keeps union validation

Handle cases where the `commands` field is passed as a JSON-encoded
string array instead of a native array. Refactor input handling in
`createBashTool` and `createWindowsShellTool` to support both string
and structured command inputs, and update `coalesceSplitHeredocCommands`
to skip non-string entries. Removes the `RunCommandsInputUnionSchema`
in favor of direct validation.

apps/cli/CHANGELOG.md

@@ -1,5 +1,48 @@
 # Cline CLI Changelog
 
+## 3.0.29
+
+- Costs are now hidden for Cline free models
+- Fixed Z.ai model metadata resolution for Z.ai models accessed through the Cline provider
+- Reverted the model-name-only display change from v3.0.28; the model picker, selector, and status bar return to their previous display behavior
+
+## 3.0.28
+
+- Added a ClinePass onboarding flow with selectable ClinePass models, plus improved ClinePass error handling
+- Added hub primitive catalogs and refreshed the hub dashboard design with a dedicated customizations breakout
+- Auto-approve toggles now apply immediately when changed
+- Feature flags now resolve using your user ID on startup
+- Fixed Cline model display names so they resolve by model name
+- Truncate large tool results by default (including MCP and custom tool output) to keep requests within context budget
+- Hardened parallel tool-call guidance for faster, more reliable multi-tool execution
+
+## 3.0.27
+
+- Added a `cline skill` command to install and manage skills, matching `cline plugin install` and `cline mcp` (installs default to the Cline agent directory)
+- Added a prefilled MCP install wizard command for quicker MCP server setup
+- Improved error handling and messaging when plugin MCP OAuth authorization fails
+- The CLI now rejects unknown commands and unquoted multi-word input with a clear error instead of silently treating bad arguments as a prompt
+
+## 3.0.26
+
+- Reverted the expandable model picker sections and ClinePass models, restoring the previous model-selection UI
+
+## 3.0.25
+
+- Added ClinePass support, with selectable ClinePass models in the model picker
+- Made model picker sections expandable
+- Added MCP server support to plugins, including authorizing plugin MCP OAuth during install
+- Encouraged parallel tool calls for faster task execution
+- Capped tool output for bash commands and file reads to keep large output within context limits
+- Allowed ranged reads on large files
+- Fixed apply_patch to fail when a hunk is skipped
+- Fixed run_commands to return captured stdout on failure and handle split heredocs
+- Fixed search tools to treat zero results as success
+- Fixed disabled-reasoning handling for StepFun flash
+- Fixed history resume rendering isolation
+- Fixed the Hugging Face URL
+- Fixed Cline OAuth token formatting in provider config
+
 ## 3.0.24
 
 - Plugin commands can now submit prompts to the agent

apps/cli/README.md

@@ -163,6 +163,30 @@ cline auth --provider anthropic --apikey sk-... --modelid claude-sonnet-4-6
 cline auth --provider openai-native --apikey sk-... --modelid gpt-5 --baseurl https://api.example.com/v1
 ```
 
+### MCP servers
+
+Manage MCP servers with the interactive wizard:
+
+```sh
+cline mcp
+cline config mcp
+```
+
+Open the add-server wizard with the name, transport, and command or URL already filled in with `cline mcp install` (`cline mcp add` also works). Stdio servers use everything after `--` as the command and arguments:
+
+```sh
+cline mcp install fs -- npx -y @modelcontextprotocol/server-filesystem /tmp
+```
+
+Remote HTTP and SSE servers take a name, transport, and URL. The wizard still asks for auth details before saving:
+
+```sh
+cline mcp install ctx7 --transport http https://mcp.context7.com/mcp
+cline mcp install events --transport sse https://example.com/sse
+```
+
+Because this command opens the wizard, it requires a TTY.
+
 ### Connectors
 
 Bridge a chat surface into RPC-backed Cline sessions. Each conversation thread maps to a session with full context. Supported platforms: Telegram, Slack, Google Chat, WhatsApp, and Linear.

apps/cli/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "@cline/cli",
 	"displayName": "cline",
-	"version": "3.0.24",
+	"version": "3.0.29",
 	"description": "Autonomous coding agent CLI - capable of creating/editing files, running commands, using the browser, and more",
 	"type": "module",
 	"publishConfig": {

apps/cli/src/cli.e2e.test.ts

@@ -746,6 +746,27 @@ Break work into clear steps.`,
 		).toBe(true);
 	});
 
+	it("routes mcp install and requires a TTY for the prefilled wizard", () => {
+		const result = runCli(
+			[
+				"mcp",
+				"install",
+				"fs",
+				"--",
+				"npx",
+				"-y",
+				"@modelcontextprotocol/server-filesystem",
+				"/tmp",
+			],
+			{ env: createIsolatedEnv() },
+		);
+
+		expect(result.status).toBe(1);
+		expect(asText(result.stderr)).toContain(
+			"cline mcp install opens the MCP wizard and requires a TTY.",
+		);
+	});
+
 	it("lists available tools", () => {
 		const homeDir = mkdtempSync(path.join(os.tmpdir(), "cli-e2e-home-"));
 		const dataDir = mkdtempSync(path.join(os.tmpdir(), "cli-e2e-data-"));

apps/cli/src/cli.interactive.e2e.test.ts

@@ -18,6 +18,8 @@ interface KeyStep {
 const INITIAL_RENDER_DELAY_SECONDS = 2.5;
 const POST_ACTION_SETTLE_SECONDS = 1.0;
 const INTERACTIVE_TEST_TIMEOUT_MS = 40_000;
+const HISTORY_PICKER_READY_DELAY_SECONDS = 8.0;
+const HISTORY_RESUME_READY_DELAY_SECONDS = 15.0;
 
 function normalizeTerminalOutput(output: string): string {
 	// biome-ignore lint/suspicious/noControlCharactersInRegex: this regex intentionally strips ANSI escape sequences
@@ -51,16 +53,40 @@ function buildScriptCommand(scriptedInput: string, launchArgs: string): string {
 	return `(${scriptedInput}) | script ${quietFlag} /dev/null ${toShellSingleQuotedLiteral(bunExec)} ${launchArgs}`;
 }
 
-function runInteractiveCli(
-	steps: KeyStep[],
-	options?: { launchConfigView?: boolean },
-): CliResult {
+function createCliEnv(): NodeJS.ProcessEnv {
 	const homeDir = mkdtempSync(path.join(os.tmpdir(), "cli-int-home-"));
 	const dataDir = mkdtempSync(path.join(os.tmpdir(), "cli-int-data-"));
 	const sessionDir = mkdtempSync(path.join(os.tmpdir(), "cli-int-sessions-"));
 	const teamDir = mkdtempSync(path.join(os.tmpdir(), "cli-int-teams-"));
 	tempDirs.push(homeDir, dataDir, sessionDir, teamDir);
 
+	return {
+		...process.env,
+		HOME: homeDir,
+		CLINE_DATA_DIR: dataDir,
+		CLINE_DB_DATA_DIR: path.join(dataDir, "db"),
+		CLINE_SESSION_DATA_DIR: sessionDir,
+		CLINE_TEAM_DATA_DIR: teamDir,
+		CLINE_SESSION_BACKEND_MODE: "local",
+		CLINE_PROVIDER_SETTINGS_PATH: path.join(
+			dataDir,
+			"settings",
+			"providers.json",
+		),
+		CLINE_HOOKS_LOG_PATH: path.join(dataDir, "logs", "hooks.jsonl"),
+	};
+}
+
+function runInteractiveCli(
+	steps: KeyStep[],
+	options?: {
+		launchConfigView?: boolean;
+		launchArgs?: string[];
+		env?: NodeJS.ProcessEnv;
+	},
+): CliResult {
+	const env = options?.env ?? createCliEnv();
+
 	const scriptedInput = [
 		...steps,
 		// Exit each interactive run explicitly so tests do not idle until timeout.
@@ -80,9 +106,13 @@ function runInteractiveCli(
 		"-k",
 		"test-key",
 	];
-	const launchArgs = [
-		...(options?.launchConfigView ? [...baseArgs, "config"] : baseArgs),
-	]
+	const launchArgs = (
+		options?.launchArgs
+			? [cliEntry, ...options.launchArgs]
+			: options?.launchConfigView
+				? [...baseArgs, "config"]
+				: baseArgs
+	)
 		.map((arg) => toShellSingleQuotedLiteral(arg))
 		.join(" ");
 	const command = buildScriptCommand(scriptedInput, launchArgs);
@@ -90,21 +120,7 @@ function runInteractiveCli(
 	return spawnSync("bash", ["-lc", command], {
 		cwd: cliRoot,
 		encoding: "utf8",
-		env: {
-			...process.env,
-			HOME: homeDir,
-			CLINE_DATA_DIR: dataDir,
-			CLINE_DB_DATA_DIR: path.join(dataDir, "db"),
-			CLINE_SESSION_DATA_DIR: sessionDir,
-			CLINE_TEAM_DATA_DIR: teamDir,
-			CLINE_SESSION_BACKEND_MODE: "local",
-			CLINE_PROVIDER_SETTINGS_PATH: path.join(
-				dataDir,
-				"settings",
-				"providers.json",
-			),
-			CLINE_HOOKS_LOG_PATH: path.join(dataDir, "logs", "hooks.jsonl"),
-		},
+		env,
 		timeout: INTERACTIVE_TEST_TIMEOUT_MS,
 		maxBuffer: 10 * 1024 * 1024,
 	});
@@ -188,6 +204,62 @@ describe("cli interactive e2e", () => {
 		expect(output).toContain("/ for commands · @ for files");
 	});
 
+	it("resumes a history-picked session and survives Ctrl+C without a native crash", {
+		timeout: 120_000,
+	}, () => {
+		const env = createCliEnv();
+		// Seed one session; the invalid key makes the run fail fast while
+		// still persisting a resumable session record.
+		const seed = spawnSync(
+			bunExec,
+			[
+				cliEntry,
+				"--provider",
+				"anthropic",
+				"-m",
+				"claude-sonnet-4-6",
+				"-k",
+				"test-key",
+				"hello",
+			],
+			{ cwd: cliRoot, encoding: "utf8", env, timeout: 60_000 },
+		);
+		expect(seed.error).toBeUndefined();
+		const history = spawnSync(bunExec, [cliEntry, "history", "--json"], {
+			cwd: cliRoot,
+			encoding: "utf8",
+			env,
+			timeout: 60_000,
+		});
+		expect(history.error).toBeUndefined();
+		expect(history.status).toBe(0);
+		const historyRows = JSON.parse(history.stdout) as unknown[];
+		expect(historyRows.length).toBeGreaterThan(0);
+
+		// history picker -> Enter resumes the seeded session in the
+		// interactive TUI -> double Ctrl+C exits it. Regression guard for
+		// the Bun "panic(main thread): Segmentation fault" that occurred
+		// when the resumed TUI shared the picker's process (a second
+		// OpenTUI renderer in one process crashes natively on teardown).
+		const result = runInteractiveCli(
+			[
+				// Select the seeded session in the picker.
+				{ delaySeconds: HISTORY_PICKER_READY_DELAY_SECONDS, input: "\r" },
+				// Give the resumed TUI time to start, then double-press
+				// Ctrl+C; the harness appends the final press 0.2s later.
+				{ delaySeconds: HISTORY_RESUME_READY_DELAY_SECONDS, input: "\u0003" },
+			],
+			{ launchArgs: ["history"], env },
+		);
+		const output = outputOf(result);
+		// The exit summary only prints after the resumed interactive TUI ran
+		// and shut down cleanly; the history picker alone never prints it.
+		expect(output).toContain("Session Summary");
+		expect(output).not.toContain("panic(");
+		expect(output).not.toContain("Segmentation fault");
+		expect(result.status).toBe(0);
+	});
+
 	it("launches config view directly with `cline config`", () => {
 		const result = runInteractiveCli(
 			[{ delaySeconds: INITIAL_RENDER_DELAY_SECONDS, input: "" }],

apps/cli/src/commands/dashboard.test.ts

@@ -6,6 +6,15 @@ import { runDashboardCommand, waitForProcessShutdown } from "./dashboard";
 
 const ENV_KEYS = [
 	"WORKSPACE_ROOT",
+	"CLINE_DIR",
+	"CLINE_SANDBOX",
+	"CLINE_SANDBOX_DATA_DIR",
+	"CLINE_DATA_DIR",
+	"CLINE_DB_DATA_DIR",
+	"CLINE_SESSION_DATA_DIR",
+	"CLINE_TEAM_DATA_DIR",
+	"CLINE_PROVIDER_SETTINGS_PATH",
+	"CLINE_HOOKS_LOG_PATH",
 	"HOST",
 	"CLINE_HUB_DASHBOARD_PORT",
 	"PUBLIC_URL",
@@ -38,6 +47,9 @@ describe("runDashboardCommand", () => {
 		let observedEnv:
 			| {
 					workspaceRoot: string | undefined;
+					clineDir: string | undefined;
+					clineDataDir: string | undefined;
+					providerSettingsPath: string | undefined;
 					host: string | undefined;
 					port: string | undefined;
 					publicUrl: string | undefined;
@@ -50,7 +62,9 @@ describe("runDashboardCommand", () => {
 		process.env.CLINE_HUB_WEBVIEW_DIST_DIR = webviewDistDir;
 
 		const exitCode = await runDashboardCommand({
+			configDir: "/tmp/cline-config",
 			cwd: "sdk",
+			dataDir: ".cline-dashboard-data",
 			host: "127.0.0.1",
 			port: "9090",
 			publicUrl: "http://127.0.0.1:9090",
@@ -62,6 +76,9 @@ describe("runDashboardCommand", () => {
 			startServer: async () => {
 				observedEnv = {
 					workspaceRoot: process.env.WORKSPACE_ROOT,
+					clineDir: process.env.CLINE_DIR,
+					clineDataDir: process.env.CLINE_DATA_DIR,
+					providerSettingsPath: process.env.CLINE_PROVIDER_SETTINGS_PATH,
 					host: process.env.HOST,
 					port: process.env.CLINE_HUB_DASHBOARD_PORT,
 					publicUrl: process.env.PUBLIC_URL,
@@ -87,6 +104,13 @@ describe("runDashboardCommand", () => {
 		expect(exitCode).toBe(0);
 		expect(observedEnv).toEqual({
 			workspaceRoot: resolve("sdk"),
+			clineDir: "/tmp/cline-config",
+			clineDataDir: resolve("sdk", ".cline-dashboard-data"),
+			providerSettingsPath: join(
+				resolve("sdk", ".cline-dashboard-data"),
+				"settings",
+				"providers.json",
+			),
 			host: "127.0.0.1",
 			port: "9090",
 			publicUrl: "http://127.0.0.1:9090",

apps/cli/src/commands/dashboard.ts

@@ -3,6 +3,7 @@ import { arch, platform } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import open from "open";
+import { configureSandboxEnvironment } from "../utils/helpers";
 import { c } from "../utils/output";
 
 export interface DashboardServerHandle {
@@ -19,7 +20,9 @@ interface DashboardCommandIo {
 }
 
 export interface RunDashboardCommandOptions {
+	configDir?: string;
 	cwd?: string;
+	dataDir?: string;
 	host?: string;
 	port?: string;
 	publicUrl?: string;
@@ -36,10 +39,9 @@ const WEBVIEW_DIST_ENV = "CLINE_HUB_WEBVIEW_DIST_DIR";
 
 function setEnvValue(name: string, value: string | undefined): () => void {
 	const previous = process.env[name];
-	if (value === undefined) {
-		return () => {};
+	if (value !== undefined) {
+		process.env[name] = value;
 	}
-	process.env[name] = value;
 	return () => {
 		if (previous === undefined) {
 			delete process.env[name];
@@ -49,21 +51,39 @@ function setEnvValue(name: string, value: string | undefined): () => void {
 	};
 }
 
+const SANDBOX_ENV_KEYS = [
+	"CLINE_SANDBOX",
+	"CLINE_SANDBOX_DATA_DIR",
+	"CLINE_DATA_DIR",
+	"CLINE_DB_DATA_DIR",
+	"CLINE_SESSION_DATA_DIR",
+	"CLINE_TEAM_DATA_DIR",
+	"CLINE_PROVIDER_SETTINGS_PATH",
+	"CLINE_HOOKS_LOG_PATH",
+] as const;
+
 async function withDashboardEnvironment<T>(
 	options: RunDashboardCommandOptions,
 	fn: () => Promise<T>,
 ): Promise<T> {
+	const cwd = options.cwd ? resolve(options.cwd) : process.cwd();
 	const restore = [
-		setEnvValue(
-			"WORKSPACE_ROOT",
-			options.cwd ? resolve(options.cwd) : undefined,
-		),
+		setEnvValue("WORKSPACE_ROOT", options.cwd ? cwd : undefined),
+		setEnvValue("CLINE_DIR", options.configDir?.trim() || undefined),
 		setEnvValue("HOST", options.host),
 		setEnvValue(DASHBOARD_PORT_ENV, options.port),
 		setEnvValue("PUBLIC_URL", options.publicUrl),
 		setEnvValue("ROOM_SECRET", options.roomSecret),
 		setEnvValue(WEBVIEW_DIST_ENV, resolveDefaultWebviewDistDir()),
+		...SANDBOX_ENV_KEYS.map((key) => setEnvValue(key, undefined)),
 	];
+	if (options.dataDir || process.env.CLINE_SANDBOX?.trim() === "1") {
+		configureSandboxEnvironment({
+			enabled: true,
+			cwd,
+			explicitDir: options.dataDir,
+		});
+	}
 	try {
 		return await fn();
 	} finally {

apps/cli/src/commands/mcp.test.ts

@@ -0,0 +1,145 @@
+import { describe, expect, it, vi } from "vitest";
+import { buildMcpInstallDefaults, runMcpInstallCommand } from "./mcp";
+
+describe("mcp install command", () => {
+	it("builds stdio wizard defaults from command args", () => {
+		expect(
+			buildMcpInstallDefaults({
+				name: "fs",
+				targetArgs: [
+					"npx",
+					"-y",
+					"@modelcontextprotocol/server-filesystem",
+					"/tmp/my dir",
+				],
+			}),
+		).toEqual({
+			name: "fs",
+			type: "stdio",
+			command: 'npx -y @modelcontextprotocol/server-filesystem "/tmp/my dir"',
+		});
+	});
+
+	it("builds remote wizard defaults and normalizes http transport", () => {
+		expect(
+			buildMcpInstallDefaults({
+				name: "ctx7",
+				transport: "http",
+				targetArgs: ["https://mcp.context7.com/mcp"],
+			}),
+		).toEqual({
+			name: "ctx7",
+			type: "streamableHttp",
+			url: "https://mcp.context7.com/mcp",
+		});
+	});
+
+	it("normalizes streamable-http transport", () => {
+		expect(
+			buildMcpInstallDefaults({
+				name: "docs",
+				transport: "streamable-http",
+				targetArgs: ["https://example.com/mcp"],
+			}),
+		).toEqual({
+			name: "docs",
+			type: "streamableHttp",
+			url: "https://example.com/mcp",
+		});
+	});
+
+	it("builds SSE wizard defaults", () => {
+		expect(
+			buildMcpInstallDefaults({
+				name: "events",
+				transport: "sse",
+				targetArgs: ["https://example.com/sse"],
+			}),
+		).toEqual({
+			name: "events",
+			type: "sse",
+			url: "https://example.com/sse",
+		});
+	});
+
+	it("rejects missing stdio command and invalid remote URL", () => {
+		expect(() =>
+			buildMcpInstallDefaults({
+				name: "fs",
+			}),
+		).toThrow(/requires a command/);
+
+		expect(() =>
+			buildMcpInstallDefaults({
+				name: "bad",
+				transport: "http",
+				targetArgs: ["not-a-url"],
+			}),
+		).toThrow(/Invalid MCP server URL/);
+	});
+
+	it("rejects remote URL schemes other than http and https", () => {
+		expect(() =>
+			buildMcpInstallDefaults({
+				name: "bad",
+				transport: "http",
+				targetArgs: ["file:///etc/passwd"],
+			}),
+		).toThrow(/only http and https are supported/);
+	});
+
+	it("opens the add wizard with prefilled defaults", async () => {
+		const runWizard = vi.fn(async () => 0);
+
+		const code = await runMcpInstallCommand({
+			name: "ctx7",
+			transport: "http",
+			targetArgs: ["https://mcp.context7.com/mcp"],
+			isTty: true,
+			runWizard,
+			io: { writeErr: vi.fn() },
+		});
+
+		expect(code).toBe(0);
+		expect(runWizard).toHaveBeenCalledWith({
+			name: "ctx7",
+			type: "streamableHttp",
+			url: "https://mcp.context7.com/mcp",
+		});
+	});
+
+	it("requires a TTY because it opens the wizard", async () => {
+		const writeErr = vi.fn();
+		const runWizard = vi.fn(async () => 0);
+
+		const code = await runMcpInstallCommand({
+			name: "ctx7",
+			transport: "http",
+			targetArgs: ["https://mcp.context7.com/mcp"],
+			isTty: false,
+			runWizard,
+			io: { writeErr },
+		});
+
+		expect(code).toBe(1);
+		expect(runWizard).not.toHaveBeenCalled();
+		expect(writeErr).toHaveBeenCalledWith(
+			"cline mcp install opens the MCP wizard and requires a TTY.",
+		);
+	});
+
+	it("checks for TTY before validating install arguments", async () => {
+		const writeErr = vi.fn();
+
+		const code = await runMcpInstallCommand({
+			name: "fs",
+			isTty: false,
+			io: { writeErr },
+		});
+
+		expect(code).toBe(1);
+		expect(writeErr).toHaveBeenCalledWith(
+			"cline mcp install opens the MCP wizard and requires a TTY.",
+		);
+	});
+});

apps/cli/src/commands/mcp.ts

@@ -0,0 +1,121 @@
+import type { McpAddDefaults } from "../wizards/mcp";
+
+export interface McpCommandIo {
+	writeErr: (text: string) => void;
+}
+
+export interface McpInstallOptions {
+	name: string;
+	targetArgs?: string[];
+	transport?: string;
+	io?: McpCommandIo;
+	isTty?: boolean;
+	runWizard?: (defaults: McpAddDefaults) => Promise<number>;
+}
+
+function normalizeTransportType(
+	value: string | undefined,
+): McpAddDefaults["type"] {
+	const normalized = (value ?? "stdio").trim();
+	if (normalized === "http" || normalized === "streamable-http") {
+		return "streamableHttp";
+	}
+	if (
+		normalized === "stdio" ||
+		normalized === "sse" ||
+		normalized === "streamableHttp"
+	) {
+		return normalized;
+	}
+	throw new Error(
+		`Unsupported MCP transport "${normalized}". Expected stdio, sse, http, streamable-http, or streamableHttp.`,
+	);
+}
+
+function assertValidUrl(url: string): void {
+	let parsed: URL;
+	try {
+		parsed = new URL(url);
+	} catch {
+		throw new Error(`Invalid MCP server URL: ${url}`);
+	}
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+		throw new Error(
+			`Invalid MCP server URL: ${url} (only http and https are supported)`,
+		);
+	}
+}
+
+function quoteCommandArg(arg: string): string {
+	if (/^[^\s"'\\]+$/.test(arg)) {
+		return arg;
+	}
+	return `"${arg.replace(/(["\\])/g, "\\$1")}"`;
+}
+
+export function buildMcpInstallDefaults(options: {
+	name: string;
+	targetArgs?: string[];
+	transport?: string;
+}): McpAddDefaults {
+	const name = options.name.trim();
+	if (!name) {
+		throw new Error("MCP server name is required");
+	}
+	const type = normalizeTransportType(options.transport);
+	const targetArgs = options.targetArgs ?? [];
+	if (type === "stdio") {
+		if (targetArgs.length === 0) {
+			throw new Error(
+				"Stdio MCP install requires a command after the server name, for example: cline mcp install fs -- npx -y @modelcontextprotocol/server-filesystem /tmp",
+			);
+		}
+		return {
+			name,
+			type,
+			command: targetArgs.map(quoteCommandArg).join(" "),
+		};
+	}
+
+	if (targetArgs.length !== 1) {
+		throw new Error(
+			"Remote MCP install requires exactly one URL argument after the server name.",
+		);
+	}
+	const url = targetArgs[0]?.trim() ?? "";
+	assertValidUrl(url);
+	return {
+		name,
+		type,
+		url,
+	};
+}
+
+async function runPrefilledWizard(defaults: McpAddDefaults): Promise<number> {
+	const { runMcpWizard } = await import("../wizards/mcp");
+	return runMcpWizard({
+		initialAction: "add",
+		addDefaults: defaults,
+		exitAfterInitialAction: true,
+	});
+}
+
+export async function runMcpInstallCommand(
+	options: McpInstallOptions,
+): Promise<number> {
+	try {
+		const isTty =
+			options.isTty ?? (process.stdin.isTTY && process.stdout.isTTY);
+		if (!isTty) {
+			throw new Error(
+				"cline mcp install opens the MCP wizard and requires a TTY.",
+			);
+		}
+		const defaults = buildMcpInstallDefaults(options);
+		return await (options.runWizard ?? runPrefilledWizard)(defaults);
+	} catch (error) {
+		const message = error instanceof Error ? error.message : String(error);
+		options.io?.writeErr(message);
+		return 1;
+	}
+}

apps/cli/src/commands/plugin.test.ts

@@ -17,6 +17,7 @@ import {
 } from "@cline/shared/storage";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import {
+	collectPluginMcpOAuthCandidates,
 	installPlugin,
 	isOfficialPluginSlug,
 	parsePluginSource,
@@ -35,6 +36,7 @@ describe("plugin install command", () => {
 	let originalHome: string | undefined;
 	let originalClineDir: string | undefined;
 	let originalClineDataDir: string | undefined;
+	let originalMcpSettingsPath: string | undefined;
 
 	beforeEach(() => {
 		root = mkdtempSync(join(tmpdir(), "cli-plugin-install-"));
@@ -43,6 +45,7 @@ describe("plugin install command", () => {
 		originalHome = process.env.HOME;
 		originalClineDir = process.env.CLINE_DIR;
 		originalClineDataDir = process.env.CLINE_DATA_DIR;
+		originalMcpSettingsPath = process.env.CLINE_MCP_SETTINGS_PATH;
 		process.env.HOME = home;
 		process.env.CLINE_DIR = join(home, ".cline");
 		process.env.CLINE_DATA_DIR = join(home, ".cline", "data");
@@ -91,6 +94,11 @@ describe("plugin install command", () => {
 		} else {
 			process.env.CLINE_DATA_DIR = originalClineDataDir;
 		}
+		if (originalMcpSettingsPath === undefined) {
+			delete process.env.CLINE_MCP_SETTINGS_PATH;
+		} else {
+			process.env.CLINE_MCP_SETTINGS_PATH = originalMcpSettingsPath;
+		}
 		rmSync(root, { recursive: true, force: true });
 	});
 
@@ -676,11 +684,341 @@ describe("plugin install command", () => {
 			expect(code).toBe(0);
 			const parsed = JSON.parse(stdout.join("")) as { installPath: string };
 			expect(parsed.installPath).toContain(join(home, ".cline", "plugins"));
+			expect("mcpOAuthCandidates" in parsed).toBe(false);
 		} finally {
 			process.stdout.write = originalWrite;
 		}
 	});
 
+	it("does not run MCP OAuth follow-up for JSON plugin installs", async () => {
+		process.env.CLINE_MCP_SETTINGS_PATH = join(root, "mcp-settings.json");
+		const source = join(root, "json-oauth-mcp-plugin.js");
+		writeFileSync(
+			source,
+			`
+export default {
+  name: "json-oauth-mcp-plugin",
+  manifest: { capabilities: ["mcp"] },
+  setup(api) {
+    api.registerMcpServer({
+      name: "json-oauth-docs",
+      transport: { type: "streamableHttp", url: "https://example.com/mcp" },
+    })
+  },
+}
+`,
+			"utf8",
+		);
+		const stdout: string[] = [];
+		const originalWrite = process.stdout.write;
+		const authorize = vi.fn();
+		process.stdout.write = ((chunk: string | Uint8Array) => {
+			stdout.push(String(chunk));
+			return true;
+		}) as typeof process.stdout.write;
+		try {
+			const code = await runPluginInstallCommand({
+				source,
+				json: true,
+				io: {
+					writeln: () => {},
+					writeErr: () => {},
+				},
+				mcpOAuth: {
+					interactive: true,
+					selectCandidates: async (candidates) => candidates,
+					authorize,
+				},
+			});
+			expect(code).toBe(0);
+			expect(authorize).not.toHaveBeenCalled();
+			const parsed = JSON.parse(stdout.join("")) as {
+				installPath: string;
+				mcpOAuthCandidates?: unknown;
+			};
+			expect(parsed.installPath).toContain(join(home, ".cline", "plugins"));
+			expect(parsed.mcpOAuthCandidates).toBeUndefined();
+		} finally {
+			process.stdout.write = originalWrite;
+		}
+	});
+
+	it("warns when plugin MCP settings sync fails after install", async () => {
+		const source = join(root, "mcp-plugin.js");
+		writeFileSync(
+			source,
+			`
+export default {
+  name: "mcp-plugin",
+  manifest: { capabilities: ["mcp"] },
+  setup(api) {
+    api.registerMcpServer({
+      name: "mcp-plugin",
+      transport: { type: "streamableHttp", url: "https://example.com/mcp" },
+    })
+  },
+}
+`,
+			"utf8",
+		);
+		const blockedDirectory = join(root, "not-a-directory");
+		writeFileSync(blockedDirectory, "file", "utf8");
+		const originalSettingsPath = process.env.CLINE_MCP_SETTINGS_PATH;
+		process.env.CLINE_MCP_SETTINGS_PATH = join(
+			blockedDirectory,
+			"cline_mcp_settings.json",
+		);
+		const output: string[] = [];
+		try {
+			const code = await runPluginInstallCommand({
+				source,
+				io: {
+					writeln: (text = "") => output.push(text),
+					writeErr: (text) => output.push(text),
+				},
+			});
+
+			expect(code).toBe(0);
+			expect(output.join("\n")).toContain("Installed plugin from");
+			expect(output.join("\n")).toContain(
+				"Warning: failed to sync plugin MCP servers",
+			);
+			expect(output.join("\n")).toContain("mcp-plugin");
+		} finally {
+			if (originalSettingsPath === undefined) {
+				delete process.env.CLINE_MCP_SETTINGS_PATH;
+			} else {
+				process.env.CLINE_MCP_SETTINGS_PATH = originalSettingsPath;
+			}
+		}
+	});
+
+	it("detects plugin-owned remote MCP servers as OAuth candidates", async () => {
+		process.env.CLINE_MCP_SETTINGS_PATH = join(root, "mcp-settings.json");
+		const source = join(root, "oauth-mcp-plugin.js");
+		writeFileSync(
+			source,
+			`
+export default {
+  name: "oauth-mcp-plugin",
+  manifest: { capabilities: ["mcp"] },
+  setup(api) {
+    api.registerMcpServer({
+      name: "oauth-docs",
+      transport: { type: "streamableHttp", url: "https://example.com/mcp" },
+    })
+  },
+}
+`,
+			"utf8",
+		);
+
+		const result = await installPlugin({ source });
+
+		expect(result.mcpOAuthCandidates).toEqual([
+			expect.objectContaining({
+				name: "oauth-docs",
+				pluginName: "oauth-mcp-plugin",
+				transportType: "streamableHttp",
+			}),
+		]);
+	});
+
+	it("does not treat remote MCP servers with static headers as OAuth candidates", async () => {
+		process.env.CLINE_MCP_SETTINGS_PATH = join(root, "mcp-settings.json");
+		const source = join(root, "headers-mcp-plugin.js");
+		writeFileSync(
+			source,
+			`
+export default {
+  name: "headers-mcp-plugin",
+  manifest: { capabilities: ["mcp"] },
+  setup(api) {
+    api.registerMcpServer({
+      name: "headers-docs",
+      transport: {
+        type: "streamableHttp",
+        url: "https://example.com/mcp",
+        headers: { Authorization: "Bearer token" },
+      },
+    })
+  },
+}
+`,
+			"utf8",
+		);
+
+		const result = await installPlugin({ source });
+
+		expect(result.mcpOAuthCandidates).toEqual([]);
+	});
+
+	it("skips plugin MCP OAuth candidates that already have tokens", async () => {
+		const settingsPath = join(root, "mcp-settings.json");
+		process.env.CLINE_MCP_SETTINGS_PATH = settingsPath;
+		const source = join(root, "authorized-mcp-plugin.js");
+		writeFileSync(
+			source,
+			`
+export default {
+  name: "authorized-mcp-plugin",
+  manifest: { capabilities: ["mcp"] },
+  setup(api) {
+    api.registerMcpServer({
+      name: "authorized-docs",
+      transport: { type: "streamableHttp", url: "https://example.com/mcp" },
+    })
+  },
+}
+`,
+			"utf8",
+		);
+		const result = await installPlugin({ source });
+		const settings = JSON.parse(readFileSync(settingsPath, "utf8")) as {
+			mcpServers?: Record<string, { oauth?: unknown }>;
+		};
+		const server = settings.mcpServers?.["authorized-docs"];
+		if (!server) {
+			throw new Error("Expected authorized-docs MCP server to be written");
+		}
+		server.oauth = { tokens: { access_token: "oauth-token" } };
+		writeFileSync(settingsPath, JSON.stringify(settings, null, 2), "utf8");
+
+		expect(
+			collectPluginMcpOAuthCandidates({
+				pluginPaths: result.entryPaths,
+				settingsPath,
+			}),
+		).toEqual([]);
+	});
+
+	it("authorizes selected plugin MCP OAuth candidates during interactive installs", async () => {
+		process.env.CLINE_MCP_SETTINGS_PATH = join(root, "mcp-settings.json");
+		const source = join(root, "interactive-mcp-plugin.js");
+		writeFileSync(
+			source,
+			`
+export default {
+  name: "interactive-mcp-plugin",
+  manifest: { capabilities: ["mcp"] },
+  setup(api) {
+    api.registerMcpServer({
+      name: "interactive-docs",
+      transport: { type: "streamableHttp", url: "https://example.com/mcp" },
+    })
+  },
+}
+`,
+			"utf8",
+		);
+		const authorized: string[] = [];
+		const output: string[] = [];
+
+		const code = await runPluginInstallCommand({
+			source,
+			io: {
+				writeln: (text = "") => output.push(text),
+				writeErr: (text) => output.push(text),
+			},
+			mcpOAuth: {
+				interactive: true,
+				selectCandidates: async (candidates) => candidates,
+				authorize: async (candidate) => {
+					authorized.push(candidate.name);
+				},
+			},
+		});
+
+		expect(code).toBe(0);
+		expect(authorized).toEqual(["interactive-docs"]);
+		expect(output.join("\n")).toContain("Installed plugin from");
+	});
+
+	it("keeps plugin install successful when MCP OAuth authorization fails", async () => {
+		process.env.CLINE_MCP_SETTINGS_PATH = join(root, "mcp-settings.json");
+		const source = join(root, "failing-oauth-mcp-plugin.js");
+		writeFileSync(
+			source,
+			`
+export default {
+  name: "failing-oauth-mcp-plugin",
+  manifest: { capabilities: ["mcp"] },
+  setup(api) {
+    api.registerMcpServer({
+      name: "failing-docs",
+      transport: { type: "streamableHttp", url: "https://example.com/mcp" },
+    })
+  },
+}
+`,
+			"utf8",
+		);
+		const output: string[] = [];
+
+		const code = await runPluginInstallCommand({
+			source,
+			io: {
+				writeln: (text = "") => output.push(text),
+				writeErr: (text) => output.push(text),
+			},
+			mcpOAuth: {
+				interactive: true,
+				selectCandidates: async (candidates) => candidates,
+				authorize: async () => {
+					throw new Error("oauth unavailable");
+				},
+			},
+		});
+
+		expect(code).toBe(0);
+		expect(output.join("\n")).toContain(
+			"Warning: failed to authorize MCP server failing-docs: oauth unavailable",
+		);
+	});
+
+	it("prints guidance for plugin MCP OAuth candidates in non-interactive installs", async () => {
+		process.env.CLINE_MCP_SETTINGS_PATH = join(root, "mcp-settings.json");
+		const source = join(root, "non-interactive-mcp-plugin.js");
+		writeFileSync(
+			source,
+			`
+export default {
+  name: "non-interactive-mcp-plugin",
+  manifest: { capabilities: ["mcp"] },
+  setup(api) {
+    api.registerMcpServer({
+      name: "non-interactive-docs",
+      transport: { type: "streamableHttp", url: "https://example.com/mcp" },
+    })
+  },
+}
+`,
+			"utf8",
+		);
+		const output: string[] = [];
+		const authorize = vi.fn();
+
+		const code = await runPluginInstallCommand({
+			source,
+			io: {
+				writeln: (text = "") => output.push(text),
+				writeErr: (text) => output.push(text),
+			},
+			mcpOAuth: {
+				interactive: false,
+				authorize,
+			},
+		});
+
+		expect(code).toBe(0);
+		expect(authorize).not.toHaveBeenCalled();
+		expect(output.join("\n")).toContain(
+			"Plugin MCP servers may require OAuth authorization",
+		);
+		expect(output.join("\n")).toContain("non-interactive-docs");
+		expect(output.join("\n")).toContain('Run "cline mcp"');
+	});
+
 	it("prints JSON output for official plugin installs", async () => {
 		const officialPluginsRepo = await createOfficialPluginsRepo({
 			"json-plugin": {

apps/cli/src/commands/plugin.ts

@@ -21,7 +21,15 @@ import {
 	resolve,
 	sep,
 } from "node:path";
-import { type PluginUninstallOptions, uninstallPlugin } from "@cline/core";
+import {
+	type McpServerRegistration,
+	type PluginMcpSettingsSyncResult,
+	type PluginUninstallOptions,
+	resolveDefaultMcpSettingsPath,
+	resolveMcpServerRegistrations,
+	syncPluginMcpServersToSettings,
+	uninstallPlugin,
+} from "@cline/core";
 import {
 	isPluginModulePath,
 	resolveClineDir,
@@ -36,12 +44,31 @@ export interface PluginInstallOptions {
 	npmCommand?: string;
 	officialPluginsRepo?: string;
 	io?: PluginInstallIo;
+	mcpOAuth?: PluginInstallMcpOAuthOptions;
 }
 
 export interface PluginInstallResult {
 	source: string;
 	installPath: string;
 	entryPaths: string[];
+	mcpSyncFailures: PluginMcpSettingsSyncResult["failures"];
+	mcpOAuthCandidates: PluginMcpOAuthCandidate[];
+}
+
+export interface PluginMcpOAuthCandidate {
+	name: string;
+	pluginName: string;
+	pluginPath: string;
+	transportType: "sse" | "streamableHttp";
+	lastError?: string;
+}
+
+export interface PluginInstallMcpOAuthOptions {
+	interactive?: boolean;
+	selectCandidates?: (
+		candidates: PluginMcpOAuthCandidate[],
+	) => Promise<PluginMcpOAuthCandidate[]>;
+	authorize?: (candidate: PluginMcpOAuthCandidate) => Promise<void>;
 }
 
 export interface PluginInstallIo {
@@ -1005,6 +1032,81 @@ function replaceInstallPath(
 	}
 }
 
+function hasStaticHeaders(registration: McpServerRegistration): boolean {
+	const transport = registration.transport;
+	if (transport.type === "stdio") {
+		return false;
+	}
+	return (
+		transport.headers !== undefined && Object.keys(transport.headers).length > 0
+	);
+}
+
+function hasOAuthAccessToken(registration: McpServerRegistration): boolean {
+	const accessToken = registration.oauth?.tokens?.access_token;
+	return typeof accessToken === "string" && accessToken.trim().length > 0;
+}
+
+function getPluginOwner(
+	registration: McpServerRegistration,
+): { pluginName: string; pluginPath: string } | undefined {
+	const metadata = registration.metadata;
+	if (
+		!metadata ||
+		metadata.source !== "plugin" ||
+		typeof metadata.pluginName !== "string" ||
+		typeof metadata.pluginPath !== "string"
+	) {
+		return undefined;
+	}
+	return {
+		pluginName: metadata.pluginName,
+		pluginPath: metadata.pluginPath,
+	};
+}
+
+export function collectPluginMcpOAuthCandidates(input: {
+	pluginPaths: readonly string[];
+	settingsPath?: string;
+}): PluginMcpOAuthCandidate[] {
+	const pluginPaths = new Set(input.pluginPaths.map((path) => resolve(path)));
+	if (pluginPaths.size === 0) {
+		return [];
+	}
+
+	let registrations: McpServerRegistration[];
+	try {
+		registrations = resolveMcpServerRegistrations({
+			filePath: input.settingsPath ?? resolveDefaultMcpSettingsPath(),
+		});
+	} catch {
+		return [];
+	}
+
+	const candidates: PluginMcpOAuthCandidate[] = [];
+	for (const registration of registrations) {
+		const owner = getPluginOwner(registration);
+		if (!owner || !pluginPaths.has(resolve(owner.pluginPath))) {
+			continue;
+		}
+		const transportType = registration.transport.type;
+		if (transportType === "stdio") {
+			continue;
+		}
+		if (hasStaticHeaders(registration) || hasOAuthAccessToken(registration)) {
+			continue;
+		}
+		candidates.push({
+			name: registration.name,
+			pluginName: owner.pluginName,
+			pluginPath: owner.pluginPath,
+			transportType,
+			lastError: registration.oauth?.lastError,
+		});
+	}
+	return candidates.sort((left, right) => left.name.localeCompare(right.name));
+}
+
 export async function installPlugin(
 	options: PluginInstallOptions,
 ): Promise<PluginInstallResult> {
@@ -1071,28 +1173,161 @@ export async function installPlugin(
 		}
 
 		replaceInstallPath(stagingRoot, installPath, force);
-		return {
+		const result = {
 			source,
 			installPath,
 			entryPaths: entryPaths.map((entry) => resolve(installPath, entry)),
+			mcpSyncFailures: [] as PluginMcpSettingsSyncResult["failures"],
+			mcpOAuthCandidates: [] as PluginMcpOAuthCandidate[],
 		};
+		const syncResult = await syncPluginMcpServersToSettings({
+			pluginPaths: result.entryPaths,
+			cwd,
+			workspacePath: cwd,
+		});
+		result.mcpSyncFailures = syncResult.failures;
+		result.mcpOAuthCandidates = collectPluginMcpOAuthCandidates({
+			pluginPaths: result.entryPaths,
+		});
+		return result;
 	} catch (error) {
 		rmSync(stagingRoot, { recursive: true, force: true });
 		throw error;
 	}
 }
 
+function serializePluginInstallResult(
+	result: PluginInstallResult,
+): Omit<PluginInstallResult, "mcpOAuthCandidates"> {
+	return {
+		source: result.source,
+		installPath: result.installPath,
+		entryPaths: result.entryPaths,
+		mcpSyncFailures: result.mcpSyncFailures,
+	};
+}
+
+function isInteractivePluginInstall(options: PluginInstallOptions): boolean {
+	return (
+		options.mcpOAuth?.interactive ??
+		(process.stdin.isTTY && process.stdout.isTTY)
+	);
+}
+
+async function selectMcpOAuthCandidatesWithClack(
+	candidates: PluginMcpOAuthCandidate[],
+): Promise<PluginMcpOAuthCandidate[]> {
+	const p = await import("@clack/prompts");
+	const action = await p.select({
+		message: "Authorize plugin MCP servers now?",
+		options: [
+			{
+				value: "all",
+				label: "Authorize all",
+				hint: "open browser authorization for each server",
+			},
+			{
+				value: "choose",
+				label: "Choose servers",
+				hint: "select which servers to authorize",
+			},
+			{
+				value: "skip",
+				label: "Skip",
+			},
+		],
+	});
+	if (p.isCancel(action) || action === "skip") {
+		return [];
+	}
+	if (action === "all") {
+		return candidates;
+	}
+
+	const selectedNames = await p.multiselect({
+		message: "Select MCP servers to authorize",
+		options: candidates.map((candidate) => ({
+			value: candidate.name,
+			label: candidate.name,
+			hint: `${candidate.transportType} [${candidate.pluginName}]`,
+		})),
+		required: false,
+	});
+	if (p.isCancel(selectedNames) || !Array.isArray(selectedNames)) {
+		return [];
+	}
+	const selected = new Set(selectedNames);
+	return candidates.filter((candidate) => selected.has(candidate.name));
+}
+
+async function authorizeMcpOAuthCandidate(
+	candidate: PluginMcpOAuthCandidate,
+): Promise<void> {
+	const { authorizeMcpServerOAuthWithBrowser } = await import(
+		"../wizards/mcp/oauth"
+	);
+	await authorizeMcpServerOAuthWithBrowser(candidate.name, {
+		throwOnError: true,
+	});
+}
+
+async function runPluginMcpOAuthFollowup(
+	candidates: PluginMcpOAuthCandidate[],
+	options: PluginInstallOptions,
+): Promise<void> {
+	if (candidates.length === 0) {
+		return;
+	}
+
+	if (!isInteractivePluginInstall(options)) {
+		options.io?.writeln("Plugin MCP servers may require OAuth authorization:");
+		for (const candidate of candidates) {
+			options.io?.writeln(
+				`  ${candidate.name} (${candidate.transportType}, plugin: ${candidate.pluginName})`,
+			);
+		}
+		options.io?.writeln(
+			'Run "cline mcp" and choose "Authorize OAuth" to authorize them.',
+		);
+		return;
+	}
+
+	const selected =
+		options.mcpOAuth?.selectCandidates !== undefined
+			? await options.mcpOAuth.selectCandidates(candidates)
+			: await selectMcpOAuthCandidatesWithClack(candidates);
+	const authorize = options.mcpOAuth?.authorize ?? authorizeMcpOAuthCandidate;
+	for (const candidate of selected) {
+		try {
+			await authorize(candidate);
+		} catch (error) {
+			const message = error instanceof Error ? error.message : String(error);
+			options.io?.writeErr(
+				`Warning: failed to authorize MCP server ${candidate.name}: ${message}. Run "cline mcp" and choose "Authorize OAuth" to retry.`,
+			);
+		}
+	}
+}
+
 export async function runPluginInstallCommand(
 	options: PluginInstallOptions & { json?: boolean },
 ): Promise<number> {
 	try {
 		const result = await installPlugin(options);
 		if (options.json) {
-			process.stdout.write(JSON.stringify(result));
+			process.stdout.write(
+				JSON.stringify(serializePluginInstallResult(result)),
+			);
 			return 0;
 		}
 		options.io?.writeln(`Installed plugin from ${result.source}`);
 		options.io?.writeln(`  Path: ${result.installPath}`);
+		for (const failure of result.mcpSyncFailures) {
+			options.io?.writeErr(
+				`Warning: failed to sync plugin MCP servers for ${failure.pluginName ?? failure.pluginPath}: ${failure.message}`,
+			);
+		}
+		await runPluginMcpOAuthFollowup(result.mcpOAuthCandidates, options);
 		return 0;
 	} catch (error) {
 		const message = error instanceof Error ? error.message : String(error);

apps/cli/src/commands/program.ts

@@ -116,7 +116,6 @@ export function createProgram(): Command {
 			writeOut: () => {}, // suppress by default; main.ts re-enables for routing
 			writeErr: () => {},
 		})
-		.allowUnknownOption()
 		.allowExcessArguments()
 		.enablePositionalOptions()
 		.argument(

apps/cli/src/commands/skill.test.ts

@@ -0,0 +1,88 @@
+import { describe, expect, it } from "vitest";
+import { buildSkillsArgs } from "./skill";
+
+describe("buildSkillsArgs", () => {
+	it("runs the skills package through npx with -y", () => {
+		expect(buildSkillsArgs(["list"])).toEqual(["-y", "skills@latest", "list"]);
+	});
+
+	it("injects --agent cline for install-style subcommands", () => {
+		expect(buildSkillsArgs(["install", "owner/repo"])).toEqual([
+			"-y",
+			"skills@latest",
+			"add",
+			"owner/repo",
+			"--agent",
+			"cline",
+		]);
+		expect(buildSkillsArgs(["add", "owner/repo"])).toContain("cline");
+		expect(buildSkillsArgs(["i", "owner/repo"])).toContain("cline");
+		expect(buildSkillsArgs(["update", "owner/repo"])).toContain("cline");
+	});
+
+	it("aliases uninstall to the skills remove subcommand", () => {
+		expect(buildSkillsArgs(["uninstall", "my-skill"])).toEqual([
+			"-y",
+			"skills@latest",
+			"remove",
+			"my-skill",
+			"--agent",
+			"cline",
+		]);
+	});
+
+	it("does not inject when the user already targeted an agent", () => {
+		expect(
+			buildSkillsArgs(["install", "owner/repo", "--agent", "cursor"]),
+		).not.toContain("cline");
+		expect(
+			buildSkillsArgs(["install", "owner/repo", "-a", "cursor"]),
+		).not.toContain("cline");
+		expect(
+			buildSkillsArgs(["install", "owner/repo", "--agent=cursor"]),
+		).not.toContain("cline");
+	});
+
+	it("aliases install and uninstall when agent options come before the subcommand", () => {
+		expect(
+			buildSkillsArgs(["--agent", "cursor", "install", "owner/repo"]),
+		).toEqual([
+			"-y",
+			"skills@latest",
+			"--agent",
+			"cursor",
+			"add",
+			"owner/repo",
+		]);
+		expect(
+			buildSkillsArgs(["--agent=cursor", "uninstall", "my-skill"]),
+		).toEqual(["-y", "skills@latest", "--agent=cursor", "remove", "my-skill"]);
+	});
+
+	it("does not scope non-install subcommands to cline", () => {
+		expect(buildSkillsArgs(["use", "owner/repo"])).not.toContain("--agent");
+		expect(buildSkillsArgs(["list"])).not.toContain("--agent");
+	});
+
+	it("scopes remove-style subcommands to cline", () => {
+		expect(buildSkillsArgs(["remove"])).toEqual([
+			"-y",
+			"skills@latest",
+			"remove",
+			"--agent",
+			"cline",
+		]);
+		expect(buildSkillsArgs(["rm", "my-skill"])).toContain("cline");
+		expect(buildSkillsArgs(["r", "my-skill"])).toContain("cline");
+	});
+
+	it("ignores leading flags when detecting the subcommand", () => {
+		expect(buildSkillsArgs(["--global", "install", "owner/repo"])).toContain(
+			"cline",
+		);
+	});
+
+	it("forwards an empty arg list unchanged", () => {
+		expect(buildSkillsArgs([])).toEqual(["-y", "skills@latest"]);
+	});
+});

apps/cli/src/commands/skill.ts

@@ -0,0 +1,160 @@
+import { type SpawnOptions, spawn } from "node:child_process";
+
+export interface SkillCommandIo {
+	writeln: (text?: string) => void;
+	writeErr: (text: string) => void;
+}
+
+// `cline skill` is a thin wrapper around the open skills CLI
+// (https://www.npmjs.com/package/skills). We run it through `npx` so users
+// don't need a separate global install. Pin the version here if we ever need to
+// lock behavior to a known-good release.
+const SKILLS_PACKAGE = "skills@latest";
+
+// Subcommands that write skill files into an agent's skills directory. For a
+// `cline skill` command we default these to Cline unless the user picked their
+// own agent. `use` is intentionally excluded: without --agent it prints the
+// generated prompt to stdout, whereas adding --agent would launch that agent
+// interactively instead — not what someone scoping to Cline would expect.
+const CLINE_SCOPED_SUBCOMMANDS = new Set([
+	"add",
+	"install",
+	"i",
+	"update",
+	"remove",
+	"rm",
+	"r",
+	"uninstall",
+]);
+
+const SKILLS_SUBCOMMAND_ALIASES = new Map([
+	["install", "add"],
+	["uninstall", "remove"],
+]);
+
+function hasAgentFlag(args: readonly string[]): boolean {
+	return args.some(
+		(arg) => arg === "-a" || arg === "--agent" || arg.startsWith("--agent="),
+	);
+}
+
+function optionConsumesNextValue(arg: string): boolean {
+	return arg === "-a" || arg === "--agent";
+}
+
+function findSubcommandIndex(args: readonly string[]): number {
+	for (let index = 0; index < args.length; index++) {
+		const arg = args[index];
+		if (arg.startsWith("-")) {
+			if (optionConsumesNextValue(arg)) {
+				index++;
+			}
+			continue;
+		}
+		return index;
+	}
+	return -1;
+}
+
+function findSubcommand(args: readonly string[]): string | undefined {
+	const index = findSubcommandIndex(args);
+	return index >= 0 ? args[index] : undefined;
+}
+
+function normalizeSkillsSubcommandAliases(args: string[]): void {
+	const index = findSubcommandIndex(args);
+	if (index < 0) return;
+	const alias = SKILLS_SUBCOMMAND_ALIASES.get(args[index]);
+	if (alias) {
+		args[index] = alias;
+	}
+}
+
+/**
+ * Build the argument list passed to `npx`, injecting `--agent cline` for
+ * install-style subcommands unless the user already targeted an agent.
+ */
+export function buildSkillsArgs(userArgs: readonly string[]): string[] {
+	const args = [...userArgs];
+	const subcommand = findSubcommand(args);
+	normalizeSkillsSubcommandAliases(args);
+	if (
+		subcommand &&
+		CLINE_SCOPED_SUBCOMMANDS.has(subcommand) &&
+		!hasAgentFlag(args)
+	) {
+		args.push("--agent", "cline");
+	}
+	return ["-y", SKILLS_PACKAGE, ...args];
+}
+
+function resolveExitCode(
+	code: number | null,
+	signal: NodeJS.Signals | null,
+): number {
+	if (code !== null) {
+		return code;
+	}
+	switch (signal) {
+		case "SIGINT":
+			return 130;
+		case "SIGTERM":
+			return 143;
+		default:
+			return 1;
+	}
+}
+
+/**
+ * Forward all arguments to the open skills CLI via `npx skills`.
+ *
+ * Returns the child process exit code, or 1 if npx is unavailable or fails to
+ * spawn. stdio is inherited so the skills CLI's interactive prompts and output
+ * pass straight through to the user's terminal.
+ */
+export async function runSkillCommand(
+	userArgs: readonly string[],
+	io: SkillCommandIo,
+): Promise<number> {
+	const args = buildSkillsArgs(userArgs);
+	const isWindows = process.platform === "win32";
+	const options: SpawnOptions = {
+		stdio: "inherit",
+		env: process.env,
+		// Prevent a console window from flashing on Windows.
+		windowsHide: true,
+		...(isWindows ? { shell: true } : {}),
+	};
+
+	return new Promise<number>((resolve) => {
+		const child = spawn("npx", args, options);
+
+		const forward = (signal: NodeJS.Signals) => {
+			child.kill(signal);
+		};
+		const handleSigint = () => forward("SIGINT");
+		const handleSigterm = () => forward("SIGTERM");
+		process.on("SIGINT", handleSigint);
+		process.on("SIGTERM", handleSigterm);
+		const cleanup = () => {
+			process.off("SIGINT", handleSigint);
+			process.off("SIGTERM", handleSigterm);
+		};
+
+		child.once("error", (error: NodeJS.ErrnoException) => {
+			cleanup();
+			if (error.code === "ENOENT") {
+				io.writeErr(
+					'npx was not found. Install Node.js (which includes npx) to use "cline skill".',
+				);
+			} else {
+				io.writeErr(`Failed to run npx ${SKILLS_PACKAGE}: ${error.message}`);
+			}
+			resolve(1);
+		});
+		child.once("close", (code, signal) => {
+			cleanup();
+			resolve(resolveExitCode(code, signal));
+		});
+	});
+}

apps/cli/src/connectors/catalog.ts

@@ -1,36 +1,2 @@
-export type ConnectorCatalogEntry = {
-	name: string;
-	description: string;
-};
-
-export const CONNECTOR_CATALOG: ConnectorCatalogEntry[] = [
-	{
-		name: "discord",
-		description:
-			"Discord interactions and gateway bridge backed by RPC runtime sessions",
-	},
-	{
-		name: "gchat",
-		description: "Google Chat webhook bridge backed by RPC runtime sessions",
-	},
-	{
-		name: "linear",
-		description: "Linear webhook bridge backed by RPC runtime sessions",
-	},
-	{
-		name: "slack",
-		description: "Slack webhook/socket bridge backed by RPC runtime sessions",
-	},
-	{
-		name: "telegram",
-		description: "Bridge Telegram bot messages into RPC chat sessions",
-	},
-	{
-		name: "whatsapp",
-		description: "Bridge WhatsApp webhook messages into RPC chat sessions",
-	},
-];
-
-export function listConnectorCatalog(): ConnectorCatalogEntry[] {
-	return CONNECTOR_CATALOG.map((entry) => ({ ...entry }));
-}
+export type { ConnectorCatalogEntry } from "@cline/shared";
+export { CONNECTOR_CATALOG, listConnectorCatalog } from "@cline/shared";

apps/cli/src/main.test.ts

@@ -84,6 +84,11 @@ const historyMocks = vi.hoisted(() => ({
 	runHistoryExport: vi.fn(async () => 0),
 	runHistoryUpdate: vi.fn(async () => 0),
 }));
+const historyResumeMocks = vi.hoisted(() => ({
+	spawnHistoryResume: vi.fn<() => Promise<number | undefined>>(
+		async () => undefined,
+	),
+}));
 const loggingMocks = vi.hoisted(() => ({
 	createCliLoggerAdapter: vi.fn(() => ({
 		core: {
@@ -109,6 +114,7 @@ const telemetryMocks = vi.hoisted(() => ({
 }));
 const featureFlagMocks = vi.hoisted(() => ({
 	getBooleanFlagEnabled: vi.fn(() => false),
+	setCliFeatureFlagsAccountContext: vi.fn(),
 }));
 
 function forcePromptModeInput() {
@@ -174,6 +180,8 @@ vi.mock("./utils/feature-flags", () => ({
 		getBooleanFlagEnabled: featureFlagMocks.getBooleanFlagEnabled,
 	}),
 	refreshCliFeatureFlagsInBackground: vi.fn(),
+	setCliFeatureFlagsAccountContext:
+		featureFlagMocks.setCliFeatureFlagsAccountContext,
 }));
 vi.mock("./runtime/prompt", () => ({
 	resolveSystemPrompt: promptMocks.resolveSystemPrompt,
@@ -183,6 +191,7 @@ vi.mock("./commands/dashboard", () => dashboardMocks);
 vi.mock("./kanban-migration/notice", () => migrationNoticeMocks);
 vi.mock("./commands/update", () => updateMocks);
 vi.mock("./commands/history", () => historyMocks);
+vi.mock("./utils/history-resume", () => historyResumeMocks);
 vi.mock("./logging/adapter", () => loggingMocks);
 vi.mock("./utils/hub-runtime", () => hubRuntimeMocks);
 vi.mock("./utils/telemetry", () => telemetryMocks);
@@ -202,6 +211,8 @@ describe("runCli lightweight command dispatch", () => {
 		historyMocks.runHistoryExport.mockResolvedValue(0);
 		historyMocks.runHistoryUpdate.mockReset();
 		historyMocks.runHistoryUpdate.mockResolvedValue(0);
+		historyResumeMocks.spawnHistoryResume.mockReset();
+		historyResumeMocks.spawnHistoryResume.mockResolvedValue(undefined);
 		sessionMocks.getSessionRow.mockReset();
 		sessionMocks.getSessionRow.mockResolvedValue({
 			sessionId: "sess_123",
@@ -244,6 +255,9 @@ describe("runCli lightweight command dispatch", () => {
 		providerSettingsMocks.getProviderSettings.mockReset();
 		providerSettingsMocks.getProviderSettings.mockReturnValue(undefined);
 		providerSettingsMocks.saveProviderSettings.mockReset();
+		featureFlagMocks.getBooleanFlagEnabled.mockReset();
+		featureFlagMocks.getBooleanFlagEnabled.mockReturnValue(false);
+		featureFlagMocks.setCliFeatureFlagsAccountContext.mockReset();
 		kanbanMocks.launchKanban.mockReset();
 		kanbanMocks.launchKanban.mockResolvedValue(0);
 		dashboardMocks.runDashboardCommand.mockReset();
@@ -403,6 +417,61 @@ describe("runCli lightweight command dispatch", () => {
 		expect(mockState.runInteractiveImports).toBe(0);
 	});
 
+	it("rejects multiple bare positional prompt tokens", async () => {
+		const consoleError = vi
+			.spyOn(console, "error")
+			.mockImplementation(() => undefined);
+		forcePromptModeInput();
+		process.argv = ["bun", "src/index.ts", "hello", "world"];
+
+		const { runCli } = await import("./main");
+
+		await expect(runCli()).resolves.toBeUndefined();
+		expect(process.exitCode).toBe(1);
+		expect(consoleError).toHaveBeenCalledWith(
+			expect.stringContaining(
+				"Unknown command or extra arguments: hello world",
+			),
+		);
+		expect(runtimeMocks.runAgent).not.toHaveBeenCalled();
+		expect(mockState.runAgentImports).toBe(0);
+		expect(mockState.runInteractiveImports).toBe(0);
+	});
+
+	it("runs quoted positional prompt text", async () => {
+		forcePromptModeInput();
+		process.argv = ["bun", "src/index.ts", "hello world"];
+
+		const { runCli } = await import("./main");
+
+		await expect(runCli()).resolves.toBeUndefined();
+		expect(runtimeMocks.runAgent).toHaveBeenCalledTimes(1);
+		expect(runtimeMocks.runAgent).toHaveBeenCalledWith(
+			"hello world",
+			expect.any(Object),
+			expect.anything(),
+		);
+	});
+
+	it("rejects unknown root flags before loading runtime modules", async () => {
+		const consoleError = vi
+			.spyOn(console, "error")
+			.mockImplementation(() => undefined);
+		forcePromptModeInput();
+		process.argv = ["bun", "src/index.ts", "--made-up-flag"];
+
+		const { runCli } = await import("./main");
+
+		await expect(runCli()).resolves.toBeUndefined();
+		expect(process.exitCode).toBe(1);
+		expect(consoleError).toHaveBeenCalledWith(
+			expect.stringContaining("unknown option '--made-up-flag'"),
+		);
+		expect(runtimeMocks.runAgent).not.toHaveBeenCalled();
+		expect(mockState.runAgentImports).toBe(0);
+		expect(mockState.runInteractiveImports).toBe(0);
+	});
+
 	it("creates a worktree and runs prompt sessions from it", async () => {
 		forcePromptModeInput();
 		process.argv = ["bun", "src/index.ts", "--worktree", "hello"];
@@ -730,10 +799,47 @@ describe("runCli lightweight command dispatch", () => {
 		);
 	});
 
-	it("forces chat view when resuming from history picker", async () => {
+	it("resumes a history-picked session in a child process", async () => {
 		historyMocks.runHistoryList.mockImplementationOnce(
 			async () => "sess_from_history",
 		);
+		historyResumeMocks.spawnHistoryResume.mockResolvedValueOnce(0);
+		process.argv = ["bun", "src/index.ts", "history"];
+
+		const { runCli } = await import("./main");
+
+		await expect(runCli()).resolves.toBeUndefined();
+		expect(historyResumeMocks.spawnHistoryResume).toHaveBeenCalledTimes(1);
+		expect(historyResumeMocks.spawnHistoryResume).toHaveBeenCalledWith(
+			expect.objectContaining({
+				sessionId: "sess_from_history",
+				normalizedArgs: ["history"],
+				remainingArgs: ["history"],
+			}),
+		);
+		expect(runtimeMocks.runInteractive).not.toHaveBeenCalled();
+		expect(process.exitCode).toBe(0);
+	});
+
+	it("propagates the child exit code when resuming from history picker", async () => {
+		historyMocks.runHistoryList.mockImplementationOnce(
+			async () => "sess_from_history",
+		);
+		historyResumeMocks.spawnHistoryResume.mockResolvedValueOnce(3);
+		process.argv = ["bun", "src/index.ts", "history"];
+
+		const { runCli } = await import("./main");
+
+		await expect(runCli()).resolves.toBeUndefined();
+		expect(process.exitCode).toBe(3);
+		expect(runtimeMocks.runInteractive).not.toHaveBeenCalled();
+	});
+
+	it("forces chat view when the history-picker child cannot launch", async () => {
+		historyMocks.runHistoryList.mockImplementationOnce(
+			async () => "sess_from_history",
+		);
+		historyResumeMocks.spawnHistoryResume.mockResolvedValueOnce(undefined);
 		process.argv = ["bun", "src/index.ts", "history"];
 
 		const { runCli } = await import("./main");
@@ -812,6 +918,33 @@ describe("runCli lightweight command dispatch", () => {
 		);
 	});
 
+	it("seeds feature flag identity from persisted Cline account id before checking flags", async () => {
+		const clineSettings = {
+			provider: "cline",
+			model: "anthropic/claude-sonnet-4.6",
+			auth: {
+				accountId: "acct-startup",
+				accessToken: "workos:token",
+				refreshToken: "refresh-token",
+			},
+		};
+		providerSettingsMocks.getProviderSettings.mockReturnValue(clineSettings);
+		process.argv = ["bun", "src/index.ts"];
+
+		const { runCli } = await import("./main");
+
+		await expect(runCli()).resolves.toBeUndefined();
+		expect(
+			featureFlagMocks.setCliFeatureFlagsAccountContext,
+		).toHaveBeenCalledWith({ id: "acct-startup" });
+		expect(
+			featureFlagMocks.setCliFeatureFlagsAccountContext.mock
+				.invocationCallOrder[0],
+		).toBeLessThan(
+			featureFlagMocks.getBooleanFlagEnabled.mock.invocationCallOrder[0],
+		);
+	});
+
 	it("runs kanban before loading runtime modules", async () => {
 		process.argv = ["bun", "src/index.ts", "kanban"];
 
@@ -829,6 +962,10 @@ describe("runCli lightweight command dispatch", () => {
 			"bun",
 			"src/index.ts",
 			"dashboard",
+			"--config",
+			"/tmp/cline-config",
+			"--data-dir",
+			".cline-dashboard-data",
 			"--port",
 			"9090",
 			"--no-open",
@@ -839,6 +976,8 @@ describe("runCli lightweight command dispatch", () => {
 		await expect(runCli()).resolves.toBeUndefined();
 		expect(dashboardMocks.runDashboardCommand).toHaveBeenCalledWith(
 			expect.objectContaining({
+				configDir: "/tmp/cline-config",
+				dataDir: ".cline-dashboard-data",
 				port: "9090",
 				openBrowser: false,
 				io: expect.any(Object),
@@ -887,7 +1026,7 @@ describe("runCli lightweight command dispatch", () => {
 		runtimeMocks.runAgent.mockClear();
 
 		forcePromptModeInput();
-		process.argv = ["bun", "src/index.ts", "/team", "find", "the", "bug"];
+		process.argv = ["bun", "src/index.ts", "/team find the bug"];
 
 		const { runCli } = await import("./main");
 

apps/cli/src/main.ts

@@ -22,6 +22,7 @@ import {
 import {
 	getCliFeatureFlagsService,
 	refreshCliFeatureFlagsInBackground,
+	setCliFeatureFlagsAccountContext,
 } from "./utils/feature-flags";
 import {
 	configureSandboxEnvironment,
@@ -139,7 +140,7 @@ export async function runCli(): Promise<void> {
 	// Re-enable built-in help/version output for the routing program
 	program.configureOutput({
 		writeOut: (str: string) => process.stdout.write(str),
-		writeErr: (str: string) => process.stderr.write(str),
+		writeErr: () => {},
 	});
 	// Default action handles non-subcommand args (e.g. prompt text)
 	program.action(() => {});
@@ -315,6 +316,28 @@ export async function runCli(): Promise<void> {
 				io,
 			});
 		});
+	const skillCmd = program
+		.command("skill")
+		.description("Manage Cline Skills via the open skills CLI (npx skills)")
+		.allowUnknownOption()
+		.passThroughOptions()
+		.argument("[args...]", "arguments forwarded to the skills CLI")
+		.addHelpText(
+			"after",
+			"\nForwards to the open skills CLI via npx. Examples:\n" +
+				"  cline skill add <owner/repo>       Add a skill into Cline\n" +
+				"  cline skill install <owner/repo>   Alias for add\n" +
+				"  cline skill list                   List installed skills\n" +
+				"  cline skill remove                 Remove installed skills\n" +
+				"  cline skill uninstall              Alias for remove\n" +
+				"\nadd/install and remove/uninstall default to '--agent cline' unless you pass your own --agent.\n" +
+				"Run 'npx skills --help' for the full command reference.",
+		)
+		.action(async () => {
+			const { runSkillCommand } = await import("./commands/skill");
+			ctx.exitCode = await runSkillCommand(skillCmd.args, io);
+		});
+
 	const connectCmd = program
 		.command("connect")
 		.description("Connect to an external channel")
@@ -356,7 +379,7 @@ export async function runCli(): Promise<void> {
 			}
 		});
 
-	program
+	const mcpCmd = program
 		.command("mcp")
 		.description("Manage MCP servers")
 		.action(async () => {
@@ -368,6 +391,31 @@ export async function runCli(): Promise<void> {
 				);
 			}
 		});
+	const mcpInstallCmd = mcpCmd
+		.command("install")
+		.alias("add")
+		.description("Open the MCP add wizard with server fields prefilled")
+		.argument("<name>", "MCP server name")
+		.argument(
+			"[targetArgs...]",
+			"URL for remote transports, or command and args after -- for stdio",
+		)
+		.option(
+			"--transport <transport>",
+			"stdio, sse, http, streamable-http, or streamableHttp (default: stdio)",
+		)
+		.action(async (name: string, targetArgs: string[]) => {
+			const opts = mcpInstallCmd.opts<{
+				transport?: string;
+			}>();
+			const { runMcpInstallCommand } = await import("./commands/mcp");
+			ctx.exitCode = await runMcpInstallCommand({
+				name,
+				targetArgs,
+				transport: opts.transport,
+				io,
+			});
+		});
 
 	const createDoctorRuntimeCommand = async () => {
 		const { createDoctorCommand } = await import("./commands/doctor");
@@ -548,7 +596,12 @@ export async function runCli(): Promise<void> {
 	const dashboardCmd = program
 		.command("dashboard")
 		.description("Start the Cline Hub dashboard and open it in a browser")
+		.option("--config <dir>", "configuration directory")
 		.option("-c, --cwd <path>", "Workspace root", process.cwd())
+		.option(
+			"--data-dir <dir>",
+			"Use isolated local state at <dir> instead of ~/.cline (enables sandbox mode)",
+		)
 		.option("--host <host>", "Dashboard bind host")
 		.option("--port <port>", "Dashboard HTTP/WebSocket port")
 		.option("--public-url <url>", "Public dashboard URL")
@@ -556,7 +609,9 @@ export async function runCli(): Promise<void> {
 		.option("--no-open", "Start the dashboard without opening a browser")
 		.action(async () => {
 			const opts = dashboardCmd.opts<{
+				config?: string;
 				cwd?: string;
+				dataDir?: string;
 				host?: string;
 				port?: string;
 				publicUrl?: string;
@@ -565,7 +620,9 @@ export async function runCli(): Promise<void> {
 			}>();
 			const { runDashboardCommand } = await import("./commands/dashboard");
 			ctx.exitCode = await runDashboardCommand({
+				configDir: opts.config,
 				cwd: opts.cwd,
+				dataDir: opts.dataDir,
 				host: opts.host,
 				port: opts.port,
 				publicUrl: opts.publicUrl,
@@ -614,6 +671,7 @@ export async function runCli(): Promise<void> {
 		if (err instanceof CommanderError) {
 			if (err.exitCode !== 0) {
 				writeErr(err.message);
+				process.exitCode = err.exitCode;
 				return;
 			}
 			return;
@@ -664,9 +722,31 @@ export async function runCli(): Promise<void> {
 
 	// Default flow: no subcommand matched, or fall-through from config/history.
 	let args = commanderToParsedArgs(program);
+	if (program.args.length > 1) {
+		writeErr(
+			`Unknown command or extra arguments: ${program.args.join(" ")}\nPrompt text with spaces must be quoted as a single argument, for example: cline "fix the tests". Use "cline --help" to see available commands and flags.`,
+		);
+		process.exitCode = 1;
+		return;
+	}
 
 	let resumeSessionId: string | undefined = ctx.resumeSessionId;
 	if (resumeSessionId) {
+		// The history picker already created (and tore down) an OpenTUI renderer
+		// in this process; starting the interactive TUI here would create a
+		// second one, which can crash natively during teardown. Resume in a
+		// fresh `cline --id <session-id>` child process instead.
+		const { spawnHistoryResume } = await import("./utils/history-resume");
+		const childExitCode = await spawnHistoryResume({
+			sessionId: resumeSessionId,
+			normalizedArgs,
+			remainingArgs: program.args,
+			configDir,
+		});
+		if (childExitCode !== undefined) {
+			process.exitCode = childExitCode;
+			return;
+		}
 		args = {
 			...args,
 			interactive: true,
@@ -840,6 +920,12 @@ export async function runCli(): Promise<void> {
 	};
 	registerDisposable(stopUserInstructionService);
 	try {
+		const persistedClineAccountId = providerSettingsManager
+			.getProviderSettings("cline")
+			?.auth?.accountId?.trim();
+		if (persistedClineAccountId) {
+			setCliFeatureFlagsAccountContext({ id: persistedClineAccountId });
+		}
 		refreshCliFeatureFlagsInBackground();
 		const lastUsedProviderSettings =
 			providerSettingsManager.getLastUsedProviderSettings({

apps/cli/src/runtime/interactive/approvals.test.ts

@@ -61,6 +61,20 @@ describe("createInteractiveApprovalController", () => {
 		).resolves.toEqual({ approved: false, reason: "no" });
 	});
 
+	it("approves stale required-approval requests after auto-approve is enabled", async () => {
+		const controller = createInteractiveApprovalController(makeConfig(false));
+		controller.tuiToolApprover.current = async () => ({
+			approved: false,
+			reason: "stale prompt",
+		});
+
+		controller.setInteractiveAutoApprove(true);
+
+		await expect(
+			controller.requestToolApproval(makeRequest({ autoApprove: false })),
+		).resolves.toEqual({ approved: true });
+	});
+
 	it("denies approval-required requests when no TUI approver is available", async () => {
 		const controller = createInteractiveApprovalController(makeConfig(false));
 
@@ -77,6 +91,7 @@ describe("createInteractiveApprovalController", () => {
 
 		expect(controller.autoApproveAllRef.current).toBe(true);
 		expect(config.defaultToolAutoApprove).toBe(false);
-		expect(config.toolPolicies["*"]?.autoApprove).toBe(false);
+		expect(config.toolPolicies["*"]?.autoApprove).toBe(true);
+		expect(controller.resolveToolPolicy("run_commands").autoApprove).toBe(true);
 	});
 });

apps/cli/src/runtime/interactive/approvals.ts

@@ -3,6 +3,7 @@ import type { Config } from "../../utils/types";
 import {
 	applyInteractiveAutoApproveOverride,
 	cloneToolPolicies,
+	resolveInteractiveAutoApprovePolicy,
 } from "../tool-policies";
 
 export interface InteractiveRuntimeRefs {
@@ -38,10 +39,10 @@ export function createInteractiveApprovalController(config: Config) {
 	const requestToolApproval = async (
 		request: ToolApprovalRequest,
 	): Promise<ToolApprovalResult> => {
-		if (request.policy?.autoApprove === true) {
+		if (autoApproveAllRef.current) {
 			return { approved: true };
 		}
-		if (autoApproveAllRef.current && request.policy?.autoApprove !== false) {
+		if (request.policy?.autoApprove === true) {
 			return { approved: true };
 		}
 		if (refs.tuiToolApprover.current) {
@@ -54,6 +55,12 @@ export function createInteractiveApprovalController(config: Config) {
 		autoApproveAllRef,
 		setInteractiveAutoApprove,
 		requestToolApproval,
+		resolveToolPolicy: (toolName: string) =>
+			resolveInteractiveAutoApprovePolicy({
+				toolName,
+				baselinePolicies: baselineToolPolicies,
+				enabled: autoApproveAllRef.current,
+			}),
 		...refs,
 	};
 }

apps/cli/src/runtime/interactive/config-data.test.ts

@@ -1,4 +1,11 @@
-import { mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import {
+	chmod,
+	mkdir,
+	mkdtemp,
+	readFile,
+	rm,
+	writeFile,
+} from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import type { UserInstructionConfigService } from "@cline/core";
@@ -43,9 +50,17 @@ describe("interactive config data loader", () => {
 	};
 
 	afterEach(async () => {
-		process.env.CLINE_GLOBAL_SETTINGS_PATH =
-			envSnapshot.CLINE_GLOBAL_SETTINGS_PATH;
-		process.env.CLINE_MCP_SETTINGS_PATH = envSnapshot.CLINE_MCP_SETTINGS_PATH;
+		if (envSnapshot.CLINE_GLOBAL_SETTINGS_PATH === undefined) {
+			delete process.env.CLINE_GLOBAL_SETTINGS_PATH;
+		} else {
+			process.env.CLINE_GLOBAL_SETTINGS_PATH =
+				envSnapshot.CLINE_GLOBAL_SETTINGS_PATH;
+		}
+		if (envSnapshot.CLINE_MCP_SETTINGS_PATH === undefined) {
+			delete process.env.CLINE_MCP_SETTINGS_PATH;
+		} else {
+			process.env.CLINE_MCP_SETTINGS_PATH = envSnapshot.CLINE_MCP_SETTINGS_PATH;
+		}
 		await Promise.all(
 			tempRoots.map((dir) => rm(dir, { recursive: true, force: true })),
 		);
@@ -76,6 +91,28 @@ describe("interactive config data loader", () => {
 		return pluginPath;
 	}
 
+	async function writeMcpSettingsPlugin(tempRoot: string): Promise<string> {
+		const pluginsDir = join(tempRoot, ".cline", "plugins");
+		await mkdir(pluginsDir, { recursive: true });
+		const pluginPath = join(pluginsDir, "settings-mcp-plugin.js");
+		await writeFile(
+			pluginPath,
+			[
+				"export default {",
+				"  name: 'settings-mcp-plugin',",
+				"  manifest: { capabilities: ['mcp'] },",
+				"  setup(api) {",
+				"    api.registerMcpServer({",
+				"      name: 'smoke',",
+				"      transport: { type: 'stdio', command: process.execPath, args: ['-e', 'process.exit(0)'] },",
+				"    });",
+				"  },",
+				"};",
+			].join("\n"),
+		);
+		return pluginPath;
+	}
+
 	it("toggles a skill item to the opposite enabled state and refreshes before reload", async () => {
 		const tempRoot = await mkdtemp(join(tmpdir(), "cli-config-data-"));
 		tempRoots.push(tempRoot);
@@ -311,6 +348,70 @@ Find installable skills.`,
 		).toBe(true);
 	});
 
+	it("loads plugin-owned MCP servers from settings", async () => {
+		const tempRoot = await mkdtemp(join(tmpdir(), "cli-config-data-"));
+		tempRoots.push(tempRoot);
+		const settingsPath = join(tempRoot, "cline_mcp_settings.json");
+		process.env.CLINE_MCP_SETTINGS_PATH = settingsPath;
+		const pluginPath = await writeMcpSettingsPlugin(tempRoot);
+		await writeFile(
+			settingsPath,
+			`${JSON.stringify(
+				{
+					mcpServers: {
+						smoke: {
+							transport: {
+								type: "stdio",
+								command: process.execPath,
+								args: ["-e", "process.exit(0)"],
+							},
+							metadata: {
+								source: "plugin",
+								pluginName: "settings-mcp-plugin",
+								pluginPath,
+							},
+						},
+					},
+				},
+				null,
+				2,
+			)}\n`,
+		);
+		const loader = createInteractiveConfigDataLoader({
+			config: createConfig(tempRoot),
+		});
+
+		const data = await loader.loadConfigData({ includePluginTools: true });
+
+		expect(
+			data.mcp.some(
+				(item) =>
+					item.name === "smoke" &&
+					item.pluginName === "settings-mcp-plugin" &&
+					item.pluginPath === pluginPath &&
+					item.kind === "mcp",
+			),
+		).toBe(true);
+	});
+
+	it("does not load plugin MCP rows directly from plugin diagnostics", async () => {
+		const tempRoot = await mkdtemp(join(tmpdir(), "cli-config-data-"));
+		tempRoots.push(tempRoot);
+		process.env.CLINE_GLOBAL_SETTINGS_PATH = join(
+			tempRoot,
+			"global-settings.json",
+		);
+		const pluginPath = await writeMcpSettingsPlugin(tempRoot);
+		const loader = createInteractiveConfigDataLoader({
+			config: createConfig(tempRoot),
+		});
+
+		const data = await loader.loadConfigData({ includePluginTools: true });
+
+		expect(data.plugins.some((item) => item.path === pluginPath)).toBe(true);
+		expect(data.mcp.some((item) => item.pluginPath === pluginPath)).toBe(false);
+	});
+
 	it("keeps failed plugins visible with their load error", async () => {
 		const tempRoot = await mkdtemp(join(tmpdir(), "cli-config-data-"));
 		tempRoots.push(tempRoot);
@@ -731,6 +832,142 @@ Review with the bundled skill.`,
 		).toBe(false);
 	});
 
+	it("disables and re-syncs plugin-owned MCP servers when toggling plugins", async () => {
+		const tempRoot = await mkdtemp(join(tmpdir(), "cli-config-data-"));
+		tempRoots.push(tempRoot);
+		const settingsPath = join(tempRoot, "cline_mcp_settings.json");
+		process.env.CLINE_GLOBAL_SETTINGS_PATH = join(
+			tempRoot,
+			"global-settings.json",
+		);
+		process.env.CLINE_MCP_SETTINGS_PATH = settingsPath;
+		const pluginPath = await writeMcpSettingsPlugin(tempRoot);
+		await writeFile(
+			settingsPath,
+			`${JSON.stringify(
+				{
+					mcpServers: {
+						smoke: {
+							transport: {
+								type: "stdio",
+								command: process.execPath,
+								args: ["-e", "process.exit(0)"],
+							},
+							oauth: {
+								tokens: {
+									access_token: "token",
+								},
+							},
+							metadata: {
+								source: "plugin",
+								pluginName: "settings-mcp-plugin",
+								pluginPath,
+							},
+						},
+					},
+				},
+				null,
+				2,
+			)}\n`,
+		);
+		const loader = createInteractiveConfigDataLoader({
+			config: createConfig(tempRoot),
+		});
+		const item: InteractiveConfigItem = {
+			id: pluginPath,
+			name: "settings-mcp-plugin",
+			path: pluginPath,
+			enabled: true,
+			source: "workspace-plugin",
+			kind: "plugin",
+		};
+
+		await loader.onToggleConfigItem(item);
+		let settings = JSON.parse(await readFile(settingsPath, "utf8")) as {
+			mcpServers?: Record<
+				string,
+				{ disabled?: boolean; oauth?: { tokens?: Record<string, string> } }
+			>;
+		};
+		expect(settings.mcpServers?.smoke?.disabled).toBe(true);
+		expect(settings.mcpServers?.smoke?.oauth?.tokens?.access_token).toBe(
+			"token",
+		);
+
+		await loader.onToggleConfigItem({ ...item, enabled: false });
+		settings = JSON.parse(await readFile(settingsPath, "utf8")) as {
+			mcpServers?: Record<
+				string,
+				{ disabled?: boolean; oauth?: { tokens?: Record<string, string> } }
+			>;
+		};
+		expect(settings.mcpServers?.smoke?.disabled).toBeUndefined();
+		expect(settings.mcpServers?.smoke?.oauth?.tokens?.access_token).toBe(
+			"token",
+		);
+	});
+
+	it.skipIf(process.platform === "win32")(
+		"does not mark plugin disabled when MCP disable write fails",
+		async () => {
+			const tempRoot = await mkdtemp(join(tmpdir(), "cli-config-data-"));
+			tempRoots.push(tempRoot);
+			const settingsPath = join(tempRoot, "cline_mcp_settings.json");
+			const globalSettingsPath = join(tempRoot, "global-settings.json");
+			process.env.CLINE_GLOBAL_SETTINGS_PATH = globalSettingsPath;
+			process.env.CLINE_MCP_SETTINGS_PATH = settingsPath;
+			const pluginPath = await writeMcpSettingsPlugin(tempRoot);
+			await writeFile(
+				settingsPath,
+				`${JSON.stringify(
+					{
+						mcpServers: {
+							smoke: {
+								transport: {
+									type: "stdio",
+									command: process.execPath,
+									args: ["-e", "process.exit(0)"],
+								},
+								metadata: {
+									source: "plugin",
+									pluginName: "settings-mcp-plugin",
+									pluginPath,
+								},
+							},
+						},
+					},
+					null,
+					2,
+				)}\n`,
+			);
+			await chmod(settingsPath, 0o444);
+			const loader = createInteractiveConfigDataLoader({
+				config: createConfig(tempRoot),
+			});
+
+			try {
+				await expect(
+					loader.onToggleConfigItem({
+						id: pluginPath,
+						name: "settings-mcp-plugin",
+						path: pluginPath,
+						enabled: true,
+						source: "workspace-plugin",
+						kind: "plugin",
+					}),
+				).rejects.toThrow();
+			} finally {
+				await chmod(settingsPath, 0o644);
+			}
+
+			await expect(readFile(globalSettingsPath, "utf8")).rejects.toThrow();
+			const settings = JSON.parse(await readFile(settingsPath, "utf8")) as {
+				mcpServers?: Record<string, { disabled?: boolean }>;
+			};
+			expect(settings.mcpServers?.smoke?.disabled).toBeUndefined();
+		},
+	);
+
 	it("surfaces MCP OAuth status and errors", async () => {
 		const tempRoot = await mkdtemp(join(tmpdir(), "cli-config-data-"));
 		tempRoots.push(tempRoot);

apps/cli/src/runtime/interactive/config-data.ts

@@ -1,7 +1,9 @@
 import {
 	createCoreSettingsService,
+	disablePluginMcpServersInSettings,
 	setDisabledPlugin,
 	setDisabledTools,
+	syncPluginMcpServersToSettings,
 	type UserInstructionConfigService,
 	uninstallPlugin,
 } from "@cline/core";
@@ -70,7 +72,32 @@ export function createInteractiveConfigDataLoader(input: {
 		}
 
 		if (item.kind === "plugin" && typeof item.enabled === "boolean") {
-			setDisabledPlugin(item.path, item.enabled);
+			if (item.enabled) {
+				disablePluginMcpServersInSettings({ pluginPaths: [item.path] });
+				setDisabledPlugin(item.path, true);
+			} else {
+				const ownedMcpMutations = disablePluginMcpServersInSettings({
+					pluginPaths: [item.path],
+				});
+				const result = await syncPluginMcpServersToSettings({
+					pluginPaths: [item.path],
+					cwd: input.config.cwd,
+					workspacePath: workspaceRoot(),
+					providerId: input.config.providerId,
+					modelId: input.config.modelId,
+				});
+				if (ownedMcpMutations.length > 0 && result.failures.length > 0) {
+					throw new Error(
+						`Failed to sync plugin MCP servers: ${result.failures
+							.map((failure) => {
+								const plugin = failure.pluginName ?? failure.pluginPath;
+								return `${plugin}: ${failure.message}`;
+							})
+							.join("; ")}`,
+					);
+				}
+				setDisabledPlugin(item.path, false);
+			}
 			return undefined;
 		}
 

apps/cli/src/runtime/interactive/session-runtime.test.ts

@@ -152,7 +152,10 @@ function deferred<T>() {
 
 function makeRuntime(
 	manager: ReturnType<typeof makeManager>,
-	options: { resumeSessionId?: string } = {},
+	options: {
+		resumeSessionId?: string;
+		resolveToolPolicy?: (toolName: string) => Config["toolPolicies"][string];
+	} = {},
 ) {
 	mockCreateCliCore.mockResolvedValue(manager);
 	const config = makeConfig();
@@ -164,6 +167,8 @@ function makeRuntime(
 		requestToolApproval: async (
 			_request: ToolApprovalRequest,
 		): Promise<ToolApprovalResult> => ({ approved: true }),
+		resolveToolPolicy:
+			options.resolveToolPolicy ?? (() => ({ autoApprove: true })),
 		askQuestionRef: { current: null },
 		resolveMistakeLimitDecision: undefined,
 		switchToActModeTool: makeSwitchToActModeTool(),
@@ -205,6 +210,68 @@ describe("createInteractiveSessionRuntime", () => {
 		expect(runtime.getActiveSessionId()).toBe("session-2");
 	});
 
+	it("adds a live interactive approval policy hook to started sessions", async () => {
+		const manager = makeManager();
+		const upstreamBeforeTool = vi.fn(async () => ({
+			input: { text: "updated" },
+		}));
+		mockCreateRuntimeHooks.mockReturnValueOnce({
+			hooks: {
+				beforeTool: upstreamBeforeTool,
+			},
+			shutdown: vi.fn(async () => {}),
+		});
+		const runtime = makeRuntime(manager, {
+			resolveToolPolicy: (toolName) => ({
+				autoApprove: toolName === "echo",
+			}),
+		});
+
+		await runtime.ensureReady();
+
+		const startInput = manager.start.mock.calls[0]?.[0] as
+			| { config?: Config }
+			| undefined;
+		const beforeTool = startInput?.config?.hooks?.beforeTool;
+		expect(beforeTool).toBeTypeOf("function");
+
+		const result = await beforeTool?.({
+			snapshot: {
+				agentId: "agent-1",
+				conversationId: "conversation-1",
+				status: "running",
+				iteration: 1,
+				messages: [],
+				pendingToolCalls: [],
+				usage: {
+					inputTokens: 0,
+					outputTokens: 0,
+					cacheReadTokens: 0,
+					cacheWriteTokens: 0,
+				},
+			},
+			tool: {
+				name: "echo",
+				description: "",
+				inputSchema: {},
+				execute: async () => "ok",
+			},
+			toolCall: {
+				type: "tool-call",
+				toolCallId: "call-1",
+				toolName: "echo",
+				input: { text: "original" },
+			},
+			input: { text: "original" },
+		});
+
+		expect(upstreamBeforeTool).toHaveBeenCalledOnce();
+		expect(result).toEqual({
+			input: { text: "updated" },
+			policy: { autoApprove: true },
+		});
+	});
+
 	it("starts fresh after resetting an initially resumed session", async () => {
 		const manager = makeManager();
 		const runtime = makeRuntime(manager, {

apps/cli/src/runtime/interactive/session-runtime.ts

@@ -1,5 +1,6 @@
 import {
 	type AgentEvent,
+	type AgentHooks,
 	type CheckpointEntry,
 	isSessionNotFoundError,
 	type PendingPromptMutationResult,
@@ -48,6 +49,32 @@ type CurrentTurnResult = Awaited<ReturnType<CliCore["send"]>>;
 type AskQuestionRef = {
 	current: ((question: string, options: string[]) => Promise<string>) | null;
 };
+type ToolPolicyResolver = (
+	toolName: string,
+) => NonNullable<Config["toolPolicies"]>[string];
+
+function withInteractiveApprovalPolicyHook(
+	hooks: AgentHooks | undefined,
+	resolveToolPolicy: ToolPolicyResolver,
+): AgentHooks {
+	return {
+		...hooks,
+		beforeTool: async (ctx) => {
+			const result = await hooks?.beforeTool?.(ctx);
+			if (result?.stop || result?.skip) {
+				return result;
+			}
+			const policy = resolveToolPolicy(ctx.toolCall.toolName);
+			return {
+				...result,
+				policy: {
+					...result?.policy,
+					autoApprove: policy.autoApprove,
+				},
+			};
+		},
+	};
+}
 
 export function createInteractiveSessionRuntime(input: {
 	config: Config;
@@ -58,6 +85,7 @@ export function createInteractiveSessionRuntime(input: {
 	requestToolApproval: (
 		request: ToolApprovalRequest,
 	) => Promise<ToolApprovalResult>;
+	resolveToolPolicy: ToolPolicyResolver;
 	askQuestionRef: AskQuestionRef;
 	resolveMistakeLimitDecision: Config["onConsecutiveMistakeLimitReached"];
 	switchToActModeTool: NonNullable<Config["extraTools"]>[number];
@@ -152,10 +180,14 @@ export function createInteractiveSessionRuntime(input: {
 		if (!runtimeHooks) {
 			throw new Error("interactive runtime hooks are unavailable");
 		}
+		const hooks = withInteractiveApprovalPolicyHook(
+			runtimeHooks.hooks,
+			input.resolveToolPolicy,
+		);
 		return buildInteractiveSessionConfig({
 			config: input.config,
 			chatCommandState: input.chatCommandState,
-			runtimeHooks,
+			runtimeHooks: { hooks },
 			onTeamEvent: input.onTeamEvent,
 			resolveMistakeLimitDecision: input.resolveMistakeLimitDecision,
 		});

apps/cli/src/runtime/run-agent.test.ts

@@ -27,7 +27,41 @@ const outputMocks = vi.hoisted(() => ({
 	c: { dim: "", reset: "" },
 }));
 
+const sessionEventsMocks = vi.hoisted(() => ({
+	listener: undefined as ((event: unknown) => void) | undefined,
+	subscribeToAgentEvents: vi.fn(
+		(_: unknown, listener: (event: unknown) => void) => {
+			sessionEventsMocks.listener = listener;
+			return () => {};
+		},
+	),
+}));
+
+const CLINE_PASS_SUBSCRIPTION_URL =
+	"https://app.cline.bot/dashboard/subscription?personal=true";
+const CLINE_PASS_SUBSCRIPTION_MESSAGE = `No access to ClinePass subscription models yet. Subscribe to ClinePass, the low cost open weights model coding plan: ${CLINE_PASS_SUBSCRIPTION_URL}`;
+const CLINE_ORG_INDIVIDUAL_INFERENCE_SUBSCRIPTION_MESSAGE =
+	"Organization accounts cannot use ClinePass subscriptions. Go to /account -> change account to switch to your personal account for ClinePass";
+
 vi.mock("@cline/core", () => ({
+	getClineOrgIndividualInferenceSubscriptionMessage: () =>
+		CLINE_ORG_INDIVIDUAL_INFERENCE_SUBSCRIPTION_MESSAGE,
+	getClinePassSubscriptionUrl: () => CLINE_PASS_SUBSCRIPTION_URL,
+	isClineNotSubscribedError: (error: unknown) =>
+		error instanceof Error && error.name === "ClineNotSubscribedError",
+	isClineNotSubscribedMessage: (text: string) =>
+		text
+			.toLowerCase()
+			.includes("the user is not subscribed to required model plan"),
+	isClineOrgIndividualInferenceSubscriptionError: (error: unknown) =>
+		error instanceof Error &&
+		error.name === "ClineOrgIndividualInferenceSubscriptionError",
+	isClineOrgIndividualInferenceSubscriptionMessage: (text: string) =>
+		text
+			.toLowerCase()
+			.includes(
+				"organization accounts cannot use individual model inference subscriptions",
+			),
 	prewarmFileIndex: vi.fn(async () => undefined),
 	SessionSource: {
 		CLI: "cli",
@@ -77,7 +111,7 @@ vi.mock("./prompt", () => ({
 }));
 
 vi.mock("./session-events", () => ({
-	subscribeToAgentEvents: vi.fn(() => () => {}),
+	subscribeToAgentEvents: sessionEventsMocks.subscribeToAgentEvents,
 }));
 
 describe("runAgent", () => {
@@ -101,6 +135,9 @@ describe("runAgent", () => {
 		outputMocks.writeln.mockReset();
 		outputMocks.emitJsonLine.mockReset();
 		outputMocks.setActiveCliSession.mockReset();
+		sessionEventsMocks.listener = undefined;
+		sessionEventsMocks.subscribeToAgentEvents.mockClear();
+		vi.unstubAllGlobals();
 	});
 
 	afterEach(() => {
@@ -511,6 +548,39 @@ describe("runAgent", () => {
 		expect(outputMocks.writeErr).toHaveBeenCalledWith("Missing API key");
 	});
 
+	it("renders ClinePass subscription errors with friendly copy when startup throws", async () => {
+		const error = new Error(CLINE_PASS_SUBSCRIPTION_MESSAGE);
+		error.name = "ClineNotSubscribedError";
+		sessionManagerMocks.start.mockRejectedValue(error);
+
+		const { runAgent } = await import("./run-agent");
+
+		await expect(
+			runAgent("test prompt", {
+				cwd: process.cwd(),
+				enableAgentTeams: false,
+				enableSpawnAgent: false,
+				enableTools: [],
+				execution: { maxConsecutiveMistakes: 3 },
+				logger: undefined,
+				mode: "yolo",
+				modelId: "premium-model",
+				outputMode: "text",
+				providerId: "cline-pass",
+				systemPrompt: "system",
+				thinking: false,
+				toolPolicies: { "*": { autoApprove: true } },
+				verbose: false,
+				workspaceRoot: process.cwd(),
+			} as never),
+		).resolves.toBeUndefined();
+
+		expect(process.exitCode).toBe(1);
+		expect(outputMocks.writeErr).toHaveBeenCalledWith(
+			CLINE_PASS_SUBSCRIPTION_MESSAGE,
+		);
+	});
+
 	it("emits JSON error lines for non-completed results", async () => {
 		const startedAt = new Date("2026-03-22T00:00:00.000Z");
 		const endedAt = new Date("2026-03-22T00:00:01.000Z");
@@ -576,6 +646,63 @@ describe("runAgent", () => {
 		);
 	});
 
+	it("renders ClinePass subscription errors with friendly copy for failed results", async () => {
+		const startedAt = new Date("2026-03-22T00:00:00.000Z");
+		const endedAt = new Date("2026-03-22T00:00:01.000Z");
+		sessionManagerMocks.start.mockResolvedValue({
+			sessionId: "session-1",
+			manifestPath: "/tmp/manifest.json",
+			messagesPath: "/tmp/messages.json",
+			manifest: { session_id: "session-1" },
+			result: {
+				text: CLINE_PASS_SUBSCRIPTION_MESSAGE,
+				usage: {
+					inputTokens: 0,
+					outputTokens: 0,
+					cacheReadTokens: 0,
+					cacheWriteTokens: 0,
+					totalCost: 0,
+				},
+				messages: [],
+				toolCalls: [],
+				iterations: 1,
+				finishReason: "error",
+				model: { id: "premium-model", provider: "cline-pass", info: {} },
+				startedAt,
+				endedAt,
+				durationMs: 1000,
+			},
+		});
+		sessionManagerMocks.getAccumulatedUsage.mockResolvedValue(undefined);
+
+		const { runAgent } = await import("./run-agent");
+
+		await expect(
+			runAgent("test prompt", {
+				cwd: process.cwd(),
+				enableAgentTeams: false,
+				enableSpawnAgent: false,
+				enableTools: [],
+				execution: { maxConsecutiveMistakes: 3 },
+				logger: undefined,
+				mode: "yolo",
+				modelId: "premium-model",
+				outputMode: "text",
+				providerId: "cline-pass",
+				systemPrompt: "system",
+				thinking: false,
+				toolPolicies: { "*": { autoApprove: true } },
+				verbose: false,
+				workspaceRoot: process.cwd(),
+			} as never),
+		).resolves.toBeUndefined();
+
+		expect(process.exitCode).toBe(1);
+		expect(outputMocks.writeErr).toHaveBeenCalledWith(
+			CLINE_PASS_SUBSCRIPTION_MESSAGE,
+		);
+	});
+
 	it("surfaces post-run bookkeeping failures after a completed result", async () => {
 		const startedAt = new Date("2026-03-22T00:00:00.000Z");
 		const endedAt = new Date("2026-03-22T00:00:01.000Z");
@@ -837,4 +964,121 @@ describe("runAgent", () => {
 			expect.stringContaining("est. cost"),
 		);
 	});
+
+	it("zeros Cline free model costs in JSON results and agent events", async () => {
+		const startedAt = new Date("2026-03-22T00:00:00.000Z");
+		const endedAt = new Date("2026-03-22T00:00:01.000Z");
+		vi.stubGlobal(
+			"fetch",
+			vi.fn(async () => {
+				return new Response(
+					JSON.stringify({
+						free: [{ id: "deepseek/deepseek-v4-flash" }],
+					}),
+					{ status: 200, headers: { "content-type": "application/json" } },
+				);
+			}),
+		);
+		sessionManagerMocks.start.mockResolvedValue({
+			sessionId: "session-1",
+			manifestPath: "/tmp/manifest.json",
+			messagesPath: "/tmp/messages.json",
+			manifest: {
+				session_id: "session-1",
+			},
+			result: {
+				text: "completed text",
+				usage: {
+					inputTokens: 1,
+					outputTokens: 1,
+					cacheReadTokens: 0,
+					cacheWriteTokens: 0,
+					totalCost: 0.25,
+				},
+				messages: [],
+				toolCalls: [],
+				iterations: 1,
+				finishReason: "completed",
+				model: {
+					id: "deepseek/deepseek-v4-flash",
+					provider: "cline",
+					info: {},
+				},
+				startedAt,
+				endedAt,
+				durationMs: 1000,
+			},
+		});
+		sessionManagerMocks.getAccumulatedUsage.mockResolvedValue({
+			usage: {
+				inputTokens: 1,
+				outputTokens: 1,
+				cacheReadTokens: 0,
+				cacheWriteTokens: 0,
+				totalCost: 0.25,
+			},
+			aggregateUsage: {
+				inputTokens: 1,
+				outputTokens: 1,
+				cacheReadTokens: 0,
+				cacheWriteTokens: 0,
+				totalCost: 0.25,
+			},
+		});
+
+		const { runAgent } = await import("./run-agent");
+		const { handleEvent } = await import("../utils/events");
+
+		await expect(
+			runAgent("test prompt", {
+				baseUrl: "https://cline.test/api/v1",
+				cwd: process.cwd(),
+				enableAgentTeams: false,
+				enableSpawnAgent: false,
+				enableTools: [],
+				execution: {
+					maxConsecutiveMistakes: 3,
+				},
+				logger: undefined,
+				mode: "yolo",
+				modelId: "deepseek/deepseek-v4-flash",
+				outputMode: "json",
+				providerId: "cline",
+				systemPrompt: "system",
+				thinking: false,
+				toolPolicies: { "*": { autoApprove: true } },
+				verbose: false,
+				workspaceRoot: process.cwd(),
+			} as never),
+		).resolves.toBeUndefined();
+
+		const runResult = outputMocks.emitJsonLine.mock.calls.find(
+			([, payload]) =>
+				(payload as { type?: string } | undefined)?.type === "run_result",
+		)?.[1] as
+			| {
+					usage?: { totalCost?: number };
+					aggregateUsage?: { totalCost?: number };
+			  }
+			| undefined;
+		expect(runResult?.usage?.totalCost).toBe(0);
+		expect(runResult?.aggregateUsage?.totalCost).toBe(0);
+
+		sessionEventsMocks.listener?.({
+			type: "usage",
+			inputTokens: 1,
+			outputTokens: 1,
+			cost: 0.25,
+			totalCost: 0.25,
+		});
+
+		expect(handleEvent).toHaveBeenLastCalledWith(
+			expect.objectContaining({
+				type: "usage",
+				cost: 0,
+				totalCost: 0,
+			}),
+			expect.any(Object),
+		);
+	});
 });

apps/cli/src/runtime/run-agent.ts

@@ -16,7 +16,13 @@ import {
 	requestToolApproval,
 	submitAndExitInTerminal,
 } from "../utils/approval";
+import { formatCliErrorMessage } from "../utils/cline-pass-errors";
 import { handleEvent, handleTeamEvent } from "../utils/events";
+import {
+	shouldZeroClineFreeModelCost,
+	zeroCliAgentEventCost,
+	zeroCliUsageCost,
+} from "../utils/free-model-cost";
 import { createRuntimeHooks } from "../utils/hooks";
 import {
 	c,
@@ -183,8 +189,10 @@ export async function runAgent(
 	let reasoningChunkCount = 0;
 	let redactedReasoningChunkCount = 0;
 	const displayedErrorMessages = new Set<string>();
+	const shouldZeroCost = await shouldZeroClineFreeModelCost(config);
 
-	const onAgentEvent = (event: AgentEvent): void => {
+	const onAgentEvent = (rawEvent: AgentEvent): void => {
+		const event = zeroCliAgentEventCost(rawEvent, shouldZeroCost);
 		if (event.type === "content_start" && event.contentType === "reasoning") {
 			reasoningChunkCount += 1;
 			if (event.redacted) {
@@ -338,8 +346,14 @@ export async function runAgent(
 		const usageSummary = await sessionManager.getAccumulatedUsage(
 			started.sessionId,
 		);
-		const aggregateUsage = usageSummary?.aggregateUsage;
-		const usage = aggregateUsage ?? usageSummary?.usage ?? result.usage;
+		const aggregateUsage = zeroCliUsageCost(
+			usageSummary?.aggregateUsage,
+			shouldZeroCost,
+		);
+		const usage = zeroCliUsageCost(
+			aggregateUsage ?? usageSummary?.usage ?? result.usage,
+			shouldZeroCost,
+		);
 
 		if (config.outputMode === "json") {
 			emitJsonLine("stdout", {
@@ -374,7 +388,7 @@ export async function runAgent(
 		}
 
 		if (result.finishReason !== "completed") {
-			const errorText = result.text.trim();
+			const errorText = formatCliErrorMessage(result.text).trim();
 			if (
 				errorText &&
 				(config.outputMode === "json" || !displayedErrorMessages.has(errorText))
@@ -395,7 +409,7 @@ export async function runAgent(
 		);
 		process.exitCode = 0;
 	} catch (err) {
-		const message = err instanceof Error ? err.message : String(err);
+		const message = formatCliErrorMessage(err);
 		logCliError(config.logger, "CLI task run failed", { error: err });
 		writeErr(message);
 		process.exitCode = 1;

apps/cli/src/runtime/run-interactive.ts

@@ -24,6 +24,11 @@ import { disableOpenTuiGraphicsProbe } from "../tui/opentui-env";
 import type { QueuedPromptItem } from "../tui/types";
 import { type ChatCommandState, chatCommandHost } from "../utils/chat-commands";
 import { applyCliCompactionMode } from "../utils/compaction-mode";
+import {
+	shouldZeroClineFreeModelCost,
+	zeroCliAgentEventCost,
+	zeroCliUsageCost,
+} from "../utils/free-model-cost";
 import {
 	prepareTerminalForPostTuiOutput,
 	writeErr,
@@ -121,6 +126,7 @@ export async function runInteractive(
 		autoApproveAllRef,
 		setInteractiveAutoApprove,
 		requestToolApproval,
+		resolveToolPolicy,
 		tuiToolApprover,
 		tuiAskQuestion,
 	} = createInteractiveApprovalController(config);
@@ -152,6 +158,7 @@ export async function runInteractive(
 		askQuestionRef: tuiAskQuestion,
 	});
 	const providerSettingsManager = new ProviderSettingsManager();
+	let zeroCurrentTurnCost = false;
 
 	const sessionRuntime = createInteractiveSessionRuntime({
 		config,
@@ -160,11 +167,12 @@ export async function runInteractive(
 		resumeSessionId,
 		chatCommandState,
 		requestToolApproval,
+		resolveToolPolicy,
 		askQuestionRef: tuiAskQuestion,
 		resolveMistakeLimitDecision,
 		switchToActModeTool,
 		onAgentEvent: (event) => {
-			uiEvents.emit("agent", event);
+			uiEvents.emit("agent", zeroCliAgentEventCost(event, zeroCurrentTurnCost));
 		},
 		onTeamEvent: (event) => {
 			uiEvents.emit("team", event);
@@ -430,6 +438,7 @@ export async function runInteractive(
 		},
 		onSubmit: async (input, mode, delivery, attachments, onCommandOutput) => {
 			let commandOutput: string | undefined;
+			let zeroTurnCost = false;
 			try {
 				await sessionRuntime.ensureReady();
 				await waitForSubmittedMode(mode);
@@ -476,6 +485,8 @@ export async function runInteractive(
 				}
 				input = chatCommandResult.input;
 				commandOutput = chatCommandResult.commandOutput;
+				zeroTurnCost = await shouldZeroClineFreeModelCost(config);
+				zeroCurrentTurnCost = zeroTurnCost;
 				const {
 					prompt: userInput,
 					userImages,
@@ -517,8 +528,9 @@ export async function runInteractive(
 				}
 				if (result.finishReason !== "completed") {
 					if (result.finishReason === "aborted" || isAbortInProgress()) {
-						const usage = await sessionRuntime.getAccumulatedUsage(
-							result.usage,
+						const usage = zeroCliUsageCost(
+							await sessionRuntime.getAccumulatedUsage(result.usage),
+							zeroTurnCost,
 						);
 						return {
 							usage,
@@ -533,7 +545,10 @@ export async function runInteractive(
 						errorText || `Turn finished with ${result.finishReason}`,
 					);
 				}
-				const usage = await sessionRuntime.getAccumulatedUsage(result.usage);
+				const usage = zeroCliUsageCost(
+					await sessionRuntime.getAccumulatedUsage(result.usage),
+					zeroTurnCost,
+				);
 				return {
 					usage,
 					currentContextSize: getCurrentContextSize(result.messages),
@@ -557,6 +572,7 @@ export async function runInteractive(
 				});
 				throw error;
 			} finally {
+				zeroCurrentTurnCost = false;
 				if (!delivery) {
 					isRunning = false;
 					clearAbortInProgress();

apps/cli/src/runtime/tool-policies.test.ts

@@ -2,6 +2,7 @@ import { describe, expect, it } from "vitest";
 import {
 	applyInteractiveAutoApproveOverride,
 	cloneToolPolicies,
+	resolveInteractiveAutoApprovePolicy,
 } from "./tool-policies";
 
 describe("tool policy helpers", () => {
@@ -53,9 +54,9 @@ describe("tool policy helpers", () => {
 		});
 	});
 
-	it("restores the baseline policies when toggled back on", () => {
+	it("forces all baseline policies to auto-approve when toggled back on", () => {
 		const baseline = {
-			"*": { autoApprove: true },
+			"*": { autoApprove: false },
 			run_commands: { autoApprove: true, enabled: true },
 			editor: { autoApprove: false, enabled: true },
 		};
@@ -72,6 +73,40 @@ describe("tool policy helpers", () => {
 			enabled: true,
 		});
 
-		expect(target).toEqual(baseline);
+		expect(target).toEqual({
+			"*": { autoApprove: true },
+			run_commands: { autoApprove: true, enabled: true },
+			editor: { autoApprove: true, enabled: true },
+		});
+	});
+
+	it("resolves live per-tool policies from the interactive auto-approve state", () => {
+		const baseline = {
+			"*": { autoApprove: false },
+			read_files: { enabled: true },
+			editor: { autoApprove: false, enabled: true },
+		};
+
+		expect(
+			resolveInteractiveAutoApprovePolicy({
+				toolName: "editor",
+				baselinePolicies: baseline,
+				enabled: true,
+			}),
+		).toEqual({ autoApprove: true, enabled: true });
+		expect(
+			resolveInteractiveAutoApprovePolicy({
+				toolName: "run_commands",
+				baselinePolicies: baseline,
+				enabled: false,
+			}),
+		).toEqual({ autoApprove: false });
+		expect(
+			resolveInteractiveAutoApprovePolicy({
+				toolName: "read_files",
+				baselinePolicies: baseline,
+				enabled: false,
+			}),
+		).toEqual({ autoApprove: true, enabled: true });
 	});
 });

apps/cli/src/runtime/tool-policies.ts

@@ -27,21 +27,51 @@ export function cloneToolPolicies(
 	);
 }
 
+export function resolveInteractiveAutoApprovePolicy(input: {
+	toolName: string;
+	baselinePolicies: Record<string, ToolPolicy>;
+	enabled: boolean;
+}): ToolPolicy {
+	const toolPolicy = input.baselinePolicies[input.toolName] ?? {};
+	const baselinePolicy = {
+		...(input.baselinePolicies["*"] ?? {}),
+		...toolPolicy,
+	};
+	return {
+		...baselinePolicy,
+		autoApprove: input.enabled
+			? true
+			: SAFE_AUTO_APPROVE_TOOLS.has(input.toolName)
+				? (toolPolicy.autoApprove ?? true)
+				: false,
+	};
+}
+
 export function applyInteractiveAutoApproveOverride(input: {
 	targetPolicies: Record<string, ToolPolicy>;
 	baselinePolicies: Record<string, ToolPolicy>;
 	enabled: boolean;
 }): void {
 	const nextPolicies: Record<string, ToolPolicy> = input.enabled
-		? cloneToolPolicies(input.baselinePolicies)
+		? Object.fromEntries(
+				Object.entries(input.baselinePolicies).map(([name, policy]) => [
+					name,
+					{
+						...policy,
+						autoApprove: true,
+					},
+				]),
+			)
 		: Object.fromEntries(
 				Object.entries(input.baselinePolicies).map(([name, policy]) => [
 					name,
 					{
 						...policy,
-						autoApprove: SAFE_AUTO_APPROVE_TOOLS.has(name)
-							? (policy.autoApprove ?? true)
-							: false,
+						autoApprove: resolveInteractiveAutoApprovePolicy({
+							toolName: name,
+							baselinePolicies: input.baselinePolicies,
+							enabled: false,
+						}).autoApprove,
 					},
 				]),
 			);
@@ -53,9 +83,7 @@ export function applyInteractiveAutoApproveOverride(input: {
 	}
 
 	const globalPolicy = clonePolicy(nextPolicies["*"]);
-	globalPolicy.autoApprove = input.enabled
-		? (input.baselinePolicies["*"]?.autoApprove ?? true)
-		: false;
+	globalPolicy.autoApprove = input.enabled;
 	nextPolicies["*"] = globalPolicy;
 
 	for (const key of Object.keys(input.targetPolicies)) {

apps/cli/src/tui/cline-account.ts

@@ -210,7 +210,7 @@ async function onChangeToClinePass(config: ClineAccountConfig) {
 			organizationId: null,
 		});
 	} catch (error) {
-		config.logger?.debug("Failed to switch Cline Pass to personal account", {
+		config.logger?.debug("Failed to switch ClinePass to personal account", {
 			error,
 		});
 	}

apps/cli/src/tui/components/chat-entry.tsx

@@ -2,6 +2,12 @@ import { useTerminalDimensions } from "@opentui/react";
 import type React from "react";
 import { useState } from "react";
 import "opentui-spinner/react";
+import {
+	getClineOrgIndividualInferenceSubscriptionMessage,
+	getClinePassSubscriptionUrl,
+	isClineOrgIndividualInferenceSubscriptionErrorMessage,
+	isClinePassSubscriptionError,
+} from "../../utils/cline-pass-errors";
 import {
 	CLINE_CREDITS_DASHBOARD_URL,
 	isClineAccountCreditsErrorMessage,
@@ -290,6 +296,65 @@ function ClineCreditsErrorView(props: { defaultFg?: string }) {
 	);
 }
 
+function ClinePassSubscriptionErrorView(props: { defaultFg?: string }) {
+	const subscriptionUrl = getClinePassSubscriptionUrl();
+	return (
+		<box flexDirection="row">
+			<text fg="yellow" content="* " />
+			<box
+				flexDirection="column"
+				border
+				borderStyle="rounded"
+				borderColor="yellow"
+				paddingX={1}
+			>
+				<text fg="yellow">ClinePass subscription required</text>
+				<text
+					fg={props.defaultFg}
+					selectable
+					content="No access to ClinePass subscription models yet. Subscribe to ClinePass, the low cost open weights model coding plan."
+				/>
+				<box flexDirection="row">
+					<text fg="gray">Subscribe: </text>
+					<text fg="cyan" selectable>
+						<a href={subscriptionUrl}>Open subscription page</a>
+					</text>
+				</box>
+				<box flexDirection="row">
+					<text fg="gray">URL: </text>
+					<text fg="cyan" selectable>
+						<a href={subscriptionUrl}>{subscriptionUrl}</a>
+					</text>
+				</box>
+			</box>
+		</box>
+	);
+}
+
+function ClineOrgIndividualInferenceSubscriptionErrorView(props: {
+	defaultFg?: string;
+}) {
+	return (
+		<box flexDirection="row">
+			<text fg="yellow" content="* " />
+			<box
+				flexDirection="column"
+				border
+				borderStyle="rounded"
+				borderColor="yellow"
+				paddingX={1}
+			>
+				<text fg="yellow">Personal ClinePass required</text>
+				<text
+					fg={props.defaultFg}
+					selectable
+					content={getClineOrgIndividualInferenceSubscriptionMessage()}
+				/>
+			</box>
+		</box>
+	);
+}
+
 export function ChatEntryView(props: {
 	entry: ChatEntry;
 	accent?: string;
@@ -388,6 +453,14 @@ export function ChatEntryView(props: {
 			if (isClineAccountCreditsErrorMessage(entry.text)) {
 				return <ClineCreditsErrorView defaultFg={defaultFg} />;
 			}
+			if (isClineOrgIndividualInferenceSubscriptionErrorMessage(entry.text)) {
+				return (
+					<ClineOrgIndividualInferenceSubscriptionErrorView defaultFg={defaultFg} />
+				);
+			}
+			if (isClinePassSubscriptionError(entry.text)) {
+				return <ClinePassSubscriptionErrorView defaultFg={defaultFg} />;
+			}
 			return (
 				<box flexDirection="row">
 					<text fg="red" content="* " />

apps/cli/src/tui/components/dialogs/mcp-manager-dialog.test.ts

@@ -58,7 +58,11 @@ describe("mcp manager dialog helpers", () => {
 	};
 
 	afterEach(async () => {
-		process.env.CLINE_MCP_SETTINGS_PATH = envSnapshot.CLINE_MCP_SETTINGS_PATH;
+		if (envSnapshot.CLINE_MCP_SETTINGS_PATH === undefined) {
+			delete process.env.CLINE_MCP_SETTINGS_PATH;
+		} else {
+			process.env.CLINE_MCP_SETTINGS_PATH = envSnapshot.CLINE_MCP_SETTINGS_PATH;
+		}
 		await Promise.all(
 			tempRoots.map((directory) =>
 				rm(directory, { recursive: true, force: true }),
@@ -107,6 +111,44 @@ describe("mcp manager dialog helpers", () => {
 		).toBeUndefined();
 	});
 
+	it("does not toggle plugin-owned servers", async () => {
+		const tempRoot = await mkdtemp(join(tmpdir(), "cli-mcp-manager-"));
+		tempRoots.push(tempRoot);
+		const settingsPath = join(tempRoot, "cline_mcp_settings.json");
+		await writeFile(
+			settingsPath,
+			`${JSON.stringify(
+				{
+					mcpServers: {
+						docs: {
+							transport: {
+								type: "stdio",
+								command: "node",
+							},
+						},
+					},
+				},
+				null,
+				2,
+			)}\n`,
+		);
+
+		const result = toggleMcpServer({
+			name: "docs",
+			path: settingsPath,
+			enabled: true,
+			pluginName: "repo-docs",
+		});
+
+		expect(result.ok).toBe(false);
+		if (!result.ok) {
+			expect(result.message).toContain('managed by plugin "repo-docs"');
+		}
+		expect((await readSettings(settingsPath)).mcpServers?.docs?.disabled).toBe(
+			undefined,
+		);
+	});
+
 	it("returns a visible error message when toggling fails", async () => {
 		const tempRoot = await mkdtemp(join(tmpdir(), "cli-mcp-manager-"));
 		tempRoots.push(tempRoot);

apps/cli/src/tui/components/dialogs/mcp-manager-dialog.tsx

@@ -13,6 +13,7 @@ export interface McpEntry {
 	enabled?: boolean;
 	description?: string;
 	lastError?: string;
+	pluginName?: string;
 }
 
 export type McpServerToggleResult =
@@ -36,6 +37,12 @@ export function getMcpManagerEntryStatus(
 }
 
 export function toggleMcpServer(server: McpEntry): McpServerToggleResult {
+	if (server.pluginName) {
+		return {
+			ok: false,
+			message: `MCP server "${server.name}" is managed by plugin "${server.pluginName}". Disable the plugin to disable this server.`,
+		};
+	}
 	try {
 		const currentlyEnabled = server.enabled !== false;
 		setMcpServerDisabled({
@@ -71,6 +78,7 @@ export function McpManagerContent(
 	const settingsPath = servers[0]?.path ?? resolveDefaultMcpSettingsPath();
 	const itemCount = servers.length;
 	const selectedServer = servers[selected];
+	const hasPluginOwnedServers = servers.some((server) => server.pluginName);
 
 	useDialogKeyboard((key) => {
 		if (key.name === "escape") {
@@ -150,6 +158,7 @@ export function McpManagerContent(
 									{isSel ? "\u25b8 " : "  "}
 									{enabledIcon}
 									{srv.name}
+									{srv.pluginName ? " *" : ""}
 								</text>
 								{status && (
 									<text fg={srv.lastError ? palette.error : "gray"}>
@@ -184,6 +193,12 @@ export function McpManagerContent(
 				</box>
 			)}
 
+			{hasPluginOwnedServers && (
+				<text fg="gray" marginTop={1}>
+					* managed by plugin; disable the plugin to disable the server.
+				</text>
+			)}
+
 			<text fg="gray" marginTop={1}>
 				<em>{getMcpManagerFooterText(servers.length > 0)}</em>
 			</text>

apps/cli/src/tui/components/model-selector/model-selector.tsx

@@ -134,6 +134,7 @@ export function ModelSelectorContent(
 		currentModel: string;
 		currentProviderName: string;
 		models: ModelOption[];
+		showCustomModelId?: boolean;
 	},
 ) {
 	const {
@@ -143,6 +144,7 @@ export function ModelSelectorContent(
 		currentModel,
 		currentProviderName,
 		models,
+		showCustomModelId = true,
 	} = props;
 	const [search, setSearch] = useState("");
 	const [selected, setSelected] = useState(() => {
@@ -164,7 +166,7 @@ export function ModelSelectorContent(
 		return scored.map((r) => r.model);
 	}, [models, search]);
 
-	const optionCount = filtered.length + 1;
+	const optionCount = filtered.length + (showCustomModelId ? 1 : 0);
 	const safeSelected = Math.min(selected, Math.max(0, optionCount - 1));
 
 	useDialogKeyboard((key) => {
@@ -188,7 +190,7 @@ export function ModelSelectorContent(
 				resolve(model.key);
 				return;
 			}
-			if (safeSelected === filtered.length) {
+			if (showCustomModelId && safeSelected === filtered.length) {
 				setIsCreatingCustomModel(true);
 				setCustomModelId("");
 				setCustomModelError("");
@@ -290,6 +292,7 @@ export function ModelSelectorContent(
 				dimmed={onProvider}
 				currentModel={currentModel}
 				onSelect={resolve}
+				showCustomModelId={showCustomModelId}
 				onCreateCustomModel={() => {
 					setIsCreatingCustomModel(true);
 					setCustomModelId("");
@@ -408,6 +411,7 @@ function ModelList(props: {
 	dimmed?: boolean;
 	currentModel: string;
 	onSelect: (key: string) => void;
+	showCustomModelId: boolean;
 	onCreateCustomModel: () => void;
 }) {
 	const {
@@ -416,11 +420,12 @@ function ModelList(props: {
 		dimmed,
 		currentModel,
 		onSelect,
+		showCustomModelId,
 		onCreateCustomModel,
 	} = props;
 	const rows: ({ type: "model"; model: ModelOption } | { type: "custom" })[] = [
 		...items.map((model) => ({ type: "model" as const, model })),
-		{ type: "custom" as const },
+		...(showCustomModelId ? ([{ type: "custom" as const }] as const) : []),
 	];
 
 	if (rows.length <= MAX_VISIBLE) {

apps/cli/src/tui/components/status-bar.test.ts

@@ -57,7 +57,7 @@ describe("formatStatusBarUsageText", () => {
 				totalCost: 0.123,
 				showCost: true,
 			}),
-		).toBe("(12,345) $0.12");
+		).toBe("(12,345 tokens) $0.12");
 	});
 
 	it("omits cost when usage cost is hidden", () => {
@@ -67,6 +67,6 @@ describe("formatStatusBarUsageText", () => {
 				totalCost: 0.123,
 				showCost: false,
 			}),
-		).toBe("(12,345)");
+		).toBe("(12,345 tokens)");
 	});
 });

apps/cli/src/tui/components/status-bar.tsx

@@ -51,7 +51,7 @@ export function formatStatusBarUsageText(input: {
 	totalCost: number;
 	showCost: boolean;
 }): string {
-	const tokens = `(${input.totalTokens.toLocaleString()})`;
+	const tokens = `(${input.totalTokens.toLocaleString()} tokens)`;
 	if (!input.showCost) return tokens;
 	return `${tokens} ${formatCost(input.totalCost)}`;
 }

apps/cli/src/tui/contexts/session-context.tsx

@@ -106,9 +106,9 @@ export function SessionProvider(props: {
 	const [uiMode, setUiMode] = useState<AgentMode>(
 		config.mode === "plan" ? "plan" : "act",
 	);
-	const [autoApproveAll, _setAutoApproveAll] = useState(
-		config.toolPolicies["*"]?.autoApprove !== false,
-	);
+	const initialAutoApproveAll = config.toolPolicies["*"]?.autoApprove !== false;
+	const autoApproveAllRef = useRef(initialAutoApproveAll);
+	const [autoApproveAll, _setAutoApproveAll] = useState(initialAutoApproveAll);
 	const [compactionMode, _setCompactionMode] = useState<CliCompactionMode>(() =>
 		getCliCompactionMode(config),
 	);
@@ -192,11 +192,10 @@ export function SessionProvider(props: {
 	}, []);
 
 	const toggleAutoApprove = useCallback(() => {
-		_setAutoApproveAll((prev) => {
-			const next = !prev;
-			onAutoApproveChange(next);
-			return next;
-		});
+		const next = !autoApproveAllRef.current;
+		autoApproveAllRef.current = next;
+		onAutoApproveChange(next);
+		_setAutoApproveAll(next);
 	}, [onAutoApproveChange]);
 
 	const setCompactionMode = useCallback(

apps/cli/src/tui/history-standalone.tsx

@@ -17,7 +17,9 @@ export async function renderHistoryStandalone(input: {
 	});
 
 	return new Promise((resolve) => {
-		let settled = false;
+		let result: number | string = 0;
+		let resolved = false;
+		let destroyStarted = false;
 		let unmounted = false;
 		const root = createRoot(renderer);
 
@@ -29,24 +31,29 @@ export async function renderHistoryStandalone(input: {
 			root.unmount();
 		};
 
-		const settle = (value: number | string) => {
-			if (settled) {
-				return;
-			}
-			settled = true;
-			unmountRoot();
-			renderer.destroy();
-			resolve(value);
-		};
-
+		// Resolve only once teardown has finished, so callers never run while
+		// the renderer is still restoring the terminal.
 		renderer.on("destroy", () => {
 			unmountRoot();
-			if (!settled) {
-				settled = true;
-				resolve(0);
+			if (!resolved) {
+				resolved = true;
+				resolve(result);
 			}
 		});
 
+		const settle = (value: number | string) => {
+			if (destroyStarted) {
+				return;
+			}
+			destroyStarted = true;
+			result = value;
+			unmountRoot();
+			// Let OpenTUI finish parsing the current stdin batch before teardown.
+			queueMicrotask(() => {
+				renderer.destroy();
+			});
+		};
+
 		root.render(
 			React.createElement(HistoryStandaloneContent, {
 				rows: input.rows,

apps/cli/src/tui/hooks/use-agent-events.ts

@@ -4,6 +4,7 @@ import type {
 	PendingPromptSnapshot,
 	PendingPromptSubmittedEvent,
 } from "../../runtime/session-events";
+import { formatCliErrorMessage } from "../../utils/cline-pass-errors";
 import { resolveStatusNoticeLabel } from "../../utils/events";
 import {
 	formatToolInput,
@@ -171,7 +172,10 @@ export function useAgentEventHandlers(deps: AgentEventDeps) {
 					turnErrorReportedRef.current = true;
 					onTurnErrorReported(true);
 					if (!event.recoverable || verbose) {
-						appendEntry({ kind: "error", text: event.error.message });
+						appendEntry({
+							kind: "error",
+							text: formatCliErrorMessage(event.error),
+						});
 					}
 					break;
 				case "notice":

apps/cli/src/tui/hooks/use-mcp-manager.tsx

@@ -17,6 +17,7 @@ function toMcpEntries(items: InteractiveConfigItem[]): McpEntry[] {
 		enabled: item.enabled,
 		description: item.description,
 		lastError: item.loadError,
+		pluginName: item.pluginName,
 	}));
 }
 

apps/cli/src/tui/hooks/use-model-selector.tsx

@@ -323,6 +323,7 @@ export function useModelSelector(opts: {
 									currentModel={config.modelId}
 									currentProviderName={providerDisplayName}
 									models={modelOptions}
+									showCustomModelId={config.providerId !== "cline-pass"}
 								/>
 							),
 						});
@@ -413,6 +414,7 @@ export function useModelSelector(opts: {
 							currentModel={config.modelId}
 							currentProviderName={providerDisplayName}
 							models={modelOptions}
+							showCustomModelId={config.providerId !== "cline-pass"}
 						/>
 					),
 				});

apps/cli/src/tui/hooks/use-prompt-input-controller.ts

@@ -1,4 +1,5 @@
 import { useCallback, useLayoutEffect, useRef, useState } from "react";
+import { formatCliErrorMessage } from "../../utils/cline-pass-errors";
 import { shouldShowCliUsageCost } from "../../utils/usage-cost-display";
 import type { SlashCommandRegistry } from "../commands/slash-command-registry";
 import {
@@ -376,7 +377,7 @@ export function usePromptInputController(input: {
 				if (!turnErrorReportedRef.current) {
 					session.appendEntry({
 						kind: "error",
-						text: error instanceof Error ? error.message : String(error),
+						text: formatCliErrorMessage(error),
 					});
 				}
 			} finally {

apps/cli/src/tui/interactive-config.ts

@@ -86,6 +86,7 @@ export interface InteractiveConfigData {
 	mcp: InteractiveConfigItem[];
 	tools: InteractiveConfigItem[];
 	workflowSlashCommands: InteractiveSlashCommand[];
+	pluginDiagnosticsLoaded?: boolean;
 }
 
 export interface LoadInteractiveConfigDataOptions {
@@ -93,12 +94,14 @@ export interface LoadInteractiveConfigDataOptions {
 }
 
 export function isToggleableInteractiveConfigItem(
-	item: Pick<InteractiveConfigItem, "kind" | "source">,
+	item: Pick<InteractiveConfigItem, "kind" | "source" | "pluginName">,
 ): boolean {
+	if (item.kind === "mcp") {
+		return !item.pluginName;
+	}
 	return (
 		item.kind === "skill" ||
 		item.kind === "plugin" ||
-		item.kind === "mcp" ||
 		item.source === "builtin" ||
 		item.source === "workspace-plugin" ||
 		item.source === "global-plugin"
@@ -242,9 +245,10 @@ function readPackageName(packageJsonPath: string): string | undefined {
 	}
 }
 
-function getPluginDisplayName(filePath: string): string {
+function getPluginDisplayName(filePath: string, searchRoot: string): string {
 	let current = dirname(filePath);
-	for (let depth = 0; depth < 4; depth++) {
+	const root = resolve(searchRoot);
+	while (isPathWithin(root, current)) {
 		const packageJsonPath = join(current, "package.json");
 		if (existsSync(packageJsonPath)) {
 			const packageName = readPackageName(packageJsonPath);
@@ -384,7 +388,7 @@ export async function loadInteractiveConfigData(input: {
 			for (const filePath of discoverPluginModulePaths(directory)) {
 				plugins.push({
 					id: filePath,
-					name: getPluginDisplayName(filePath),
+					name: getPluginDisplayName(filePath, directory),
 					path: filePath,
 					enabled: !disabledPlugins.has(filePath),
 					kind: "plugin",
@@ -458,6 +462,16 @@ export async function loadInteractiveConfigData(input: {
 			for (const registration of resolveMcpServerRegistrations({
 				filePath: mcpSettingsPath,
 			})) {
+				const pluginName =
+					registration.metadata?.source === "plugin" &&
+					typeof registration.metadata.pluginName === "string"
+						? registration.metadata.pluginName
+						: undefined;
+				const pluginPath =
+					registration.metadata?.source === "plugin" &&
+					typeof registration.metadata.pluginPath === "string"
+						? registration.metadata.pluginPath
+						: undefined;
 				mcp.push({
 					id: registration.name,
 					name: registration.name,
@@ -467,6 +481,8 @@ export async function loadInteractiveConfigData(input: {
 					source: detectSource(mcpSettingsPath, input.workspaceRoot),
 					description: getMcpDescription(registration),
 					loadError: registration.oauth?.lastError,
+					pluginName,
+					pluginPath,
 				});
 			}
 		} catch {
@@ -514,6 +530,7 @@ export async function loadInteractiveConfigData(input: {
 					toolNames: [pluginTool.name],
 					configKind: "tool",
 					pluginName: pluginTool.pluginName,
+					pluginPath: pluginTool.path,
 					source: pluginTool.source,
 					description: pluginTool.description,
 				});
@@ -533,5 +550,6 @@ export async function loadInteractiveConfigData(input: {
 		mcp: toSorted(mcp.filter((item) => existsSync(item.path))),
 		tools: toSorted(tools),
 		workflowSlashCommands,
+		pluginDiagnosticsLoaded: input.includePluginTools !== false,
 	};
 }

apps/cli/src/tui/views/config-view-helpers.ts

@@ -229,3 +229,15 @@ export function getConfigFooterText({
 export function getConfigItemDisplayName(name: string): string {
 	return name;
 }
+
+export function getPluginDiagnosticsLoadingText(
+	tab: InteractiveConfigTab,
+): string | undefined {
+	if (tab === "tools") {
+		return "Loading plugin tools...";
+	}
+	if (tab === "plugins") {
+		return "Loading plugin diagnostics...";
+	}
+	return undefined;
+}

apps/cli/src/tui/views/config-view.test.ts

@@ -59,6 +59,18 @@ describe("config view helpers", () => {
 		expect(isToggleableConfigItem(createItem({ kind: "mcp" }))).toBe(true);
 	});
 
+	it("does not treat plugin MCP rows as toggleable", () => {
+		expect(
+			isToggleableConfigItem(
+				createItem({
+					kind: "mcp",
+					pluginName: "plugin",
+					source: "workspace-plugin",
+				}),
+			),
+		).toBe(false);
+	});
+
 	it("resolves Enter/Tab on a skill row to details", () => {
 		const skill = createItem({
 			kind: "skill",

apps/cli/src/tui/views/config-view.tsx

@@ -25,6 +25,7 @@ import {
 	getConfigFooterText,
 	getConfigItemDisplayName,
 	getConfigTabs,
+	getPluginDiagnosticsLoadingText,
 	isInlineConfigAction,
 	isToggleableConfigItem,
 	resolveActiveConfigItems,
@@ -198,6 +199,7 @@ function appendToolGroupRows(
 			rightLabel: `${enabledCount}/${groupItems.length} tools enabled`,
 			indent: 2,
 		});
+
 		for (const item of sortBySourceThenName(groupItems)) {
 			rows.push({
 				kind: "ext",
@@ -245,17 +247,24 @@ function appendToolRows(
 		appendExtRows(rows, builtinTools);
 	}
 
-	const pluginGroups = groupToolItems(items.filter((item) => item.pluginName));
+	const pluginToolItems = items.filter((item) => item.pluginName);
+	const pluginGroups = groupToolItems(pluginToolItems);
 	if (pluginGroups.length > 0) {
 		rows.push({ kind: "head", label: "Plugins" });
 		appendToolGroupRows(
 			rows,
 			pluginGroups,
-			getSharedToolNames(items.filter((item) => item.pluginName)),
+			getSharedToolNames(pluginToolItems),
 		);
 	}
 }
 
+function hasPluginDiagnostics(data: InteractiveConfigData): boolean {
+	return (
+		data.pluginDiagnosticsLoaded || data.tools.some((item) => item.pluginName)
+	);
+}
+
 function appendSkillRows(
 	rows: ConfigRow[],
 	items: InteractiveConfigItem[],
@@ -305,11 +314,18 @@ function withOptimisticToggle(
 		).filter(Boolean),
 	);
 	const updateItems = (items: InteractiveConfigItem[]) =>
-		items.map((candidate) =>
-			matchesItem(candidate)
-				? { ...candidate, enabled: nextEnabled }
-				: candidate,
-		);
+		items.map((candidate) => {
+			if (matchesItem(candidate)) {
+				return { ...candidate, enabled: nextEnabled };
+			}
+			if (
+				item.kind === "plugin" &&
+				(candidate.path === item.path || candidate.pluginPath === item.path)
+			) {
+				return { ...candidate, enabled: nextEnabled };
+			}
+			return candidate;
+		});
 	const updateTools = (items: InteractiveConfigItem[]) =>
 		items.map((candidate) => {
 			if (matchesItem(candidate)) {
@@ -381,7 +397,7 @@ export function ConfigPanelContent(props: ConfigPanelProps) {
 	);
 	const [configData, setConfigData] = useState(props.configData);
 	const [pluginToolsLoaded, setPluginToolsLoaded] = useState(
-		props.configData.tools.some((item) => item.pluginName),
+		hasPluginDiagnostics(props.configData),
 	);
 	const [pluginToolsLoading, setPluginToolsLoading] = useState(false);
 	const [pluginToolsError, setPluginToolsError] = useState<
@@ -465,10 +481,11 @@ export function ConfigPanelContent(props: ConfigPanelProps) {
 				});
 			} else if (activeTab === "tools") {
 				appendToolRows(r, activeItems);
-				if (pluginToolsLoading) {
+				const loadingText = getPluginDiagnosticsLoadingText(activeTab);
+				if (pluginToolsLoading && loadingText) {
 					r.push({
 						kind: "detail",
-						text: "Loading plugin tools...",
+						text: loadingText,
 					});
 				}
 				if (pluginToolsError) {
@@ -499,9 +516,10 @@ export function ConfigPanelContent(props: ConfigPanelProps) {
 					});
 				}
 				if (activeTab === "plugins" && pluginToolsLoading) {
+					const loadingText = getPluginDiagnosticsLoadingText(activeTab);
 					r.push({
 						kind: "detail",
-						text: "Loading plugin diagnostics...",
+						text: loadingText ?? "Loading plugin diagnostics...",
 					});
 				}
 				if (activeTab === "plugins" && pluginToolsError) {
@@ -549,15 +567,13 @@ export function ConfigPanelContent(props: ConfigPanelProps) {
 			});
 			if (nextData) {
 				setConfigData(nextData);
-				setPluginToolsLoaded(nextData.tools.some((tool) => tool.pluginName));
+				setPluginToolsLoaded(hasPluginDiagnostics(nextData));
 			} else if (item.kind === "plugin" && loadConfigData) {
 				const refreshedData = await loadConfigData({
 					includePluginTools: true,
 				});
 				setConfigData(refreshedData);
-				setPluginToolsLoaded(
-					refreshedData.tools.some((tool) => tool.pluginName),
-				);
+				setPluginToolsLoaded(hasPluginDiagnostics(refreshedData));
 				setPluginToolsError(undefined);
 			}
 		} catch (error) {

apps/cli/src/tui/views/onboarding/auth.test.ts

@@ -5,6 +5,7 @@ const hoisted = vi.hoisted(() => ({
 	startClineDeviceAuth: vi.fn(),
 	completeClineDeviceAuth: vi.fn(),
 	saveLocalProviderOAuthCredentials: vi.fn(),
+	identifyFeatureFlagsAccount: vi.fn(async () => {}),
 	openMock: vi.fn(() => Promise.resolve()),
 }));
 
@@ -22,6 +23,10 @@ vi.mock("@cline/shared", () => ({
 
 vi.mock("open", () => ({ default: hoisted.openMock }));
 
+vi.mock("../../../utils/feature-flags", () => ({
+	identifyFeatureFlagsAccount: hoisted.identifyFeatureFlagsAccount,
+}));
+
 import { runDeviceCodeAuthFlow, runOAuthAuthFlow } from "./auth";
 
 // Minimal stand-in for a telemetry service. The auth helpers must forward this
@@ -45,6 +50,8 @@ describe("onboarding auth telemetry forwarding", () => {
 		hoisted.startClineDeviceAuth.mockReset();
 		hoisted.completeClineDeviceAuth.mockReset();
 		hoisted.saveLocalProviderOAuthCredentials.mockReset();
+		hoisted.identifyFeatureFlagsAccount.mockReset();
+		hoisted.identifyFeatureFlagsAccount.mockResolvedValue(undefined);
 		hoisted.openMock.mockReset();
 		hoisted.openMock.mockResolvedValue(undefined);
 	});
@@ -85,6 +92,7 @@ describe("onboarding auth telemetry forwarding", () => {
 		// Identity, not deep-equal — we are validating the exact reference flows
 		// through so opt-out / common metadata stays consistent.
 		expect(telemetryArg).toBe(fakeTelemetry);
+		expect(hoisted.identifyFeatureFlagsAccount).not.toHaveBeenCalled();
 	});
 
 	it("does not pass telemetry when none is provided (back-compat)", () => {
@@ -121,6 +129,8 @@ describe("onboarding auth telemetry forwarding", () => {
 			access: "a",
 			refresh: "r",
 			expires: 0,
+			accountId: "acct-1",
+			email: "user@example.com",
 		});
 
 		runDeviceCodeAuthFlow({
@@ -146,6 +156,10 @@ describe("onboarding auth telemetry forwarding", () => {
 		// emitted by completeClineDeviceAuth, so passing telemetry to the start
 		// helper would double-emit the event.
 		expect(hoisted.startClineDeviceAuth).toHaveBeenCalledWith();
+		expect(hoisted.identifyFeatureFlagsAccount).toHaveBeenCalledWith({
+			id: "acct-1",
+			email: "user@example.com",
+		});
 		expect(hoisted.openMock).toHaveBeenCalledWith(
 			"https://verify?user_code=uc",
 			{ wait: false },

apps/cli/src/tui/views/onboarding/auth.ts

@@ -9,6 +9,7 @@ import {
 } from "@cline/core";
 import { getClineEnvironmentConfig } from "@cline/shared";
 import open from "open";
+import { identifyFeatureFlagsAccount } from "../../../utils/feature-flags";
 
 export type OnboardingOAuthProviderId = string;
 
@@ -18,6 +19,10 @@ export function isOnboardingOAuthProviderId(
 	return isOAuthProvider(providerId);
 }
 
+function isClineAccountOAuthProvider(providerId: string): boolean {
+	return providerId === "cline" || providerId === "cline-pass";
+}
+
 export function runOAuthAuthFlow(input: {
 	providerId: OnboardingOAuthProviderId;
 	providerSettingsManager: ProviderSettingsManager;
@@ -56,6 +61,12 @@ export function runOAuthAuthFlow(input: {
 				existing,
 				credentials,
 			);
+			if (isClineAccountOAuthProvider(input.providerId)) {
+				void identifyFeatureFlagsAccount({
+					id: credentials.accountId,
+					email: credentials.email,
+				}).catch(() => {});
+			}
 			input.onComplete(input.providerId);
 		})
 		.catch((err: unknown) => {
@@ -118,6 +129,12 @@ export function runDeviceCodeAuthFlow(input: {
 						existing,
 						credentials,
 					);
+					if (isClineAccountOAuthProvider(input.providerId)) {
+						void identifyFeatureFlagsAccount({
+							id: credentials.accountId,
+							email: credentials.email,
+						}).catch(() => {});
+					}
 					input.onComplete(input.providerId);
 				})
 				.catch((err: unknown) => {

apps/cli/src/tui/views/onboarding/controller.ts

@@ -9,12 +9,14 @@ import {
 	resolveProviderConfig,
 	saveLocalProviderSettings,
 } from "@cline/core";
+import { isClineProvider } from "@cline/shared";
 import { useCallback, useEffect, useMemo, useRef, useState } from "react";
 import {
 	type CodexCliStatus,
 	checkCodexCliInstalled,
 	isOpenAICodexCliProvider,
 } from "../../../utils/codex-cli";
+import { getCliFeatureFlagsService } from "../../../utils/feature-flags";
 import { getPersistedProviderApiKey } from "../../../utils/provider-auth";
 import { listLocalProviders } from "../../../utils/provider-catalog";
 import { getCliTelemetryService } from "../../../utils/telemetry";
@@ -46,11 +48,13 @@ import {
 import { FIELD_ORDER } from "./fields";
 import { useOnboardingKeyboard } from "./keyboard";
 import {
+	getMainMenuOptions,
 	type ModelEntry,
 	type OnboardingResult,
 	type OnboardingStep,
 	type ProviderEntry,
 	type ReasoningEffort,
+	shouldUseFeaturedClineModelPicker,
 	type ThinkingLevel,
 	toModelEntriesFromKnownModels,
 	toModelEntry,
@@ -71,6 +75,14 @@ export function useOnboardingController(props: OnboardingControllerProps) {
 		() => props.providerSettingsManager ?? new ProviderSettingsManager(),
 		[props.providerSettingsManager],
 	);
+	const menuOptions = useMemo(
+		() =>
+			getMainMenuOptions({
+				isClinePassEnabled:
+					getCliFeatureFlagsService().getBooleanFlagEnabled("ext-cline-pass"),
+			}),
+		[],
+	);
 	const [step, setStep] = useState<OnboardingStep>("menu");
 	const [menuSelected, setMenuSelected] = useState(0);
 	const [oauthProvider, setOauthProvider] = useState("");
@@ -153,6 +165,9 @@ export function useOnboardingController(props: OnboardingControllerProps) {
 
 	const createCustomModelItem = useCallback(
 		(_search: string, filteredItems: SearchableItem[]) => {
+			if (activeProviderId === "cline-pass") {
+				return undefined;
+			}
 			if (filteredItems.some((item) => item.key === CUSTOM_MODEL_ID_ACTION)) {
 				return undefined;
 			}
@@ -163,7 +178,7 @@ export function useOnboardingController(props: OnboardingControllerProps) {
 				searchText: "create custom model id manual entry",
 			} satisfies SearchableItem;
 		},
-		[],
+		[activeProviderId],
 	);
 
 	const modelList = useSearchableList(modelItems, createCustomModelItem);
@@ -256,7 +271,7 @@ export function useOnboardingController(props: OnboardingControllerProps) {
 			const provider = providers.find((p) => p.id === providerId);
 			setActiveProviderName(provider?.name ?? providerId);
 			setModelsDefaultId(provider?.defaultModelId ?? "");
-			if (providerId === "cline") {
+			if (shouldUseFeaturedClineModelPicker(providerId)) {
 				setClineModelSelected(0);
 				setStep("cline_model");
 			} else if (providerId === "openai-compatible") {
@@ -307,7 +322,7 @@ export function useOnboardingController(props: OnboardingControllerProps) {
 
 	const startOAuthFlow = useCallback(
 		(providerId: OnboardingOAuthProviderId) => {
-			if (providerId === "cline") {
+			if (isClineProvider(providerId)) {
 				startDeviceCodeFlow(providerId);
 				return;
 			}
@@ -611,6 +626,7 @@ export function useOnboardingController(props: OnboardingControllerProps) {
 		onExit: props.onExit,
 		oauthProvider,
 		activeProviderId,
+		menuOptions,
 		menuSelected,
 		providerList,
 		modelList,
@@ -685,6 +701,7 @@ export function useOnboardingController(props: OnboardingControllerProps) {
 		},
 		handleModelItemSelect: selectModelItem,
 		menuSelected,
+		menuOptions,
 		modelItems,
 		modelList,
 		modelsLoading,

apps/cli/src/tui/views/onboarding/keyboard.ts

@@ -3,10 +3,13 @@ import { useKeyboard } from "@opentui/react";
 import type { Dispatch, SetStateAction } from "react";
 import type { ClineModelPickerEntry } from "../../components/model-selector/cline-model-picker";
 import type { SearchableListState } from "../../components/searchable-list";
-import type { OnboardingOAuthProviderId } from "./auth";
+import {
+	isOnboardingOAuthProviderId,
+	type OnboardingOAuthProviderId,
+} from "./auth";
 import { FIELD_ORDER } from "./fields";
 import {
-	MAIN_MENU,
+	type MenuOption,
 	type OnboardingStep,
 	THINKING_LEVELS,
 	type ThinkingLevel,
@@ -17,6 +20,7 @@ export function useOnboardingKeyboard(input: {
 	onExit: () => void;
 	oauthProvider: string;
 	activeProviderId: string;
+	menuOptions: MenuOption[];
 	menuSelected: number;
 	providerList: SearchableListState;
 	modelList: SearchableListState;
@@ -133,17 +137,21 @@ export function useOnboardingKeyboard(input: {
 
 		if (input.step === "menu") {
 			if (key.name === "up") {
-				input.setMenuSelected((s) => (s <= 0 ? MAIN_MENU.length - 1 : s - 1));
+				input.setMenuSelected((s) =>
+					s <= 0 ? input.menuOptions.length - 1 : s - 1,
+				);
 				return;
 			}
 			if (key.name === "down") {
-				input.setMenuSelected((s) => (s >= MAIN_MENU.length - 1 ? 0 : s + 1));
+				input.setMenuSelected((s) =>
+					s >= input.menuOptions.length - 1 ? 0 : s + 1,
+				);
 				return;
 			}
 			if (key.name === "return") {
-				const option = MAIN_MENU[input.menuSelected];
+				const option = input.menuOptions[input.menuSelected];
 				if (!option) return;
-				if (option.value === "cline" || option.value === "openai-codex") {
+				if (isOnboardingOAuthProviderId(option.value)) {
 					input.startOAuthFlow(option.value);
 				} else {
 					input.setStep("byo_provider");

apps/cli/src/tui/views/onboarding/model.test.ts

@@ -1,12 +1,30 @@
 import { describe, expect, it } from "vitest";
 import {
+	getMainMenuOptions,
 	getOAuthProviderLabel,
+	shouldUseFeaturedClineModelPicker,
 	toModelEntriesFromKnownModels,
 	toModelEntry,
 	toProviderEntry,
 } from "./model";
 
 describe("onboarding model helpers", () => {
+	it("hides ClinePass from the main menu unless its feature flag is enabled", () => {
+		expect(
+			getMainMenuOptions().some((option) => option.value === "cline-pass"),
+		).toBe(false);
+		expect(
+			getMainMenuOptions({ isClinePassEnabled: false }).some(
+				(option) => option.value === "cline-pass",
+			),
+		).toBe(false);
+		expect(
+			getMainMenuOptions({ isClinePassEnabled: true }).some(
+				(option) => option.value === "cline-pass",
+			),
+		).toBe(true);
+	});
+
 	it("maps provider catalog entries into onboarding provider entries", () => {
 		expect(
 			toProviderEntry({
@@ -112,7 +130,14 @@ describe("onboarding model helpers", () => {
 
 	it("formats OAuth provider labels for onboarding status views", () => {
 		expect(getOAuthProviderLabel("cline")).toBe("Cline");
+		expect(getOAuthProviderLabel("cline-pass")).toBe("ClinePass");
 		expect(getOAuthProviderLabel("openai-codex")).toBe("ChatGPT");
 		expect(getOAuthProviderLabel("oca")).toBe("oca");
 	});
+
+	it("uses the featured Cline model picker only for the Cline provider", () => {
+		expect(shouldUseFeaturedClineModelPicker("cline")).toBe(true);
+		expect(shouldUseFeaturedClineModelPicker("cline-pass")).toBe(false);
+		expect(shouldUseFeaturedClineModelPicker("anthropic")).toBe(false);
+	});
 });

apps/cli/src/tui/views/onboarding/model.ts

@@ -43,6 +43,12 @@ export const MAIN_MENU: MenuOption[] = [
 		detail: "Latest models with regular free promos",
 		icon: "\u263a",
 	},
+	{
+		label: "Sign in with ClinePass",
+		value: "cline-pass",
+		detail: "Low cost subscription for everyone",
+		icon: "\u2726",
+	},
 	{
 		label: "Sign in with ChatGPT",
 		value: "openai-codex",
@@ -57,6 +63,14 @@ export const MAIN_MENU: MenuOption[] = [
 	},
 ];
 
+export function getMainMenuOptions(options?: {
+	isClinePassEnabled?: boolean;
+}): MenuOption[] {
+	return MAIN_MENU.filter(
+		(option) => option.value !== "cline-pass" || options?.isClinePassEnabled,
+	);
+}
+
 export interface OnboardingResult {
 	providerId: string;
 	modelId: string;
@@ -139,6 +153,9 @@ export function toModelEntriesFromKnownModels(
 }
 
 export function getOAuthProviderLabel(providerId: string): string {
+	if (providerId === "cline-pass") {
+		return "ClinePass";
+	}
 	if (providerId === "cline") {
 		return "Cline";
 	}
@@ -147,3 +164,7 @@ export function getOAuthProviderLabel(providerId: string): string {
 	}
 	return providerId;
 }
+
+export function shouldUseFeaturedClineModelPicker(providerId: string): boolean {
+	return providerId === "cline";
+}

apps/cli/src/tui/views/onboarding/screens.tsx

@@ -20,7 +20,7 @@ import {
 import { useTerminalBackground } from "../../hooks/use-terminal-background";
 import { getDefaultForeground, palette } from "../../palette";
 import { FIELD_ORDER } from "./fields";
-import { MAIN_MENU, THINKING_LEVELS } from "./model";
+import { type MenuOption, THINKING_LEVELS } from "./model";
 
 type MouseTrackerState = ReturnType<typeof useMouseTracker>;
 
@@ -633,6 +633,7 @@ export function OnboardingThinkingLevelScreen(props: {
 
 export function OnboardingMainMenuScreen(props: {
 	contentWidth: number;
+	menuOptions: MenuOption[];
 	menuSelected: number;
 	mouse: MouseTrackerState;
 }) {
@@ -671,7 +672,7 @@ export function OnboardingMainMenuScreen(props: {
 				marginTop={1}
 				gap={0}
 			>
-				{MAIN_MENU.map((option, i) => {
+				{props.menuOptions.map((option, i) => {
 					const isSel = i === props.menuSelected;
 					return (
 						<box

apps/cli/src/tui/views/onboarding/view.tsx

@@ -166,6 +166,7 @@ export function OnboardingView(props: OnboardingViewProps) {
 	return (
 		<OnboardingMainMenuScreen
 			contentWidth={contentWidth}
+			menuOptions={state.menuOptions}
 			menuSelected={state.menuSelected}
 			mouse={mouse}
 		/>

apps/cli/src/utils/cline-pass-errors.test.ts

@@ -0,0 +1,44 @@
+import { describe, expect, it } from "vitest";
+import {
+	formatCliErrorMessage,
+	getClineOrgIndividualInferenceSubscriptionMessage,
+	getClinePassSubscriptionUrl,
+	isClineOrgIndividualInferenceSubscriptionErrorMessage,
+	isClinePassSubscriptionError,
+} from "./cline-pass-errors";
+
+describe("cline-pass-errors", () => {
+	it("recognizes both raw and formatted ClinePass subscription messages", () => {
+		expect(
+			isClinePassSubscriptionError(
+				"the user is not subscribed to required model plan",
+			),
+		).toBe(true);
+
+		const formatted = `No access to ClinePass subscription models yet. Subscribe to ClinePass, the low cost open weights model coding plan: ${getClinePassSubscriptionUrl()}`;
+		expect(isClinePassSubscriptionError(formatted)).toBe(true);
+		expect(formatCliErrorMessage(new Error(formatted))).toBe(formatted);
+	});
+
+	it("formats the ClinePass subscription URL", () => {
+		expect(getClinePassSubscriptionUrl()).toBe(
+			"https://app.cline.bot/dashboard/subscription?personal=true",
+		);
+	});
+
+	it("recognizes and formats organization account individual subscription errors", () => {
+		const raw =
+			"403 Error 403: organization accounts cannot use individual model inference subscriptions";
+		const formatted = getClineOrgIndividualInferenceSubscriptionMessage();
+
+		expect(isClineOrgIndividualInferenceSubscriptionErrorMessage(raw)).toBe(
+			true,
+		);
+		expect(
+			isClineOrgIndividualInferenceSubscriptionErrorMessage(
+				new Error(formatted),
+			),
+		).toBe(true);
+		expect(formatCliErrorMessage(new Error(raw))).toBe(formatted);
+	});
+});

apps/cli/src/utils/cline-pass-errors.ts

@@ -0,0 +1,69 @@
+import {
+	getClineOrgIndividualInferenceSubscriptionMessage,
+	getClinePassSubscriptionUrl,
+	isClineNotSubscribedError,
+	isClineNotSubscribedMessage,
+	isClineOrgIndividualInferenceSubscriptionError,
+	isClineOrgIndividualInferenceSubscriptionMessage,
+} from "@cline/core";
+
+export {
+	getClineOrgIndividualInferenceSubscriptionMessage,
+	getClinePassSubscriptionUrl,
+};
+
+function isFormattedClinePassSubscriptionMessage(message: string): boolean {
+	const normalized = message.trim().toLowerCase();
+	return (
+		normalized.includes("no access to clinepass subscription models yet") &&
+		normalized.includes("subscribe to clinepass")
+	);
+}
+
+export function isClinePassSubscriptionError(error: unknown): boolean {
+	if (isClineNotSubscribedError(error)) {
+		return true;
+	}
+	if (error instanceof Error) {
+		return (
+			error.name === "ClineNotSubscribedError" ||
+			isClineNotSubscribedMessage(error.message) ||
+			isFormattedClinePassSubscriptionMessage(error.message)
+		);
+	}
+	return (
+		typeof error === "string" &&
+		(isClineNotSubscribedMessage(error) ||
+			isFormattedClinePassSubscriptionMessage(error))
+	);
+}
+
+export function isClineOrgIndividualInferenceSubscriptionErrorMessage(
+	error: unknown,
+): boolean {
+	if (isClineOrgIndividualInferenceSubscriptionError(error)) {
+		return true;
+	}
+	if (error instanceof Error) {
+		return (
+			error.name === "ClineOrgIndividualInferenceSubscriptionError" ||
+			isClineOrgIndividualInferenceSubscriptionMessage(error.message) ||
+			error.message === getClineOrgIndividualInferenceSubscriptionMessage()
+		);
+	}
+	return (
+		typeof error === "string" &&
+		(isClineOrgIndividualInferenceSubscriptionMessage(error) ||
+			error === getClineOrgIndividualInferenceSubscriptionMessage())
+	);
+}
+
+export function formatCliErrorMessage(error: unknown): string {
+	if (isClineOrgIndividualInferenceSubscriptionErrorMessage(error)) {
+		return getClineOrgIndividualInferenceSubscriptionMessage();
+	}
+	if (error instanceof Error) {
+		return error.message;
+	}
+	return String(error);
+}

apps/cli/src/utils/feature-flags.ts

@@ -87,22 +87,29 @@ export async function disposeCliFeatureFlagsService(): Promise<void> {
 	await current.dispose();
 }
 
-export async function identifyFeatureFlagsAccount(
-	account: { id?: string; email?: string },
-	logger?: BasicLogger,
-): Promise<void> {
+export function setCliFeatureFlagsAccountContext(account: {
+	id?: string;
+	email?: string;
+}): void {
 	const accountId = account.id?.trim();
 	cliFeatureFlagsContext = {
 		...cliFeatureFlagsContext,
 		...(accountId ? { distinctId: accountId, userId: accountId } : {}),
 		...(account.email?.trim() ? { email: account.email.trim() } : {}),
 	};
+	cliFeatureFlagsService?.setContext(getCliFeatureFlagsContext());
+}
+
+export async function identifyFeatureFlagsAccount(
+	account: { id?: string; email?: string },
+	logger?: BasicLogger,
+): Promise<void> {
+	setCliFeatureFlagsAccountContext(account);
 
 	if (!cliFeatureFlagsService) {
 		return;
 	}
 
-	cliFeatureFlagsService.setContext(getCliFeatureFlagsContext());
 	try {
 		await cliFeatureFlagsService.poll();
 	} catch (error) {

apps/cli/src/utils/free-model-cost.test.ts

@@ -0,0 +1,162 @@
+import type { AgentEvent } from "@cline/core";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import {
+	clearClineFreeModelCostCache,
+	shouldZeroClineFreeModelCost,
+	zeroCliAgentEventCost,
+	zeroCliUsageCost,
+} from "./free-model-cost";
+
+afterEach(() => {
+	clearClineFreeModelCostCache();
+	vi.unstubAllGlobals();
+});
+
+describe("shouldZeroClineFreeModelCost", () => {
+	it("uses the Cline free model list", async () => {
+		const fetchMock = vi.fn(
+			async (_input: Parameters<typeof fetch>[0], _init?: RequestInit) => {
+				return new Response(
+					JSON.stringify({
+						free: [{ id: "deepseek/deepseek-v4-flash" }],
+					}),
+					{ status: 200, headers: { "content-type": "application/json" } },
+				);
+			},
+		);
+		vi.stubGlobal("fetch", fetchMock);
+
+		await expect(
+			shouldZeroClineFreeModelCost({
+				providerId: "cline",
+				modelId: "deepseek/deepseek-v4-flash",
+				baseUrl: "https://cline.test/api/v1",
+			}),
+		).resolves.toBe(true);
+
+		expect(fetchMock.mock.calls[0]?.[0]).toBe(
+			"https://cline.test/api/v1/ai/cline/recommended-models",
+		);
+	});
+
+	it("does not zero non-Cline providers", async () => {
+		const fetchMock = vi.fn();
+		vi.stubGlobal("fetch", fetchMock);
+
+		await expect(
+			shouldZeroClineFreeModelCost({
+				providerId: "openrouter",
+				modelId: "deepseek/deepseek-v4-flash",
+				baseUrl: "https://cline.test/api/v1",
+			}),
+		).resolves.toBe(false);
+		expect(fetchMock).not.toHaveBeenCalled();
+	});
+
+	it("does not match a paid model by only the final path segment", async () => {
+		vi.stubGlobal(
+			"fetch",
+			vi.fn(async () => {
+				return new Response(
+					JSON.stringify({
+						free: [{ id: "deepseek/deepseek-v4-flash" }],
+					}),
+					{ status: 200, headers: { "content-type": "application/json" } },
+				);
+			}),
+		);
+
+		await expect(
+			shouldZeroClineFreeModelCost({
+				providerId: "cline",
+				modelId: "acme/deepseek-v4-flash",
+				baseUrl: "https://cline.test/api/v1",
+			}),
+		).resolves.toBe(false);
+	});
+
+	it("retries after a failed free model list fetch", async () => {
+		const fetchMock = vi
+			.fn()
+			.mockResolvedValueOnce(new Response("unavailable", { status: 503 }))
+			.mockResolvedValueOnce(
+				new Response(
+					JSON.stringify({
+						free: [{ id: "deepseek/deepseek-v4-flash" }],
+					}),
+					{ status: 200, headers: { "content-type": "application/json" } },
+				),
+			);
+		vi.stubGlobal("fetch", fetchMock);
+
+		await expect(
+			shouldZeroClineFreeModelCost({
+				providerId: "cline",
+				modelId: "deepseek/deepseek-v4-flash",
+				baseUrl: "https://cline.test/api/v1",
+			}),
+		).resolves.toBe(false);
+		await expect(
+			shouldZeroClineFreeModelCost({
+				providerId: "cline",
+				modelId: "deepseek/deepseek-v4-flash",
+				baseUrl: "https://cline.test/api/v1",
+			}),
+		).resolves.toBe(true);
+		expect(fetchMock).toHaveBeenCalledTimes(2);
+	});
+});
+
+describe("zeroCliUsageCost", () => {
+	it("zeros total cost while preserving token usage", () => {
+		expect(
+			zeroCliUsageCost(
+				{
+					inputTokens: 10,
+					outputTokens: 5,
+					totalCost: 0.001,
+				},
+				true,
+			),
+		).toEqual({
+			inputTokens: 10,
+			outputTokens: 5,
+			totalCost: 0,
+		});
+	});
+});
+
+describe("zeroCliAgentEventCost", () => {
+	it("zeros usage event cost fields", () => {
+		const event = {
+			type: "usage",
+			inputTokens: 10,
+			outputTokens: 5,
+			cost: 0.001,
+			totalCost: 0.001,
+		} as AgentEvent;
+
+		expect(zeroCliAgentEventCost(event, true)).toMatchObject({
+			cost: 0,
+			totalCost: 0,
+		});
+	});
+
+	it("zeros done event usage cost", () => {
+		const event = {
+			type: "done",
+			reason: "completed",
+			text: "ok",
+			iterations: 1,
+			usage: {
+				inputTokens: 10,
+				outputTokens: 5,
+				totalCost: 0.001,
+			},
+		} as AgentEvent;
+
+		expect(zeroCliAgentEventCost(event, true)).toMatchObject({
+			usage: { totalCost: 0 },
+		});
+	});
+});

apps/cli/src/utils/free-model-cost.ts

@@ -0,0 +1,123 @@
+import type { AgentEvent } from "@cline/core";
+import { getClineEnvironmentConfig } from "@cline/shared";
+import type { Config } from "./types";
+
+const CLINE_RECOMMENDED_MODELS_TIMEOUT_MS = 5_000;
+const freeModelIdsByBaseUrl = new Map<
+	string,
+	Promise<readonly string[] | undefined>
+>();
+
+function normalizeModelId(modelId: string | undefined): string {
+	return modelId?.trim().toLowerCase() ?? "";
+}
+
+function modelIdsMatch(selectedModelId: string, freeModelId: string): boolean {
+	const selected = normalizeModelId(selectedModelId);
+	const free = normalizeModelId(freeModelId);
+	if (!selected || !free) return false;
+	return selected === free;
+}
+
+function resolveClineRecommendedModelsUrl(baseUrl: string): string {
+	const normalizedBaseUrl = baseUrl.trim().replace(/\/+$/, "");
+	const apiBaseUrl = normalizedBaseUrl.endsWith("/api/v1")
+		? normalizedBaseUrl.slice(0, -"/api/v1".length)
+		: normalizedBaseUrl;
+	return `${apiBaseUrl}/api/v1/ai/cline/recommended-models`;
+}
+
+async function fetchClineFreeModelIds(
+	baseUrl: string,
+): Promise<readonly string[] | undefined> {
+	const controller = new AbortController();
+	const timeout = setTimeout(
+		() => controller.abort(),
+		CLINE_RECOMMENDED_MODELS_TIMEOUT_MS,
+	);
+	try {
+		const response = await fetch(resolveClineRecommendedModelsUrl(baseUrl), {
+			signal: controller.signal,
+		});
+		if (!response.ok) return undefined;
+		const json = (await response.json()) as { free?: unknown };
+		return Array.isArray(json.free)
+			? json.free
+					.map((model) =>
+						model && typeof model === "object"
+							? (model as Record<string, unknown>).id
+							: undefined,
+					)
+					.filter((id): id is string => typeof id === "string" && id.length > 0)
+			: [];
+	} catch {
+		return undefined;
+	} finally {
+		clearTimeout(timeout);
+	}
+}
+
+function getClineFreeModelIds(baseUrl: string): Promise<readonly string[]> {
+	const cacheKey = baseUrl.trim();
+	let cached = freeModelIdsByBaseUrl.get(cacheKey);
+	if (!cached) {
+		cached = fetchClineFreeModelIds(cacheKey).then((ids) => {
+			if (!ids) freeModelIdsByBaseUrl.delete(cacheKey);
+			return ids;
+		});
+		freeModelIdsByBaseUrl.set(cacheKey, cached);
+	}
+	return cached.then((ids) => ids ?? []);
+}
+
+export async function shouldZeroClineFreeModelCost(
+	config: Pick<Config, "providerId" | "modelId" | "baseUrl">,
+): Promise<boolean> {
+	if (config.providerId !== "cline") return false;
+	const modelId = normalizeModelId(config.modelId);
+	if (!modelId) return false;
+
+	const baseUrl =
+		config.baseUrl?.trim() || getClineEnvironmentConfig().apiBaseUrl;
+	const freeModelIds = await getClineFreeModelIds(baseUrl);
+	return freeModelIds.some((freeModelId) =>
+		modelIdsMatch(modelId, freeModelId),
+	);
+}
+
+export function zeroCliUsageCost<T extends { totalCost?: number } | undefined>(
+	usage: T,
+	shouldZeroCost: boolean,
+): T {
+	if (
+		!shouldZeroCost ||
+		!usage ||
+		typeof usage.totalCost !== "number" ||
+		usage.totalCost === 0
+	) {
+		return usage;
+	}
+	return { ...usage, totalCost: 0 } as T;
+}
+
+export function zeroCliAgentEventCost(
+	event: AgentEvent,
+	shouldZeroCost: boolean,
+): AgentEvent {
+	if (!shouldZeroCost) return event;
+	if (event.type === "done" && event.usage) {
+		return {
+			...event,
+			usage: zeroCliUsageCost(event.usage, true),
+		};
+	}
+	if (event.type !== "usage") return event;
+	const next = { ...event } as Record<string, unknown>;
+	if (typeof next.cost === "number") next.cost = 0;
+	if (typeof next.totalCost === "number") next.totalCost = 0;
+	return next as unknown as AgentEvent;
+}
+
+export function clearClineFreeModelCostCache(): void {
+	freeModelIdsByBaseUrl.clear();
+}

apps/cli/src/utils/history-resume.test.ts

@@ -0,0 +1,99 @@
+import { describe, expect, it } from "vitest";
+import { buildHistoryResumeArgs } from "./history-resume";
+
+describe("buildHistoryResumeArgs", () => {
+	it("replaces the history subcommand with --id", () => {
+		expect(
+			buildHistoryResumeArgs({
+				sessionId: "sess_1",
+				normalizedArgs: ["history"],
+				remainingArgs: ["history"],
+			}),
+		).toEqual(["--id", "sess_1"]);
+	});
+
+	it("preserves global flags that precede the subcommand", () => {
+		expect(
+			buildHistoryResumeArgs({
+				sessionId: "sess_1",
+				normalizedArgs: [
+					"--data-dir",
+					"/tmp/data",
+					"-m",
+					"claude-sonnet-4-6",
+					"history",
+					"--limit",
+					"5",
+				],
+				remainingArgs: ["history", "--limit", "5"],
+			}),
+		).toEqual([
+			"--data-dir",
+			"/tmp/data",
+			"-m",
+			"claude-sonnet-4-6",
+			"--id",
+			"sess_1",
+		]);
+	});
+
+	it("keeps a global flag value that matches the subcommand alias", () => {
+		expect(
+			buildHistoryResumeArgs({
+				sessionId: "sess_1",
+				normalizedArgs: ["-m", "h", "h"],
+				remainingArgs: ["h"],
+			}),
+		).toEqual(["-m", "h", "--id", "sess_1"]);
+	});
+
+	it("forwards a config dir passed as a subcommand option", () => {
+		expect(
+			buildHistoryResumeArgs({
+				sessionId: "sess_1",
+				normalizedArgs: ["history", "--config", "/tmp/conf"],
+				remainingArgs: ["history", "--config", "/tmp/conf"],
+				configDir: "/tmp/conf",
+			}),
+		).toEqual(["--config", "/tmp/conf", "--id", "sess_1"]);
+	});
+
+	it("does not duplicate a config dir already in the global flags", () => {
+		expect(
+			buildHistoryResumeArgs({
+				sessionId: "sess_1",
+				normalizedArgs: ["--config", "/tmp/conf", "history"],
+				remainingArgs: ["history"],
+				configDir: "/tmp/conf",
+			}),
+		).toEqual(["--config", "/tmp/conf", "--id", "sess_1"]);
+	});
+
+	it("recognizes the --config=<dir> spelling in global flags", () => {
+		expect(
+			buildHistoryResumeArgs({
+				sessionId: "sess_1",
+				normalizedArgs: ["--config=/tmp/conf", "history"],
+				remainingArgs: ["history"],
+				configDir: "/tmp/conf",
+			}),
+		).toEqual(["--config=/tmp/conf", "--id", "sess_1"]);
+	});
+
+	it("returns undefined when remaining args are not a suffix of argv", () => {
+		expect(
+			buildHistoryResumeArgs({
+				sessionId: "sess_1",
+				normalizedArgs: ["history", "--limit", "5"],
+				remainingArgs: ["history", "--limit", "9"],
+			}),
+		).toBeUndefined();
+		expect(
+			buildHistoryResumeArgs({
+				sessionId: "sess_1",
+				normalizedArgs: ["history"],
+				remainingArgs: ["extra", "history"],
+			}),
+		).toBeUndefined();
+	});
+});

apps/cli/src/utils/history-resume.ts

@@ -0,0 +1,115 @@
+import { resolveCliLaunchSpec } from "./internal-launch";
+
+export interface HistoryResumeCommand {
+	launcher: string;
+	childArgs: string[];
+}
+
+export interface BuildHistoryResumeArgsInput {
+	sessionId: string;
+	/** Full normalized CLI args (process.argv.slice(2) after normalization). */
+	normalizedArgs: string[];
+	/**
+	 * Commander's `program.args` after parsing: the `history` subcommand token
+	 * and everything following it. Must be a suffix of `normalizedArgs`.
+	 */
+	remainingArgs: string[];
+	/**
+	 * Config dir resolved from the full argv. Forwarded explicitly because
+	 * `--config` may have been passed as a `history` subcommand option, which
+	 * would otherwise be dropped with the rest of the subcommand args.
+	 */
+	configDir?: string;
+}
+
+/**
+ * Builds argv for relaunching the CLI as `cline <globalFlags> --id <sessionId>`
+ * after a session is picked in `cline history`. Returns undefined when the
+ * global-flag prefix cannot be derived safely (caller falls back to resuming
+ * in-process).
+ */
+export function buildHistoryResumeArgs(
+	input: BuildHistoryResumeArgsInput,
+): string[] | undefined {
+	const { sessionId, normalizedArgs, remainingArgs, configDir } = input;
+	const splitIndex = normalizedArgs.length - remainingArgs.length;
+	if (splitIndex < 0) {
+		return undefined;
+	}
+	for (let i = 0; i < remainingArgs.length; i++) {
+		if (normalizedArgs[splitIndex + i] !== remainingArgs[i]) {
+			return undefined;
+		}
+	}
+	const globalArgs = normalizedArgs.slice(0, splitIndex);
+	const args = [...globalArgs];
+	const hasConfigFlag = globalArgs.some(
+		(arg) => arg === "--config" || arg.startsWith("--config="),
+	);
+	if (configDir && !hasConfigFlag) {
+		args.push("--config", configDir);
+	}
+	args.push("--id", sessionId);
+	return args;
+}
+
+export function buildHistoryResumeCommand(
+	input: BuildHistoryResumeArgsInput,
+): HistoryResumeCommand | undefined {
+	const childArgs = buildHistoryResumeArgs(input);
+	if (!childArgs) {
+		return undefined;
+	}
+	const spec = resolveCliLaunchSpec();
+	if (!spec) {
+		return undefined;
+	}
+	return {
+		launcher: spec.launcher,
+		childArgs: [...spec.childArgsPrefix, ...childArgs],
+	};
+}
+
+/**
+ * Resumes a history-picked session in a fresh `cline --id <sessionId>` child
+ * process with inherited stdio, and returns its exit code. Creating a second
+ * OpenTUI renderer in the picker's process can crash natively during teardown
+ * (Bun "panic(main thread): Segmentation fault" on Ctrl+C), so the resumed
+ * interactive TUI must get a process of its own.
+ *
+ * Returns undefined when the child cannot be launched; the caller should fall
+ * back to resuming in-process.
+ */
+export async function spawnHistoryResume(
+	input: BuildHistoryResumeArgsInput,
+): Promise<number | undefined> {
+	const command = buildHistoryResumeCommand(input);
+	if (!command) {
+		return undefined;
+	}
+	const { spawn } = await import("node:child_process");
+	return await new Promise<number | undefined>((resolve) => {
+		let child: ReturnType<typeof spawn>;
+		try {
+			child = spawn(command.launcher, command.childArgs, {
+				stdio: "inherit",
+			});
+		} catch {
+			resolve(undefined);
+			return;
+		}
+		// The child shares this foreground process group, so terminal-generated
+		// Ctrl+C already reaches it. Keep the parent alive to reap the child
+		// without re-forwarding a second signal into the TUI teardown path.
+		const suppressParentSignal = () => {};
+		process.on("SIGINT", suppressParentSignal);
+		process.on("SIGTERM", suppressParentSignal);
+		const finish = (value: number | undefined) => {
+			process.off("SIGINT", suppressParentSignal);
+			process.off("SIGTERM", suppressParentSignal);
+			resolve(value);
+		};
+		child.once("error", () => finish(undefined));
+		child.once("exit", (code, signal) => finish(signal ? 1 : (code ?? 0)));
+	});
+}

apps/cli/src/utils/provider-catalog.test.ts

@@ -20,7 +20,7 @@ vi.mock("./feature-flags", () => ({
 }));
 
 describe("listLocalProviders", () => {
-	it("passes the Cline Pass feature flag into the SDK provider list", async () => {
+	it("passes the ClinePass feature flag into the SDK provider list", async () => {
 		const { listLocalProviders } = await import("./provider-catalog");
 		const manager = {} as never;
 

apps/cli/src/wizards/connect/platforms.ts

@@ -1,325 +1,16 @@
-export interface PlatformDef {
-	id: string;
-	name: string;
-	type: "polling" | "webhook" | "hybrid";
-	hint: string;
-	fields: FieldDef[];
-	security?: SecurityDef;
-}
+import {
+	CONNECTOR_PLATFORMS,
+	shouldIncludeConnectorField,
+} from "@cline/shared";
 
-export interface FieldDef {
-	flag: string;
-	label: string;
-	placeholder?: string;
-	required?: boolean;
-	help?: string[];
-	initialValue?: string;
-	options?: Array<{ value: string; label: string; hint?: string }>;
-	includeWhen?: FieldCondition;
-}
+export type {
+	ConnectorFieldCondition as FieldCondition,
+	ConnectorFieldDef as FieldDef,
+	ConnectorPlatformDef as PlatformDef,
+	ConnectorSecurityDef as SecurityDef,
+	ConnectorSecurityFieldDef as SecurityFieldDef,
+} from "@cline/shared";
+export { CONNECTOR_PLATFORMS, shouldIncludeConnectorField };
 
-export type FieldCondition = {
-	flag: string;
-	equals?: string;
-	notEquals?: string;
-};
-
-export interface SecurityFieldDef {
-	key: string;
-	label: string;
-	placeholder?: string;
-	help?: string[];
-	requiredMessage: string;
-	validate?: (value: string) => string | undefined;
-}
-
-export interface SecurityDef {
-	prompt: string;
-	fields: SecurityFieldDef[];
-	buildArgs: (values: Record<string, string>) => string[];
-}
-
-export function shouldIncludeField(
-	field: FieldDef,
-	values: Record<string, string>,
-): boolean {
-	const condition = field.includeWhen;
-	if (!condition) {
-		return true;
-	}
-	const value = values[condition.flag] ?? "";
-	if (condition.equals !== undefined && value !== condition.equals) {
-		return false;
-	}
-	if (condition.notEquals !== undefined && value === condition.notEquals) {
-		return false;
-	}
-	return true;
-}
-
-function validateTelegramUserId(value: string): string | undefined {
-	return /^\d+$/.test(value)
-		? undefined
-		: "Telegram user ID must contain digits only";
-}
-
-function validateSlackTeamId(value: string): string | undefined {
-	return /^T[A-Z0-9]+$/.test(value)
-		? undefined
-		: "Slack workspace ID must start with T and contain uppercase letters or digits only";
-}
-
-function validateSlackUserId(value: string): string | undefined {
-	return /^[UW][A-Z0-9]+$/.test(value)
-		? undefined
-		: "Slack member ID must start with U or W and contain uppercase letters or digits only";
-}
-
-export const PLATFORMS: PlatformDef[] = [
-	{
-		id: "telegram",
-		name: "Telegram",
-		type: "polling",
-		hint: "Easiest to set up. No public URL needed.",
-		fields: [
-			{
-				flag: "-k",
-				label: "Bot token",
-				placeholder: "7123456789:AAH...",
-				required: true,
-				help: [
-					"Open Telegram and start a chat with @BotFather",
-					"Send /newbot and follow the prompts",
-					"BotFather gives you this after creating the bot",
-					"It looks like 7123456789:AAHxxx...",
-				],
-			},
-		],
-		security: {
-			prompt:
-				"By default, anyone who finds your bot can message it and run tasks on your machine. Restrict access to your Telegram user ID?",
-			fields: [
-				{
-					key: "userId",
-					label: "Your Telegram user ID",
-					placeholder: "123456789",
-					help: [
-						"Message @userinfobot on Telegram",
-						"It will reply with your numeric user ID",
-					],
-					requiredMessage: "User ID is required to restrict access",
-					validate: validateTelegramUserId,
-				},
-			],
-			buildArgs: ({ userId }) => ["--allowed-user-id", userId ?? ""],
-		},
-	},
-	{
-		id: "slack",
-		name: "Slack",
-		type: "hybrid",
-		hint: "Public URL for webhook mode; leave blank for socket mode.",
-		fields: [
-			{
-				flag: "--bot-token",
-				label: "Bot token",
-				placeholder: "xoxb-...",
-				required: true,
-				help: [
-					"Go to api.slack.com/apps and create a new app",
-					"Add Bot Token Scopes: chat:write, app_mentions:read, channels:history, channels:read, im:history, im:read, im:write, users:read",
-					"Install to workspace and copy the Bot Token",
-				],
-			},
-			{
-				flag: "--base-url",
-				label: "Public base URL",
-				placeholder: "leave blank for socket mode",
-				help: [
-					"Enter a publicly accessible URL for webhook mode",
-					"Leave blank to use Slack socket mode instead",
-				],
-			},
-			{
-				flag: "--signing-secret",
-				label: "Signing secret",
-				required: true,
-				help: ["Found in your app's Basic Information page"],
-				includeWhen: { flag: "--base-url", notEquals: "" },
-			},
-			{
-				flag: "--app-token",
-				label: "App-level token",
-				placeholder: "xapp-...",
-				required: true,
-				help: [
-					"Enable Socket Mode in the Slack app",
-					"Generate an app-level token with the connections:write scope",
-				],
-				includeWhen: { flag: "--base-url", equals: "" },
-			},
-		],
-		security: {
-			prompt: "Restrict which Slack users can interact with the bot?",
-			fields: [
-				{
-					key: "teamId",
-					label: "Allowed Slack workspace ID",
-					placeholder: "T01ABC123",
-					help: [
-						"Open your Slack workspace URL in a browser",
-						"The workspace ID is the segment after /client/, for example T01ABC123",
-					],
-					requiredMessage: "Workspace ID is required to restrict access",
-					validate: validateSlackTeamId,
-				},
-				{
-					key: "userId",
-					label: "Allowed Slack member ID",
-					placeholder: "U01ABC123",
-					help: [
-						"Click a user's name in Slack, then View full profile",
-						"Click ... and Copy member ID",
-					],
-					requiredMessage: "Member ID is required to restrict access",
-					validate: validateSlackUserId,
-				},
-			],
-			buildArgs: ({ teamId, userId }) => [
-				"--hook-command",
-				`jq -r ".payload.actor.participantKey" | grep -qx "slack:team:${teamId}:user:${userId}" && echo '{"action":"allow"}' || echo '{"action":"deny"}'`,
-			],
-		},
-	},
-	{
-		id: "discord",
-		name: "Discord",
-		type: "webhook",
-		hint: "Requires a Discord app and public URL.",
-		fields: [
-			{
-				flag: "--application-id",
-				label: "Application ID",
-				required: true,
-				help: [
-					"Go to discord.com/developers/applications",
-					"Create a new app, copy the Application ID",
-				],
-			},
-			{
-				flag: "--bot-token",
-				label: "Bot token",
-				required: true,
-				help: ["Go to Bot section, create a bot, copy the token"],
-			},
-			{
-				flag: "--public-key",
-				label: "Public key",
-				required: true,
-				help: ["Found in General Information of your app"],
-			},
-			{
-				flag: "--base-url",
-				label: "Public base URL",
-				placeholder: "https://example.com",
-				required: true,
-				help: [
-					"Base URL for the connector",
-					"For Discord, set the Interactions Endpoint URL to <base-url>/api/webhooks/discord",
-				],
-			},
-		],
-	},
-	{
-		id: "whatsapp",
-		name: "WhatsApp",
-		type: "webhook",
-		hint: "Requires Meta developer account and public URL.",
-		fields: [
-			{
-				flag: "--phone-number-id",
-				label: "Phone number ID",
-				required: true,
-				help: ["From your WhatsApp Business account in Meta Developer portal"],
-			},
-			{
-				flag: "--access-token",
-				label: "Access token",
-				required: true,
-				help: ["Generate a permanent token in Meta Developer portal"],
-			},
-			{
-				flag: "--app-secret",
-				label: "App secret",
-				required: true,
-				help: ["Found in App Settings > Basic"],
-			},
-			{
-				flag: "--verify-token",
-				label: "Webhook verify token",
-				placeholder: "my-verify-token",
-				required: true,
-				help: ["Any string you choose, used to verify webhook setup"],
-			},
-			{
-				flag: "--base-url",
-				label: "Public base URL",
-				placeholder: "https://example.com",
-				required: true,
-			},
-		],
-	},
-	{
-		id: "gchat",
-		name: "Google Chat",
-		type: "webhook",
-		hint: "Requires Google Cloud project and public URL.",
-		fields: [
-			{
-				flag: "--credentials-json",
-				label: "Service account credentials JSON",
-				required: true,
-				help: [
-					"Create a service account in Google Cloud Console",
-					"Download the credentials JSON file",
-					"Paste the JSON content here",
-				],
-			},
-			{
-				flag: "--base-url",
-				label: "Public base URL",
-				placeholder: "https://example.com",
-				required: true,
-			},
-		],
-	},
-	{
-		id: "linear",
-		name: "Linear",
-		type: "webhook",
-		hint: "React to Linear issues and comments.",
-		fields: [
-			{
-				flag: "--api-key",
-				label: "API key",
-				required: true,
-				help: ["Go to Linear Settings > API > Personal API keys"],
-			},
-			{
-				flag: "--webhook-secret",
-				label: "Webhook signing secret",
-				required: true,
-				help: [
-					"Go to Settings > API > Webhooks, create one",
-					"Copy the signing secret",
-				],
-			},
-			{
-				flag: "--base-url",
-				label: "Public base URL",
-				placeholder: "https://example.com",
-				required: true,
-			},
-		],
-	},
-];
+export const PLATFORMS = CONNECTOR_PLATFORMS;
+export const shouldIncludeField = shouldIncludeConnectorField;

apps/cli/src/wizards/mcp/index.ts

@@ -1,6 +1,5 @@
 import * as p from "@clack/prompts";
-import { authorizeMcpServerOAuth } from "@cline/core";
-import open from "open";
+import { authorizeMcpServerOAuthWithBrowser as authorizeOAuth } from "./oauth";
 import {
 	addServer,
 	clearServerOAuth,
@@ -17,16 +16,6 @@ function isCancel(value: unknown): value is symbol {
 	return p.isCancel(value);
 }
 
-function toErrorMessage(error: unknown): string {
-	if (error instanceof Error) {
-		const message = error.message.trim();
-		if (message.length > 0) {
-			return message;
-		}
-	}
-	return String(error);
-}
-
 function transportLabel(t: McpTransport): string {
 	if (t.type === "stdio") return `stdio: ${t.command}`;
 	return `${t.type}: ${t.url}`;
@@ -62,6 +51,19 @@ interface UrlServerConfig {
 	authMode: RemoteAuthMode;
 }
 
+export interface McpAddDefaults {
+	name?: string;
+	type?: McpTransport["type"];
+	command?: string;
+	url?: string;
+}
+
+export interface RunMcpWizardOptions {
+	initialAction?: "add";
+	addDefaults?: McpAddDefaults;
+	exitAfterInitialAction?: boolean;
+}
+
 export function parseStdioCommand(input: string): string[] {
 	const tokens: string[] = [];
 	let current = "";
@@ -107,12 +109,15 @@ export function parseStdioCommand(input: string): string[] {
 	return tokens;
 }
 
-async function collectStdioTransport(): Promise<McpTransport | null> {
+async function collectStdioTransport(
+	defaultCommand?: string,
+): Promise<McpTransport | null> {
 	p.log.info("Quoted arguments and escaped spaces are supported");
 
 	const command = await p.text({
 		message: "Command to run",
 		placeholder: "npx -y @modelcontextprotocol/server-filesystem",
+		initialValue: defaultCommand,
 		validate: (v) => {
 			if (!v?.trim()) return "Command is required";
 			return undefined;
@@ -152,10 +157,12 @@ async function collectStdioTransport(): Promise<McpTransport | null> {
 
 async function collectUrlTransport(
 	type: "sse" | "streamableHttp",
+	defaultUrl?: string,
 ): Promise<UrlServerConfig | null> {
 	const url = await p.text({
 		message: "Server URL",
 		placeholder: "https://example.com/mcp",
+		initialValue: defaultUrl,
 		validate: (v) => {
 			if (!v?.trim()) return "URL is required";
 			try {
@@ -222,33 +229,11 @@ async function collectUrlTransport(
 	};
 }
 
-async function authorizeOAuth(name: string): Promise<void> {
-	p.log.info("Opening browser for MCP OAuth authorization");
-	try {
-		const result = await authorizeMcpServerOAuth({
-			serverName: name,
-			filePath: getSettingsPath(),
-			openUrl: async (url) => {
-				p.log.message(`Authorization URL: ${url}`);
-				await open(url, { wait: false });
-			},
-			onServerListening: (info) => {
-				p.log.message(`Waiting for OAuth callback at ${info.callbackUrl}`);
-			},
-		});
-		p.log.success(result.message);
-	} catch (error) {
-		p.log.error(`OAuth authorization failed: ${toErrorMessage(error)}`);
-		p.log.warn(
-			`Server "${name}" is still saved. Choose "Authorize OAuth" to retry.`,
-		);
-	}
-}
-
-async function actionAdd(): Promise<void> {
+async function actionAdd(defaults?: McpAddDefaults): Promise<void> {
 	const name = await p.text({
 		message: "Server name",
 		placeholder: "my-mcp-server",
+		initialValue: defaults?.name,
 		validate: (v) => {
 			if (!v?.trim()) return "Name is required";
 			const existing = loadServers();
@@ -262,6 +247,7 @@ async function actionAdd(): Promise<void> {
 
 	const type = await p.select({
 		message: "Server type",
+		initialValue: defaults?.type,
 		options: [
 			{
 				value: "stdio",
@@ -285,9 +271,12 @@ async function actionAdd(): Promise<void> {
 	let transport: McpTransport | null;
 	let authMode: RemoteAuthMode = "none";
 	if (type === "stdio") {
-		transport = await collectStdioTransport();
+		transport = await collectStdioTransport(defaults?.command);
 	} else {
-		const config = await collectUrlTransport(type as "sse" | "streamableHttp");
+		const config = await collectUrlTransport(
+			type as "sse" | "streamableHttp",
+			defaults?.url,
+		);
 		transport = config?.transport ?? null;
 		authMode = config?.authMode ?? "none";
 	}
@@ -441,9 +430,25 @@ async function actionAuthorizeOAuth(): Promise<void> {
 	await authorizeOAuth(name);
 }
 
-export async function runMcpWizard(): Promise<number> {
+export async function runMcpWizard(
+	options: RunMcpWizardOptions = {},
+): Promise<number> {
 	p.intro("MCP Servers");
 
+	if (options.initialAction === "add") {
+		let initialActionExitCode = 0;
+		try {
+			await actionAdd(options.addDefaults);
+		} catch (err) {
+			initialActionExitCode = 1;
+			p.log.error(err instanceof Error ? err.message : String(err));
+		}
+		if (options.exitAfterInitialAction === true) {
+			p.outro("Done");
+			return initialActionExitCode;
+		}
+	}
+
 	let keepGoing = true;
 	while (keepGoing) {
 		const action = await p.select({

apps/cli/src/wizards/mcp/oauth.ts

@@ -0,0 +1,45 @@
+import * as p from "@clack/prompts";
+import {
+	authorizeMcpServerOAuth,
+	resolveDefaultMcpSettingsPath,
+} from "@cline/core";
+import open from "open";
+
+function toErrorMessage(error: unknown): string {
+	if (error instanceof Error) {
+		const message = error.message.trim();
+		if (message.length > 0) {
+			return message;
+		}
+	}
+	return String(error);
+}
+
+export async function authorizeMcpServerOAuthWithBrowser(
+	name: string,
+	options: { throwOnError?: boolean } = {},
+): Promise<void> {
+	p.log.info("Opening browser for MCP OAuth authorization");
+	try {
+		const result = await authorizeMcpServerOAuth({
+			serverName: name,
+			filePath: resolveDefaultMcpSettingsPath(),
+			openUrl: async (url) => {
+				p.log.message(`Authorization URL: ${url}`);
+				await open(url, { wait: false });
+			},
+			onServerListening: (info) => {
+				p.log.message(`Waiting for OAuth callback at ${info.callbackUrl}`);
+			},
+		});
+		p.log.success(result.message);
+	} catch (error) {
+		if (options.throwOnError === true) {
+			throw error instanceof Error ? error : new Error(toErrorMessage(error));
+		}
+		p.log.error(`OAuth authorization failed: ${toErrorMessage(error)}`);
+		p.log.warn(
+			`Server "${name}" is still saved. Choose "Authorize OAuth" to retry.`,
+		);
+	}
+}

apps/cline-hub/package.json

@@ -12,6 +12,7 @@
 		"dev": "bun run src/dev.ts",
 		"start": "bun run src/server.ts",
 		"smoke:options": "bun run src/validate-options.ts",
+		"test": "bunx vitest run --config vitest.config.ts",
 		"typecheck": "bun tsc -p tsconfig.json --noEmit"
 	},
 	"dependencies": {

apps/cline-hub/src/options.ts

@@ -1,3 +1,5 @@
+import { isIP } from "node:net";
+
 export interface ClineHubServerOptions {
 	host: string;
 	port: number;
@@ -47,6 +49,9 @@ function normalizePublicUrl(
 			`PUBLIC_URL must use http: or https:, got ${parsed.protocol}`,
 		);
 	}
+	if (shouldAddDashboardPortToPublicUrl(parsed, port)) {
+		parsed.port = String(port);
+	}
 	parsed.hash = "";
 	return parsed.toString().replace(/\/$/, "");
 }
@@ -85,12 +90,26 @@ export function resolveClineHubServerOptions(
 	};
 }
 
+function isDefaultProtocolPort(url: URL, port: number): boolean {
+	return (
+		(url.protocol === "http:" && port === 80) ||
+		(url.protocol === "https:" && port === 443)
+	);
+}
+
+function shouldAddDashboardPortToPublicUrl(url: URL, port: number): boolean {
+	if (url.port || isDefaultProtocolPort(url, port)) return false;
+	const hostname = url.hostname.replace(/^\[|\]$/g, "");
+	return hostname === "localhost" || isIP(hostname) !== 0;
+}
+
 export function buildInviteUrl(
 	publicUrl: string,
 	roomSecret: string | undefined,
 ): string {
-	if (!roomSecret) return publicUrl;
 	const url = new URL(publicUrl);
-	url.searchParams.set("roomSecret", roomSecret);
+	if (roomSecret) {
+		url.searchParams.set("roomSecret", roomSecret);
+	}
 	return url.toString();
 }

apps/cline-hub/src/server.ts

@@ -4,6 +4,7 @@ import {
 	handleToolApprovalResponse,
 	rejectOrphanedApprovals,
 } from "./server/approvals";
+import { isAuthorizedBrowserToDesktopRequest } from "./server/browser-auth";
 import {
 	browserConfig,
 	host,
@@ -14,7 +15,11 @@ import {
 	webviewDistDir,
 } from "./server/deps";
 import { handleDesktopCommand } from "./server/desktop-commands";
-import { createJsonResponse, WebviewAssets } from "./server/http";
+import {
+	createJsonResponse,
+	isWebviewRoute,
+	WebviewAssets,
+} from "./server/http";
 import {
 	attachHub,
 	detachHub,
@@ -22,6 +27,7 @@ import {
 	syncHubClientsAndSessions,
 	syncHubHealth,
 } from "./server/hub";
+import { fetchMarketplaceCatalog } from "./server/marketplace";
 import {
 	loadModels,
 	runProviderOAuthLogin,
@@ -52,17 +58,33 @@ export interface ClineHubDashboardServer {
 	stop: () => Promise<void>;
 }
 
+const PUBLIC_BROWSER_PATHS = new Set([
+	"/version",
+	"/health",
+	"/config.json",
+	"/api/marketplace/catalog",
+	"/icon.png",
+	"/icon.svg",
+	"/icon.ico",
+	"/32x32.png",
+	"/cline-logo-filled.svg",
+	"/favicon.svg",
+]);
+
+function isPublicStaticAssetPath(pathname: string): boolean {
+	return pathname.startsWith("/assets/") || PUBLIC_BROWSER_PATHS.has(pathname);
+}
+
+function isPublicBrowserRoute(_req: Request, url: URL): boolean {
+	return isWebviewRoute(url.pathname) || isPublicStaticAssetPath(url.pathname);
+}
+
 export async function startClineHubDashboardServer(): Promise<ClineHubDashboardServer> {
 	const ctx = new HubContext();
 	const assets = new WebviewAssets(webviewDistDir);
 	const syncClientsAndSessions = () => syncHubClientsAndSessions(ctx);
 	let stopped = false;
 
-	function isAuthorizedBrowserRequest(url: URL): boolean {
-		if (!roomSecret) return true;
-		return url.searchParams.get("roomSecret") === roomSecret;
-	}
-
 	await attachHub(ctx);
 	const healthInterval = setInterval(() => {
 		void (async () => {
@@ -76,6 +98,21 @@ export async function startClineHubDashboardServer(): Promise<ClineHubDashboardS
 		hostname: host,
 		async fetch(req, server) {
 			const url = new URL(req.url);
+			if (
+				!isAuthorizedBrowserToDesktopRequest(
+					req,
+					url,
+					{
+						bindHost: host,
+						port,
+						publicUrl,
+						roomSecret,
+					},
+					isPublicBrowserRoute,
+				)
+			) {
+				return createJsonResponse({ error: "unauthorized_browser" }, 403);
+			}
 			if (url.pathname === "/version") {
 				return createJsonResponse({ coreVersion: CORE_BUILD_VERSION });
 			}
@@ -84,9 +121,6 @@ export async function startClineHubDashboardServer(): Promise<ClineHubDashboardS
 				return createJsonResponse(hubStatusPayload(ctx));
 			}
 			if (url.pathname === "/browser") {
-				if (!isAuthorizedBrowserRequest(url)) {
-					return createJsonResponse({ error: "invalid_room_secret" }, 401);
-				}
 				const displayName = `Browser ${Math.random().toString(36).slice(2, 6)}`;
 				const data = {
 					socket: undefined as never,
@@ -99,6 +133,21 @@ export async function startClineHubDashboardServer(): Promise<ClineHubDashboardS
 			if (url.pathname === "/config.json") {
 				return createJsonResponse(browserConfig);
 			}
+			if (url.pathname === "/api/marketplace/catalog") {
+				try {
+					return createJsonResponse(await fetchMarketplaceCatalog());
+				} catch (error) {
+					return createJsonResponse(
+						{
+							error:
+								error instanceof Error
+									? error.message
+									: "Failed to fetch marketplace catalog",
+						},
+						502,
+					);
+				}
+			}
 			return assets.serve(url.pathname);
 		},
 		websocket: {

apps/cline-hub/src/server/browser-auth.test.ts

@@ -0,0 +1,359 @@
+import { describe, expect, it } from "vitest";
+import {
+	allowedBrowserHosts,
+	allowedBrowserOrigins,
+	isAuthorizedBrowserRequest,
+	isAuthorizedBrowserToDesktopRequest,
+	requiresBrowserRequestAuth,
+} from "./browser-auth";
+
+const defaultOptions = {
+	bindHost: "127.0.0.1",
+	port: 8787,
+	publicUrl: "http://127.0.0.1:8787",
+};
+
+const publicRoute = (_req: Request, url: URL) => url.pathname === "/public";
+
+function browserRequest(
+	origin?: string,
+	init?: Omit<RequestInit, "headers"> & {
+		headers?: Record<string, string>;
+	},
+): Request {
+	return new Request("http://127.0.0.1:8787/browser", {
+		...init,
+		headers: {
+			host: "127.0.0.1:8787",
+			...(origin === undefined ? {} : { origin }),
+			...(init?.headers ?? {}),
+		},
+	});
+}
+
+describe("allowedBrowserOrigins", () => {
+	it("allows the configured public URL origin and local aliases for local binds", () => {
+		expect([...allowedBrowserOrigins(defaultOptions)].sort()).toEqual([
+			"http://127.0.0.1:8787",
+			"http://[::1]:8787",
+			"http://localhost:8787",
+		]);
+	});
+
+	it("uses the configured public URL scheme for local aliases", () => {
+		expect(
+			[
+				...allowedBrowserOrigins({
+					...defaultOptions,
+					publicUrl: "https://127.0.0.1:8787",
+				}),
+			].sort(),
+		).toEqual([
+			"https://127.0.0.1:8787",
+			"https://[::1]:8787",
+			"https://localhost:8787",
+		]);
+	});
+
+	it("omits default protocol ports for local alias origins", () => {
+		expect(
+			[
+				...allowedBrowserOrigins({
+					bindHost: "127.0.0.1",
+					port: 80,
+					publicUrl: "http://localhost",
+				}),
+			].sort(),
+		).toEqual(["http://127.0.0.1", "http://[::1]", "http://localhost"]);
+
+		expect(
+			[
+				...allowedBrowserOrigins({
+					bindHost: "127.0.0.1",
+					port: 443,
+					publicUrl: "https://localhost",
+				}),
+			].sort(),
+		).toEqual(["https://127.0.0.1", "https://[::1]", "https://localhost"]);
+	});
+
+	it("allows the configured public URL origin and explicit bind origin for non-local binds", () => {
+		expect(
+			[
+				...allowedBrowserOrigins({
+					bindHost: "0.0.0.0",
+					port: 8787,
+					publicUrl: "https://example.ngrok-free.app",
+					roomSecret: "secret",
+				}),
+			].sort(),
+		).toEqual(["https://0.0.0.0:8787", "https://example.ngrok-free.app"]);
+	});
+});
+
+describe("allowedBrowserHosts", () => {
+	it("allows the configured public URL host and local aliases for local binds", () => {
+		expect([...allowedBrowserHosts(defaultOptions)].sort()).toEqual([
+			"127.0.0.1:8787",
+			"[::1]:8787",
+			"localhost:8787",
+		]);
+	});
+
+	it("omits default protocol ports for local alias hosts", () => {
+		expect(
+			[
+				...allowedBrowserHosts({
+					bindHost: "127.0.0.1",
+					port: 80,
+					publicUrl: "http://localhost",
+				}),
+			].sort(),
+		).toEqual(["127.0.0.1", "[::1]", "localhost"]);
+
+		expect(
+			[
+				...allowedBrowserHosts({
+					bindHost: "127.0.0.1",
+					port: 443,
+					publicUrl: "https://localhost",
+				}),
+			].sort(),
+		).toEqual(["127.0.0.1", "[::1]", "localhost"]);
+	});
+
+	it("allows the configured public URL host and explicit bind host for non-local binds", () => {
+		expect(
+			[
+				...allowedBrowserHosts({
+					bindHost: "0.0.0.0",
+					port: 8787,
+					publicUrl: "https://example.ngrok-free.app",
+					roomSecret: "secret",
+				}),
+			].sort(),
+		).toEqual(["0.0.0.0:8787", "example.ngrok-free.app"]);
+	});
+});
+
+describe("requiresBrowserRequestAuth", () => {
+	it("does not require browser auth for public GET routes", () => {
+		expect(
+			requiresBrowserRequestAuth(
+				new Request("http://127.0.0.1:8787/public"),
+				new URL("http://127.0.0.1:8787/public"),
+				publicRoute,
+			),
+		).toBe(false);
+	});
+
+	it("requires browser auth for unknown paths even when they use GET", () => {
+		expect(
+			requiresBrowserRequestAuth(
+				new Request("http://127.0.0.1:8787/future-api"),
+				new URL("http://127.0.0.1:8787/future-api"),
+				publicRoute,
+			),
+		).toBe(true);
+	});
+
+	it("requires browser auth for privileged paths even when they use GET", () => {
+		expect(
+			requiresBrowserRequestAuth(
+				new Request("http://127.0.0.1:8787/browser"),
+				new URL("http://127.0.0.1:8787/browser"),
+				publicRoute,
+			),
+		).toBe(true);
+	});
+
+	it("requires browser auth for every WebSocket upgrade path", () => {
+		expect(
+			requiresBrowserRequestAuth(
+				new Request("http://127.0.0.1:8787/future-socket", {
+					headers: { upgrade: "websocket" },
+				}),
+				new URL("http://127.0.0.1:8787/future-socket"),
+				publicRoute,
+			),
+		).toBe(true);
+	});
+
+	it("requires browser auth for every unsafe HTTP method", () => {
+		expect(
+			requiresBrowserRequestAuth(
+				new Request("http://127.0.0.1:8787/future-api", { method: "POST" }),
+				new URL("http://127.0.0.1:8787/future-api"),
+				publicRoute,
+			),
+		).toBe(true);
+	});
+});
+
+describe("isAuthorizedBrowserRequest", () => {
+	it.each([
+		"http://127.0.0.1:8787",
+		"http://localhost:8787",
+		"http://[::1]:8787",
+	])("accepts local dashboard origin %s without a room secret", (origin) => {
+		expect(
+			isAuthorizedBrowserRequest(
+				browserRequest(origin),
+				new URL("http://127.0.0.1:8787/browser"),
+				defaultOptions,
+			),
+		).toBe(true);
+	});
+
+	it.each([
+		undefined,
+		"",
+		"null",
+		"not a url",
+		"http://evil.attacker.example.com",
+		"http://127.0.0.1:9999",
+		"https://127.0.0.1:8787",
+	])("rejects untrusted origin %s", (origin) => {
+		expect(
+			isAuthorizedBrowserRequest(
+				browserRequest(origin),
+				new URL("http://127.0.0.1:8787/browser"),
+				defaultOptions,
+			),
+		).toBe(false);
+	});
+
+	it.each([
+		undefined,
+		"",
+		"evil.attacker.example.com",
+		"127.0.0.1:9999",
+		"localhost:9999",
+	])("rejects untrusted host %s", (host) => {
+		expect(
+			isAuthorizedBrowserRequest(
+				browserRequest("http://127.0.0.1:8787", {
+					headers: host === undefined ? { host: "" } : { host },
+				}),
+				new URL("http://127.0.0.1:8787/browser"),
+				defaultOptions,
+			),
+		).toBe(false);
+	});
+
+	it("allows explicit wildcard bind host and origin when a room secret is configured", () => {
+		expect(
+			isAuthorizedBrowserRequest(
+				browserRequest("http://0.0.0.0:8787", {
+					headers: { host: "0.0.0.0:8787" },
+				}),
+				new URL("http://0.0.0.0:8787/browser?roomSecret=invite-123"),
+				{
+					bindHost: "0.0.0.0",
+					port: 8787,
+					publicUrl: "http://127.0.0.1:8787",
+					roomSecret: "invite-123",
+				},
+			),
+		).toBe(true);
+	});
+
+	it("requires trusted origin, trusted host, and room secret when a room secret is configured", () => {
+		const options = { ...defaultOptions, roomSecret: "invite-123" };
+
+		expect(
+			isAuthorizedBrowserRequest(
+				browserRequest("http://127.0.0.1:8787"),
+				new URL("http://127.0.0.1:8787/browser?roomSecret=invite-123"),
+				options,
+			),
+		).toBe(true);
+		expect(
+			isAuthorizedBrowserRequest(
+				browserRequest("http://127.0.0.1:8787"),
+				new URL("http://127.0.0.1:8787/browser"),
+				options,
+			),
+		).toBe(false);
+		expect(
+			isAuthorizedBrowserRequest(
+				browserRequest("http://evil.attacker.example.com"),
+				new URL("http://127.0.0.1:8787/browser?roomSecret=invite-123"),
+				options,
+			),
+		).toBe(false);
+		expect(
+			isAuthorizedBrowserRequest(
+				browserRequest("http://127.0.0.1:8787", {
+					headers: { host: "evil.attacker.example.com" },
+				}),
+				new URL("http://127.0.0.1:8787/browser?roomSecret=invite-123"),
+				options,
+			),
+		).toBe(false);
+	});
+});
+
+describe("isAuthorizedBrowserToDesktopRequest", () => {
+	it("allows safe public GET routes without an origin", () => {
+		expect(
+			isAuthorizedBrowserToDesktopRequest(
+				new Request("http://127.0.0.1:8787/public"),
+				new URL("http://127.0.0.1:8787/public"),
+				defaultOptions,
+				publicRoute,
+			),
+		).toBe(true);
+	});
+
+	it("rejects future WebSocket paths from untrusted origins by default", () => {
+		expect(
+			isAuthorizedBrowserToDesktopRequest(
+				new Request("http://127.0.0.1:8787/future-socket", {
+					headers: {
+						host: "127.0.0.1:8787",
+						origin: "http://evil.attacker.example.com",
+						upgrade: "websocket",
+					},
+				}),
+				new URL("http://127.0.0.1:8787/future-socket"),
+				defaultOptions,
+				publicRoute,
+			),
+		).toBe(false);
+	});
+
+	it("rejects future unsafe HTTP routes from untrusted origins by default", () => {
+		expect(
+			isAuthorizedBrowserToDesktopRequest(
+				new Request("http://127.0.0.1:8787/future-api", {
+					method: "POST",
+					headers: {
+						host: "127.0.0.1:8787",
+						origin: "http://evil.attacker.example.com",
+					},
+				}),
+				new URL("http://127.0.0.1:8787/future-api"),
+				defaultOptions,
+				publicRoute,
+			),
+		).toBe(false);
+	});
+
+	it("allows future unsafe HTTP routes from trusted origins", () => {
+		expect(
+			isAuthorizedBrowserToDesktopRequest(
+				new Request("http://127.0.0.1:8787/future-api", {
+					method: "POST",
+					headers: {
+						host: "127.0.0.1:8787",
+						origin: "http://127.0.0.1:8787",
+					},
+				}),
+				new URL("http://127.0.0.1:8787/future-api"),
+				defaultOptions,
+				publicRoute,
+			),
+		).toBe(true);
+	});
+});

apps/cline-hub/src/server/browser-auth.ts

@@ -0,0 +1,134 @@
+import { isNonLocalBindHost } from "../options";
+
+export interface BrowserRequestAuthOptions {
+	bindHost: string;
+	port: number;
+	publicUrl: string;
+	roomSecret?: string;
+}
+
+const SAFE_HTTP_METHODS = new Set(["GET", "HEAD", "OPTIONS"]);
+
+export type PublicBrowserRoutePredicate = (req: Request, url: URL) => boolean;
+
+function isWebSocketUpgrade(req: Request): boolean {
+	return req.headers.get("upgrade")?.toLowerCase() === "websocket";
+}
+
+function parseOrigin(value: string | null): string | undefined {
+	const origin = parseHeader(value);
+	try {
+		return new URL(origin ?? "").origin;
+	} catch {
+		return undefined;
+	}
+}
+
+function parseHeader(value: string | null): string | undefined {
+	const host = value?.trim().toLowerCase();
+	return host || undefined;
+}
+
+function formatHostForOrigin(host: string): string {
+	return host.includes(":") && !host.startsWith("[") ? `[${host}]` : host;
+}
+
+function isDefaultProtocolPort(protocol: string, port: number): boolean {
+	return (
+		(protocol === "http:" && port === 80) ||
+		(protocol === "https:" && port === 443)
+	);
+}
+
+function originForHost(protocol: string, host: string, port: number): string {
+	return new URL(`${protocol}//${formatHostForOrigin(host)}:${port}`).origin;
+}
+
+function hostHeaderForHost(
+	protocol: string,
+	host: string,
+	port: number,
+): string {
+	const formattedHost = formatHostForOrigin(host).toLowerCase();
+	return isDefaultProtocolPort(protocol, port)
+		? formattedHost
+		: `${formattedHost}:${port}`;
+}
+
+export function allowedBrowserOrigins({
+	bindHost,
+	port,
+	publicUrl,
+}: BrowserRequestAuthOptions): Set<string> {
+	const publicUrlParts = new URL(publicUrl);
+	const origins = new Set<string>();
+	origins.add(publicUrlParts.origin);
+
+	origins.add(originForHost(publicUrlParts.protocol, bindHost, port));
+
+	if (!isNonLocalBindHost(bindHost)) {
+		for (const hostname of ["127.0.0.1", "localhost", "[::1]"]) {
+			origins.add(originForHost(publicUrlParts.protocol, hostname, port));
+		}
+	}
+
+	return origins;
+}
+
+export function allowedBrowserHosts({
+	bindHost,
+	port,
+	publicUrl,
+}: BrowserRequestAuthOptions): Set<string> {
+	const publicUrlParts = new URL(publicUrl);
+	const hosts = new Set<string>();
+	const publicHost = publicUrlParts.host.toLowerCase();
+	hosts.add(publicHost);
+
+	hosts.add(hostHeaderForHost(publicUrlParts.protocol, bindHost, port));
+
+	if (!isNonLocalBindHost(bindHost)) {
+		for (const hostname of ["127.0.0.1", "localhost", "[::1]"]) {
+			hosts.add(hostHeaderForHost(publicUrlParts.protocol, hostname, port));
+		}
+	}
+
+	return hosts;
+}
+
+export function requiresBrowserRequestAuth(
+	req: Request,
+	url: URL,
+	isPublicBrowserRoute: PublicBrowserRoutePredicate,
+): boolean {
+	if (isWebSocketUpgrade(req)) return true;
+	if (!SAFE_HTTP_METHODS.has(req.method.toUpperCase())) return true;
+	return !isPublicBrowserRoute(req, url);
+}
+
+export function isAuthorizedBrowserRequest(
+	req: Request,
+	url: URL,
+	options: BrowserRequestAuthOptions,
+): boolean {
+	const host = parseHeader(req.headers.get("host"));
+	if (!host || !allowedBrowserHosts(options).has(host)) return false;
+
+	const origin = parseOrigin(req.headers.get("origin"));
+	if (!origin || !allowedBrowserOrigins(options).has(origin)) return false;
+
+	if (!options.roomSecret) return true;
+	return url.searchParams.get("roomSecret") === options.roomSecret;
+}
+
+export function isAuthorizedBrowserToDesktopRequest(
+	req: Request,
+	url: URL,
+	options: BrowserRequestAuthOptions,
+	isPublicBrowserRoute: PublicBrowserRoutePredicate,
+): boolean {
+	return (
+		!requiresBrowserRequestAuth(req, url, isPublicBrowserRoute) ||
+		isAuthorizedBrowserRequest(req, url, options)
+	);
+}

apps/cline-hub/src/server/connectors.test.ts

@@ -0,0 +1,97 @@
+import { describe, expect, it } from "vitest";
+import { __test__ } from "./connectors";
+
+describe("connector launch command", () => {
+	it("uses Bun conditions when launching the source CLI from Bun", () => {
+		expect(
+			__test__.buildCliConnectCommand(["telegram", "--bot-token", "token"], {
+				execPath: "/Users/test/.bun/bin/bun",
+				cliPath: "/repo/apps/cli/src/index.ts",
+				exists: () => true,
+			}),
+		).toEqual({
+			launcher: "/Users/test/.bun/bin/bun",
+			childArgs: [
+				"--conditions=development",
+				"/repo/apps/cli/src/index.ts",
+				"connect",
+				"telegram",
+				"--bot-token",
+				"token",
+			],
+		});
+	});
+
+	it("uses compiled CLI subcommands without Bun flags", () => {
+		expect(
+			__test__.buildCliConnectCommand(["telegram", "--bot-token", "token"], {
+				execPath: "/Applications/Cline/bin/cline",
+				cliPath: "/repo/apps/cli/src/index.ts",
+				exists: () => true,
+			}),
+		).toEqual({
+			launcher: "/Applications/Cline/bin/cline",
+			childArgs: ["connect", "telegram", "--bot-token", "token"],
+		});
+	});
+
+	it("uses Bun conditions when launching the source CLI from Node", () => {
+		expect(
+			__test__.buildCliConnectCommand(["telegram", "--bot-token", "token"], {
+				execPath: "/usr/local/bin/node",
+				cliPath: "/repo/apps/cli/src/index.ts",
+				exists: () => true,
+			}),
+		).toEqual({
+			launcher: "bun",
+			childArgs: [
+				"--conditions=development",
+				"/repo/apps/cli/src/index.ts",
+				"connect",
+				"telegram",
+				"--bot-token",
+				"token",
+			],
+		});
+	});
+
+	it("detects Windows Node when launching the source CLI", () => {
+		expect(
+			__test__.buildCliConnectCommand(["telegram", "--bot-token", "token"], {
+				execPath: "node.exe",
+				cliPath: "C:\\repo\\apps\\cli\\src\\index.ts",
+				exists: () => true,
+			}),
+		).toEqual({
+			launcher: "bun",
+			childArgs: [
+				"--conditions=development",
+				"C:\\repo\\apps\\cli\\src\\index.ts",
+				"connect",
+				"telegram",
+				"--bot-token",
+				"token",
+			],
+		});
+	});
+
+	it("strips terminal color codes from connector command failures", () => {
+		expect(
+			__test__.normalizeConnectorError(
+				"\u001B[31merror:\u001B[0m error: unknown option '--conditions=development'",
+				"connector start failed",
+			),
+		).toBe("unknown option '--conditions=development'");
+	});
+
+	it("turns Telegram unauthorized responses into a token validation message", () => {
+		expect(
+			__test__.normalizeConnectorError(
+				"\u001B[31merror:\u001B[0m Telegram getMe failed (401 Unauthorized): Unauthorized",
+				"connector start failed",
+			),
+		).toBe(
+			"Telegram rejected this bot token. Copy the token from @BotFather and try again.",
+		);
+	});
+});

apps/cline-hub/src/server/connectors.ts

@@ -1,5 +1,8 @@
 import { spawn } from "node:child_process";
+import { existsSync } from "node:fs";
+import { basename } from "node:path";
 import process from "node:process";
+import { withResolvedClineBuildEnv } from "@cline/shared";
 import { listConnectorCatalog } from "../../../cli/src/connectors/catalog";
 import { listActiveConnectors } from "../../../cli/src/connectors/status";
 import {
@@ -13,6 +16,68 @@ import type {
 import { cliIndexPath, workspaceRoot } from "./deps";
 import { asRecord, asString } from "./utils";
 
+type CliConnectCommand = {
+	launcher: string;
+	childArgs: string[];
+};
+
+const ANSI_ESCAPE_PATTERN = new RegExp(
+	[
+		"[\\u001B\\u009B][[\\]()#;?]*",
+		"(?:(?:(?:[a-zA-Z\\d]*(?:;[a-zA-Z\\d]*)*)?\\u0007)",
+		"|(?:(?:\\d{1,4}(?:;\\d{0,4})*)?[\\dA-PR-TZcf-nq-uy=><~]))",
+	].join(""),
+	"g",
+);
+
+function stripAnsi(value: string): string {
+	return value.replace(ANSI_ESCAPE_PATTERN, "");
+}
+
+function normalizeConnectorError(rawMessage: string, fallback: string): string {
+	const message =
+		stripAnsi(rawMessage)
+			.replace(/\r\n/g, "\n")
+			.trim()
+			.replace(/^(?:error:\s*)+/i, "")
+			.trim() || fallback;
+
+	if (
+		/^Telegram getMe failed \(401 Unauthorized\): Unauthorized$/i.test(message)
+	) {
+		return "Telegram rejected this bot token. Copy the token from @BotFather and try again.";
+	}
+
+	return message.slice(0, 2_000);
+}
+
+function buildCliConnectCommand(
+	args: string[],
+	options: {
+		execPath?: string;
+		cliPath?: string;
+		exists?: (path: string) => boolean;
+	} = {},
+): CliConnectCommand {
+	const execPath = options.execPath ?? process.execPath;
+	const cliPath = options.cliPath ?? cliIndexPath;
+	const exists = options.exists ?? existsSync;
+	const runtimeName = basename(execPath).toLowerCase();
+	const isBunRuntime = runtimeName.includes("bun");
+	const isNodeRuntime = runtimeName === "node" || runtimeName === "node.exe";
+	const useBunSourceEntrypoint =
+		(isBunRuntime || isNodeRuntime) && exists(cliPath);
+	const launcher = isBunRuntime
+		? execPath
+		: useBunSourceEntrypoint
+			? "bun"
+			: execPath;
+	const childArgs = useBunSourceEntrypoint
+		? ["--conditions=development", cliPath, "connect", ...args]
+		: ["connect", ...args];
+	return { launcher, childArgs };
+}
+
 export function connectorChannelsPayload(): WebviewConnectorChannelsResponse {
 	const supported = new Set(
 		listConnectorCatalog().map((connector) => connector.name),
@@ -55,23 +120,14 @@ async function runCliConnectCommand(args: string[]): Promise<{
 	stdout: string;
 	stderr: string;
 }> {
-	const launcher = (process.versions as Record<string, string | undefined>).bun
-		? process.execPath
-		: "bun";
-	const child = spawn(
-		launcher,
-		["--conditions=development", cliIndexPath, "connect", ...args],
-		{
-			cwd: workspaceRoot,
-			env: {
-				...process.env,
-				CLINE_BUILD_ENV: process.env.CLINE_BUILD_ENV ?? "development",
-			},
-			stdio: ["ignore", "pipe", "pipe"],
-			// Prevent a console window from flashing on Windows.
-			windowsHide: true,
-		},
-	);
+	const { launcher, childArgs } = buildCliConnectCommand(args);
+	const child = spawn(launcher, childArgs, {
+		cwd: workspaceRoot,
+		env: withResolvedClineBuildEnv(process.env),
+		stdio: ["ignore", "pipe", "pipe"],
+		// Prevent a console window from flashing on Windows.
+		windowsHide: true,
+	});
 	let stdout = "";
 	let stderr = "";
 	child.stdout?.setEncoding("utf8");
@@ -157,9 +213,10 @@ export async function startConnectorChannel(
 	const result = await runCliConnectCommand(cliArgs);
 	if (result.code !== 0) {
 		throw new Error(
-			(result.stderr.trim() || result.stdout.trim() || "connector start failed")
-				.trim()
-				.slice(0, 2_000),
+			normalizeConnectorError(
+				result.stderr || result.stdout,
+				"connector start failed",
+			),
 		);
 	}
 	await waitForConnectorState(() =>
@@ -168,6 +225,11 @@ export async function startConnectorChannel(
 	return connectorChannelsPayload();
 }
 
+export const __test__ = {
+	buildCliConnectCommand,
+	normalizeConnectorError,
+};
+
 export async function stopConnectorChannel(
 	args?: Record<string, unknown>,
 ): Promise<WebviewConnectorChannelsResponse> {
@@ -182,9 +244,10 @@ export async function stopConnectorChannel(
 	const result = await runCliConnectCommand([channel, "--stop"]);
 	if (result.code !== 0) {
 		throw new Error(
-			(result.stderr.trim() || result.stdout.trim() || "connector stop failed")
-				.trim()
-				.slice(0, 2_000),
+			normalizeConnectorError(
+				result.stderr || result.stdout,
+				"connector stop failed",
+			),
 		);
 	}
 	await waitForConnectorState(

apps/cline-hub/src/server/desktop-commands.ts

@@ -4,15 +4,20 @@ import {
 	ClineAccountService,
 	ensureCustomProvidersLoaded,
 	executeClineAccountAction,
+	formatProviderOAuthApiKey,
 	getLocalProviderModels,
+	getPersistedProviderApiKey,
+	getProviderOAuthCredentialsFromSettings,
+	getValidClineCredentials,
 	listLocalProviders,
 	loginAndSaveLocalProviderOAuthCredentials,
 	normalizeOAuthProvider,
 	type ProviderCapability,
 	type ProviderClient,
 	type ProviderProtocol,
+	type ProviderSettings,
 	readGlobalSettings,
-	resolveLocalClineAuthToken,
+	saveLocalProviderOAuthCredentials,
 	saveLocalProviderSettings,
 	setAutoUpdateEnabledGlobally,
 	setDisabledPlugin,
@@ -27,6 +32,12 @@ import {
 	stopConnectorChannel,
 } from "./connectors";
 import { providerSettingsManager, workspaceRoot } from "./deps";
+import {
+	installMarketplaceEntryForDesktopCommand,
+	listMarketplaceInstalledEntries,
+	uninstallLocalPrimitive,
+	uninstallMarketplaceEntryForDesktopCommand,
+} from "./marketplace";
 import {
 	deleteMcpServer,
 	ensureMcpSettingsFile,
@@ -52,6 +63,39 @@ const ROUTINE_SCHEDULE_COMMANDS = new Set([
 	"delete_routine_schedule",
 ]);
 
+async function resolveHubClineAccountAuthToken(input: {
+	settings?: ProviderSettings;
+	apiBaseUrl: string;
+}): Promise<string | undefined> {
+	const credentials = input.settings
+		? getProviderOAuthCredentialsFromSettings("cline", input.settings)
+		: null;
+	if (!credentials || !input.settings) {
+		return getPersistedProviderApiKey("cline", input.settings);
+	}
+
+	const nextCredentials = await getValidClineCredentials(credentials, {
+		apiBaseUrl: input.apiBaseUrl,
+	});
+	if (!nextCredentials) {
+		throw new Error(
+			"Cline account requires re-authentication. Run cline auth cline.",
+		);
+	}
+
+	if (nextCredentials !== credentials) {
+		saveLocalProviderOAuthCredentials(
+			providerSettingsManager,
+			"cline",
+			input.settings,
+			nextCredentials,
+			{ setLastUsed: false },
+		);
+	}
+
+	return formatProviderOAuthApiKey("cline", nextCredentials);
+}
+
 export async function handleDesktopCommand(
 	ctx: HubContext,
 	command: string,
@@ -128,10 +172,18 @@ export async function handleDesktopCommand(
 	}
 	if (command === "cline_account") {
 		const settings = providerSettingsManager.getProviderSettings("cline");
+		const apiBaseUrl =
+			settings?.baseUrl?.trim() || getClineEnvironmentConfig().apiBaseUrl;
+		const authToken = await resolveHubClineAccountAuthToken({
+			settings,
+			apiBaseUrl,
+		});
+		if (!authToken) {
+			throw new Error("No Cline account auth token found");
+		}
 		const accountService = new ClineAccountService({
-			apiBaseUrl:
-				settings?.baseUrl?.trim() || getClineEnvironmentConfig().apiBaseUrl,
-			getAuthToken: async () => resolveLocalClineAuthToken(settings),
+			apiBaseUrl,
+			getAuthToken: async () => authToken,
 		});
 		return await executeClineAccountAction(
 			args as ClineAccountActionRequest,
@@ -213,6 +265,27 @@ export async function handleDesktopCommand(
 	if (command === "list_user_instruction_configs") {
 		return await listUserInstructionConfigs(workspaceRoot);
 	}
+	if (command === "list_marketplace_installed_entries") {
+		return listMarketplaceInstalledEntries(
+			args,
+			await listUserInstructionConfigs(workspaceRoot),
+		);
+	}
+	if (command === "install_marketplace_entry") {
+		const result = await installMarketplaceEntryForDesktopCommand(args);
+		broadcastHubState(ctx);
+		return result;
+	}
+	if (command === "uninstall_marketplace_entry") {
+		const result = await uninstallMarketplaceEntryForDesktopCommand(args);
+		broadcastHubState(ctx);
+		return result;
+	}
+	if (command === "uninstall_local_primitive") {
+		const result = await uninstallLocalPrimitive(args, { workspaceRoot });
+		broadcastHubState(ctx);
+		return result;
+	}
 	if (command === "toggle_disabled_plugin_tool") {
 		const toolName = String(args?.name ?? "").trim();
 		if (!toolName) throw new Error("tool name is required");

apps/cline-hub/src/server/http.test.ts

@@ -0,0 +1,54 @@
+import { describe, expect, it } from "vitest";
+import { isWebviewRoute, normalizeWebviewIndexHtml } from "./http";
+
+describe("isWebviewRoute", () => {
+	it.each([
+		"/",
+		"/chat",
+		"/sessions",
+		"/models",
+		"/customizations",
+		"/rules",
+		"/hooks",
+		"/mcp",
+		"/plugins",
+		"/skills",
+		"/agents",
+		"/tools",
+		"/marketplace",
+		"/marketplace/mcp",
+		"/marketplace/skills",
+		"/marketplace/plugins",
+		"/channels",
+		"/schedules",
+		"/settings",
+		"/settings/providers",
+	])("matches dashboard SPA route %s", (pathname) => {
+		expect(isWebviewRoute(pathname)).toBe(true);
+	});
+
+	it("does not treat nested marketplace asset requests as SPA routes", () => {
+		expect(isWebviewRoute("/marketplace/assets/index.js")).toBe(false);
+	});
+});
+
+describe("normalizeWebviewIndexHtml", () => {
+	it("rewrites relative built asset URLs so deep links can refresh", () => {
+		expect(
+			normalizeWebviewIndexHtml(
+				'<script type="module" src="./assets/index.js"></script><link href="./assets/index.css">',
+			),
+		).toBe(
+			'<script type="module" src="/assets/index.js"></script><link href="/assets/index.css">',
+		);
+	});
+
+	it("injects the persisted theme bootstrap once", () => {
+		const normalized = normalizeWebviewIndexHtml(
+			"<html><head></head><body></body></html>",
+		);
+
+		expect(normalized).toContain('id="cline-hub-theme-bootstrap"');
+		expect(normalizeWebviewIndexHtml(normalized)).toBe(normalized);
+	});
+});

apps/cline-hub/src/server/http.ts

@@ -15,6 +15,25 @@ export function createTextResponse(text: string, status = 200): Response {
 	});
 }
 
+const NO_STORE_HEADERS = {
+	"cache-control": "no-store, no-cache, must-revalidate, proxy-revalidate",
+	pragma: "no-cache",
+	expires: "0",
+};
+
+const IMMUTABLE_ASSET_CACHE = "public, max-age=31536000, immutable";
+const THEME_BOOTSTRAP_SCRIPT = `<script id="cline-hub-theme-bootstrap">
+  (() => {
+    try {
+      const theme = window.localStorage.getItem("cline-hub-theme");
+      if (theme === "dark" || theme === "light") {
+        document.documentElement.classList.toggle("dark", theme === "dark");
+        document.documentElement.dataset.clineHubTheme = theme;
+      }
+    } catch {}
+  })();
+</script>`;
+
 function contentTypeFor(path: string): string {
 	switch (extname(path)) {
 		case ".html":
@@ -36,20 +55,47 @@ function contentTypeFor(path: string): string {
 	}
 }
 
-function isWebviewRoute(pathname: string): boolean {
+export function isWebviewRoute(pathname: string): boolean {
 	return (
 		pathname === "/" ||
 		pathname === "/index.html" ||
 		pathname === "/chat" ||
+		pathname === "/sessions" ||
+		pathname === "/models" ||
+		pathname === "/customizations" ||
+		pathname === "/rules" ||
+		pathname === "/hooks" ||
+		pathname === "/mcp" ||
+		pathname === "/plugins" ||
+		pathname === "/skills" ||
+		pathname === "/agents" ||
+		pathname === "/tools" ||
+		pathname === "/marketplace" ||
+		pathname === "/marketplace/mcp" ||
+		pathname === "/marketplace/skills" ||
+		pathname === "/marketplace/plugins" ||
+		pathname === "/channels" ||
+		pathname === "/schedules" ||
 		pathname === "/settings" ||
 		pathname.startsWith("/settings/")
 	);
 }
 
+export function normalizeWebviewIndexHtml(html: string): string {
+	const normalized = html
+		.replaceAll('src="./', 'src="/')
+		.replaceAll('href="./', 'href="/');
+	if (normalized.includes('id="cline-hub-theme-bootstrap"')) {
+		return normalized;
+	}
+	return normalized.replace("<head>", `<head>\n${THEME_BOOTSTRAP_SCRIPT}`);
+}
+
 function renderDevIndexHtml(devServerUrl: string): string {
 	return `<!doctype html>
 <html lang="en">
 <head>
+  ${THEME_BOOTSTRAP_SCRIPT}
   <meta charset="UTF-8" />
   <meta name="viewport" content="width=device-width, initial-scale=1.0" />
   <script type="module">
@@ -60,7 +106,7 @@ function renderDevIndexHtml(devServerUrl: string): string {
     window.__vite_plugin_react_preamble_installed__ = true;
   </script>
   <script type="module" src="${devServerUrl}/@vite/client"></script>
-  <link rel="icon" type="image/svg+xml" href="${devServerUrl}/favicon.svg" />
+  <link rel="icon" type="image/svg+xml" href="${devServerUrl}/cline-logo-filled.svg" />
   <title>Cline Hub</title>
 </head>
 <body>
@@ -74,6 +120,14 @@ function renderDevIndexHtml(devServerUrl: string): string {
 export class WebviewAssets {
 	constructor(private readonly webviewDistDir: string) {}
 
+	private async resolveCurrentMainAssetPath(): Promise<string | undefined> {
+		const indexFile = Bun.file(join(this.webviewDistDir, "index.html"));
+		if (!(await indexFile.exists())) return undefined;
+		const html = await indexFile.text();
+		const match = html.match(/src="\.\/(assets\/index-[^"]+\.js)"/);
+		return match?.[1] ? join(this.webviewDistDir, match[1]) : undefined;
+	}
+
 	private resolveStaticPath(pathname: string): string | undefined {
 		const decoded = decodeURIComponent(pathname);
 		const requested = decoded === "/" ? "/index.html" : decoded;
@@ -89,8 +143,11 @@ export class WebviewAssets {
 	private async serveIndex(): Promise<Response> {
 		const indexFile = Bun.file(join(this.webviewDistDir, "index.html"));
 		if (await indexFile.exists()) {
-			return new Response(indexFile, {
-				headers: { "content-type": "text/html; charset=utf-8" },
+			return new Response(normalizeWebviewIndexHtml(await indexFile.text()), {
+				headers: {
+					"content-type": "text/html; charset=utf-8",
+					...NO_STORE_HEADERS,
+				},
 			});
 		}
 		return createTextResponse(
@@ -103,7 +160,10 @@ export class WebviewAssets {
 		const devServerUrl = process.env.VITE_DEV_SERVER_URL?.trim();
 		if (devServerUrl && isWebviewRoute(pathname)) {
 			return new Response(renderDevIndexHtml(devServerUrl), {
-				headers: { "content-type": "text/html; charset=utf-8" },
+				headers: {
+					"content-type": "text/html; charset=utf-8",
+					...NO_STORE_HEADERS,
+				},
 			});
 		}
 		if (isWebviewRoute(pathname)) {
@@ -112,12 +172,37 @@ export class WebviewAssets {
 
 		const filePath = this.resolveStaticPath(pathname);
 		if (!filePath) return createTextResponse("not found", 404);
-		const file = Bun.file(filePath);
+		let responsePath = filePath;
+		let file = Bun.file(responsePath);
+		if (
+			!(await file.exists()) &&
+			/^\/assets\/index-[A-Za-z0-9_-]+\.js$/.test(pathname)
+		) {
+			const currentMainAssetPath = await this.resolveCurrentMainAssetPath();
+			if (currentMainAssetPath) {
+				responsePath = currentMainAssetPath;
+				file = Bun.file(responsePath);
+			}
+		}
 		if (!(await file.exists())) {
 			return createTextResponse("not found", 404);
 		}
+		const isHashedAsset = /^\/assets\/.+-[A-Za-z0-9_-]+\.[A-Za-z0-9]+$/.test(
+			pathname,
+		);
 		return new Response(file, {
-			headers: { "content-type": contentTypeFor(filePath) },
+			headers: {
+				"content-type": contentTypeFor(responsePath),
+				"cache-control": isHashedAsset
+					? IMMUTABLE_ASSET_CACHE
+					: NO_STORE_HEADERS["cache-control"],
+				...(isHashedAsset
+					? {}
+					: {
+							pragma: NO_STORE_HEADERS.pragma,
+							expires: NO_STORE_HEADERS.expires,
+						}),
+			},
 		});
 	}
 }

apps/cline-hub/src/server/marketplace.test.ts

@@ -0,0 +1,870 @@
+import { createHash } from "node:crypto";
+import {
+	existsSync,
+	mkdirSync,
+	mkdtempSync,
+	readFileSync,
+	rmSync,
+	writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import {
+	buildMarketplaceMcpInput,
+	fetchMarketplaceCatalog,
+	installMarketplaceEntry,
+	installMarketplaceEntryForDesktopCommand,
+	listMarketplaceInstalledEntries,
+	uninstallLocalPrimitive,
+	uninstallMarketplaceEntry,
+	uninstallMarketplaceEntryForDesktopCommand,
+} from "./marketplace";
+
+describe("marketplace installer", () => {
+	const originalWrapperPath = process.env.CLINE_WRAPPER_PATH;
+	const originalClineDir = process.env.CLINE_DIR;
+	const originalHome = process.env.HOME;
+	const originalMcpSettingsPath = process.env.CLINE_MCP_SETTINGS_PATH;
+
+	afterEach(() => {
+		if (originalWrapperPath === undefined) {
+			delete process.env.CLINE_WRAPPER_PATH;
+		} else {
+			process.env.CLINE_WRAPPER_PATH = originalWrapperPath;
+		}
+		if (originalClineDir === undefined) {
+			delete process.env.CLINE_DIR;
+		} else {
+			process.env.CLINE_DIR = originalClineDir;
+		}
+		if (originalHome === undefined) {
+			delete process.env.HOME;
+		} else {
+			process.env.HOME = originalHome;
+		}
+		if (originalMcpSettingsPath === undefined) {
+			delete process.env.CLINE_MCP_SETTINGS_PATH;
+		} else {
+			process.env.CLINE_MCP_SETTINGS_PATH = originalMcpSettingsPath;
+		}
+		vi.restoreAllMocks();
+	});
+
+	it("maps remote MCP catalog args to the hub MCP upsert shape", () => {
+		expect(
+			buildMarketplaceMcpInput([
+				"context7",
+				"--transport",
+				"http",
+				"https://mcp.context7.com/mcp",
+			]),
+		).toEqual({
+			name: "context7",
+			transportType: "streamableHttp",
+			url: "https://mcp.context7.com/mcp",
+			disabled: false,
+		});
+	});
+
+	it("maps stdio MCP catalog args to command and args", () => {
+		expect(
+			buildMarketplaceMcpInput(["filesystem", "npx", "-y", "server", "/tmp"]),
+		).toEqual({
+			name: "filesystem",
+			transportType: "stdio",
+			command: "npx",
+			args: ["-y", "server", "/tmp"],
+			disabled: false,
+		});
+	});
+
+	it("preserves server flags after stdio MCP command args begin", () => {
+		expect(
+			buildMarketplaceMcpInput([
+				"search",
+				"npx",
+				"-y",
+				"server",
+				"--transport",
+				"stdio",
+			]),
+		).toEqual({
+			name: "search",
+			transportType: "stdio",
+			command: "npx",
+			args: ["-y", "server", "--transport", "stdio"],
+			disabled: false,
+		});
+	});
+
+	it("runs skills globally for Cline without prompts", async () => {
+		const homeDir = mkdtempSync(join(tmpdir(), "cline-marketplace-home-"));
+		process.env.HOME = homeDir;
+		const spawnCommand = vi.fn(async () => {
+			mkdirSync(join(homeDir, ".agents", "skills", "web-design-guidelines"), {
+				recursive: true,
+			});
+			writeFileSync(
+				join(homeDir, ".agents", "skills", "web-design-guidelines", "SKILL.md"),
+				"---\nname: web-design-guidelines\n---\n",
+			);
+			return {
+				exitCode: 0,
+				stdout: "installed",
+				stderr: "",
+			};
+		});
+
+		await installMarketplaceEntry(
+			{
+				entry: {
+					id: "web-design-guidelines",
+					type: "skill",
+					name: "Web Design Guidelines",
+					install: {
+						args: [
+							"vercel-labs/agent-skills",
+							"--skill",
+							"web-design-guidelines",
+						],
+					},
+				},
+			},
+			{ spawnCommand },
+		);
+
+		expect(spawnCommand).toHaveBeenCalledWith("npx", [
+			"-y",
+			"skills@latest",
+			"add",
+			"vercel-labs/agent-skills",
+			"--skill",
+			"web-design-guidelines",
+			"-g",
+			"-a",
+			"cline",
+			"-y",
+		]);
+	});
+
+	it("skips skill install commands when the global skill already exists", async () => {
+		const homeDir = mkdtempSync(join(tmpdir(), "cline-marketplace-home-"));
+		process.env.HOME = homeDir;
+		mkdirSync(join(homeDir, ".agents", "skills", "cline-sdk"), {
+			recursive: true,
+		});
+		writeFileSync(
+			join(homeDir, ".agents", "skills", "cline-sdk", "SKILL.md"),
+			"---\nname: cline-sdk\n---\n",
+		);
+		const spawnCommand = vi.fn(async () => ({
+			exitCode: 0,
+			stdout: "",
+			stderr: "",
+		}));
+
+		await expect(
+			installMarketplaceEntry(
+				{
+					entry: {
+						id: "cline-sdk",
+						type: "skill",
+						name: "Cline SDK",
+						install: { args: ["cline/sdk-skill"] },
+					},
+				},
+				{ spawnCommand },
+			),
+		).resolves.toMatchObject({
+			status: "installed",
+			message: "Cline SDK is already installed.",
+		});
+		expect(spawnCommand).not.toHaveBeenCalled();
+	});
+
+	it("reports Cline global skills as marketplace-installed", () => {
+		const clineDir = mkdtempSync(join(tmpdir(), "cline-marketplace-cline-"));
+		process.env.CLINE_DIR = clineDir;
+		mkdirSync(join(clineDir, "skills", "cline-sdk"), {
+			recursive: true,
+		});
+		writeFileSync(
+			join(clineDir, "skills", "cline-sdk", "SKILL.md"),
+			"---\nname: cline-sdk\n---\n",
+		);
+
+		expect(
+			listMarketplaceInstalledEntries({
+				entries: [
+					{
+						id: "cline-sdk",
+						type: "skill",
+						name: "Cline SDK",
+						install: { args: ["cline/sdk-skill"] },
+					},
+				],
+			}),
+		).toEqual({ installedKeys: ["skill:cline-sdk"] });
+	});
+
+	it("accepts skill installs that create Cline global skills", async () => {
+		const homeDir = mkdtempSync(join(tmpdir(), "cline-marketplace-home-"));
+		const clineDir = join(homeDir, ".cline");
+		process.env.HOME = homeDir;
+		process.env.CLINE_DIR = clineDir;
+		const spawnCommand = vi.fn(async () => {
+			mkdirSync(join(clineDir, "skills", "cline-sdk"), {
+				recursive: true,
+			});
+			writeFileSync(
+				join(clineDir, "skills", "cline-sdk", "SKILL.md"),
+				"---\nname: cline-sdk\n---\n",
+			);
+			return {
+				exitCode: 0,
+				stdout: "installed",
+				stderr: "",
+			};
+		});
+
+		await expect(
+			installMarketplaceEntry(
+				{
+					entry: {
+						id: "cline-sdk",
+						type: "skill",
+						name: "Cline SDK",
+						install: { args: ["cline/sdk-skill"] },
+					},
+				},
+				{ spawnCommand },
+			),
+		).resolves.toMatchObject({
+			status: "installed",
+			message: "Installed Cline SDK globally for Cline.",
+		});
+	});
+
+	it("removes Cline global marketplace skills without prompts", async () => {
+		const homeDir = mkdtempSync(join(tmpdir(), "cline-marketplace-home-"));
+		process.env.HOME = homeDir;
+		const skillDir = join(homeDir, ".agents", "skills", "cline-sdk");
+		mkdirSync(skillDir, { recursive: true });
+		writeFileSync(join(skillDir, "SKILL.md"), "---\nname: cline-sdk\n---\n");
+		const spawnCommand = vi.fn(async () => {
+			rmSync(skillDir, { recursive: true, force: true });
+			return {
+				exitCode: 0,
+				stdout: "removed",
+				stderr: "",
+			};
+		});
+
+		await expect(
+			uninstallMarketplaceEntry(
+				{
+					entry: {
+						id: "cline-sdk",
+						type: "skill",
+						name: "Cline SDK",
+						install: { args: ["cline/sdk-skill"] },
+					},
+				},
+				{ spawnCommand },
+			),
+		).resolves.toMatchObject({
+			status: "uninstalled",
+			message: "Uninstalled Cline SDK.",
+		});
+		expect(spawnCommand).toHaveBeenCalledWith("npx", [
+			"-y",
+			"skills@latest",
+			"remove",
+			"cline-sdk",
+			"-g",
+			"-a",
+			"cline",
+			"-y",
+		]);
+	});
+
+	it("does not report project-local skills as marketplace-installed globals", () => {
+		const homeDir = mkdtempSync(join(tmpdir(), "cline-marketplace-home-"));
+		process.env.HOME = homeDir;
+
+		expect(
+			listMarketplaceInstalledEntries(
+				{
+					entries: [
+						{
+							id: "cline-sdk",
+							type: "skill",
+							name: "Cline SDK",
+							install: { args: ["cline/sdk-skill"] },
+						},
+					],
+				},
+				{
+					skills: [
+						{
+							id: "cline-sdk",
+							name: "cline-sdk",
+							path: "/workspace/project/.agents/skills/cline-sdk/SKILL.md",
+						},
+					],
+				},
+			),
+		).toEqual({ installedKeys: [] });
+	});
+
+	it("rejects skill installs that exit zero but report failure", async () => {
+		const homeDir = mkdtempSync(join(tmpdir(), "cline-marketplace-home-"));
+		process.env.HOME = homeDir;
+		const spawnCommand = vi.fn(async () => ({
+			exitCode: 0,
+			stdout: "Failed to install 1",
+			stderr: "",
+		}));
+
+		await expect(
+			installMarketplaceEntry(
+				{
+					entry: {
+						id: "cline-sdk",
+						type: "skill",
+						name: "Cline SDK",
+						install: { args: ["cline/sdk-skill"] },
+					},
+				},
+				{ spawnCommand },
+			),
+		).rejects.toThrow("Skill install failed");
+	});
+
+	it("redacts common secret formats from failed install output", async () => {
+		const homeDir = mkdtempSync(join(tmpdir(), "cline-marketplace-home-"));
+		process.env.HOME = homeDir;
+		const spawnCommand = vi.fn(async () => ({
+			exitCode: 1,
+			stdout:
+				"Authorization: Bearer stdout-token\napi key stdout-key\nOPENAI_API_KEY=compound-key",
+			stderr:
+				"TOKEN=stderr-token\npassword is stderr-password\nANTHROPIC_SECRET_KEY=anthropic-secret",
+		}));
+
+		let message = "";
+		try {
+			await installMarketplaceEntry(
+				{
+					entry: {
+						id: "cline-sdk",
+						type: "skill",
+						name: "Cline SDK",
+						install: { args: ["cline/sdk-skill"] },
+					},
+				},
+				{ spawnCommand },
+			);
+		} catch (error) {
+			message = error instanceof Error ? error.message : String(error);
+		}
+
+		expect(message).toContain("Authorization: [redacted]");
+		expect(message).toContain("api key [redacted]");
+		expect(message).toContain("OPENAI_API_KEY=[redacted]");
+		expect(message).toContain("TOKEN=[redacted]");
+		expect(message).toContain("password is [redacted]");
+		expect(message).toContain("ANTHROPIC_SECRET_KEY=[redacted]");
+		expect(message).not.toContain("stdout-token");
+		expect(message).not.toContain("stdout-key");
+		expect(message).not.toContain("compound-key");
+		expect(message).not.toContain("stderr-token");
+		expect(message).not.toContain("stderr-password");
+		expect(message).not.toContain("anthropic-secret");
+	});
+
+	it("rejects skill installs before spawning when the global skill directory is not writable", async () => {
+		const homeDir = mkdtempSync(join(tmpdir(), "cline-marketplace-home-"));
+		process.env.HOME = homeDir;
+		mkdirSync(join(homeDir, ".agents"), { recursive: true });
+		writeFileSync(join(homeDir, ".agents", "skills"), "");
+		const spawnCommand = vi.fn(async () => ({
+			exitCode: 0,
+			stdout: "",
+			stderr: "",
+		}));
+
+		await expect(
+			installMarketplaceEntry(
+				{
+					entry: {
+						id: "cline-sdk",
+						type: "skill",
+						name: "Cline SDK",
+						install: { args: ["cline/sdk-skill"] },
+					},
+				},
+				{ spawnCommand },
+			),
+		).rejects.toThrow(
+			"Cannot install skill globally because ~/.agents/skills is not writable",
+		);
+		expect(spawnCommand).not.toHaveBeenCalled();
+	});
+
+	it("rejects skill installs that do not create a global skill", async () => {
+		const homeDir = mkdtempSync(join(tmpdir(), "cline-marketplace-home-"));
+		process.env.HOME = homeDir;
+		const spawnCommand = vi.fn(async () => ({
+			exitCode: 0,
+			stdout: "Installation complete",
+			stderr: "",
+		}));
+
+		await expect(
+			installMarketplaceEntry(
+				{
+					entry: {
+						id: "cline-sdk",
+						type: "skill",
+						name: "Cline SDK",
+						install: { args: ["cline/sdk-skill"] },
+					},
+				},
+				{ spawnCommand },
+			),
+		).rejects.toThrow("was not found in Cline's global skills directories");
+	});
+
+	it("runs official plugin installs through the current Cline CLI", async () => {
+		process.env.CLINE_WRAPPER_PATH = "/usr/local/bin/cline";
+		const spawnCommand = vi.fn(async () => ({
+			exitCode: 0,
+			stdout: JSON.stringify({ installPath: "/tmp/plugin" }),
+			stderr: "",
+		}));
+
+		await installMarketplaceEntry(
+			{
+				entry: {
+					id: "marketplace-test-plugin",
+					type: "plugin",
+					name: "Marketplace Test Plugin",
+					install: { args: ["marketplace-test-plugin"] },
+				},
+			},
+			{ spawnCommand },
+		);
+
+		expect(spawnCommand).toHaveBeenCalledWith("/usr/local/bin/cline", [
+			"plugin",
+			"install",
+			"marketplace-test-plugin",
+			"--json",
+		]);
+	});
+
+	it("runs official plugin uninstalls through the current Cline CLI", async () => {
+		process.env.CLINE_WRAPPER_PATH = "/usr/local/bin/cline";
+		const spawnCommand = vi.fn(async () => ({
+			exitCode: 0,
+			stdout: JSON.stringify({
+				name: "goal",
+				installPath: "/tmp/plugin",
+				removedPaths: ["/tmp/plugin"],
+				entryPaths: [],
+			}),
+			stderr: "",
+		}));
+
+		await expect(
+			uninstallMarketplaceEntry(
+				{
+					entry: {
+						id: "goal",
+						type: "plugin",
+						name: "Goal",
+						install: { args: ["goal"] },
+					},
+				},
+				{ spawnCommand },
+			),
+		).resolves.toMatchObject({
+			status: "uninstalled",
+			message: "Uninstalled Goal.",
+		});
+
+		expect(spawnCommand).toHaveBeenCalledWith("/usr/local/bin/cline", [
+			"plugin",
+			"uninstall",
+			"goal",
+			"--json",
+		]);
+	});
+
+	it("resolves desktop installs from the server catalog instead of browser-sent args", async () => {
+		process.env.CLINE_WRAPPER_PATH = "/usr/local/bin/cline";
+		const spawnCommand = vi.fn(async () => ({
+			exitCode: 0,
+			stdout: JSON.stringify({ installPath: "/tmp/plugin" }),
+			stderr: "",
+		}));
+
+		await installMarketplaceEntryForDesktopCommand(
+			{
+				entry: {
+					id: "marketplace-test-plugin",
+					type: "plugin",
+					name: "Tampered",
+					install: { args: ["malicious-source"] },
+				},
+			},
+			{
+				spawnCommand,
+				loadCatalog: async () => ({
+					entries: [
+						{
+							id: "marketplace-test-plugin",
+							type: "plugin",
+							name: "Marketplace Test Plugin",
+							install: { args: ["marketplace-test-plugin"] },
+						},
+					],
+				}),
+			},
+		);
+
+		expect(spawnCommand).toHaveBeenCalledWith("/usr/local/bin/cline", [
+			"plugin",
+			"install",
+			"marketplace-test-plugin",
+			"--json",
+		]);
+	});
+
+	it("resolves desktop uninstalls from the server catalog instead of browser-sent args", async () => {
+		process.env.CLINE_WRAPPER_PATH = "/usr/local/bin/cline";
+		const spawnCommand = vi.fn(async () => ({
+			exitCode: 0,
+			stdout: JSON.stringify({
+				name: "goal",
+				installPath: "/tmp/plugin",
+				removedPaths: ["/tmp/plugin"],
+				entryPaths: [],
+			}),
+			stderr: "",
+		}));
+
+		await uninstallMarketplaceEntryForDesktopCommand(
+			{
+				entry: {
+					id: "goal",
+					type: "plugin",
+					name: "Tampered",
+					install: { args: ["malicious-source"] },
+				},
+			},
+			{
+				spawnCommand,
+				loadCatalog: async () => ({
+					entries: [
+						{
+							id: "goal",
+							type: "plugin",
+							name: "Goal",
+							install: { args: ["goal"] },
+						},
+					],
+				}),
+			},
+		);
+
+		expect(spawnCommand).toHaveBeenCalledWith("/usr/local/bin/cline", [
+			"plugin",
+			"uninstall",
+			"goal",
+			"--json",
+		]);
+	});
+
+	it("uninstalls MCP marketplace entries from Cline MCP settings", async () => {
+		const settingsPath = join(
+			mkdtempSync(join(tmpdir(), "cline-marketplace-mcp-")),
+			"cline_mcp_settings.json",
+		);
+		process.env.CLINE_MCP_SETTINGS_PATH = settingsPath;
+		writeFileSync(
+			settingsPath,
+			JSON.stringify(
+				{
+					mcpServers: {
+						context7: {
+							transport: {
+								type: "streamableHttp",
+								url: "https://mcp.context7.com/mcp",
+							},
+						},
+					},
+				},
+				null,
+				2,
+			),
+		);
+
+		await expect(
+			uninstallMarketplaceEntry({
+				entry: {
+					id: "context7",
+					type: "mcp",
+					name: "Context7",
+					install: {
+						args: [
+							"context7",
+							"--transport",
+							"http",
+							"https://mcp.context7.com/mcp",
+						],
+					},
+				},
+			}),
+		).resolves.toMatchObject({
+			status: "uninstalled",
+			message: "Uninstalled Context7.",
+		});
+		expect(
+			listMarketplaceInstalledEntries({
+				entries: [
+					{
+						id: "context7",
+						type: "mcp",
+						name: "Context7",
+						install: {
+							args: [
+								"context7",
+								"--transport",
+								"http",
+								"https://mcp.context7.com/mcp",
+							],
+						},
+					},
+				],
+			}),
+		).toEqual({ installedKeys: [] });
+	});
+
+	it("uninstalls local MCP servers by name", async () => {
+		const settingsPath = join(
+			mkdtempSync(join(tmpdir(), "cline-local-mcp-")),
+			"cline_mcp_settings.json",
+		);
+		process.env.CLINE_MCP_SETTINGS_PATH = settingsPath;
+		writeFileSync(
+			settingsPath,
+			JSON.stringify(
+				{
+					mcpServers: {
+						context7: {
+							transport: {
+								type: "streamableHttp",
+								url: "https://mcp.context7.com/mcp",
+							},
+						},
+					},
+				},
+				null,
+				2,
+			),
+		);
+
+		await expect(
+			uninstallLocalPrimitive({
+				type: "mcp",
+				id: "context7",
+				name: "context7",
+			}),
+		).resolves.toMatchObject({
+			status: "uninstalled",
+			message: "Uninstalled context7.",
+		});
+		expect(readFileSync(settingsPath, "utf8")).not.toContain("context7");
+	});
+
+	it("uninstalls local skills by removing their configured skill directory", async () => {
+		const workspaceRoot = mkdtempSync(join(tmpdir(), "cline-local-skill-"));
+		const skillDir = join(workspaceRoot, ".cline", "skills", "review");
+		mkdirSync(skillDir, { recursive: true });
+		const skillPath = join(skillDir, "SKILL.md");
+		writeFileSync(skillPath, "---\nname: review\n---\nReview changes.");
+
+		await expect(
+			uninstallLocalPrimitive(
+				{
+					type: "skill",
+					id: "review",
+					name: "Review",
+					path: skillPath,
+				},
+				{ workspaceRoot },
+			),
+		).resolves.toMatchObject({
+			status: "uninstalled",
+			message: "Uninstalled Review.",
+		});
+		expect(existsSync(skillDir)).toBe(false);
+	});
+
+	it("reports official plugin marketplace entries installed from Cline home", () => {
+		const clineDir = mkdtempSync(join(tmpdir(), "cline-marketplace-test-"));
+		process.env.CLINE_DIR = clineDir;
+		const sourceKey =
+			"official:https://github.com/cline/plugins.git#plugins/goal";
+		const hash = createHash("sha256")
+			.update(sourceKey)
+			.digest("hex")
+			.slice(0, 12);
+		mkdirSync(
+			join(clineDir, "plugins", "_installed", "official", `goal-${hash}`),
+			{
+				recursive: true,
+			},
+		);
+
+		expect(
+			listMarketplaceInstalledEntries({
+				entries: [
+					{
+						id: "goal",
+						type: "plugin",
+						name: "Goal",
+						install: { args: ["goal"] },
+					},
+				],
+			}),
+		).toEqual({ installedKeys: ["plugin:goal"] });
+	});
+
+	it("does not report plugin inventory substring matches as installed", () => {
+		process.env.CLINE_DIR = mkdtempSync(
+			join(tmpdir(), "cline-marketplace-test-"),
+		);
+
+		expect(
+			listMarketplaceInstalledEntries(
+				{
+					entries: [
+						{
+							id: "goal",
+							type: "plugin",
+							name: "Goal",
+							install: { args: ["goal"] },
+						},
+					],
+				},
+				{
+					plugins: [
+						{
+							name: "goal-helper",
+							path: "/workspace/.cline/plugins/goal-helper/index.ts",
+						},
+					],
+				},
+			),
+		).toEqual({ installedKeys: [] });
+	});
+
+	it("skips invalid marketplace entries during installed-status checks", () => {
+		const clineDir = mkdtempSync(join(tmpdir(), "cline-marketplace-test-"));
+		process.env.CLINE_DIR = clineDir;
+		const sourceKey =
+			"official:https://github.com/cline/plugins.git#plugins/goal";
+		const hash = createHash("sha256")
+			.update(sourceKey)
+			.digest("hex")
+			.slice(0, 12);
+		mkdirSync(
+			join(clineDir, "plugins", "_installed", "official", `goal-${hash}`),
+			{
+				recursive: true,
+			},
+		);
+
+		expect(
+			listMarketplaceInstalledEntries({
+				entries: [
+					{
+						id: "broken-mcp",
+						type: "mcp",
+						name: "Broken MCP",
+						install: {
+							args: [
+								"broken-mcp",
+								"--transport",
+								"ws",
+								"https://example.com/mcp",
+							],
+						},
+					},
+					{
+						id: "goal",
+						type: "plugin",
+						name: "Goal",
+						install: { args: ["goal"] },
+					},
+				],
+			}),
+		).toEqual({ installedKeys: ["plugin:goal"] });
+	});
+
+	it("rejects invalid marketplace entries before spawning commands", async () => {
+		const spawnCommand = vi.fn(async () => ({
+			exitCode: 0,
+			stdout: "",
+			stderr: "",
+		}));
+
+		await expect(
+			installMarketplaceEntry(
+				{
+					entry: {
+						id: "bad",
+						type: "skill",
+						install: { args: [] },
+					},
+				},
+				{ spawnCommand },
+			),
+		).rejects.toThrow("marketplace install args are required");
+		expect(spawnCommand).not.toHaveBeenCalled();
+	});
+
+	it("fetches the marketplace catalog through the server helper", async () => {
+		const fetchImpl = vi.fn(async () => {
+			return new Response(JSON.stringify({ version: 1, entries: [] }), {
+				headers: { "content-type": "application/json" },
+			});
+		});
+
+		await expect(fetchMarketplaceCatalog(fetchImpl)).resolves.toEqual({
+			version: 1,
+			entries: [],
+		});
+		expect(fetchImpl).toHaveBeenCalledWith(
+			"https://cline.github.io/marketplace/catalog.json",
+			{ headers: { Accept: "application/json" } },
+		);
+	});
+
+	it("surfaces marketplace catalog upstream failures", async () => {
+		const fetchImpl = vi.fn(async () => {
+			return new Response("nope", {
+				status: 503,
+				statusText: "Service Unavailable",
+			});
+		});
+
+		await expect(fetchMarketplaceCatalog(fetchImpl)).rejects.toThrow(
+			"Failed to fetch marketplace catalog: 503 Service Unavailable",
+		);
+	});
+});

apps/cline-hub/src/server/session-mapping.ts

@@ -235,6 +235,7 @@ export function toWebviewSessionSummary(
 		providerId: session.provider,
 		model: session.model,
 		workspaceRoot: session.workspaceRoot,
+		createdAt: session.createdAt,
 		updatedAt: session.updatedAt,
 		inputTokens: session.inputTokens,
 		outputTokens: session.outputTokens,

apps/cline-hub/src/server/user-instructions.test.ts

@@ -0,0 +1,70 @@
+import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, describe, expect, it } from "vitest";
+import { listUserInstructionConfigs } from "./user-instructions";
+
+describe("listUserInstructionConfigs", () => {
+	const tempRoots: string[] = [];
+	const envSnapshot = {
+		CLINE_GLOBAL_SETTINGS_PATH: process.env.CLINE_GLOBAL_SETTINGS_PATH,
+		CLINE_MCP_SETTINGS_PATH: process.env.CLINE_MCP_SETTINGS_PATH,
+	};
+
+	afterEach(async () => {
+		if (envSnapshot.CLINE_GLOBAL_SETTINGS_PATH === undefined) {
+			delete process.env.CLINE_GLOBAL_SETTINGS_PATH;
+		} else {
+			process.env.CLINE_GLOBAL_SETTINGS_PATH =
+				envSnapshot.CLINE_GLOBAL_SETTINGS_PATH;
+		}
+		if (envSnapshot.CLINE_MCP_SETTINGS_PATH === undefined) {
+			delete process.env.CLINE_MCP_SETTINGS_PATH;
+		} else {
+			process.env.CLINE_MCP_SETTINGS_PATH = envSnapshot.CLINE_MCP_SETTINGS_PATH;
+		}
+		await Promise.all(
+			tempRoots.map((dir) => rm(dir, { recursive: true, force: true })),
+		);
+		tempRoots.length = 0;
+	});
+
+	it("uses the package name for package-backed plugin entries", async () => {
+		const tempRoot = await mkdtemp(join(tmpdir(), "cline-hub-config-"));
+		tempRoots.push(tempRoot);
+		process.env.CLINE_GLOBAL_SETTINGS_PATH = join(tempRoot, "settings.json");
+		process.env.CLINE_MCP_SETTINGS_PATH = join(tempRoot, "mcp.json");
+		const packageDir = join(
+			tempRoot,
+			".cline",
+			"plugins",
+			"_installed",
+			"git",
+			"github.com",
+			"demo",
+			"package",
+		);
+		await mkdir(packageDir, { recursive: true });
+		const pluginPath = join(packageDir, "index.ts");
+		await writeFile(
+			join(packageDir, "package.json"),
+			JSON.stringify(
+				{
+					name: "cline-sdk-portable-agents",
+					cline: {
+						plugins: [{ paths: ["./index.ts"] }],
+					},
+				},
+				null,
+				2,
+			),
+		);
+		await writeFile(pluginPath, "export default {};\n");
+
+		const data = await listUserInstructionConfigs(tempRoot);
+		const plugins = data.plugins as Array<{ name: string; path: string }>;
+		const plugin = plugins.find((item) => item.path === pluginPath);
+
+		expect(plugin?.name).toBe("cline-sdk-portable-agents");
+	});
+});

apps/cline-hub/src/server/user-instructions.ts

@@ -1,5 +1,13 @@
 import { existsSync, readdirSync, readFileSync } from "node:fs";
-import { extname, join, basename as pathBasename } from "node:path";
+import {
+	dirname,
+	extname,
+	isAbsolute,
+	join,
+	basename as pathBasename,
+	relative,
+	resolve,
+} from "node:path";
 import {
 	createUserInstructionConfigService,
 	discoverPluginModulePaths,
@@ -17,6 +25,48 @@ function resolveAgentConfigSearchPaths(workspaceRoot?: string): string[] {
 	return resolveSharedAgentConfigSearchPaths(workspaceRoot);
 }
 
+function readPackageName(packageJsonPath: string): string | undefined {
+	try {
+		const packageJson = JSON.parse(readFileSync(packageJsonPath, "utf8")) as {
+			name?: unknown;
+		};
+		return typeof packageJson.name === "string" && packageJson.name.trim()
+			? packageJson.name.trim()
+			: undefined;
+	} catch {
+		return undefined;
+	}
+}
+
+function isPathWithin(parentPath: string, childPath: string): boolean {
+	const relativePath = relative(resolve(parentPath), resolve(childPath));
+	return (
+		relativePath === "" ||
+		(!relativePath.startsWith("..") && !isAbsolute(relativePath))
+	);
+}
+
+function getPluginDisplayName(filePath: string, searchRoot: string): string {
+	let current = dirname(filePath);
+	const root = resolve(searchRoot);
+	while (isPathWithin(root, current)) {
+		const packageJsonPath = join(current, "package.json");
+		if (existsSync(packageJsonPath)) {
+			const packageName = readPackageName(packageJsonPath);
+			if (packageName) {
+				return packageName;
+			}
+			break;
+		}
+		const parent = resolve(current, "..");
+		if (parent === current) {
+			break;
+		}
+		current = parent;
+	}
+	return pathBasename(filePath, extname(filePath));
+}
+
 export async function listUserInstructionConfigs(
 	targetWorkspaceRoot: string,
 ): Promise<JsonRecord> {
@@ -115,7 +165,7 @@ export async function listUserInstructionConfigs(
 				for (const filePath of discoverPluginModulePaths(directory)) {
 					if (pluginsByPath.has(filePath)) continue;
 					pluginsByPath.set(filePath, {
-						name: pathBasename(filePath, extname(filePath)),
+						name: getPluginDisplayName(filePath, directory),
 						path: filePath,
 						enabled: !disabledPlugins.has(filePath),
 					});

apps/cline-hub/src/validate-options.ts

@@ -41,6 +41,23 @@ expectEqual(
 	"invite URL",
 );
 
+const tailscale = resolveClineHubServerOptions({
+	HOST: "0.0.0.0",
+	CLINE_HUB_DASHBOARD_PORT: "8787",
+	PUBLIC_URL: "http://100.82.5.118",
+	ROOM_SECRET: "invite-123",
+});
+expectEqual(
+	tailscale.publicUrl,
+	"http://100.82.5.118:8787",
+	"direct IP public URL gets dashboard port",
+);
+expectEqual(
+	buildInviteUrl(tailscale.publicUrl, tailscale.roomSecret),
+	"http://100.82.5.118:8787/?roomSecret=invite-123",
+	"invite URL for direct IP public URL",
+);
+
 expectThrows(
 	() => resolveClineHubServerOptions({ HOST: "0.0.0.0" }),
 	"non-local bind without ROOM_SECRET",

apps/cline-hub/src/webview-protocol.ts

@@ -109,6 +109,7 @@ export type WebviewSessionSummary = {
 	providerId?: string;
 	model?: string;
 	workspaceRoot?: string;
+	createdAt?: number;
 	updatedAt?: number;
 	inputTokens?: number;
 	outputTokens?: number;

apps/cline-hub/src/webview/index.html

@@ -2,9 +2,9 @@
 <html lang="en">
   <head>
     <meta charset="UTF-8" />
-    <link rel="icon" type="image/svg+xml" href="/favicon.svg" />
+    <link rel="icon" type="image/svg+xml" href="/cline-logo-filled.svg" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>webview</title>
+    <title>Cline Hub</title>
   </head>
   <body>
     <div id="root"></div>

apps/cline-hub/src/webview/package.json

@@ -10,13 +10,12 @@
 	},
 	"dependencies": {
 		"@base-ui/react": "^1.3.0",
-		"@fontsource-variable/geist": "^5.2.8",
+		"@fontsource-variable/schibsted-grotesk": "^5.2.8",
 		"@radix-ui/react-use-controllable-state": "^1.2.2",
 		"@rive-app/react-webgl2": "^4.27.2",
+		"@shikijs/langs": "^4.2.0",
+		"@shikijs/themes": "^4.2.0",
 		"@streamdown/cjk": "^1.0.3",
-		"@streamdown/code": "^1.1.1",
-		"@streamdown/math": "^1.0.2",
-		"@streamdown/mermaid": "^1.0.2",
 		"@tailwindcss/vite": "^4.2.1",
 		"@xyflow/react": "^12.10.1",
 		"ai": "^6.0.116",
@@ -27,6 +26,7 @@
 		"embla-carousel-react": "^8.6.0",
 		"lucide-react": "^0.577.0",
 		"media-chrome": "^4.18.1",
+		"mermaid": "^11.15.0",
 		"motion": "^12.38.0",
 		"nanoid": "^5.1.7",
 		"next-themes": "^0.4.6",

apps/cline-hub/src/webview/public/cline-logo-filled.svg

@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg id="Ebene_1" xmlns="http://www.w3.org/2000/svg" version="1.1" viewBox="0 0 466.73 487.04">
+  <!-- Generator: Adobe Illustrator 29.8.1, SVG Export Plug-In . SVG Version: 2.1.1 Build 2)  -->
+  <path d="M463.6,275.08l-29.26-58.75v-33.83c0-56.08-45.01-101.5-100.53-101.5h-50.01c3.62-7.43,5.61-15.79,5.61-24.61,0-31.17-25.08-56.39-56.07-56.39s-56.07,25.22-56.07,56.39c0,8.82,1.99,17.17,5.61,24.61h-50.01c-55.51,0-100.52,45.42-100.52,101.5v33.83l-29.87,58.59c-3.01,5.9-3.01,12.92,0,18.81l29.87,57.93v33.83c0,56.08,45.01,101.5,100.52,101.5h200.95c55.51,0,100.53-45.42,100.53-101.5v-33.83l29.21-58.13c2.9-5.79,2.9-12.61.05-18.46ZM202.75,322.96c0,25.48-20.54,46.14-45.88,46.14s-45.88-20.66-45.88-46.14v-82.02c0-25.48,20.54-46.14,45.88-46.14s45.88,20.66,45.88,46.14v82.02ZM350.58,322.96c0,25.48-20.54,46.14-45.88,46.14s-45.88-20.66-45.88-46.14v-82.02c0-25.48,20.54-46.14,45.88-46.14s45.88,20.66,45.88,46.14v82.02Z"/>
+</svg>

apps/cline-hub/src/webview/src/components/ai-elements/code-block.tsx

@@ -11,12 +11,13 @@ import {
 	useState,
 } from "react";
 import type {
-	BundledLanguage,
-	BundledTheme,
-	HighlighterGeneric,
+	HighlighterCore,
+	LanguageRegistration,
 	ThemedToken,
-} from "shiki";
-import { createHighlighter } from "shiki";
+	ThemeRegistration,
+} from "shiki/core";
+import { createHighlighterCore } from "shiki/core";
+import { createJavaScriptRegexEngine } from "shiki/engine/javascript";
 import { Button } from "@/components/ui/button";
 import {
 	Select,
@@ -36,6 +37,78 @@ const isUnderline = (fontStyle: number | undefined) =>
 	// oxlint-disable-next-line eslint(no-bitwise)
 	fontStyle && fontStyle & 4;
 
+const SUPPORTED_LANGUAGES = [
+	"bash",
+	"css",
+	"diff",
+	"html",
+	"javascript",
+	"json",
+	"jsonc",
+	"jsx",
+	"markdown",
+	"python",
+	"shellscript",
+	"tsx",
+	"typescript",
+	"yaml",
+] as const;
+
+export type SupportedCodeLanguage = (typeof SUPPORTED_LANGUAGES)[number];
+
+const SUPPORTED_LANGUAGE_SET = new Set<string>(SUPPORTED_LANGUAGES);
+
+const LANGUAGE_LOADERS: Record<
+	SupportedCodeLanguage,
+	() => Promise<LanguageRegistration[]>
+> = {
+	bash: () => import("@shikijs/langs/bash").then((module) => module.default),
+	css: () => import("@shikijs/langs/css").then((module) => module.default),
+	diff: () => import("@shikijs/langs/diff").then((module) => module.default),
+	html: () => import("@shikijs/langs/html").then((module) => module.default),
+	javascript: () =>
+		import("@shikijs/langs/javascript").then((module) => module.default),
+	json: () => import("@shikijs/langs/json").then((module) => module.default),
+	jsonc: () => import("@shikijs/langs/jsonc").then((module) => module.default),
+	jsx: () => import("@shikijs/langs/jsx").then((module) => module.default),
+	markdown: () =>
+		import("@shikijs/langs/markdown").then((module) => module.default),
+	python: () =>
+		import("@shikijs/langs/python").then((module) => module.default),
+	shellscript: () =>
+		import("@shikijs/langs/shellscript").then((module) => module.default),
+	tsx: () => import("@shikijs/langs/tsx").then((module) => module.default),
+	typescript: () =>
+		import("@shikijs/langs/typescript").then((module) => module.default),
+	yaml: () => import("@shikijs/langs/yaml").then((module) => module.default),
+};
+
+const LANGUAGE_ALIASES: Record<string, SupportedCodeLanguage> = {
+	console: "shellscript",
+	cjs: "javascript",
+	htm: "html",
+	js: "javascript",
+	json5: "jsonc",
+	md: "markdown",
+	mjs: "javascript",
+	py: "python",
+	sh: "shellscript",
+	shell: "shellscript",
+	ts: "typescript",
+	yml: "yaml",
+};
+
+const normalizeLanguage = (
+	language: string,
+): SupportedCodeLanguage | "text" => {
+	const normalized = language.trim().toLowerCase();
+	if (!normalized) {
+		return "text";
+	}
+	const aliased = LANGUAGE_ALIASES[normalized] ?? normalized;
+	return SUPPORTED_LANGUAGE_SET.has(aliased) ? aliased : "text";
+};
+
 // Transform tokens to include pre-computed keys to avoid noArrayIndexKey lint
 interface KeyedToken {
 	token: ThemedToken;
@@ -108,7 +181,7 @@ const LineSpan = ({
 // Types
 type CodeBlockProps = HTMLAttributes<HTMLDivElement> & {
 	code: string;
-	language: BundledLanguage;
+	language: string;
 	showLineNumbers?: boolean;
 };
 
@@ -128,10 +201,9 @@ const CodeBlockContext = createContext<CodeBlockContextType>({
 });
 
 // Highlighter cache (singleton per language)
-const highlighterCache = new Map<
-	string,
-	Promise<HighlighterGeneric<BundledLanguage, BundledTheme>>
->();
+let highlighterPromise: Promise<HighlighterCore> | undefined;
+let themesPromise: Promise<void> | undefined;
+const languagePromises = new Map<SupportedCodeLanguage, Promise<void>>();
 
 // Token cache
 const tokensCache = new Map<string, TokenizedCode>();
@@ -139,27 +211,44 @@ const tokensCache = new Map<string, TokenizedCode>();
 // Subscribers for async token updates
 const subscribers = new Map<string, Set<(result: TokenizedCode) => void>>();
 
-const getTokensCacheKey = (code: string, language: BundledLanguage) => {
+const getTokensCacheKey = (code: string, language: string) => {
 	const start = code.slice(0, 100);
 	const end = code.length > 100 ? code.slice(-100) : "";
 	return `${language}:${code.length}:${start}:${end}`;
 };
 
-const getHighlighter = (
-	language: BundledLanguage,
-): Promise<HighlighterGeneric<BundledLanguage, BundledTheme>> => {
-	const cached = highlighterCache.get(language);
+const getHighlighter = (): Promise<HighlighterCore> => {
+	if (!highlighterPromise) {
+		highlighterPromise = createHighlighterCore({
+			engine: createJavaScriptRegexEngine({ forgiving: true }),
+		});
+	}
+	return highlighterPromise;
+};
+
+const ensureThemes = (highlighter: HighlighterCore): Promise<void> => {
+	if (!themesPromise) {
+		themesPromise = Promise.all([
+			import("@shikijs/themes/github-light").then((module) => module.default),
+			import("@shikijs/themes/github-dark").then((module) => module.default),
+		]).then((themes: ThemeRegistration[]) => highlighter.loadTheme(...themes));
+	}
+	return themesPromise;
+};
+
+const ensureLanguage = (
+	highlighter: HighlighterCore,
+	language: SupportedCodeLanguage,
+): Promise<void> => {
+	const cached = languagePromises.get(language);
 	if (cached) {
 		return cached;
 	}
-
-	const highlighterPromise = createHighlighter({
-		langs: [language],
-		themes: ["github-light", "github-dark"],
-	});
-
-	highlighterCache.set(language, highlighterPromise);
-	return highlighterPromise;
+	const languagePromise = LANGUAGE_LOADERS[language]().then((registrations) =>
+		highlighter.loadLanguage(...registrations),
+	);
+	languagePromises.set(language, languagePromise);
+	return languagePromise;
 };
 
 // Create raw tokens for immediate display while highlighting loads
@@ -181,11 +270,16 @@ const createRawTokens = (code: string): TokenizedCode => ({
 // Synchronous highlight with callback for async results
 export const highlightCode = (
 	code: string,
-	language: BundledLanguage,
+	language: string,
 	// oxlint-disable-next-line eslint-plugin-promise(prefer-await-to-callbacks)
 	callback?: (result: TokenizedCode) => void,
 ): TokenizedCode | null => {
-	const tokensCacheKey = getTokensCacheKey(code, language);
+	const langToUse = normalizeLanguage(language);
+	if (langToUse === "text") {
+		return createRawTokens(code);
+	}
+
+	const tokensCacheKey = getTokensCacheKey(code, langToUse);
 
 	// Return cached result if available
 	const cached = tokensCache.get(tokensCacheKey);
@@ -202,11 +296,11 @@ export const highlightCode = (
 	}
 
 	// Start highlighting in background - fire-and-forget async pattern
-	getHighlighter(language)
+	getHighlighter()
 		// oxlint-disable-next-line eslint-plugin-promise(prefer-await-to-then)
-		.then((highlighter) => {
-			const availableLangs = highlighter.getLoadedLanguages();
-			const langToUse = availableLangs.includes(language) ? language : "text";
+		.then(async (highlighter) => {
+			await ensureThemes(highlighter);
+			await ensureLanguage(highlighter, langToUse);
 
 			const result = highlighter.codeToTokens(code, {
 				lang: langToUse,
@@ -376,7 +470,7 @@ export const CodeBlockContent = ({
 	showLineNumbers = false,
 }: {
 	code: string;
-	language: BundledLanguage;
+	language: string;
 	showLineNumbers?: boolean;
 }) => {
 	// Memoized raw tokens for immediate display

apps/cline-hub/src/webview/src/components/ai-elements/message.tsx

@@ -1,9 +1,5 @@
 "use client";
 
-import { cjk } from "@streamdown/cjk";
-import { code } from "@streamdown/code";
-import { math } from "@streamdown/math";
-import { mermaid } from "@streamdown/mermaid";
 import type { UIMessage } from "ai";
 import { ChevronLeftIcon, ChevronRightIcon } from "lucide-react";
 import type { ComponentProps, HTMLAttributes, ReactElement } from "react";
@@ -16,7 +12,6 @@ import {
 	useMemo,
 	useState,
 } from "react";
-import { Streamdown } from "streamdown";
 import { Button } from "@/components/ui/button";
 import { ButtonGroup, ButtonGroupText } from "@/components/ui/button-group";
 import {
@@ -26,6 +21,7 @@ import {
 	TooltipTrigger,
 } from "@/components/ui/tooltip";
 import { cn } from "@/lib/utils";
+import { HubStreamdown } from "./streamdown";
 
 export type MessageProps = HTMLAttributes<HTMLDivElement> & {
 	from: UIMessage["role"];
@@ -316,24 +312,18 @@ export const MessageBranchPage = ({
 	);
 };
 
-export type MessageResponseProps = ComponentProps<typeof Streamdown>;
-
-const streamdownPlugins = { cjk, code, math, mermaid };
+export type MessageResponseProps = ComponentProps<typeof HubStreamdown>;
 
 export const MessageResponse = memo(
 	({ className, ...props }: MessageResponseProps) => (
-		<Streamdown
+		<HubStreamdown
 			className={cn(
 				"size-full [&>*:first-child]:mt-0 [&>*:last-child]:mb-0",
 				className,
 			)}
-			plugins={streamdownPlugins}
 			{...props}
 		/>
 	),
-	(prevProps, nextProps) =>
-		prevProps.children === nextProps.children &&
-		nextProps.isAnimating === prevProps.isAnimating,
 );
 
 MessageResponse.displayName = "MessageResponse";

apps/cline-hub/src/webview/src/components/ai-elements/reasoning.tsx

@@ -1,10 +1,6 @@
 "use client";
 
 import { useControllableState } from "@radix-ui/react-use-controllable-state";
-import { cjk } from "@streamdown/cjk";
-import { code } from "@streamdown/code";
-import { math } from "@streamdown/math";
-import { mermaid } from "@streamdown/mermaid";
 import { BrainIcon, ChevronDownIcon } from "lucide-react";
 import type { ComponentProps, ReactNode } from "react";
 import {
@@ -17,7 +13,6 @@ import {
 	useRef,
 	useState,
 } from "react";
-import { Streamdown } from "streamdown";
 import {
 	Collapsible,
 	CollapsibleContent,
@@ -26,6 +21,7 @@ import {
 import { cn } from "@/lib/utils";
 
 import { Shimmer } from "./shimmer";
+import { HubStreamdown } from "./streamdown";
 
 interface ReasoningContextValue {
 	isStreaming: boolean;
@@ -204,8 +200,6 @@ export type ReasoningContentProps = ComponentProps<
 	children: string;
 };
 
-const streamdownPlugins = { cjk, code, math, mermaid };
-
 export const ReasoningContent = memo(
 	({ className, children, ...props }: ReasoningContentProps) => (
 		<CollapsibleContent
@@ -216,7 +210,7 @@ export const ReasoningContent = memo(
 			)}
 			{...props}
 		>
-			<Streamdown plugins={streamdownPlugins}>{children}</Streamdown>
+			<HubStreamdown>{children}</HubStreamdown>
 		</CollapsibleContent>
 	),
 );

apps/cline-hub/src/webview/src/components/ai-elements/streamdown.tsx

@@ -0,0 +1,170 @@
+import { cjk } from "@streamdown/cjk";
+import type { MermaidConfig } from "mermaid";
+import type { ComponentProps, ReactNode } from "react";
+import { isValidElement, memo } from "react";
+import {
+	type Components,
+	type DiagramPlugin,
+	Streamdown,
+	type StreamdownProps,
+} from "streamdown";
+import {
+	CodeBlock,
+	CodeBlockActions,
+	CodeBlockCopyButton,
+	CodeBlockFilename,
+	CodeBlockHeader,
+	CodeBlockTitle,
+} from "@/components/ai-elements/code-block";
+import { cn } from "@/lib/utils";
+
+type MarkdownCodeProps = ComponentProps<"code"> & {
+	"data-block"?: boolean | string;
+	node?: {
+		properties?: {
+			metastring?: string;
+		};
+	};
+};
+
+const LANGUAGE_CLASS_PATTERN = /(?:^|\s)language-([^\s]+)/;
+const START_LINE_PATTERN = /startLine=(\d+)/;
+const NO_LINE_NUMBERS_PATTERN = /\bnoLineNumbers\b/;
+
+function codeText(children: ReactNode): string {
+	if (typeof children === "string" || typeof children === "number") {
+		return String(children);
+	}
+	if (Array.isArray(children)) {
+		return children.map(codeText).join("");
+	}
+	if (isValidElement<{ children?: ReactNode }>(children)) {
+		return codeText(children.props.children);
+	}
+	return "";
+}
+
+const MarkdownCode = ({
+	children,
+	className,
+	node,
+	"data-block": dataBlock,
+	...props
+}: MarkdownCodeProps) => {
+	const language = className?.match(LANGUAGE_CLASS_PATTERN)?.[1] ?? "text";
+
+	if (!dataBlock) {
+		return (
+			<code
+				className={cn(
+					"rounded bg-muted px-1.5 py-0.5 font-mono text-sm",
+					className,
+				)}
+				{...props}
+			>
+				{children}
+			</code>
+		);
+	}
+
+	const meta = node?.properties?.metastring;
+	const startLineMatch = meta?.match(START_LINE_PATTERN);
+	const startLine = startLineMatch ? Number.parseInt(startLineMatch[1], 10) : 1;
+	const showLineNumbers = meta ? !NO_LINE_NUMBERS_PATTERN.test(meta) : true;
+
+	return (
+		<CodeBlock
+			code={codeText(children)}
+			data-start-line={startLine > 1 ? startLine : undefined}
+			language={language}
+			showLineNumbers={showLineNumbers}
+		>
+			<CodeBlockHeader>
+				<CodeBlockTitle>
+					<CodeBlockFilename>{language}</CodeBlockFilename>
+				</CodeBlockTitle>
+				<CodeBlockActions>
+					<CodeBlockCopyButton />
+				</CodeBlockActions>
+			</CodeBlockHeader>
+		</CodeBlock>
+	);
+};
+
+const markdownComponents = {
+	code: MarkdownCode,
+} satisfies Components;
+
+const DEFAULT_MERMAID_CONFIG = {
+	fontFamily: "monospace",
+	securityLevel: "strict",
+	startOnLoad: false,
+	suppressErrorRendering: true,
+	theme: "default",
+} satisfies MermaidConfig;
+
+interface LazyMermaidInstance {
+	initialize: (config: MermaidConfig) => void;
+	render: (
+		id: string,
+		source: string,
+	) => Promise<{
+		svg: string;
+	}>;
+}
+
+function createLazyMermaidPlugin(): DiagramPlugin {
+	let config: MermaidConfig = DEFAULT_MERMAID_CONFIG;
+	let initialized = false;
+
+	const instance: LazyMermaidInstance = {
+		initialize(nextConfig: MermaidConfig) {
+			config = { ...DEFAULT_MERMAID_CONFIG, ...config, ...nextConfig };
+			initialized = false;
+		},
+		async render(id: string, source: string) {
+			const mermaidModule = await import("mermaid");
+			const mermaid = mermaidModule.default;
+			if (!initialized) {
+				mermaid.initialize(config);
+				initialized = true;
+			}
+			return mermaid.render(id, source);
+		},
+	};
+
+	return {
+		getMermaid(nextConfig?: MermaidConfig) {
+			if (nextConfig) {
+				instance.initialize(nextConfig);
+			}
+			return instance;
+		},
+		language: "mermaid",
+		name: "mermaid",
+		type: "diagram",
+	};
+}
+
+const streamdownPlugins = { cjk, mermaid: createLazyMermaidPlugin() };
+
+export type HubStreamdownProps = StreamdownProps;
+
+export const HubStreamdown = memo(
+	({ className, components, ...props }: HubStreamdownProps) => {
+		const mergedComponents = components
+			? { ...markdownComponents, ...components }
+			: markdownComponents;
+
+		return (
+			<Streamdown
+				className={className}
+				components={mergedComponents}
+				plugins={streamdownPlugins}
+				{...props}
+			/>
+		);
+	},
+);
+
+HubStreamdown.displayName = "HubStreamdown";

apps/cline-hub/src/webview/src/components/ui/accordion.tsx

@@ -32,7 +32,7 @@ function AccordionTrigger({
 			<AccordionPrimitive.Trigger
 				data-slot="accordion-trigger"
 				className={cn(
-					"group/accordion-trigger relative flex flex-1 items-start justify-between rounded-lg border border-transparent py-2.5 text-left text-sm font-medium transition-all outline-none hover:underline focus-visible:border-ring focus-visible:ring-3 focus-visible:ring-ring/50 focus-visible:after:border-ring aria-disabled:pointer-events-none aria-disabled:opacity-50 **:data-[slot=accordion-trigger-icon]:ml-auto **:data-[slot=accordion-trigger-icon]:size-4 **:data-[slot=accordion-trigger-icon]:text-muted-foreground",
+					"group/accordion-trigger relative flex flex-1 cursor-pointer items-start justify-between rounded-lg border border-transparent py-2.5 text-left text-sm font-medium transition-all outline-none hover:underline focus-visible:border-ring focus-visible:ring-3 focus-visible:ring-ring/50 focus-visible:after:border-ring aria-disabled:pointer-events-none aria-disabled:cursor-not-allowed aria-disabled:opacity-50 **:data-[slot=accordion-trigger-icon]:ml-auto **:data-[slot=accordion-trigger-icon]:size-4 **:data-[slot=accordion-trigger-icon]:text-muted-foreground",
 					className,
 				)}
 				{...props}

apps/cline-hub/src/webview/src/components/ui/checkbox.tsx

@@ -9,7 +9,7 @@ function Checkbox({ className, ...props }: CheckboxPrimitive.Root.Props) {
 		<CheckboxPrimitive.Root
 			data-slot="checkbox"
 			className={cn(
-				"peer relative flex size-4 shrink-0 items-center justify-center rounded-lg border border-input transition-colors outline-none group-has-disabled/field:opacity-50 after:absolute after:-inset-x-3 after:-inset-y-2 focus-visible:border-ring focus-visible:ring-3 focus-visible:ring-ring/50 disabled:cursor-not-allowed disabled:opacity-50 aria-invalid:border-destructive aria-invalid:ring-3 aria-invalid:ring-destructive/20 aria-invalid:aria-checked:border-primary dark:bg-input/30 dark:aria-invalid:border-destructive/50 dark:aria-invalid:ring-destructive/40 data-checked:border-primary data-checked:bg-primary data-checked:text-primary-foreground dark:data-checked:bg-primary",
+				"peer relative flex size-4 shrink-0 cursor-pointer items-center justify-center rounded-lg border border-input transition-colors outline-none group-has-disabled/field:opacity-50 after:absolute after:-inset-x-3 after:-inset-y-2 focus-visible:border-ring focus-visible:ring-3 focus-visible:ring-ring/50 disabled:cursor-not-allowed disabled:opacity-50 data-disabled:cursor-not-allowed aria-invalid:border-destructive aria-invalid:ring-3 aria-invalid:ring-destructive/20 aria-invalid:aria-checked:border-primary dark:bg-input/30 dark:aria-invalid:border-destructive/50 dark:aria-invalid:ring-destructive/40 data-checked:border-primary data-checked:bg-primary data-checked:text-primary-foreground dark:data-checked:bg-primary",
 				className,
 			)}
 			{...props}

apps/cline-hub/src/webview/src/components/ui/combobox.tsx

@@ -24,7 +24,10 @@ function ComboboxTrigger({
 	return (
 		<ComboboxPrimitive.Trigger
 			data-slot="combobox-trigger"
-			className={cn("[&_svg:not([class*='size-'])]:size-4", className)}
+			className={cn(
+				"cursor-pointer data-disabled:cursor-not-allowed [&_svg:not([class*='size-'])]:size-4",
+				className,
+			)}
 			{...props}
 		>
 			{children}
@@ -140,7 +143,7 @@ function ComboboxItem({
 		<ComboboxPrimitive.Item
 			data-slot="combobox-item"
 			className={cn(
-				"relative flex w-full cursor-default items-center gap-2 rounded-md py-1 pr-8 pl-1.5 text-sm outline-hidden select-none data-highlighted:bg-accent data-highlighted:text-accent-foreground not-data-[variant=destructive]:data-highlighted:**:text-accent-foreground data-disabled:pointer-events-none data-disabled:opacity-50 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4",
+				"relative flex w-full cursor-pointer items-center gap-2 rounded-md py-1 pr-8 pl-1.5 text-sm outline-hidden select-none data-highlighted:bg-accent data-highlighted:text-accent-foreground not-data-[variant=destructive]:data-highlighted:**:text-accent-foreground data-disabled:pointer-events-none data-disabled:cursor-not-allowed data-disabled:opacity-50 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4",
 				className,
 			)}
 			{...props}
@@ -250,7 +253,7 @@ function ComboboxChip({
 			{showRemove && (
 				<ComboboxPrimitive.ChipRemove
 					render={<Button variant="ghost" size="icon-xs" />}
-					className="-ml-1 opacity-50 hover:opacity-100"
+					className="-ml-1 cursor-pointer opacity-50 hover:opacity-100"
 					data-slot="combobox-chip-remove"
 				>
 					<XIcon className="pointer-events-none" />

apps/cline-hub/src/webview/src/components/ui/command.tsx

@@ -152,7 +152,7 @@ function CommandItem({
 		<CommandPrimitive.Item
 			data-slot="command-item"
 			className={cn(
-				"group/command-item relative flex cursor-default items-center gap-2 rounded-sm px-2 py-1.5 text-sm outline-hidden select-none in-data-[slot=dialog-content]:rounded-lg! data-[disabled=true]:pointer-events-none data-[disabled=true]:opacity-50 data-selected:bg-muted data-selected:text-foreground [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4 data-selected:*:[svg]:text-foreground",
+				"group/command-item relative flex cursor-pointer items-center gap-2 rounded-sm px-2 py-1.5 text-sm outline-hidden select-none in-data-[slot=dialog-content]:rounded-lg! data-[disabled=true]:pointer-events-none data-[disabled=true]:cursor-not-allowed data-[disabled=true]:opacity-50 data-selected:bg-muted data-selected:text-foreground [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4 data-selected:*:[svg]:text-foreground",
 				className,
 			)}
 			{...props}

apps/cline-hub/src/webview/src/components/ui/dropdown-menu.tsx

@@ -90,7 +90,7 @@ function DropdownMenuItem({
 			data-inset={inset}
 			data-variant={variant}
 			className={cn(
-				"group/dropdown-menu-item relative flex cursor-default items-center gap-1.5 rounded-md px-1.5 py-1 text-sm outline-hidden select-none focus:bg-accent focus:text-accent-foreground not-data-[variant=destructive]:focus:**:text-accent-foreground data-inset:pl-7 data-[variant=destructive]:text-destructive data-[variant=destructive]:focus:bg-destructive/10 data-[variant=destructive]:focus:text-destructive dark:data-[variant=destructive]:focus:bg-destructive/20 data-disabled:pointer-events-none data-disabled:opacity-50 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4 data-[variant=destructive]:*:[svg]:text-destructive",
+				"group/dropdown-menu-item relative flex cursor-pointer items-center gap-1.5 rounded-md px-1.5 py-1 text-sm outline-hidden select-none focus:bg-accent focus:text-accent-foreground not-data-[variant=destructive]:focus:**:text-accent-foreground data-inset:pl-7 data-[variant=destructive]:text-destructive data-[variant=destructive]:focus:bg-destructive/10 data-[variant=destructive]:focus:text-destructive dark:data-[variant=destructive]:focus:bg-destructive/20 data-disabled:pointer-events-none data-disabled:cursor-not-allowed data-disabled:opacity-50 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4 data-[variant=destructive]:*:[svg]:text-destructive",
 				className,
 			)}
 			{...props}
@@ -115,7 +115,7 @@ function DropdownMenuSubTrigger({
 			data-slot="dropdown-menu-sub-trigger"
 			data-inset={inset}
 			className={cn(
-				"flex cursor-default items-center gap-1.5 rounded-md px-1.5 py-1 text-sm outline-hidden select-none focus:bg-accent focus:text-accent-foreground not-data-[variant=destructive]:focus:**:text-accent-foreground data-inset:pl-7 data-popup-open:bg-accent data-popup-open:text-accent-foreground data-open:bg-accent data-open:text-accent-foreground [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4",
+				"flex cursor-pointer items-center gap-1.5 rounded-md px-1.5 py-1 text-sm outline-hidden select-none focus:bg-accent focus:text-accent-foreground not-data-[variant=destructive]:focus:**:text-accent-foreground data-inset:pl-7 data-popup-open:bg-accent data-popup-open:text-accent-foreground data-open:bg-accent data-open:text-accent-foreground data-disabled:cursor-not-allowed [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4",
 				className,
 			)}
 			{...props}
@@ -164,7 +164,7 @@ function DropdownMenuCheckboxItem({
 			data-slot="dropdown-menu-checkbox-item"
 			data-inset={inset}
 			className={cn(
-				"relative flex cursor-default items-center gap-1.5 rounded-md py-1 pr-8 pl-1.5 text-sm outline-hidden select-none focus:bg-accent focus:text-accent-foreground focus:**:text-accent-foreground data-inset:pl-7 data-disabled:pointer-events-none data-disabled:opacity-50 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4",
+				"relative flex cursor-pointer items-center gap-1.5 rounded-md py-1 pr-8 pl-1.5 text-sm outline-hidden select-none focus:bg-accent focus:text-accent-foreground focus:**:text-accent-foreground data-inset:pl-7 data-disabled:pointer-events-none data-disabled:cursor-not-allowed data-disabled:opacity-50 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4",
 				className,
 			)}
 			checked={checked}
@@ -205,7 +205,7 @@ function DropdownMenuRadioItem({
 			data-slot="dropdown-menu-radio-item"
 			data-inset={inset}
 			className={cn(
-				"relative flex cursor-default items-center gap-1.5 rounded-md py-1 pr-8 pl-1.5 text-sm outline-hidden select-none focus:bg-accent focus:text-accent-foreground focus:**:text-accent-foreground data-inset:pl-7 data-disabled:pointer-events-none data-disabled:opacity-50 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4",
+				"relative flex cursor-pointer items-center gap-1.5 rounded-md py-1 pr-8 pl-1.5 text-sm outline-hidden select-none focus:bg-accent focus:text-accent-foreground focus:**:text-accent-foreground data-inset:pl-7 data-disabled:pointer-events-none data-disabled:cursor-not-allowed data-disabled:opacity-50 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4",
 				className,
 			)}
 			{...props}

apps/cline-hub/src/webview/src/components/ui/menubar.tsx

@@ -56,7 +56,7 @@ function MenubarTrigger({
 		<DropdownMenuTrigger
 			data-slot="menubar-trigger"
 			className={cn(
-				"flex items-center rounded-sm px-1.5 py-0.5 text-sm font-medium outline-hidden select-none hover:bg-muted aria-expanded:bg-muted",
+				"flex cursor-pointer items-center rounded-sm px-1.5 py-0.5 text-sm font-medium outline-hidden select-none hover:bg-muted aria-expanded:bg-muted",
 				className,
 			)}
 			{...props}
@@ -120,7 +120,7 @@ function MenubarCheckboxItem({
 			data-slot="menubar-checkbox-item"
 			data-inset={inset}
 			className={cn(
-				"relative flex cursor-default items-center gap-1.5 rounded-md py-1 pr-1.5 pl-7 text-sm outline-hidden select-none focus:bg-accent focus:text-accent-foreground focus:**:text-accent-foreground data-inset:pl-7 data-disabled:pointer-events-none data-disabled:opacity-50 [&_svg]:pointer-events-none [&_svg]:shrink-0",
+				"relative flex cursor-pointer items-center gap-1.5 rounded-md py-1 pr-1.5 pl-7 text-sm outline-hidden select-none focus:bg-accent focus:text-accent-foreground focus:**:text-accent-foreground data-inset:pl-7 data-disabled:pointer-events-none data-disabled:cursor-not-allowed data-disabled:opacity-50 [&_svg]:pointer-events-none [&_svg]:shrink-0",
 				className,
 			)}
 			checked={checked}
@@ -155,7 +155,7 @@ function MenubarRadioItem({
 			data-slot="menubar-radio-item"
 			data-inset={inset}
 			className={cn(
-				"relative flex cursor-default items-center gap-1.5 rounded-md py-1 pr-1.5 pl-7 text-sm outline-hidden select-none focus:bg-accent focus:text-accent-foreground focus:**:text-accent-foreground data-inset:pl-7 data-disabled:pointer-events-none data-disabled:opacity-50 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4",
+				"relative flex cursor-pointer items-center gap-1.5 rounded-md py-1 pr-1.5 pl-7 text-sm outline-hidden select-none focus:bg-accent focus:text-accent-foreground focus:**:text-accent-foreground data-inset:pl-7 data-disabled:pointer-events-none data-disabled:cursor-not-allowed data-disabled:opacity-50 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4",
 				className,
 			)}
 			{...props}

apps/cline-hub/src/webview/src/components/ui/native-select.tsx

@@ -23,7 +23,7 @@ function NativeSelect({
 			<select
 				data-slot="native-select"
 				data-size={size}
-				className="h-full w-full min-w-0 appearance-none rounded-lg border border-input bg-transparent py-1 pr-8 pl-2.5 text-sm transition-colors outline-none select-none selection:bg-primary selection:text-primary-foreground placeholder:text-muted-foreground focus-visible:border-ring focus-visible:ring-3 focus-visible:ring-ring/50 disabled:pointer-events-none disabled:cursor-not-allowed aria-invalid:border-destructive aria-invalid:ring-3 aria-invalid:ring-destructive/20 data-[size=sm]:h-7 data-[size=sm]:rounded-[min(var(--radius-md),10px)] data-[size=sm]:py-0.5 dark:bg-input/30 dark:hover:bg-input/50 dark:aria-invalid:border-destructive/50 dark:aria-invalid:ring-destructive/40"
+				className="h-full w-full min-w-0 cursor-pointer appearance-none rounded-lg border border-input bg-transparent py-1 pr-8 pl-2.5 text-sm transition-colors outline-none select-none selection:bg-primary selection:text-primary-foreground placeholder:text-muted-foreground focus-visible:border-ring focus-visible:ring-3 focus-visible:ring-ring/50 disabled:pointer-events-none disabled:cursor-not-allowed aria-invalid:border-destructive aria-invalid:ring-3 aria-invalid:ring-destructive/20 data-[size=sm]:h-7 data-[size=sm]:rounded-[min(var(--radius-md),10px)] data-[size=sm]:py-0.5 dark:bg-input/30 dark:hover:bg-input/50 dark:aria-invalid:border-destructive/50 dark:aria-invalid:ring-destructive/40"
 				{...props}
 			/>
 			<ChevronDownIcon

apps/cline-hub/src/webview/src/components/ui/radio-group.tsx

@@ -18,7 +18,7 @@ function RadioGroupItem({ className, ...props }: RadioPrimitive.Root.Props) {
 		<RadioPrimitive.Root
 			data-slot="radio-group-item"
 			className={cn(
-				"group/radio-group-item peer relative flex aspect-square size-4 shrink-0 rounded-full border border-input outline-none after:absolute after:-inset-x-3 after:-inset-y-2 focus-visible:border-ring focus-visible:ring-3 focus-visible:ring-ring/50 disabled:cursor-not-allowed disabled:opacity-50 aria-invalid:border-destructive aria-invalid:ring-3 aria-invalid:ring-destructive/20 aria-invalid:aria-checked:border-primary dark:bg-input/30 dark:aria-invalid:border-destructive/50 dark:aria-invalid:ring-destructive/40 data-checked:border-primary data-checked:bg-primary data-checked:text-primary-foreground dark:data-checked:bg-primary",
+				"group/radio-group-item peer relative flex aspect-square size-4 shrink-0 cursor-pointer rounded-full border border-input outline-none after:absolute after:-inset-x-3 after:-inset-y-2 focus-visible:border-ring focus-visible:ring-3 focus-visible:ring-ring/50 disabled:cursor-not-allowed disabled:opacity-50 data-disabled:cursor-not-allowed aria-invalid:border-destructive aria-invalid:ring-3 aria-invalid:ring-destructive/20 aria-invalid:aria-checked:border-primary dark:bg-input/30 dark:aria-invalid:border-destructive/50 dark:aria-invalid:ring-destructive/40 data-checked:border-primary data-checked:bg-primary data-checked:text-primary-foreground dark:data-checked:bg-primary",
 				className,
 			)}
 			{...props}

apps/cline-hub/src/webview/src/components/ui/select.tsx

@@ -38,7 +38,7 @@ function SelectTrigger({
 			data-slot="select-trigger"
 			data-size={size}
 			className={cn(
-				"flex w-fit items-center justify-between gap-1.5 rounded-lg border border-input bg-transparent py-2 pr-2 pl-2.5 text-sm whitespace-nowrap transition-colors outline-none select-none focus-visible:border-ring focus-visible:ring-3 focus-visible:ring-ring/50 disabled:cursor-not-allowed disabled:opacity-50 aria-invalid:border-destructive aria-invalid:ring-3 aria-invalid:ring-destructive/20 data-placeholder:text-muted-foreground data-[size=default]:h-8 data-[size=sm]:h-7 data-[size=sm]:rounded-[min(var(--radius-md),10px)] *:data-[slot=select-value]:line-clamp-1 *:data-[slot=select-value]:flex *:data-[slot=select-value]:items-center *:data-[slot=select-value]:gap-1.5 dark:bg-input/30 dark:hover:bg-input/50 dark:aria-invalid:border-destructive/50 dark:aria-invalid:ring-destructive/40 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4",
+				"flex w-fit cursor-pointer items-center justify-between gap-1.5 rounded-lg border border-input bg-transparent py-2 pr-2 pl-2.5 text-sm whitespace-nowrap transition-colors outline-none select-none focus-visible:border-ring focus-visible:ring-3 focus-visible:ring-ring/50 disabled:cursor-not-allowed disabled:opacity-50 aria-invalid:border-destructive aria-invalid:ring-3 aria-invalid:ring-destructive/20 data-placeholder:text-muted-foreground data-[size=default]:h-8 data-[size=sm]:h-7 data-[size=sm]:rounded-[min(var(--radius-md),10px)] *:data-[slot=select-value]:line-clamp-1 *:data-[slot=select-value]:flex *:data-[slot=select-value]:items-center *:data-[slot=select-value]:gap-1.5 dark:bg-input/30 dark:hover:bg-input/50 dark:aria-invalid:border-destructive/50 dark:aria-invalid:ring-destructive/40 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4",
 				className,
 			)}
 			{...props}
@@ -117,7 +117,7 @@ function SelectItem({
 		<SelectPrimitive.Item
 			data-slot="select-item"
 			className={cn(
-				"relative flex w-full cursor-default items-center gap-1.5 rounded-md py-1 pr-8 pl-1.5 text-sm outline-hidden select-none focus:bg-accent focus:text-accent-foreground not-data-[variant=destructive]:focus:**:text-accent-foreground data-disabled:pointer-events-none data-disabled:opacity-50 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4 *:[span]:last:flex *:[span]:last:items-center *:[span]:last:gap-2",
+				"relative flex w-full cursor-pointer items-center gap-1.5 rounded-md py-1 pr-8 pl-1.5 text-sm outline-hidden select-none focus:bg-accent focus:text-accent-foreground not-data-[variant=destructive]:focus:**:text-accent-foreground data-disabled:pointer-events-none data-disabled:cursor-not-allowed data-disabled:opacity-50 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4 *:[span]:last:flex *:[span]:last:items-center *:[span]:last:gap-2",
 				className,
 			)}
 			{...props}
@@ -157,7 +157,7 @@ function SelectScrollUpButton({
 		<SelectPrimitive.ScrollUpArrow
 			data-slot="select-scroll-up-button"
 			className={cn(
-				"top-0 z-10 flex w-full cursor-default items-center justify-center bg-popover py-1 [&_svg:not([class*='size-'])]:size-4",
+				"top-0 z-10 flex w-full cursor-pointer items-center justify-center bg-popover py-1 [&_svg:not([class*='size-'])]:size-4",
 				className,
 			)}
 			{...props}
@@ -175,7 +175,7 @@ function SelectScrollDownButton({
 		<SelectPrimitive.ScrollDownArrow
 			data-slot="select-scroll-down-button"
 			className={cn(
-				"bottom-0 z-10 flex w-full cursor-default items-center justify-center bg-popover py-1 [&_svg:not([class*='size-'])]:size-4",
+				"bottom-0 z-10 flex w-full cursor-pointer items-center justify-center bg-popover py-1 [&_svg:not([class*='size-'])]:size-4",
 				className,
 			)}
 			{...props}

apps/cline-hub/src/webview/src/components/ui/switch.tsx

@@ -16,7 +16,7 @@ function Switch({
 			data-slot="switch"
 			data-size={size}
 			className={cn(
-				"peer group/switch relative inline-flex shrink-0 items-center rounded-full border border-transparent transition-all outline-none after:absolute after:-inset-x-3 after:-inset-y-2 focus-visible:border-ring focus-visible:ring-3 focus-visible:ring-ring/50 aria-invalid:border-destructive aria-invalid:ring-3 aria-invalid:ring-destructive/20 data-[size=default]:h-[18.4px] data-[size=default]:w-8 data-[size=sm]:h-3.5 data-[size=sm]:w-6 dark:aria-invalid:border-destructive/50 dark:aria-invalid:ring-destructive/40 data-checked:bg-primary data-unchecked:bg-input dark:data-unchecked:bg-input/80 data-disabled:cursor-not-allowed data-disabled:opacity-50",
+				"peer group/switch relative inline-flex cursor-pointer shrink-0 items-center rounded-full border border-transparent transition-all outline-none after:absolute after:-inset-x-3 after:-inset-y-2 focus-visible:border-ring focus-visible:ring-3 focus-visible:ring-ring/50 aria-invalid:border-destructive aria-invalid:ring-3 aria-invalid:ring-destructive/20 data-[size=default]:h-[18.4px] data-[size=default]:w-8 data-[size=sm]:h-3.5 data-[size=sm]:w-6 dark:aria-invalid:border-destructive/50 dark:aria-invalid:ring-destructive/40 data-checked:bg-primary data-unchecked:bg-input dark:data-unchecked:bg-input/80 data-disabled:cursor-not-allowed data-disabled:opacity-50",
 				className,
 			)}
 			{...props}

apps/cline-hub/src/webview/src/components/ui/tabs.tsx

@@ -58,7 +58,7 @@ function TabsTrigger({ className, ...props }: TabsPrimitive.Tab.Props) {
 		<TabsPrimitive.Tab
 			data-slot="tabs-trigger"
 			className={cn(
-				"relative inline-flex h-[calc(100%-1px)] flex-1 items-center justify-center gap-1.5 rounded-md border border-transparent px-1.5 py-0.5 text-sm font-medium whitespace-nowrap text-foreground/60 transition-all group-data-vertical/tabs:w-full group-data-vertical/tabs:justify-start hover:text-foreground focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50 focus-visible:outline-1 focus-visible:outline-ring disabled:pointer-events-none disabled:opacity-50 aria-disabled:pointer-events-none aria-disabled:opacity-50 dark:text-muted-foreground dark:hover:text-foreground group-data-[variant=default]/tabs-list:data-active:shadow-sm group-data-[variant=line]/tabs-list:data-active:shadow-none [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4",
+				"relative inline-flex h-[calc(100%-1px)] flex-1 cursor-pointer items-center justify-center gap-1.5 rounded-md border border-transparent px-1.5 py-0.5 text-sm font-medium whitespace-nowrap text-foreground/60 transition-all group-data-vertical/tabs:w-full group-data-vertical/tabs:justify-start hover:text-foreground focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50 focus-visible:outline-1 focus-visible:outline-ring disabled:pointer-events-none disabled:cursor-not-allowed disabled:opacity-50 aria-disabled:pointer-events-none aria-disabled:cursor-not-allowed aria-disabled:opacity-50 dark:text-muted-foreground dark:hover:text-foreground group-data-[variant=default]/tabs-list:data-active:shadow-sm group-data-[variant=line]/tabs-list:data-active:shadow-none [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4",
 				"group-data-[variant=line]/tabs-list:bg-transparent group-data-[variant=line]/tabs-list:data-active:bg-transparent dark:group-data-[variant=line]/tabs-list:data-active:border-transparent dark:group-data-[variant=line]/tabs-list:data-active:bg-transparent",
 				"data-active:bg-background data-active:text-foreground dark:data-active:border-input dark:data-active:bg-input/30 dark:data-active:text-foreground",
 				"after:absolute after:bg-foreground after:opacity-0 after:transition-opacity group-data-horizontal/tabs:after:inset-x-0 group-data-horizontal/tabs:after:bottom-[-5px] group-data-horizontal/tabs:after:h-0.5 group-data-vertical/tabs:after:inset-y-0 group-data-vertical/tabs:after:-right-1 group-data-vertical/tabs:after:w-0.5 group-data-[variant=line]/tabs-list:data-active:after:opacity-100",