-cline connect telegram -k "$TELEGRAM_BOT_TOKEN" --allowed-user-id 12345
-```
-
-You can also pass a manual `--hook-command` that returns `{"action":"deny"}` for unauthorized `session.authorize` events. If neither access option is configured, messages are allowed.
+For participant restrictions, run the interactive connector wizard with `cline connect` or pass a `--hook-command` that returns `{"action":"deny"}` for unauthorized `session.authorize` events. If no hook is configured, messages are allowed.
 
 ## Message Delivery
 

apps/cli/src/connectors/adapters/telegram.test.ts

@@ -62,72 +62,6 @@ describe("telegramConnector", () => {
 		expect(options.enableTools).toBe(true);
 	});
 
-	it("builds an authorization hook from --allowed-user-id", () => {
-		const options = parseTelegramArgs([
-			"--bot-token",
-			"123:test",
-			"--cwd",
-			"/tmp/work",
-			"--allowed-user-id",
-			"1201547643",
-		]);
-
-		expect(options.hookCommand).toBe(
-			`jq -r ".payload.actor.participantKey" | grep -qx "telegram:id:1201547643" && echo '{"action":"allow"}' || echo '{"action":"deny","message":"unauthorized","reason":"not_on_allowlist"}'`,
-		);
-	});
-
-	it("rejects unsafe --allowed-user-id values", () => {
-		expect(() =>
-			parseTelegramArgs([
-				"--bot-token",
-				"123:test",
-				"--cwd",
-				"/tmp/work",
-				"--allowed-user-id",
-				"123; rm -rf /",
-			]),
-		).toThrow("digits only");
-	});
-
-	it("rejects mixing --allowed-user-id with --hook-command", () => {
-		expect(() =>
-			parseTelegramArgs([
-				"--bot-token",
-				"123:test",
-				"--cwd",
-				"/tmp/work",
-				"--allowed-user-id",
-				"1201547643",
-				"--hook-command",
-				"echo noop",
-			]),
-		).toThrow("either --allowed-user-id or --hook-command");
-	});
-
-	it("rejects mixing --allowed-user-id with the hook command env var", () => {
-		const originalHookCommand = process.env.CLINE_CONNECT_HOOK_COMMAND;
-		process.env.CLINE_CONNECT_HOOK_COMMAND = "echo noop";
-		try {
-			expect(() =>
-				parseTelegramArgs([
-					"--bot-token",
-					"123:test",
-					"--cwd",
-					"/tmp/work",
-					"--allowed-user-id",
-					"1201547643",
-				]),
-			).toThrow("either --allowed-user-id or --hook-command");
-		} finally {
-			if (originalHookCommand === undefined) {
-				delete process.env.CLINE_CONNECT_HOOK_COMMAND;
-			} else {
-				process.env.CLINE_CONNECT_HOOK_COMMAND = originalHookCommand;
-			}
-		}
-	});
-
 	it("does not require the bot username", () => {
 		const options = parseTelegramArgs([
 			"--bot-token",
@@ -363,7 +297,7 @@ describe("telegram binding lookup", () => {
 		expect(result?.binding.sessionId).toBe("sess-2");
 	});
 
-	it("does not reuse a binding by participant key across different chats", () => {
+	it("reuses a binding by participant key across different chats", () => {
 		const result = __test__.findBindingForThread(
 			{
 				"telegram:user:alice": {
@@ -389,6 +323,7 @@ describe("telegram binding lookup", () => {
 			},
 		);
 
-		expect(result).toBeUndefined();
+		expect(result?.key).toBe("telegram:user:alice");
+		expect(result?.binding.sessionId).toBe("sess-1");
 	});
 });

apps/cli/src/connectors/adapters/telegram.ts

@@ -42,7 +42,7 @@ import {
 	type ConnectorBindingStore,
 	type ConnectorThreadState,
 	clearBindingSessionIds,
-	findBindingForDeliveryTarget,
+	findBindingForParticipantKey,
 	findBindingForThread,
 	loadThreadState,
 	persistMergedThreadState,
@@ -89,20 +89,6 @@ function readTelegramBotId(botToken: string): string | undefined {
 	return /^\d+$/.test(botId) ? botId : undefined;
 }
 
-function normalizeAllowedTelegramUserId(value: string): string {
-	const userId = value.trim();
-	if (!/^\d+$/.test(userId)) {
-		throw new Error(
-			"connect telegram --allowed-user-id must contain digits only",
-		);
-	}
-	return userId;
-}
-
-function buildTelegramAllowedUserHookCommand(userId: string): string {
-	return `jq -r ".payload.actor.participantKey" | grep -qx "telegram:id:${userId}" && echo '{"action":"allow"}' || echo '{"action":"deny","message":"unauthorized","reason":"not_on_allowlist"}'`;
-}
-
 function describeTelegramGetMeFailure(
 	response: Response,
 	body: string,
@@ -293,20 +279,20 @@ async function deliverScheduledResult(input: {
 	const threadId =
 		typeof delivery.threadId === "string" ? delivery.threadId.trim() : "";
 	const bindingKey =
-		typeof delivery.bindingKey === "string" ? delivery.bindingKey.trim() : "";
-	const participantKey =
-		typeof delivery.participantKey === "string"
-			? delivery.participantKey.trim()
-			: "";
-	if (!threadId && !bindingKey && !participantKey) {
+		typeof delivery.bindingKey === "string"
+			? delivery.bindingKey.trim()
+			: typeof delivery.participantKey === "string"
+				? delivery.participantKey.trim()
+				: "";
+	if (!threadId && !bindingKey) {
 		return;
 	}
 	const bindings = readBindings<TelegramThreadState>(input.bindingsPath);
-	const match = findBindingForDeliveryTarget(bindings, {
-		bindingKey,
-		threadId,
-		participantKey,
-	});
+	const match = bindingKey
+		? findBindingForParticipantKey(bindings, bindingKey)
+		: threadId
+			? { key: threadId, binding: bindings[threadId] }
+			: undefined;
 	const binding = match?.binding;
 	const deliveryThreadId = match?.key || threadId;
 	if (!binding?.serializedThread) {
@@ -432,10 +418,6 @@ class TelegramConnector extends ConnectorBase<
 			.option("--mode <act|plan>", "Agent mode", "act")
 			.option("-i, --interactive", "Keep connector in foreground")
 			.option("--no-tools", "Disable tools for Telegram sessions")
-			.option(
-				"--allowed-user-id <id>",
-				"Only allow this Telegram user ID to use the bot",
-			)
 			.option(
 				"--hook-command <command>",
 				"Run a shell command for connector events",
@@ -452,7 +434,6 @@ class TelegramConnector extends ConnectorBase<
 					"Notes:",
 					"  - Without -i, the connector is launched in the background.",
 					"  - Tools are enabled by default for Telegram sessions.",
-					"  - Use --allowed-user-id or `cline connect` to restrict Telegram access.",
 					"  - Bot username is discovered from the Telegram bot token when omitted.",
 					"  - Provider/model default to the CLI's last-used provider settings.",
 				].join("\n"),
@@ -473,7 +454,6 @@ class TelegramConnector extends ConnectorBase<
 			tools?: boolean;
 			rpcAddress?: string;
 			hookCommand?: string;
-			allowedUserId?: string;
 		}>();
 		const botUsername =
 			normalizeTelegramBotUsername(opts.botUsername ?? "") ||
@@ -485,15 +465,6 @@ class TelegramConnector extends ConnectorBase<
 		if (!botToken) {
 			throw new Error("connect telegram requires -k/--bot-token <token>");
 		}
-		const hookCommand =
-			opts.hookCommand?.trim() ||
-			process.env.CLINE_CONNECT_HOOK_COMMAND?.trim();
-		const allowedUserId = opts.allowedUserId?.trim();
-		if (hookCommand && allowedUserId) {
-			throw new Error(
-				"connect telegram accepts either --allowed-user-id or --hook-command, not both",
-			);
-		}
 		return {
 			botToken,
 			...(botUsername ? { botUsername } : {}),
@@ -509,11 +480,9 @@ class TelegramConnector extends ConnectorBase<
 				opts.rpcAddress?.trim() ||
 				process.env.CLINE_RPC_ADDRESS?.trim() ||
 				resolveDefaultCliRpcAddress(),
-			hookCommand: allowedUserId
-				? buildTelegramAllowedUserHookCommand(
-						normalizeAllowedTelegramUserId(allowedUserId),
-					)
-				: hookCommand,
+			hookCommand:
+				opts.hookCommand?.trim() ||
+				process.env.CLINE_CONNECT_HOOK_COMMAND?.trim(),
 		};
 	}
 
@@ -788,7 +757,9 @@ class TelegramConnector extends ConnectorBase<
 			thread: Thread<TelegramThreadState>,
 			text: string,
 		) => {
-			const queueKey = thread.id;
+			const queueKey =
+				(await loadThreadState(thread, bindingsPath, startRequest))
+					.participantKey || thread.id;
 			const runTurn = async () => {
 				try {
 					await handleConnectorUserTurn({

apps/cli/src/connectors/adapters/whatsapp.test.ts

@@ -65,7 +65,7 @@ describe("whatsapp binding lookup", () => {
 		expect(result?.binding.sessionId).toBe("sess-2");
 	});
 
-	it("does not reuse a binding by participant key across different threads", () => {
+	it("reuses a binding by participant key across different threads", () => {
 		const result = __test__.findBindingForThread(
 			{
 				"whatsapp:user:15551234567": {
@@ -91,6 +91,7 @@ describe("whatsapp binding lookup", () => {
 			},
 		);
 
-		expect(result).toBeUndefined();
+		expect(result?.key).toBe("whatsapp:user:15551234567");
+		expect(result?.binding.sessionId).toBe("sess-1");
 	});
 });

apps/cli/src/connectors/adapters/whatsapp.ts

@@ -46,7 +46,7 @@ import {
 	type ConnectorBindingStore,
 	type ConnectorThreadState,
 	clearBindingSessionIds,
-	findBindingForDeliveryTarget,
+	findBindingForParticipantKey,
 	findBindingForThread,
 	loadThreadState,
 	persistMergedThreadState,
@@ -226,20 +226,20 @@ async function deliverScheduledResult(input: {
 	const threadId =
 		typeof delivery.threadId === "string" ? delivery.threadId.trim() : "";
 	const bindingKey =
-		typeof delivery.bindingKey === "string" ? delivery.bindingKey.trim() : "";
-	const participantKey =
-		typeof delivery.participantKey === "string"
-			? delivery.participantKey.trim()
-			: "";
-	if (!threadId && !bindingKey && !participantKey) {
+		typeof delivery.bindingKey === "string"
+			? delivery.bindingKey.trim()
+			: typeof delivery.participantKey === "string"
+				? delivery.participantKey.trim()
+				: "";
+	if (!threadId && !bindingKey) {
 		return;
 	}
 	const bindings = readBindings<WhatsAppThreadState>(input.bindingsPath);
-	const match = findBindingForDeliveryTarget(bindings, {
-		bindingKey,
-		threadId,
-		participantKey,
-	});
+	const match = bindingKey
+		? findBindingForParticipantKey(bindings, bindingKey)
+		: threadId
+			? { key: threadId, binding: bindings[threadId] }
+			: undefined;
 	const binding = match?.binding;
 	if (!binding?.serializedThread) {
 		return;
@@ -597,7 +597,9 @@ class WhatsAppConnector extends ConnectorBase<
 			thread: Thread<WhatsAppThreadState>,
 			text: string,
 		) => {
-			const queueKey = thread.id;
+			const queueKey =
+				(await loadThreadState(thread, bindingsPath, startRequest))
+					.participantKey || thread.id;
 			const runTurn = async () => {
 				try {
 					await handleConnectorUserTurn({

apps/cli/src/connectors/catalog.ts

@@ -1,2 +1,36 @@
-export type { ConnectorCatalogEntry } from "@cline/shared";
-export { CONNECTOR_CATALOG, listConnectorCatalog } from "@cline/shared";
+export type ConnectorCatalogEntry = {
+	name: string;
+	description: string;
+};
+
+export const CONNECTOR_CATALOG: ConnectorCatalogEntry[] = [
+	{
+		name: "discord",
+		description:
+			"Discord interactions and gateway bridge backed by RPC runtime sessions",
+	},
+	{
+		name: "gchat",
+		description: "Google Chat webhook bridge backed by RPC runtime sessions",
+	},
+	{
+		name: "linear",
+		description: "Linear webhook bridge backed by RPC runtime sessions",
+	},
+	{
+		name: "slack",
+		description: "Slack webhook bridge backed by RPC runtime sessions",
+	},
+	{
+		name: "telegram",
+		description: "Bridge Telegram bot messages into RPC chat sessions",
+	},
+	{
+		name: "whatsapp",
+		description: "Bridge WhatsApp webhook messages into RPC chat sessions",
+	},
+];
+
+export function listConnectorCatalog(): ConnectorCatalogEntry[] {
+	return CONNECTOR_CATALOG.map((entry) => ({ ...entry }));
+}

apps/cli/src/connectors/common.ts

@@ -194,9 +194,6 @@ export function spawnDetachedConnector(
 				...withResolvedClineBuildEnv(process.env),
 				[childEnvKey]: "1",
 			},
-			// Prevent a console window from appearing on Windows; detached
-			// processes otherwise allocate a new visible console.
-			windowsHide: true,
 		});
 		logSpawnedProcess({
 			component: options?.component ?? "connectors",

apps/cli/src/connectors/connector-host.test.ts

@@ -92,11 +92,6 @@ function createRuntimeClient(
 ) {
 	const startRuntimeSession = vi.fn(async () => ({ sessionId: "session-1" }));
 	const updateSession = vi.fn(async () => undefined);
-	const getSession = vi.fn(
-		async (sessionId: string): Promise<{ sessionId: string } | undefined> => ({
-			sessionId,
-		}),
-	);
 	const abortRuntimeSession = vi.fn(async () => undefined);
 	const deleteSession = vi.fn(async () => undefined);
 	const sendRuntimeSession = vi.fn(async () => ({
@@ -111,7 +106,6 @@ function createRuntimeClient(
 		client: {
 			startRuntimeSession,
 			updateSession,
-			getSession,
 			abortRuntimeSession,
 			stopRuntimeSession: abortRuntimeSession,
 			deleteSession,
@@ -121,7 +115,6 @@ function createRuntimeClient(
 		},
 		startRuntimeSession,
 		updateSession,
-		getSession,
 		sendRuntimeSession,
 		readMessages,
 	};
@@ -600,8 +593,7 @@ describe("handleConnectorUserTurn", () => {
 				metadata: expect.objectContaining({
 					delivery: expect.objectContaining({
 						adapter: "telegram",
-						bindingKey: "thread-1",
-						participantKey: "telegram:user:alice",
+						bindingKey: "telegram:user:alice",
 					}),
 				}),
 			}),
@@ -635,8 +627,7 @@ describe("handleConnectorUserTurn", () => {
 				metadata: {
 					delivery: {
 						adapter: "telegram",
-						bindingKey: "thread-1",
-						participantKey: "telegram:user:alice",
+						bindingKey: "telegram:user:alice",
 						threadId: "thread-1",
 					},
 				},
@@ -649,8 +640,7 @@ describe("handleConnectorUserTurn", () => {
 				metadata: {
 					delivery: {
 						adapter: "telegram",
-						bindingKey: "thread-2",
-						participantKey: "telegram:user:bob",
+						bindingKey: "telegram:user:bob",
 						threadId: "thread-2",
 					},
 				},
@@ -709,8 +699,7 @@ describe("handleConnectorUserTurn", () => {
 					delivery: expect.objectContaining({
 						adapter: "telegram",
 						threadId: "thread-1",
-						bindingKey: "thread-1",
-						participantKey: "telegram:user:alice",
+						bindingKey: "telegram:user:alice",
 						userName: "ClineAdapterBot",
 					}),
 				}),
@@ -1453,7 +1442,7 @@ describe("handleConnectorUserTurn", () => {
 		});
 		const runtime = createRuntimeClient("unused");
 		const activeTurns = new Map([
-			["other-turn-key", { sessionId: "session-1", threadId: "thread-1" }],
+			["other-turn-key", { sessionId: "session-1" }],
 		]);
 
 		await handleConnectorUserTurn({
@@ -1489,105 +1478,4 @@ describe("handleConnectorUserTurn", () => {
 		);
 		expect(posts.at(-1)).toEqual({ raw: "Steering current task." });
 	});
-
-	it("starts a normal turn when the active session is in a different thread", async () => {
-		const dir = mkdtempSync(join(tmpdir(), "connector-host-test-"));
-		tempDirs.push(dir);
-		const bindingsPath = join(dir, "threads.json");
-		const { thread, posts } = createThread({
-			enableTools: true,
-			autoApproveTools: true,
-			cwd: "/tmp/work",
-			workspaceRoot: "/tmp/work",
-			welcomeSentAt: new Date().toISOString(),
-		});
-		const runtime = createRuntimeClient("normal reply");
-		const activeTurns = new Map([
-			["other-thread", { sessionId: "session-1", threadId: "other-thread" }],
-		]);
-
-		await handleConnectorUserTurn({
-			thread: thread as never,
-			text: "start work in this thread",
-			client: runtime.client as never,
-			pendingApprovals: new Map(),
-			baseStartRequest: baseStartRequest() as never,
-			explicitSystemPrompt: undefined,
-			clientId: "client-1",
-			logger: {
-				core: { debug: vi.fn(), log: vi.fn(), error: vi.fn() },
-			} as never,
-			transport: "telegram",
-			botUserName: "ClineAdapterBot",
-			requestStop: vi.fn(),
-			bindingsPath,
-			systemRules: "rules",
-			errorLabel: "Telegram",
-			getSessionMetadata: () => ({}),
-			reusedLogMessage: "reused",
-			activeTurns,
-			turnKey: "thread-1",
-		});
-
-		expect(runtime.startRuntimeSession).toHaveBeenCalled();
-		expect(runtime.sendRuntimeSession).toHaveBeenCalledWith(
-			"session-1",
-			expect.not.objectContaining({
-				delivery: "steer",
-			}),
-			{ timeoutMs: null },
-		);
-		expect(posts.at(-1)).toEqual({ raw: "normal reply" });
-	});
-
-	it("starts a fresh session when persisted thread session is missing from the hub", async () => {
-		const dir = mkdtempSync(join(tmpdir(), "connector-host-test-"));
-		tempDirs.push(dir);
-		const bindingsPath = join(dir, "threads.json");
-		const { thread, posts, getState } = createThread({
-			sessionId: "stale-session",
-			enableTools: true,
-			autoApproveTools: true,
-			cwd: "/tmp/work",
-			workspaceRoot: "/tmp/work",
-			welcomeSentAt: new Date().toISOString(),
-		});
-		const runtime = createRuntimeClient("fresh reply");
-		runtime.getSession.mockResolvedValueOnce(undefined);
-
-		await handleConnectorUserTurn({
-			thread: thread as never,
-			text: "continue after hub restart",
-			client: runtime.client as never,
-			pendingApprovals: new Map(),
-			baseStartRequest: baseStartRequest() as never,
-			explicitSystemPrompt: undefined,
-			clientId: "client-1",
-			logger: {
-				core: { debug: vi.fn(), log: vi.fn(), error: vi.fn() },
-			} as never,
-			transport: "telegram",
-			botUserName: "ClineAdapterBot",
-			requestStop: vi.fn(),
-			bindingsPath,
-			systemRules: "rules",
-			errorLabel: "Telegram",
-			getSessionMetadata: () => ({}),
-			reusedLogMessage: "reused",
-			startedLogMessage: "started",
-			turnKey: "thread-1",
-		});
-
-		expect(runtime.getSession).toHaveBeenCalledWith("stale-session");
-		expect(runtime.startRuntimeSession).toHaveBeenCalled();
-		expect(runtime.sendRuntimeSession).toHaveBeenCalledWith(
-			"session-1",
-			expect.not.objectContaining({
-				delivery: "steer",
-			}),
-			{ timeoutMs: null },
-		);
-		expect(getState().sessionId).toBe("session-1");
-		expect(posts.at(-1)).toEqual({ raw: "fresh reply" });
-	});
 });

apps/cli/src/connectors/connector-host.ts

@@ -749,7 +749,9 @@ export async function handleConnectorUserTurn<
 					`channelId=${input.thread.channelId}`,
 					`deliveryAdapter=${input.transport}`,
 					`deliveryThread=${input.thread.id}`,
-					`deliveryBindingKey=${input.thread.id}`,
+					...(effectiveCurrent.participantKey
+						? [`deliveryBindingKey=${effectiveCurrent.participantKey}`]
+						: []),
 					`deliveryChannel=${input.thread.channelId}`,
 					...(input.botUserName
 						? [`deliveryUserName=${input.botUserName}`]
@@ -787,9 +789,11 @@ export async function handleConnectorUserTurn<
 						delivery: {
 							adapter: input.transport,
 							threadId: input.thread.id,
-							bindingKey: input.thread.id,
 							...(current.participantKey
-								? { participantKey: current.participantKey }
+								? {
+										bindingKey: current.participantKey,
+										participantKey: current.participantKey,
+									}
 								: {}),
 							...(current.participantLabel
 								? { participantLabel: current.participantLabel }
@@ -828,6 +832,11 @@ export async function handleConnectorUserTurn<
 					].join("\n");
 				},
 				list: async () => {
+					const current = await loadThreadState(
+						input.thread,
+						input.bindingsPath,
+						input.baseStartRequest,
+					);
 					const schedules = await input.client.listSchedules({ limit: 200 });
 					const matching = schedules.filter((schedule) => {
 						const delivery = schedule.metadata?.delivery;
@@ -837,9 +846,17 @@ export async function handleConnectorUserTurn<
 							!Array.isArray(delivery)
 								? (delivery as Record<string, unknown>)
 								: undefined;
+						const deliveryBindingKey =
+							typeof deliveryRecord?.bindingKey === "string"
+								? deliveryRecord.bindingKey
+								: typeof deliveryRecord?.participantKey === "string"
+									? deliveryRecord.participantKey
+									: undefined;
 						return (
 							deliveryRecord?.adapter === input.transport &&
-							deliveryRecord.threadId === input.thread.id
+							(current.participantKey
+								? deliveryBindingKey === current.participantKey
+								: deliveryRecord.threadId === input.thread.id)
 						);
 					});
 					if (matching.length === 0) {
@@ -896,9 +913,7 @@ export async function handleConnectorUserTurn<
 		input.activeTurns?.get(turnKey) ??
 		(input.activeTurns && currentState.sessionId?.trim()
 			? Array.from(input.activeTurns.values()).find(
-					(turn) =>
-						turn.sessionId === currentState.sessionId?.trim() &&
-						turn.threadId === input.thread.id,
+					(turn) => turn.sessionId === currentState.sessionId?.trim(),
 				)
 			: undefined);
 	if (activeTurn?.sessionId?.trim()) {

apps/cli/src/connectors/session-runtime.test.ts

@@ -1,17 +1,15 @@
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { afterEach, describe, expect, it, vi } from "vitest";
 
 const {
 	mockGetLastUsedProviderSettings,
 	mockGetProviderSettings,
 	mockResolveSystemPrompt,
 	mockGetProviderCollection,
-	mockGetBooleanFlagEnabled,
 } = vi.hoisted(() => ({
 	mockGetLastUsedProviderSettings: vi.fn(),
 	mockGetProviderSettings: vi.fn(),
 	mockResolveSystemPrompt: vi.fn(),
 	mockGetProviderCollection: vi.fn(),
-	mockGetBooleanFlagEnabled: vi.fn(),
 }));
 
 vi.mock("@cline/core", async () => {
@@ -20,8 +18,8 @@ vi.mock("@cline/core", async () => {
 	return {
 		...actual,
 		ProviderSettingsManager: class {
-			getLastUsedProviderSettings(options?: unknown) {
-				return mockGetLastUsedProviderSettings(options);
+			getLastUsedProviderSettings() {
+				return mockGetLastUsedProviderSettings();
 			}
 
 			getProviderSettings(providerId: string) {
@@ -45,12 +43,6 @@ vi.mock("../utils/helpers", () => ({
 	resolveWorkspaceRoot: vi.fn((cwd: string) => cwd),
 }));
 
-vi.mock("../utils/feature-flags", () => ({
-	getCliFeatureFlagsService: () => ({
-		getBooleanFlagEnabled: mockGetBooleanFlagEnabled,
-	}),
-}));
-
 vi.mock("../commands/auth", async () => {
 	const actual =
 		await vi.importActual<typeof import("../commands/auth")>(
@@ -65,10 +57,6 @@ vi.mock("../commands/auth", async () => {
 import { buildConnectorStartRequest } from "./session-runtime";
 
 describe("buildConnectorStartRequest", () => {
-	beforeEach(() => {
-		mockGetBooleanFlagEnabled.mockReturnValue(false);
-	});
-
 	afterEach(() => {
 		vi.clearAllMocks();
 		delete process.env.OPENROUTER_API_KEY;
@@ -100,64 +88,5 @@ describe("buildConnectorStartRequest", () => {
 		expect(request.provider).toBe("openrouter");
 		expect(request.apiKey).toBe("env-openrouter-key");
 		expect(request.model).toBe("anthropic/claude-sonnet-4.6");
-		expect(mockGetLastUsedProviderSettings).toHaveBeenCalledWith({
-			isClinePassEnabled: false,
-		});
-	});
-
-	it("uses auth material resolved by provider settings manager", async () => {
-		mockGetLastUsedProviderSettings.mockReturnValue({ provider: "cline-pass" });
-		mockGetProviderSettings.mockReturnValue({
-			provider: "cline-pass",
-			auth: { accessToken: "workos:resolved-token" },
-		});
-		mockGetProviderCollection.mockReturnValue({
-			provider: { env: ["CLINE_API_KEY"] },
-		});
-		mockResolveSystemPrompt.mockResolvedValue("system");
-
-		const request = await buildConnectorStartRequest({
-			options: {
-				cwd: "/tmp/work",
-				mode: "act",
-				enableTools: false,
-			},
-			io: { writeln: vi.fn(), writeErr: vi.fn() },
-			loggerConfig: { enabled: false, level: "info", destination: "stdout" },
-			systemRules: "Rules",
-			defaultModel: "cline-pass/glm-5.2",
-		});
-
-		expect(request.provider).toBe("cline-pass");
-		expect(request.apiKey).toBe("workos:resolved-token");
-		expect(request.model).toBe("cline-pass/glm-5.2");
-	});
-
-	it("uses auth material resolved by provider settings manager", async () => {
-		mockGetLastUsedProviderSettings.mockReturnValue({ provider: "cline-pass" });
-		mockGetProviderSettings.mockReturnValue({
-			provider: "cline-pass",
-			auth: { accessToken: "workos:resolved-token" },
-		});
-		mockGetProviderCollection.mockReturnValue({
-			provider: { env: ["CLINE_API_KEY"] },
-		});
-		mockResolveSystemPrompt.mockResolvedValue("system");
-
-		const request = await buildConnectorStartRequest({
-			options: {
-				cwd: "/tmp/work",
-				mode: "act",
-				enableTools: false,
-			},
-			io: { writeln: vi.fn(), writeErr: vi.fn() },
-			loggerConfig: { enabled: false, level: "info", destination: "stdout" },
-			systemRules: "Rules",
-			defaultModel: "cline-pass/glm-5.2",
-		});
-
-		expect(request.provider).toBe("cline-pass");
-		expect(request.apiKey).toBe("workos:resolved-token");
-		expect(request.model).toBe("cline-pass/glm-5.2");
 	});
 });

apps/cli/src/connectors/session-runtime.ts

@@ -16,7 +16,6 @@ import {
 import type { CliLoggerAdapter } from "../logging/adapter";
 import { resolveSystemPrompt } from "../runtime/prompt";
 import { resolveCliSessionMetadata } from "../utils/enterprise";
-import { getCliFeatureFlagsService } from "../utils/feature-flags";
 import { resolveWorkspaceRoot } from "../utils/helpers";
 import {
 	parseLocalRowMetadata,
@@ -63,10 +62,7 @@ export async function buildConnectorStartRequest(input: {
 }): Promise<ChatStartSessionRequest> {
 	const providerSettingsManager = new ProviderSettingsManager();
 	const lastUsedProviderSettings =
-		providerSettingsManager.getLastUsedProviderSettings({
-			isClinePassEnabled:
-				getCliFeatureFlagsService().getBooleanFlagEnabled("ext-cline-pass"),
-		});
+		providerSettingsManager.getLastUsedProviderSettings();
 	const provider = normalizeProviderId(
 		input.options.provider?.trim() ||
 			lastUsedProviderSettings?.provider ||
@@ -163,57 +159,36 @@ export async function getOrCreateSessionId<
 	);
 	const existing = threadState.sessionId?.trim();
 	if (existing) {
-		const existingSession = await input.client.getSession(existing);
-		if (existingSession) {
-			await persistMergedThreadState(
-				input.thread,
-				input.bindingsPath,
-				{
-					...threadState,
-					sessionId: existing,
-				},
-				input.errorLabel,
-			);
-			input.logger.core.log(input.reusedLogMessage, {
-				transport: input.transport,
-				threadId: input.thread.id,
-				sessionId: existing,
-			});
-			await dispatchConnectorHook(
-				input.hookCommand,
-				{
-					adapter: input.transport,
-					botUserName: input.hookBotUserName,
-					event: "session.reused",
-					payload: {
-						threadId: input.thread.id,
-						channelId: input.thread.channelId,
-						sessionId: existing,
-					},
-					ts: new Date().toISOString(),
-				},
-				input.logger,
-			);
-			return existing;
-		}
 		await persistMergedThreadState(
 			input.thread,
 			input.bindingsPath,
 			{
 				...threadState,
-				sessionId: undefined,
+				sessionId: existing,
 			},
 			input.errorLabel,
 		);
-		input.logger.core.log(
-			"Connector thread session missing; starting a new session",
+		input.logger.core.log(input.reusedLogMessage, {
+			transport: input.transport,
+			threadId: input.thread.id,
+			sessionId: existing,
+		});
+		await dispatchConnectorHook(
+			input.hookCommand,
 			{
-				severity: "warn",
-				transport: input.transport,
-				threadId: input.thread.id,
-				sessionId: existing,
+				adapter: input.transport,
+				botUserName: input.hookBotUserName,
+				event: "session.reused",
+				payload: {
+					threadId: input.thread.id,
+					channelId: input.thread.channelId,
+					sessionId: existing,
+				},
+				ts: new Date().toISOString(),
 			},
+			input.logger,
 		);
+		return existing;
 	}
 
 	const started = await input.client.startRuntimeSession(input.startRequest);

apps/cli/src/connectors/status.ts

@@ -26,7 +26,6 @@ export type ActiveConnectorRecord = {
 	phoneNumberId?: string;
 	port?: number;
 	baseUrl?: string;
-	connectionMode?: string;
 };
 
 function listConnectorStatePaths(
@@ -69,8 +68,6 @@ const connectorFieldExtractors: Record<
 	startedAt: (p) => (typeof p.startedAt === "string" ? p.startedAt : undefined),
 	port: (p) => (typeof p.port === "number" ? p.port : undefined),
 	baseUrl: (p) => (typeof p.baseUrl === "string" ? p.baseUrl : undefined),
-	connectionMode: (p) =>
-		typeof p.connectionMode === "string" ? p.connectionMode : undefined,
 	userName: (p) => (typeof p.userName === "string" ? p.userName : undefined),
 	botUsername: (p) =>
 		typeof p.botUsername === "string" ? p.botUsername : undefined,
@@ -94,10 +91,7 @@ const connectorConfigs: Record<
 		required: ["userName"],
 		optional: ["startedAt", "port", "baseUrl"],
 	},
-	slack: {
-		required: ["userName"],
-		optional: ["startedAt", "connectionMode", "port", "baseUrl"],
-	},
+	slack: { required: ["userName"], optional: ["startedAt", "port", "baseUrl"] },
 	whatsapp: {
 		required: ["userName"],
 		optional: ["startedAt", "phoneNumberId", "port", "baseUrl"],

apps/cli/src/connectors/thread-bindings.test.ts

@@ -6,7 +6,6 @@ import { afterEach, describe, expect, it } from "vitest";
 import {
 	type ConnectorThreadState,
 	clearBindingSessionIds,
-	findBindingForDeliveryTarget,
 	isParticipantMuted,
 	isThreadMuted,
 	readBindingForThread,
@@ -53,16 +52,16 @@ afterEach(() => {
 });
 
 describe("thread binding refresh", () => {
-	it("refreshes the serialized thread immediately when DM channel fallback rebinds a thread id", () => {
+	it("refreshes the serialized thread immediately when channel fallback rebinds a thread id", () => {
 		const path = createBindingsPath();
 		writeBindings<TestState>(path, {
 			legacy_thread_id: {
 				channelId: "slack:C123",
-				isDM: true,
+				isDM: false,
 				serializedThread: JSON.stringify({
 					id: "legacy_thread_id",
 					channelId: "slack:C123",
-					isDM: true,
+					isDM: false,
 				}),
 				sessionId: "sess-1",
 				state: { sessionId: "sess-1", teamId: "T123" },
@@ -75,7 +74,7 @@ describe("thread binding refresh", () => {
 			createThread({
 				id: "new_thread_id",
 				channelId: "slack:C123",
-				isDM: true,
+				isDM: false,
 			}),
 			"Slack",
 		);
@@ -86,7 +85,7 @@ describe("thread binding refresh", () => {
 		expect(bindings.new_thread_id?.serializedThread).toContain("new_thread_id");
 	});
 
-	it("does not rebind a different thread by participant key", () => {
+	it("refreshes the serialized thread when a participant-key binding matches a new thread id", () => {
 		const path = createBindingsPath();
 		const participantKey = "slack:team:T123:user:U123";
 		writeBindings<TestState>(path, {
@@ -120,69 +119,10 @@ describe("thread binding refresh", () => {
 			participantKey,
 		);
 
-		expect(binding).toBeUndefined();
+		expect(binding?.serializedThread).toContain("new_thread_id");
 		expect(
 			readBindings<TestState>(path)[participantKey]?.serializedThread,
-		).toContain("legacy_thread_id");
-	});
-
-	it("resolves schedule delivery targets by exact binding key before participant metadata", () => {
-		const path = createBindingsPath();
-		writeBindings<TestState>(path, {
-			"slack:C123:111.222": {
-				kind: "conversation",
-				channelId: "slack:C123",
-				isDM: false,
-				participantKey: "slack:team:T123:user:U123",
-				serializedThread: "{}",
-				sessionId: "sess-thread",
-				state: {
-					sessionId: "sess-thread",
-					participantKey: "slack:team:T123:user:U123",
-				},
-				updatedAt: "2026-03-17T00:00:00.000Z",
-			},
-		});
-
-		const match = findBindingForDeliveryTarget<TestState>(
-			readBindings<TestState>(path),
-			{
-				bindingKey: "slack:C123:111.222",
-				threadId: "slack:C123:111.222",
-				participantKey: "slack:team:T123:user:U123",
-			},
-		);
-
-		expect(match?.key).toBe("slack:C123:111.222");
-		expect(match?.binding.sessionId).toBe("sess-thread");
-	});
-
-	it("resolves schedule delivery targets by participant key when no exact thread binding exists", () => {
-		const path = createBindingsPath();
-		writeBindings<TestState>(path, {
-			"slack:team:T123:user:U123": {
-				channelId: "slack:C123",
-				isDM: true,
-				participantKey: "slack:team:T123:user:U123",
-				serializedThread: "{}",
-				sessionId: "sess-participant",
-				state: {
-					sessionId: "sess-participant",
-					participantKey: "slack:team:T123:user:U123",
-				},
-				updatedAt: "2026-03-17T00:00:00.000Z",
-			},
-		});
-
-		const match = findBindingForDeliveryTarget<TestState>(
-			readBindings<TestState>(path),
-			{
-				participantKey: "slack:team:T123:user:U123",
-			},
-		);
-
-		expect(match?.key).toBe("slack:team:T123:user:U123");
-		expect(match?.binding.sessionId).toBe("sess-participant");
+		).toContain("new_thread_id");
 	});
 
 	it("stores mute state at thread scope instead of participant scope", () => {

apps/cli/src/connectors/thread-bindings.ts

@@ -14,7 +14,7 @@ export type ConnectorThreadState = {
 };
 
 export type ConnectorThreadBinding<TState extends ConnectorThreadState> = {
-	kind?: "conversation" | "participant" | "thread" | "thread-participant-mute";
+	kind?: "participant" | "thread" | "thread-participant-mute";
 	channelId: string;
 	isDM: boolean;
 	participantKey?: string;
@@ -134,9 +134,12 @@ function clearSerializedThreadSessionId(serializedThread: string | undefined): {
 
 export function resolveThreadBindingKey(
 	thread: ConnectorBindingThreadIdentity,
-	_state?: ConnectorThreadState | null,
+	state?: ConnectorThreadState | null,
 ): string {
-	return thread.id;
+	return (
+		normalizeParticipantKey(state?.participantKey ?? thread.participantKey) ??
+		thread.id
+	);
 }
 
 export function readBindings<TState extends ConnectorThreadState>(
@@ -157,13 +160,40 @@ export function findBindingForThread<TState extends ConnectorThreadState>(
 	bindings: ConnectorBindingStore<TState>,
 	thread: ConnectorBindingThreadIdentity,
 ): { binding: ConnectorThreadBinding<TState>; key: string } | undefined {
+	const participantKey = normalizeParticipantKey(thread.participantKey);
+	if (participantKey) {
+		const exactThread = bindings[thread.id];
+		const exactThreadParticipantKey = normalizeParticipantKey(
+			exactThread?.participantKey ?? exactThread?.state?.participantKey,
+		);
+		if (
+			exactThread &&
+			!isControlBinding(exactThread) &&
+			exactThreadParticipantKey === participantKey
+		) {
+			return { key: thread.id, binding: exactThread };
+		}
+		const exactParticipant = bindings[participantKey];
+		if (exactParticipant && !isControlBinding(exactParticipant)) {
+			return { key: participantKey, binding: exactParticipant };
+		}
+		for (const [key, binding] of Object.entries(bindings)) {
+			if (isControlBinding(binding)) {
+				continue;
+			}
+			const bindingParticipantKey = normalizeParticipantKey(
+				binding.participantKey ?? binding.state?.participantKey,
+			);
+			if (bindingParticipantKey === participantKey) {
+				return { key, binding };
+			}
+		}
+		return undefined;
+	}
 	const exact = bindings[thread.id];
 	if (exact && !isControlBinding(exact)) {
 		return { key: thread.id, binding: exact };
 	}
-	if (!thread.isDM) {
-		return undefined;
-	}
 	for (const [key, binding] of Object.entries(bindings)) {
 		if (isControlBinding(binding)) {
 			continue;
@@ -252,8 +282,29 @@ export function persistThreadBinding<TState extends ConnectorThreadState>(
 		thread as ConnectorBindingThreadIdentity,
 		state,
 	);
+	for (const [key, binding] of Object.entries(bindings)) {
+		if (isControlBinding(binding)) {
+			continue;
+		}
+		const bindingParticipantKey = normalizeParticipantKey(
+			binding.participantKey ?? binding.state?.participantKey,
+		);
+		const matchesParticipant =
+			participantKey && bindingParticipantKey === participantKey;
+		const matchesLegacyKey = participantKey && key === thread.id;
+		const matchesLegacyThread =
+			!participantKey &&
+			binding.channelId === thread.channelId &&
+			binding.isDM === thread.isDM;
+		if (
+			key !== bindingKey &&
+			(matchesParticipant || matchesLegacyKey || matchesLegacyThread)
+		) {
+			delete bindings[key];
+		}
+	}
 	bindings[bindingKey] = {
-		kind: "conversation",
+		kind: "participant",
 		channelId: thread.channelId,
 		isDM: thread.isDM,
 		participantKey,
@@ -480,37 +531,6 @@ export function findBindingForParticipantKey<
 	return undefined;
 }
 
-export function findBindingForDeliveryTarget<
-	TState extends ConnectorThreadState,
->(
-	bindings: ConnectorBindingStore<TState>,
-	input: {
-		bindingKey?: string;
-		threadId?: string;
-		participantKey?: string;
-	},
-): { binding: ConnectorThreadBinding<TState>; key: string } | undefined {
-	const bindingKey = normalizeParticipantKey(input.bindingKey);
-	if (bindingKey) {
-		const exact = bindings[bindingKey];
-		if (exact && !isControlBinding(exact)) {
-			return { key: bindingKey, binding: exact };
-		}
-		const participantMatch = findBindingForParticipantKey(bindings, bindingKey);
-		if (participantMatch) {
-			return participantMatch;
-		}
-	}
-	const threadId = input.threadId?.trim();
-	if (threadId) {
-		const exact = bindings[threadId];
-		if (exact && !isControlBinding(exact)) {
-			return { key: threadId, binding: exact };
-		}
-	}
-	return findBindingForParticipantKey(bindings, input.participantKey);
-}
-
 export async function persistMergedThreadState<
 	TState extends ConnectorThreadState,
 >(

apps/cli/src/main.test.ts

@@ -29,9 +29,7 @@ const authMocks = vi.hoisted(() => ({
 	runAuthCommand: vi.fn(),
 }));
 const providerSettingsMocks = vi.hoisted(() => ({
-	getLastUsedProviderSettings: vi.fn<(options?: unknown) => unknown>(
-		() => undefined,
-	),
+	getLastUsedProviderSettings: vi.fn<() => unknown>(() => undefined),
 	getProviderConfig: vi.fn<(providerId: string, options?: unknown) => unknown>(
 		() => undefined,
 	),
@@ -84,11 +82,6 @@ const historyMocks = vi.hoisted(() => ({
 	runHistoryExport: vi.fn(async () => 0),
 	runHistoryUpdate: vi.fn(async () => 0),
 }));
-const historyResumeMocks = vi.hoisted(() => ({
-	spawnHistoryResume: vi.fn<() => Promise<number | undefined>>(
-		async () => undefined,
-	),
-}));
 const loggingMocks = vi.hoisted(() => ({
 	createCliLoggerAdapter: vi.fn(() => ({
 		core: {
@@ -108,14 +101,10 @@ const hubRuntimeMocks = vi.hoisted(() => ({
 }));
 const telemetryMocks = vi.hoisted(() => ({
 	captureCliExtensionActivated: vi.fn(),
-	identifyTelemetryAccount: vi.fn(),
+	identifyCliTelemetryAccount: vi.fn(),
 	getCliTelemetryService: vi.fn(),
 	disposeCliTelemetryService: vi.fn(async () => {}),
 }));
-const featureFlagMocks = vi.hoisted(() => ({
-	getBooleanFlagEnabled: vi.fn(() => false),
-	setCliFeatureFlagsAccountContext: vi.fn(),
-}));
 
 function forcePromptModeInput() {
 	Object.defineProperty(process.stdin, "isTTY", {
@@ -159,8 +148,8 @@ vi.mock("@cline/core", () => {
 			stop: vi.fn(),
 		})),
 		ProviderSettingsManager: class {
-			getLastUsedProviderSettings(options?: unknown) {
-				return providerSettingsMocks.getLastUsedProviderSettings(options);
+			getLastUsedProviderSettings() {
+				return providerSettingsMocks.getLastUsedProviderSettings();
 			}
 			getProviderSettings(providerId: string) {
 				return providerSettingsMocks.getProviderSettings(providerId);
@@ -175,14 +164,6 @@ vi.mock("@cline/core", () => {
 	};
 });
 vi.mock("./utils/provider-auth", () => authMocks);
-vi.mock("./utils/feature-flags", () => ({
-	getCliFeatureFlagsService: () => ({
-		getBooleanFlagEnabled: featureFlagMocks.getBooleanFlagEnabled,
-	}),
-	refreshCliFeatureFlagsInBackground: vi.fn(),
-	setCliFeatureFlagsAccountContext:
-		featureFlagMocks.setCliFeatureFlagsAccountContext,
-}));
 vi.mock("./runtime/prompt", () => ({
 	resolveSystemPrompt: promptMocks.resolveSystemPrompt,
 }));
@@ -191,7 +172,6 @@ vi.mock("./commands/dashboard", () => dashboardMocks);
 vi.mock("./kanban-migration/notice", () => migrationNoticeMocks);
 vi.mock("./commands/update", () => updateMocks);
 vi.mock("./commands/history", () => historyMocks);
-vi.mock("./utils/history-resume", () => historyResumeMocks);
 vi.mock("./logging/adapter", () => loggingMocks);
 vi.mock("./utils/hub-runtime", () => hubRuntimeMocks);
 vi.mock("./utils/telemetry", () => telemetryMocks);
@@ -211,8 +191,6 @@ describe("runCli lightweight command dispatch", () => {
 		historyMocks.runHistoryExport.mockResolvedValue(0);
 		historyMocks.runHistoryUpdate.mockReset();
 		historyMocks.runHistoryUpdate.mockResolvedValue(0);
-		historyResumeMocks.spawnHistoryResume.mockReset();
-		historyResumeMocks.spawnHistoryResume.mockResolvedValue(undefined);
 		sessionMocks.getSessionRow.mockReset();
 		sessionMocks.getSessionRow.mockResolvedValue({
 			sessionId: "sess_123",
@@ -255,9 +233,6 @@ describe("runCli lightweight command dispatch", () => {
 		providerSettingsMocks.getProviderSettings.mockReset();
 		providerSettingsMocks.getProviderSettings.mockReturnValue(undefined);
 		providerSettingsMocks.saveProviderSettings.mockReset();
-		featureFlagMocks.getBooleanFlagEnabled.mockReset();
-		featureFlagMocks.getBooleanFlagEnabled.mockReturnValue(false);
-		featureFlagMocks.setCliFeatureFlagsAccountContext.mockReset();
 		kanbanMocks.launchKanban.mockReset();
 		kanbanMocks.launchKanban.mockResolvedValue(0);
 		dashboardMocks.runDashboardCommand.mockReset();
@@ -271,7 +246,7 @@ describe("runCli lightweight command dispatch", () => {
 		updateMocks.getPreferredKanbanInstaller.mockReset();
 		updateMocks.getPreferredKanbanInstaller.mockReturnValue(undefined);
 		telemetryMocks.captureCliExtensionActivated.mockReset();
-		telemetryMocks.identifyTelemetryAccount.mockReset();
+		telemetryMocks.identifyCliTelemetryAccount.mockReset();
 		telemetryMocks.getCliTelemetryService.mockReset();
 		telemetryMocks.disposeCliTelemetryService.mockReset();
 		telemetryMocks.disposeCliTelemetryService.mockResolvedValue(undefined);
@@ -417,61 +392,6 @@ describe("runCli lightweight command dispatch", () => {
 		expect(mockState.runInteractiveImports).toBe(0);
 	});
 
-	it("rejects multiple bare positional prompt tokens", async () => {
-		const consoleError = vi
-			.spyOn(console, "error")
-			.mockImplementation(() => undefined);
-		forcePromptModeInput();
-		process.argv = ["bun", "src/index.ts", "hello", "world"];
-
-		const { runCli } = await import("./main");
-
-		await expect(runCli()).resolves.toBeUndefined();
-		expect(process.exitCode).toBe(1);
-		expect(consoleError).toHaveBeenCalledWith(
-			expect.stringContaining(
-				"Unknown command or extra arguments: hello world",
-			),
-		);
-		expect(runtimeMocks.runAgent).not.toHaveBeenCalled();
-		expect(mockState.runAgentImports).toBe(0);
-		expect(mockState.runInteractiveImports).toBe(0);
-	});
-
-	it("runs quoted positional prompt text", async () => {
-		forcePromptModeInput();
-		process.argv = ["bun", "src/index.ts", "hello world"];
-
-		const { runCli } = await import("./main");
-
-		await expect(runCli()).resolves.toBeUndefined();
-		expect(runtimeMocks.runAgent).toHaveBeenCalledTimes(1);
-		expect(runtimeMocks.runAgent).toHaveBeenCalledWith(
-			"hello world",
-			expect.any(Object),
-			expect.anything(),
-		);
-	});
-
-	it("rejects unknown root flags before loading runtime modules", async () => {
-		const consoleError = vi
-			.spyOn(console, "error")
-			.mockImplementation(() => undefined);
-		forcePromptModeInput();
-		process.argv = ["bun", "src/index.ts", "--made-up-flag"];
-
-		const { runCli } = await import("./main");
-
-		await expect(runCli()).resolves.toBeUndefined();
-		expect(process.exitCode).toBe(1);
-		expect(consoleError).toHaveBeenCalledWith(
-			expect.stringContaining("unknown option '--made-up-flag'"),
-		);
-		expect(runtimeMocks.runAgent).not.toHaveBeenCalled();
-		expect(mockState.runAgentImports).toBe(0);
-		expect(mockState.runInteractiveImports).toBe(0);
-	});
-
 	it("creates a worktree and runs prompt sessions from it", async () => {
 		forcePromptModeInput();
 		process.argv = ["bun", "src/index.ts", "--worktree", "hello"];
@@ -799,47 +719,10 @@ describe("runCli lightweight command dispatch", () => {
 		);
 	});
 
-	it("resumes a history-picked session in a child process", async () => {
+	it("forces chat view when resuming from history picker", async () => {
 		historyMocks.runHistoryList.mockImplementationOnce(
 			async () => "sess_from_history",
 		);
-		historyResumeMocks.spawnHistoryResume.mockResolvedValueOnce(0);
-		process.argv = ["bun", "src/index.ts", "history"];
-
-		const { runCli } = await import("./main");
-
-		await expect(runCli()).resolves.toBeUndefined();
-		expect(historyResumeMocks.spawnHistoryResume).toHaveBeenCalledTimes(1);
-		expect(historyResumeMocks.spawnHistoryResume).toHaveBeenCalledWith(
-			expect.objectContaining({
-				sessionId: "sess_from_history",
-				normalizedArgs: ["history"],
-				remainingArgs: ["history"],
-			}),
-		);
-		expect(runtimeMocks.runInteractive).not.toHaveBeenCalled();
-		expect(process.exitCode).toBe(0);
-	});
-
-	it("propagates the child exit code when resuming from history picker", async () => {
-		historyMocks.runHistoryList.mockImplementationOnce(
-			async () => "sess_from_history",
-		);
-		historyResumeMocks.spawnHistoryResume.mockResolvedValueOnce(3);
-		process.argv = ["bun", "src/index.ts", "history"];
-
-		const { runCli } = await import("./main");
-
-		await expect(runCli()).resolves.toBeUndefined();
-		expect(process.exitCode).toBe(3);
-		expect(runtimeMocks.runInteractive).not.toHaveBeenCalled();
-	});
-
-	it("forces chat view when the history-picker child cannot launch", async () => {
-		historyMocks.runHistoryList.mockImplementationOnce(
-			async () => "sess_from_history",
-		);
-		historyResumeMocks.spawnHistoryResume.mockResolvedValueOnce(undefined);
 		process.argv = ["bun", "src/index.ts", "history"];
 
 		const { runCli } = await import("./main");
@@ -918,33 +801,6 @@ describe("runCli lightweight command dispatch", () => {
 		);
 	});
 
-	it("seeds feature flag identity from persisted Cline account id before checking flags", async () => {
-		const clineSettings = {
-			provider: "cline",
-			model: "anthropic/claude-sonnet-4.6",
-			auth: {
-				accountId: "acct-startup",
-				accessToken: "workos:token",
-				refreshToken: "refresh-token",
-			},
-		};
-		providerSettingsMocks.getProviderSettings.mockReturnValue(clineSettings);
-		process.argv = ["bun", "src/index.ts"];
-
-		const { runCli } = await import("./main");
-
-		await expect(runCli()).resolves.toBeUndefined();
-		expect(
-			featureFlagMocks.setCliFeatureFlagsAccountContext,
-		).toHaveBeenCalledWith({ id: "acct-startup" });
-		expect(
-			featureFlagMocks.setCliFeatureFlagsAccountContext.mock
-				.invocationCallOrder[0],
-		).toBeLessThan(
-			featureFlagMocks.getBooleanFlagEnabled.mock.invocationCallOrder[0],
-		);
-	});
-
 	it("runs kanban before loading runtime modules", async () => {
 		process.argv = ["bun", "src/index.ts", "kanban"];
 
@@ -962,10 +818,6 @@ describe("runCli lightweight command dispatch", () => {
 			"bun",
 			"src/index.ts",
 			"dashboard",
-			"--config",
-			"/tmp/cline-config",
-			"--data-dir",
-			".cline-dashboard-data",
 			"--port",
 			"9090",
 			"--no-open",
@@ -976,8 +828,6 @@ describe("runCli lightweight command dispatch", () => {
 		await expect(runCli()).resolves.toBeUndefined();
 		expect(dashboardMocks.runDashboardCommand).toHaveBeenCalledWith(
 			expect.objectContaining({
-				configDir: "/tmp/cline-config",
-				dataDir: ".cline-dashboard-data",
 				port: "9090",
 				openBrowser: false,
 				io: expect.any(Object),
@@ -1026,7 +876,7 @@ describe("runCli lightweight command dispatch", () => {
 		runtimeMocks.runAgent.mockClear();
 
 		forcePromptModeInput();
-		process.argv = ["bun", "src/index.ts", "/team find the bug"];
+		process.argv = ["bun", "src/index.ts", "/team", "find", "the", "bug"];
 
 		const { runCli } = await import("./main");
 

apps/cli/src/main.ts

@@ -19,11 +19,6 @@ import {
 	buildCliCompactionConfig,
 	CLI_COMPACTION_MODE_EXPECTED_TEXT,
 } from "./utils/compaction-mode";
-import {
-	getCliFeatureFlagsService,
-	refreshCliFeatureFlagsInBackground,
-	setCliFeatureFlagsAccountContext,
-} from "./utils/feature-flags";
 import {
 	configureSandboxEnvironment,
 	normalizeAutoApproveArgs,
@@ -140,7 +135,7 @@ export async function runCli(): Promise<void> {
 	// Re-enable built-in help/version output for the routing program
 	program.configureOutput({
 		writeOut: (str: string) => process.stdout.write(str),
-		writeErr: () => {},
+		writeErr: (str: string) => process.stderr.write(str),
 	});
 	// Default action handles non-subcommand args (e.g. prompt text)
 	program.action(() => {});
@@ -157,7 +152,6 @@ export async function runCli(): Promise<void> {
 		.option("-k, --apikey <key>", "API key")
 		.option("-m, --modelid <id>", "Model ID")
 		.option("-b, --baseurl <url>", "Base URL")
-		.option("--azure-api-version <version>", "Azure API version")
 		.option("--config <dir>", "configuration directory")
 		.option("-c, --cwd <path>", "Working directory")
 		.option(
@@ -171,7 +165,6 @@ export async function runCli(): Promise<void> {
 				apikey?: string;
 				modelid?: string;
 				baseurl?: string;
-				azureApiVersion?: string;
 				config?: string;
 				cwd?: string;
 				dataDir?: string;
@@ -202,7 +195,6 @@ export async function runCli(): Promise<void> {
 				apikey: opts.apikey,
 				modelid: opts.modelid,
 				baseurl: opts.baseurl,
-				azureApiVersion: opts.azureApiVersion,
 				io,
 			});
 		});
@@ -292,52 +284,6 @@ export async function runCli(): Promise<void> {
 				io,
 			});
 		});
-	const pluginUninstallCmd = pluginCmd
-		.command("uninstall")
-		.alias("remove")
-		.alias("rm")
-		.description("Uninstall a Cline Plugin by name or path")
-		.argument("<name>", "plugin package name, installed slug, or plugin path")
-		.option("--json", "Output as JSON")
-		.option(
-			"--cwd <path>",
-			"Search <path>/.cline/plugins before global plugins",
-		)
-		.action(async (name: string) => {
-			const opts = pluginUninstallCmd.opts<{
-				json?: boolean;
-				cwd?: string;
-			}>();
-			const { runPluginUninstallCommand } = await import("./commands/plugin");
-			ctx.exitCode = await runPluginUninstallCommand({
-				name,
-				cwd: opts.cwd,
-				json: opts.json === true || program.opts().json === true,
-				io,
-			});
-		});
-	const skillCmd = program
-		.command("skill")
-		.description("Manage Cline Skills via the open skills CLI (npx skills)")
-		.allowUnknownOption()
-		.passThroughOptions()
-		.argument("[args...]", "arguments forwarded to the skills CLI")
-		.addHelpText(
-			"after",
-			"\nForwards to the open skills CLI via npx. Examples:\n" +
-				"  cline skill add <owner/repo>       Add a skill into Cline\n" +
-				"  cline skill install <owner/repo>   Alias for add\n" +
-				"  cline skill list                   List installed skills\n" +
-				"  cline skill remove                 Remove installed skills\n" +
-				"  cline skill uninstall              Alias for remove\n" +
-				"\nadd/install and remove/uninstall default to '--agent cline' unless you pass your own --agent.\n" +
-				"Run 'npx skills --help' for the full command reference.",
-		)
-		.action(async () => {
-			const { runSkillCommand } = await import("./commands/skill");
-			ctx.exitCode = await runSkillCommand(skillCmd.args, io);
-		});
-
 	const connectCmd = program
 		.command("connect")
 		.description("Connect to an external channel")
@@ -379,7 +325,7 @@ export async function runCli(): Promise<void> {
 			}
 		});
 
-	const mcpCmd = program
+	program
 		.command("mcp")
 		.description("Manage MCP servers")
 		.action(async () => {
@@ -391,31 +337,6 @@ export async function runCli(): Promise<void> {
 				);
 			}
 		});
-	const mcpInstallCmd = mcpCmd
-		.command("install")
-		.alias("add")
-		.description("Open the MCP add wizard with server fields prefilled")
-		.argument("<name>", "MCP server name")
-		.argument(
-			"[targetArgs...]",
-			"URL for remote transports, or command and args after -- for stdio",
-		)
-		.option(
-			"--transport <transport>",
-			"stdio, sse, http, streamable-http, or streamableHttp (default: stdio)",
-		)
-		.action(async (name: string, targetArgs: string[]) => {
-			const opts = mcpInstallCmd.opts<{
-				transport?: string;
-			}>();
-			const { runMcpInstallCommand } = await import("./commands/mcp");
-			ctx.exitCode = await runMcpInstallCommand({
-				name,
-				targetArgs,
-				transport: opts.transport,
-				io,
-			});
-		});
 
 	const createDoctorRuntimeCommand = async () => {
 		const { createDoctorCommand } = await import("./commands/doctor");
@@ -596,12 +517,7 @@ export async function runCli(): Promise<void> {
 	const dashboardCmd = program
 		.command("dashboard")
 		.description("Start the Cline Hub dashboard and open it in a browser")
-		.option("--config <dir>", "configuration directory")
 		.option("-c, --cwd <path>", "Workspace root", process.cwd())
-		.option(
-			"--data-dir <dir>",
-			"Use isolated local state at <dir> instead of ~/.cline (enables sandbox mode)",
-		)
 		.option("--host <host>", "Dashboard bind host")
 		.option("--port <port>", "Dashboard HTTP/WebSocket port")
 		.option("--public-url <url>", "Public dashboard URL")
@@ -609,9 +525,7 @@ export async function runCli(): Promise<void> {
 		.option("--no-open", "Start the dashboard without opening a browser")
 		.action(async () => {
 			const opts = dashboardCmd.opts<{
-				config?: string;
 				cwd?: string;
-				dataDir?: string;
 				host?: string;
 				port?: string;
 				publicUrl?: string;
@@ -620,9 +534,7 @@ export async function runCli(): Promise<void> {
 			}>();
 			const { runDashboardCommand } = await import("./commands/dashboard");
 			ctx.exitCode = await runDashboardCommand({
-				configDir: opts.config,
 				cwd: opts.cwd,
-				dataDir: opts.dataDir,
 				host: opts.host,
 				port: opts.port,
 				publicUrl: opts.publicUrl,
@@ -671,7 +583,6 @@ export async function runCli(): Promise<void> {
 		if (err instanceof CommanderError) {
 			if (err.exitCode !== 0) {
 				writeErr(err.message);
-				process.exitCode = err.exitCode;
 				return;
 			}
 			return;
@@ -722,31 +633,9 @@ export async function runCli(): Promise<void> {
 
 	// Default flow: no subcommand matched, or fall-through from config/history.
 	let args = commanderToParsedArgs(program);
-	if (program.args.length > 1) {
-		writeErr(
-			`Unknown command or extra arguments: ${program.args.join(" ")}\nPrompt text with spaces must be quoted as a single argument, for example: cline "fix the tests". Use "cline --help" to see available commands and flags.`,
-		);
-		process.exitCode = 1;
-		return;
-	}
 
 	let resumeSessionId: string | undefined = ctx.resumeSessionId;
 	if (resumeSessionId) {
-		// The history picker already created (and tore down) an OpenTUI renderer
-		// in this process; starting the interactive TUI here would create a
-		// second one, which can crash natively during teardown. Resume in a
-		// fresh `cline --id <session-id>` child process instead.
-		const { spawnHistoryResume } = await import("./utils/history-resume");
-		const childExitCode = await spawnHistoryResume({
-			sessionId: resumeSessionId,
-			normalizedArgs,
-			remainingArgs: program.args,
-			configDir,
-		});
-		if (childExitCode !== undefined) {
-			process.exitCode = childExitCode;
-			return;
-		}
 		args = {
 			...args,
 			interactive: true,
@@ -920,18 +809,8 @@ export async function runCli(): Promise<void> {
 	};
 	registerDisposable(stopUserInstructionService);
 	try {
-		const persistedClineAccountId = providerSettingsManager
-			.getProviderSettings("cline")
-			?.auth?.accountId?.trim();
-		if (persistedClineAccountId) {
-			setCliFeatureFlagsAccountContext({ id: persistedClineAccountId });
-		}
-		refreshCliFeatureFlagsInBackground();
 		const lastUsedProviderSettings =
-			providerSettingsManager.getLastUsedProviderSettings({
-				isClinePassEnabled:
-					getCliFeatureFlagsService().getBooleanFlagEnabled("ext-cline-pass"),
-			});
+			providerSettingsManager.getLastUsedProviderSettings();
 		const provider = normalizeProviderId(
 			args.provider?.trim() || lastUsedProviderSettings?.provider || "cline",
 		);

apps/cli/src/runtime/interactive/approvals.test.ts

@@ -61,20 +61,6 @@ describe("createInteractiveApprovalController", () => {
 		).resolves.toEqual({ approved: false, reason: "no" });
 	});
 
-	it("approves stale required-approval requests after auto-approve is enabled", async () => {
-		const controller = createInteractiveApprovalController(makeConfig(false));
-		controller.tuiToolApprover.current = async () => ({
-			approved: false,
-			reason: "stale prompt",
-		});
-
-		controller.setInteractiveAutoApprove(true);
-
-		await expect(
-			controller.requestToolApproval(makeRequest({ autoApprove: false })),
-		).resolves.toEqual({ approved: true });
-	});
-
 	it("denies approval-required requests when no TUI approver is available", async () => {
 		const controller = createInteractiveApprovalController(makeConfig(false));
 
@@ -91,7 +77,6 @@ describe("createInteractiveApprovalController", () => {
 
 		expect(controller.autoApproveAllRef.current).toBe(true);
 		expect(config.defaultToolAutoApprove).toBe(false);
-		expect(config.toolPolicies["*"]?.autoApprove).toBe(true);
-		expect(controller.resolveToolPolicy("run_commands").autoApprove).toBe(true);
+		expect(config.toolPolicies["*"]?.autoApprove).toBe(false);
 	});
 });

apps/cli/src/runtime/interactive/approvals.ts

@@ -3,7 +3,6 @@ import type { Config } from "../../utils/types";
 import {
 	applyInteractiveAutoApproveOverride,
 	cloneToolPolicies,
-	resolveInteractiveAutoApprovePolicy,
 } from "../tool-policies";
 
 export interface InteractiveRuntimeRefs {
@@ -39,10 +38,10 @@ export function createInteractiveApprovalController(config: Config) {
 	const requestToolApproval = async (
 		request: ToolApprovalRequest,
 	): Promise<ToolApprovalResult> => {
-		if (autoApproveAllRef.current) {
+		if (request.policy?.autoApprove === true) {
 			return { approved: true };
 		}
-		if (request.policy?.autoApprove === true) {
+		if (autoApproveAllRef.current && request.policy?.autoApprove !== false) {
 			return { approved: true };
 		}
 		if (refs.tuiToolApprover.current) {
@@ -55,12 +54,6 @@ export function createInteractiveApprovalController(config: Config) {
 		autoApproveAllRef,
 		setInteractiveAutoApprove,
 		requestToolApproval,
-		resolveToolPolicy: (toolName: string) =>
-			resolveInteractiveAutoApprovePolicy({
-				toolName,
-				baselinePolicies: baselineToolPolicies,
-				enabled: autoApproveAllRef.current,
-			}),
 		...refs,
 	};
 }