fix(core): hide synthetic empty assistant content

* Improve OpenRouter sticky session routing

OpenRouter prompt caching was getting weaker cache hit rates because requests did not include a stable session_id. Without that identifier, OpenRouter can route consecutive turns away from the same upstream cache context even when cache_control is present, causing more fresh input billing.

Propagate explicit runtime sessionId metadata from agents into model requests without synthesizing fallback session or conversation ids. Add provider metadata for sticky sessions so OpenRouter maps metadata.sessionId to the JSON body session_id field, while keeping the mechanism extensible for header-based providers.

Apply sticky-session metadata in the AI SDK provider fetch wrapper, preserving explicit wire values when callers already set them. Move trimNonEmpty and omitUndefinedValues into @cline/shared for reuse, and cover the JSON-body, header, and no-fallback paths with tests.

* Tighten sticky session fetch body handling

Treat init.body null as an explicit no-body override so the sticky-session wrapper does not inspect or parse a Request body that the caller has intentionally overridden.

Model fetch body text by source, which removes the unreachable JSON-body injection branch and makes the Request rewrite path explicit. Also type the provider fetch mocks so sticky-session assertions compile cleanly in editors.

* merges model-handle default metadata with per-request metadata

.claude/hooks/claude-code-for-web-setup.sh

@@ -41,11 +41,11 @@ fi
 
 # Install project dependencies
 echo "Installing dependencies..."
-bun run install:all
+npm run install:all
 
 # Generate gRPC/protobuf types (required for TypeScript)
 echo "Generating proto types..."
-bun run protos
+npm run protos
 
 echo ""
 echo "Session setup complete!"

.clinerules/bun-and-node.md

@@ -1,55 +0,0 @@
-# Bun (tooling) and Node (runtime)
-
-This repo uses **bun** for package management and task running, and **Node** as
-the execution runtime. Both are correct at the same time; the distinction is the
-source of most confusion, so keep it straight before editing scripts, configs,
-docs, or comments.
-
-## Use bun for tooling
-
-- `bun install` (never `npm install` / `npm ci`)
-- `bun run <script>` (never `npm run <script>`)
-- `bunx <bin>` (never `npx <bin>`)
-- `bun <file>.ts` to run a TS entrypoint directly (no `ts-node` / `tsx`)
-- `bun esbuild.mjs` to drive the build (esbuild/vite are still the bundlers)
-- `bun run --parallel ...` for parallel tasks
-
-The root `bun.lock` is the single lockfile for the whole workspace, including
-`apps/vscode`, `webview-ui`, and `testing-platform`. There are no per-package npm
-lockfiles.
-
-## Node is the runtime — do NOT rewrite these to bun
-
-The build product runs on Node: the VS Code extension host loads
-`dist/extension.js` as CommonJS under Node, and the standalone `cline-core` is a
-Node process. The following are Node runtime/ABI references and are correct as-is:
-
-| Reference | Why it is Node |
-|-----------|----------------|
-| esbuild `platform: "node"` / `target: "node..."` | The bundle targets the Node runtime (extension host, standalone core). |
-| `TARGET_NODE_VERSION` (`scripts/package-standalone.mjs`) | Pins the Node ABI of the bundled standalone runtime (matches the JetBrains-packaged Node). |
-| `prebuild-install --target=<node version>` | Downloads native `.node` binaries for that Node ABI. |
-| `NODE_PATH=... node cline-core.js` | The standalone core is launched by Node, not bun. |
-| `node:` import specifiers (e.g. `node:fs`) | Node builtin module scheme; unrelated to tooling. |
-| `process.versions.node`, `engines.node`, `@types/node` | Runtime version probe / declared runtime / its types. |
-| `ELECTRON_RUN_AS_NODE` | VS Code/Electron runs the extension host as Node. |
-
-When a file legitimately uses both bun and node (e.g. `package-standalone.mjs`
-does `bun install` but `prebuild-install --target=<node>`), the `node` token is
-the runtime/ABI target, not tooling. If unsure, leave it.
-
-## Tests: bun vs the VS Code host
-
-A test file's runner is decided by its import:
-
-- **`import ... from "bun:test"`** → runs under `bun test` (the node-side unit
-  suites + the SDK/model-catalog suites). `scripts/run-bun-unit-tests.ts`
-  discovers these by the `bun:test` import and runs one isolated bun process per
-  file. `build-tests.js` excludes them from the integration compile so the
-  `bun:test` builtin never reaches Node.
-- **`import ... from "mocha"`** → runs under `@vscode/test-cli` in a real VS Code
-  extension host (Node). These exercise the live `vscode` API and cannot run
-  under bun.
-
-So a file imports `bun:test` XOR `mocha`. Don't add `bun:test` to a test that
-needs the real extension host.

.clinerules/debug-harness.md

@@ -1,128 +0,0 @@
-# Debug Harness
-
-HTTP-controlled debugger for the VSCode extension at `src/dev/debug-harness/server.ts`.
-
-## Quick start
-
-```bash
-# Build extension first if needed (protos + esbuild):
-bun run protos && IS_DEV=true bun esbuild.mjs
-
-# Launch (skip-build if already built):
-bun src/dev/debug-harness/server.ts --skip-build --auto-launch
-
-# In another terminal:
-curl localhost:19229/api -d '{"method":"status"}'
-```
-
-## Data Isolation
-
-The debugee runs with `CLINE_DIR=~/.cline2` by default, separate from your real `~/.cline`.
-This prevents the debugee's logout from logging out the debugger, and vice versa.
-Override with `--cline-dir /tmp/test-dir`. Check with `status()` → `clineDir`.
-
-## Browser Capture & OAuth
-
-The debugee runs with `CLINE_CAPTURE_BROWSER=1`, which intercepts `openExternal()` in
-`src/utils/env.ts`. URLs are captured instead of opening a real browser:
-
-- Logged to `$CLINE_DIR/data/debug-captured-urls.jsonl`
-- POSTed in real-time to `/captured-url` on the harness server
-- Queryable via `oauth.captured_urls`
-
-### OAuth API
-
-- **`oauth.captured_urls`** `{clear?}` — URLs the debugee tried to open
-- **`oauth.read_stored_token`** — Check auth token presence in secrets.json
-- **`oauth.simulate_callback`** `{path, code?, state?, provider?, token?}` — Build vscode:// callback URI
-- **`oauth.read_captured_urls_file`** — Read on-disk JSONL of captured URLs
-
-### OAuth testing flow
-
-For **Cline OAuth** (SDK local callback): The SDK starts a local HTTP server, the auth URL
-is captured. To complete: open the captured URL in a real browser (it redirects back to the
-SDK's callback server), OR extract the callback port and `curl http://127.0.0.1:PORT/callback?code=...`.
-
-For **MCP/Provider OAuth** (vscode:// URI): The redirect goes to a vscode:// URI.
-`oauth.simulate_callback` only *builds* the URI — it does not deliver it, and the ESM
-extension host can't `require()` the handler. To actually deliver the callback, call the
-debug-only hook via `ext.evaluate` (with `awaitPromise: true`):
-`globalThis.__clineHandleUri("vscode://saoudrizwan.claude-dev/...?code=...&state=...")`.
-It runs the same `SharedUriHandler.handleUri` as VSCode's real URI handler and exists only
-when `CLINE_CAPTURE_BROWSER` is set (the harness always sets it; never ships in prod).
-For end-to-end MCP OAuth, get a real `code` from the local MCP OAuth test server
-(`bun run dev:mcp-oauth-test-server`).
-
-## Navigating Views — Use Commands, Not Clicks
-
-Don't try to find/click small sidebar icons. Use VSCode commands via command palette.
-Registered in `src/registry.ts`:
-
-| Command | View |
-|---------|------|
-| `cline.accountButtonClicked` | Account / sign-in |
-| `cline.historyButtonClicked` | Task history |
-| `cline.settingsButtonClicked` | Settings |
-| `cline.mcpButtonClicked` | MCP servers |
-| `cline.plusButtonClicked` | New task (chat) |
-| `cline.worktreesButtonClicked` | Worktrees |
-
-```bash
-curl localhost:19229/api -d '{"method":"ui.command_palette","params":{"command":"cline.accountButtonClicked"}}'
-```
-
-## Key commands
-
-All via `POST localhost:19229/api` with `{"method":"...", "params":{...}}`:
-
-- **`launch`** / **`shutdown`** — lifecycle
-- **`ui.screenshot`** — screenshot to `/tmp/cline-debug/`; returns `{path}` — **use `read_file` on the path to examine, do NOT `open` the file** (Preview.app covers the VSCode window)
-- **`ui.open_sidebar`** — open the Cline sidebar
-- **`ext.set_breakpoint`** `{file, line, condition?}` — breakpoint by source file (sourcemap-resolved)
-- **`ext.evaluate`** `{expression, callFrameId?}` — eval in extension host
-- **`ext.resume`** / **`ext.step_over`** / **`ext.step_into`** — stepping
-- **`ext.call_stack`** — inspect when paused
-- **`web.evaluate`** `{expression}` — eval in webview
-- **`web.post_message`** `{message}` — send postMessage to extension host via exposed vsCodeApi
-- **`wait_for_pause`** `{timeout?}` — block until breakpoint hit
-- **`ui.locator`** `{role?, testId?, text?, frame?}` — Playwright locator (auto-retries on stale sidebar frame)
-- **`ui.react_input`** `{text, selector?, clear?, submit?}` — set React textarea value via `execCommand('insertText')`; works reliably across multiple tasks
-- **`ui.send_message`** `{text, images?, files?, responseType?}` — send chat message bypassing the textarea entirely (via gRPC postMessage)
-- **`ui.command_palette`** `{command}` — run VSCode command
-
-## Typical Session
-
-```bash
-# 1. Launch
-curl localhost:19229/api -d '{"method":"launch","params":{"skipBuild":true}}'
-
-# 2. Open sidebar + dismiss overlays (ALWAYS do this first)
-curl localhost:19229/api -d '{"method":"ui.open_sidebar"}'
-curl localhost:19229/api -d '{"method":"web.evaluate","params":{"expression":"document.querySelectorAll(\".sr-only\").forEach(el => el.parentElement?.click())"}}'
-
-# 3. Navigate to view
-curl localhost:19229/api -d '{"method":"ui.command_palette","params":{"command":"cline.accountButtonClicked"}}'
-
-# 4. Check captured OAuth URLs if testing auth
-curl localhost:19229/api -d '{"method":"oauth.captured_urls"}'
-
-# 5. Verify
-curl localhost:19229/api -d '{"method":"ui.screenshot"}'
-```
-
-## Caveats
-
-- **⚠️ Dismiss promotional overlays FIRST**: On fresh launches, full-screen promo overlays block the sidebar. **Dismiss immediately after `ui.open_sidebar`**, before any other interaction or screenshot. May need to run twice:
-  ```bash
-  curl localhost:19229/api -d '{"method": "ui.open_sidebar"}'
-  curl localhost:19229/api -d '{"method": "web.evaluate", "params": {"expression": "document.querySelectorAll(\".sr-only\").forEach(el => el.parentElement?.click())"}}'
-  ```
-- **Screenshots — don't open the file**: `ui.screenshot` and `ui.sidebar_screenshot` save PNGs to `/tmp/cline-debug/` and return the `{path}`. Use `read_file` on that path to examine screenshots. Running `open <path>` launches Preview.app on macOS which covers the VSCode window.
-- **Scripts count = 0 after launch**: CDP connects after extension host starts, so scripts parsed during startup aren't tracked. Breakpoints still work via sourcemap resolution.
-- **Port 9230**: Extension host inspector. If another VSCode instance uses this port, the harness will fail to connect. Kill other debug instances first.
-- **macOS only** for now (Playwright Electron launch behavior).
-- **Webview CDP**: `connect_webview` may fail depending on Electron version. `web.evaluate` still works via Playwright's `frame.evaluate()` fallback.
-- **Sourcemap paths**: esbuild outputs relative paths like `../src/extension.ts` in the sourcemap. The resolver handles this, but if a file isn't found, use `ext.source_files` to see exact paths.
-- **OAuth with fake codes**: Browser capture intercepts the URL but doesn't provide a valid auth code. For real OAuth testing, open the captured URL in a browser. For unit testing, mock the token exchange.
-
-See `src/dev/debug-harness/README.md` for full API reference.

.clinerules/general.md

@@ -13,56 +13,11 @@ This file is the secret sauce for working effectively in this codebase. It captu
 **What NOT to add:** Stuff you can figure out from reading a few files, obvious patterns, or standard practices. This file should be high-signal, not comprehensive.
 
 ## Miscellaneous
-- The whole repo (including `apps/vscode`) uses **bun** for package management and task running. Emit `bun run X` / `bun install` / `bunx <bin>` / `bun file.ts`, never npm/npx. Node remains the *runtime* (VS Code's extension host and the standalone cline-core are Node), so Node-runtime tokens are legitimate and must not be "fixed" to bun — see @.clinerules/bun-and-node.md for the keep-list vs rewrite-list.
-- Avoid provider-specific string matching / hardcoded provider branches when fixing provider/config plumbing. Prefer provider metadata, shared catalog/defaults, explicit protocol/client capabilities, or centralized normalization utilities that apply by data shape rather than `providerId === "..."`. If a provider exception seems necessary, stop and explain why instead of adding ad-hoc string matching.
-- This is a VS Code extension—check `package.json` for available scripts before trying to verify builds (e.g., `bun run compile`, not `bun run build`).
+- This is a VS Code extension—check `package.json` for available scripts before trying to verify builds (e.g., `npm run compile`, not `npm run build`).
 - When creating PRs, contributors should not create changelog-entry files. Maintainers handle release versioning and changelog curation during the release process.
 - When adding new feature flags, see this PR as a reference https://github.com/cline/cline/pull/7566
 - Additional instructions about making requests: @.clinerules/network.md
 
-## Searching the Codebase — Avoiding Build Output
-
-Several directories contain build output or generated code that produces
-noisy or unusable results with `search_files` / `grep`:
-
-| Directory | What it is | Why it's a problem |
-|-----------|-----------|-------------------|
-| `out/` | esbuild bundle output | Mirrors `src/` structure as minified JS — every search gets duplicate hits on single-line files |
-| `dist/` | Packaged extension | Entire extension bundled into one minified `extension.js` (~1 long line) |
-| `dist-standalone/` | Standalone build output | Same minification issue |
-| `src/generated/` | Generated protobuf code | Auto-generated from `proto/`; not the source of truth |
-| `src/shared/proto/` | Generated proto type defs | Auto-generated from `proto/`; not the source of truth |
-| `node_modules/` | Dependencies | Huge, not project source |
-
-### How to skip build output
-
-**`search_files`** — Point at `src/` (not the project root) and use `file_pattern`:
-```
-search_files(path="src/core", regex="myFunction", file_pattern="*.ts")
-```
-The `file_pattern` parameter is the most effective filter — e.g. `"*.ts"`,
-`"*.tsx"`, `"*.proto"`.
-
-**`grep` directly** — Exclude build dirs and restrict to source extensions:
-```bash
-grep -rn "myFunction" src/ --include="*.ts" --exclude-dir={out,dist,node_modules,generated}
-```
-
-### When you must search minified files
-
-Sometimes you need to verify what got bundled (e.g., checking if a change
-made it into the build). Minified files are typically one long line, so
-normal `grep` shows the entire file as context. Use these approaches:
-
-- **`grep -oP`** to extract just the match with limited surrounding context:
-  ```bash
-  grep -oP '.{0,40}myFunction.{0,40}' dist/extension.js
-  ```
-- **`read_file`** on files in `out/src/` — these have source maps and are
-  more readable than `dist/extension.js` (which is the fully bundled output).
-- **Source maps** — `out/src/*.js.map` and `dist/extension.js.map` can be
-  used to trace minified output back to original source locations.
-
 ## gRPC/Protobuf Communication
 The extension and webview communicate via gRPC-like protocol over VS Code message passing.
 
@@ -73,7 +28,7 @@ The extension and webview communicate via gRPC-like protocol over VS Code messag
 - Naming: Services `PascalCaseService`, RPCs `camelCase`, Messages `PascalCase`
 - For streaming responses, use `stream` keyword (see `subscribeToAuthCallback` in `account.proto`)
 
-**Run `bun run protos`** after any proto changes—generates types in:
+**Run `npm run protos`** after any proto changes—generates types in:
 - `src/shared/proto/` - Shared type definitions
 - `src/generated/grpc-js/` - Service implementations
 - `src/generated/nice-grpc/` - Promise-based clients
@@ -93,6 +48,93 @@ The extension and webview communicate via gRPC-like protocol over VS Code messag
 - `src/core/controller/task/explainChanges.ts` - Handler implementation
 - `webview-ui/src/components/chat/ChatRow.tsx` - UI rendering
 
+## Adding a New API Provider
+When adding a new provider (e.g., "openai-codex"), you must update the proto conversion layer in THREE places or the provider will silently reset to Anthropic:
+
+1. `proto/cline/models.proto` - Add to the `ApiProvider` enum (e.g., `OPENAI_CODEX = 40;`)
+2. `convertApiProviderToProto()` in `src/shared/proto-conversions/models/api-configuration-conversion.ts` - Add case mapping string to proto enum
+3. `convertProtoToApiProvider()` in the same file - Add case mapping proto enum back to string
+
+**Why this matters:** Without these, the provider string hits the `default` case and returns `ANTHROPIC`. The webview, provider list, and handler all work fine, but the state silently resets when it round-trips through proto serialization. No error is thrown.
+
+**Other files to update when adding a provider:**
+- `src/shared/api.ts` - Add to `ApiProvider` union type, define models
+- `src/shared/providers/providers.json` - Add to provider list for dropdown
+- `src/core/api/index.ts` - Register handler in `createHandlerForProvider()`
+- `webview-ui/src/components/settings/utils/providerUtils.ts` - Add cases in `getModelsForProvider()` and `normalizeApiConfiguration()`
+- `webview-ui/src/utils/validate.ts` - Add validation case
+- `webview-ui/src/components/settings/ApiOptions.tsx` - Render provider component
+
+## Responses API Providers (OpenAI Codex, OpenAI Native)
+Providers using OpenAI's Responses API require native tool calling. XML tools don't work with the Responses API.
+
+**Symptoms of broken native tool calling:**
+- Tools get called multiple times (e.g., `ask_followup_question` asks the same question twice)
+- Tool arguments get duplicated or malformed
+- The model responds but tools aren't recognized
+
+**Root causes to check:**
+1. **Provider missing from `isNextGenModelProvider()`** in `src/utils/model-utils.ts`. The native variant matchers (e.g., `native-gpt-5/config.ts`) call this function. If your provider isn't in the list, the matcher returns false and falls back to XML tools.
+
+2. **Model missing `apiFormat: ApiFormat.OPENAI_RESPONSES`** in its model info (`src/shared/api.ts`). This property signals that the model requires native tool calling. The task runner in `src/core/task/index.ts` checks this and forces `enableNativeToolCalls: true` regardless of user settings.
+
+**When adding a new Responses API provider:**
+1. Add provider to `isNextGenModelProvider()` list in `src/utils/model-utils.ts`
+2. Set `apiFormat: ApiFormat.OPENAI_RESPONSES` on all models that use the Responses API
+3. The variant matcher and task runner will handle the rest automatically
+
+## Adding Tools to System Prompt
+This is tricky—multiple prompt variants and configs. **Always search for existing similar tools first and follow their pattern.** Look at the full chain from prompt definition → variant configs → handler → UI before implementing.
+
+1. **Add to `ClineDefaultTool` enum** in `src/shared/tools.ts`
+2. **Tool definition** in `src/core/prompts/system-prompt/tools/` (create file like `generate_explanation.ts`)
+   - Define variants for each `ModelFamily` (generic, next-gen, xs, etc.)
+   - Export variants array (e.g., `export const my_tool_variants = [GENERIC, NATIVE_NEXT_GEN, XS]`)
+   - **Fallback behavior**: If a variant isn't defined for a model family, `ClineToolSet.getToolByNameWithFallback()` automatically falls back to GENERIC. So you only need to export `[GENERIC]` unless the tool needs model-specific behavior.
+3. **Register in `src/core/prompts/system-prompt/tools/init.ts`** - Import and spread into `allToolVariants`
+4. **Add to variant configs** - Each model family has its own config in `src/core/prompts/system-prompt/variants/*/config.ts`. Add your tool's enum to the `.tools()` list:
+   - `generic/config.ts`, `next-gen/config.ts`, `gpt-5/config.ts`, `native-gpt-5/config.ts`, `native-gpt-5-1/config.ts`, `native-next-gen/config.ts`, `gemini-3/config.ts`, `glm/config.ts`, `hermes/config.ts`, `xs/config.ts`
+   - **Important**: If you add to a variant's config, make sure the tool spec exports a variant for that ModelFamily (or relies on GENERIC fallback)
+5. **Create handler** in `src/core/task/tools/handlers/`
+6. **Wire up in `ToolExecutor.ts`** if needed for execution flow
+7. **Add to tool parsing** in `src/core/assistant-message/index.ts` if needed
+8. **If tool has UI feedback**: add `ClineSay` enum in proto, update `src/shared/ExtensionMessage.ts`, update `src/shared/proto-conversions/cline-message.ts`, update `webview-ui/src/components/chat/ChatRow.tsx`
+
+## Modifying System Prompt
+**Read these first:** `src/core/prompts/system-prompt/README.md`, `tools/README.md`, `__tests__/README.md`
+
+System prompt is modular: **components** (reusable sections) + **variants** (model-specific configs) + **templates** (with `{{PLACEHOLDER}}` resolution).
+
+**Key directories:**
+- `components/` - Shared sections: `rules.ts`, `capabilities.ts`, `editing_files.ts`, etc.
+- `variants/` - Model-specific: `generic/`, `next-gen/`, `xs/`, `gpt-5/`, `gemini-3/`, `hermes/`, `glm/`, etc.
+- `templates/` - Template engine and placeholder definitions
+
+**Variant tiers (ask user which to modify):**
+- **Next-gen** (Claude 4, GPT-5, Gemini 2.5): `next-gen/`, `native-next-gen/`, `native-gpt-5/`, `native-gpt-5-1/`, `gemini-3/`, `gpt-5/`
+- **Standard** (default fallback): `generic/`
+- **Local/small models**: `xs/`, `hermes/`, `glm/`
+
+**How overrides work:** Variants can override components via `componentOverrides` in their `config.ts`, or provide a custom template in `template.ts` (e.g., `next-gen/template.ts` exports `rules_template`). If no override, the shared component from `components/` is used.
+
+**Example: Adding a rule to RULES section**
+1. Check if variant overrides rules: look for `rules_template` in `variants/*/template.ts` or `componentOverrides.RULES` in `config.ts`
+2. If shared: modify `components/rules.ts`
+3. If overridden: modify that variant's template
+4. XS variant is special—has heavily condensed inline content in `template.ts`
+
+**After any changes, regenerate snapshots:**
+```bash
+UPDATE_SNAPSHOTS=true npm run test:unit
+```
+Snapshots live in `__tests__/__snapshots__/`. Tests validate across model families and context variations (browser, MCP, focus chain).
+
+## Modifying Default Slash Commands
+Three places need updates:
+- `src/core/slash-commands/index.ts` - Command definitions
+- `src/core/prompts/commands.ts` - System prompt integration
+- `webview-ui/src/utils/slash-commands.ts` - Webview autocomplete
+
 ## Adding New Global State Keys
 Adding a new key to global state requires updates in multiple places. Missing any step causes silent failures.
 
@@ -109,7 +151,7 @@ Settings plumbing gotcha: if a key is user-toggleable from settings, wire both c
 Missing one path causes a toggle to appear to change in one surface while the backend state stays unchanged.
 
 Webview toggle gotcha: settings changes must also round-trip back in state payloads.
-- Add the field to `UpdateSettingsRequest` in `proto/cline/state.proto` (for webview update requests), then run `bun run protos`
+- Add the field to `UpdateSettingsRequest` in `proto/cline/state.proto` (for webview update requests), then run `npm run protos`
 - Include the key in `Controller.getStateToPostToWebview()` (`src/core/controller/index.ts`)
 - Ensure `ExtensionState` and webview defaults include the key (`src/shared/ExtensionMessage.ts`, `webview-ui/src/context/ExtensionStateContext.tsx`)
 If this round-trip wiring is missing, the backend value can update but the toggle in webview appears stuck or reverts.
@@ -157,48 +199,3 @@ const isGenerating = explanationInfo.status === "generating" && !wasCancelled
 **See also:** `BrowserSessionRow.tsx` uses similar pattern with `isLastApiReqInterrupted` and `isLastMessageResume`.
 
 **Backend side:** When streaming is cancelled, clean up properly (close tabs, clear comments, etc.) by checking `taskState.abort` after the streaming function returns.
-
-## Debug Harness: clear inherited VSCode/Electron env vars before launching
-
-The debug harness (`apps/vscode/src/dev/debug-harness/server.ts`) launches a child
-VSCode via Playwright's `_electron.launch({ env: { ...process.env, ... } })`. If you
-run the harness from a process that was itself spawned by VSCode (e.g. the Cline
-extension host, an integrated terminal, or an agent running inside VSCode), the
-parent's VSCode/Electron env vars leak into the child and break the launch.
-
-The fatal one is **`ELECTRON_RUN_AS_NODE=1`**: it makes the child VSCode binary run
-as plain Node, so it rejects every VSCode CLI flag. Symptom:
-
-```
-.../Visual Studio Code.app/Contents/MacOS/Code: bad option: --extensionDevelopmentPath=...
-Error: Process failed to launch!   (Playwright _electron.launch)
-```
-
-This is NOT the macOS Playwright flakiness mentioned in the harness README — it's
-env inheritance. Fix: strip the inherited vars before starting the harness:
-
-```bash
-env -u ELECTRON_RUN_AS_NODE -u ELECTRON_NO_ATTACH_CONSOLE \
-    -u VSCODE_CLI -u VSCODE_CODE_CACHE_PATH -u VSCODE_CRASH_REPORTER_PROCESS_TYPE \
-    -u VSCODE_CWD -u VSCODE_ESM_ENTRYPOINT -u VSCODE_HANDLES_UNCAUGHT_ERRORS \
-    -u VSCODE_IPC_HOOK -u VSCODE_NLS_CONFIG -u VSCODE_PID -u VSCODE_L10N_BUNDLE_LOCATION \
-    bun src/dev/debug-harness/server.ts --auto-launch --skip-build
-```
-
-Check your own env with `env | grep -iE 'electron|vscode_'` first; `ELECTRON_RUN_AS_NODE=1`
-present means you must scrub before launching.
-
-Other harness notes confirmed in practice:
-- The extension host is **ESM** (`VSCODE_ESM_ENTRYPOINT`), so `ext.evaluate` has no
-  `require` and module-internal functions aren't reachable as globals. To inspect
-  internal builders (e.g. `buildBedrockProviderConfig`), set a breakpoint with
-  `ext.set_breakpoint` and read locals via `ext.evaluate` with the paused `callFrameId`
-  — don't try to `require()` the bundle.
-- `web.evaluate` wraps the expression as a single returned expression; multi-statement
-  snippets must be an IIFE `(() => { ...; return x; })()`, otherwise you get
-  `SyntaxError: Unexpected token ';'`.
-- Webview settings inputs are `vscode-text-field` web components with debounced React
-  onChange. Setting `.value` + dispatching events via `web.evaluate` is unreliable for
-  some fields; focus the inner shadow `input` then use real keystrokes (`ui.type` +
-  `ui.press Tab`, or click the dropdown option) to make the value persist.
-

.clinerules/protobuf-development.md

@@ -42,7 +42,7 @@ Here, we use the common `StringRequest` and `KeyValuePair` types.
 
 After editing a `.proto` file, regenerate the TypeScript code. From the project root, run:
 ```bash
-bun run protos
+npm run protos
 ```
 This command compiles all `.proto` files and outputs the generated code to `src/generated/` and `src/shared/`. Do not edit these generated files manually.
 

.clinerules/sdk-migration.md

@@ -1,26 +0,0 @@
-# SDK Adapter
-
-The VSCode extension runs on the Cline SDK (`@cline/core`, `@cline/llms`,
-`@cline/shared`) through an adapter layer in `apps/vscode/src/sdk/`. The
-webview still talks gRPC; the adapter translates between gRPC handlers and SDK
-calls. See `apps/vscode/src/dev/debug-harness/README.md` for the debug harness.
-
-## Conventions
-
-1. **Look up SDK APIs, don't guess.** Use `kb_search(name="sdk", query="...")`
-   before implementing against an SDK surface.
-2. **Reference the pre-SDK implementation when replacing a module.** Add a
-   `// Replaces classic src/core/... (see origin/main)` header and use
-   `kb_search(name="cline", commit="origin/main")` or
-   `git show origin/main:path` to consult the prior implementation.
-3. **Single entry point.** There is one codepath — the SDK adapter. No
-   `CLINE_SDK` env flag.
-4. **Use `{appBaseUrl}`**, never hardcode `app.cline.bot`.
-5. **Avoid `as` casts.** Use explicit conversion functions with tests. The
-   branded types in `apps/vscode/src/sdk/model-catalog/contracts.ts` exist so
-   casts are unnecessary outside parse/compute boundaries.
-
-## Debug harness
-
-- **Dismiss the Kanban/promo overlay** before any debug harness interaction.
-- **Use the command palette** to navigate tabs in the debug harness.

.clinerules/workflows/hotfix-release.md

@@ -91,7 +91,7 @@ On the main branch, create a commit that updates:
 
 3. No changelog-entry file cleanup is needed. Contributors do not create changelog-entry files in this repo.
 
-**No dependency install is needed.** A CHANGELOG + `version` bump does not change any dependency, and `bun.lock` does not pin workspace-package versions, so the lockfile stays consistent. The publish workflow runs `bun install --frozen-lockfile`, which would *fail* on an out-of-sync lock — so only run `bun install` here if you actually change dependencies (then commit the updated `bun.lock`).
+**Skip running `npm run install:all`** - release automation handles lockfile consistency as needed.
 
 Commit with message format: `v{VERSION} Release Notes (hotfix)`
 

.github/copilot-instructions.md

@@ -9,14 +9,14 @@ This is a VS Code extension. Read `.clinerules/general.md` for tribal knowledge
 - **MCP**: `src/services/mcp/McpHub.ts`.
 
 ## Build & Test (Critical — non-obvious commands)
-- **Build**: `bun run compile` — NOT `bun run build`.
-- **Watch**: `bun run watch` (extension + webview).
-- **Protos**: `bun run protos` — run **immediately** after any `.proto` change. Generates into `src/shared/proto/`, `src/generated/`.
-- **Tests**: `bun run test:unit`. After prompt/tool changes: `UPDATE_SNAPSHOTS=true bun run test:unit`.
+- **Build**: `npm run compile` — NOT `npm run build`.
+- **Watch**: `npm run watch` (extension + webview).
+- **Protos**: `npm run protos` — run **immediately** after any `.proto` change. Generates into `src/shared/proto/`, `src/generated/`.
+- **Tests**: `npm run test:unit`. After prompt/tool changes: `UPDATE_SNAPSHOTS=true npm run test:unit`.
 
 ## Protobuf RPC Workflow (4 steps)
 1. **Define** in `proto/cline/*.proto`. Naming: `PascalCaseService`, `camelCase` RPCs, `PascalCase` Messages. Use `common.proto` shared types for simple data.
-2. **Generate**: `bun run protos`.
+2. **Generate**: `npm run protos`.
 3. **Backend handler**: `src/core/controller/<domain>/`. 
 4. **Frontend call**: `UiServiceClient.myMethod(Request.create({...}))`.
 - Adding enums (e.g. `ClineSay`) → also update `src/shared/proto-conversions/cline-message.ts`.
@@ -38,7 +38,7 @@ For Responses API providers: add to `isNextGenModelProvider()` in `src/utils/mod
 4. Whitelist in `src/core/prompts/system-prompt/variants/*/config.ts` for each model family.
 5. Handler in `src/core/task/tools/handlers/`, wire in `ToolExecutor.ts`.
 6. If tool has UI: add `ClineSay` enum in proto → `ExtensionMessage.ts` → `cline-message.ts` → `ChatRow.tsx`.
-7. Regenerate snapshots: `UPDATE_SNAPSHOTS=true bun run test:unit`.
+7. Regenerate snapshots: `UPDATE_SNAPSHOTS=true npm run test:unit`.
 
 ## Modifying System Prompt
 Modular: `components/` (shared) + `variants/` (model-specific) + `templates/` (`{{PLACEHOLDER}}`). Variants override components via `componentOverrides` in `config.ts` or custom `template.ts`. XS variant is heavily condensed inline. Always regenerate snapshots after changes.

.github/pull_request_template.md

@@ -59,7 +59,7 @@ We're not looking for exhaustive documentation - just evidence that you've thoug
 <!-- Put an 'x' in all boxes that apply -->
 
 -   [ ] Changes are limited to a single feature, bugfix or chore (split larger changes into separate PRs)
--   [ ] Tests are passing (`bun test`) and code is formatted and linted (`bun run format && bun run lint`)
+-   [ ] Tests are passing (`npm test`) and code is formatted and linted (`npm run format && npm run lint`)
 -   [ ] I have reviewed [contributor guidelines](https://github.com/cline/cline/blob/main/CONTRIBUTING.md)
 
 ### Screenshots

.github/workflows/ext-vscode-publish-nightly.yml

@@ -31,9 +31,6 @@ jobs:
     if: github.repository == 'cline/cline' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/dpc/sdk-migration-simpler-login')
     runs-on: ubuntu-latest
     environment: PublishNightly
-    # The VS Code extension's package.json and lockfiles live under apps/vscode/
-    # (the repo root has no package.json). Mirror ext-vscode-test.yml so install
-    # and publish steps run in the correct workspace.
     defaults:
       run:
         working-directory: apps/vscode
@@ -53,47 +50,21 @@ jobs:
           echo "Building sha: $GITHUB_SHA"
           git --no-pager log -1 --oneline
 
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: 1.3.14
-
-      # Node is still REQUIRED in the publish job (not just for install): the publish
-      # scripts run as `node ./scripts/publish-*.mjs` and shell out to `npx ovsx`.
-      # setup-bun does not provide a Node runtime, so keep setup-node here.
-      # Pinned to Node 22 because newer LTS (Node 24 / npm 11) can make vsce's
-      # `npm list` dependency detection fail with ELSPROBLEMS during packaging.
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
+          # Keep publish environment aligned with test workflow/tooling lockfile expectations.
+          # Newer LTS (Node 24 / npm 11) can make `npm list` fail with ELSPROBLEMS during vsce packaging.
           node-version: 22
 
-      # Single root install resolves the whole bun workspace at once (replaces the
-      # per-package `npm ci` steps for apps/vscode + webview-ui).
-      - name: Install workspace dependencies
+      - name: Install extension dependencies
         working-directory: ${{ github.workspace }}
-        run: bun install --frozen-lockfile
+        run: npm --prefix apps/vscode ci --include=optional
 
-      # @cline/* are local workspace symlinks to source packages; build dist/ before
-      # packaging/publishing the extension.
-      - name: Build SDK packages
+      - name: Install webview-ui dependencies
         working-directory: ${{ github.workspace }}
-        run: bun run build:sdk
+        run: npm --prefix apps/vscode/webview-ui ci --include=optional
 
-      - name: Assert better-sqlite3 native binary present
-        run: |
-          NODE_FILE="node_modules/better-sqlite3/build/Release/better_sqlite3.node"
-          if [ ! -f "$NODE_FILE" ]; then
-            echo "ERROR: better-sqlite3 native binary missing at apps/vscode/$NODE_FILE"
-            echo "(bun trustedDependencies postinstall likely did not run)"
-            exit 1
-          fi
-          echo "Found better-sqlite3 native binary: $NODE_FILE"
-
-      # vsce is now a workspace devDependency (on node_modules/.bin), but ovsx is not
-      # vendored and the publish script invokes it via `npx ovsx`, so install ovsx
-      # globally here (npm is available via setup-node). vsce is installed globally
-      # too to preserve the script's existing PATH expectations.
       - name: Install Publishing Tools
         run: npm install -g @vscode/vsce ovsx
 
@@ -111,9 +82,7 @@ jobs:
           OTEL_EXPORTER_OTLP_PROTOCOL: ${{ secrets.OTEL_EXPORTER_OTLP_PROTOCOL }}
           OTEL_EXPORTER_OTLP_ENDPOINT: ${{ secrets.OTEL_EXPORTER_OTLP_ENDPOINT }}
           OTEL_EXPORTER_OTLP_HEADERS: ${{ secrets.OTEL_EXPORTER_OTLP_HEADERS }}
-        # The script itself runs under `node ./scripts/publish-nightly.mjs`; bun run
-        # just launches it. Node + npm (for `npx ovsx`) are provided by setup-node above.
-        run: bun run publish:marketplace:nightly
+        run: npm run publish:marketplace:nightly
 
       - name: Tag published commit
         working-directory: ${{ github.workspace }}

.github/workflows/ext-vscode-publish-stable.yml

@@ -109,48 +109,19 @@ jobs:
                   echo "tag=$TAG" >> $GITHUB_OUTPUT
                   echo "resolved_sha=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
 
-            - name: Setup Bun
-              uses: oven-sh/setup-bun@v2
-              with:
-                  bun-version: 1.3.14
-
-            # Node is still REQUIRED in the publish job (not just for install): the
-            # publish scripts run as `node scripts/publish-*.mjs`, the version step uses
-            # `node -p`, and `npx ovsx` needs npm. setup-bun does not provide a Node
-            # runtime, so keep setup-node. Pinned to Node 22 because newer LTS
-            # (Node 24 / npm 11) can make vsce's `npm list` detection fail with
-            # ELSPROBLEMS during packaging.
             - name: Setup Node.js
               uses: actions/setup-node@v4
               with:
                   node-version: 22
 
-            # Single root install resolves the whole bun workspace at once (replaces the
-            # per-package `npm install` steps for apps/vscode + webview-ui).
-            - name: Install workspace dependencies
+            - name: Install extension dependencies
               working-directory: ${{ github.workspace }}
-              run: bun install --frozen-lockfile
+              run: npm --prefix apps/vscode install --include=optional
 
-            # @cline/* are local workspace symlinks to source packages; build dist/ before
-            # packaging/publishing the extension.
-            - name: Build SDK packages
+            - name: Install webview-ui dependencies
               working-directory: ${{ github.workspace }}
-              run: bun run build:sdk
+              run: npm --prefix apps/vscode/webview-ui install --include=optional
 
-            - name: Assert better-sqlite3 native binary present
-              run: |
-                  NODE_FILE="node_modules/better-sqlite3/build/Release/better_sqlite3.node"
-                  if [ ! -f "$NODE_FILE" ]; then
-                    echo "ERROR: better-sqlite3 native binary missing at apps/vscode/$NODE_FILE"
-                    echo "(bun trustedDependencies postinstall likely did not run)"
-                    exit 1
-                  fi
-                  echo "Found better-sqlite3 native binary: $NODE_FILE"
-
-            # vsce is a workspace devDependency (on node_modules/.bin), but ovsx is not
-            # vendored and the publish script invokes it via `npx ovsx`, so install ovsx
-            # globally (npm is available via setup-node). vsce is installed globally too
-            # to preserve the script's existing PATH expectations.
             - name: Install Publishing Tools
               run: npm install -g @vscode/vsce ovsx
 
@@ -193,20 +164,14 @@ jobs:
                   node scripts/marketplace-readme.mjs swap-in
                   trap 'node scripts/marketplace-readme.mjs restore' EXIT
 
-                  # Required to generate the .vsix. --no-dependencies: the extension
-                  # is fully esbuild-bundled, and under the bun workspace the @cline/*
-                  # deps are symlinks pointing outside the package, so without this vsce
-                  # would walk them and pull the whole monorepo into the .vsix.
-                  vsce package --no-dependencies --allow-package-secrets sendgrid --out "cline-${{ steps.get_version.outputs.version }}.vsix"
+                  # Required to generate the .vsix
+                  vsce package  --allow-package-secrets sendgrid --out "cline-${{ steps.get_version.outputs.version }}.vsix"
 
-                  # These scripts run under `node scripts/publish-marketplace.mjs`;
-                  # bun run just launches them. Node + npm (for `npx ovsx`) come from
-                  # setup-node above.
                   if [ "$RELEASE_TYPE" = "pre-release" ]; then
-                    bun run publish:marketplace:prerelease
+                    npm run publish:marketplace:prerelease
                     echo "Successfully published pre-release version ${{ steps.get_version.outputs.version }} to VS Code Marketplace and Open VSX Registry"
                   else
-                    bun run publish:marketplace
+                    npm run publish:marketplace
                     echo "Successfully published release version ${{ steps.get_version.outputs.version }} to VS Code Marketplace and Open VSX Registry"
                   fi
 

.github/workflows/ext-vscode-test-e2e.yml

@@ -45,16 +45,12 @@ jobs:
                           - 'apps/vscode/assets/**'
                           - 'apps/vscode/walkthrough/**'
                           - 'apps/vscode/package.json'
-                          - 'apps/vscode/webview-ui/package.json'
-                          # Root bun lockfile is authoritative for the whole workspace (incl. apps/vscode).
-                          - 'bun.lock'
-                          # SDK source packages are local workspace symlinks (@cline/*), so SDK changes affect the build.
-                          - 'sdk/packages/**'
+                          - 'apps/vscode/package-lock.json'
                           - 'apps/vscode/buf.yaml'
                           - 'apps/vscode/tsconfig*.json'
                           - 'apps/vscode/biome.jsonc'
                           - 'apps/vscode/esbuild.mjs'
-                          - 'apps/vscode/bunfig.toml'
+                          - 'apps/vscode/.mocharc.json'
                           - 'apps/vscode/.vscode-test.mjs'
                           - 'apps/vscode/.vscodeignore'
                           - 'apps/vscode/playwright*.ts'
@@ -88,20 +84,26 @@ jobs:
                 working-directory: apps/vscode
         steps:
             - uses: actions/checkout@v4
-            - name: Setup Bun
-              uses: oven-sh/setup-bun@v2
+            - name: Setup Node.js environment
+              uses: actions/setup-node@v4
               with:
-                  bun-version: 1.3.14
+                  node-version: 22
 
-            # Cache Bun's global install cache - keyed on the authoritative root bun.lock.
-            - name: Cache Bun install cache
+            # Cache root dependencies - only reuse if package-lock.json exactly matches
+            - name: Cache root dependencies
               uses: actions/cache@v4
-              id: bun-cache
+              id: root-cache
               with:
-                  path: ~/.bun/install/cache
-                  key: ${{ runner.os }}-bun-${{ hashFiles('bun.lock') }}
-                  restore-keys: |
-                      ${{ runner.os }}-bun-
+                  path: apps/vscode/node_modules
+                  key: ${{ runner.os }}-npm-${{ hashFiles('apps/vscode/package-lock.json') }}
+
+            # Cache webview-ui dependencies - only reuse if package-lock.json exactly matches
+            - name: Cache webview-ui dependencies
+              uses: actions/cache@v4
+              id: webview-cache
+              with:
+                  path: apps/vscode/webview-ui/node_modules
+                  key: ${{ runner.os }}-npm-webview-${{ hashFiles('apps/vscode/webview-ui/package-lock.json') }}
 
             # Cache VS Code installation
             - name: Cache VS Code
@@ -122,41 +124,22 @@ jobs:
                       ~/.cache/ms-playwright
                       ~/Library/Caches/ms-playwright
                       ~/AppData/Local/ms-playwright
-                  key: playwright-browsers-${{ runner.os }}-${{ hashFiles('bun.lock') }}
+                  key: playwright-browsers-${{ runner.os }}-${{ hashFiles('apps/vscode/package-lock.json') }}
                   restore-keys: |
                       playwright-browsers-${{ runner.os }}-
 
-            # Single root install resolves the entire bun workspace at once (replaces
-            # the per-package `npm ci` steps for apps/vscode + webview-ui).
-            - name: Install workspace dependencies
+            - name: Install extension dependencies
               working-directory: ${{ github.workspace }}
-              run: bun install --frozen-lockfile
+              run: npm --prefix apps/vscode ci
               env:
                   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-            # @cline/* are local workspace symlinks to source packages; build dist/
-            # before building/packaging the extension for E2E.
-            - name: Build SDK packages
+            - name: Install webview-ui dependencies
               working-directory: ${{ github.workspace }}
-              run: bun run build:sdk
+              run: npm --prefix apps/vscode/webview-ui ci
 
-            - name: Assert better-sqlite3 native binary present
-              # Force bash: the Windows runner defaults to pwsh, which can't parse this
-              # POSIX test. Git Bash ships on GitHub's windows-latest images.
-              shell: bash
-              run: |
-                  NODE_FILE="node_modules/better-sqlite3/build/Release/better_sqlite3.node"
-                  if [ ! -f "$NODE_FILE" ]; then
-                    echo "ERROR: better-sqlite3 native binary missing at apps/vscode/$NODE_FILE"
-                    echo "(bun trustedDependencies postinstall likely did not run)"
-                    exit 1
-                  fi
-                  echo "Found better-sqlite3 native binary: $NODE_FILE"
-
-            # NOTE: vsce is no longer installed globally. @vscode/vsce is a workspace
-            # devDependency of apps/vscode (resolved into node_modules/.bin), and the
-            # `test:e2e:build` script invokes `vsce` via `bun run`, which puts the local
-            # .bin on PATH. No global install needed.
+            - name: Install vsce
+              run: npm install -g @vscode/vsce
 
             - name: Install xvfb on Linux
               if: matrix.runner == 'ubuntu'
@@ -165,11 +148,11 @@ jobs:
             # Run optimized E2E tests (eliminates redundant builds)
             - name: Run E2E tests - Linux
               if: matrix.runner == 'ubuntu'
-              run: xvfb-run -a bun run test:e2e:optimal
+              run: xvfb-run -a npm run test:e2e:optimal
 
             - name: Run E2E tests - Non-Linux
               if: matrix.runner != 'ubuntu'
-              run: bun run test:e2e:optimal
+              run: npm run test:e2e:optimal
 
             - uses: actions/upload-artifact@v4
               if: ${{ failure() }}

.github/workflows/ext-vscode-test.yml

@@ -45,16 +45,13 @@ jobs:
                           - 'apps/vscode/assets/**'
                           - 'apps/vscode/walkthrough/**'
                           - 'apps/vscode/package.json'
-                          - 'apps/vscode/webview-ui/package.json'
-                          # Root bun lockfile is authoritative for the whole workspace (incl. apps/vscode).
-                          - 'bun.lock'
-                          # SDK source packages are local workspace symlinks (@cline/*), so SDK changes affect the build.
-                          - 'sdk/packages/**'
+                          - 'apps/vscode/package-lock.json'
                           - 'apps/vscode/buf.yaml'
                           - 'apps/vscode/tsconfig*.json'
                           - 'apps/vscode/biome.jsonc'
                           - 'apps/vscode/esbuild.mjs'
-                          - 'apps/vscode/bunfig.toml'
+                          - 'apps/vscode/.mocharc.json'
+                          - 'apps/vscode/.nycrc*.json'
                           - 'apps/vscode/.vscode-test.mjs'
                           - 'apps/vscode/test-setup.js'
                           - '.github/workflows/ext-vscode-test.yml'
@@ -63,13 +60,9 @@ jobs:
                           - 'apps/vscode/proto/**'
                           - 'apps/vscode/standalone/**'
                           - 'apps/vscode/testing-platform/**'
-                          - 'apps/vscode/testing-platform/package.json'
                           - 'apps/vscode/tests/specs/**'
                           - 'apps/vscode/package.json'
-                          # Root bun lockfile is authoritative for the whole workspace (incl. apps/vscode).
-                          - 'bun.lock'
-                          # SDK source packages are local workspace symlinks (@cline/*), so SDK changes affect the build.
-                          - 'sdk/packages/**'
+                          - 'apps/vscode/package-lock.json'
                           - 'apps/vscode/buf.yaml'
                           - 'apps/vscode/tsconfig*.json'
                           - 'apps/vscode/esbuild.mjs'
@@ -89,38 +82,27 @@ jobs:
             - name: Checkout code
               uses: actions/checkout@v4
 
-            - name: Setup Bun
-              uses: oven-sh/setup-bun@v2
+            - name: Setup Node.js environment
+              uses: actions/setup-node@v4
               with:
-                  bun-version: 1.3.14
+                  node-version: 22
+                  cache: 'npm'
+                  cache-dependency-path: |
+                      apps/vscode/package-lock.json
+                      apps/vscode/webview-ui/package-lock.json
 
-            # Single root install resolves the entire bun workspace (apps/vscode,
-            # webview-ui, testing-platform and the @cline/* SDK symlinks) at once,
-            # so the previous per-package `npm ci` steps collapse into one.
-            - name: Install workspace dependencies
+            - name: Install extension dependencies
               working-directory: ${{ github.workspace }}
-              run: bun install --frozen-lockfile
+              run: npm --prefix apps/vscode ci
               env:
                   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-            # @cline/* are local workspace symlinks to source packages; their dist/
-            # output must be built before the extension can type-check/compile.
-            - name: Build SDK packages
+            - name: Install webview-ui dependencies
               working-directory: ${{ github.workspace }}
-              run: bun run build:sdk
-
-            - name: Assert better-sqlite3 native binary present
-              run: |
-                  NODE_FILE="node_modules/better-sqlite3/build/Release/better_sqlite3.node"
-                  if [ ! -f "$NODE_FILE" ]; then
-                    echo "ERROR: better-sqlite3 native binary missing at apps/vscode/$NODE_FILE"
-                    echo "(bun trustedDependencies postinstall likely did not run)"
-                    exit 1
-                  fi
-                  echo "Found better-sqlite3 native binary: $NODE_FILE"
+              run: npm --prefix apps/vscode/webview-ui ci
 
             - name: Run Quality Checks (Parallel)
-              run: bun run ci:check-all
+              run: npm run ci:check-all
 
     vscode-test:
         needs: [detect-changes, quality-checks]
@@ -141,43 +123,30 @@ jobs:
             - name: Checkout code
               uses: actions/checkout@v4
 
-            - name: Setup Bun
-              uses: oven-sh/setup-bun@v2
+            - name: Setup Node.js environment
+              uses: actions/setup-node@v4
               with:
-                  bun-version: 1.3.14
+                  node-version: 22
+                  cache: 'npm'
+                  cache-dependency-path: |
+                      apps/vscode/package-lock.json
+                      apps/vscode/webview-ui/package-lock.json
 
-            # Single root install resolves the entire bun workspace at once (replaces
-            # the per-package `npm ci` steps for apps/vscode + webview-ui).
-            - name: Install workspace dependencies
+            - name: Install extension dependencies
               working-directory: ${{ github.workspace }}
-              run: bun install --frozen-lockfile
+              run: npm --prefix apps/vscode ci
               env:
                   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-            # @cline/* are local workspace symlinks to source packages; build dist/
-            # before compiling/testing the extension.
-            - name: Build SDK packages
+            - name: Install webview-ui dependencies
               working-directory: ${{ github.workspace }}
-              run: bun run build:sdk
+              run: npm --prefix apps/vscode/webview-ui ci
 
-            - name: Assert better-sqlite3 native binary present
+            - name: Set up NPM on Windows
+              if: runner.os == 'Windows'
+              working-directory: ${{ github.workspace }}
               run: |
-                  NODE_FILE="node_modules/better-sqlite3/build/Release/better_sqlite3.node"
-                  if [ ! -f "$NODE_FILE" ]; then
-                    echo "ERROR: better-sqlite3 native binary missing at apps/vscode/$NODE_FILE"
-                    echo "(bun trustedDependencies postinstall likely did not run)"
-                    exit 1
-                  fi
-                  echo "Found better-sqlite3 native binary: $NODE_FILE"
-
-            # NOTE: The old `npm config set script-shell bash` step is intentionally
-            # removed. Scripts are now launched with `bun run`, which uses Bun's own
-            # built-in cross-platform shell rather than npm's configured script-shell,
-            # so that npm-specific Windows workaround no longer applies. Bash-dependent
-            # scripts (e.g. scripts/proto-lint.sh, standalone/runclinecore.sh) are
-            # invoked explicitly via `bash ...` from within the package scripts, and
-            # this job's `defaults.run.shell: bash` (Git Bash on Windows) still covers
-            # the workflow `run:` blocks below.
+                  npm config set script-shell "C:\\Program Files\\Git\\bin\\bash.exe"
 
             - name: Cache VS Code test runtime
               if: runner.os == 'Windows'
@@ -189,51 +158,24 @@ jobs:
             # Build the extension and tests (without redundant checks)
             - name: Build Tests and Extension
               id: build_step
-              run: bun run ci:build
+              run: npm run ci:build
 
-            - name: Vitest Suites (SDK adapter + model catalog)
-              id: vitest_tests
-              if: ${{ !cancelled() && steps.build_step.outcome == 'success' }}
-              # The vitest config sets passWithNoTests: true, so a broken glob/alias
-              # would "pass" with zero tests. Capture output and assert a non-zero
-              # test count to guard against silent skips.
-              run: |
-                  set -o pipefail
-                  bun run test:vitest 2>&1 | tee vitest-output.log
-                  # Strip ANSI color codes before matching — vitest colorizes the
-                  # "Tests  N passed" summary, so the count is not adjacent to the
-                  # "Tests" label in the raw bytes.
-                  if ! sed -r 's/\x1b\[[0-9;]*m//g' vitest-output.log | grep -Eq 'Tests[[:space:]]+[0-9]*[1-9][0-9]* (passed|failed)'; then
-                    echo "ERROR: vitest reported zero tests (possible silent skip)."
-                    exit 1
-                  fi
-
-            - name: Unit Tests (bun) - Linux
+            - name: Unit Tests with coverage - Linux
               id: unit_tests_linux
               if: ${{ !cancelled() && steps.build_step.outcome == 'success' && runner.os == 'Linux' }}
-              # The node-side unit suite (.mocharc spec set) now runs under `bun test`
-              # via scripts/run-bun-unit-tests.ts (one isolated bun process per file).
-              # The runner exits non-zero on any failure and prints a final
-              # "Files: N  Pass: P  Fail: F" summary; assert a non-zero pass count to
-              # guard against an empty glob silently "passing".
               run: |
-                  set -o pipefail
-                  bun run test:unit 2>&1 | tee unit-output.log
-                  if ! grep -Eq 'Pass:[[:space:]]+[0-9]*[1-9][0-9]*' unit-output.log; then
-                    echo "ERROR: bun unit runner reported zero passing tests (possible silent skip)."
-                    exit 1
-                  fi
+                  npx nyc --nycrc-path .nycrc.unit.json --reporter=lcov npm run test:unit
 
-            - name: Unit Tests (bun) - Non-Linux
+            - name: Unit Tests - Non-Linux
               id: unit_tests_non_linux
               if: ${{ !cancelled() && steps.build_step.outcome == 'success' && runner.os != 'Linux' }}
               run: |
-                  bun run test:unit
+                  npm run test:unit
 
             - name: Extension Integration Tests - Linux
               id: integration_tests_linux
               if: ${{ !cancelled() && steps.build_step.outcome == 'success' && runner.os == 'Linux' }}
-              run: xvfb-run -a bun run test:coverage
+              run: xvfb-run -a npm run test:coverage
 
             - name: Extension Integration Tests - Non-Linux
               id: integration_tests_non_linux
@@ -241,7 +183,7 @@ jobs:
               run: |
                   for attempt in 1 2 3; do
                     echo "Running extension integration tests (attempt ${attempt}/3)"
-                    if bun run test:integration; then
+                    if npm run test:integration; then
                       exit 0
                     fi
 
@@ -259,7 +201,7 @@ jobs:
               if: ${{ !cancelled() && steps.build_step.outcome == 'success' }}
               run: |
                   cd webview-ui
-                  bun run test:coverage
+                  npm run test:coverage
 
             - name: Save Coverage Reports
               uses: actions/upload-artifact@v4
@@ -268,6 +210,7 @@ jobs:
               with:
                   name: pr-coverage-reports
                   path: |
+                      apps/vscode/coverage-unit/lcov.info
                       apps/vscode/webview-ui/coverage/lcov.info
 
     test-platform-integration:
@@ -281,45 +224,39 @@ jobs:
             - name: Checkout code
               uses: actions/checkout@v4
 
-            - name: Setup Bun
-              uses: oven-sh/setup-bun@v2
+            - name: Setup Node.js environment
+              uses: actions/setup-node@v4
               with:
-                  bun-version: 1.3.14
+                  node-version: 22
+                  cache: 'npm'
+                  cache-dependency-path: |
+                      apps/vscode/package-lock.json
+                      apps/vscode/webview-ui/package-lock.json
+                      apps/vscode/testing-platform/package-lock.json
 
-            # Single root install resolves the whole bun workspace, including the
-            # testing-platform package, so the separate per-package `npm ci` steps
-            # (extension + webview-ui + testing-platform) collapse into one.
-            - name: Install workspace dependencies
+            - name: Install extension dependencies
               working-directory: ${{ github.workspace }}
-              run: bun install --frozen-lockfile
+              run: npm --prefix apps/vscode ci
               env:
                   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-            # @cline/* are local workspace symlinks to source packages; build dist/
-            # before compiling the standalone core.
-            - name: Build SDK packages
+            - name: Install webview-ui dependencies
               working-directory: ${{ github.workspace }}
-              run: bun run build:sdk
-
-            - name: Assert better-sqlite3 native binary present
-              run: |
-                  NODE_FILE="node_modules/better-sqlite3/build/Release/better_sqlite3.node"
-                  if [ ! -f "$NODE_FILE" ]; then
-                    echo "ERROR: better-sqlite3 native binary missing at apps/vscode/$NODE_FILE"
-                    echo "(bun trustedDependencies postinstall likely did not run)"
-                    exit 1
-                  fi
-                  echo "Found better-sqlite3 native binary: $NODE_FILE"
+              run: npm --prefix apps/vscode/webview-ui ci
 
             - name: Download ripgrep binaries
-              run: bun run download-ripgrep
+              run: npm run download-ripgrep
 
             - name: Compile Standalone
-              run: bun run compile-standalone
+              run: npm run compile-standalone
+
+            - name: Install testing platform dependencies
+              working-directory: ${{ github.workspace }}
+              run: npm --prefix apps/vscode/testing-platform ci
 
             - name: Running testing platform integration spec tests
               timeout-minutes: 7
-              run: bun run test:tp-orchestrator -- tests/specs/ --count=1 --coverage
+              run: npm run test:tp-orchestrator -- tests/specs/ --count=1 --coverage
 
             - name: Save Coverage Reports
               uses: actions/upload-artifact@v4

.gitignore

@@ -13,9 +13,6 @@ tmp
 pnpm-lock.yaml
 
 .clineignore
-.cline/enterprise
-.cline/remote-config
-**/.cline/remote-config
 .venv
 .actrc
 CLAUDE.local.md
@@ -84,4 +81,3 @@ apps/vscode/webview-ui/src/**/*.js.map
 *.db-wal
 .cline/**/managed.json
 .cline/**/bundle.json
-apps/vscode/tsconfig.test.generated.json

.husky/pre-commit

@@ -7,5 +7,4 @@ fi
 
 gitleaks git --pre-commit --redact --staged --verbose || exit 1
 
-cd apps/vscode && bunx lint-staged
-
+lint-staged

.vscode/launch.json

@@ -126,7 +126,10 @@
 				"${workspaceFolder}/apps/vscode/dist-standalone/**/*.js"
 			],
 			"preLaunchTask": "compile-standalone",
-			"runtimeExecutable": "bun",
+			"runtimeExecutable": "npx",
+			"runtimeArgs": [
+				"tsx"
+			],
 			"program": "scripts/test-standalone-core-api-server.ts",
 			"envFile": "${workspaceFolder}/apps/vscode/.env",
 			"env": {
@@ -180,7 +183,7 @@
 			"name": "Open Storybook",
 			"type": "node",
 			"request": "launch",
-			"runtimeExecutable": "bun",
+			"runtimeExecutable": "npm",
 			"runtimeArgs": [
 				"run",
 				"storybook"

.vscode/tasks.json

@@ -6,7 +6,7 @@
 		{
 			"label": "compile-standalone",
 			"type": "shell",
-			"command": "bun run compile-standalone",
+			"command": "npm run compile-standalone",
 			"group": "build",
 			"problemMatcher": [],
 			"presentation": {
@@ -19,7 +19,7 @@
 		{
 			"label": "npm: protos",
 			"type": "shell",
-			"command": "bun run protos",
+			"command": "npm run protos",
 			"problemMatcher": [],
 			"isBackground": false,
 			"presentation": {
@@ -65,7 +65,7 @@
 		},
 		{
 			"type": "shell",
-			"command": "bun run build:webview",
+			"command": "npm run build:webview",
 			"group": "build",
 			"problemMatcher": [],
 			"isBackground": true,
@@ -86,7 +86,7 @@
 		},
 		{
 			"type": "shell",
-			"command": "bun run build:webview:test",
+			"command": "npm run build:webview:test",
 			"group": "build",
 			"problemMatcher": [],
 			"isBackground": true,
@@ -108,7 +108,7 @@
 		},
 		{
 			"type": "shell",
-			"command": "bun run dev:webview",
+			"command": "npm run dev:webview",
 			"group": "build",
 			"problemMatcher": [
 				{
@@ -145,7 +145,7 @@
 		},
 		{
 			"type": "shell",
-			"command": "bun run watch:esbuild",
+			"command": "npm run watch:esbuild",
 			"group": "build",
 			"problemMatcher": {
 				"pattern": [
@@ -184,7 +184,7 @@
 		},
 		{
 			"type": "shell",
-			"command": "bun run watch:esbuild:test",
+			"command": "npm run watch:esbuild:test",
 			"group": "build",
 			"problemMatcher": {
 				"pattern": [
@@ -224,7 +224,7 @@
 		},
 		{
 			"type": "shell",
-			"command": "bun run watch:tsc",
+			"command": "npm run watch:tsc",
 			"group": "build",
 			"problemMatcher": "$tsc-watch",
 			"isBackground": true,
@@ -242,7 +242,7 @@
 		},
 		{
 			"type": "shell",
-			"command": "bun run watch-tests",
+			"command": "npm run watch-tests",
 			"label": "npm: watch-tests",
 			"problemMatcher": "$tsc-watch",
 			"isBackground": true,
@@ -282,7 +282,7 @@
 		},
 		{
 			"type": "shell",
-			"command": "bun run storybook",
+			"command": "npm run storybook",
 			"group": "build",
 			"problemMatcher": [],
 			"isBackground": false,

CLAUDE.md

@@ -0,0 +1,2 @@
+@.clinerules/general.md
+@.clinerules/network.md

CONTRIBUTING.md

@@ -45,7 +45,7 @@ We also welcome contributions to our [documentation](https://github.com/cline/cl
 3. Install [bun](https://bun.com)
 4. Install the necessary dependencies for the extension and webview-gui:
     ```bash
-    cd apps/vscode && bun run install:all && cd ../..
+    cd apps/vscode && npm run install:all && cd ../..
     cd sdk && bun run build && cd ..
     ```
 5. Generate Protocol Buffer files (required before first build):
@@ -61,8 +61,8 @@ We also welcome contributions to our [documentation](https://github.com/cline/cl
 2. Push your branch and create a PR on GitHub. Our CI will:
    - Run tests and checks
 3. Testing
-    - Run `cd apps/vscode && bun run test` to run tests locally. 
-    - Before submitting PR, run `bun run format:fix` to format your code
+    - Run `cd apps/vscode && npm run test` to run tests locally. 
+    - Before submitting PR, run `npm run format:fix` to format your code
 
 ### Extension
 
@@ -74,12 +74,12 @@ We also welcome contributions to our [documentation](https://github.com/cline/cl
 
 2. **Local Development**
     - cd into the vscode extension, `cd apps/vscode`
-    - Run `bun run install:all` to install dependencies
-    - Run `bun run protos` to generate Protocol Buffer files (required before first build)
-    - Run `bun run test` to run tests locally
+    - Run `npm run install:all` to install dependencies
+    - Run `npm run protos` to generate Protocol Buffer files (required before first build)
+    - Run `npm run test` to run tests locally
     - Run → Start Debugging or `>Debug: Select and Start Debugging` and wait for a new VS Code instance to open
-    - **Terminal Workflow**: Use `bun run dev` (generates protos + runs watch mode) or `bun run watch` (if protos already generated)
-    - Before submitting PR, run `bun run format:fix` to format your code
+    - **Terminal Workflow**: Use `npm run dev` (generates protos + runs watch mode) or `npm run watch` (if protos already generated)
+    - Before submitting PR, run `npm run format:fix` to format your code
 
 3. **Linux-specific Setup**
     VS Code extension tests on Linux require the following system libraries:
@@ -135,8 +135,8 @@ Anyone can contribute code to Cline, but we ask that you follow these guidelines
 
 2. **Code Quality**
 
-    - Run `bun run lint` to check code style
-    - Run `bun run format` to automatically format code
+    - Run `npm run lint` to check code style
+    - Run `npm run format` to automatically format code
     - All PRs must pass CI checks which include both linting and formatting
     - Address any warnings or errors from linter before submitting
     - Follow TypeScript best practices and maintain type safety
@@ -144,7 +144,7 @@ Anyone can contribute code to Cline, but we ask that you follow these guidelines
 3. **Testing**
 
     - Add tests for new features
-    - Run `bun test` to ensure all tests pass
+    - Run `npm test` to ensure all tests pass
     - Update existing tests if your changes affect them
     - Include both unit tests and integration tests where appropriate
 
@@ -154,9 +154,9 @@ Anyone can contribute code to Cline, but we ask that you follow these guidelines
     
     - **Running E2E tests:**
       ```bash
-      bun run test:e2e        # Build and run all E2E tests
-      bun run e2e             # Run tests without rebuilding
-      bun run test:e2e -- --debug  # Run with interactive debugger
+      npm run test:e2e        # Build and run all E2E tests
+      npm run e2e             # Run tests without rebuilding
+      npm run test:e2e -- --debug  # Run with interactive debugger
       ```
     
     - **Writing E2E tests:**

apps/cli/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Cline CLI Changelog
 
+## 3.0.29
+
+- Costs are now hidden for Cline free models
+- Fixed Z.ai model metadata resolution for Z.ai models accessed through the Cline provider
+- Reverted the model-name-only display change from v3.0.28; the model picker, selector, and status bar return to their previous display behavior
+
+## 3.0.28
+
+- Added a ClinePass onboarding flow with selectable ClinePass models, plus improved ClinePass error handling
+- Added hub primitive catalogs and refreshed the hub dashboard design with a dedicated customizations breakout
+- Auto-approve toggles now apply immediately when changed
+- Feature flags now resolve using your user ID on startup
+- Fixed Cline model display names so they resolve by model name
+- Truncate large tool results by default (including MCP and custom tool output) to keep requests within context budget
+- Hardened parallel tool-call guidance for faster, more reliable multi-tool execution
+
 ## 3.0.27
 
 - Added a `cline skill` command to install and manage skills, matching `cline plugin install` and `cline mcp` (installs default to the Cline agent directory)

apps/cli/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "@cline/cli",
 	"displayName": "cline",
-	"version": "3.0.27",
+	"version": "3.0.29",
 	"description": "Autonomous coding agent CLI - capable of creating/editing files, running commands, using the browser, and more",
 	"type": "module",
 	"publishConfig": {

apps/cli/src/connectors/catalog.ts

@@ -1,36 +1,2 @@
-export type ConnectorCatalogEntry = {
-	name: string;
-	description: string;
-};
-
-export const CONNECTOR_CATALOG: ConnectorCatalogEntry[] = [
-	{
-		name: "discord",
-		description:
-			"Discord interactions and gateway bridge backed by RPC runtime sessions",
-	},
-	{
-		name: "gchat",
-		description: "Google Chat webhook bridge backed by RPC runtime sessions",
-	},
-	{
-		name: "linear",
-		description: "Linear webhook bridge backed by RPC runtime sessions",
-	},
-	{
-		name: "slack",
-		description: "Slack webhook/socket bridge backed by RPC runtime sessions",
-	},
-	{
-		name: "telegram",
-		description: "Bridge Telegram bot messages into RPC chat sessions",
-	},
-	{
-		name: "whatsapp",
-		description: "Bridge WhatsApp webhook messages into RPC chat sessions",
-	},
-];
-
-export function listConnectorCatalog(): ConnectorCatalogEntry[] {
-	return CONNECTOR_CATALOG.map((entry) => ({ ...entry }));
-}
+export type { ConnectorCatalogEntry } from "@cline/shared";
+export { CONNECTOR_CATALOG, listConnectorCatalog } from "@cline/shared";

apps/cli/src/runtime/run-agent.test.ts

@@ -27,11 +27,25 @@ const outputMocks = vi.hoisted(() => ({
 	c: { dim: "", reset: "" },
 }));
 
+const sessionEventsMocks = vi.hoisted(() => ({
+	listener: undefined as ((event: unknown) => void) | undefined,
+	subscribeToAgentEvents: vi.fn(
+		(_: unknown, listener: (event: unknown) => void) => {
+			sessionEventsMocks.listener = listener;
+			return () => {};
+		},
+	),
+}));
+
 const CLINE_PASS_SUBSCRIPTION_URL =
-	"https://app.cline.bot/dashboard/subscription/";
+	"https://app.cline.bot/dashboard/subscription?personal=true";
 const CLINE_PASS_SUBSCRIPTION_MESSAGE = `No access to ClinePass subscription models yet. Subscribe to ClinePass, the low cost open weights model coding plan: ${CLINE_PASS_SUBSCRIPTION_URL}`;
+const CLINE_ORG_INDIVIDUAL_INFERENCE_SUBSCRIPTION_MESSAGE =
+	"Organization accounts cannot use ClinePass subscriptions. Go to /account -> change account to switch to your personal account for ClinePass";
 
 vi.mock("@cline/core", () => ({
+	getClineOrgIndividualInferenceSubscriptionMessage: () =>
+		CLINE_ORG_INDIVIDUAL_INFERENCE_SUBSCRIPTION_MESSAGE,
 	getClinePassSubscriptionUrl: () => CLINE_PASS_SUBSCRIPTION_URL,
 	isClineNotSubscribedError: (error: unknown) =>
 		error instanceof Error && error.name === "ClineNotSubscribedError",
@@ -39,6 +53,15 @@ vi.mock("@cline/core", () => ({
 		text
 			.toLowerCase()
 			.includes("the user is not subscribed to required model plan"),
+	isClineOrgIndividualInferenceSubscriptionError: (error: unknown) =>
+		error instanceof Error &&
+		error.name === "ClineOrgIndividualInferenceSubscriptionError",
+	isClineOrgIndividualInferenceSubscriptionMessage: (text: string) =>
+		text
+			.toLowerCase()
+			.includes(
+				"organization accounts cannot use individual model inference subscriptions",
+			),
 	prewarmFileIndex: vi.fn(async () => undefined),
 	SessionSource: {
 		CLI: "cli",
@@ -88,7 +111,7 @@ vi.mock("./prompt", () => ({
 }));
 
 vi.mock("./session-events", () => ({
-	subscribeToAgentEvents: vi.fn(() => () => {}),
+	subscribeToAgentEvents: sessionEventsMocks.subscribeToAgentEvents,
 }));
 
 describe("runAgent", () => {
@@ -112,6 +135,9 @@ describe("runAgent", () => {
 		outputMocks.writeln.mockReset();
 		outputMocks.emitJsonLine.mockReset();
 		outputMocks.setActiveCliSession.mockReset();
+		sessionEventsMocks.listener = undefined;
+		sessionEventsMocks.subscribeToAgentEvents.mockClear();
+		vi.unstubAllGlobals();
 	});
 
 	afterEach(() => {
@@ -938,4 +964,121 @@ describe("runAgent", () => {
 			expect.stringContaining("est. cost"),
 		);
 	});
+
+	it("zeros Cline free model costs in JSON results and agent events", async () => {
+		const startedAt = new Date("2026-03-22T00:00:00.000Z");
+		const endedAt = new Date("2026-03-22T00:00:01.000Z");
+		vi.stubGlobal(
+			"fetch",
+			vi.fn(async () => {
+				return new Response(
+					JSON.stringify({
+						free: [{ id: "deepseek/deepseek-v4-flash" }],
+					}),
+					{ status: 200, headers: { "content-type": "application/json" } },
+				);
+			}),
+		);
+		sessionManagerMocks.start.mockResolvedValue({
+			sessionId: "session-1",
+			manifestPath: "/tmp/manifest.json",
+			messagesPath: "/tmp/messages.json",
+			manifest: {
+				session_id: "session-1",
+			},
+			result: {
+				text: "completed text",
+				usage: {
+					inputTokens: 1,
+					outputTokens: 1,
+					cacheReadTokens: 0,
+					cacheWriteTokens: 0,
+					totalCost: 0.25,
+				},
+				messages: [],
+				toolCalls: [],
+				iterations: 1,
+				finishReason: "completed",
+				model: {
+					id: "deepseek/deepseek-v4-flash",
+					provider: "cline",
+					info: {},
+				},
+				startedAt,
+				endedAt,
+				durationMs: 1000,
+			},
+		});
+		sessionManagerMocks.getAccumulatedUsage.mockResolvedValue({
+			usage: {
+				inputTokens: 1,
+				outputTokens: 1,
+				cacheReadTokens: 0,
+				cacheWriteTokens: 0,
+				totalCost: 0.25,
+			},
+			aggregateUsage: {
+				inputTokens: 1,
+				outputTokens: 1,
+				cacheReadTokens: 0,
+				cacheWriteTokens: 0,
+				totalCost: 0.25,
+			},
+		});
+
+		const { runAgent } = await import("./run-agent");
+		const { handleEvent } = await import("../utils/events");
+
+		await expect(
+			runAgent("test prompt", {
+				baseUrl: "https://cline.test/api/v1",
+				cwd: process.cwd(),
+				enableAgentTeams: false,
+				enableSpawnAgent: false,
+				enableTools: [],
+				execution: {
+					maxConsecutiveMistakes: 3,
+				},
+				logger: undefined,
+				mode: "yolo",
+				modelId: "deepseek/deepseek-v4-flash",
+				outputMode: "json",
+				providerId: "cline",
+				systemPrompt: "system",
+				thinking: false,
+				toolPolicies: { "*": { autoApprove: true } },
+				verbose: false,
+				workspaceRoot: process.cwd(),
+			} as never),
+		).resolves.toBeUndefined();
+
+		const runResult = outputMocks.emitJsonLine.mock.calls.find(
+			([, payload]) =>
+				(payload as { type?: string } | undefined)?.type === "run_result",
+		)?.[1] as
+			| {
+					usage?: { totalCost?: number };
+					aggregateUsage?: { totalCost?: number };
+			  }
+			| undefined;
+		expect(runResult?.usage?.totalCost).toBe(0);
+		expect(runResult?.aggregateUsage?.totalCost).toBe(0);
+
+		sessionEventsMocks.listener?.({
+			type: "usage",
+			inputTokens: 1,
+			outputTokens: 1,
+			cost: 0.25,
+			totalCost: 0.25,
+		});
+
+		expect(handleEvent).toHaveBeenLastCalledWith(
+			expect.objectContaining({
+				type: "usage",
+				cost: 0,
+				totalCost: 0,
+			}),
+			expect.any(Object),
+		);
+	});
 });

apps/cli/src/runtime/run-agent.ts

@@ -18,6 +18,11 @@ import {
 } from "../utils/approval";
 import { formatCliErrorMessage } from "../utils/cline-pass-errors";
 import { handleEvent, handleTeamEvent } from "../utils/events";
+import {
+	shouldZeroClineFreeModelCost,
+	zeroCliAgentEventCost,
+	zeroCliUsageCost,
+} from "../utils/free-model-cost";
 import { createRuntimeHooks } from "../utils/hooks";
 import {
 	c,
@@ -184,8 +189,10 @@ export async function runAgent(
 	let reasoningChunkCount = 0;
 	let redactedReasoningChunkCount = 0;
 	const displayedErrorMessages = new Set<string>();
+	const shouldZeroCost = await shouldZeroClineFreeModelCost(config);
 
-	const onAgentEvent = (event: AgentEvent): void => {
+	const onAgentEvent = (rawEvent: AgentEvent): void => {
+		const event = zeroCliAgentEventCost(rawEvent, shouldZeroCost);
 		if (event.type === "content_start" && event.contentType === "reasoning") {
 			reasoningChunkCount += 1;
 			if (event.redacted) {
@@ -339,8 +346,14 @@ export async function runAgent(
 		const usageSummary = await sessionManager.getAccumulatedUsage(
 			started.sessionId,
 		);
-		const aggregateUsage = usageSummary?.aggregateUsage;
-		const usage = aggregateUsage ?? usageSummary?.usage ?? result.usage;
+		const aggregateUsage = zeroCliUsageCost(
+			usageSummary?.aggregateUsage,
+			shouldZeroCost,
+		);
+		const usage = zeroCliUsageCost(
+			aggregateUsage ?? usageSummary?.usage ?? result.usage,
+			shouldZeroCost,
+		);
 
 		if (config.outputMode === "json") {
 			emitJsonLine("stdout", {

apps/cli/src/runtime/run-interactive.ts

@@ -24,6 +24,11 @@ import { disableOpenTuiGraphicsProbe } from "../tui/opentui-env";
 import type { QueuedPromptItem } from "../tui/types";
 import { type ChatCommandState, chatCommandHost } from "../utils/chat-commands";
 import { applyCliCompactionMode } from "../utils/compaction-mode";
+import {
+	shouldZeroClineFreeModelCost,
+	zeroCliAgentEventCost,
+	zeroCliUsageCost,
+} from "../utils/free-model-cost";
 import {
 	prepareTerminalForPostTuiOutput,
 	writeErr,
@@ -153,6 +158,7 @@ export async function runInteractive(
 		askQuestionRef: tuiAskQuestion,
 	});
 	const providerSettingsManager = new ProviderSettingsManager();
+	let zeroCurrentTurnCost = false;
 
 	const sessionRuntime = createInteractiveSessionRuntime({
 		config,
@@ -166,7 +172,7 @@ export async function runInteractive(
 		resolveMistakeLimitDecision,
 		switchToActModeTool,
 		onAgentEvent: (event) => {
-			uiEvents.emit("agent", event);
+			uiEvents.emit("agent", zeroCliAgentEventCost(event, zeroCurrentTurnCost));
 		},
 		onTeamEvent: (event) => {
 			uiEvents.emit("team", event);
@@ -432,6 +438,7 @@ export async function runInteractive(
 		},
 		onSubmit: async (input, mode, delivery, attachments, onCommandOutput) => {
 			let commandOutput: string | undefined;
+			let zeroTurnCost = false;
 			try {
 				await sessionRuntime.ensureReady();
 				await waitForSubmittedMode(mode);
@@ -478,6 +485,8 @@ export async function runInteractive(
 				}
 				input = chatCommandResult.input;
 				commandOutput = chatCommandResult.commandOutput;
+				zeroTurnCost = await shouldZeroClineFreeModelCost(config);
+				zeroCurrentTurnCost = zeroTurnCost;
 				const {
 					prompt: userInput,
 					userImages,
@@ -519,8 +528,9 @@ export async function runInteractive(
 				}
 				if (result.finishReason !== "completed") {
 					if (result.finishReason === "aborted" || isAbortInProgress()) {
-						const usage = await sessionRuntime.getAccumulatedUsage(
-							result.usage,
+						const usage = zeroCliUsageCost(
+							await sessionRuntime.getAccumulatedUsage(result.usage),
+							zeroTurnCost,
 						);
 						return {
 							usage,
@@ -535,7 +545,10 @@ export async function runInteractive(
 						errorText || `Turn finished with ${result.finishReason}`,
 					);
 				}
-				const usage = await sessionRuntime.getAccumulatedUsage(result.usage);
+				const usage = zeroCliUsageCost(
+					await sessionRuntime.getAccumulatedUsage(result.usage),
+					zeroTurnCost,
+				);
 				return {
 					usage,
 					currentContextSize: getCurrentContextSize(result.messages),
@@ -559,6 +572,7 @@ export async function runInteractive(
 				});
 				throw error;
 			} finally {
+				zeroCurrentTurnCost = false;
 				if (!delivery) {
 					isRunning = false;
 					clearAbortInProgress();

apps/cli/src/tests/flags.test.ts

@@ -26,6 +26,7 @@ test.describe("root flag descriptions", () => {
 			"Set reasoning effort level",
 			"consecutive mistakes",
 			"Output messages as JSON",
+			"ACP",
 			"Check for updates and install if available",
 			"Run the kanban app",
 		]);

apps/cli/src/tui/components/chat-entry.tsx

@@ -3,7 +3,9 @@ import type React from "react";
 import { useState } from "react";
 import "opentui-spinner/react";
 import {
+	getClineOrgIndividualInferenceSubscriptionMessage,
 	getClinePassSubscriptionUrl,
+	isClineOrgIndividualInferenceSubscriptionErrorMessage,
 	isClinePassSubscriptionError,
 } from "../../utils/cline-pass-errors";
 import {
@@ -329,6 +331,30 @@ function ClinePassSubscriptionErrorView(props: { defaultFg?: string }) {
 	);
 }
 
+function ClineOrgIndividualInferenceSubscriptionErrorView(props: {
+	defaultFg?: string;
+}) {
+	return (
+		<box flexDirection="row">
+			<text fg="yellow" content="* " />
+			<box
+				flexDirection="column"
+				border
+				borderStyle="rounded"
+				borderColor="yellow"
+				paddingX={1}
+			>
+				<text fg="yellow">Personal ClinePass required</text>
+				<text
+					fg={props.defaultFg}
+					selectable
+					content={getClineOrgIndividualInferenceSubscriptionMessage()}
+				/>
+			</box>
+		</box>
+	);
+}
+
 export function ChatEntryView(props: {
 	entry: ChatEntry;
 	accent?: string;
@@ -427,6 +453,11 @@ export function ChatEntryView(props: {
 			if (isClineAccountCreditsErrorMessage(entry.text)) {
 				return <ClineCreditsErrorView defaultFg={defaultFg} />;
 			}
+			if (isClineOrgIndividualInferenceSubscriptionErrorMessage(entry.text)) {
+				return (
+					<ClineOrgIndividualInferenceSubscriptionErrorView defaultFg={defaultFg} />
+				);
+			}
 			if (isClinePassSubscriptionError(entry.text)) {
 				return <ClinePassSubscriptionErrorView defaultFg={defaultFg} />;
 			}

apps/cli/src/utils/cline-pass-errors.test.ts

@@ -1,7 +1,9 @@
 import { describe, expect, it } from "vitest";
 import {
 	formatCliErrorMessage,
+	getClineOrgIndividualInferenceSubscriptionMessage,
 	getClinePassSubscriptionUrl,
+	isClineOrgIndividualInferenceSubscriptionErrorMessage,
 	isClinePassSubscriptionError,
 } from "./cline-pass-errors";
 
@@ -20,7 +22,23 @@ describe("cline-pass-errors", () => {
 
 	it("formats the ClinePass subscription URL", () => {
 		expect(getClinePassSubscriptionUrl()).toBe(
-			"https://app.cline.bot/dashboard/subscription/",
+			"https://app.cline.bot/dashboard/subscription?personal=true",
 		);
 	});
+
+	it("recognizes and formats organization account individual subscription errors", () => {
+		const raw =
+			"403 Error 403: organization accounts cannot use individual model inference subscriptions";
+		const formatted = getClineOrgIndividualInferenceSubscriptionMessage();
+
+		expect(isClineOrgIndividualInferenceSubscriptionErrorMessage(raw)).toBe(
+			true,
+		);
+		expect(
+			isClineOrgIndividualInferenceSubscriptionErrorMessage(
+				new Error(formatted),
+			),
+		).toBe(true);
+		expect(formatCliErrorMessage(new Error(raw))).toBe(formatted);
+	});
 });

apps/cli/src/utils/cline-pass-errors.ts

@@ -1,10 +1,16 @@
 import {
+	getClineOrgIndividualInferenceSubscriptionMessage,
 	getClinePassSubscriptionUrl,
 	isClineNotSubscribedError,
 	isClineNotSubscribedMessage,
+	isClineOrgIndividualInferenceSubscriptionError,
+	isClineOrgIndividualInferenceSubscriptionMessage,
 } from "@cline/core";
 
-export { getClinePassSubscriptionUrl };
+export {
+	getClineOrgIndividualInferenceSubscriptionMessage,
+	getClinePassSubscriptionUrl,
+};
 
 function isFormattedClinePassSubscriptionMessage(message: string): boolean {
 	const normalized = message.trim().toLowerCase();
@@ -32,7 +38,30 @@ export function isClinePassSubscriptionError(error: unknown): boolean {
 	);
 }
 
+export function isClineOrgIndividualInferenceSubscriptionErrorMessage(
+	error: unknown,
+): boolean {
+	if (isClineOrgIndividualInferenceSubscriptionError(error)) {
+		return true;
+	}
+	if (error instanceof Error) {
+		return (
+			error.name === "ClineOrgIndividualInferenceSubscriptionError" ||
+			isClineOrgIndividualInferenceSubscriptionMessage(error.message) ||
+			error.message === getClineOrgIndividualInferenceSubscriptionMessage()
+		);
+	}
+	return (
+		typeof error === "string" &&
+		(isClineOrgIndividualInferenceSubscriptionMessage(error) ||
+			error === getClineOrgIndividualInferenceSubscriptionMessage())
+	);
+}
+
 export function formatCliErrorMessage(error: unknown): string {
+	if (isClineOrgIndividualInferenceSubscriptionErrorMessage(error)) {
+		return getClineOrgIndividualInferenceSubscriptionMessage();
+	}
 	if (error instanceof Error) {
 		return error.message;
 	}

apps/cli/src/utils/free-model-cost.test.ts

@@ -0,0 +1,162 @@
+import type { AgentEvent } from "@cline/core";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import {
+	clearClineFreeModelCostCache,
+	shouldZeroClineFreeModelCost,
+	zeroCliAgentEventCost,
+	zeroCliUsageCost,
+} from "./free-model-cost";
+
+afterEach(() => {
+	clearClineFreeModelCostCache();
+	vi.unstubAllGlobals();
+});
+
+describe("shouldZeroClineFreeModelCost", () => {
+	it("uses the Cline free model list", async () => {
+		const fetchMock = vi.fn(
+			async (_input: Parameters<typeof fetch>[0], _init?: RequestInit) => {
+				return new Response(
+					JSON.stringify({
+						free: [{ id: "deepseek/deepseek-v4-flash" }],
+					}),
+					{ status: 200, headers: { "content-type": "application/json" } },
+				);
+			},
+		);
+		vi.stubGlobal("fetch", fetchMock);
+
+		await expect(
+			shouldZeroClineFreeModelCost({
+				providerId: "cline",
+				modelId: "deepseek/deepseek-v4-flash",
+				baseUrl: "https://cline.test/api/v1",
+			}),
+		).resolves.toBe(true);
+
+		expect(fetchMock.mock.calls[0]?.[0]).toBe(
+			"https://cline.test/api/v1/ai/cline/recommended-models",
+		);
+	});
+
+	it("does not zero non-Cline providers", async () => {
+		const fetchMock = vi.fn();
+		vi.stubGlobal("fetch", fetchMock);
+
+		await expect(
+			shouldZeroClineFreeModelCost({
+				providerId: "openrouter",
+				modelId: "deepseek/deepseek-v4-flash",
+				baseUrl: "https://cline.test/api/v1",
+			}),
+		).resolves.toBe(false);
+		expect(fetchMock).not.toHaveBeenCalled();
+	});
+
+	it("does not match a paid model by only the final path segment", async () => {
+		vi.stubGlobal(
+			"fetch",
+			vi.fn(async () => {
+				return new Response(
+					JSON.stringify({
+						free: [{ id: "deepseek/deepseek-v4-flash" }],
+					}),
+					{ status: 200, headers: { "content-type": "application/json" } },
+				);
+			}),
+		);
+
+		await expect(
+			shouldZeroClineFreeModelCost({
+				providerId: "cline",
+				modelId: "acme/deepseek-v4-flash",
+				baseUrl: "https://cline.test/api/v1",
+			}),
+		).resolves.toBe(false);
+	});
+
+	it("retries after a failed free model list fetch", async () => {
+		const fetchMock = vi
+			.fn()
+			.mockResolvedValueOnce(new Response("unavailable", { status: 503 }))
+			.mockResolvedValueOnce(
+				new Response(
+					JSON.stringify({
+						free: [{ id: "deepseek/deepseek-v4-flash" }],
+					}),
+					{ status: 200, headers: { "content-type": "application/json" } },
+				),
+			);
+		vi.stubGlobal("fetch", fetchMock);
+
+		await expect(
+			shouldZeroClineFreeModelCost({
+				providerId: "cline",
+				modelId: "deepseek/deepseek-v4-flash",
+				baseUrl: "https://cline.test/api/v1",
+			}),
+		).resolves.toBe(false);
+		await expect(
+			shouldZeroClineFreeModelCost({
+				providerId: "cline",
+				modelId: "deepseek/deepseek-v4-flash",
+				baseUrl: "https://cline.test/api/v1",
+			}),
+		).resolves.toBe(true);
+		expect(fetchMock).toHaveBeenCalledTimes(2);
+	});
+});
+
+describe("zeroCliUsageCost", () => {
+	it("zeros total cost while preserving token usage", () => {
+		expect(
+			zeroCliUsageCost(
+				{
+					inputTokens: 10,
+					outputTokens: 5,
+					totalCost: 0.001,
+				},
+				true,
+			),
+		).toEqual({
+			inputTokens: 10,
+			outputTokens: 5,
+			totalCost: 0,
+		});
+	});
+});
+
+describe("zeroCliAgentEventCost", () => {
+	it("zeros usage event cost fields", () => {
+		const event = {
+			type: "usage",
+			inputTokens: 10,
+			outputTokens: 5,
+			cost: 0.001,
+			totalCost: 0.001,
+		} as AgentEvent;
+
+		expect(zeroCliAgentEventCost(event, true)).toMatchObject({
+			cost: 0,
+			totalCost: 0,
+		});
+	});
+
+	it("zeros done event usage cost", () => {
+		const event = {
+			type: "done",
+			reason: "completed",
+			text: "ok",
+			iterations: 1,
+			usage: {
+				inputTokens: 10,
+				outputTokens: 5,
+				totalCost: 0.001,
+			},
+		} as AgentEvent;
+
+		expect(zeroCliAgentEventCost(event, true)).toMatchObject({
+			usage: { totalCost: 0 },
+		});
+	});
+});

apps/cli/src/utils/free-model-cost.ts

@@ -0,0 +1,123 @@
+import type { AgentEvent } from "@cline/core";
+import { getClineEnvironmentConfig } from "@cline/shared";
+import type { Config } from "./types";
+
+const CLINE_RECOMMENDED_MODELS_TIMEOUT_MS = 5_000;
+const freeModelIdsByBaseUrl = new Map<
+	string,
+	Promise<readonly string[] | undefined>
+>();
+
+function normalizeModelId(modelId: string | undefined): string {
+	return modelId?.trim().toLowerCase() ?? "";
+}
+
+function modelIdsMatch(selectedModelId: string, freeModelId: string): boolean {
+	const selected = normalizeModelId(selectedModelId);
+	const free = normalizeModelId(freeModelId);
+	if (!selected || !free) return false;
+	return selected === free;
+}
+
+function resolveClineRecommendedModelsUrl(baseUrl: string): string {
+	const normalizedBaseUrl = baseUrl.trim().replace(/\/+$/, "");
+	const apiBaseUrl = normalizedBaseUrl.endsWith("/api/v1")
+		? normalizedBaseUrl.slice(0, -"/api/v1".length)
+		: normalizedBaseUrl;
+	return `${apiBaseUrl}/api/v1/ai/cline/recommended-models`;
+}
+
+async function fetchClineFreeModelIds(
+	baseUrl: string,
+): Promise<readonly string[] | undefined> {
+	const controller = new AbortController();
+	const timeout = setTimeout(
+		() => controller.abort(),
+		CLINE_RECOMMENDED_MODELS_TIMEOUT_MS,
+	);
+	try {
+		const response = await fetch(resolveClineRecommendedModelsUrl(baseUrl), {
+			signal: controller.signal,
+		});
+		if (!response.ok) return undefined;
+		const json = (await response.json()) as { free?: unknown };
+		return Array.isArray(json.free)
+			? json.free
+					.map((model) =>
+						model && typeof model === "object"
+							? (model as Record<string, unknown>).id
+							: undefined,
+					)
+					.filter((id): id is string => typeof id === "string" && id.length > 0)
+			: [];
+	} catch {
+		return undefined;
+	} finally {
+		clearTimeout(timeout);
+	}
+}
+
+function getClineFreeModelIds(baseUrl: string): Promise<readonly string[]> {
+	const cacheKey = baseUrl.trim();
+	let cached = freeModelIdsByBaseUrl.get(cacheKey);
+	if (!cached) {
+		cached = fetchClineFreeModelIds(cacheKey).then((ids) => {
+			if (!ids) freeModelIdsByBaseUrl.delete(cacheKey);
+			return ids;
+		});
+		freeModelIdsByBaseUrl.set(cacheKey, cached);
+	}
+	return cached.then((ids) => ids ?? []);
+}
+
+export async function shouldZeroClineFreeModelCost(
+	config: Pick<Config, "providerId" | "modelId" | "baseUrl">,
+): Promise<boolean> {
+	if (config.providerId !== "cline") return false;
+	const modelId = normalizeModelId(config.modelId);
+	if (!modelId) return false;
+
+	const baseUrl =
+		config.baseUrl?.trim() || getClineEnvironmentConfig().apiBaseUrl;
+	const freeModelIds = await getClineFreeModelIds(baseUrl);
+	return freeModelIds.some((freeModelId) =>
+		modelIdsMatch(modelId, freeModelId),
+	);
+}
+
+export function zeroCliUsageCost<T extends { totalCost?: number } | undefined>(
+	usage: T,
+	shouldZeroCost: boolean,
+): T {
+	if (
+		!shouldZeroCost ||
+		!usage ||
+		typeof usage.totalCost !== "number" ||
+		usage.totalCost === 0
+	) {
+		return usage;
+	}
+	return { ...usage, totalCost: 0 } as T;
+}
+
+export function zeroCliAgentEventCost(
+	event: AgentEvent,
+	shouldZeroCost: boolean,
+): AgentEvent {
+	if (!shouldZeroCost) return event;
+	if (event.type === "done" && event.usage) {
+		return {
+			...event,
+			usage: zeroCliUsageCost(event.usage, true),
+		};
+	}
+	if (event.type !== "usage") return event;
+	const next = { ...event } as Record<string, unknown>;
+	if (typeof next.cost === "number") next.cost = 0;
+	if (typeof next.totalCost === "number") next.totalCost = 0;
+	return next as unknown as AgentEvent;
+}
+
+export function clearClineFreeModelCostCache(): void {
+	freeModelIdsByBaseUrl.clear();
+}

apps/cli/src/wizards/connect/platforms.ts

@@ -1,325 +1,16 @@
-export interface PlatformDef {
-	id: string;
-	name: string;
-	type: "polling" | "webhook" | "hybrid";
-	hint: string;
-	fields: FieldDef[];
-	security?: SecurityDef;
-}
+import {
+	CONNECTOR_PLATFORMS,
+	shouldIncludeConnectorField,
+} from "@cline/shared";
 
-export interface FieldDef {
-	flag: string;
-	label: string;
-	placeholder?: string;
-	required?: boolean;
-	help?: string[];
-	initialValue?: string;
-	options?: Array<{ value: string; label: string; hint?: string }>;
-	includeWhen?: FieldCondition;
-}
+export type {
+	ConnectorFieldCondition as FieldCondition,
+	ConnectorFieldDef as FieldDef,
+	ConnectorPlatformDef as PlatformDef,
+	ConnectorSecurityDef as SecurityDef,
+	ConnectorSecurityFieldDef as SecurityFieldDef,
+} from "@cline/shared";
+export { CONNECTOR_PLATFORMS, shouldIncludeConnectorField };
 
-export type FieldCondition = {
-	flag: string;
-	equals?: string;
-	notEquals?: string;
-};
-
-export interface SecurityFieldDef {
-	key: string;
-	label: string;
-	placeholder?: string;
-	help?: string[];
-	requiredMessage: string;
-	validate?: (value: string) => string | undefined;
-}
-
-export interface SecurityDef {
-	prompt: string;
-	fields: SecurityFieldDef[];
-	buildArgs: (values: Record<string, string>) => string[];
-}
-
-export function shouldIncludeField(
-	field: FieldDef,
-	values: Record<string, string>,
-): boolean {
-	const condition = field.includeWhen;
-	if (!condition) {
-		return true;
-	}
-	const value = values[condition.flag] ?? "";
-	if (condition.equals !== undefined && value !== condition.equals) {
-		return false;
-	}
-	if (condition.notEquals !== undefined && value === condition.notEquals) {
-		return false;
-	}
-	return true;
-}
-
-function validateTelegramUserId(value: string): string | undefined {
-	return /^\d+$/.test(value)
-		? undefined
-		: "Telegram user ID must contain digits only";
-}
-
-function validateSlackTeamId(value: string): string | undefined {
-	return /^T[A-Z0-9]+$/.test(value)
-		? undefined
-		: "Slack workspace ID must start with T and contain uppercase letters or digits only";
-}
-
-function validateSlackUserId(value: string): string | undefined {
-	return /^[UW][A-Z0-9]+$/.test(value)
-		? undefined
-		: "Slack member ID must start with U or W and contain uppercase letters or digits only";
-}
-
-export const PLATFORMS: PlatformDef[] = [
-	{
-		id: "telegram",
-		name: "Telegram",
-		type: "polling",
-		hint: "Easiest to set up. No public URL needed.",
-		fields: [
-			{
-				flag: "-k",
-				label: "Bot token",
-				placeholder: "7123456789:AAH...",
-				required: true,
-				help: [
-					"Open Telegram and start a chat with @BotFather",
-					"Send /newbot and follow the prompts",
-					"BotFather gives you this after creating the bot",
-					"It looks like 7123456789:AAHxxx...",
-				],
-			},
-		],
-		security: {
-			prompt:
-				"By default, anyone who finds your bot can message it and run tasks on your machine. Restrict access to your Telegram user ID?",
-			fields: [
-				{
-					key: "userId",
-					label: "Your Telegram user ID",
-					placeholder: "123456789",
-					help: [
-						"Message @userinfobot on Telegram",
-						"It will reply with your numeric user ID",
-					],
-					requiredMessage: "User ID is required to restrict access",
-					validate: validateTelegramUserId,
-				},
-			],
-			buildArgs: ({ userId }) => ["--allowed-user-id", userId ?? ""],
-		},
-	},
-	{
-		id: "slack",
-		name: "Slack",
-		type: "hybrid",
-		hint: "Public URL for webhook mode; leave blank for socket mode.",
-		fields: [
-			{
-				flag: "--bot-token",
-				label: "Bot token",
-				placeholder: "xoxb-...",
-				required: true,
-				help: [
-					"Go to api.slack.com/apps and create a new app",
-					"Add Bot Token Scopes: chat:write, app_mentions:read, channels:history, channels:read, im:history, im:read, im:write, users:read",
-					"Install to workspace and copy the Bot Token",
-				],
-			},
-			{
-				flag: "--base-url",
-				label: "Public base URL",
-				placeholder: "leave blank for socket mode",
-				help: [
-					"Enter a publicly accessible URL for webhook mode",
-					"Leave blank to use Slack socket mode instead",
-				],
-			},
-			{
-				flag: "--signing-secret",
-				label: "Signing secret",
-				required: true,
-				help: ["Found in your app's Basic Information page"],
-				includeWhen: { flag: "--base-url", notEquals: "" },
-			},
-			{
-				flag: "--app-token",
-				label: "App-level token",
-				placeholder: "xapp-...",
-				required: true,
-				help: [
-					"Enable Socket Mode in the Slack app",
-					"Generate an app-level token with the connections:write scope",
-				],
-				includeWhen: { flag: "--base-url", equals: "" },
-			},
-		],
-		security: {
-			prompt: "Restrict which Slack users can interact with the bot?",
-			fields: [
-				{
-					key: "teamId",
-					label: "Allowed Slack workspace ID",
-					placeholder: "T01ABC123",
-					help: [
-						"Open your Slack workspace URL in a browser",
-						"The workspace ID is the segment after /client/, for example T01ABC123",
-					],
-					requiredMessage: "Workspace ID is required to restrict access",
-					validate: validateSlackTeamId,
-				},
-				{
-					key: "userId",
-					label: "Allowed Slack member ID",
-					placeholder: "U01ABC123",
-					help: [
-						"Click a user's name in Slack, then View full profile",
-						"Click ... and Copy member ID",
-					],
-					requiredMessage: "Member ID is required to restrict access",
-					validate: validateSlackUserId,
-				},
-			],
-			buildArgs: ({ teamId, userId }) => [
-				"--hook-command",
-				`jq -r ".payload.actor.participantKey" | grep -qx "slack:team:${teamId}:user:${userId}" && echo '{"action":"allow"}' || echo '{"action":"deny"}'`,
-			],
-		},
-	},
-	{
-		id: "discord",
-		name: "Discord",
-		type: "webhook",
-		hint: "Requires a Discord app and public URL.",
-		fields: [
-			{
-				flag: "--application-id",
-				label: "Application ID",
-				required: true,
-				help: [
-					"Go to discord.com/developers/applications",
-					"Create a new app, copy the Application ID",
-				],
-			},
-			{
-				flag: "--bot-token",
-				label: "Bot token",
-				required: true,
-				help: ["Go to Bot section, create a bot, copy the token"],
-			},
-			{
-				flag: "--public-key",
-				label: "Public key",
-				required: true,
-				help: ["Found in General Information of your app"],
-			},
-			{
-				flag: "--base-url",
-				label: "Public base URL",
-				placeholder: "https://example.com",
-				required: true,
-				help: [
-					"Base URL for the connector",
-					"For Discord, set the Interactions Endpoint URL to <base-url>/api/webhooks/discord",
-				],
-			},
-		],
-	},
-	{
-		id: "whatsapp",
-		name: "WhatsApp",
-		type: "webhook",
-		hint: "Requires Meta developer account and public URL.",
-		fields: [
-			{
-				flag: "--phone-number-id",
-				label: "Phone number ID",
-				required: true,
-				help: ["From your WhatsApp Business account in Meta Developer portal"],
-			},
-			{
-				flag: "--access-token",
-				label: "Access token",
-				required: true,
-				help: ["Generate a permanent token in Meta Developer portal"],
-			},
-			{
-				flag: "--app-secret",
-				label: "App secret",
-				required: true,
-				help: ["Found in App Settings > Basic"],
-			},
-			{
-				flag: "--verify-token",
-				label: "Webhook verify token",
-				placeholder: "my-verify-token",
-				required: true,
-				help: ["Any string you choose, used to verify webhook setup"],
-			},
-			{
-				flag: "--base-url",
-				label: "Public base URL",
-				placeholder: "https://example.com",
-				required: true,
-			},
-		],
-	},
-	{
-		id: "gchat",
-		name: "Google Chat",
-		type: "webhook",
-		hint: "Requires Google Cloud project and public URL.",
-		fields: [
-			{
-				flag: "--credentials-json",
-				label: "Service account credentials JSON",
-				required: true,
-				help: [
-					"Create a service account in Google Cloud Console",
-					"Download the credentials JSON file",
-					"Paste the JSON content here",
-				],
-			},
-			{
-				flag: "--base-url",
-				label: "Public base URL",
-				placeholder: "https://example.com",
-				required: true,
-			},
-		],
-	},
-	{
-		id: "linear",
-		name: "Linear",
-		type: "webhook",
-		hint: "React to Linear issues and comments.",
-		fields: [
-			{
-				flag: "--api-key",
-				label: "API key",
-				required: true,
-				help: ["Go to Linear Settings > API > Personal API keys"],
-			},
-			{
-				flag: "--webhook-secret",
-				label: "Webhook signing secret",
-				required: true,
-				help: [
-					"Go to Settings > API > Webhooks, create one",
-					"Copy the signing secret",
-				],
-			},
-			{
-				flag: "--base-url",
-				label: "Public base URL",
-				placeholder: "https://example.com",
-				required: true,
-			},
-		],
-	},
-];
+export const PLATFORMS = CONNECTOR_PLATFORMS;
+export const shouldIncludeField = shouldIncludeConnectorField;

apps/cli/src/wizards/mcp/settings.test.ts

@@ -57,17 +57,6 @@ describe("MCP wizard settings", () => {
 		expect(Object.keys(parsed.mcpServers ?? {})).toEqual(["added"]);
 	});
 
-	it("creates the settings file when adding a server to a missing path", async () => {
-		const settingsPath = await useTempSettingsPath();
-
-		addServer("added", { type: "stdio", command: "npx", args: ["server"] });
-
-		const parsed = JSON.parse(await readFile(settingsPath, "utf8")) as {
-			mcpServers?: Record<string, unknown>;
-		};
-		expect(Object.keys(parsed.mcpServers ?? {})).toEqual(["added"]);
-	});
-
 	it("parses quoted stdio command arguments", () => {
 		expect(
 			parseStdioCommand('npx -y "@scope/server name" --root "my dir"'),

apps/cli/src/wizards/mcp/settings.ts

@@ -1,9 +1,8 @@
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
 import {
 	type McpServerOAuthState,
-	McpSettingsUpdateSkippedError,
 	resolveDefaultMcpSettingsPath,
-	updateMcpSettingsFileSync,
 } from "@cline/core";
 
 export interface McpServerEntry {
@@ -57,6 +56,28 @@ export function loadServers(): McpServerEntry[] {
 	}
 }
 
+function readRawSettings(): Record<string, unknown> {
+	const path = getSettingsPath();
+	if (!existsSync(path)) return {};
+	try {
+		const raw = readFileSync(path, "utf-8");
+		const parsed = JSON.parse(raw);
+		return parsed && typeof parsed === "object" && !Array.isArray(parsed)
+			? (parsed as Record<string, unknown>)
+			: {};
+	} catch {
+		return {};
+	}
+}
+
+function readRawServers(): Record<string, unknown> {
+	const settings = readRawSettings();
+	const servers = settings.mcpServers;
+	return servers && typeof servers === "object" && !Array.isArray(servers)
+		? { ...(servers as Record<string, unknown>) }
+		: {};
+}
+
 function getOwnServerRecord(
 	servers: Record<string, unknown>,
 	name: string,
@@ -71,85 +92,62 @@ function getOwnServerRecord(
 	return value as Record<string, unknown>;
 }
 
-/**
- * Mutate the MCP settings file through @cline/core's locked read-update-write
- * helper. The mutator must be synchronous and pure; the helper may call it more
- * than once to verify deterministic output. Throw McpSettingsUpdateSkippedError
- * for normal no-op cases instead of returning a boolean that callers can ignore.
- */
-function mutateServers(mutate: (servers: Record<string, unknown>) => void): void {
-	updateMcpSettingsFileSync(getSettingsPath(), (settings) => {
-		const serversValue = settings.mcpServers;
-		const servers = serversValue && typeof serversValue === "object" && !Array.isArray(serversValue)
-			? { ...(serversValue as Record<string, unknown>) }
-			: {};
-		mutate(servers);
-		settings.mcpServers = servers;
-	});
+function writeServers(servers: Record<string, unknown>): void {
+	const path = getSettingsPath();
+	const settings = readRawSettings();
+	mkdirSync(dirname(path), { recursive: true });
+	writeFileSync(
+		path,
+		`${JSON.stringify({ ...settings, mcpServers: servers }, null, 2)}\n`,
+	);
 }
 
 export function addServer(name: string, transport: McpTransport): void {
-	mutateServers((servers) => {
-		servers[name] = { transport };
-	});
+	const servers = readRawServers();
+	servers[name] = { transport };
+	writeServers(servers);
 }
 
 export function removeServer(name: string): boolean {
-	try {
-		mutateServers((servers) => {
-			if (!(name in servers)) {
-				throw new McpSettingsUpdateSkippedError(`MCP server not found: ${name}`);
-			}
-			delete servers[name];
-		});
-		return true;
-	} catch (error) {
-		if (error instanceof McpSettingsUpdateSkippedError) {
-			return false;
-		}
-		throw error;
-	}
+	const servers = readRawServers();
+	if (!(name in servers)) return false;
+	delete servers[name];
+	writeServers(servers);
+	return true;
 }
 
 export function updateServer(name: string, transport: McpTransport): void {
-	mutateServers((servers) => {
-		const existing =
-			servers[name] && typeof servers[name] === "object"
-				? (servers[name] as Record<string, unknown>)
-				: {};
-		servers[name] = { ...existing, transport };
-	});
+	const servers = readRawServers();
+	const existing =
+		servers[name] && typeof servers[name] === "object"
+			? (servers[name] as Record<string, unknown>)
+			: {};
+	servers[name] = { ...existing, transport };
+	writeServers(servers);
 }
 
 export function clearServerOAuth(name: string): void {
-	try {
-		mutateServers((servers) => {
-			const existing = getOwnServerRecord(servers, name);
-			if (!existing) {
-				throw new McpSettingsUpdateSkippedError(`MCP server not found: ${name}`);
-			}
-			delete existing.oauth;
-			servers[name] = existing;
-		});
-	} catch (error) {
-		if (error instanceof McpSettingsUpdateSkippedError) {
-			return;
-		}
-		throw error;
+	const servers = readRawServers();
+	const existing = getOwnServerRecord(servers, name);
+	if (!existing) {
+		return;
 	}
+	delete existing.oauth;
+	servers[name] = existing;
+	writeServers(servers);
 }
 
 export function toggleServer(name: string, disabled: boolean): void {
-	mutateServers((servers) => {
-		const existing =
-			servers[name] && typeof servers[name] === "object"
-				? (servers[name] as Record<string, unknown>)
-				: {};
-		if (disabled) {
-			existing.disabled = true;
-		} else {
-			delete existing.disabled;
-		}
-		servers[name] = existing;
-	});
+	const servers = readRawServers();
+	const existing =
+		servers[name] && typeof servers[name] === "object"
+			? (servers[name] as Record<string, unknown>)
+			: {};
+	if (disabled) {
+		existing.disabled = true;
+	} else {
+		delete existing.disabled;
+	}
+	servers[name] = existing;
+	writeServers(servers);
 }

apps/cline-hub/src/options.ts

@@ -1,3 +1,5 @@
+import { isIP } from "node:net";
+
 export interface ClineHubServerOptions {
 	host: string;
 	port: number;
@@ -47,6 +49,9 @@ function normalizePublicUrl(
 			`PUBLIC_URL must use http: or https:, got ${parsed.protocol}`,
 		);
 	}
+	if (shouldAddDashboardPortToPublicUrl(parsed, port)) {
+		parsed.port = String(port);
+	}
 	parsed.hash = "";
 	return parsed.toString().replace(/\/$/, "");
 }
@@ -85,12 +90,26 @@ export function resolveClineHubServerOptions(
 	};
 }
 
+function isDefaultProtocolPort(url: URL, port: number): boolean {
+	return (
+		(url.protocol === "http:" && port === 80) ||
+		(url.protocol === "https:" && port === 443)
+	);
+}
+
+function shouldAddDashboardPortToPublicUrl(url: URL, port: number): boolean {
+	if (url.port || isDefaultProtocolPort(url, port)) return false;
+	const hostname = url.hostname.replace(/^\[|\]$/g, "");
+	return hostname === "localhost" || isIP(hostname) !== 0;
+}
+
 export function buildInviteUrl(
 	publicUrl: string,
 	roomSecret: string | undefined,
 ): string {
-	if (!roomSecret) return publicUrl;
 	const url = new URL(publicUrl);
-	url.searchParams.set("roomSecret", roomSecret);
+	if (roomSecret) {
+		url.searchParams.set("roomSecret", roomSecret);
+	}
 	return url.toString();
 }

apps/cline-hub/src/server.ts

@@ -4,6 +4,7 @@ import {
 	handleToolApprovalResponse,
 	rejectOrphanedApprovals,
 } from "./server/approvals";
+import { isAuthorizedBrowserToDesktopRequest } from "./server/browser-auth";
 import {
 	browserConfig,
 	host,
@@ -14,7 +15,11 @@ import {
 	webviewDistDir,
 } from "./server/deps";
 import { handleDesktopCommand } from "./server/desktop-commands";
-import { createJsonResponse, WebviewAssets } from "./server/http";
+import {
+	createJsonResponse,
+	isWebviewRoute,
+	WebviewAssets,
+} from "./server/http";
 import {
 	attachHub,
 	detachHub,
@@ -53,17 +58,33 @@ export interface ClineHubDashboardServer {
 	stop: () => Promise<void>;
 }
 
+const PUBLIC_BROWSER_PATHS = new Set([
+	"/version",
+	"/health",
+	"/config.json",
+	"/api/marketplace/catalog",
+	"/icon.png",
+	"/icon.svg",
+	"/icon.ico",
+	"/32x32.png",
+	"/cline-logo-filled.svg",
+	"/favicon.svg",
+]);
+
+function isPublicStaticAssetPath(pathname: string): boolean {
+	return pathname.startsWith("/assets/") || PUBLIC_BROWSER_PATHS.has(pathname);
+}
+
+function isPublicBrowserRoute(_req: Request, url: URL): boolean {
+	return isWebviewRoute(url.pathname) || isPublicStaticAssetPath(url.pathname);
+}
+
 export async function startClineHubDashboardServer(): Promise<ClineHubDashboardServer> {
 	const ctx = new HubContext();
 	const assets = new WebviewAssets(webviewDistDir);
 	const syncClientsAndSessions = () => syncHubClientsAndSessions(ctx);
 	let stopped = false;
 
-	function isAuthorizedBrowserRequest(url: URL): boolean {
-		if (!roomSecret) return true;
-		return url.searchParams.get("roomSecret") === roomSecret;
-	}
-
 	await attachHub(ctx);
 	const healthInterval = setInterval(() => {
 		void (async () => {
@@ -77,6 +98,21 @@ export async function startClineHubDashboardServer(): Promise<ClineHubDashboardS
 		hostname: host,
 		async fetch(req, server) {
 			const url = new URL(req.url);
+			if (
+				!isAuthorizedBrowserToDesktopRequest(
+					req,
+					url,
+					{
+						bindHost: host,
+						port,
+						publicUrl,
+						roomSecret,
+					},
+					isPublicBrowserRoute,
+				)
+			) {
+				return createJsonResponse({ error: "unauthorized_browser" }, 403);
+			}
 			if (url.pathname === "/version") {
 				return createJsonResponse({ coreVersion: CORE_BUILD_VERSION });
 			}
@@ -85,9 +121,6 @@ export async function startClineHubDashboardServer(): Promise<ClineHubDashboardS
 				return createJsonResponse(hubStatusPayload(ctx));
 			}
 			if (url.pathname === "/browser") {
-				if (!isAuthorizedBrowserRequest(url)) {
-					return createJsonResponse({ error: "invalid_room_secret" }, 401);
-				}
 				const displayName = `Browser ${Math.random().toString(36).slice(2, 6)}`;
 				const data = {
 					socket: undefined as never,

apps/cline-hub/src/server/browser-auth.test.ts

@@ -0,0 +1,359 @@
+import { describe, expect, it } from "vitest";
+import {
+	allowedBrowserHosts,
+	allowedBrowserOrigins,
+	isAuthorizedBrowserRequest,
+	isAuthorizedBrowserToDesktopRequest,
+	requiresBrowserRequestAuth,
+} from "./browser-auth";
+
+const defaultOptions = {
+	bindHost: "127.0.0.1",
+	port: 8787,
+	publicUrl: "http://127.0.0.1:8787",
+};
+
+const publicRoute = (_req: Request, url: URL) => url.pathname === "/public";
+
+function browserRequest(
+	origin?: string,
+	init?: Omit<RequestInit, "headers"> & {
+		headers?: Record<string, string>;
+	},
+): Request {
+	return new Request("http://127.0.0.1:8787/browser", {
+		...init,
+		headers: {
+			host: "127.0.0.1:8787",
+			...(origin === undefined ? {} : { origin }),
+			...(init?.headers ?? {}),
+		},
+	});
+}
+
+describe("allowedBrowserOrigins", () => {
+	it("allows the configured public URL origin and local aliases for local binds", () => {
+		expect([...allowedBrowserOrigins(defaultOptions)].sort()).toEqual([
+			"http://127.0.0.1:8787",
+			"http://[::1]:8787",
+			"http://localhost:8787",
+		]);
+	});
+
+	it("uses the configured public URL scheme for local aliases", () => {
+		expect(
+			[
+				...allowedBrowserOrigins({
+					...defaultOptions,
+					publicUrl: "https://127.0.0.1:8787",
+				}),
+			].sort(),
+		).toEqual([
+			"https://127.0.0.1:8787",
+			"https://[::1]:8787",
+			"https://localhost:8787",
+		]);
+	});
+
+	it("omits default protocol ports for local alias origins", () => {
+		expect(
+			[
+				...allowedBrowserOrigins({
+					bindHost: "127.0.0.1",
+					port: 80,
+					publicUrl: "http://localhost",
+				}),
+			].sort(),
+		).toEqual(["http://127.0.0.1", "http://[::1]", "http://localhost"]);
+
+		expect(
+			[
+				...allowedBrowserOrigins({
+					bindHost: "127.0.0.1",
+					port: 443,
+					publicUrl: "https://localhost",
+				}),
+			].sort(),
+		).toEqual(["https://127.0.0.1", "https://[::1]", "https://localhost"]);
+	});
+
+	it("allows the configured public URL origin and explicit bind origin for non-local binds", () => {
+		expect(
+			[
+				...allowedBrowserOrigins({
+					bindHost: "0.0.0.0",
+					port: 8787,
+					publicUrl: "https://example.ngrok-free.app",
+					roomSecret: "secret",
+				}),
+			].sort(),
+		).toEqual(["https://0.0.0.0:8787", "https://example.ngrok-free.app"]);
+	});
+});
+
+describe("allowedBrowserHosts", () => {
+	it("allows the configured public URL host and local aliases for local binds", () => {
+		expect([...allowedBrowserHosts(defaultOptions)].sort()).toEqual([
+			"127.0.0.1:8787",
+			"[::1]:8787",
+			"localhost:8787",
+		]);
+	});
+
+	it("omits default protocol ports for local alias hosts", () => {
+		expect(
+			[
+				...allowedBrowserHosts({
+					bindHost: "127.0.0.1",
+					port: 80,
+					publicUrl: "http://localhost",
+				}),
+			].sort(),
+		).toEqual(["127.0.0.1", "[::1]", "localhost"]);
+
+		expect(
+			[
+				...allowedBrowserHosts({
+					bindHost: "127.0.0.1",
+					port: 443,
+					publicUrl: "https://localhost",
+				}),
+			].sort(),
+		).toEqual(["127.0.0.1", "[::1]", "localhost"]);
+	});
+
+	it("allows the configured public URL host and explicit bind host for non-local binds", () => {
+		expect(
+			[
+				...allowedBrowserHosts({
+					bindHost: "0.0.0.0",
+					port: 8787,
+					publicUrl: "https://example.ngrok-free.app",
+					roomSecret: "secret",
+				}),
+			].sort(),
+		).toEqual(["0.0.0.0:8787", "example.ngrok-free.app"]);
+	});
+});
+
+describe("requiresBrowserRequestAuth", () => {
+	it("does not require browser auth for public GET routes", () => {
+		expect(
+			requiresBrowserRequestAuth(
+				new Request("http://127.0.0.1:8787/public"),
+				new URL("http://127.0.0.1:8787/public"),
+				publicRoute,
+			),
+		).toBe(false);
+	});
+
+	it("requires browser auth for unknown paths even when they use GET", () => {
+		expect(
+			requiresBrowserRequestAuth(
+				new Request("http://127.0.0.1:8787/future-api"),
+				new URL("http://127.0.0.1:8787/future-api"),
+				publicRoute,
+			),
+		).toBe(true);
+	});
+
+	it("requires browser auth for privileged paths even when they use GET", () => {
+		expect(
+			requiresBrowserRequestAuth(
+				new Request("http://127.0.0.1:8787/browser"),
+				new URL("http://127.0.0.1:8787/browser"),
+				publicRoute,
+			),
+		).toBe(true);
+	});
+
+	it("requires browser auth for every WebSocket upgrade path", () => {
+		expect(
+			requiresBrowserRequestAuth(
+				new Request("http://127.0.0.1:8787/future-socket", {
+					headers: { upgrade: "websocket" },
+				}),
+				new URL("http://127.0.0.1:8787/future-socket"),
+				publicRoute,
+			),
+		).toBe(true);
+	});
+
+	it("requires browser auth for every unsafe HTTP method", () => {
+		expect(
+			requiresBrowserRequestAuth(
+				new Request("http://127.0.0.1:8787/future-api", { method: "POST" }),
+				new URL("http://127.0.0.1:8787/future-api"),
+				publicRoute,
+			),
+		).toBe(true);
+	});
+});
+
+describe("isAuthorizedBrowserRequest", () => {
+	it.each([
+		"http://127.0.0.1:8787",
+		"http://localhost:8787",
+		"http://[::1]:8787",
+	])("accepts local dashboard origin %s without a room secret", (origin) => {
+		expect(
+			isAuthorizedBrowserRequest(
+				browserRequest(origin),
+				new URL("http://127.0.0.1:8787/browser"),
+				defaultOptions,
+			),
+		).toBe(true);
+	});
+
+	it.each([
+		undefined,
+		"",
+		"null",
+		"not a url",
+		"http://evil.attacker.example.com",
+		"http://127.0.0.1:9999",
+		"https://127.0.0.1:8787",
+	])("rejects untrusted origin %s", (origin) => {
+		expect(
+			isAuthorizedBrowserRequest(
+				browserRequest(origin),
+				new URL("http://127.0.0.1:8787/browser"),
+				defaultOptions,
+			),
+		).toBe(false);
+	});
+
+	it.each([
+		undefined,
+		"",
+		"evil.attacker.example.com",
+		"127.0.0.1:9999",
+		"localhost:9999",
+	])("rejects untrusted host %s", (host) => {
+		expect(
+			isAuthorizedBrowserRequest(
+				browserRequest("http://127.0.0.1:8787", {
+					headers: host === undefined ? { host: "" } : { host },
+				}),
+				new URL("http://127.0.0.1:8787/browser"),
+				defaultOptions,
+			),
+		).toBe(false);
+	});
+
+	it("allows explicit wildcard bind host and origin when a room secret is configured", () => {
+		expect(
+			isAuthorizedBrowserRequest(
+				browserRequest("http://0.0.0.0:8787", {
+					headers: { host: "0.0.0.0:8787" },
+				}),
+				new URL("http://0.0.0.0:8787/browser?roomSecret=invite-123"),
+				{
+					bindHost: "0.0.0.0",
+					port: 8787,
+					publicUrl: "http://127.0.0.1:8787",
+					roomSecret: "invite-123",
+				},
+			),
+		).toBe(true);
+	});
+
+	it("requires trusted origin, trusted host, and room secret when a room secret is configured", () => {
+		const options = { ...defaultOptions, roomSecret: "invite-123" };
+
+		expect(
+			isAuthorizedBrowserRequest(
+				browserRequest("http://127.0.0.1:8787"),
+				new URL("http://127.0.0.1:8787/browser?roomSecret=invite-123"),
+				options,
+			),
+		).toBe(true);
+		expect(
+			isAuthorizedBrowserRequest(
+				browserRequest("http://127.0.0.1:8787"),
+				new URL("http://127.0.0.1:8787/browser"),
+				options,
+			),
+		).toBe(false);
+		expect(
+			isAuthorizedBrowserRequest(
+				browserRequest("http://evil.attacker.example.com"),
+				new URL("http://127.0.0.1:8787/browser?roomSecret=invite-123"),
+				options,
+			),
+		).toBe(false);
+		expect(
+			isAuthorizedBrowserRequest(
+				browserRequest("http://127.0.0.1:8787", {
+					headers: { host: "evil.attacker.example.com" },
+				}),
+				new URL("http://127.0.0.1:8787/browser?roomSecret=invite-123"),
+				options,
+			),
+		).toBe(false);
+	});
+});
+
+describe("isAuthorizedBrowserToDesktopRequest", () => {
+	it("allows safe public GET routes without an origin", () => {
+		expect(
+			isAuthorizedBrowserToDesktopRequest(
+				new Request("http://127.0.0.1:8787/public"),
+				new URL("http://127.0.0.1:8787/public"),
+				defaultOptions,
+				publicRoute,
+			),
+		).toBe(true);
+	});
+
+	it("rejects future WebSocket paths from untrusted origins by default", () => {
+		expect(
+			isAuthorizedBrowserToDesktopRequest(
+				new Request("http://127.0.0.1:8787/future-socket", {
+					headers: {
+						host: "127.0.0.1:8787",
+						origin: "http://evil.attacker.example.com",
+						upgrade: "websocket",
+					},
+				}),
+				new URL("http://127.0.0.1:8787/future-socket"),
+				defaultOptions,
+				publicRoute,
+			),
+		).toBe(false);
+	});
+
+	it("rejects future unsafe HTTP routes from untrusted origins by default", () => {
+		expect(
+			isAuthorizedBrowserToDesktopRequest(
+				new Request("http://127.0.0.1:8787/future-api", {
+					method: "POST",
+					headers: {
+						host: "127.0.0.1:8787",
+						origin: "http://evil.attacker.example.com",
+					},
+				}),
+				new URL("http://127.0.0.1:8787/future-api"),
+				defaultOptions,
+				publicRoute,
+			),
+		).toBe(false);
+	});
+
+	it("allows future unsafe HTTP routes from trusted origins", () => {
+		expect(
+			isAuthorizedBrowserToDesktopRequest(
+				new Request("http://127.0.0.1:8787/future-api", {
+					method: "POST",
+					headers: {
+						host: "127.0.0.1:8787",
+						origin: "http://127.0.0.1:8787",
+					},
+				}),
+				new URL("http://127.0.0.1:8787/future-api"),
+				defaultOptions,
+				publicRoute,
+			),
+		).toBe(true);
+	});
+});

apps/cline-hub/src/server/browser-auth.ts

@@ -0,0 +1,134 @@
+import { isNonLocalBindHost } from "../options";
+
+export interface BrowserRequestAuthOptions {
+	bindHost: string;
+	port: number;
+	publicUrl: string;
+	roomSecret?: string;
+}
+
+const SAFE_HTTP_METHODS = new Set(["GET", "HEAD", "OPTIONS"]);
+
+export type PublicBrowserRoutePredicate = (req: Request, url: URL) => boolean;
+
+function isWebSocketUpgrade(req: Request): boolean {
+	return req.headers.get("upgrade")?.toLowerCase() === "websocket";
+}
+
+function parseOrigin(value: string | null): string | undefined {
+	const origin = parseHeader(value);
+	try {
+		return new URL(origin ?? "").origin;
+	} catch {
+		return undefined;
+	}
+}
+
+function parseHeader(value: string | null): string | undefined {
+	const host = value?.trim().toLowerCase();
+	return host || undefined;
+}
+
+function formatHostForOrigin(host: string): string {
+	return host.includes(":") && !host.startsWith("[") ? `[${host}]` : host;
+}
+
+function isDefaultProtocolPort(protocol: string, port: number): boolean {
+	return (
+		(protocol === "http:" && port === 80) ||
+		(protocol === "https:" && port === 443)
+	);
+}
+
+function originForHost(protocol: string, host: string, port: number): string {
+	return new URL(`${protocol}//${formatHostForOrigin(host)}:${port}`).origin;
+}
+
+function hostHeaderForHost(
+	protocol: string,
+	host: string,
+	port: number,
+): string {
+	const formattedHost = formatHostForOrigin(host).toLowerCase();
+	return isDefaultProtocolPort(protocol, port)
+		? formattedHost
+		: `${formattedHost}:${port}`;
+}
+
+export function allowedBrowserOrigins({
+	bindHost,
+	port,
+	publicUrl,
+}: BrowserRequestAuthOptions): Set<string> {
+	const publicUrlParts = new URL(publicUrl);
+	const origins = new Set<string>();
+	origins.add(publicUrlParts.origin);
+
+	origins.add(originForHost(publicUrlParts.protocol, bindHost, port));
+
+	if (!isNonLocalBindHost(bindHost)) {
+		for (const hostname of ["127.0.0.1", "localhost", "[::1]"]) {
+			origins.add(originForHost(publicUrlParts.protocol, hostname, port));
+		}
+	}
+
+	return origins;
+}
+
+export function allowedBrowserHosts({
+	bindHost,
+	port,
+	publicUrl,
+}: BrowserRequestAuthOptions): Set<string> {
+	const publicUrlParts = new URL(publicUrl);
+	const hosts = new Set<string>();
+	const publicHost = publicUrlParts.host.toLowerCase();
+	hosts.add(publicHost);
+
+	hosts.add(hostHeaderForHost(publicUrlParts.protocol, bindHost, port));
+
+	if (!isNonLocalBindHost(bindHost)) {
+		for (const hostname of ["127.0.0.1", "localhost", "[::1]"]) {
+			hosts.add(hostHeaderForHost(publicUrlParts.protocol, hostname, port));
+		}
+	}
+
+	return hosts;
+}
+
+export function requiresBrowserRequestAuth(
+	req: Request,
+	url: URL,
+	isPublicBrowserRoute: PublicBrowserRoutePredicate,
+): boolean {
+	if (isWebSocketUpgrade(req)) return true;
+	if (!SAFE_HTTP_METHODS.has(req.method.toUpperCase())) return true;
+	return !isPublicBrowserRoute(req, url);
+}
+
+export function isAuthorizedBrowserRequest(
+	req: Request,
+	url: URL,
+	options: BrowserRequestAuthOptions,
+): boolean {
+	const host = parseHeader(req.headers.get("host"));
+	if (!host || !allowedBrowserHosts(options).has(host)) return false;
+
+	const origin = parseOrigin(req.headers.get("origin"));
+	if (!origin || !allowedBrowserOrigins(options).has(origin)) return false;
+
+	if (!options.roomSecret) return true;
+	return url.searchParams.get("roomSecret") === options.roomSecret;
+}
+
+export function isAuthorizedBrowserToDesktopRequest(
+	req: Request,
+	url: URL,
+	options: BrowserRequestAuthOptions,
+	isPublicBrowserRoute: PublicBrowserRoutePredicate,
+): boolean {
+	return (
+		!requiresBrowserRequestAuth(req, url, isPublicBrowserRoute) ||
+		isAuthorizedBrowserRequest(req, url, options)
+	);
+}

apps/cline-hub/src/server/connectors.test.ts

@@ -0,0 +1,97 @@
+import { describe, expect, it } from "vitest";
+import { __test__ } from "./connectors";
+
+describe("connector launch command", () => {
+	it("uses Bun conditions when launching the source CLI from Bun", () => {
+		expect(
+			__test__.buildCliConnectCommand(["telegram", "--bot-token", "token"], {
+				execPath: "/Users/test/.bun/bin/bun",
+				cliPath: "/repo/apps/cli/src/index.ts",
+				exists: () => true,
+			}),
+		).toEqual({
+			launcher: "/Users/test/.bun/bin/bun",
+			childArgs: [
+				"--conditions=development",
+				"/repo/apps/cli/src/index.ts",
+				"connect",
+				"telegram",
+				"--bot-token",
+				"token",
+			],
+		});
+	});
+
+	it("uses compiled CLI subcommands without Bun flags", () => {
+		expect(
+			__test__.buildCliConnectCommand(["telegram", "--bot-token", "token"], {
+				execPath: "/Applications/Cline/bin/cline",
+				cliPath: "/repo/apps/cli/src/index.ts",
+				exists: () => true,
+			}),
+		).toEqual({
+			launcher: "/Applications/Cline/bin/cline",
+			childArgs: ["connect", "telegram", "--bot-token", "token"],
+		});
+	});
+
+	it("uses Bun conditions when launching the source CLI from Node", () => {
+		expect(
+			__test__.buildCliConnectCommand(["telegram", "--bot-token", "token"], {
+				execPath: "/usr/local/bin/node",
+				cliPath: "/repo/apps/cli/src/index.ts",
+				exists: () => true,
+			}),
+		).toEqual({
+			launcher: "bun",
+			childArgs: [
+				"--conditions=development",
+				"/repo/apps/cli/src/index.ts",
+				"connect",
+				"telegram",
+				"--bot-token",
+				"token",
+			],
+		});
+	});
+
+	it("detects Windows Node when launching the source CLI", () => {
+		expect(
+			__test__.buildCliConnectCommand(["telegram", "--bot-token", "token"], {
+				execPath: "node.exe",
+				cliPath: "C:\\repo\\apps\\cli\\src\\index.ts",
+				exists: () => true,
+			}),
+		).toEqual({
+			launcher: "bun",
+			childArgs: [
+				"--conditions=development",
+				"C:\\repo\\apps\\cli\\src\\index.ts",
+				"connect",
+				"telegram",
+				"--bot-token",
+				"token",
+			],
+		});
+	});
+
+	it("strips terminal color codes from connector command failures", () => {
+		expect(
+			__test__.normalizeConnectorError(
+				"\u001B[31merror:\u001B[0m error: unknown option '--conditions=development'",
+				"connector start failed",
+			),
+		).toBe("unknown option '--conditions=development'");
+	});
+
+	it("turns Telegram unauthorized responses into a token validation message", () => {
+		expect(
+			__test__.normalizeConnectorError(
+				"\u001B[31merror:\u001B[0m Telegram getMe failed (401 Unauthorized): Unauthorized",
+				"connector start failed",
+			),
+		).toBe(
+			"Telegram rejected this bot token. Copy the token from @BotFather and try again.",
+		);
+	});
+});

apps/cline-hub/src/server/connectors.ts

@@ -1,5 +1,8 @@
 import { spawn } from "node:child_process";
+import { existsSync } from "node:fs";
+import { basename } from "node:path";
 import process from "node:process";
+import { withResolvedClineBuildEnv } from "@cline/shared";
 import { listConnectorCatalog } from "../../../cli/src/connectors/catalog";
 import { listActiveConnectors } from "../../../cli/src/connectors/status";
 import {
@@ -13,6 +16,68 @@ import type {
 import { cliIndexPath, workspaceRoot } from "./deps";
 import { asRecord, asString } from "./utils";
 
+type CliConnectCommand = {
+	launcher: string;
+	childArgs: string[];
+};
+
+const ANSI_ESCAPE_PATTERN = new RegExp(
+	[
+		"[\\u001B\\u009B][[\\]()#;?]*",
+		"(?:(?:(?:[a-zA-Z\\d]*(?:;[a-zA-Z\\d]*)*)?\\u0007)",
+		"|(?:(?:\\d{1,4}(?:;\\d{0,4})*)?[\\dA-PR-TZcf-nq-uy=><~]))",
+	].join(""),
+	"g",
+);
+
+function stripAnsi(value: string): string {
+	return value.replace(ANSI_ESCAPE_PATTERN, "");
+}
+
+function normalizeConnectorError(rawMessage: string, fallback: string): string {
+	const message =
+		stripAnsi(rawMessage)
+			.replace(/\r\n/g, "\n")
+			.trim()
+			.replace(/^(?:error:\s*)+/i, "")
+			.trim() || fallback;
+
+	if (
+		/^Telegram getMe failed \(401 Unauthorized\): Unauthorized$/i.test(message)
+	) {
+		return "Telegram rejected this bot token. Copy the token from @BotFather and try again.";
+	}
+
+	return message.slice(0, 2_000);
+}
+
+function buildCliConnectCommand(
+	args: string[],
+	options: {
+		execPath?: string;
+		cliPath?: string;
+		exists?: (path: string) => boolean;
+	} = {},
+): CliConnectCommand {
+	const execPath = options.execPath ?? process.execPath;
+	const cliPath = options.cliPath ?? cliIndexPath;
+	const exists = options.exists ?? existsSync;
+	const runtimeName = basename(execPath).toLowerCase();
+	const isBunRuntime = runtimeName.includes("bun");
+	const isNodeRuntime = runtimeName === "node" || runtimeName === "node.exe";
+	const useBunSourceEntrypoint =
+		(isBunRuntime || isNodeRuntime) && exists(cliPath);
+	const launcher = isBunRuntime
+		? execPath
+		: useBunSourceEntrypoint
+			? "bun"
+			: execPath;
+	const childArgs = useBunSourceEntrypoint
+		? ["--conditions=development", cliPath, "connect", ...args]
+		: ["connect", ...args];
+	return { launcher, childArgs };
+}
+
 export function connectorChannelsPayload(): WebviewConnectorChannelsResponse {
 	const supported = new Set(
 		listConnectorCatalog().map((connector) => connector.name),
@@ -55,23 +120,14 @@ async function runCliConnectCommand(args: string[]): Promise<{
 	stdout: string;
 	stderr: string;
 }> {
-	const launcher = (process.versions as Record<string, string | undefined>).bun
-		? process.execPath
-		: "bun";
-	const child = spawn(
-		launcher,
-		["--conditions=development", cliIndexPath, "connect", ...args],
-		{
-			cwd: workspaceRoot,
-			env: {
-				...process.env,
-				CLINE_BUILD_ENV: process.env.CLINE_BUILD_ENV ?? "development",
-			},
-			stdio: ["ignore", "pipe", "pipe"],
-			// Prevent a console window from flashing on Windows.
-			windowsHide: true,
-		},
-	);
+	const { launcher, childArgs } = buildCliConnectCommand(args);
+	const child = spawn(launcher, childArgs, {
+		cwd: workspaceRoot,
+		env: withResolvedClineBuildEnv(process.env),
+		stdio: ["ignore", "pipe", "pipe"],
+		// Prevent a console window from flashing on Windows.
+		windowsHide: true,
+	});
 	let stdout = "";
 	let stderr = "";
 	child.stdout?.setEncoding("utf8");
@@ -157,9 +213,10 @@ export async function startConnectorChannel(
 	const result = await runCliConnectCommand(cliArgs);
 	if (result.code !== 0) {
 		throw new Error(
-			(result.stderr.trim() || result.stdout.trim() || "connector start failed")
-				.trim()
-				.slice(0, 2_000),
+			normalizeConnectorError(
+				result.stderr || result.stdout,
+				"connector start failed",
+			),
 		);
 	}
 	await waitForConnectorState(() =>
@@ -168,6 +225,11 @@ export async function startConnectorChannel(
 	return connectorChannelsPayload();
 }
 
+export const __test__ = {
+	buildCliConnectCommand,
+	normalizeConnectorError,
+};
+
 export async function stopConnectorChannel(
 	args?: Record<string, unknown>,
 ): Promise<WebviewConnectorChannelsResponse> {
@@ -182,9 +244,10 @@ export async function stopConnectorChannel(
 	const result = await runCliConnectCommand([channel, "--stop"]);
 	if (result.code !== 0) {
 		throw new Error(
-			(result.stderr.trim() || result.stdout.trim() || "connector stop failed")
-				.trim()
-				.slice(0, 2_000),
+			normalizeConnectorError(
+				result.stderr || result.stdout,
+				"connector stop failed",
+			),
 		);
 	}
 	await waitForConnectorState(

apps/cline-hub/src/server/mcp.ts

@@ -1,5 +1,5 @@
-import { existsSync, readFileSync } from "node:fs";
-import { updateMcpSettingsFileSync } from "@cline/core";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
 import { resolveMcpSettingsPath } from "@cline/shared/storage";
 import type { JsonRecord } from "./types";
 
@@ -65,9 +65,9 @@ export function readMcpServersResponse(): JsonRecord {
 }
 
 export function writeMcpServersMap(servers: JsonRecord): void {
-	updateMcpSettingsFileSync(resolveMcpSettingsPath(), (settings) => {
-		settings.mcpServers = servers;
-	});
+	const path = resolveMcpSettingsPath();
+	mkdirSync(dirname(path), { recursive: true });
+	writeFileSync(path, `${JSON.stringify({ mcpServers: servers }, null, 2)}\n`);
 }
 
 export function ensureMcpSettingsFile(): string {
@@ -78,21 +78,23 @@ export function ensureMcpSettingsFile(): string {
 	return path;
 }
 
+function readServersMap(): { path: string; servers: JsonRecord } {
+	const path = ensureMcpSettingsFile();
+	const parsed = JSON.parse(readFileSync(path, "utf8")) as JsonRecord;
+	return { path, servers: (parsed.mcpServers as JsonRecord | undefined) ?? {} };
+}
+
 export function setMcpServerDisabled(
 	name: string,
 	disabled: boolean,
 ): JsonRecord {
-	// Hold the cross-process lock across read-modify-write so a concurrent writer
-	// (the extension, the CLI) cannot clobber this change.
-	updateMcpSettingsFileSync(resolveMcpSettingsPath(), (settings) => {
-		const servers = ((settings.mcpServers as JsonRecord | undefined) ?? {}) as JsonRecord;
-		const current = servers[name];
-		if (!current || typeof current !== "object") {
-			throw new Error(`unknown MCP server: ${name}`);
-		}
-		servers[name] = { ...(current as JsonRecord), disabled };
-		settings.mcpServers = servers;
-	});
+	const { servers } = readServersMap();
+	const current = servers[name];
+	if (!current || typeof current !== "object") {
+		throw new Error(`unknown MCP server: ${name}`);
+	}
+	servers[name] = { ...(current as JsonRecord), disabled };
+	writeMcpServersMap(servers);
 	return readMcpServersResponse();
 }
 
@@ -125,27 +127,19 @@ export function upsertMcpServer(input: JsonRecord): JsonRecord {
 					},
 					disabled: input.disabled === true,
 				};
-	// Hold the cross-process lock across read-modify-write so a concurrent writer
-	// cannot clobber this upsert.
-	updateMcpSettingsFileSync(resolveMcpSettingsPath(), (settings) => {
-		const servers = ((settings.mcpServers as JsonRecord | undefined) ?? {}) as JsonRecord;
-		if (previousName && previousName !== name) {
-			delete servers[previousName];
-		}
-		servers[name] = next;
-		settings.mcpServers = servers;
-	});
+	const { servers } = readServersMap();
+	if (previousName && previousName !== name) {
+		delete servers[previousName];
+	}
+	servers[name] = next;
+	writeMcpServersMap(servers);
 	return readMcpServersResponse();
 }
 
 export function deleteMcpServer(name: string): JsonRecord {
 	if (!name) throw new Error("server name is required");
-	// Hold the cross-process lock across read-modify-write so a concurrent writer
-	// cannot resurrect the deleted server from a stale snapshot.
-	updateMcpSettingsFileSync(resolveMcpSettingsPath(), (settings) => {
-		const servers = ((settings.mcpServers as JsonRecord | undefined) ?? {}) as JsonRecord;
-		delete servers[name];
-		settings.mcpServers = servers;
-	});
+	const { servers } = readServersMap();
+	delete servers[name];
+	writeMcpServersMap(servers);
 	return readMcpServersResponse();
 }

apps/cline-hub/src/validate-options.ts

@@ -41,6 +41,23 @@ expectEqual(
 	"invite URL",
 );
 
+const tailscale = resolveClineHubServerOptions({
+	HOST: "0.0.0.0",
+	CLINE_HUB_DASHBOARD_PORT: "8787",
+	PUBLIC_URL: "http://100.82.5.118",
+	ROOM_SECRET: "invite-123",
+});
+expectEqual(
+	tailscale.publicUrl,
+	"http://100.82.5.118:8787",
+	"direct IP public URL gets dashboard port",
+);
+expectEqual(
+	buildInviteUrl(tailscale.publicUrl, tailscale.roomSecret),
+	"http://100.82.5.118:8787/?roomSecret=invite-123",
+	"invite URL for direct IP public URL",
+);
+
 expectThrows(
 	() => resolveClineHubServerOptions({ HOST: "0.0.0.0" }),
 	"non-local bind without ROOM_SECRET",

apps/cline-hub/src/webview/package.json

@@ -13,10 +13,9 @@
 		"@fontsource-variable/schibsted-grotesk": "^5.2.8",
 		"@radix-ui/react-use-controllable-state": "^1.2.2",
 		"@rive-app/react-webgl2": "^4.27.2",
+		"@shikijs/langs": "^4.2.0",
+		"@shikijs/themes": "^4.2.0",
 		"@streamdown/cjk": "^1.0.3",
-		"@streamdown/code": "^1.1.1",
-		"@streamdown/math": "^1.0.2",
-		"@streamdown/mermaid": "^1.0.2",
 		"@tailwindcss/vite": "^4.2.1",
 		"@xyflow/react": "^12.10.1",
 		"ai": "^6.0.116",
@@ -27,6 +26,7 @@
 		"embla-carousel-react": "^8.6.0",
 		"lucide-react": "^0.577.0",
 		"media-chrome": "^4.18.1",
+		"mermaid": "^11.15.0",
 		"motion": "^12.38.0",
 		"nanoid": "^5.1.7",
 		"next-themes": "^0.4.6",

apps/cline-hub/src/webview/src/App.tsx

@@ -22,7 +22,14 @@ import {
 	WrenchIcon,
 } from "lucide-react";
 import type { ReactNode } from "react";
-import { useCallback, useEffect, useMemo, useState } from "react";
+import {
+	lazy,
+	Suspense,
+	useCallback,
+	useEffect,
+	useMemo,
+	useState,
+} from "react";
 import {
 	AlertDialog,
 	AlertDialogAction,
@@ -53,19 +60,24 @@ import type {
 	WebviewOutboundMessage,
 	WebviewSessionSummary,
 } from "../../webview-protocol";
-import Chat from "./Chat";
 import { PageFrame, PageHeader } from "./components/views/page-layout";
-import {
-	type CustomizationSection,
-	CustomizationSectionView,
-} from "./components/views/settings/extensions-view";
-import {
-	type SettingsSection,
-	SettingsView,
-} from "./components/views/settings/settings-view";
+import type { CustomizationSection } from "./components/views/settings/extensions-view";
+import type { SettingsSection } from "./components/views/settings/settings-view";
 import { syncHubTheme } from "./lib/theme";
 import { postToHost } from "./vscode";
 
+const Chat = lazy(() => import("./Chat"));
+const SettingsView = lazy(() =>
+	import("./components/views/settings/settings-view").then((module) => ({
+		default: module.SettingsView,
+	})),
+);
+const CustomizationSectionView = lazy(() =>
+	import("./components/views/settings/extensions-view").then((module) => ({
+		default: module.CustomizationSectionView,
+	})),
+);
+
 type View =
 	| "home"
 	| "sessions"
@@ -238,6 +250,14 @@ function currentPathWithSearch(): string {
 	return `${window.location.pathname}${window.location.search}`;
 }
 
+function ViewLoading() {
+	return (
+		<PageFrame>
+			<p className="text-sm text-muted-foreground">Loading...</p>
+		</PageFrame>
+	);
+}
+
 function formatRelativeTime(timestamp?: number): string {
 	if (!timestamp) return "unknown";
 	const elapsed = Math.max(0, Date.now() - timestamp);
@@ -1333,7 +1353,7 @@ function App() {
 
 	return (
 		<Shell onNavigate={navigate} version={hubState.coreVersion} view={view}>
-			{content}
+			<Suspense fallback={<ViewLoading />}>{content}</Suspense>
 		</Shell>
 	);
 }

apps/cline-hub/src/webview/src/components/ai-elements/code-block.tsx

@@ -11,12 +11,13 @@ import {
 	useState,
 } from "react";
 import type {
-	BundledLanguage,
-	BundledTheme,
-	HighlighterGeneric,
+	HighlighterCore,
+	LanguageRegistration,
 	ThemedToken,
-} from "shiki";
-import { createHighlighter } from "shiki";
+	ThemeRegistration,
+} from "shiki/core";
+import { createHighlighterCore } from "shiki/core";
+import { createJavaScriptRegexEngine } from "shiki/engine/javascript";
 import { Button } from "@/components/ui/button";
 import {
 	Select,
@@ -36,6 +37,78 @@ const isUnderline = (fontStyle: number | undefined) =>
 	// oxlint-disable-next-line eslint(no-bitwise)
 	fontStyle && fontStyle & 4;
 
+const SUPPORTED_LANGUAGES = [
+	"bash",
+	"css",
+	"diff",
+	"html",
+	"javascript",
+	"json",
+	"jsonc",
+	"jsx",
+	"markdown",
+	"python",
+	"shellscript",
+	"tsx",
+	"typescript",
+	"yaml",
+] as const;
+
+export type SupportedCodeLanguage = (typeof SUPPORTED_LANGUAGES)[number];
+
+const SUPPORTED_LANGUAGE_SET = new Set<string>(SUPPORTED_LANGUAGES);
+
+const LANGUAGE_LOADERS: Record<
+	SupportedCodeLanguage,
+	() => Promise<LanguageRegistration[]>
+> = {
+	bash: () => import("@shikijs/langs/bash").then((module) => module.default),
+	css: () => import("@shikijs/langs/css").then((module) => module.default),
+	diff: () => import("@shikijs/langs/diff").then((module) => module.default),
+	html: () => import("@shikijs/langs/html").then((module) => module.default),
+	javascript: () =>
+		import("@shikijs/langs/javascript").then((module) => module.default),
+	json: () => import("@shikijs/langs/json").then((module) => module.default),
+	jsonc: () => import("@shikijs/langs/jsonc").then((module) => module.default),
+	jsx: () => import("@shikijs/langs/jsx").then((module) => module.default),
+	markdown: () =>
+		import("@shikijs/langs/markdown").then((module) => module.default),
+	python: () =>
+		import("@shikijs/langs/python").then((module) => module.default),
+	shellscript: () =>
+		import("@shikijs/langs/shellscript").then((module) => module.default),
+	tsx: () => import("@shikijs/langs/tsx").then((module) => module.default),
+	typescript: () =>
+		import("@shikijs/langs/typescript").then((module) => module.default),
+	yaml: () => import("@shikijs/langs/yaml").then((module) => module.default),
+};
+
+const LANGUAGE_ALIASES: Record<string, SupportedCodeLanguage> = {
+	console: "shellscript",
+	cjs: "javascript",
+	htm: "html",
+	js: "javascript",
+	json5: "jsonc",
+	md: "markdown",
+	mjs: "javascript",
+	py: "python",
+	sh: "shellscript",
+	shell: "shellscript",
+	ts: "typescript",
+	yml: "yaml",
+};
+
+const normalizeLanguage = (
+	language: string,
+): SupportedCodeLanguage | "text" => {
+	const normalized = language.trim().toLowerCase();
+	if (!normalized) {
+		return "text";
+	}
+	const aliased = LANGUAGE_ALIASES[normalized] ?? normalized;
+	return SUPPORTED_LANGUAGE_SET.has(aliased) ? aliased : "text";
+};
+
 // Transform tokens to include pre-computed keys to avoid noArrayIndexKey lint
 interface KeyedToken {
 	token: ThemedToken;
@@ -108,7 +181,7 @@ const LineSpan = ({
 // Types
 type CodeBlockProps = HTMLAttributes<HTMLDivElement> & {
 	code: string;
-	language: BundledLanguage;
+	language: string;
 	showLineNumbers?: boolean;
 };
 
@@ -128,10 +201,9 @@ const CodeBlockContext = createContext<CodeBlockContextType>({
 });
 
 // Highlighter cache (singleton per language)
-const highlighterCache = new Map<
-	string,
-	Promise<HighlighterGeneric<BundledLanguage, BundledTheme>>
->();
+let highlighterPromise: Promise<HighlighterCore> | undefined;
+let themesPromise: Promise<void> | undefined;
+const languagePromises = new Map<SupportedCodeLanguage, Promise<void>>();
 
 // Token cache
 const tokensCache = new Map<string, TokenizedCode>();
@@ -139,27 +211,44 @@ const tokensCache = new Map<string, TokenizedCode>();
 // Subscribers for async token updates
 const subscribers = new Map<string, Set<(result: TokenizedCode) => void>>();
 
-const getTokensCacheKey = (code: string, language: BundledLanguage) => {
+const getTokensCacheKey = (code: string, language: string) => {
 	const start = code.slice(0, 100);
 	const end = code.length > 100 ? code.slice(-100) : "";
 	return `${language}:${code.length}:${start}:${end}`;
 };
 
-const getHighlighter = (
-	language: BundledLanguage,
-): Promise<HighlighterGeneric<BundledLanguage, BundledTheme>> => {
-	const cached = highlighterCache.get(language);
+const getHighlighter = (): Promise<HighlighterCore> => {
+	if (!highlighterPromise) {
+		highlighterPromise = createHighlighterCore({
+			engine: createJavaScriptRegexEngine({ forgiving: true }),
+		});
+	}
+	return highlighterPromise;
+};
+
+const ensureThemes = (highlighter: HighlighterCore): Promise<void> => {
+	if (!themesPromise) {
+		themesPromise = Promise.all([
+			import("@shikijs/themes/github-light").then((module) => module.default),
+			import("@shikijs/themes/github-dark").then((module) => module.default),
+		]).then((themes: ThemeRegistration[]) => highlighter.loadTheme(...themes));
+	}
+	return themesPromise;
+};
+
+const ensureLanguage = (
+	highlighter: HighlighterCore,
+	language: SupportedCodeLanguage,
+): Promise<void> => {
+	const cached = languagePromises.get(language);
 	if (cached) {
 		return cached;
 	}
-
-	const highlighterPromise = createHighlighter({
-		langs: [language],
-		themes: ["github-light", "github-dark"],
-	});
-
-	highlighterCache.set(language, highlighterPromise);
-	return highlighterPromise;
+	const languagePromise = LANGUAGE_LOADERS[language]().then((registrations) =>
+		highlighter.loadLanguage(...registrations),
+	);
+	languagePromises.set(language, languagePromise);
+	return languagePromise;
 };
 
 // Create raw tokens for immediate display while highlighting loads
@@ -181,11 +270,16 @@ const createRawTokens = (code: string): TokenizedCode => ({
 // Synchronous highlight with callback for async results
 export const highlightCode = (
 	code: string,
-	language: BundledLanguage,
+	language: string,
 	// oxlint-disable-next-line eslint-plugin-promise(prefer-await-to-callbacks)
 	callback?: (result: TokenizedCode) => void,
 ): TokenizedCode | null => {
-	const tokensCacheKey = getTokensCacheKey(code, language);
+	const langToUse = normalizeLanguage(language);
+	if (langToUse === "text") {
+		return createRawTokens(code);
+	}
+
+	const tokensCacheKey = getTokensCacheKey(code, langToUse);
 
 	// Return cached result if available
 	const cached = tokensCache.get(tokensCacheKey);
@@ -202,11 +296,11 @@ export const highlightCode = (
 	}
 
 	// Start highlighting in background - fire-and-forget async pattern
-	getHighlighter(language)
+	getHighlighter()
 		// oxlint-disable-next-line eslint-plugin-promise(prefer-await-to-then)
-		.then((highlighter) => {
-			const availableLangs = highlighter.getLoadedLanguages();
-			const langToUse = availableLangs.includes(language) ? language : "text";
+		.then(async (highlighter) => {
+			await ensureThemes(highlighter);
+			await ensureLanguage(highlighter, langToUse);
 
 			const result = highlighter.codeToTokens(code, {
 				lang: langToUse,
@@ -376,7 +470,7 @@ export const CodeBlockContent = ({
 	showLineNumbers = false,
 }: {
 	code: string;
-	language: BundledLanguage;
+	language: string;
 	showLineNumbers?: boolean;
 }) => {
 	// Memoized raw tokens for immediate display

apps/cline-hub/src/webview/src/components/ai-elements/message.tsx

@@ -1,9 +1,5 @@
 "use client";
 
-import { cjk } from "@streamdown/cjk";
-import { code } from "@streamdown/code";
-import { math } from "@streamdown/math";
-import { mermaid } from "@streamdown/mermaid";
 import type { UIMessage } from "ai";
 import { ChevronLeftIcon, ChevronRightIcon } from "lucide-react";
 import type { ComponentProps, HTMLAttributes, ReactElement } from "react";
@@ -16,7 +12,6 @@ import {
 	useMemo,
 	useState,
 } from "react";
-import { Streamdown } from "streamdown";
 import { Button } from "@/components/ui/button";
 import { ButtonGroup, ButtonGroupText } from "@/components/ui/button-group";
 import {
@@ -26,6 +21,7 @@ import {
 	TooltipTrigger,
 } from "@/components/ui/tooltip";
 import { cn } from "@/lib/utils";
+import { HubStreamdown } from "./streamdown";
 
 export type MessageProps = HTMLAttributes<HTMLDivElement> & {
 	from: UIMessage["role"];
@@ -316,24 +312,18 @@ export const MessageBranchPage = ({
 	);
 };
 
-export type MessageResponseProps = ComponentProps<typeof Streamdown>;
-
-const streamdownPlugins = { cjk, code, math, mermaid };
+export type MessageResponseProps = ComponentProps<typeof HubStreamdown>;
 
 export const MessageResponse = memo(
 	({ className, ...props }: MessageResponseProps) => (
-		<Streamdown
+		<HubStreamdown
 			className={cn(
 				"size-full [&>*:first-child]:mt-0 [&>*:last-child]:mb-0",
 				className,
 			)}
-			plugins={streamdownPlugins}
 			{...props}
 		/>
 	),
-	(prevProps, nextProps) =>
-		prevProps.children === nextProps.children &&
-		nextProps.isAnimating === prevProps.isAnimating,
 );
 
 MessageResponse.displayName = "MessageResponse";

apps/cline-hub/src/webview/src/components/ai-elements/reasoning.tsx

@@ -1,10 +1,6 @@
 "use client";
 
 import { useControllableState } from "@radix-ui/react-use-controllable-state";
-import { cjk } from "@streamdown/cjk";
-import { code } from "@streamdown/code";
-import { math } from "@streamdown/math";
-import { mermaid } from "@streamdown/mermaid";
 import { BrainIcon, ChevronDownIcon } from "lucide-react";
 import type { ComponentProps, ReactNode } from "react";
 import {
@@ -17,7 +13,6 @@ import {
 	useRef,
 	useState,
 } from "react";
-import { Streamdown } from "streamdown";
 import {
 	Collapsible,
 	CollapsibleContent,
@@ -26,6 +21,7 @@ import {
 import { cn } from "@/lib/utils";
 
 import { Shimmer } from "./shimmer";
+import { HubStreamdown } from "./streamdown";
 
 interface ReasoningContextValue {
 	isStreaming: boolean;
@@ -204,8 +200,6 @@ export type ReasoningContentProps = ComponentProps<
 	children: string;
 };
 
-const streamdownPlugins = { cjk, code, math, mermaid };
-
 export const ReasoningContent = memo(
 	({ className, children, ...props }: ReasoningContentProps) => (
 		<CollapsibleContent
@@ -216,7 +210,7 @@ export const ReasoningContent = memo(
 			)}
 			{...props}
 		>
-			<Streamdown plugins={streamdownPlugins}>{children}</Streamdown>
+			<HubStreamdown>{children}</HubStreamdown>
 		</CollapsibleContent>
 	),
 );

apps/cline-hub/src/webview/src/components/ai-elements/streamdown.tsx

@@ -0,0 +1,170 @@
+import { cjk } from "@streamdown/cjk";
+import type { MermaidConfig } from "mermaid";
+import type { ComponentProps, ReactNode } from "react";
+import { isValidElement, memo } from "react";
+import {
+	type Components,
+	type DiagramPlugin,
+	Streamdown,
+	type StreamdownProps,
+} from "streamdown";
+import {
+	CodeBlock,
+	CodeBlockActions,
+	CodeBlockCopyButton,
+	CodeBlockFilename,
+	CodeBlockHeader,
+	CodeBlockTitle,
+} from "@/components/ai-elements/code-block";
+import { cn } from "@/lib/utils";
+
+type MarkdownCodeProps = ComponentProps<"code"> & {
+	"data-block"?: boolean | string;
+	node?: {
+		properties?: {
+			metastring?: string;
+		};
+	};
+};
+
+const LANGUAGE_CLASS_PATTERN = /(?:^|\s)language-([^\s]+)/;
+const START_LINE_PATTERN = /startLine=(\d+)/;
+const NO_LINE_NUMBERS_PATTERN = /\bnoLineNumbers\b/;
+
+function codeText(children: ReactNode): string {
+	if (typeof children === "string" || typeof children === "number") {
+		return String(children);
+	}
+	if (Array.isArray(children)) {
+		return children.map(codeText).join("");
+	}
+	if (isValidElement<{ children?: ReactNode }>(children)) {
+		return codeText(children.props.children);
+	}
+	return "";
+}
+
+const MarkdownCode = ({
+	children,
+	className,
+	node,
+	"data-block": dataBlock,
+	...props
+}: MarkdownCodeProps) => {
+	const language = className?.match(LANGUAGE_CLASS_PATTERN)?.[1] ?? "text";
+
+	if (!dataBlock) {
+		return (
+			<code
+				className={cn(
+					"rounded bg-muted px-1.5 py-0.5 font-mono text-sm",
+					className,
+				)}
+				{...props}
+			>
+				{children}
+			</code>
+		);
+	}
+
+	const meta = node?.properties?.metastring;
+	const startLineMatch = meta?.match(START_LINE_PATTERN);
+	const startLine = startLineMatch ? Number.parseInt(startLineMatch[1], 10) : 1;
+	const showLineNumbers = meta ? !NO_LINE_NUMBERS_PATTERN.test(meta) : true;
+
+	return (
+		<CodeBlock
+			code={codeText(children)}
+			data-start-line={startLine > 1 ? startLine : undefined}
+			language={language}
+			showLineNumbers={showLineNumbers}
+		>
+			<CodeBlockHeader>
+				<CodeBlockTitle>
+					<CodeBlockFilename>{language}</CodeBlockFilename>
+				</CodeBlockTitle>
+				<CodeBlockActions>
+					<CodeBlockCopyButton />
+				</CodeBlockActions>
+			</CodeBlockHeader>
+		</CodeBlock>
+	);
+};
+
+const markdownComponents = {
+	code: MarkdownCode,
+} satisfies Components;
+
+const DEFAULT_MERMAID_CONFIG = {
+	fontFamily: "monospace",
+	securityLevel: "strict",
+	startOnLoad: false,
+	suppressErrorRendering: true,
+	theme: "default",
+} satisfies MermaidConfig;
+
+interface LazyMermaidInstance {
+	initialize: (config: MermaidConfig) => void;
+	render: (
+		id: string,
+		source: string,
+	) => Promise<{
+		svg: string;
+	}>;
+}
+
+function createLazyMermaidPlugin(): DiagramPlugin {
+	let config: MermaidConfig = DEFAULT_MERMAID_CONFIG;
+	let initialized = false;
+
+	const instance: LazyMermaidInstance = {
+		initialize(nextConfig: MermaidConfig) {
+			config = { ...DEFAULT_MERMAID_CONFIG, ...config, ...nextConfig };
+			initialized = false;
+		},
+		async render(id: string, source: string) {
+			const mermaidModule = await import("mermaid");
+			const mermaid = mermaidModule.default;
+			if (!initialized) {
+				mermaid.initialize(config);
+				initialized = true;
+			}
+			return mermaid.render(id, source);
+		},
+	};
+
+	return {
+		getMermaid(nextConfig?: MermaidConfig) {
+			if (nextConfig) {
+				instance.initialize(nextConfig);
+			}
+			return instance;
+		},
+		language: "mermaid",
+		name: "mermaid",
+		type: "diagram",
+	};
+}
+
+const streamdownPlugins = { cjk, mermaid: createLazyMermaidPlugin() };
+
+export type HubStreamdownProps = StreamdownProps;
+
+export const HubStreamdown = memo(
+	({ className, components, ...props }: HubStreamdownProps) => {
+		const mergedComponents = components
+			? { ...markdownComponents, ...components }
+			: markdownComponents;
+
+		return (
+			<Streamdown
+				className={className}
+				components={mergedComponents}
+				plugins={streamdownPlugins}
+				{...props}
+			/>
+		);
+	},
+);
+
+HubStreamdown.displayName = "HubStreamdown";

apps/cline-hub/src/webview/src/components/views/marketplace-view.tsx

@@ -3,6 +3,7 @@ import {
 	Puzzle,
 	Search,
 	Server,
+	Star,
 	Trash2,
 	Zap,
 } from "lucide-react";
@@ -26,6 +27,7 @@ import {
 	type MarketplacePrimitiveType,
 	type MarketplaceTag,
 } from "@/lib/marketplace";
+import { cn } from "@/lib/utils";
 import { CommandBadge, PageFrame, PageHeader } from "./page-layout";
 
 type EntryActionState =
@@ -114,6 +116,13 @@ function entryKey(entry: Pick<MarketplaceEntry, "id" | "type">): string {
 	return `${entry.type}:${entry.id}`;
 }
 
+function compareFeaturedEntries(
+	left: MarketplaceEntry,
+	right: MarketplaceEntry,
+): number {
+	return Number(Boolean(right.featured)) - Number(Boolean(left.featured));
+}
+
 function normalizeMatchValue(value: string): string {
 	return value.trim().toLowerCase();
 }
@@ -257,6 +266,8 @@ function MarketplaceEntryCard({
 	onToggleExpanded,
 	onUninstall,
 	matchedLocalItems = [],
+	showFeatured = true,
+	showTags = true,
 	sourceLabel,
 	tagLabels,
 }: {
@@ -269,6 +280,8 @@ function MarketplaceEntryCard({
 	onToggleExpanded: (entry: MarketplaceEntry) => void;
 	onUninstall: (entry: MarketplaceEntry) => void;
 	matchedLocalItems?: MarketplaceLocalInstalledItem[];
+	showFeatured?: boolean;
+	showTags?: boolean;
 	sourceLabel?: string;
 	tagLabels: Map<string, string>;
 }) {
@@ -299,15 +312,63 @@ function MarketplaceEntryCard({
 				: installed
 					? "Uninstall"
 					: "Install";
+	const statusMessage = inlineMessage ? (
+		<output
+			className={cn(
+				"text-xs",
+				actionState?.status === "failed"
+					? "text-destructive"
+					: "text-muted-foreground",
+			)}
+		>
+			{inlineMessage}
+		</output>
+	) : setupNeeded ? (
+		<span className="text-xs text-amber-700 dark:text-amber-300">
+			Requires setup after install
+		</span>
+	) : null;
+	const actionButton = (
+		<Button
+			disabled={!installedStatusReady || busy}
+			onClick={handleActionClick}
+			size="sm"
+			type="button"
+			variant={installed ? "destructive" : "default"}
+		>
+			{busy || !installedStatusReady ? <Spinner /> : null}
+			{installed && !busy ? <Trash2 className="size-4" /> : null}
+			{actionLabel}
+		</Button>
+	);
 	const content = (
 		<>
+			{!installed ? (
+				<div
+					className="absolute top-4 right-4"
+					data-marketplace-entry-interactive
+				>
+					{actionButton}
+				</div>
+			) : null}
 			<div className="min-w-0">
 				<div className="flex min-w-0 items-start justify-between gap-2">
-					<div className="flex min-w-0 flex-1 items-center gap-3">
+					<div
+						className={cn(
+							"flex min-w-0 flex-1 items-center gap-2",
+							!installed && "pr-24",
+						)}
+					>
 						<EntryIcon className="h-4 w-4 shrink-0 text-primary" />
-						<h2 className="min-w-0 flex-1 truncate text-sm font-semibold text-foreground">
+						<h2 className="min-w-0 truncate text-sm font-semibold text-foreground">
 							{entry.name}
 						</h2>
+						{showFeatured && entry.featured ? (
+							<Badge className="border border-violet-500/20 bg-violet-500/10 text-violet-700 dark:text-violet-300">
+								<Star className="fill-current" />
+								Featured
+							</Badge>
+						) : null}
 					</div>
 					<div className="flex shrink-0 flex-wrap items-center justify-end gap-2">
 						{sourceLabel ? (
@@ -349,23 +410,34 @@ function MarketplaceEntryCard({
 				) : null}
 			</div>
 
-			<p className="line-clamp-2 text-xs leading-5 text-muted-foreground">
-				{entry.description}
-			</p>
+			<div className="flex flex-col gap-3 sm:flex-row sm:items-stretch sm:justify-between">
+				<div className="grid min-w-0 flex-1 gap-2">
+					{showTags && entry.tags.length > 0 ? (
+						<div className="flex flex-wrap gap-1.5">
+							{entry.tags.slice(0, 5).map((tag) => (
+								<Badge
+									key={tag}
+									variant="outline"
+									className="max-w-full text-muted-foreground"
+								>
+									<span className="truncate">{tagLabels.get(tag) ?? tag}</span>
+								</Badge>
+							))}
+						</div>
+					) : null}
 
-			{entry.tags.length > 0 ? (
-				<div className="flex flex-wrap gap-1.5">
-					{entry.tags.slice(0, 5).map((tag) => (
-						<Badge
-							key={tag}
-							variant="outline"
-							className="max-w-full text-muted-foreground"
-						>
-							<span className="truncate">{tagLabels.get(tag) ?? tag}</span>
-						</Badge>
-					))}
+					<p className="line-clamp-2 text-xs leading-5 text-muted-foreground">
+						{entry.description}
+					</p>
+					{statusMessage}
 				</div>
-			) : null}
+
+				{installed ? (
+					<div className="flex shrink-0 flex-col items-start gap-1 sm:items-end sm:justify-end">
+						{actionButton}
+					</div>
+				) : null}
+			</div>
 
 			{matchedLocalItems.some((item) => item.renderMatchedDetails) ? (
 				<div className="grid gap-2" data-marketplace-entry-details>
@@ -377,36 +449,6 @@ function MarketplaceEntryCard({
 				</div>
 			) : null}
 
-			<div className="flex flex-wrap items-center justify-between gap-3">
-				<div className="min-h-5 text-xs text-muted-foreground">
-					{inlineMessage ? (
-						<output
-							className={
-								actionState?.status === "failed"
-									? "text-destructive"
-									: "text-muted-foreground"
-							}
-						>
-							{inlineMessage}
-						</output>
-					) : setupNeeded ? (
-						<span className="text-amber-700 dark:text-amber-300">
-							Requires setup after install
-						</span>
-					) : null}
-				</div>
-				<Button
-					disabled={!installedStatusReady || busy}
-					onClick={handleActionClick}
-					type="button"
-					variant={installed ? "destructive" : "default"}
-				>
-					{busy || !installedStatusReady ? <Spinner /> : null}
-					{installed && !busy ? <Trash2 className="size-4" /> : null}
-					{actionLabel}
-				</Button>
-			</div>
-
 			{expanded && hasExpandableDetails ? (
 				<EntryDetails actionState={actionState} entry={entry} />
 			) : null}
@@ -415,7 +457,7 @@ function MarketplaceEntryCard({
 
 	if (!hasExpandableDetails) {
 		return (
-			<div className="grid gap-3 rounded-lg border bg-card p-4 text-left transition-colors hover:bg-accent/20">
+			<div className="relative grid gap-2 rounded-lg border bg-card p-4 text-left transition-colors hover:bg-accent/20">
 				{content}
 			</div>
 		);
@@ -426,7 +468,7 @@ function MarketplaceEntryCard({
 		<div
 			aria-expanded={expanded}
 			aria-label={`${expanded ? "Collapse" : "Expand"} ${entry.name}`}
-			className="grid cursor-pointer gap-3 rounded-lg border bg-card p-4 text-left transition-colors hover:bg-accent/20 focus-visible:border-ring focus-visible:ring-3 focus-visible:ring-ring/50 focus-visible:outline-none"
+			className="relative grid cursor-pointer gap-2 rounded-lg border bg-card p-4 text-left transition-colors hover:bg-accent/20 focus-visible:border-ring focus-visible:ring-3 focus-visible:ring-ring/50 focus-visible:outline-none"
 			onClick={(event) => {
 				if (
 					event.target instanceof HTMLElement &&
@@ -487,6 +529,7 @@ function MarketplaceSection({
 	emptyMessage,
 	entries,
 	expandedEntryKey,
+	headerContent,
 	installedEntryKeys,
 	installedStatusReady,
 	localOnlyInstalledItems = [],
@@ -494,6 +537,8 @@ function MarketplaceSection({
 	onInstall,
 	onToggleExpanded,
 	onUninstall,
+	showFeaturedBadges = true,
+	showEntryTags = true,
 	sourceLabel,
 	tagLabels,
 	title,
@@ -502,6 +547,7 @@ function MarketplaceSection({
 	emptyMessage: string;
 	entries: MarketplaceEntry[];
 	expandedEntryKey: string | null;
+	headerContent?: ReactNode;
 	installedEntryKeys: Set<string>;
 	installedStatusReady: boolean;
 	localOnlyInstalledItems?: MarketplaceLocalInstalledItem[];
@@ -509,6 +555,8 @@ function MarketplaceSection({
 	onInstall: (entry: MarketplaceEntry) => void;
 	onToggleExpanded: (entry: MarketplaceEntry) => void;
 	onUninstall: (entry: MarketplaceEntry) => void;
+	showFeaturedBadges?: boolean;
+	showEntryTags?: boolean;
 	sourceLabel?: string;
 	tagLabels: Map<string, string>;
 	title: string;
@@ -520,6 +568,7 @@ function MarketplaceSection({
 				<h2 className="text-base font-semibold text-foreground">{title}</h2>
 				<span className="text-sm text-muted-foreground">{totalCount}</span>
 			</div>
+			{headerContent}
 			{totalCount > 0 ? (
 				<div className="grid gap-3">
 					{localOnlyInstalledItems.map((item) => item.render())}
@@ -537,6 +586,8 @@ function MarketplaceSection({
 								onToggleExpanded={onToggleExpanded}
 								onUninstall={onUninstall}
 								matchedLocalItems={matchedLocalItemsByEntryKey?.get(key) ?? []}
+								showFeatured={showFeaturedBadges}
+								showTags={showEntryTags}
 								sourceLabel={sourceLabel}
 								tagLabels={tagLabels}
 							/>
@@ -626,19 +677,48 @@ export function MarketplaceView({
 	);
 
 	const primitiveEntries = useMemo(
-		() => catalog?.entries.filter((entry) => entry.type === primitive) ?? [],
+		() =>
+			(catalog?.entries.filter((entry) => entry.type === primitive) ?? []).sort(
+				compareFeaturedEntries,
+			),
 		[catalog?.entries, primitive],
 	);
 
+	const queryFilteredEntries = useMemo(() => {
+		const normalizedQuery = query.trim().toLowerCase();
+		return primitiveEntries.filter((entry) => {
+			return (
+				normalizedQuery.length === 0 ||
+				entrySearchText(entry, tagLabels).includes(normalizedQuery)
+			);
+		});
+	}, [primitiveEntries, query, tagLabels]);
+
+	const installedEntries = useMemo(
+		() =>
+			queryFilteredEntries.filter((entry) =>
+				installedEntryKeys.has(entryKey(entry)),
+			),
+		[queryFilteredEntries, installedEntryKeys],
+	);
+
+	const marketplaceEntriesBeforeTag = useMemo(
+		() =>
+			queryFilteredEntries.filter(
+				(entry) => !installedEntryKeys.has(entryKey(entry)),
+			),
+		[queryFilteredEntries, installedEntryKeys],
+	);
+
 	const tagCounts = useMemo(() => {
 		const counts = new Map<string, number>();
-		for (const entry of primitiveEntries) {
+		for (const entry of marketplaceEntriesBeforeTag) {
 			for (const tag of entry.tags) {
 				counts.set(tag, (counts.get(tag) ?? 0) + 1);
 			}
 		}
 		return counts;
-	}, [primitiveEntries]);
+	}, [marketplaceEntriesBeforeTag]);
 
 	const primitiveTags = useMemo(
 		() =>
@@ -646,26 +726,20 @@ export function MarketplaceView({
 		[catalog?.tags, tagCounts],
 	);
 
-	const filteredEntries = useMemo(() => {
-		const normalizedQuery = query.trim().toLowerCase();
-		return primitiveEntries.filter((entry) => {
-			const matchesTag = !selectedTag || entry.tags.includes(selectedTag);
-			const matchesQuery =
-				normalizedQuery.length === 0 ||
-				entrySearchText(entry, tagLabels).includes(normalizedQuery);
-			return matchesTag && matchesQuery;
-		});
-	}, [primitiveEntries, query, selectedTag, tagLabels]);
+	const catalogEntries = useMemo(
+		() =>
+			marketplaceEntriesBeforeTag.filter(
+				(entry) => !selectedTag || entry.tags.includes(selectedTag),
+			),
+		[marketplaceEntriesBeforeTag, selectedTag],
+	);
 
 	const matchedLocalItemsByEntryKey = useMemo(() => {
 		const matched = new Map<string, MarketplaceLocalInstalledItem[]>();
 		for (const item of installedItems ?? []) {
-			for (const entry of filteredEntries) {
+			for (const entry of installedEntries) {
 				const key = entryKey(entry);
-				if (
-					!installedEntryKeys.has(key) ||
-					!entryMatchesLocalItem(entry, item)
-				) {
+				if (!entryMatchesLocalItem(entry, item)) {
 					continue;
 				}
 				const items = matched.get(key) ?? [];
@@ -674,49 +748,78 @@ export function MarketplaceView({
 			}
 		}
 		return matched;
-	}, [filteredEntries, installedEntryKeys, installedItems]);
+	}, [installedEntries, installedItems]);
 
-	const matchedLocalItemKeys = useMemo(
-		() =>
-			new Set(
-				[...matchedLocalItemsByEntryKey.values()].flatMap((items) =>
-					items.map((item) => item.key),
-				),
-			),
-		[matchedLocalItemsByEntryKey],
-	);
+	const matchedLocalItemKeys = useMemo(() => {
+		const matched = new Set<string>();
+		const installedMarketplaceEntries = primitiveEntries.filter((entry) =>
+			installedEntryKeys.has(entryKey(entry)),
+		);
+		for (const item of installedItems ?? []) {
+			if (
+				installedMarketplaceEntries.some((entry) =>
+					entryMatchesLocalItem(entry, item),
+				)
+			) {
+				matched.add(item.key);
+			}
+		}
+		return matched;
+	}, [installedEntryKeys, installedItems, primitiveEntries]);
 
-	const localOnlyInstalledItems = useMemo(
-		() =>
-			(installedItems ?? []).filter(
-				(item) => !matchedLocalItemKeys.has(item.key),
-			),
-		[installedItems, matchedLocalItemKeys],
-	);
+	const localOnlyInstalledItems = useMemo(() => {
+		const normalizedQuery = query.trim().toLowerCase();
+		return (installedItems ?? []).filter((item) => {
+			if (matchedLocalItemKeys.has(item.key)) {
+				return false;
+			}
+			return (
+				normalizedQuery.length === 0 ||
+				item.matchValues
+					.map(normalizeMatchValue)
+					.some((value) => value.includes(normalizedQuery))
+			);
+		});
+	}, [installedItems, matchedLocalItemKeys, query]);
 
-	const installedEntries = useMemo(
-		() =>
-			filteredEntries.filter((entry) =>
-				installedEntryKeys.has(entryKey(entry)),
-			),
-		[filteredEntries, installedEntryKeys],
-	);
-
-	const catalogEntries = useMemo(
-		() =>
-			filteredEntries.filter(
-				(entry) => !installedEntryKeys.has(entryKey(entry)),
-			),
-		[filteredEntries, installedEntryKeys],
-	);
-
-	const activeFilters = query.trim().length > 0 || selectedTag !== null;
 	const installedStatusReady = installedStatusState === "ready";
 
-	const clearFilters = () => {
-		setQuery("");
-		setSelectedTag(null);
-	};
+	const marketplaceTagFilters =
+		primitiveTags.length > 0 ? (
+			<div className="flex flex-col gap-2 md:flex-row md:items-center md:justify-between">
+				<div className="flex gap-2 overflow-x-auto pb-1">
+					{primitiveTags.map((tag) => (
+						<TagButton
+							active={selectedTag === tag.id}
+							count={tagCounts.get(tag.id) ?? 0}
+							key={tag.id}
+							onClick={() =>
+								setSelectedTag((current) =>
+									current === tag.id ? null : tag.id,
+								)
+							}
+							tag={tag}
+						/>
+					))}
+				</div>
+				<div className="flex min-h-8 shrink-0 items-center gap-2 text-sm text-muted-foreground">
+					<span className="font-medium text-foreground">
+						{catalogEntries.length}
+					</span>
+					<span>{catalogEntries.length === 1 ? "result" : "results"}</span>
+					{selectedTag ? (
+						<Button
+							onClick={() => setSelectedTag(null)}
+							size="sm"
+							type="button"
+							variant="ghost"
+						>
+							Clear filters
+						</Button>
+					) : null}
+				</div>
+			</div>
+		) : null;
 
 	const setEntryState = (entry: MarketplaceEntry, state: EntryActionState) => {
 		const key = entryKey(entry);
@@ -863,43 +966,7 @@ export function MarketplaceView({
 									value={query}
 								/>
 							</div>
-							<div className="flex min-h-8 items-center gap-2 text-sm text-muted-foreground">
-								<span className="font-medium text-foreground">
-									{filteredEntries.length}
-								</span>
-								<span>
-									{filteredEntries.length === 1 ? "result" : "results"}
-								</span>
-								{activeFilters ? (
-									<Button
-										onClick={clearFilters}
-										size="sm"
-										type="button"
-										variant="ghost"
-									>
-										Clear filters
-									</Button>
-								) : null}
-							</div>
 						</div>
-
-						{primitiveTags.length > 0 ? (
-							<div className="flex gap-2 overflow-x-auto pb-1">
-								{primitiveTags.map((tag) => (
-									<TagButton
-										active={selectedTag === tag.id}
-										count={tagCounts.get(tag.id) ?? 0}
-										key={tag.id}
-										onClick={() =>
-											setSelectedTag((current) =>
-												current === tag.id ? null : tag.id,
-											)
-										}
-										tag={tag}
-									/>
-								))}
-							</div>
-						) : null}
 					</div>
 
 					<MarketplaceSection
@@ -914,6 +981,8 @@ export function MarketplaceView({
 						onInstall={installEntry}
 						onToggleExpanded={toggleExpanded}
 						onUninstall={uninstallEntry}
+						showFeaturedBadges={false}
+						showEntryTags={false}
 						sourceLabel="Marketplace"
 						tagLabels={tagLabels}
 						title="Installed"
@@ -924,6 +993,7 @@ export function MarketplaceView({
 						emptyMessage={pageDetails.emptyCatalog}
 						entries={catalogEntries}
 						expandedEntryKey={expandedEntryKey}
+						headerContent={marketplaceTagFilters}
 						installedEntryKeys={installedEntryKeys}
 						installedStatusReady={installedStatusReady}
 						onInstall={installEntry}

apps/cline-hub/src/webview/src/components/views/settings/extensions-view.tsx

@@ -39,10 +39,10 @@ export type CustomizationSection =
 const sectionDescriptions: Record<CustomizationSection, string> = {
 	Rules: "Review project and global rule files that shape Cline behavior.",
 	Hooks: "Inspect hook configuration and recent execution status.",
-	MCP: "Manage installed MCP servers and add new servers from the catalog.",
-	Skills: "Manage installed skills and add new skills from the catalog.",
+	MCP: "Manage installed MCP servers and add new servers from the marketplace.",
+	Skills: "Manage installed skills and add new skills from the marketplace.",
 	Agents: "Review configured agents discovered from local settings.",
-	Plugins: "Manage installed plugins and add new plugins from the catalog.",
+	Plugins: "Manage installed plugins and add new plugins from the marketplace.",
 	Tools: "Inspect built-in tools and tools contributed by plugins.",
 };
 

apps/cline-hub/src/webview/src/lib/marketplace.ts

@@ -17,6 +17,7 @@ export type MarketplaceEntry = {
 	id: string;
 	type: MarketplacePrimitiveType;
 	name: string;
+	featured?: boolean;
 	tagline: string;
 	description: string;
 	tags: string[];
@@ -100,7 +101,7 @@ export async function fetchMarketplaceCatalog(): Promise<MarketplaceCatalog> {
 		headers: { Accept: "application/json" },
 	});
 	if (!response.ok) {
-		throw new Error(`Failed to fetch marketplace catalog: ${response.status}`);
+		throw new Error(`Failed to fetch marketplace: ${response.status}`);
 	}
 	const data = await response.json();
 	const baseUrl = typeof data?.baseUrl === "string" ? data.baseUrl : undefined;
@@ -152,6 +153,10 @@ export async function fetchMarketplaceCatalog(): Promise<MarketplaceCatalog> {
 						id: candidate.id,
 						type: candidate.type,
 						name: candidate.name,
+						featured:
+							typeof candidate.featured === "boolean"
+								? candidate.featured
+								: undefined,
 						tagline: candidate.tagline,
 						description: candidate.description,
 						tags: toStringArray(candidate.tags),

apps/cline-hub/src/webview/vite.config.ts

@@ -3,6 +3,27 @@ import tailwindcss from "@tailwindcss/vite";
 import react from "@vitejs/plugin-react-swc";
 import { defineConfig } from "vite";
 
+const mermaidChunkGroups = [
+	{
+		name: "mermaid-parser",
+		maxSize: 450_000,
+		test: /node_modules[\\/](?:\.bun[\\/])?@mermaid-js[+]parser/,
+	},
+	{
+		name: "mermaid-langium",
+		test: /node_modules[\\/](?:\.bun[\\/])?langium/,
+	},
+	{
+		name: "mermaid-layout",
+		maxSize: 450_000,
+		test: /node_modules[\\/](?:\.bun[\\/])?(?:cytoscape|cytoscape-cose-bilkent|dagre|elkjs)/,
+	},
+	{
+		name: "mermaid-markup",
+		test: /node_modules[\\/](?:\.bun[\\/])?(?:katex|dompurify)/,
+	},
+];
+
 export default defineConfig({
 	plugins: [react(), tailwindcss()],
 	resolve: {
@@ -25,5 +46,13 @@ export default defineConfig({
 		outDir: "../../dist/webview",
 		emptyOutDir: true,
 		cssMinify: "esbuild",
+		chunkSizeWarningLimit: 600,
+		rolldownOptions: {
+			output: {
+				codeSplitting: {
+					groups: mermaidChunkGroups,
+				},
+			},
+		},
 	},
 });

apps/examples/desktop-app/sidecar/commands.ts

@@ -1,9 +1,11 @@
 import { execFileSync, spawn } from "node:child_process";
 import {
 	existsSync,
+	mkdirSync,
 	readdirSync,
 	readFileSync,
 	rmSync,
+	writeFileSync,
 } from "node:fs";
 import { basename, dirname, extname, join } from "node:path";
 import type {
@@ -43,7 +45,6 @@ import {
 	setDisabledPlugin,
 	setDisabledTools,
 	toggleDisabledTool,
-	updateMcpSettingsFileSync,
 } from "@cline/core";
 import { getClineEnvironmentConfig } from "@cline/shared";
 import { broadcastEvent, resolveSidecarAskQuestion } from "./context";
@@ -142,9 +143,9 @@ function readMcpServersResponse(): JsonRecord {
 }
 
 function writeMcpServersMap(servers: JsonRecord): void {
-	updateMcpSettingsFileSync(resolveMcpSettingsPath(), (settings) => {
-		settings.mcpServers = servers;
-	});
+	const path = resolveMcpSettingsPath();
+	mkdirSync(dirname(path), { recursive: true });
+	writeFileSync(path, `${JSON.stringify({ mcpServers: servers }, null, 2)}\n`);
 }
 
 function ensureMcpSettingsFile(): string {
@@ -1042,19 +1043,18 @@ export async function handleCommand(
 	}
 	if (command === "set_mcp_server_disabled") {
 		const path = ensureMcpSettingsFile();
-		updateMcpSettingsFileSync(path, (settings) => {
-			const servers = ((settings.mcpServers as JsonRecord | undefined) ?? {}) as JsonRecord;
-			const name = String(args?.name ?? "").trim();
-			const current = servers[name];
-			if (!current || typeof current !== "object") {
-				throw new Error(`unknown MCP server: ${name}`);
-			}
-			servers[name] = {
-				...(current as JsonRecord),
-				disabled: Boolean(args?.disabled),
-			};
-			settings.mcpServers = servers;
-		});
+		const parsed = JSON.parse(readFileSync(path, "utf8")) as JsonRecord;
+		const servers = (parsed.mcpServers as JsonRecord | undefined) ?? {};
+		const name = String(args?.name ?? "").trim();
+		const current = servers[name];
+		if (!current || typeof current !== "object") {
+			throw new Error(`unknown MCP server: ${name}`);
+		}
+		servers[name] = {
+			...(current as JsonRecord),
+			disabled: Boolean(args?.disabled),
+		};
+		writeMcpServersMap(servers);
 		return readMcpServersResponse();
 	}
 	if (command === "upsert_mcp_server") {
@@ -1093,23 +1093,21 @@ export async function handleCommand(
 						metadata: input.metadata,
 					};
 		const path = ensureMcpSettingsFile();
-		updateMcpSettingsFileSync(path, (settings) => {
-			const servers = ((settings.mcpServers as JsonRecord | undefined) ?? {}) as JsonRecord;
-			if (previousName && previousName !== name) {
-				delete servers[previousName];
-			}
-			servers[name] = next;
-			settings.mcpServers = servers;
-		});
+		const parsed = JSON.parse(readFileSync(path, "utf8")) as JsonRecord;
+		const servers = (parsed.mcpServers as JsonRecord | undefined) ?? {};
+		if (previousName && previousName !== name) {
+			delete servers[previousName];
+		}
+		servers[name] = next;
+		writeMcpServersMap(servers);
 		return readMcpServersResponse();
 	}
 	if (command === "delete_mcp_server") {
 		const path = ensureMcpSettingsFile();
-		updateMcpSettingsFileSync(path, (settings) => {
-			const servers = ((settings.mcpServers as JsonRecord | undefined) ?? {}) as JsonRecord;
-			delete servers[String(args?.name ?? "")];
-			settings.mcpServers = servers;
-		});
+		const parsed = JSON.parse(readFileSync(path, "utf8")) as JsonRecord;
+		const servers = (parsed.mcpServers as JsonRecord | undefined) ?? {};
+		delete servers[String(args?.name ?? "")];
+		writeMcpServersMap(servers);
 		return readMcpServersResponse();
 	}
 	if (command === "ensure_mcp_settings_file") {

apps/vscode/.mocharc.json

@@ -0,0 +1,16 @@
+{
+	"extension": [
+		"ts"
+	],
+	"spec": [
+		"src/**/__tests__/*.ts",
+		"src/test/services/**/*.test.ts"
+	],
+	"require": [
+		"ts-node/register",
+		"source-map-support/register",
+		"./src/test/requires.ts"
+	],
+	"recursive": true,
+	"exit": true
+}

apps/vscode/.nycrc.unit.json

@@ -0,0 +1,48 @@
+{
+	"all": true,
+	"check-coverage": false,
+	"reporter": [
+		"text",
+		"lcov"
+	],
+	"include": [
+		"src/**/*.ts"
+	],
+	"exclude": [
+		"**/*.d.ts",
+
+		"**/*.{test,spec}.{js,jsx,ts,tsx,mjs,cjs}",
+		"**/__tests__/**",
+		"**/test/**",
+		"**/tests/**",
+		"**/.nyc_output/**",
+		"**/.vscode-test/**",
+		"**/tests-results/**",
+		"src/test/**",
+
+		"src/generated/**",
+
+		"**/node_modules/**",
+		"**/dist/**",
+		"**/out/**",
+		"**/build/**",
+		"**/coverage/**",
+		"**/coverage-unit/**",
+		"**/proto/**",
+
+		"**/*.{config,setup}.{js,ts,mjs,cjs}",
+		"**/vite-env.d.ts",
+
+		"**/*.{css,scss,sass,less,styl}",
+		"**/*.{svg,png,jpg,jpeg,gif,ico}",
+		"**/*.{json,yaml,yml}"
+	],
+	"extension": [
+		".ts",
+		".js"
+	],
+	"cache": true,
+	"sourceMap": true,
+	"instrument": true,
+	"report-dir": "./coverage-unit"
+}

apps/vscode/.vscode-test.mjs

@@ -1,20 +1,9 @@
 import { defineConfig } from "@vscode/test-cli"
 import path from "path"
-
 const vscodeTestVersion = process.env.VSCODE_TEST_VERSION ?? "stable"
 
 export default defineConfig({
-	files: [
-		"out/src/{core,test,utils,shared,integrations,hosts,services}/**/*.test.js",
-		"src/{core,test,utils,shared,integrations,hosts,services}/**/*.test.js",
-		// The bun unit suite (src/**/__tests__/* and src/test/services/**) runs under
-		// `bun test` (run-bun-unit-tests.ts) and imports `bun:test`, which this
-		// Node-based runner cannot load. Exclude it here.
-		"!out/src/**/__tests__/**/*.test.js",
-		"!out/src/test/services/**/*.test.js",
-		"!src/**/__tests__/**/*.test.js",
-		"!src/test/services/**/*.test.js",
-	],
+	files: "{out/**/*.test.js,src/**/*.test.js,!src/test/e2e/**/*.test.js,!out/src/test/e2e/**/*.test.js}",
 	mocha: {
 		ui: "bdd",
 		timeout: 20000, // Maximum time (in ms) that a test can run before failing

apps/vscode/.vscodeignore

@@ -5,31 +5,13 @@
 # Agent tooling, never shipped in the VSIX
 .agents/**
 .claude/**
-.cline/**
 .codex/**
 CLAUDE.local.md
 out/
 dist-standalone/
 node_modules/
-# Nested workspace-member node_modules (bun links these under each package).
-# Scoped to the sub-package dirs so it doesn't shadow the top-level
-# node_modules/@vscode/codicons re-include below.
-webview-ui/node_modules/**
-testing-platform/node_modules/**
-standalone/**/node_modules/**
 src/**
 standalone/**
-# Build/dev tooling and inputs — bundled into dist/extension.js, not needed in the VSIX.
-bunfig.toml
-esbuild.mjs
-knip.json
-biome.jsonc
-test-setup.js
-.env.example
-scripts/**
-proto/**
-testing-platform/**
-tests/**
 .gitignore
 .yarnrc
 esbuild.js
@@ -52,7 +34,6 @@ sdk/**
 # only exists if a publish aborts mid-swap; neither should ship in the .vsix.
 README.marketplace.md
 .README.github.bak
-package.json.backup
 
 # Custom
 **/demo.gif
@@ -65,6 +46,7 @@ eslint-rules/
 old_docs/
 evals/
 .codespellrc
+.mocharc.json
 buf.yaml
 .clinerules/
 
@@ -96,9 +78,6 @@ old_docs/**
 e2e-build.mjs
 e2e.vsix
 test-results/
-coverage/**
-webview-ui/coverage/**
-webview-ui/.vite-port
 
 # Ignore Storybook files
 **/*.stories.tsx

apps/vscode/README.marketplace.md

@@ -1,7 +1,3 @@
-<div align="center"><sub>
-English | <a href="https://github.com/cline/cline/blob/main/locales/es/README.md" target="_blank">Español</a> | <a href="https://github.com/cline/cline/blob/main/locales/de/README.md" target="_blank">Deutsch</a> | <a href="https://github.com/cline/cline/blob/main/locales/ja/README.md" target="_blank">日本語</a> | <a href="https://github.com/cline/cline/blob/main/locales/zh-cn/README.md" target="_blank">简体中文</a> | <a href="https://github.com/cline/cline/blob/main/locales/zh-tw/README.md" target="_blank">繁體中文</a> | <a href="https://github.com/cline/cline/blob/main/locales/ko/README.md" target="_blank">한국어</a>
-</sub></div>
-
 # Cline
 <div align="center">
 <table>

apps/vscode/SDK_MIGRATION_AUDIT.md

@@ -1,325 +0,0 @@
-# VSCode Extension → Cline SDK Migration Audit
-
-> Status: **living document**. Updated 2026-06-21.
->
-> **The extension host has now been demolished to a bare-bones inert shell** so it
-> can be rebuilt from near-zero on the Cline SDK, the way `apps/cli` is. See
-> [Bare-bones demolition](#bare-bones-demolition-2026-06-21) for exactly what was
-> removed and what survived. The earlier sections below describe the architecture
-> and the original incremental plan; they remain useful as the blueprint for the
-> rebuild.
-
-## TL;DR
-
-The VSCode extension still carries a large amount of **provider-, model-, and
-session-specific code that the Cline SDK is designed to own**. The CLI
-(`apps/cli`) already proves the target architecture: it is a thin shell that
-delegates *everything* — provider selection, auth, model catalog, session
-lifecycle, the agent loop, persistence, streaming — to the SDK
-(`@cline/core`, `@cline/llms`, `@cline/agents`). The extension should converge on
-that same pattern.
-
-This document inventories what should move to the SDK, what was removed in the
-first pass, and a prioritized roadmap for the rest.
-
----
-
-## Bare-bones demolition (2026-06-21)
-
-We decided to stop doing this incrementally and instead **gut the extension host
-down to a minimal inert shell**, then rebuild it on the SDK like `apps/cli`. The
-demolition was executed by a multi-agent workflow and verified to compile.
-
-### Result
-
-- **571 files changed · 752 insertions · 93,256 deletions** (363 files deleted,
-  208 modified).
-- **`tsc --noEmit` is green for both the host and the webview.**
-  - Host check: `cd apps/vscode && bun run protos && bunx tsc --noEmit`
-    (the `protos` step regenerates `src/generated/**`, which is a build artifact
-    and not committed — you must run it before typechecking).
-  - Webview check: `cd apps/vscode/webview-ui && bunx tsc --noEmit`.
-- The webview UI is **fully intact** — it renders and you can click around, but
-  every backend action is inert.
-
-### The demolition seam
-
-The webview talks to the host **only** through generated proto service clients
-over a postMessage bridge, and never imports handler implementations. So the
-strategy was:
-
-1. **Decouple the handler layer.** Every gRPC handler under
-   `src/core/controller/<group>/` was gutted to an inert stub that returns an
-   empty/default proto response and imports nothing downward. This severed the
-   handlers from all implementation.
-2. **Delete the implementation** now that nothing references it.
-3. **Rewrite the shell** (`extension.ts`, `common.ts`, `Controller`, `hosts/`)
-   to the minimum needed to render the webview and route gRPC.
-4. **Reconverge** with an iterative `tsc`-fix loop until host + webview were clean.
-
-### What was deleted (entire areas)
-
-- `src/sdk/**` (the entire SDK bridge — ~14.6k lines)
-- `src/services/**` (mcp, auth, telemetry, feature-flags, … — ~12.6k lines)
-- `src/integrations/**` (~4.5k lines)
-- `src/core/task/**`, `src/core/context/**`, `src/core/hooks/**`,
-  `src/core/storage/**`, `src/core/prompts/**`, `src/core/mentions/**`,
-  `src/core/ignore/**`, `src/core/locks/**`
-- Most of `src/hosts/vscode/**` (terminal, diff view, comment review,
-  commit-message generation, file migrations, …)
-- **All host-side test files** (`src/**/*.test.ts`, `src/__tests__`). Webview
-  tests were kept.
-
-### What survived (the shell)
-
-- `src/extension.ts` — **760 → 106 lines**: HostProvider setup, storage context,
-  register the sidebar webview provider, route gRPC. Throwing stubs for removed
-  host creators (diff/terminal/review).
-- `src/core/controller/` — `grpc-handler.ts`, `grpc-request-registry.ts`,
-  `grpc-recorder/**`, `index.ts` (a **minimal inert `Controller`** with
-  `any`-typed/no-op members), and all the **gutted handler files** (kept because
-  the generated `protobus-services.ts` imports them by path; bodies return empty
-  responses).
-- `src/core/webview/**` — the `WebviewProvider` (slimmed to construct the minimal
-  Controller and load the webview HTML).
-- `src/hosts/` — `host-provider.ts`, `VscodeWebviewProvider.ts`, and the
-  hostbridge client/handler needed for the webview + gRPC path.
-- `src/shared/**` (incl. `src/shared/proto/**`), `src/generated/**`,
-  `src/utils/**`, `src/registry.ts`, `src/config.ts` — kept (types + generated
-  glue the webview and shell compile against).
-- `webview-ui/**` — kept entirely (the inert UI).
-
-### Caveats / not-yet-verified
-
-- **Only `tsc` was verified.** The actual bundle builds
-  (`bun esbuild.mjs` for the host, `bun run build:webview` for vite) and a real
-  Extension-Development-Host launch have **not** been run yet. Compiling ≠ runs.
-- `package.json` still declares many `commands`/menus whose handlers were removed.
-  They'll be dead/no-op in the UI until cleaned up.
-- The minimal `Controller` uses `any` in several places by design — this is
-  throwaway scaffolding to be replaced by the SDK-backed implementation.
-
-### Rebuilding on the SDK (next)
-
-The shell is the foundation. Rebuild the host the way `apps/cli` does it
-(`apps/cli/src/session/session.ts`, `apps/cli/src/runtime/run-agent.ts`): create a
-`ClineCore`, `core.start()` sessions, `core.subscribe()` to events, and translate
-those SDK events into the webview's gRPC/`ClineMessage` shape inside the surviving
-handler/`Controller` layer. The (now empty) gRPC handlers are the exact insertion
-points: re-implement each by delegating to `@cline/core` / `@cline/llms` instead of
-the deleted in-extension code. The [target architecture](#the-target-architecture-what-the-cli-demonstrates)
-table below is the contract for what the SDK should own.
-
----
-
-## The target architecture (what the CLI demonstrates)
-
-The CLI hands these responsibilities entirely to the SDK and keeps zero
-provider-specific code:
-
-| Responsibility | SDK owner |
-|---|---|
-| Provider selection / settings persistence | `ProviderSettingsManager` (`@cline/core`) |
-| Provider auth / OAuth flows | `@cline/core/auth/*`, `getProviderAuthHandler()` |
-| API handler creation (per-protocol HTTP) | `createHandler()` (`@cline/llms`) |
-| Model catalog (ids, pricing, context windows) | `getProviderCollection()`, `resolveProviderConfig()` (`@cline/llms`) |
-| Session start / resume / events | `ClineCore.create()/start()/send()/subscribe()` (`@cline/core`) |
-| Agent loop (model → tools → repeat) | `Agent` / `AgentRuntime` (`@cline/agents`) |
-| Conversation history & persistence | `CoreSessionService`, `persistence-service.ts` (`@cline/core`) |
-| Context window mgmt / truncation / tokens | `MessageBuilder` (`@cline/core`) |
-| Checkpoints / restore | `SessionVersioningService` (`@cline/core`) |
-| MCP servers | `createMcpTools()`, `InMemoryMcpManager` (`@cline/core`) |
-
-The CLI's consumer pattern (see `apps/cli/src/session/session.ts`,
-`apps/cli/src/runtime/run-agent.ts`, `apps/cli/src/main.ts`):
-
-```
-ClineCore.create({ clientName, backendMode, ... })
-  → core.start({ config, prompt, localRuntime })
-  → core.subscribe(sessionId, event => render(event))
-```
-
-**Already done well in the extension:** the legacy per-provider *API handlers*
-are gone. `src/core/api/index.ts` is types-only and all inference routes through
-`@cline/llms` via `apps/vscode/src/sdk/sdk-api-handler.ts`. The remaining work is
-mostly in the **webview settings UI**, the **model-refresh/catalog layer**, and
-**proto/config conversion**.
-
----
-
-## The core anti-pattern: per-provider files
-
-The headline divergence from the CLI is that the extension has **one file (often
-several) per provider**:
-
-- **`webview-ui/src/components/settings/providers/*Provider.tsx`** — ~35 bespoke
-  settings components (`AnthropicProvider.tsx`, `BedrockProvider.tsx`,
-  `GroqProvider.tsx`, …), ~6,000 lines.
-- **`webview-ui/src/components/settings/*ModelPicker.tsx`** — ~10 bespoke model
-  pickers (`OpenRouterModelPicker.tsx`, `GroqModelPicker.tsx`, …), ~3,200 lines.
-- **`src/core/controller/models/refresh*.ts` / `get*Models.ts`** — ~23
-  per-provider model-refresh RPC handlers, ~2,350 lines.
-
-The replacement already exists and works: **`GenericProviderSettings.tsx`** is a
-fully-featured, catalog-driven settings shell (API key, optional base URL,
-model picker, reasoning selector, model info) that takes only a `providerId` plus
-presentation metadata. It pulls its model list from the unified
-`resolveProviderModels` RPC (`useProviderModels(providerId)`), i.e. the SDK
-catalog — not from per-provider state.
-
-`providers/providerSettingsRegistry.ts` is the cutover mechanism:
-
-- `CUSTOM_PROVIDER_SETTINGS_IDS` — providers that *still* have bespoke UIs.
-- `getGenericProviderSettings(id, listing)` — builds generic settings from an SDK
-  `ProviderListing` (requires `protocol ∈ {anthropic, gemini, openai-chat,
-  openai-responses}`).
-- `getFallbackGenericProviderSettings(id)` — static fallback so a generic
-  provider renders **before** SDK listings load.
-
-In `ApiOptions.tsx`, providers mid-migration are dispatched with a
-`&& !genericProviderSettings` guard, meaning the bespoke component is now just a
-**pre-listing fallback**. Completing a provider's migration =
-make the generic path always resolve, then delete the fallback component, its
-model picker, its dispatch block, and its import.
-
----
-
-## What was removed this pass
-
-Three providers were fully cut over to the generic SDK-driven path and their
-bespoke code deleted. These were chosen because they were already dual-pathed
-(`&& !genericProviderSettings`) and have simple API-key-only config.
-
-**Deleted (6 files, ~1,066 lines):**
-
-- `webview-ui/src/components/settings/providers/GroqProvider.tsx`
-- `webview-ui/src/components/settings/providers/BasetenProvider.tsx`
-- `webview-ui/src/components/settings/providers/VercelAIGatewayProvider.tsx`
-- `webview-ui/src/components/settings/GroqModelPicker.tsx`
-- `webview-ui/src/components/settings/BasetenModelPicker.tsx`
-- `webview-ui/src/components/settings/VercelModelPicker.tsx`
-
-**Modified:**
-
-- `providers/providerSettingsRegistry.ts` — added `groq`, `baseten`,
-  `vercel-ai-gateway` to `FALLBACK_GENERIC_PROVIDER_NAMES` so the generic path
-  *always* renders for them (no dependency on the catalog listing being loaded).
-- `ApiOptions.tsx` — removed the 3 imports and the 3 `selectedProvider === …`
-  dispatch blocks. These providers now fall through to the single
-  `genericProviderSettings && <GenericProviderSettings … />` block.
-- `context/ExtensionStateContext.tsx` — updated a now-stale comment about
-  `BasetenModelPicker`; flagged the legacy `refreshBasetenModelsRpc` /
-  `basetenModels` state as orphaned (see follow-ups).
-- `providers/providerSettingsRegistry.test.ts` — added fallback assertions for
-  the 3 migrated providers.
-
-**Verification:** `tsc -b` clean; `vitest run src/components/settings/` →
-10 files / 87 tests passing.
-
-> ⚠️ **Runtime check still recommended.** Typecheck + unit tests confirm the
-> wiring, but the settings UI for these 3 providers should be smoke-tested in a
-> running extension host (open Settings → select Groq / Baseten / Vercel AI
-> Gateway → confirm API-key field, model picker, and model selection persist).
-
-**Orphaned-but-left (intentional, to keep this pass small):** the legacy
-per-provider model-refresh plumbing for baseten/vercel (`refreshBasetenModelsRpc`,
-`setBasetenModels`, and the analogous vercel state in `ExtensionStateContext.tsx`
-+ `src/core/controller/models/refresh*.ts`) is no longer consumed by the UI but
-was not removed here — it touches RPC services and shared state. Queued under
-[Roadmap §3](#3-per-provider-model-refresh-layer).
-
----
-
-## Roadmap (prioritized)
-
-Ordered by value/risk. Each item notes whether it can be done **extension-only**
-or **needs SDK changes** (deferred per this pass's scope).
-
-### 1. Finish migrating "simple" providers to `GenericProviderSettings`
-
-**Extension-only. Low risk. High value.** Same recipe as this pass. Candidates
-that are already dual-pathed or API-key-only and likely covered by the generic
-shell + SDK catalog:
-
-- `huggingface` (already `&& !genericProviderSettings` guarded — next easiest)
-- `xai`, `zai`, `qwen`, `moonshot`, `aihubmix`, `asksage`, `dify`, `requesty`
-
-Recipe per provider:
-1. Confirm SDK `ProviderListing.protocol` is one of the generic protocols (or add
-   to `getFallbackGenericProviderSettings`).
-2. Add to `FALLBACK_GENERIC_PROVIDER_NAMES` (+ overrides for base URL / signup).
-3. Delete `*Provider.tsx`, its `*ModelPicker.tsx`, the dispatch block, the import.
-4. `tsc -b` + settings tests + runtime smoke test.
-
-### 2. Collapse the `ApiOptions.tsx` dispatch chain
-
-**Extension-only. Medium risk.** Today it's a ~30-branch
-`selectedProvider === "x" && <XProvider/>` ladder. As §1 empties it, the file
-should converge to: `genericProviderSettings ? <GenericProviderSettings/> :
-<remaining custom providers>`. The genuinely-custom set that needs bespoke UI
-(multi-field auth, special flows) is small: `bedrock`, `vertex`, `sapaicore`,
-`oca`, `openai` (compatible), `lmstudio`, `ollama`, `vscode-lm`, `cline`,
-`cline-pass`, `claude-code`, `openai-codex`.
-
-### 3. Per-provider model-refresh layer
-
-**Needs SDK alignment. Medium/high value.** `src/core/controller/models/`
-contains ~23 `refresh*Models.ts` / `get*Models.ts` handlers that fetch model
-lists from provider APIs. The SDK's unified `resolveProviderModels` RPC +
-`@cline/llms` catalog is meant to own live model discovery. Migrate consumers to
-the unified RPC, then delete the per-provider handlers and their
-`ExtensionStateContext` state (`basetenModels`, `vercelAiGatewayModels`,
-`groqModels`, `openRouterModels`, …). The orphaned baseten/vercel state from this
-pass is the first cleanup here.
-
-### 4. ApiConfiguration ↔ proto conversion & provider type unions
-
-**Needs SDK changes (deferred).** `src/shared/proto-conversions/models/`
-(~1,000 lines, esp. `api-configuration-conversion.ts` at ~800) and the provider
-type unions / model metadata in `src/shared/api.ts` + `src/shared/providers/*.json`
-duplicate what the SDK's `ProviderConfig` / catalog already model. The extension
-should consume SDK provider/config types directly rather than maintaining a
-parallel `ApiConfiguration` shape. **SDK gap:** needs the SDK to expose its
-provider config + listing metadata richly enough that the webview can drive all
-settings UIs from it. Document the exact fields needed, then implement on the SDK
-side in a follow-up.
-
-### 5. In-extension model catalog (`src/sdk/model-catalog/`)
-
-**Needs SDK changes (deferred).** ~3,000 lines (`catalog.ts`, `store.ts`,
-`effective-config.ts`, `contracts.ts`, `shape-adapter.ts`, …) that re-derive an
-effective model/provider config inside the extension. Much of this is a shim that
-exists because the SDK catalog isn't yet consumed end-to-end. As §3/§4 land, this
-layer should shrink to a thin host adapter or disappear.
-
-### 6. Session / task / state overlap
-
-**Mostly SDK-owned already; keep VSCode glue.** The agent loop, context-window
-management, truncation, and token counting are already owned by the SDK
-(`@cline/agents` `agent-runtime.ts`, `@cline/core` `message-builder.ts`,
-`session-runtime-orchestrator.ts`). The extension's `src/sdk/*` is largely a
-legitimate bridge (webview gRPC, VSCode UI concerns). Candidates to consolidate
-*into* the SDK over time (deferred — needs SDK changes):
-
-- `src/sdk/sdk-task-history.ts` (~747) overlaps `persistence-service.ts` /
-  `session-data.ts`.
-- `src/sdk/tool-approval-denial.ts` + `sdk-tool-policies.ts` — tool policy logic
-  the SDK could own generically.
-- `src/core/hooks/*` + `src/sdk/hooks-adapter.ts` overlap the SDK hook system.
-
-Keep in the extension (genuinely VSCode-specific): `message-translator.ts`
-(webview message format), `StateManager.ts` (VSCode storage), the
-`sdk-*-coordinator.ts` bridge layer, `vscode-run-commands-tool.ts` (terminal),
-`McpHub.ts` (connection lifecycle), `vscode-lm/*` (GitHub Copilot models).
-
----
-
-## Appendix: key files
-
-- Generic settings shell: `webview-ui/src/components/settings/providers/GenericProviderSettings.tsx`
-- Cutover registry: `webview-ui/src/components/settings/providers/providerSettingsRegistry.ts`
-- Provider dispatch: `webview-ui/src/components/settings/ApiOptions.tsx`
-- Unified model RPC hook: `webview-ui/src/hooks/useProviderModels.ts`
-- SDK API handler bridge: `apps/vscode/src/sdk/sdk-api-handler.ts`
-- Session factory: `apps/vscode/src/sdk/cline-session-factory.ts`
-- CLI reference (target pattern): `apps/cli/src/session/session.ts`, `apps/cli/src/runtime/run-agent.ts`

apps/vscode/biome.jsonc

@@ -1,11 +1,6 @@
 {
-	"root": true,
+	"root": false,
 	"$schema": "./node_modules/@biomejs/biome/configuration_schema.json",
-	"vcs": {
-		"enabled": true,
-		"clientKind": "git",
-		"defaultBranch": "main"
-	},
 	"assist": {
 		"enabled": true,
 		"actions": {
@@ -129,18 +124,14 @@
 			"!!**/playwright",
 			"!!**/.vscode-test",
 			"!!**/test-results",
-			"!!**/coverage",
 			"!!**/node_modules",
 			"!!**/webview-ui/build",
 			"!!**/generated",
 			"!!**/proto",
-			"!!**/tests/specs",
-			"!!assets/icons/*.svg"
+			"!!**/tests/specs"
 		]
 	},
-	"plugins": [
-		"src/dev/grit/process-env.grit"
-	],
+	"plugins": ["src/dev/grit/process-env.grit"],
 	"overrides": [
 		{
 			"includes": [
@@ -155,15 +146,11 @@
 				"!!src/integrations/terminal/**",
 				"!!src/core/controller/ui/openWalkthrough.ts"
 			],
-			"plugins": [
-				"src/dev/grit/vscode-api.grit"
-			]
+			"plugins": ["src/dev/grit/vscode-api.grit"]
 		},
 		{
 			// Do not use console logging directly, use the Logger service instead.
-			"plugins": [
-				"src/dev/grit/console-log.grit"
-			],
+			"plugins": ["src/dev/grit/console-log.grit"],
 			"includes": [
 				"**",
 				"!!**/esbuild.*",
@@ -196,9 +183,7 @@
 				"!!src/core/storage/utils/state-helpers.ts",
 				"!!src/extension.ts"
 			],
-			"plugins": [
-				"src/dev/grit/use-cache-service.grit"
-			]
+			"plugins": ["src/dev/grit/use-cache-service.grit"]
 		}
 	]
 }

apps/vscode/bunfig.toml

@@ -1,7 +0,0 @@
-[test]
-# Module-substitution aliases for `bun test`. bun resolves tsconfig `paths`
-# (@/*, @core/*, @shared/*, …) and the real @cline/llms + @cline/shared dist
-# builds on its own; the preload only shadows `vscode` and `@cline/core` with
-# their unit-test stubs (mirrors vitest.config.ts resolve.alias). See
-# src/test/bun-test-preload.ts for details.
-preload = ["./src/test/bun-test-preload.ts"]

apps/vscode/esbuild.mjs

@@ -85,6 +85,44 @@ const esbuildProblemMatcherPlugin = {
 	},
 }
 
+const copyWasmFiles = {
+	name: "copy-wasm-files",
+	setup(build) {
+		build.onEnd(() => {
+			// tree sitter
+			const sourceDir = path.join(__dirname, "node_modules", "web-tree-sitter")
+			const targetDir = path.join(__dirname, destDir)
+
+			// Copy tree-sitter.wasm
+			fs.copyFileSync(path.join(sourceDir, "tree-sitter.wasm"), path.join(targetDir, "tree-sitter.wasm"))
+
+			// Copy language-specific WASM files
+			const languageWasmDir = path.join(__dirname, "node_modules", "tree-sitter-wasms", "out")
+			const languages = [
+				"typescript",
+				"tsx",
+				"python",
+				"rust",
+				"javascript",
+				"go",
+				"cpp",
+				"c",
+				"c_sharp",
+				"ruby",
+				"java",
+				"php",
+				"swift",
+				"kotlin",
+			]
+
+			languages.forEach((lang) => {
+				const filename = `tree-sitter-${lang}.wasm`
+				fs.copyFileSync(path.join(languageWasmDir, filename), path.join(targetDir, filename))
+			})
+		})
+	},
+}
+
 const buildEnvVars = {
 	"import.meta.url": "_importMetaUrl",
 	"process.env.IS_STANDALONE": JSON.stringify(standalone ? "true" : "false"),
@@ -138,6 +176,7 @@ const baseConfig = {
 	define: buildEnvVars,
 	tsconfig: path.resolve(__dirname, "tsconfig.json"),
 	plugins: [
+		copyWasmFiles,
 		aliasResolverPlugin,
 		/* add to the end of plugins array */
 		esbuildProblemMatcherPlugin,

apps/vscode/knip.json

@@ -1,34 +1,23 @@
 {
-	"$schema": "https://unpkg.com/knip@5/schema.json",
-	"workspaces": {
-		".": {
-			"entry": [
-				"src/extension.ts",
-				"src/standalone/cline-core.ts",
-				"src/generated/hosts/standalone/protobus-server-setup.ts",
-				"src/generated/hosts/standalone/host-bridge-clients.ts",
-				"src/generated/hosts/vscode/protobus-services.ts",
-				"src/generated/hosts/vscode/hostbridge-grpc-service-config.ts",
-				"src/**/*.test.ts",
-				"src/**/__tests__/**/*.ts",
-				"src/test/**/*.ts"
-			],
-			"project": [
-				"src/**/*.ts"
-			]
-		},
-		"webview-ui": {
-			"entry": [
-				"src/services/grpc-client.ts",
-				"src/**/*.test.{ts,tsx}",
-				"src/**/*.spec.{ts,tsx}",
-				"src/**/__tests__/**/*.{ts,tsx}"
-			],
-			"project": [
-				"src/**/*.{ts,tsx}",
-				"*.ts"
-			],
-			"vite": true
-		}
-	}
+	"entry": [
+		"src/extension.ts",
+		"src/standalone/cline-core.ts",
+		"src/generated/hosts/standalone/protobus-server-setup.ts",
+		"src/generated/hosts/standalone/host-bridge-clients.ts",
+		"src/generated/hosts/vscode/protobus-services.ts",
+		"src/generated/hosts/vscode/hostbridge-grpc-service-config.ts"
+	],
+	"project": [
+		"src/**/*.ts"
+	],
+	"ignore": [
+		"out/**",
+		"node_modules/**",
+		"*.d.ts",
+		"**/*.test.ts",
+		"**/__tests__",
+		"src/test/**",
+		"src/shared/**"
+	],
+	"vite": true
 }

apps/vscode/package.json

@@ -2,7 +2,7 @@
 	"name": "claude-dev",
 	"displayName": "Cline",
 	"description": "Autonomous coding agent right in your IDE, capable of creating/editing files, running commands, using the browser, and more with your permission every step of the way.",
-	"version": "3.89.0",
+	"version": "3.89.2",
 	"icon": "assets/icons/icon.png",
 	"engines": {
 		"vscode": "^1.84.0"
@@ -89,7 +89,7 @@
 					{
 						"id": "mcp",
 						"title": "Extend with Powerful Tools (MCP)",
-						"description": "Connect to databases, APIs, and other external tools through MCP.",
+						"description": "Connect to databases, APIs, or discover new capabilities in the MCP Marketplace.",
 						"media": {
 							"markdown": "walkthrough/step4.md"
 						}
@@ -229,9 +229,26 @@
 				"command": "cline.reconstructTaskHistory",
 				"title": "Reconstruct Task History",
 				"category": "Cline"
+			},
+			{
+				"command": "cline.reviewComment.reply",
+				"title": "Reply",
+				"category": "Cline",
+				"enablement": "!commentIsEmpty"
+			},
+			{
+				"command": "cline.reviewComment.addToChat",
+				"title": "Add to Cline Chat",
+				"category": "Cline",
+				"icon": "$(link-external)"
 			}
 		],
 		"keybindings": [
+			{
+				"command": "editor.action.submitComment",
+				"key": "enter",
+				"when": "commentEditorFocused && commentController == cline-ai-review && !commentIsEmpty"
+			},
 			{
 				"command": "cline.addToChat",
 				"key": "cmd+'",
@@ -333,6 +350,24 @@
 				{
 					"command": "cline.abortGitCommitMessage",
 					"when": "config.git.enabled && cline.isGeneratingCommit"
+				},
+				{
+					"command": "cline.reviewComment.reply",
+					"when": "false"
+				}
+			],
+			"comments/commentThread/context": [
+				{
+					"command": "cline.reviewComment.reply",
+					"group": "inline",
+					"when": "commentController == cline-ai-review"
+				}
+			],
+			"comments/commentThread/title": [
+				{
+					"command": "cline.reviewComment.addToChat",
+					"group": "inline",
+					"when": "commentController == cline-ai-review"
 				}
 			]
 		},
@@ -342,74 +377,66 @@
 		}
 	},
 	"scripts": {
-		"vscode:prepublish": "bun run package",
-		"compile": "bun run check-types && bun run lint && bun esbuild.mjs",
-		"compile-standalone": "bun run check-types && bun run lint && bun esbuild.mjs --standalone",
+		"vscode:prepublish": "npm run package",
+		"compile": "npm run check-types && npm run lint && node esbuild.mjs",
+		"compile-standalone": "npm run check-types && npm run lint && node esbuild.mjs --standalone",
 		"postcompile-standalone": "node scripts/package-standalone.mjs",
-		"dev": "bun run protos && bun run watch",
-		"watch": "bun run --parallel watch:esbuild watch:tsc",
-		"watch:esbuild": "bun esbuild.mjs --watch",
+		"dev": "npm run protos && npm run watch",
+		"watch": "npx npm-run-all -p watch:*",
+		"watch:esbuild": "node esbuild.mjs --watch",
 		"watch:tsc": "tsc --noEmit --watch --project tsconfig.json",
-		"package": "bun run check-types && bun run build:webview && bun run lint && bun esbuild.mjs --production",
+		"package": "npm run check-types && npm run build:webview && npm run lint && node esbuild.mjs --production",
 		"protos": "node scripts/build-proto.mjs",
 		"protos-python": "node scripts/build-python-proto.mjs",
 		"download-ripgrep": "node scripts/download-ripgrep.mjs",
-		"postprotos": "biome format --config-path ./biome.jsonc src/shared/proto src/core/controller src/hosts/ webview-ui/src/services src/generated --write --no-errors-on-unmatched",
+		"postprotos": "biome format --config-path ./biome.jsonc src/shared/proto src/generated webview-ui/src/services/grpc-client.ts --write --no-errors-on-unmatched",
 		"clean:build": "rimraf dist dist-standalone webview-ui/build src/generated out/",
 		"clean:deps": "rimraf node_modules webview-ui/node_modules",
-		"clean:all": "bun run clean:build && bun run clean:deps",
+		"clean:all": "npm run clean:build && npm run clean:deps",
 		"compile-tests": "node ./scripts/build-tests.js",
 		"watch-tests": "tsc -p . -w --outDir out",
-		"check-types": "bun run protos && bunx tsc --noEmit && cd webview-ui && bunx tsc --noEmit",
-		"lint": "biome lint --config-path ./biome.jsonc --no-errors-on-unmatched --files-ignore-unknown=true --diagnostic-level=error && bun run lint:proto",
+		"check-types": "npm run protos && tsc --noEmit && cd webview-ui && tsc --noEmit",
+		"lint": "biome lint --config-path ./biome.jsonc --no-errors-on-unmatched --files-ignore-unknown=true --diagnostic-level=error && npm run lint:proto",
 		"lint:proto": "bash ./scripts/proto-lint.sh",
-		"analyze:unused": "bunx --yes knip --config knip.json --include files,exports,types,enumMembers,duplicates",
-		"analyze:unused:prod": "bunx --yes knip --config knip.json --production --include files,exports,types,enumMembers,dependencies",
-		"analyze:unused:fix-exports": "node scripts/remove-unused-exports.mjs --apply",
-		"analyze:unused:fix-exports:dry": "node scripts/remove-unused-exports.mjs",
-		"format": "biome format --config-path ./biome.jsonc --changed --since main --no-errors-on-unmatched --files-ignore-unknown=true --diagnostic-level=error --semicolons=as-needed",
-		"format:fix": "biome check --config-path ./biome.jsonc --changed --since main --no-errors-on-unmatched --files-ignore-unknown=true --write --semicolons=as-needed",
-		"fix:all": "biome check --config-path ./biome.jsonc --no-errors-on-unmatched --files-ignore-unknown=true --write --diagnostic-level=error --unsafe --semicolons=as-needed",
-		"ci:check-all": "bun run --parallel check-types lint format",
-		"ci:build": "bun run protos && bun run build:webview && bun esbuild.mjs && bun run compile-tests",
-		"pretest": "bun run compile && bun run compile-tests && bun run compile-standalone && bun run lint",
-		"test": "bun run test:unit && bun run test:integration",
-		"test:integration": "bun run compile-tests && vscode-test",
-		"test:unit": "bun scripts/run-bun-unit-tests.ts",
-		"test:vitest": "vitest run --config vitest.config.ts",
-		"test:vitest:watch": "vitest --config vitest.config.ts",
-		"test:bun": "bun scripts/run-bun-tests.ts",
-		"test:bun:unit": "bun scripts/run-bun-unit-tests.ts",
-		"test:coverage": "bun run compile-tests && vscode-test --coverage",
-		"test:sca-server": "bun --watch scripts/test-standalone-core-api-server.ts",
-		"test:tp-orchestrator": "bun scripts/testing-platform-orchestrator.ts",
-		"dev:mcp-oauth-test-server": "bun src/dev/mcp-oauth-test-server/server.ts",
+		"format": "biome format --config-path ./biome.jsonc --changed --since main --no-errors-on-unmatched --files-ignore-unknown=true --diagnostic-level=error",
+		"format:fix": "biome check --config-path ./biome.jsonc --changed --since main --no-errors-on-unmatched --files-ignore-unknown=true --write",
+		"fix:all": "biome check --config-path ./biome.jsonc --no-errors-on-unmatched --files-ignore-unknown=true --write --diagnostic-level=error --unsafe",
+		"ci:check-all": "npx npm-run-all -p check-types lint format",
+		"ci:build": "npm run protos && npm run build:webview && node esbuild.mjs && npm run compile-tests",
+		"pretest": "npm run compile && npm run compile-tests && npm run compile-standalone && npm run lint",
+		"test": "npx npm-run-all test:unit test:integration",
+		"test:integration": "vscode-test",
+		"test:unit": "cross-env TS_NODE_PROJECT=./tsconfig.unit-test.json mocha",
+		"test:coverage": "vscode-test --coverage",
+		"test:sca-server": "npx tsx watch scripts/test-standalone-core-api-server.ts",
+		"test:tp-orchestrator": "npx tsx scripts/testing-platform-orchestrator.ts",
 		"e2e": "playwright test -c playwright.config.ts",
-		"test:e2e:build": "vsce package --no-dependencies --allow-package-secrets sendgrid --out dist/e2e.vsix",
-		"test:e2e": "playwright install && bun run test:e2e:build && node src/test/e2e/utils/build.mjs && playwright test",
-		"test:e2e:optimal": "bun run test:e2e:build && node src/test/e2e/utils/build.mjs && playwright test",
-		"test:e2e:ui": "bun scripts/interactive-playwright.ts",
-		"install:all": "bun install",
-		"dev:webview": "cd webview-ui && bun run dev",
-		"build:webview": "cd webview-ui && bun run build",
-		"test:webview": "cd webview-ui && bun run test",
+		"test:e2e:build": "vsce package --allow-package-secrets sendgrid --out dist/e2e.vsix",
+		"test:e2e": "playwright install && npm run test:e2e:build && node src/test/e2e/utils/build.mjs && playwright test",
+		"test:e2e:optimal": "npm run test:e2e:build && node src/test/e2e/utils/build.mjs && playwright test",
+		"test:e2e:ui": "npx tsx scripts/interactive-playwright.ts",
+		"install:all": "npm install && cd webview-ui && npm install",
+		"dev:webview": "cd webview-ui && npm run dev",
+		"build:webview": "cd webview-ui && npm run build",
+		"test:webview": "cd webview-ui && npm run test",
 		"publish:marketplace": "node scripts/publish-marketplace.mjs",
 		"publish:marketplace:prerelease": "node scripts/publish-marketplace.mjs --pre-release",
 		"publish:marketplace:nightly": "node ./scripts/publish-nightly.mjs",
-		"docs": "cd docs && bun run dev",
-		"docs:check-links": "cd docs && bun run check",
-		"docs:rename-file": "cd docs && bun run rename",
+		"prepare": "npx husky",
+		"docs": "cd docs && npm run dev",
+		"docs:check-links": "cd docs && npm run check",
+		"docs:rename-file": "cd docs && npm run rename",
 		"report-issue": "node scripts/report-issue.js",
-		"storybook": "cd webview-ui && bun run storybook",
-		"eval:smoke:run": "bun evals/smoke-tests/run-smoke-tests.ts"
+		"storybook": "cd webview-ui && npm run storybook",
+		"eval:smoke:run": "npx tsx evals/smoke-tests/run-smoke-tests.ts"
 	},
 	"lint-staged": {
 		"src/shared/storage/state-keys.ts": [
 			"node scripts/generate-state-proto.mjs",
-			"git add apps/vscode/proto/cline/state.proto"
+			"git add proto/cline/state.proto"
 		],
 		"*": [
-			"biome check --write --staged --no-errors-on-unmatched --files-ignore-unknown=true --semicolons=as-needed"
+			"biome check --write --staged --no-errors-on-unmatched --files-ignore-unknown=true"
 		]
 	},
 	"devDependencies": {
@@ -425,6 +452,7 @@
 		"@types/node": "20.x",
 		"@types/pdf-parse": "^1.1.4",
 		"@types/picomatch": "^4.0.2",
+		"@types/proxyquire": "^1.3.31",
 		"@types/shell-quote": "^1.7.5",
 		"@types/should": "^11.2.0",
 		"@types/sinon": "^21.0.0",
@@ -436,41 +464,42 @@
 		"c8": "^10.1.3",
 		"chai": "^4.3.10",
 		"chalk": "5.6.2",
+		"cross-env": "^10.1.0",
 		"dotenv": "^17.2.3",
 		"esbuild": "^0.25.0",
-		"glob": "^11.0.0",
 		"grpc-tools": "^1.13.0",
+		"husky": "^9.1.7",
 		"lint-staged": "^16.1.0",
 		"minimatch": "^3.0.3",
-		"minimist": "^1.2.8",
-		"mocha": "^11.7.4",
-		"playwright": "^1.55.1",
+		"npm-run-all": "^4.1.5",
+		"nyc": "^17.1.0",
 		"prebuild-install": "^7.1.3",
 		"protoc-gen-ts": "^0.8.7",
+		"proxyquire": "^2.1.3",
 		"rimraf": "^6.0.1",
 		"should": "^13.2.3",
 		"sinon": "^21.0.3",
-		"tar": "^7.5.2",
 		"tree-kill": "^1.2.2",
+		"ts-node": "^10.9.2",
 		"ts-proto": "^2.6.1",
 		"tsconfig-paths": "^4.2.0",
-		"typescript": "^5.4.5",
-		"vitest": "^4.0.17"
+		"typescript": "^5.4.5"
 	},
 	"dependencies": {
-		"@anthropic-ai/sdk": "^0.37.0",
+		"@anthropic-ai/sdk": "^0.50.4",
+		"@anthropic-ai/vertex-sdk": "^0.11.5",
+		"@aws-sdk/client-bedrock-runtime": "^3.922.0",
+		"@aws-sdk/credential-providers": "^3.922.0",
+		"@azure/identity": "^4.13.0",
 		"@bufbuild/protobuf": "^2.2.5",
-		"@cline/agents": "workspace:*",
-		"@cline/core": "workspace:*",
-		"@cline/llms": "workspace:*",
-		"@cline/shared": "workspace:*",
+		"@cerebras/cerebras_cloud_sdk": "^1.35.0",
+		"@google-cloud/vertexai": "^1.9.3",
 		"@google/genai": "^1.30.0",
 		"@grpc/grpc-js": "^1.9.15",
-		"@grpc/proto-loader": "^0.7.13",
 		"@grpc/reflection": "^1.0.4",
+		"@mistralai/mistralai": "^1.5.0",
 		"@modelcontextprotocol/sdk": "^1.25.1",
 		"@opentelemetry/api": "^1.9.0",
-		"@opentelemetry/api-logs": "^0.56.0",
 		"@opentelemetry/core": "^2.1.0",
 		"@opentelemetry/exporter-logs-otlp-grpc": "^0.56.0",
 		"@opentelemetry/exporter-logs-otlp-http": "^0.56.0",
@@ -490,6 +519,9 @@
 		"@opentelemetry/sdk-trace-node": "^1.30.1",
 		"@opentelemetry/semantic-conventions": "^1.37.0",
 		"@playwright/test": "^1.55.1",
+		"@sap-ai-sdk/ai-api": "^2.7.0",
+		"@sap-ai-sdk/orchestration": "^2.7.0",
+		"@sap-cloud-sdk/connectivity": "^4.6.0",
 		"@streamparser/json": "^0.0.22",
 		"@tailwindcss/vite": "^4.1.14",
 		"@types/uuid": "^10.0.0",
@@ -515,15 +547,13 @@
 		"ignore": "^7.0.3",
 		"image-size": "^2.0.2",
 		"isbinaryfile": "^5.0.2",
-		"js-yaml": "^4.1.1",
 		"jschardet": "^3.1.4",
 		"json5": "^2.2.3",
-		"jwt-decode": "^4.0.0",
 		"mammoth": "^1.11.0",
 		"nanoid": "^5.1.6",
 		"nice-grpc": "^2.1.12",
-		"nice-grpc-common": "^2.0.3",
 		"node-machine-id": "^1.1.12",
+		"ollama": "^0.5.13",
 		"open": "^10.1.2",
 		"open-graph-scraper": "^6.9.0",
 		"openai": "^6.21.0",
@@ -542,13 +572,24 @@
 		"simple-git": "3.36.0",
 		"strip-ansi": "^7.1.2",
 		"tailwindcss": "^4.1.14",
+		"tree-sitter-wasms": "^0.1.11",
 		"ts-morph": "^25.0.1",
 		"turndown": "^7.2.0",
 		"ulid": "^2.4.0",
 		"undici": "^7.26.0",
 		"uuid": "^11.1.0",
 		"vscode-uri": "^3.1.0",
-		"zod": "^4.3.6"
+		"web-tree-sitter": "^0.22.6",
+		"zod": "^3.24.2"
+	},
+	"overrides": {
+		"tar-fs": ">=3.1.1",
+		"tar": "^7.5.2",
+		"vite": "^7.1.11",
+		"js-yaml": "^4.1.1",
+		"serialize-javascript": ">=7.0.3",
+		"protobufjs": "7.5.8",
+		"diff": "8.0.4"
 	},
 	"c8": {
 		"reporter": [

apps/vscode/proto/cline/mcp.proto

@@ -12,11 +12,16 @@ service McpService {
   rpc toggleMcpServer(ToggleMcpServerRequest) returns (McpServers);
   rpc updateMcpTimeout(UpdateMcpTimeoutRequest) returns (McpServers);
   rpc addRemoteMcpServer(AddRemoteMcpServerRequest) returns (McpServers);
+  rpc downloadMcp(StringRequest) returns (McpDownloadResponse);
   rpc restartMcpServer(StringRequest) returns (McpServers);
   rpc deleteMcpServer(StringRequest) returns (McpServers);
   rpc toggleToolAutoApprove(ToggleToolAutoApproveRequest) returns (McpServers);
+  rpc refreshMcpMarketplace(EmptyRequest) returns (McpMarketplaceCatalog);
   rpc openMcpSettings(EmptyRequest) returns (Empty);
   rpc authenticateMcpServer(StringRequest) returns (Empty);
+
+  // Subscribe to MCP marketplace catalog updates
+  rpc subscribeToMcpMarketplaceCatalog(EmptyRequest) returns (stream McpMarketplaceCatalog);
   rpc getLatestMcpServers(Empty) returns (McpServers);
 
   // Subscribe to MCP server updates
@@ -109,3 +114,40 @@ message McpServer {
 message McpServers {
   repeated McpServer mcp_servers = 1;
 }
+
+message McpMarketplaceItem {
+  string mcp_id = 1;
+  string github_url = 2;
+  string name = 3;
+  string author = 4;
+  string description = 5;
+  string codicon_icon = 6;
+  string logo_url = 7;
+  string category = 8;
+  repeated string tags = 9;
+  bool requires_api_key = 10;
+  optional string readme_content = 11;
+  optional string llms_installation_content = 12;
+  bool is_recommended = 13;
+  int32 github_stars = 14;
+  int32 download_count = 15;
+  string created_at = 16;
+  string updated_at = 17;
+  string last_github_sync = 18;
+}
+
+message McpMarketplaceCatalog {
+  repeated McpMarketplaceItem items = 1;
+}
+
+message McpDownloadResponse {
+  string mcp_id = 1;
+  string github_url = 2;
+  string name = 3;
+  string author = 4;
+  string description = 5;
+  string readme_content = 6;
+  string llms_installation_content = 7;
+  bool requires_api_key = 8;
+  optional string error = 9;
+}

apps/vscode/proto/cline/models.proto

@@ -21,6 +21,8 @@ service ModelsService {
   rpc refreshOpenRouterModelsRpc(EmptyRequest) returns (OpenRouterCompatibleModelInfo);
   // Refreshes and returns recommended and free Cline models
   rpc refreshClineRecommendedModelsRpc(EmptyRequest) returns (ClineRecommendedModelsResponse);
+  // Refreshes and returns Cline provider models
+  rpc refreshClineModelsRpc(EmptyRequest) returns (OpenRouterCompatibleModelInfo);
   // Refreshes and returns Hugging Face models
   rpc refreshHuggingFaceModels(EmptyRequest) returns (OpenRouterCompatibleModelInfo);
   // Refreshes and returns OpenAI models
@@ -53,18 +55,6 @@ service ModelsService {
   rpc getAihubmixModels(EmptyRequest) returns (OpenRouterCompatibleModelInfo);
   // Refreshes and returns Vercel AI Gateway models
   rpc refreshVercelAiGatewayModelsRpc(EmptyRequest) returns (OpenRouterCompatibleModelInfo);
-  // Lists providers available from the unified SDK-backed catalog
-  rpc listProviders(Empty) returns (ProviderListingsResponse);
-  // Resolves model metadata for a provider through the unified SDK-backed catalog
-  rpc resolveProviderModels(ResolveProviderModelsRequest) returns (ProviderModelsResponse);
-  // Resolves model metadata for a provider/model without refreshing model lists
-  rpc resolveModelInfo(ResolveModelInfoRequest) returns (ResolveModelInfoResponse);
-  // Reads redacted effective provider configuration
-  rpc readProviderConfig(StringRequest) returns (ProviderConfigResponse);
-  // Writes provider configuration fields and returns redacted effective configuration
-  rpc writeProviderConfig(WriteProviderConfigRequest) returns (ProviderConfigResponse);
-  // Commits a mode-specific model selection atomically with its model metadata
-  rpc commitModelSelection(CommitModelSelectionRequest) returns (Empty);
 }
 
 // List of VS Code LM models
@@ -127,142 +117,6 @@ message OpenRouterCompatibleModelInfo {
   map<string, OpenRouterModelInfo> models = 1;
 }
 
-// Lightweight provider entry for the top-level model/provider picker.
-// Does not include the full model list; use resolveProviderModels for models.
-message ProviderListing {
-  string id = 1;
-  string name = 2;
-  optional string default_model_id = 3;
-  optional string family = 4;
-  optional string protocol = 5;
-  optional string auth_description = 6;
-  optional string base_url_description = 7;
-  bool allows_custom_model_ids = 8;
-
-  // SDK-driven hint for cost display. Values: "show" (default) or "hide".
-  // Sourced from `resolveProviderUsageCostDisplay(provider.metadata)` in
-  // `@cline/llms`. When "hide", consumers must suppress per-token pricing
-  // and total cost displays (matches the CLI's `shouldShowCliUsageCost`).
-  string usage_cost_display = 11;
-}
-
-message ProviderListingsResponse {
-  repeated ProviderListing providers = 1;
-}
-
-message ResolveProviderModelsRequest {
-  string provider_id = 1;
-  bool force_refresh = 2;
-  optional string request_id = 3;
-}
-
-message CatalogErrorInfo {
-  string kind = 1;
-  string message = 2;
-  optional string code = 3;
-  optional bool retryable = 4;
-}
-
-message ProviderModelsResponse {
-  string provider_id = 1;
-  string request_id = 2;
-  string config_fingerprint = 3;
-  int64 fetched_at = 4;
-  bool ok = 5;
-  map<string, OpenRouterModelInfo> models = 6;
-  optional string default_model_id = 7;
-  optional string source = 8;
-  optional CatalogErrorInfo error = 9;
-}
-
-message ResolveModelInfoRequest {
-  string provider_id = 1;
-  optional string model_id = 2;
-}
-
-message ResolveModelInfoResponse {
-  string provider_id = 1;
-  string model_id = 2;
-  optional OpenRouterModelInfo model_info = 3;
-  string source = 4;
-}
-
-message AwsProviderConfig {
-  optional string authentication = 1;
-  optional string profile = 2;
-  optional string access_key = 3;
-  int64 access_key_length = 4;
-  optional string secret_key = 5;
-  int64 secret_key_length = 6;
-  optional string session_token = 7;
-  int64 session_token_length = 8;
-  optional string endpoint = 9;
-  optional bool use_prompt_cache = 10;
-  optional string custom_model_base_id = 11;
-  optional bool use_cross_region_inference = 12;
-  optional bool use_global_inference = 13;
-}
-
-message GcpProviderConfig {
-  optional string project_id = 1;
-  optional string region = 2;
-}
-
-message ProviderConfigResponse {
-  string provider_id = 1;
-  optional string base_url = 2;
-  optional string api_line = 3;
-  map<string, string> headers = 4;
-  optional string region = 5;
-  int64 api_key_length = 6;
-  bool has_access_token = 7;
-  bool has_refresh_token = 8;
-  optional string account_id = 9;
-  optional CommittedModelSelection plan_selection = 10;
-  optional CommittedModelSelection act_selection = 11;
-  optional AwsProviderConfig aws = 12;
-  optional GcpProviderConfig gcp = 13;
-}
-
-message CommittedModelSelection {
-  string provider_id = 1;
-  string model_id = 2;
-  OpenRouterModelInfo model_info = 3;
-}
-
-message ProviderReasoningPatch {
-  optional bool enabled = 1;
-  optional string effort = 2; // "none" | "low" | "medium" | "high" | "xhigh"
-  optional int32 budget_tokens = 3;
-}
-
-message WriteProviderConfigPatch {
-  optional string api_key = 1;
-  optional string base_url = 2;
-  map<string, string> headers = 3;
-  optional string region = 4;
-  optional string api_line = 5;
-  optional string access_token = 6;
-  optional string refresh_token = 7;
-  optional string account_id = 8;
-  optional ProviderReasoningPatch reasoning = 9;
-  optional bool clear_headers = 10;
-  optional AwsProviderConfig aws = 11;
-  optional GcpProviderConfig gcp = 12;
-}
-
-message WriteProviderConfigRequest {
-  string provider_id = 1;
-  WriteProviderConfigPatch patch = 2;
-}
-
-message CommitModelSelectionRequest {
-  string provider_id = 1;
-  string mode = 2;
-  string model_id = 3;
-  OpenRouterModelInfo model_info = 4;
-}
-
 message ClineRecommendedModel {
   string id = 1;
   string name = 2;

apps/vscode/proto/cline/remote_config.proto

@@ -1,32 +0,0 @@
-syntax = "proto3";
-
-package cline;
-
-import "cline/common.proto";
-
-option go_package = "github.com/cline/grpc-go/cline";
-option java_multiple_files = true;
-option java_package = "bot.cline.proto";
-
-enum RemoteConfigType {
-  RULE = 0;
-  WORKFLOW = 1;
-  SKILL = 2;
-}
-
-message RemoteConfigSetting {
-  RemoteConfigType type = 1;
-  string name = 2;
-  string content = 3;
-  bool enabled = 4;
-  bool locked = 5;
-}
-
-message RemoteConfigSettingsResponse {
-  repeated RemoteConfigSetting settings = 1;
-}
-
-service RemoteConfigService {
-  rpc getRemoteConfigSettings(Empty) returns (RemoteConfigSettingsResponse);
-  rpc toggleRemoteConfigSetting(StringRequest) returns (RemoteConfigSetting);
-}

apps/vscode/proto/cline/slash.proto

@@ -23,7 +23,7 @@ message SlashCommandInfo {
   string name = 1; // Command name without slash, e.g., "newtask", "smol"
   string description = 2; // Human-readable description
   string section = 3; // "default", "custom", or "cli"
-  bool cli_compatible = 4; // false for VS Code-only commands
+  bool cli_compatible = 4; // false for VS Code-only commands like explain-changes
 }
 
 // Response containing all available slash commands

apps/vscode/proto/cline/state.proto

@@ -250,6 +250,7 @@ message Settings {
   optional string default_terminal_profile = 137;
   optional int32 terminal_output_line_limit = 138;
   optional int32 max_consecutive_mistakes = 139;
+  optional bool strict_plan_mode_enabled = 141;
   optional bool yolo_mode_toggled = 142;
   optional bool use_auto_condense = 143;
   optional bool cline_web_tools_enabled = 144;
@@ -285,6 +286,7 @@ message Settings {
   optional string act_mode_cline_model_id = 180;
   optional OpenRouterModelInfo act_mode_cline_model_info = 181;
   optional bool show_feature_tips = 182;
+  optional bool lazy_teammate_mode_enabled = 183;
 }
 
 message State {
@@ -389,7 +391,6 @@ message UpdateSettingsRequest {
   reserved 15; // was openai_reasoning_effort (moved to mode-scoped reasoning effort)
   reserved 23; // was dictation_settings (dictation removed)
   reserved 38; // was skills_enabled (removed - now always enabled)
-  reserved 43; // was lazy_teammate_mode_enabled (removed)
 
   Metadata metadata = 1;
   optional ModelsApiConfiguration api_configuration = 2;
@@ -404,7 +405,7 @@ message UpdateSettingsRequest {
   optional int32 terminal_output_line_limit = 12;
   optional PlanActMode mode = 13;
   optional string preferred_language = 14;
-  reserved 16; // was strict_plan_mode_enabled (removed)
+  optional bool strict_plan_mode_enabled = 16;
   optional FocusChainSettings focus_chain_settings = 17;
   optional bool use_auto_condense = 18;
   optional string custom_prompt = 19;
@@ -428,6 +429,7 @@ message UpdateSettingsRequest {
   optional bool worktrees_enabled = 40;
   optional bool double_check_completion_enabled = 41;
   optional bool show_feature_tips = 42;
+  optional bool lazy_teammate_mode_enabled = 43;
 }
 
 message UpdateTerminalConnectionTimeoutRequest {
@@ -454,11 +456,6 @@ message OnboardingProgressRequest {
   optional string action = 2;
   optional bool completed = 3;
   optional string model_selected = 4;
-  optional string page = 5;
-  optional string page_variant = 6;
-  optional string user_type = 7;
-  optional int32 destination_step = 8;
-  optional string destination_page = 9;
 }
 
 message OnboardingModelGroup {

apps/vscode/proto/cline/task.proto

@@ -32,8 +32,6 @@ service TaskService {
   rpc getTaskHistory(GetTaskHistoryRequest) returns (TaskHistoryArray);
   // Sends a response to a previous ask operation
   rpc askResponse(AskResponseRequest) returns (Empty);
-  // Edits a previous user message, truncates following conversation, and regenerates
-  rpc editMessageAndRegenerate(EditMessageAndRegenerateRequest) returns (Empty);
   // Records task feedback (thumbs up/down)
   rpc taskFeedback(StringRequest) returns (Empty);
   // Shows task completion changes diff in a view
@@ -42,6 +40,8 @@ service TaskService {
   rpc executeQuickWin(ExecuteQuickWinRequest) returns (Empty);
   // Deletes all task history
   rpc deleteAllTaskHistory(EmptyRequest) returns (DeleteAllTaskHistoryCount);
+  // Explains changes with AI and adds inline comments to the diff view
+  rpc explainChanges(ExplainChangesRequest) returns (Empty);
 }
 
 // Request message for creating a new task
@@ -82,14 +82,12 @@ message GetTaskHistoryRequest {
   string search_query = 3;
   string sort_by = 4;
   bool current_workspace_only = 5;
-  int32 limit = 6;
-  int32 offset = 7;
 }
 
 // Response for task history
 message TaskHistoryArray {
   repeated TaskItem tasks = 1;
-  bool has_more = 2;
+  int32 total_count = 2;
 }
 
 // Task item details for history list
@@ -116,16 +114,6 @@ message AskResponseRequest {
   repeated string files = 5;
 }
 
-// Request for editing a past user message and regenerating the conversation after it
-message EditMessageAndRegenerateRequest {
-  Metadata metadata = 1;
-  int64 message_ts = 2;
-  string text = 3;
-  repeated string images = 4;
-  repeated string files = 5;
-  bool restore_workspace = 6;
-}
-
 // Request for executing a quick win task
 message ExecuteQuickWinRequest {
   Metadata metadata = 1;
@@ -137,3 +125,10 @@ message ExecuteQuickWinRequest {
 message DeleteAllTaskHistoryCount {
   int32 tasks_deleted = 1;
 }
+
+// Request for explaining changes with AI
+message ExplainChangesRequest {
+  Metadata metadata = 1;
+  // Timestamp of the completion message to explain changes for
+  int64 message_ts = 2;
+}

apps/vscode/proto/cline/ui.proto

@@ -67,6 +67,7 @@ enum ClineSay {
   INFO = 26;
   TASK_PROGRESS = 27;
   ERROR_RETRY = 28;
+  GENERATE_EXPLANATION = 29;
   HOOK_STATUS = 30;
   HOOK_OUTPUT_STREAM = 31;
   COMMAND_PERMISSION_DENIED = 32;
@@ -225,12 +226,6 @@ message ClineMessage {
   ClineAskNewTask ask_new_task = 21;
   ClineApiReqInfo api_req_info = 22;
   ClineModelInfo model_info = 23;
-
-  // Convergent-replica fields (see webview-message-state-design.md):
-  // seq = monotonic freshness (higher seq wins for the same ts/identity)
-  // epoch = conversation/replica fence (older epoch is dropped by the webview)
-  int64 seq = 24;
-  int64 epoch = 25;
 }
 
 message ShowWebviewEvent {

apps/vscode/scripts/build-proto.mjs

@@ -34,26 +34,9 @@ const GRPC_JS_OUT_DIR = path.resolve("src/generated/grpc-js")
 const NICE_JS_OUT_DIR = path.resolve("src/generated/nice-grpc")
 const DESCRIPTOR_OUT_DIR = path.resolve("dist-standalone/proto")
 
-// protoc invokes the ts-proto plugin as a child process, so it needs a path it can
-// directly execute. On POSIX the package's JS bin (with its shebang) works. On
-// Windows protoc cannot exec a bare .js or bun's `.bunx` shim ("%1 is not a valid
-// Win32 application"), and the package manager's `.cmd` shim location/name varies
-// (npm vs bun's hoisted store). To be package-manager-agnostic, generate a tiny
-// .cmd wrapper that runs the resolved plugin JS via `node`.
-function resolveTsProtoPlugin() {
-	const pluginJs = require.resolve("ts-proto/protoc-gen-ts_proto")
-	if (!isWindows) {
-		return pluginJs
-	}
-	const wrapperDir = path.resolve("dist-standalone")
-	fsSync.mkdirSync(wrapperDir, { recursive: true })
-	const wrapperPath = path.join(wrapperDir, "protoc-gen-ts_proto.cmd")
-	// %* forwards protoc's plugin args/stdio to the JS entry run under node.
-	fsSync.writeFileSync(wrapperPath, `@echo off\r\nnode "${pluginJs}" %*\r\n`)
-	return wrapperPath
-}
-
-const TS_PROTO_PLUGIN = resolveTsProtoPlugin()
+const TS_PROTO_PLUGIN = isWindows
+	? path.resolve("node_modules/.bin/protoc-gen-ts_proto.cmd") // Use the .bin directory path for Windows
+	: require.resolve("ts-proto/protoc-gen-ts_proto")
 
 const TS_PROTO_OPTIONS = [
 	"env=both",

apps/vscode/scripts/build-tests.js

@@ -1,7 +1,5 @@
 #!/usr/bin/env node
 const { execSync } = require("child_process")
-const fs = require("fs")
-const path = require("path")
 const esbuild = require("esbuild")
 
 const watch = process.argv.includes("--watch")
@@ -55,43 +53,7 @@ async function main() {
 	}
 }
 
-// tsc does not delete output for source/tests that were removed or are no longer
-// part of tsconfig.test.json. The VS Code test runner globs out/src/**/*.test.js,
-// so stale compiled tests can still run unless we clear the test build output first.
-fs.rmSync(path.join(__dirname, "..", "out", "src"), { recursive: true, force: true })
-fs.rmSync(path.join(__dirname, "..", "out", "packages"), { recursive: true, force: true })
-
-// Single source of truth for the bun-vs-integration test split: any *.test.ts that
-// imports from "bun:test" is owned by the bun runner (scripts/run-bun-unit-tests.ts)
-// and must NOT be compiled into the Node-based @vscode/test-cli `out/` tree (Node
-// cannot load the `bun:test` builtin, and these files use bun-only APIs like
-// `mock.module` / 3-arg `it`). Generate a tsconfig that excludes them so the
-// integration compile only ever sees mocha-owned tests.
-const projectRoot = path.join(__dirname, "..")
-const bunTestImport = /from\s+["']bun:test["']/
-function collectBunTestFiles(dir, acc) {
-	for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
-		if (entry.name === "node_modules") continue
-		const full = path.join(dir, entry.name)
-		if (entry.isDirectory()) {
-			collectBunTestFiles(full, acc)
-		} else if (entry.isFile() && entry.name.endsWith(".test.ts")) {
-			if (bunTestImport.test(fs.readFileSync(full, "utf-8"))) {
-				acc.push(path.relative(projectRoot, full).split(path.sep).join("/"))
-			}
-		}
-	}
-	return acc
-}
-const bunOwnedTests = collectBunTestFiles(path.join(projectRoot, "src"), [])
-// tsconfig.test.json is JSONC (contains comments); parse with json5 (a project dep).
-const JSON5 = require("json5")
-const baseTestConfig = JSON5.parse(fs.readFileSync(path.join(projectRoot, "tsconfig.test.json"), "utf-8"))
-baseTestConfig.exclude = [...(baseTestConfig.exclude ?? []), ...bunOwnedTests]
-const generatedConfigPath = path.join(projectRoot, "tsconfig.test.generated.json")
-fs.writeFileSync(generatedConfigPath, JSON.stringify(baseTestConfig, null, "\t"))
-
-execSync(`tsc -p ${JSON.stringify(generatedConfigPath)} --outDir out`, { encoding: "utf-8" })
+execSync("tsc -p ./tsconfig.test.json --outDir out", { encoding: "utf-8" })
 
 main().catch((e) => {
 	console.error(e)

apps/vscode/scripts/find-dead-src.mjs

@@ -1,129 +0,0 @@
-// Dead-source finder: uses esbuild's own bundle reachability (the same analysis
-// that drives tree-shaking + minification mangling) to compute which src/ files
-// are reachable from BOTH shipped entry points:
-//   - src/extension.ts            (VS Code extension host)
-//   - src/standalone/cline-core.ts (standalone host used by JetBrains + CLI)
-//
-// A src/*.ts file that is NOT in the union of metafile inputs for those two
-// builds is unreachable from any shipped entry => dead (modulo dynamic import()
-// of computed specifiers, which esbuild surfaces separately).
-//
-// Run: node scripts/find-dead-src.mjs
-
-import fs from "node:fs"
-import path from "node:path"
-import { fileURLToPath } from "node:url"
-import * as esbuild from "esbuild"
-import { glob } from "glob"
-
-const __dirname = path.dirname(fileURLToPath(import.meta.url))
-const root = path.resolve(__dirname, "..")
-
-const aliases = {
-	"@": path.join(root, "src"),
-	"@core": path.join(root, "src/core"),
-	"@integrations": path.join(root, "src/integrations"),
-	"@services": path.join(root, "src/services"),
-	"@shared": path.join(root, "src/shared"),
-	"@utils": path.join(root, "src/utils"),
-	"@packages": path.join(root, "src/packages"),
-}
-
-const aliasResolverPlugin = {
-	name: "alias-resolver",
-	setup(build) {
-		for (const [alias, aliasPath] of Object.entries(aliases)) {
-			const aliasRegex = new RegExp(`^${alias}($|/.*)`)
-			build.onResolve({ filter: aliasRegex }, (args) => {
-				const importPath = args.path.replace(alias, aliasPath)
-				const exts = [".ts", ".tsx", ".js", ".jsx"]
-				if (fs.existsSync(importPath)) {
-					const stats = fs.statSync(importPath)
-					if (stats.isDirectory()) {
-						for (const ext of exts) {
-							const idx = path.join(importPath, `index${ext}`)
-							if (fs.existsSync(idx)) return { path: idx }
-						}
-					} else {
-						return { path: importPath }
-					}
-				}
-				for (const ext of exts) {
-					if (fs.existsSync(`${importPath}${ext}`)) return { path: `${importPath}${ext}` }
-				}
-				return undefined
-			})
-		}
-	},
-}
-
-const common = {
-	bundle: true,
-	minify: false,
-	sourcemap: false,
-	logLevel: "silent",
-	format: "cjs",
-	platform: "node",
-	metafile: true,
-	write: false,
-	absWorkingDir: root,
-	tsconfig: path.join(root, "tsconfig.json"),
-	packages: "external",
-	plugins: [aliasResolverPlugin],
-	define: { "process.env.IS_DEV": "false", "process.env.IS_TEST": "false" },
-	banner: { js: "const _importMetaUrl=require('url').pathToFileURL(__filename)" },
-}
-
-async function inputsFor(entry, external) {
-	const r = await esbuild.build({ ...common, entryPoints: [entry], external })
-	return new Set(Object.keys(r.metafile.inputs).filter((f) => f.startsWith("src/") && /\.tsx?$/.test(f)))
-}
-
-const ext = await inputsFor("src/extension.ts", ["vscode"])
-const standalone = await inputsFor("src/standalone/cline-core.ts", [
-	"vscode",
-	"@grpc/reflection",
-	"grpc-health-check",
-	"better-sqlite3",
-])
-const live = new Set([...ext, ...standalone])
-
-// Third consumer: the webview (webview-ui/) is a separate Vite/React build that
-// imports extension code ONLY from src/shared (via "@shared/*" alias or relative
-// "../src/shared/*" paths). Any src/shared file referenced from webview-ui/src is
-// therefore live even if the extension-host/standalone bundles don't reach it.
-// Conservatively mark every src/shared file mentioned by the webview as live.
-const webviewFiles = await glob("webview-ui/src/**/*.{ts,tsx}", { cwd: root })
-const sharedMentionedByWebview = new Set()
-for (const wf of webviewFiles) {
-	const text = fs.readFileSync(path.join(root, wf), "utf8")
-	// Match @shared/X or .../src/shared/X import specifiers and map to src/shared/X
-	const re = /(?:@shared\/|src\/shared\/)([A-Za-z0-9_./-]+)/g
-	let m
-	while ((m = re.exec(text))) {
-		const rel = m[1].replace(/\.(ts|tsx|js|jsx)$/, "")
-		for (const cand of [`src/shared/${rel}.ts`, `src/shared/${rel}.tsx`, `src/shared/${rel}/index.ts`]) {
-			if (fs.existsSync(path.join(root, cand))) sharedMentionedByWebview.add(cand)
-		}
-	}
-}
-for (const f of sharedMentionedByWebview) live.add(f)
-console.log(`src/shared files referenced by webview: ${sharedMentionedByWebview.size}`)
-
-// All non-test, non-.d.ts source files on disk.
-const allSrc = (await glob("src/**/*.{ts,tsx}", { cwd: root }))
-	.filter((f) => !/\.test\.tsx?$/.test(f))
-	.filter((f) => !f.endsWith(".d.ts"))
-	.filter((f) => !f.includes("/__tests__/"))
-	.filter((f) => !f.startsWith("src/test/"))
-	.filter((f) => !f.startsWith("src/generated/")) // generated host glue
-	.filter((f) => !f.startsWith("src/dev/")) // dev-only tooling
-
-const dead = allSrc.filter((f) => !live.has(f)).sort()
-
-console.log(`extension inputs: ${ext.size}`)
-console.log(`standalone inputs: ${standalone.size}`)
-console.log(`union live src files: ${live.size}`)
-console.log(`candidate dead files: ${dead.length}`)
-fs.writeFileSync("/tmp/dead-src.json", JSON.stringify(dead, null, "\t"))
-console.log("--- dead candidates written to /tmp/dead-src.json ---")

apps/vscode/scripts/generate-state-proto.mjs

@@ -453,7 +453,7 @@ async function main() {
 	await fs.writeFile(STATE_PROTO_PATH, protoContent)
 	console.log(`Updated ${STATE_PROTO_PATH}`)
 
-	console.log("\nGeneration complete! Run 'bun run protos' to regenerate TypeScript from protos.")
+	console.log("\nGeneration complete! Run 'npm run protos' to regenerate TypeScript from protos.")
 }
 
 main().catch((error) => {

apps/vscode/scripts/interactive-playwright.ts

@@ -1,4 +1,4 @@
-#!/usr/bin/env bun
+#!/usr/bin/env npx tsx
 
 /**
  * Interactive Playwright launcher for the Cline VS Code extension.
@@ -15,10 +15,10 @@
  *
  * Usage:
  *   1. (Optional) Build and install the e2e extension:
- *        bun run test:e2e:build
+ *        npm run test:e2e:build
  *
  *   2. From the repo root, start the interactive session:
- *        bun run test:e2e:ui
+ *        npm run test:e2e:ui
  *
  *   3. VS Code will launch with the Cline extension loaded and gRPC recording enabled.
  *

apps/vscode/scripts/package-standalone.mjs

@@ -47,13 +47,8 @@ async function installNodeDependencies() {
 
 	await cpr(RUNTIME_DEPS_DIR, BUILD_DIR)
 
-	// This is an ISOLATED runtime install inside the standalone distribution
-	// directory (dist-standalone), driven by the "cline-core" runtime-files
-	// manifest — it is NOT part of the monorepo workspace install. TARGET_NODE_VERSION
-	// and the prebuild-install calls below target the Node ABI of the bundled
-	// runtime (matching the JetBrains-packaged Node), not the build tooling.
-	console.log("Running bun install in distribution directory...")
-	execSync("bun install", { stdio: "inherit", cwd: BUILD_DIR })
+	console.log("Running npm install in distribution directory...")
+	execSync("npm install", { stdio: "inherit", cwd: BUILD_DIR })
 
 	// Move the vscode directory into node_modules.
 	// It can't be installed using npm because it will create a symlink which cannot be unzipped correctly on windows.
@@ -97,10 +92,7 @@ async function packageAllBinaryDeps() {
 			const dest = path.join(binaryDir, module)
 			await cpr(src, dest)
 
-			// Download the binary libs.
-			// `--target=${TARGET_NODE_VERSION}` selects the Node ABI of the bundled
-			// standalone runtime (NOT the bun/build tooling) so the prebuilt native
-			// `.node` binaries load in the Node that runs cline-core.
+			// Download the binary libs
 			const v = IS_VERBOSE ? "--verbose" : ""
 			const cmd = `npx prebuild-install --platform=${platform} --arch=${arch} --target=${TARGET_NODE_VERSION} ${v}`
 			log_verbose(`${module}: ${cmd}`)

apps/vscode/scripts/publish-marketplace.mjs

@@ -37,16 +37,13 @@ process.on("SIGINT", cleanupOnSignal(130))
 process.on("SIGTERM", cleanupOnSignal(143))
 
 try {
-	// --no-dependencies: the extension is fully esbuild-bundled into dist/extension.js,
-	// so vsce must not walk node_modules (the @cline/* workspace symlinks point out of
-	// the package and would drag the whole monorepo into the VSIX).
-	const vsceArgs = ["publish", "--no-dependencies", "--allow-package-secrets", "sendgrid"]
+	const vsceArgs = ["publish", "--allow-package-secrets", "sendgrid"]
 	if (isPrerelease) {
 		vsceArgs.push("--pre-release")
 	}
 	execFileSync("vsce", vsceArgs, { stdio: "inherit" })
 
-	const ovsxArgs = ["ovsx", "publish", "--no-dependencies"]
+	const ovsxArgs = ["ovsx", "publish"]
 	if (isPrerelease) {
 		ovsxArgs.push("--pre-release")
 	}

apps/vscode/scripts/publish-nightly.mjs

@@ -35,9 +35,9 @@
  *   least as often as the scheduled release nightly runs.
  *
  * Usage:
- *   bun run publish:marketplace:nightly                    # release channel
- *   bun run publish:marketplace:nightly -- --pre-release   # pre-release channel
- *   bun run publish:marketplace:nightly -- --dry-run       # package only
+ *   npm run publish:marketplace:nightly                    # release channel
+ *   npm run publish:marketplace:nightly -- --pre-release   # pre-release channel
+ *   npm run publish:marketplace:nightly -- --dry-run       # package only
  *
  * Environment variables:
  *   VSCE_PAT  - Personal Access Token for VS Code Marketplace
@@ -388,9 +388,6 @@ class NightlyPublisher {
 		const args = [
 			"package",
 			...(isPreRelease ? ["--pre-release"] : []),
-			// The extension is fully esbuild-bundled, so vsce must not walk node_modules
-			// (the @cline/* workspace symlinks point outside the package).
-			"--no-dependencies",
 			"--no-update-package-json",
 			"--no-git-tag-version",
 			"--allow-package-secrets",
@@ -582,7 +579,7 @@ if (showHelp) {
 Nightly publish script for VS Code extension
 
 Usage:
-  bun run publish:marketplace:nightly [options]
+  npm run publish:marketplace:nightly [options]
 
 Options:
   --pre-release    Publish to the pre-release channel of cline-nightly.
@@ -596,10 +593,10 @@ Environment variables:
   OVSX_PAT         Personal Access Token for OpenVSX Registry
 
 Examples:
-  bun run publish:marketplace:nightly                      # Release channel publish
-  bun run publish:marketplace:nightly -- --pre-release     # Pre-release channel publish
-  bun run publish:marketplace:nightly -- --dry-run         # Package only
-  VSCE_PAT="token" bun run publish:marketplace:nightly     # Publish to VS Code only
+  npm run publish:marketplace:nightly                      # Release channel publish
+  npm run publish:marketplace:nightly -- --pre-release     # Pre-release channel publish
+  npm run publish:marketplace:nightly -- --dry-run         # Package only
+  VSCE_PAT="token" npm run publish:marketplace:nightly     # Publish to VS Code only
 `)
 	process.exit(0)
 }

apps/vscode/scripts/run-bun-tests.ts

@@ -1,80 +0,0 @@
-#!/usr/bin/env bun
-
-import { spawn } from "node:child_process"
-import path from "node:path"
-/**
- * Runner for the SDK-adapter + model-catalog `bun test` suites (the same set
- * `vitest.config.ts` covers; `test:vitest` runs them under vitest).
- *
- * Why a script instead of a bare `bun test <globs>`:
- *
- *  1. Curated include set. These suites are an explicit list (see
- *     INCLUDE_PATTERNS, kept in sync with `vitest.config.ts` `test.include`),
- *     not the whole tree, so the node-side unit and @vscode/test-cli suites are
- *     not pulled in. `bun test`'s positional args don't expand `**` the way we
- *     need, so we resolve the globs ourselves with bun's `Glob`.
- *
- *  2. One process per file. `bun test` runs all files in a single process by
- *     default, so `mock.module(...)` registrations leak between files — suites
- *     mocking the same specifier with different shapes (e.g.
- *     `@/core/storage/StateManager`, `@cline/core`) clobber each other.
- *     `--parallel` runs each file in its own worker process, giving each a fresh
- *     module registry.
- *
- * Usage:
- *   bun scripts/run-bun-tests.ts            # run the curated set, isolated
- *   bun scripts/run-bun-tests.ts --list     # print the resolved file list only
- */
-import { Glob } from "bun"
-
-// Mirror of vitest.config.ts `test.include`. Keep these in sync.
-const INCLUDE_PATTERNS = [
-	"src/sdk/**/*.test.ts",
-	"src/shared/vsCodeSelectorUtils.test.ts",
-	"src/core/storage/remote-config/**/*.test.ts",
-	"src/shared/model-catalog/provider-helpers.test.ts",
-	"src/core/controller/models/__tests__/providerCatalogHandlers.test.ts",
-	"src/core/controller/models/__tests__/providerSwitchNormalization.test.ts",
-	"src/core/controller/models/__tests__/resolveModelInfo.test.ts",
-	"src/core/controller/models/__tests__/providerCatalogSmoke.test.ts",
-	"src/core/controller/models/__tests__/refreshClineRecommendedModels.test.ts",
-]
-
-const projectRoot = path.resolve(import.meta.dir, "..")
-
-async function resolveFiles(): Promise<string[]> {
-	const seen = new Set<string>()
-	for (const pattern of INCLUDE_PATTERNS) {
-		const glob = new Glob(pattern)
-		for await (const match of glob.scan({ cwd: projectRoot, onlyFiles: true })) {
-			seen.add(match)
-		}
-	}
-	return [...seen].sort()
-}
-
-async function main(): Promise<void> {
-	const files = await resolveFiles()
-	if (files.length === 0) {
-		console.error("run-bun-tests: no test files matched the include patterns")
-		process.exit(1)
-	}
-
-	const passthrough = process.argv.slice(2)
-	if (passthrough.includes("--list")) {
-		console.log(files.join("\n"))
-		return
-	}
-
-	const args = ["test", "--parallel", ...passthrough.filter((arg) => arg !== "--list"), ...files]
-	const child = spawn("bun", args, { cwd: projectRoot, stdio: "inherit" })
-	child.on("exit", (code, signal) => {
-		if (signal) {
-			process.kill(process.pid, signal)
-			return
-		}
-		process.exit(code ?? 1)
-	})
-}
-
-void main()

apps/vscode/scripts/run-bun-unit-tests.ts

@@ -1,198 +0,0 @@
-#!/usr/bin/env bun
-
-import path from "node:path"
-/**
- * Runner for the node-side `bun test` unit suites.
- *
- * A test file belongs to this runner iff it imports from "bun:test" (files that
- * need the real VS Code extension host import from "mocha" and run under
- * @vscode/test-cli instead). We glob all `*.test.ts` and keep only the
- * bun:test ones; the SDK/model-catalog suites listed in IGNORED run through
- * `run-bun-tests.ts`, so they're skipped here to avoid double-running.
- *
- * Why one process per file: `bun test --parallel <allFiles>` reuses a pool of
- * worker processes, and `mock.module(...)` registrations accumulate across files
- * sharing a worker. Suites that mock the same specifier with different shapes
- * (e.g. `@core/storage/disk`, `@cline/core`, `fs/promises`, `os`) then clobber
- * each other and fail only at scale. Spawning one `bun test` process per file
- * (bounded by a small concurrency pool, via `Bun.spawn`) gives each file a fresh
- * module registry.
- *
- * Usage:
- *   bun scripts/run-bun-unit-tests.ts            # run the suite, isolated
- *   bun scripts/run-bun-unit-tests.ts --list     # print the resolved file list
- *   bun scripts/run-bun-unit-tests.ts --all      # include ELECTRON_HOST_ONLY
- *   bun scripts/run-bun-unit-tests.ts -c 6       # concurrency (default 4)
- */
-import { Glob } from "bun"
-
-const projectRoot = path.resolve(import.meta.dir, "..")
-
-// A file runs under `bun test` iff it imports "bun:test"; mocha-owned files are
-// skipped by the import filter in resolveFiles().
-const INCLUDE_PATTERNS = ["src/**/*.test.ts"]
-const BUN_TEST_IMPORT = /from\s+["']bun:test["']/
-
-// SDK + model-catalog suites run through `run-bun-tests.ts`; skip them here so
-// they aren't run twice.
-const IGNORED = new Set<string>([
-	"src/core/controller/models/__tests__/providerCatalogHandlers.test.ts",
-	"src/core/controller/models/__tests__/providerCatalogSmoke.test.ts",
-	"src/core/controller/models/__tests__/providerSwitchNormalization.test.ts",
-	"src/core/controller/models/__tests__/resolveModelInfo.test.ts",
-	"src/core/controller/models/__tests__/refreshClineRecommendedModels.test.ts",
-])
-
-// Files that require the real VSCode Electron host (@vscode/test-cli). Excluded
-// by default; they continue to run under @vscode/test-cli.
-const ELECTRON_HOST_ONLY = new Set<string>([])
-
-async function resolveFiles(includeHostOnly: boolean): Promise<string[]> {
-	const seen = new Set<string>()
-	for (const pattern of INCLUDE_PATTERNS) {
-		const glob = new Glob(pattern)
-		for await (const match of glob.scan({ cwd: projectRoot, onlyFiles: true })) {
-			const normalized = match.split(path.sep).join("/")
-			if (IGNORED.has(normalized)) {
-				continue
-			}
-			if (!includeHostOnly && ELECTRON_HOST_ONLY.has(normalized)) {
-				continue
-			}
-			// Only bun-runner-owned files (those importing "bun:test"). Files still on
-			// the @vscode/test-cli Electron host import from "mocha" and are skipped.
-			const source = await Bun.file(path.join(projectRoot, normalized)).text()
-			if (!BUN_TEST_IMPORT.test(source)) {
-				continue
-			}
-			seen.add(normalized)
-		}
-	}
-	return [...seen].sort()
-}
-
-type FileResult = {
-	file: string
-	code: number
-	pass: number
-	fail: number
-	output: string
-}
-
-// `bun test` prints its summary as e.g. " 12 pass\n  0 fail".
-function parseCounts(output: string): { pass: number; fail: number } {
-	let pass = 0
-	let fail = 0
-	for (const m of output.matchAll(/^\s*(\d+)\s+pass\b/gm)) {
-		pass += Number(m[1])
-	}
-	for (const m of output.matchAll(/^\s*(\d+)\s+fail\b/gm)) {
-		fail += Number(m[1])
-	}
-	return { pass, fail }
-}
-
-const PER_FILE_TIMEOUT_MS = 120_000
-
-async function runOne(file: string): Promise<FileResult> {
-	const proc = Bun.spawn(["bun", "test", file], {
-		cwd: projectRoot,
-		stdout: "pipe",
-		stderr: "pipe",
-		env: { ...process.env, FORCE_COLOR: "0" },
-	})
-	// Guard against a single hung file stalling the whole pool: kill it after a
-	// generous per-file budget and surface it as a failure.
-	let timedOut = false
-	const timer = setTimeout(() => {
-		timedOut = true
-		proc.kill()
-	}, PER_FILE_TIMEOUT_MS)
-	const [stdout, stderr, code] = await Promise.all([
-		new Response(proc.stdout).text(),
-		new Response(proc.stderr).text(),
-		proc.exited,
-	])
-	clearTimeout(timer)
-	const output = stdout + stderr + (timedOut ? `\n[runner] TIMEOUT after ${PER_FILE_TIMEOUT_MS}ms — killed\n` : "")
-	const { pass, fail } = parseCounts(output)
-	// A nonzero exit with no parsed counts (load/parse error, timeout) must count
-	// as a failure so the gate cannot pass silently.
-	const effectiveFail = timedOut && fail === 0 ? Math.max(fail, 1) : fail
-	return { file, code, pass, fail: effectiveFail, output }
-}
-
-async function runPool(files: string[], concurrency: number): Promise<FileResult[]> {
-	const results: FileResult[] = []
-	let next = 0
-	const launch = async (): Promise<void> => {
-		while (next < files.length) {
-			const file = files[next++]
-			const result = await runOne(file)
-			results.push(result)
-			const failed = result.fail > 0 || result.code !== 0
-			const status = failed ? "FAIL" : "ok"
-			const counts = `${result.pass} pass / ${result.fail} fail`
-			process.stdout.write(`[${results.length}/${files.length}] ${status.padEnd(4)} ${counts.padEnd(20)} ${file}\n`)
-			if (failed) {
-				process.stdout.write(result.output.trimEnd() + "\n")
-			}
-		}
-	}
-	const workers: Promise<void>[] = []
-	for (let i = 0; i < Math.min(concurrency, files.length); i++) {
-		workers.push(launch())
-	}
-	await Promise.all(workers)
-	return results
-}
-
-function parseConcurrency(argv: string[]): number {
-	const flagIdx = argv.findIndex((a) => a === "-c" || a === "--concurrency")
-	if (flagIdx !== -1 && argv[flagIdx + 1]) {
-		const n = Number(argv[flagIdx + 1])
-		if (Number.isFinite(n) && n > 0) {
-			return Math.floor(n)
-		}
-	}
-	return 4
-}
-
-async function main(): Promise<void> {
-	const passthrough = process.argv.slice(2)
-	const includeHostOnly = passthrough.includes("--all")
-	const files = await resolveFiles(includeHostOnly)
-	if (files.length === 0) {
-		console.error("run-bun-unit-tests: no test files matched")
-		process.exit(1)
-	}
-
-	if (passthrough.includes("--list")) {
-		console.log(files.join("\n"))
-		return
-	}
-
-	const concurrency = parseConcurrency(passthrough)
-	const started = Date.now()
-	console.log(`Running ${files.length} unit test files, isolated (concurrency ${concurrency})…\n`)
-
-	const results = await runPool(files, concurrency)
-
-	const totalPass = results.reduce((sum, r) => sum + r.pass, 0)
-	const totalFail = results.reduce((sum, r) => sum + r.fail, 0)
-	const failedFiles = results.filter((r) => r.fail > 0 || r.code !== 0).sort((a, b) => a.file.localeCompare(b.file))
-	const elapsed = ((Date.now() - started) / 1000).toFixed(1)
-
-	console.log("\n──────────────────────────────────────────────")
-	console.log(`Files: ${results.length}   Pass: ${totalPass}   Fail: ${totalFail}   Time: ${elapsed}s`)
-	if (failedFiles.length > 0) {
-		console.log(`\nFailing files (${failedFiles.length}):`)
-		for (const r of failedFiles) {
-			console.log(`  ${r.file}  (${r.pass} pass / ${r.fail} fail, exit ${r.code})`)
-		}
-		process.exit(1)
-	}
-	console.log("All unit test files passed.")
-}
-
-void main()

apps/vscode/scripts/run-extension-host.sh

@@ -18,11 +18,11 @@ fi
 
 # Step 1: Build protos (everything depends on this)
 echo "Building protos..."
-bun run protos || { echo "Protos build failed"; exit 1; }
+npm run protos || { echo "Protos build failed"; exit 1; }
 
 # Step 2: Build webview once
 echo "Building webview..."
-bun run build:webview || { echo "Webview build failed"; exit 1; }
+npm run build:webview || { echo "Webview build failed"; exit 1; }
 
 # Step 3: Kill existing session if one is running
 tmux kill-session -t "$SESSION" 2>/dev/null
@@ -44,9 +44,9 @@ tmux select-layout -t "$SESSION" even-horizontal
 # Ctrl+C kills the whole session
 tmux bind-key -T root C-c kill-session
 
-tmux send-keys -t "$SESSION:0.0" "bun run watch:esbuild" Enter
-tmux send-keys -t "$SESSION:0.1" "bun run watch:tsc" Enter
-tmux send-keys -t "$SESSION:0.2" "bun run dev:webview" Enter
+tmux send-keys -t "$SESSION:0.0" "npm run watch:esbuild" Enter
+tmux send-keys -t "$SESSION:0.1" "npm run watch:tsc" Enter
+tmux send-keys -t "$SESSION:0.2" "npm run dev:webview" Enter
 tmux send-keys -t "$SESSION:0.3" "while [ ! -f '$WORKSPACE/dist/extension.js' ]; do sleep 0.5; done && echo 'Launching Extension Host...' && code --extensionDevelopmentPath='$WORKSPACE' --disable-workspace-trust --disable-extension saoudrizwan.claude-dev --disable-extension saoudrizwan.cline-nightly '$WORKSPACE' && echo 'Extension Host launched.'" Enter
 
 # Attach to the session

apps/vscode/scripts/test-hostbridge-server.ts

@@ -1,4 +1,4 @@
-#!/usr/bin/env bun
+#!/usr/bin/env npx tsx
 import * as grpc from "@grpc/grpc-js"
 import { ReflectionService } from "@grpc/reflection"
 import * as health from "grpc-health-check"
@@ -87,12 +87,6 @@ function createMockService<T extends grpc.UntypedServiceImplementation>(serviceN
 						})
 						return
 
-					case "openExternal":
-						simulateOAuthBrowserCallback(call.request?.value || "")
-							.then(() => callback(null, {}))
-							.catch((error) => callback(error))
-						return
-
 					case "getWebviewHtml":
 						callback(null, {
 							html: "<html><body>Fake Webview</body></html>",
@@ -149,41 +143,6 @@ function createMockService<T extends grpc.UntypedServiceImplementation>(serviceN
 	return new Proxy({} as T, handler)
 }
 
-async function simulateOAuthBrowserCallback(urlString: string): Promise<void> {
-	let url: URL
-	try {
-		url = new URL(urlString)
-	} catch {
-		return
-	}
-
-	if (!isLoopbackHost(url.hostname) || url.pathname !== "/api/v1/auth/authorize") {
-		return
-	}
-
-	const callbackUrl = url.searchParams.get("callback_url") ?? url.searchParams.get("redirect_uri")
-	if (!callbackUrl) {
-		return
-	}
-
-	const callback = new URL(callbackUrl)
-	if (!isLoopbackHost(callback.hostname) || callback.pathname !== "/auth") {
-		return
-	}
-
-	callback.searchParams.set("code", "test-personal-token")
-	callback.searchParams.set("provider", "cline")
-
-	const response = await fetch(callback.toString())
-	if (!response.ok) {
-		throw new Error(`Mock OAuth callback failed: ${response.status} ${response.statusText}`)
-	}
-}
-
-function isLoopbackHost(hostname: string): boolean {
-	return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1"
-}
-
 if (require.main === module) {
 	startTestHostBridgeServer().catch((err) => {
 		console.error("Failed to start test host bridge server:", err)

apps/vscode/scripts/test-standalone-core-api-server.ts

@@ -1,4 +1,4 @@
-#!/usr/bin/env bun
+#!/usr/bin/env npx tsx
 
 /**
  * Simple Cline gRPC Server
@@ -7,13 +7,13 @@
  * without requiring the full installation, while automatically mocking all external services. Simply run:
  *
  *   # One-time setup (generates protobuf files)
- *	 bun run compile-standalone
- *   bun run test:sca-server
+ *	 npm run compile-standalone
+ *   npm run test:sca-server
  *
  * The following components are started automatically:
  *   1. HostBridge test server
  *   2. ClineApiServerMock (mock implementation of the Cline API)
- *   3. SDK WorkOS device-auth flow, with WorkOS fetches mocked by testing-platform-workos-fetch-mock.cjs
+ *   3. AuthServiceMock (activated if E2E_TEST="true")
  *
  * Environment Variables for Customization:
  *   PROJECT_ROOT - Override project root directory (default: parent of scripts dir)
@@ -22,7 +22,7 @@
  *   PROTOBUS_PORT - gRPC server port (default: 26040)
  *   HOSTBRIDGE_PORT - HostBridge server port (default: 26041)
  *   WORKSPACE_DIR - Working directory (default: current directory)
- *   E2E_TEST - Enable legacy mock auth mode (default: false)
+ *   E2E_TEST - Enable E2E test mode (default: true)
  *   CLINE_ENVIRONMENT - Environment setting (default: local)
  *
  * Ideal for local development, testing, or lightweight E2E scenarios.
@@ -38,7 +38,7 @@ import { ClineApiServerMock } from "../src/test/e2e/fixtures/server/index"
 const PROTOBUS_PORT = process.env.PROTOBUS_PORT || "26040"
 const HOSTBRIDGE_PORT = process.env.HOSTBRIDGE_PORT || "26041"
 const WORKSPACE_DIR = process.env.WORKSPACE_DIR || process.cwd()
-const E2E_TEST = process.env.E2E_TEST || "false"
+const E2E_TEST = process.env.E2E_TEST || "true"
 const CLINE_ENVIRONMENT = process.env.CLINE_ENVIRONMENT || "local"
 const USE_C8 = process.env.USE_C8 === "true"
 
@@ -66,7 +66,7 @@ async function main(): Promise<void> {
 		console.error("  CLINE_DIST_DIR - Override distribution directory")
 		console.error("  CLINE_CORE_FILE - Override core file name")
 		console.error("")
-		console.error("To build the standalone version, run: bun run compile-standalone")
+		console.error("To build the standalone version, run: npm run compile-standalone")
 		process.exit(1)
 	}
 
@@ -83,8 +83,8 @@ async function main(): Promise<void> {
 	const clineTestWorkspace = mkdtempSync(path.join(os.tmpdir(), "cline-test-workspace-"))
 
 	console.log("Starting HostBridge test server...")
-	const hostbridge: ChildProcess = spawn("bun", [path.join(__dirname, "test-hostbridge-server.ts")], {
-		stdio: "inherit",
+	const hostbridge: ChildProcess = spawn("npx", ["tsx", path.join(__dirname, "test-hostbridge-server.ts")], {
+		stdio: "pipe",
 		env: {
 			...process.env,
 			TEST_HOSTBRIDGE_WORKSPACE_DIR: clineTestWorkspace,
@@ -115,16 +115,13 @@ async function main(): Promise<void> {
 
 	const covDir = path.join(projectRoot, `coverage/coverage-core-${PROTOBUS_PORT}`)
 
-	const workosFetchMockPath = path.join(projectRoot, "scripts", "testing-platform-workos-fetch-mock.cjs")
-	const baseArgs = ["--enable-source-maps", "--require", workosFetchMockPath, path.join(distDir, "cline-core.js")]
+	const baseArgs = ["--enable-source-maps", path.join(distDir, "cline-core.js")]
 
-	const c8Bin = path.join(projectRoot, "node_modules", ".bin", process.platform === "win32" ? "c8.cmd" : "c8")
-	const spawnCommand = USE_C8 ? c8Bin : "node"
-	const spawnArgs = USE_C8 ? ["--report-dir", covDir, "node", ...baseArgs] : baseArgs
+	const spawnArgs = USE_C8 ? ["c8", "--report-dir", covDir, "node", ...baseArgs] : ["node", ...baseArgs]
 
 	console.log(`Starting Cline Core Service... (useC8=${USE_C8})`)
 
-	const coreService: ChildProcess = spawn(spawnCommand, spawnArgs, {
+	const coreService: ChildProcess = spawn("npx", spawnArgs, {
 		cwd: projectRoot,
 		env: {
 			...process.env,

apps/vscode/scripts/testing-platform-orchestrator.ts

@@ -1,15 +1,15 @@
-#!/usr/bin/env bun
+#!/usr/bin/env npx tsx
 /**
  * Test Orchestrator
  *
  * Automates server lifecycle for running spec files against the standalone server.
  *
  * Prerequisites:
- *   Build standalone first: `bun run compile-standalone`
+ *   Build standalone first: `npm run compile-standalone`
  *
  * Usage:
- *   - Single file:   `bun run test:tp-orchestrator path/to/spec.json`
- *   - All specs dir: `bun run test:tp-orchestrator tests/specs`
+ *   - Single file:   `npm run test:tp-orchestrator path/to/spec.json`
+ *   - All specs dir: `npm run test:tp-orchestrator tests/specs`
  *
  * Flags:
  *   --server-logs        Show server logs (hidden by default)
@@ -29,7 +29,7 @@ import kill from "tree-kill"
 let showServerLogs = false
 let fix = false
 let coverage = false
-const WAIT_SERVER_DEFAULT_TIMEOUT = 60000
+const WAIT_SERVER_DEFAULT_TIMEOUT = 15000
 const usedPorts = new Set<number>()
 
 /**
@@ -94,10 +94,8 @@ async function startServer(): Promise<{ server: ChildProcess; grpcPort: string }
 	const grpcPort = (await getAvailablePort()).toString()
 	const hostbridgePort = (await getAvailablePort()).toString()
 
-	const server = spawn("bun", ["scripts/test-standalone-core-api-server.ts"], {
-		// When logs are hidden, ignore stdio instead of piping it without a reader:
-		// an unread pipe can fill and stall server startup/shutdown in CI.
-		stdio: showServerLogs ? "inherit" : "ignore",
+	const server = spawn("npx", ["tsx", "scripts/test-standalone-core-api-server.ts"], {
+		stdio: showServerLogs ? "inherit" : "pipe",
 		env: {
 			...process.env,
 			PROTOBUS_PORT: grpcPort,
@@ -106,50 +104,29 @@ async function startServer(): Promise<{ server: ChildProcess; grpcPort: string }
 		},
 	})
 
-	try {
-		// Wait for either the server to become ready or fail on spawn error.
-		await Promise.race([
-			waitForPort(Number(grpcPort), "127.0.0.1", WAIT_SERVER_DEFAULT_TIMEOUT),
-			new Promise((_, reject) => server.once("error", reject)),
-			new Promise((_, reject) =>
-				server.once("exit", (code, signal) => reject(new Error(`Server exited before ready: ${code ?? signal}`))),
-			),
-		])
-	} catch (error) {
-		await stopServer(server)
-		throw error
-	}
+	// Wait for either the server to become ready or fail on spawn error
+	await Promise.race([
+		waitForPort(Number(grpcPort), "127.0.0.1", WAIT_SERVER_DEFAULT_TIMEOUT),
+		new Promise((_, reject) => server.once("error", reject)),
+	])
 
 	return { server, grpcPort }
 }
 
 function stopServer(server: ChildProcess): Promise<void> {
 	return new Promise((resolve) => {
-		if (!server.pid || server.exitCode !== null || server.signalCode !== null) return resolve()
+		if (!server.pid) return resolve()
 
-		let settled = false
-		const finish = () => {
-			if (!settled) {
-				settled = true
-				resolve()
-			}
-		}
-
-		server.once("exit", finish)
 		kill(server.pid, "SIGINT", (err) => {
 			if (err) console.warn("Failed to kill server process:", err)
+			server.once("exit", () => resolve())
 		})
-		setTimeout(() => {
-			if (!settled && server.pid) {
-				kill(server.pid, "SIGKILL", finish)
-			}
-		}, 5000).unref()
 	})
 }
 
 function runTestingPlatform(specFile: string, grpcPort: string): Promise<void> {
 	return new Promise((resolve, reject) => {
-		const testProcess = spawn("bun", ["index.ts", specFile, ...(fix ? ["--fix"] : [])], {
+		const testProcess = spawn("npx", ["ts-node", "index.ts", specFile, ...(fix ? ["--fix"] : [])], {
 			cwd: path.join(process.cwd(), "testing-platform"),
 			stdio: "inherit",
 			env: {
@@ -232,7 +209,7 @@ async function main() {
 
 	if (!inputPath) {
 		console.error(
-			"Usage: bun scripts/testing-platform-orchestrator.ts <spec-file-or-folder> [--count=N] [--server-logs] [--fix] [--coverage]",
+			"Usage: npx tsx scripts/testing-platform-orchestrator.ts <spec-file-or-folder> [--count=N] [--server-logs] [--fix] [--coverage]",
 		)
 		process.exit(1)
 	}

apps/vscode/scripts/testing-platform-workos-fetch-mock.cjs

@@ -1,56 +0,0 @@
-// Preload used by the standalone testing platform.
-// It makes the SDK WorkOS device-auth flow deterministic and fully local while
-// leaving production auth code on the same device-auth path used by users.
-
-const originalFetch = globalThis.fetch?.bind(globalThis)
-
-const WORKOS_ORIGIN = "https://api.workos.com"
-const DEVICE_CODE = "test-device-code"
-const USER_CODE = "PTBC-TXTP"
-const ACCESS_TOKEN = "test-personal-token"
-const REFRESH_TOKEN = "test-personal-token_refresh"
-
-function jsonResponse(body, init = {}) {
-	return new Response(JSON.stringify(body), {
-		status: init.status ?? 200,
-		headers: { "Content-Type": "application/json", ...(init.headers ?? {}) },
-	})
-}
-
-function inputUrl(input) {
-	if (typeof input === "string") return input
-	if (input instanceof URL) return input.toString()
-	if (input && typeof input === "object" && "url" in input) return input.url
-	return String(input)
-}
-
-globalThis.fetch = async (input, init) => {
-	const urlString = inputUrl(input)
-	let url
-	try {
-		url = new URL(urlString)
-	} catch {
-		return originalFetch(input, init)
-	}
-
-	if (url.origin === WORKOS_ORIGIN && url.pathname === "/user_management/authorize/device") {
-		return jsonResponse({
-			device_code: DEVICE_CODE,
-			user_code: USER_CODE,
-			verification_uri: "https://login.workos.test/device",
-			verification_uri_complete: `https://login.workos.test/device?user_code=${USER_CODE}`,
-			expires_in: 300,
-			interval: 1,
-		})
-	}
-
-	if (url.origin === WORKOS_ORIGIN && url.pathname === "/user_management/authenticate") {
-		return jsonResponse({
-			access_token: ACCESS_TOKEN,
-			refresh_token: REFRESH_TOKEN,
-			token_type: "Bearer",
-		})
-	}
-
-	return originalFetch(input, init)
-}

apps/vscode/src/__tests__/config.test.ts

@@ -0,0 +1,694 @@
+import { afterEach, beforeEach, describe, it } from "mocha"
+import "should"
+import fs from "fs/promises"
+import os from "os"
+import path from "path"
+import sinon from "sinon"
+import { ClineConfigurationError, ClineEndpoint, ClineEnv, Environment } from "../config"
+
+describe("ClineEndpoint configuration", () => {
+	let sandbox: sinon.SinonSandbox
+	let tempDir: string
+	let originalHomedir: typeof os.homedir
+
+	beforeEach(async () => {
+		sandbox = sinon.createSandbox()
+		tempDir = path.join(os.tmpdir(), `config-test-${Date.now()}-${Math.random().toString(36).slice(2)}`)
+		await fs.mkdir(tempDir, { recursive: true })
+
+		// Create .cline directory
+		await fs.mkdir(path.join(tempDir, ".cline"), { recursive: true })
+
+		// Stub os.homedir to return our temp directory
+		originalHomedir = os.homedir
+		sandbox
+			.stub(os, "homedir")
+			.returns(tempDir)
+
+		// Reset the singleton state using internal method
+		;(ClineEndpoint as any)._instance = null
+		;(ClineEndpoint as any)._initialized = false
+		;(ClineEndpoint as any)._extensionFsPath = undefined
+	})
+
+	afterEach(async () => {
+		sandbox.restore()
+		// Reset singleton state
+		;(ClineEndpoint as any)._instance = null
+		;(ClineEndpoint as any)._initialized = false
+		try {
+			await fs.rm(tempDir, { recursive: true, force: true })
+		} catch {
+			// Ignore cleanup errors
+		}
+	})
+
+	describe("valid config parsing", () => {
+		it("should parse valid endpoints.json with all required fields", async () => {
+			const validConfig = {
+				appBaseUrl: "https://app.enterprise.com",
+				apiBaseUrl: "https://api.enterprise.com",
+				mcpBaseUrl: "https://mcp.enterprise.com",
+			}
+
+			await fs.writeFile(path.join(tempDir, ".cline", "endpoints.json"), JSON.stringify(validConfig), "utf8")
+
+			await ClineEndpoint.initialize(tempDir)
+
+			const config = ClineEndpoint.config
+			config.appBaseUrl.should.equal("https://app.enterprise.com")
+			config.apiBaseUrl.should.equal("https://api.enterprise.com")
+			config.mcpBaseUrl.should.equal("https://mcp.enterprise.com")
+			config.environment.should.equal(Environment.selfHosted)
+		})
+
+		it("should work without endpoints.json (standard mode)", async () => {
+			// No endpoints.json file exists
+
+			await ClineEndpoint.initialize(tempDir)
+
+			const config = ClineEndpoint.config
+			config.environment.should.not.equal(Environment.selfHosted)
+			// Should use production defaults
+			config.appBaseUrl.should.equal("https://app.cline.bot")
+			config.apiBaseUrl.should.equal("https://api.cline.bot")
+		})
+
+		it("should accept URLs with ports", async () => {
+			const validConfig = {
+				appBaseUrl: "http://localhost:3000",
+				apiBaseUrl: "http://localhost:7777",
+				mcpBaseUrl: "http://localhost:8080/mcp",
+			}
+
+			await fs.writeFile(path.join(tempDir, ".cline", "endpoints.json"), JSON.stringify(validConfig), "utf8")
+
+			await ClineEndpoint.initialize(tempDir)
+
+			const config = ClineEndpoint.config
+			config.appBaseUrl.should.equal("http://localhost:3000")
+			config.apiBaseUrl.should.equal("http://localhost:7777")
+			config.mcpBaseUrl.should.equal("http://localhost:8080/mcp")
+		})
+
+		it("should accept URLs with paths", async () => {
+			const validConfig = {
+				appBaseUrl: "https://proxy.enterprise.com/cline/app",
+				apiBaseUrl: "https://proxy.enterprise.com/cline/api",
+				mcpBaseUrl: "https://proxy.enterprise.com/cline/mcp",
+			}
+
+			await fs.writeFile(path.join(tempDir, ".cline", "endpoints.json"), JSON.stringify(validConfig), "utf8")
+
+			await ClineEndpoint.initialize(tempDir)
+
+			const config = ClineEndpoint.config
+			config.appBaseUrl.should.equal("https://proxy.enterprise.com/cline/app")
+		})
+	})
+
+	describe("invalid JSON handling", () => {
+		it("should throw ClineConfigurationError for invalid JSON syntax", async () => {
+			await fs.writeFile(path.join(tempDir, ".cline", "endpoints.json"), "{ invalid json }", "utf8")
+
+			try {
+				await ClineEndpoint.initialize(tempDir)
+				throw new Error("Should have thrown")
+			} catch (error: any) {
+				error.should.be.instanceof(ClineConfigurationError)
+				error.message.should.containEql("Invalid JSON")
+			}
+		})
+
+		it("should throw ClineConfigurationError for truncated JSON", async () => {
+			await fs.writeFile(path.join(tempDir, ".cline", "endpoints.json"), '{"appBaseUrl": "https://test.com"', "utf8")
+
+			try {
+				await ClineEndpoint.initialize(tempDir)
+				throw new Error("Should have thrown")
+			} catch (error: any) {
+				error.should.be.instanceof(ClineConfigurationError)
+				error.message.should.containEql("Invalid JSON")
+			}
+		})
+
+		it("should throw ClineConfigurationError for empty file", async () => {
+			await fs.writeFile(path.join(tempDir, ".cline", "endpoints.json"), "", "utf8")
+
+			try {
+				await ClineEndpoint.initialize(tempDir)
+				throw new Error("Should have thrown")
+			} catch (error: any) {
+				error.should.be.instanceof(ClineConfigurationError)
+			}
+		})
+
+		it("should throw ClineConfigurationError for non-object JSON", async () => {
+			await fs.writeFile(path.join(tempDir, ".cline", "endpoints.json"), '"just a string"', "utf8")
+
+			try {
+				await ClineEndpoint.initialize(tempDir)
+				throw new Error("Should have thrown")
+			} catch (error: any) {
+				error.should.be.instanceof(ClineConfigurationError)
+				error.message.should.containEql("must contain a JSON object")
+			}
+		})
+
+		it("should throw ClineConfigurationError for array JSON", async () => {
+			await fs.writeFile(path.join(tempDir, ".cline", "endpoints.json"), "[]", "utf8")
+
+			try {
+				await ClineEndpoint.initialize(tempDir)
+				throw new Error("Should have thrown")
+			} catch (error: any) {
+				error.should.be.instanceof(ClineConfigurationError)
+				// Arrays pass the object check but fail on required fields
+				error.message.should.containEql("Missing required field")
+			}
+		})
+
+		it("should throw ClineConfigurationError for null JSON", async () => {
+			await fs.writeFile(path.join(tempDir, ".cline", "endpoints.json"), "null", "utf8")
+
+			try {
+				await ClineEndpoint.initialize(tempDir)
+				throw new Error("Should have thrown")
+			} catch (error: any) {
+				error.should.be.instanceof(ClineConfigurationError)
+				error.message.should.containEql("must contain a JSON object")
+			}
+		})
+	})
+
+	describe("missing required fields", () => {
+		it("should throw ClineConfigurationError when appBaseUrl is missing", async () => {
+			const config = {
+				apiBaseUrl: "https://api.enterprise.com",
+				mcpBaseUrl: "https://mcp.enterprise.com",
+			}
+
+			await fs.writeFile(path.join(tempDir, ".cline", "endpoints.json"), JSON.stringify(config), "utf8")
+
+			try {
+				await ClineEndpoint.initialize(tempDir)
+				throw new Error("Should have thrown")
+			} catch (error: any) {
+				error.should.be.instanceof(ClineConfigurationError)
+				error.message.should.containEql('Missing required field "appBaseUrl"')
+			}
+		})
+
+		it("should throw ClineConfigurationError when apiBaseUrl is missing", async () => {
+			const config = {
+				appBaseUrl: "https://app.enterprise.com",
+				mcpBaseUrl: "https://mcp.enterprise.com",
+			}
+
+			await fs.writeFile(path.join(tempDir, ".cline", "endpoints.json"), JSON.stringify(config), "utf8")
+
+			try {
+				await ClineEndpoint.initialize(tempDir)
+				throw new Error("Should have thrown")
+			} catch (error: any) {
+				error.should.be.instanceof(ClineConfigurationError)
+				error.message.should.containEql('Missing required field "apiBaseUrl"')
+			}
+		})
+
+		it("should throw ClineConfigurationError when mcpBaseUrl is missing", async () => {
+			const config = {
+				appBaseUrl: "https://app.enterprise.com",
+				apiBaseUrl: "https://api.enterprise.com",
+			}
+
+			await fs.writeFile(path.join(tempDir, ".cline", "endpoints.json"), JSON.stringify(config), "utf8")
+
+			try {
+				await ClineEndpoint.initialize(tempDir)
+				throw new Error("Should have thrown")
+			} catch (error: any) {
+				error.should.be.instanceof(ClineConfigurationError)
+				error.message.should.containEql('Missing required field "mcpBaseUrl"')
+			}
+		})
+
+		it("should throw ClineConfigurationError when all fields are missing", async () => {
+			await fs.writeFile(path.join(tempDir, ".cline", "endpoints.json"), "{}", "utf8")
+
+			try {
+				await ClineEndpoint.initialize(tempDir)
+				throw new Error("Should have thrown")
+			} catch (error: any) {
+				error.should.be.instanceof(ClineConfigurationError)
+				error.message.should.containEql("Missing required field")
+			}
+		})
+
+		it("should throw ClineConfigurationError when field is null", async () => {
+			const config = {
+				appBaseUrl: null,
+				apiBaseUrl: "https://api.enterprise.com",
+				mcpBaseUrl: "https://mcp.enterprise.com",
+			}
+
+			await fs.writeFile(path.join(tempDir, ".cline", "endpoints.json"), JSON.stringify(config), "utf8")
+
+			try {
+				await ClineEndpoint.initialize(tempDir)
+				throw new Error("Should have thrown")
+			} catch (error: any) {
+				error.should.be.instanceof(ClineConfigurationError)
+				error.message.should.containEql('Missing required field "appBaseUrl"')
+			}
+		})
+
+		it("should throw ClineConfigurationError when field is empty string", async () => {
+			const config = {
+				appBaseUrl: "",
+				apiBaseUrl: "https://api.enterprise.com",
+				mcpBaseUrl: "https://mcp.enterprise.com",
+			}
+
+			await fs.writeFile(path.join(tempDir, ".cline", "endpoints.json"), JSON.stringify(config), "utf8")
+
+			try {
+				await ClineEndpoint.initialize(tempDir)
+				throw new Error("Should have thrown")
+			} catch (error: any) {
+				error.should.be.instanceof(ClineConfigurationError)
+				error.message.should.containEql("cannot be empty")
+			}
+		})
+
+		it("should throw ClineConfigurationError when field is whitespace only", async () => {
+			const config = {
+				appBaseUrl: "   ",
+				apiBaseUrl: "https://api.enterprise.com",
+				mcpBaseUrl: "https://mcp.enterprise.com",
+			}
+
+			await fs.writeFile(path.join(tempDir, ".cline", "endpoints.json"), JSON.stringify(config), "utf8")
+
+			try {
+				await ClineEndpoint.initialize(tempDir)
+				throw new Error("Should have thrown")
+			} catch (error: any) {
+				error.should.be.instanceof(ClineConfigurationError)
+				error.message.should.containEql("cannot be empty")
+			}
+		})
+
+		it("should throw ClineConfigurationError when field is non-string", async () => {
+			const config = {
+				appBaseUrl: 12345,
+				apiBaseUrl: "https://api.enterprise.com",
+				mcpBaseUrl: "https://mcp.enterprise.com",
+			}
+
+			await fs.writeFile(path.join(tempDir, ".cline", "endpoints.json"), JSON.stringify(config), "utf8")
+
+			try {
+				await ClineEndpoint.initialize(tempDir)
+				throw new Error("Should have thrown")
+			} catch (error: any) {
+				error.should.be.instanceof(ClineConfigurationError)
+				error.message.should.containEql("must be a string")
+			}
+		})
+	})
+
+	describe("invalid URL detection", () => {
+		it("should throw ClineConfigurationError for invalid URL format", async () => {
+			const config = {
+				appBaseUrl: "not-a-valid-url",
+				apiBaseUrl: "https://api.enterprise.com",
+				mcpBaseUrl: "https://mcp.enterprise.com",
+			}
+
+			await fs.writeFile(path.join(tempDir, ".cline", "endpoints.json"), JSON.stringify(config), "utf8")
+
+			try {
+				await ClineEndpoint.initialize(tempDir)
+				throw new Error("Should have thrown")
+			} catch (error: any) {
+				error.should.be.instanceof(ClineConfigurationError)
+				error.message.should.containEql("must be a valid URL")
+			}
+		})
+
+		it("should throw ClineConfigurationError for URL without protocol", async () => {
+			const config = {
+				appBaseUrl: "app.enterprise.com",
+				apiBaseUrl: "https://api.enterprise.com",
+				mcpBaseUrl: "https://mcp.enterprise.com",
+			}
+
+			await fs.writeFile(path.join(tempDir, ".cline", "endpoints.json"), JSON.stringify(config), "utf8")
+
+			try {
+				await ClineEndpoint.initialize(tempDir)
+				throw new Error("Should have thrown")
+			} catch (error: any) {
+				error.should.be.instanceof(ClineConfigurationError)
+				error.message.should.containEql("must be a valid URL")
+			}
+		})
+
+		it("should throw ClineConfigurationError for malformed URL", async () => {
+			const config = {
+				appBaseUrl: "https://",
+				apiBaseUrl: "https://api.enterprise.com",
+				mcpBaseUrl: "https://mcp.enterprise.com",
+			}
+
+			await fs.writeFile(path.join(tempDir, ".cline", "endpoints.json"), JSON.stringify(config), "utf8")
+
+			try {
+				await ClineEndpoint.initialize(tempDir)
+				throw new Error("Should have thrown")
+			} catch (error: any) {
+				error.should.be.instanceof(ClineConfigurationError)
+				error.message.should.containEql("must be a valid URL")
+			}
+		})
+
+		it("should include the invalid URL value in error message", async () => {
+			const invalidUrl = "definitely-not-a-url"
+			const config = {
+				appBaseUrl: invalidUrl,
+				apiBaseUrl: "https://api.enterprise.com",
+				mcpBaseUrl: "https://mcp.enterprise.com",
+			}
+
+			await fs.writeFile(path.join(tempDir, ".cline", "endpoints.json"), JSON.stringify(config), "utf8")
+
+			try {
+				await ClineEndpoint.initialize(tempDir)
+				throw new Error("Should have thrown")
+			} catch (error: any) {
+				error.should.be.instanceof(ClineConfigurationError)
+				error.message.should.containEql(invalidUrl)
+			}
+		})
+	})
+
+	describe("environment switching blocked in self-hosted mode", () => {
+		it("should throw error when trying to change environment in self-hosted mode", async () => {
+			const config = {
+				appBaseUrl: "https://app.enterprise.com",
+				apiBaseUrl: "https://api.enterprise.com",
+				mcpBaseUrl: "https://mcp.enterprise.com",
+			}
+
+			await fs.writeFile(path.join(tempDir, ".cline", "endpoints.json"), JSON.stringify(config), "utf8")
+
+			await ClineEndpoint.initialize(tempDir)
+
+			// Verify we're in self-hosted mode
+			ClineEndpoint.config.environment.should.equal(Environment.selfHosted)
+
+			// Try to change environment - should throw
+			try {
+				ClineEnv.setEnvironment("staging")
+				throw new Error("Should have thrown")
+			} catch (error: any) {
+				error.message.should.containEql("Cannot change environment in on-premise mode")
+			}
+		})
+
+		it("should throw error for all environment values in self-hosted mode", async () => {
+			const config = {
+				appBaseUrl: "https://app.enterprise.com",
+				apiBaseUrl: "https://api.enterprise.com",
+				mcpBaseUrl: "https://mcp.enterprise.com",
+			}
+
+			await fs.writeFile(path.join(tempDir, ".cline", "endpoints.json"), JSON.stringify(config), "utf8")
+
+			await ClineEndpoint.initialize(tempDir)
+
+			const environments = ["staging", "local", "production", "anything"]
+			for (const env of environments) {
+				try {
+					ClineEnv.setEnvironment(env)
+					throw new Error(`Should have thrown for environment: ${env}`)
+				} catch (error: any) {
+					error.message.should.containEql("Cannot change environment in on-premise mode")
+				}
+			}
+		})
+
+		it("should allow environment switching in standard mode", async () => {
+			// No endpoints.json file - standard mode
+
+			await ClineEndpoint.initialize(tempDir)
+
+			// Verify we're NOT in self-hosted mode
+			ClineEndpoint.config.environment.should.not.equal(Environment.selfHosted)
+
+			// Should be able to change environment
+			ClineEnv.setEnvironment("staging")
+			ClineEnv.getEnvironment().environment.should.equal("staging")
+
+			ClineEnv.setEnvironment("local")
+			ClineEnv.getEnvironment().environment.should.equal("local")
+
+			ClineEnv.setEnvironment("production")
+			ClineEnv.getEnvironment().environment.should.equal("production")
+		})
+	})
+
+	describe("self-hosted mode behavior", () => {
+		it("should report selfHosted environment in self-hosted mode", async () => {
+			const config = {
+				appBaseUrl: "https://app.enterprise.com",
+				apiBaseUrl: "https://api.enterprise.com",
+				mcpBaseUrl: "https://mcp.enterprise.com",
+			}
+
+			await fs.writeFile(path.join(tempDir, ".cline", "endpoints.json"), JSON.stringify(config), "utf8")
+
+			await ClineEndpoint.initialize(tempDir)
+
+			const envConfig = ClineEndpoint.config
+			envConfig.environment.should.equal(Environment.selfHosted)
+		})
+
+		it("should use custom endpoints from file", async () => {
+			const customConfig = {
+				appBaseUrl: "https://custom-app.internal",
+				apiBaseUrl: "https://custom-api.internal",
+				mcpBaseUrl: "https://custom-mcp.internal/v1",
+			}
+
+			await fs.writeFile(path.join(tempDir, ".cline", "endpoints.json"), JSON.stringify(customConfig), "utf8")
+
+			await ClineEndpoint.initialize(tempDir)
+
+			const config = ClineEndpoint.config
+			config.appBaseUrl.should.equal("https://custom-app.internal")
+			config.apiBaseUrl.should.equal("https://custom-api.internal")
+			config.mcpBaseUrl.should.equal("https://custom-mcp.internal/v1")
+		})
+	})
+
+	describe("initialization behavior", () => {
+		it("should only initialize once", async () => {
+			await ClineEndpoint.initialize(tempDir)
+			ClineEndpoint.isInitialized().should.be.true()
+
+			// Second initialize should be a no-op
+			await ClineEndpoint.initialize(tempDir)
+			ClineEndpoint.isInitialized().should.be.true()
+		})
+
+		it("should throw error when accessing config before initialization", async () => {
+			// Already reset in beforeEach, so accessing should throw
+			try {
+				const _ = ClineEndpoint.config
+				throw new Error("Should have thrown")
+			} catch (error: any) {
+				error.message.should.containEql("not initialized")
+			}
+		})
+	})
+
+	describe("isSelfHosted() method", () => {
+		it("should return true when not initialized (safety fallback)", async () => {
+			// Reset singleton state - already done in beforeEach, not initialized
+			ClineEndpoint.isInitialized().should.be.false()
+			ClineEndpoint.isSelfHosted().should.be.true()
+		})
+
+		it("should return true when in self-hosted mode", async () => {
+			const config = {
+				appBaseUrl: "https://app.enterprise.com",
+				apiBaseUrl: "https://api.enterprise.com",
+				mcpBaseUrl: "https://mcp.enterprise.com",
+			}
+			await fs.writeFile(path.join(tempDir, ".cline", "endpoints.json"), JSON.stringify(config), "utf8")
+			await ClineEndpoint.initialize(tempDir)
+
+			ClineEndpoint.isSelfHosted().should.be.true()
+		})
+
+		it("should return false when in normal mode (no endpoints.json)", async () => {
+			// No endpoints.json file exists
+			await ClineEndpoint.initialize(tempDir)
+
+			ClineEndpoint.isSelfHosted().should.be.false()
+		})
+	})
+
+	describe("bundled endpoints.json behavior", () => {
+		let bundledDir: string
+		let setVscodeHostProviderMock: (mock: { extensionFsPath: string; globalStorageFsPath: string }) => void
+
+		beforeEach(async () => {
+			// Create a separate directory for bundled config
+			bundledDir = path.join(os.tmpdir(), `config-bundled-test-${Date.now()}-${Math.random().toString(36).slice(2)}`)
+			await fs.mkdir(bundledDir, { recursive: true })
+
+			// Import HostProvider utilities
+			const hostProviderModule = await import("../test/host-provider-test-utils")
+			setVscodeHostProviderMock = hostProviderModule.setVscodeHostProviderMock
+		})
+
+		afterEach(async () => {
+			try {
+				await fs.rm(bundledDir, { recursive: true, force: true })
+			} catch {
+				// Ignore cleanup errors
+			}
+		})
+
+		it("should use bundled endpoints.json when available", async () => {
+			const bundledConfig = {
+				appBaseUrl: "https://bundled.enterprise.com",
+				apiBaseUrl: "https://bundled-api.enterprise.com",
+				mcpBaseUrl: "https://bundled-mcp.enterprise.com",
+			}
+
+			// Set up bundled config
+			await fs.writeFile(path.join(bundledDir, "endpoints.json"), JSON.stringify(bundledConfig), "utf8")
+
+			await ClineEndpoint.initialize(bundledDir)
+
+			const config = ClineEndpoint.config
+			config.appBaseUrl.should.equal("https://bundled.enterprise.com")
+			config.apiBaseUrl.should.equal("https://bundled-api.enterprise.com")
+			config.mcpBaseUrl.should.equal("https://bundled-mcp.enterprise.com")
+			config.environment.should.equal(Environment.selfHosted)
+		})
+
+		it("should prefer bundled endpoints.json over user file", async () => {
+			const bundledConfig = {
+				appBaseUrl: "https://bundled.enterprise.com",
+				apiBaseUrl: "https://bundled-api.enterprise.com",
+				mcpBaseUrl: "https://bundled-mcp.enterprise.com",
+			}
+
+			const userConfig = {
+				appBaseUrl: "https://user.enterprise.com",
+				apiBaseUrl: "https://user-api.enterprise.com",
+				mcpBaseUrl: "https://user-mcp.enterprise.com",
+			}
+
+			// Set up both configs
+			await fs.writeFile(path.join(bundledDir, "endpoints.json"), JSON.stringify(bundledConfig), "utf8")
+			await fs.writeFile(path.join(tempDir, ".cline", "endpoints.json"), JSON.stringify(userConfig), "utf8")
+
+			await ClineEndpoint.initialize(bundledDir)
+
+			// Should use bundled config, not user config
+			const config = ClineEndpoint.config
+			config.appBaseUrl.should.equal("https://bundled.enterprise.com")
+			config.apiBaseUrl.should.equal("https://bundled-api.enterprise.com")
+			config.mcpBaseUrl.should.equal("https://bundled-mcp.enterprise.com")
+		})
+
+		it("should fall back to user endpoints.json when bundled is not present", async () => {
+			const userConfig = {
+				appBaseUrl: "https://user.enterprise.com",
+				apiBaseUrl: "https://user-api.enterprise.com",
+				mcpBaseUrl: "https://user-mcp.enterprise.com",
+			}
+
+			// Only create user config, no bundled config
+			await fs.writeFile(path.join(tempDir, ".cline", "endpoints.json"), JSON.stringify(userConfig), "utf8")
+
+			await ClineEndpoint.initialize(bundledDir)
+
+			// Should use user config
+			const config = ClineEndpoint.config
+			config.appBaseUrl.should.equal("https://user.enterprise.com")
+			config.apiBaseUrl.should.equal("https://user-api.enterprise.com")
+			config.mcpBaseUrl.should.equal("https://user-mcp.enterprise.com")
+		})
+
+		it("should use standard mode when neither bundled nor user file exists", async () => {
+			// No config files at all
+
+			await ClineEndpoint.initialize(bundledDir)
+
+			// Should use production defaults
+			const config = ClineEndpoint.config
+			config.environment.should.not.equal(Environment.selfHosted)
+			config.appBaseUrl.should.equal("https://app.cline.bot")
+			config.apiBaseUrl.should.equal("https://api.cline.bot")
+		})
+
+		it("should throw ClineConfigurationError for invalid bundled file", async () => {
+			const invalidConfig = {
+				appBaseUrl: "not-a-url",
+				apiBaseUrl: "https://api.enterprise.com",
+				mcpBaseUrl: "https://mcp.enterprise.com",
+			}
+
+			// Set up invalid bundled config
+			await fs.writeFile(path.join(bundledDir, "endpoints.json"), JSON.stringify(invalidConfig), "utf8")
+
+			try {
+				await ClineEndpoint.initialize(bundledDir)
+				throw new Error("Should have thrown")
+			} catch (error: any) {
+				error.should.be.instanceof(ClineConfigurationError)
+				error.message.should.containEql("must be a valid URL")
+				error.message.should.containEql("bundled")
+			}
+		})
+
+		it("should throw ClineConfigurationError for invalid JSON in bundled file", async () => {
+			// Set up invalid JSON in bundled file
+			await fs.writeFile(path.join(bundledDir, "endpoints.json"), "{ invalid json }", "utf8")
+
+			try {
+				await ClineEndpoint.initialize(bundledDir)
+				throw new Error("Should have thrown")
+			} catch (error: any) {
+				error.should.be.instanceof(ClineConfigurationError)
+				error.message.should.containEql("Invalid JSON")
+				error.message.should.containEql("bundled")
+			}
+		})
+
+		it("should indicate bundled source in error messages", async () => {
+			const incompleteConfig = {
+				appBaseUrl: "https://bundled.enterprise.com",
+				// Missing apiBaseUrl and mcpBaseUrl
+			}
+
+			await fs.writeFile(path.join(bundledDir, "endpoints.json"), JSON.stringify(incompleteConfig), "utf8")
+
+			try {
+				await ClineEndpoint.initialize(bundledDir)
+				throw new Error("Should have thrown")
+			} catch (error: any) {
+				error.should.be.instanceof(ClineConfigurationError)
+				error.message.should.containEql("Missing required field")
+				error.message.should.containEql(path.join(bundledDir, "endpoints.json"))
+			}
+		})
+	})
+})

apps/vscode/src/common.ts

@@ -4,38 +4,170 @@ import "./utils/path" // necessary to have access to String.prototype.toPosix
 import { HostProvider } from "@/hosts/host-provider"
 import { Logger } from "@/shared/services/Logger"
 import type { StorageContext } from "@/shared/storage/storage-context"
+import { FileContextTracker } from "./core/context/context-tracking/FileContextTracker"
+import { clearOnboardingModelsCache } from "./core/controller/models/getClineOnboardingModels"
+import { HookDiscoveryCache } from "./core/hooks/HookDiscoveryCache"
+import { HookProcessRegistry } from "./core/hooks/HookProcessRegistry"
+import { StateManager } from "./core/storage/StateManager"
+import { AgentConfigLoader } from "./core/task/tools/subagent/AgentConfigLoader"
+import { ExtensionRegistryInfo } from "./registry"
+import { ErrorService } from "./services/error"
+import { featureFlagsService } from "./services/feature-flags"
+import { getDistinctId } from "./services/logging/distinctId"
+import { telemetryService } from "./services/telemetry"
+import { PostHogClientProvider } from "./services/telemetry/providers/posthog/PostHogClientProvider"
+import { ClineTempManager } from "./services/temp"
+import { cleanupTestMode } from "./services/test/TestMode"
+import { ShowMessageType } from "./shared/proto/host/window"
+import { syncWorker } from "./shared/services/worker/sync"
+import { getBlobStoreSettingsFromEnv } from "./shared/services/worker/worker"
+import { getLatestAnnouncementId } from "./utils/announcements"
+import { arePathsEqual } from "./utils/path"
 
 /**
- * Performs initialization for Cline that is common to all platforms.
+ * Performs intialization for Cline that is common to all platforms.
  *
- * This is the MINIMAL inert-shell version: it only wires up logging,
- * initializes the bundled endpoint configuration, and creates the webview
- * provider so the UI can render. All heavy services (state manager,
- * telemetry, error service, sync worker, hooks, etc.) have been removed.
- *
- * @param _storageContext kept for signature compatibility with callers.
+ * @param context
  * @returns The webview provider
+ * @throws ClineConfigurationError if endpoints.json exists but is invalid
  */
-export async function initialize(_storageContext: StorageContext): Promise<WebviewProvider> {
+export async function initialize(storageContext: StorageContext): Promise<WebviewProvider> {
 	// Configure the shared Logging class to use HostProvider's output channels and debug logger
 	Logger.subscribe((msg: string) => HostProvider.get().logToChannel(msg)) // File system logging
 	Logger.subscribe((msg: string) => HostProvider.env.debugLog({ value: msg })) // Host debug logging
 
 	// Initialize ClineEndpoint configuration (reads bundled and ~/.cline/endpoints.json if present)
 	// This must be done before any other code that calls ClineEnv.config()
+	// Throws ClineConfigurationError if config file exists but is invalid
 	const { ClineEndpoint } = await import("./config")
 	await ClineEndpoint.initialize(HostProvider.get().extensionFsPath)
 
+	try {
+		await StateManager.initialize(storageContext)
+	} catch (error) {
+		Logger.error("[Cline] CRITICAL: Failed to initialize StateManager:", error)
+		HostProvider.window.showMessage({
+			type: ShowMessageType.ERROR,
+			message: "Failed to initialize storage. Please check logs for details or try restarting the client.",
+		})
+	}
+
+	// =============== External services ===============
+	await ErrorService.initialize()
+	// Initialize PostHog client provider (skip in self-hosted mode)
+	if (!ClineEndpoint.isSelfHosted()) {
+		PostHogClientProvider.getInstance()
+	}
+
 	// =============== Webview services ===============
 	const webview = HostProvider.get().createWebviewProvider()
 
+	const stateManager = StateManager.get()
+	// Non-blocking announcement check and display
+	showVersionUpdateAnnouncement(stateManager)
+	// Check if this workspace was opened from worktree quick launch
+	await checkWorktreeAutoOpen(stateManager)
+
+	// =============== Background sync and cleanup tasks ===============
+	// Use remote config blobStoreConfig if available, otherwise fall back to env vars
+	const blobStoreSettings = stateManager.getRemoteConfigSettings()?.blobStoreConfig ?? getBlobStoreSettingsFromEnv()
+	syncWorker().init({ ...blobStoreSettings, userDistinctId: getDistinctId() })
+	// Clean up old temp files in background (non-blocking) and start periodic cleanup every 24 hours
+	ClineTempManager.startPeriodicCleanup()
+	// Clean up orphaned file context warnings (startup cleanup)
+	FileContextTracker.cleanupOrphanedWarnings(stateManager)
+
+	telemetryService.captureExtensionActivated()
+
 	return webview
 }
 
+async function showVersionUpdateAnnouncement(stateManager: StateManager) {
+	// Version checking for autoupdate notification
+	const currentVersion = ExtensionRegistryInfo.version
+	const previousVersion = stateManager.getGlobalStateKey("clineVersion")
+	// Perform post-update actions if necessary
+	try {
+		if (!previousVersion || currentVersion !== previousVersion) {
+			Logger.log(`Cline version changed: ${previousVersion} -> ${currentVersion}. First run or update detected.`)
+
+			// Check if there's a new announcement to show
+			const lastShownAnnouncementId = stateManager.getGlobalStateKey("lastShownAnnouncementId")
+			const latestAnnouncementId = getLatestAnnouncementId()
+
+			if (lastShownAnnouncementId !== latestAnnouncementId) {
+				// Show notification when there's a new announcement (major/minor updates or fresh installs)
+				const message = previousVersion
+					? `Cline has been updated to v${currentVersion}`
+					: `Welcome to Cline v${currentVersion}`
+				HostProvider.window.showMessage({
+					type: ShowMessageType.INFORMATION,
+					message,
+				})
+			}
+			// Always update the main version tracker for the next launch.
+			await stateManager.setGlobalState("clineVersion", currentVersion)
+		}
+	} catch (error) {
+		const errorMessage = error instanceof Error ? error.message : String(error)
+		Logger.error(`Error during post-update actions: ${errorMessage}, Stack trace: ${error.stack}`)
+	}
+}
+
+/**
+ * Checks if this workspace was opened from the worktree quick launch button.
+ * If so, opens the Cline sidebar and clears the state.
+ */
+async function checkWorktreeAutoOpen(stateManager: StateManager): Promise<void> {
+	try {
+		// Read directly from globalState (not StateManager cache) since this may have been
+		// set by another window right before this one opened
+		const worktreeAutoOpenPath = stateManager.getGlobalStateKey("worktreeAutoOpenPath")
+		if (!worktreeAutoOpenPath) {
+			return
+		}
+
+		// Get current workspace path
+		const workspacePaths = (await HostProvider.workspace.getWorkspacePaths({})).paths
+		if (workspacePaths.length === 0) {
+			return
+		}
+
+		const currentPath = workspacePaths[0]
+
+		// Check if current workspace matches the worktree path
+		if (arePathsEqual(currentPath, worktreeAutoOpenPath)) {
+			// Clear the state first to prevent re-triggering
+			stateManager.setGlobalState("worktreeAutoOpenPath", undefined)
+			// Open the Cline sidebar
+			await HostProvider.workspace.openClineSidebarPanel({})
+		}
+	} catch (error) {
+		Logger.error("Error checking worktree auto-open", error)
+	}
+}
+
 /**
  * Performs cleanup when Cline is deactivated that is common to all platforms.
  */
 export async function tearDown(): Promise<void> {
+	AgentConfigLoader.getInstance()?.dispose()
+	PostHogClientProvider.getInstance().dispose()
+	telemetryService.dispose()
+	ErrorService.get().dispose()
+	featureFlagsService.dispose()
 	// Dispose all webview instances
 	await WebviewProvider.disposeAllInstances()
+	syncWorker().dispose()
+	clearOnboardingModelsCache()
+
+	// Kill any running hook processes to prevent zombies
+	await HookProcessRegistry.terminateAll()
+	// Clean up hook discovery cache
+	HookDiscoveryCache.getInstance().dispose()
+	// Stop periodic temp file cleanup
+	ClineTempManager.stopPeriodicCleanup()
+
+	// Clean up test mode
+	cleanupTestMode()
 }

apps/vscode/src/config.ts

@@ -4,11 +4,12 @@ import * as path from "path"
 import { Environment, type EnvironmentConfig } from "./shared/config-types"
 import { Logger } from "./shared/services/Logger"
 
-export { Environment } /**
+export { Environment, type EnvironmentConfig }
+
+/**
  * Schema for the endpoints.json configuration file used in on-premise deployments.
  * All fields are required and must be valid URLs.
  */
-
 interface EndpointsFileSchema {
 	appBaseUrl: string
 	apiBaseUrl: string
@@ -35,7 +36,7 @@ class ClineEndpoint {
 	private onPremiseConfig: EndpointsFileSchema | null = null
 	private environment: Environment = Environment.production
 	// Track if config came from bundled file (enterprise distribution)
-	private isBundled = false
+	private isBundled: boolean = false
 
 	private constructor() {
 		// Set environment at module load. Use override if provided.

apps/vscode/src/core/api/adapters/diff-editors.ts

@@ -0,0 +1,606 @@
+import { ClineStorageMessage } from "@/shared/messages/content"
+
+const APPLY_PATCH_PATCH_REGEX = /\*\*\* Begin Patch\s+([\s\S]*?)\s+\*\*\* End Patch/m
+
+/**
+ * Convert apply_patch tool calls to write_to_file and replace_in_file format
+ */
+export function convertApplyPatchToolCalls(messages: Array<ClineStorageMessage>): Array<ClineStorageMessage> {
+	// Map to track tool_use_id to converted tool info and original input
+	const toolUseIdMap = new Map<string, { name: string; input: any; originalInput: any }>()
+
+	return messages.map((message) => {
+		if (!Array.isArray(message.content)) {
+			return message
+		}
+
+		const convertedContent = message.content.map((block) => {
+			// Handle tool_use blocks
+			if (block.type === "tool_use" && block.name === "apply_patch") {
+				const converted = convertApplyPatchToToolCalls(block.input)
+				// Store the conversion with original input for matching tool_result
+				toolUseIdMap.set(block.id, { ...converted, originalInput: block.input })
+
+				return {
+					...block,
+					name: converted.name,
+					input: converted.input,
+				}
+			}
+
+			// Handle tool_result blocks
+			if (block.type === "tool_result") {
+				const conversion = toolUseIdMap.get(block.tool_use_id)
+				if (conversion) {
+					// Reconstruct the tool_result content to match apply_patch format
+					const reconstructedContent = reconstructApplyPatchResult(
+						block,
+						conversion.name,
+						conversion.input,
+						conversion.originalInput,
+					)
+					return {
+						...block,
+						content: reconstructedContent,
+					}
+				}
+			}
+
+			return block
+		})
+
+		return {
+			...message,
+			content: convertedContent,
+		}
+	})
+}
+
+interface ConvertedTool {
+	name: string
+	input: any
+}
+
+/**
+ * Parse apply_patch input and convert to write_to_file or replace_in_file format
+ */
+function convertApplyPatchToToolCalls(input: any): ConvertedTool {
+	const patchInput = typeof input === "string" ? input : input?.input || ""
+
+	// Parse the patch format
+	const patchMatch = patchInput.match(APPLY_PATCH_PATCH_REGEX)
+	if (!patchMatch) {
+		// If we can't parse it, return as-is with write_to_file
+		return {
+			name: "write_to_file",
+			input: input,
+		}
+	}
+
+	const patchContent = patchMatch[1]
+
+	// Extract file operation (Add, Update, or Delete)
+	const fileMatch = patchContent.match(/\*\*\* (Add|Update|Delete) File: (.+?)(?:\n|$)/m)
+	if (!fileMatch) {
+		return {
+			name: "write_to_file",
+			input: input,
+		}
+	}
+
+	const action = fileMatch[1]
+	const filePath = fileMatch[2].trim()
+
+	// If it's an Add operation, convert to write_to_file
+	if (action === "Add") {
+		// Extract the content after the file line
+		const contentAfterFile = patchContent.substring(fileMatch.index! + fileMatch[0].length)
+		return {
+			name: "write_to_file",
+			input: {
+				absolutePath: filePath,
+				content: extractNewContentFromPatch(contentAfterFile),
+			},
+		}
+	}
+
+	// If it's Update or Delete, convert to replace_in_file
+	if (action === "Update" || action === "Delete") {
+		const diff = convertPatchToDiff(patchContent.substring(fileMatch.index! + fileMatch[0].length))
+		return {
+			name: "replace_in_file",
+			input: {
+				absolutePath: filePath,
+				diff: diff,
+			},
+		}
+	}
+
+	// Fallback
+	return {
+		name: "write_to_file",
+		input: input,
+	}
+}
+
+/**
+ * Extract new content from add operation patch
+ */
+function extractNewContentFromPatch(patchContent: string): string {
+	// For Add operations, the patch should contain lines starting with +
+	const lines = patchContent.split("\n")
+	const contentLines: string[] = []
+
+	for (const line of lines) {
+		if (line.startsWith("+")) {
+			// Remove the + prefix and exactly ONE space if present (but not if it's a tab)
+			let content = line.substring(1)
+			if (content.startsWith(" ") && !content.startsWith("\t")) {
+				content = content.substring(1)
+			}
+			contentLines.push(content)
+		}
+	}
+
+	return contentLines.join("\n")
+}
+
+/**
+ * Convert V4A patch format to SEARCH/REPLACE format
+ */
+function convertPatchToDiff(patchContent: string): string {
+	const diffBlocks: string[] = []
+	const lines = patchContent.split("\n")
+
+	let i = 0
+	while (i < lines.length) {
+		const line = lines[i]
+
+		// Skip empty lines at the start
+		if (!line.trim() && i === 0) {
+			i++
+			continue
+		}
+
+		// Check if this is the start of a hunk (@@) or a direct change line
+		if (line.trim().startsWith("@@") || line.startsWith("-") || line.startsWith("+")) {
+			const currentSearch: string[] = []
+			const currentReplace: string[] = []
+
+			// Collect @@ context marker lines
+			// @@ prefix marks context lines. If @@something, then "something" is context.
+			// If just @@, then it's an empty context line.
+			while (i < lines.length && lines[i].trim().startsWith("@@")) {
+				const trimmedLine = lines[i].trim()
+				// Extract the actual context content after @@
+				const contextLine = trimmedLine.substring(2)
+				// Always add the context line (even if empty)
+				currentSearch.push(contextLine)
+				currentReplace.push(contextLine)
+				i++
+			}
+
+			if (i >= lines.length) {
+				break
+			}
+
+			// Collect all remaining lines in this hunk until we hit end of content or next @@
+			const hunkLines: string[] = []
+			while (i < lines.length) {
+				// Check if this is a new hunk (starts with @@)
+				if (lines[i].trim().startsWith("@@")) {
+					break
+				}
+				hunkLines.push(lines[i])
+				i++
+			}
+
+			// Now process the hunk to build SEARCH/REPLACE
+			let hasChanges = false
+			for (let j = 0; j < hunkLines.length; j++) {
+				const hunkLine = hunkLines[j]
+
+				if (hunkLine.startsWith("-")) {
+					hasChanges = true
+					// Strip the - prefix and exactly ONE space if present (but not if it's a tab)
+					let content = hunkLine.substring(1)
+					if (content.startsWith(" ") && !content.startsWith(" \t")) {
+						content = content.substring(1)
+					}
+					currentSearch.push(content)
+				} else if (hunkLine.startsWith("+")) {
+					hasChanges = true
+					// Strip the + prefix and exactly ONE space if present (but not if it's a tab)
+					let content = hunkLine.substring(1)
+					if (content.startsWith(" ") && !content.startsWith(" \t")) {
+						content = content.substring(1)
+					}
+					currentReplace.push(content)
+				} else {
+					// Context line without @@ prefix - add to both sides
+					currentSearch.push(hunkLine)
+					currentReplace.push(hunkLine)
+				}
+			}
+
+			// Create the diff block if we have changes
+			if (hasChanges && (currentSearch.length > 0 || currentReplace.length > 0)) {
+				diffBlocks.push(
+					"------- SEARCH\n" +
+						currentSearch.join("\n") +
+						"\n=======\n" +
+						currentReplace.join("\n") +
+						"\n+++++++ REPLACE",
+				)
+			}
+		} else {
+			i++
+		}
+	}
+
+	return diffBlocks.join("\n")
+}
+
+/**
+ * Reconstruct tool_result content to match apply_patch format by extracting
+ * the final file content and converting it back to V4A patch format
+ */
+function reconstructApplyPatchResult(
+	block: any,
+	convertedToolName: string,
+	_convertedInput: any,
+	originalInput: any,
+): string | any[] {
+	// Extract the content from the tool_result
+	const content = typeof block.content === "string" ? block.content : ""
+
+	// Try to extract the final_file_content
+	const finalContentMatch = content.match(/<final_file_content path="([^"]+)">\s*([\s\S]*?)\s*<\/final_file_content>/)
+
+	if (!finalContentMatch) {
+		// If no final_file_content found, return original content
+		return block.content
+	}
+
+	const filePath = finalContentMatch[1]
+	const finalContent = finalContentMatch[2]
+
+	// Reconstruct the result message based on the converted tool type
+	if (convertedToolName === "write_to_file") {
+		// For write_to_file, we just need to confirm the file was created/written
+		return `[apply_patch for '${filePath}'] Result:\nThe content was successfully saved to ${filePath}.\n\nThe file has been created/updated with the new content.`
+	}
+
+	if (convertedToolName === "replace_in_file") {
+		// For replace_in_file, we need to reconstruct the V4A patch format result
+		// Try to parse the original patch to get the action and build context
+		const patchInput = typeof originalInput === "string" ? originalInput : originalInput?.input || ""
+		const patchMatch = patchInput.match(APPLY_PATCH_PATCH_REGEX)
+
+		if (patchMatch) {
+			const patchContent = patchMatch[1]
+			const fileMatch = patchContent.match(/\*\*\* (Add|Update|Delete) File: (.+?)(?:\n|$)/m)
+
+			if (fileMatch) {
+				const action = fileMatch[1]
+				return `[apply_patch for '${filePath}'] Result:\nThe content was successfully updated in ${filePath}.\n\nThe file has been modified using ${action} operation.\n\n<final_file_content path="${filePath}">\n${finalContent}\n</final_file_content>\n\nIMPORTANT: For any future changes to this file, use the final_file_content shown above as your reference.`
+			}
+		}
+
+		// Fallback for replace_in_file
+		return `[apply_patch for '${filePath}'] Result:\nThe content was successfully updated in ${filePath}.\n\n<final_file_content path="${filePath}">\n${finalContent}\n</final_file_content>\n\nIMPORTANT: For any future changes to this file, use the final_file_content shown above as your reference.`
+	}
+
+	// Default fallback
+	return block.content
+}
+
+/**
+ * Convert write_to_file and replace_in_file tool calls to apply_patch format
+ */
+export function convertWriteToFileToolCalls(messages: Array<ClineStorageMessage>): Array<ClineStorageMessage> {
+	// Map to track tool_use_id to converted tool info and original input
+	const toolUseIdMap = new Map<string, { originalName: string; originalInput: any; patchInput?: string }>()
+
+	// First pass: collect tool_use blocks
+	for (const message of messages) {
+		if (!Array.isArray(message.content)) {
+			continue
+		}
+		for (const block of message.content) {
+			if (block.type === "tool_use" && (block.name === "write_to_file" || block.name === "replace_in_file")) {
+				toolUseIdMap.set(block.id, {
+					originalName: block.name,
+					originalInput: block.input,
+				})
+			}
+		}
+	}
+
+	// Second pass: find tool_results and extract final content to build proper patches
+	const finalContentMap = new Map<string, string>()
+	for (const message of messages) {
+		if (!Array.isArray(message.content)) {
+			continue
+		}
+		for (const block of message.content) {
+			if (block.type === "tool_result" && toolUseIdMap.has(block.tool_use_id)) {
+				const content = typeof block.content === "string" ? block.content : ""
+				const finalContentMatch = content.match(
+					/<final_file_content path="([^"]+)">\s*([\s\S]*?)\s*<\/final_file_content>/,
+				)
+				if (finalContentMatch) {
+					finalContentMap.set(block.tool_use_id, finalContentMatch[2])
+				}
+			}
+		}
+	}
+
+	// Third pass: convert messages
+	return messages.map((message) => {
+		if (!Array.isArray(message.content)) {
+			return message
+		}
+
+		const convertedContent = message.content.map((block) => {
+			// Handle tool_use blocks for write_to_file and replace_in_file
+			if (block.type === "tool_use" && (block.name === "write_to_file" || block.name === "replace_in_file")) {
+				const finalContent = finalContentMap.get(block.id)
+				const patchInput = convertToPatchFormat(block.name, block.input, finalContent)
+
+				// Update the map with the generated patch
+				const existingEntry = toolUseIdMap.get(block.id)
+				if (existingEntry) {
+					existingEntry.patchInput = patchInput
+				}
+
+				return {
+					...block,
+					name: "apply_patch",
+					input: {
+						input: patchInput,
+					},
+				}
+			}
+
+			// Handle tool_result blocks
+			if (block.type === "tool_result") {
+				const conversion = toolUseIdMap.get(block.tool_use_id)
+				if (conversion) {
+					// Reconstruct the tool_result content to match apply_patch format
+					const reconstructedContent = reconstructWriteToFileResult(
+						block,
+						conversion.originalName,
+						conversion.originalInput,
+					)
+					return {
+						...block,
+						content: reconstructedContent,
+					}
+				}
+			}
+
+			return block
+		})
+
+		return {
+			...message,
+			content: convertedContent,
+		}
+	})
+}
+
+/**
+ * Convert write_to_file or replace_in_file input to apply_patch format
+ */
+function convertToPatchFormat(toolName: string, input: any, finalContent?: string): string {
+	const filePath = input.absolutePath || input.path || ""
+
+	if (toolName === "write_to_file") {
+		// Convert write_to_file to Add operation
+		const content = input.content || ""
+		const lines = content.split("\n")
+		const patchLines = ["@@"]
+		patchLines.push(...lines.map((line: string) => `+ ${line}`))
+
+		return `apply_patch <<"EOF"
+*** Begin Patch
+*** Add File: ${filePath}
+${patchLines.join("\n")}
+*** End Patch
+EOF`
+	}
+
+	if (toolName === "replace_in_file") {
+		// Convert replace_in_file to Update operation
+		const diff = input.diff || ""
+
+		// Parse SEARCH/REPLACE blocks and convert to V4A format with context
+		const patchContent = convertDiffToPatchWithContext(diff, finalContent)
+
+		return `apply_patch <<"EOF"
+*** Begin Patch
+*** Update File: ${filePath}
+${patchContent}
+*** End Patch
+EOF`
+	}
+
+	return ""
+}
+
+/**
+ * Convert SEARCH/REPLACE diff format to V4A patch format with additional context from final content
+ */
+function convertDiffToPatchWithContext(diff: string, finalContent?: string): string {
+	const patchLines: string[] = []
+
+	// Match all SEARCH/REPLACE blocks
+	const blockRegex = /------- SEARCH\s*\n([\s\S]*?)\n=======\s*\n([\s\S]*?)\n\+{7} REPLACE/g
+	let match
+
+	while ((match = blockRegex.exec(diff)) !== null) {
+		const searchContent = match[1]
+		const replaceContent = match[2]
+
+		const searchLines = searchContent.split("\n")
+		const replaceLines = replaceContent.split("\n")
+
+		// Find common prefix and suffix between search and replace
+		let prefixEnd = 0
+		while (
+			prefixEnd < searchLines.length &&
+			prefixEnd < replaceLines.length &&
+			searchLines[prefixEnd] === replaceLines[prefixEnd]
+		) {
+			prefixEnd++
+		}
+
+		let suffixStart = searchLines.length
+		let replaceSuffixStart = replaceLines.length
+		while (
+			suffixStart > prefixEnd &&
+			replaceSuffixStart > prefixEnd &&
+			searchLines[suffixStart - 1] === replaceLines[replaceSuffixStart - 1]
+		) {
+			suffixStart--
+			replaceSuffixStart--
+		}
+
+		// If we have finalContent, extract additional context from it
+		if (finalContent) {
+			const finalLines = finalContent.split("\n")
+
+			// Find where the replaced content appears in the final file
+			let matchIndex = -1
+			for (let i = 0; i < finalLines.length; i++) {
+				// Try to match the first replace line
+				if (replaceLines.length > 0 && finalLines[i] === replaceLines[0]) {
+					// Check if subsequent lines also match
+					let allMatch = true
+					for (let j = 1; j < replaceLines.length && i + j < finalLines.length; j++) {
+						if (finalLines[i + j] !== replaceLines[j]) {
+							allMatch = false
+							break
+						}
+					}
+					if (allMatch) {
+						matchIndex = i
+						break
+					}
+				}
+			}
+
+			if (matchIndex >= 0) {
+				// Extract up to 3 lines before as context
+				const contextStart = Math.max(0, matchIndex - 3)
+				const contextLines: string[] = []
+				for (let i = contextStart; i < matchIndex; i++) {
+					contextLines.push(finalLines[i])
+				}
+
+				// Pad to 3 lines if needed (with empty strings)
+				while (contextLines.length < 3) {
+					contextLines.unshift("")
+				}
+
+				// Add @@ marker with the first context line
+				if (contextLines[0] === "") {
+					patchLines.push("@@")
+				} else {
+					patchLines.push(`@@${contextLines[0]}`)
+				}
+
+				// Add remaining context lines (without @@ marker)
+				for (let i = 1; i < contextLines.length; i++) {
+					patchLines.push(contextLines[i])
+				}
+
+				// Add common prefix lines (without +/- markers)
+				for (let i = 0; i < prefixEnd; i++) {
+					patchLines.push(searchLines[i])
+				}
+
+				// Add the actual changes (lines that differ)
+				for (let i = prefixEnd; i < suffixStart; i++) {
+					patchLines.push(`- ${searchLines[i]}`)
+				}
+				for (let i = prefixEnd; i < replaceSuffixStart; i++) {
+					patchLines.push(`+ ${replaceLines[i]}`)
+				}
+
+				// Add common suffix lines (without +/- markers)
+				for (let i = suffixStart; i < searchLines.length; i++) {
+					patchLines.push(searchLines[i])
+				}
+
+				// Extract up to 3 lines after as trailing context (without @@ markers)
+				const contextEnd = Math.min(finalLines.length, matchIndex + replaceLines.length + 3)
+				for (let i = matchIndex + replaceLines.length; i < contextEnd; i++) {
+					patchLines.push(finalLines[i])
+				}
+
+				continue
+			}
+		}
+
+		// Fallback: if no finalContent or couldn't find match, use the prefix/suffix from SEARCH/REPLACE
+		patchLines.push("@@")
+
+		// Add common prefix lines (without +/- markers)
+		for (let i = 0; i < prefixEnd; i++) {
+			patchLines.push(searchLines[i])
+		}
+
+		// Add the actual changes (lines that differ)
+		for (let i = prefixEnd; i < suffixStart; i++) {
+			patchLines.push(`- ${searchLines[i]}`)
+		}
+		for (let i = prefixEnd; i < replaceSuffixStart; i++) {
+			patchLines.push(`+ ${replaceLines[i]}`)
+		}
+
+		// Add common suffix lines (without +/- markers)
+		for (let i = suffixStart; i < searchLines.length; i++) {
+			patchLines.push(searchLines[i])
+		}
+	}
+
+	return patchLines.join("\n")
+}
+
+/**
+ * Reconstruct tool_result content to match apply_patch result format
+ */
+function reconstructWriteToFileResult(block: any, originalToolName: string, originalInput: any): string | any[] {
+	// Extract the content from the tool_result
+	const content = typeof block.content === "string" ? block.content : ""
+
+	// Try to extract the final_file_content
+	const finalContentMatch = content.match(/<final_file_content path="([^"]+)">\s*([\s\S]*?)\s*<\/final_file_content>/)
+
+	const filePath = originalInput.absolutePath || originalInput.path || ""
+
+	if (!finalContentMatch) {
+		// If no final_file_content found, create a simple success message
+		if (originalToolName === "write_to_file") {
+			return `[apply_patch for '${filePath}'] Result:\nThe content was successfully saved to ${filePath}.\n\nThe file has been created/updated with the new content.`
+		} else {
+			return `[apply_patch for '${filePath}'] Result:\nThe content was successfully updated in ${filePath}.\n\nThe file has been modified.`
+		}
+	}
+
+	const finalContent = finalContentMatch[2]
+
+	// Reconstruct the result message based on the original tool type
+	if (originalToolName === "write_to_file") {
+		return `[apply_patch for '${filePath}'] Result:\nThe content was successfully saved to ${filePath}.\n\nThe file has been created/updated with the new content.`
+	}
+
+	if (originalToolName === "replace_in_file") {
+		return `[apply_patch for '${filePath}'] Result:\nThe content was successfully updated in ${filePath}.\n\nThe file has been modified using Update operation.\n\n<final_file_content path="${filePath}">\n${finalContent}\n</final_file_content>\n\nIMPORTANT: For any future changes to this file, use the final_file_content shown above as your reference.`
+	}
+
+	// Default fallback
+	return block.content
+}

apps/vscode/src/core/api/adapters/index.ts

@@ -0,0 +1,60 @@
+import { ClineStorageMessage } from "@/shared/messages/content"
+import { ClineDefaultTool } from "@/shared/tools"
+import { convertApplyPatchToolCalls, convertWriteToFileToolCalls } from "./diff-editors"
+
+/**
+ * Transforms tool call messages between different tool formats based on native tool support.
+ * Converts between apply_patch and write_to_file/replace_in_file formats as needed.
+ *
+ * @param clineMessages - Array of messages containing tool calls to transform
+ * @param nativeTools - Array of tools natively supported by the current provider
+ * @returns Transformed messages array, or original if no transformation needed
+ */
+export function transformToolCallMessages(
+	clineMessages: ClineStorageMessage[],
+	nativeTools?: ClineDefaultTool[],
+): ClineStorageMessage[] {
+	// Early return if no messages or native tools provided
+	if (!clineMessages?.length || !nativeTools?.length) {
+		return clineMessages
+	}
+
+	// Create Sets for O(1) lookup performance
+	const nativeToolSet = new Set(nativeTools)
+	const usedToolSet = new Set<string>()
+
+	// Single pass: collect all tools used in assistant messages
+	for (const msg of clineMessages) {
+		if (msg.role === "assistant" && Array.isArray(msg.content)) {
+			for (const block of msg.content) {
+				if (block.type === "tool_use" && block.name) {
+					usedToolSet.add(block.name)
+				}
+			}
+		}
+	}
+
+	// Early return if no tools were used
+	if (usedToolSet.size === 0) {
+		return clineMessages
+	}
+
+	// Determine which conversion to apply
+	const hasApplyPatchNative = nativeToolSet.has(ClineDefaultTool.APPLY_PATCH)
+	const hasFileEditNative = nativeToolSet.has(ClineDefaultTool.FILE_EDIT) || nativeToolSet.has(ClineDefaultTool.FILE_NEW)
+
+	const hasApplyPatchUsed = usedToolSet.has(ClineDefaultTool.APPLY_PATCH)
+	const hasFileEditUsed = usedToolSet.has(ClineDefaultTool.FILE_EDIT) || usedToolSet.has(ClineDefaultTool.FILE_NEW)
+
+	// Convert write_to_file/replace_in_file → apply_patch
+	if (hasApplyPatchNative && hasFileEditUsed) {
+		return convertWriteToFileToolCalls(clineMessages)
+	}
+
+	// Convert apply_patch → write_to_file/replace_in_file
+	if (hasFileEditNative && hasApplyPatchUsed) {
+		return convertApplyPatchToolCalls(clineMessages)
+	}
+
+	return clineMessages
+}

apps/vscode/src/core/api/index.ts

@@ -1,18 +1,67 @@
-import { ModelInfo } from "@shared/api"
+import { ApiConfiguration, clinePassDefaultModelId, ModelInfo, QwenApiRegions, resolveClinePassModelInfo } from "@shared/api"
 import { Mode } from "@shared/storage/types"
+import { featureFlagsService } from "@/services/feature-flags"
+import { ClineStorageMessage } from "@/shared/messages/content"
+import { FeatureFlag } from "@/shared/services/feature-flags/feature-flags"
+import { Logger } from "@/shared/services/Logger"
+import { ClineTool } from "@/shared/tools"
+import { AIhubmixHandler } from "./providers/aihubmix"
+import { AnthropicHandler } from "./providers/anthropic"
+import { AskSageHandler } from "./providers/asksage"
+import { BasetenHandler } from "./providers/baseten"
+import { AwsBedrockHandler } from "./providers/bedrock"
+import { CerebrasHandler } from "./providers/cerebras"
+import { ClaudeCodeHandler } from "./providers/claude-code"
+import { ClineHandler } from "./providers/cline"
+import { DeepSeekHandler } from "./providers/deepseek"
+import { DifyHandler } from "./providers/dify"
+import { DoubaoHandler } from "./providers/doubao"
+import { FireworksHandler } from "./providers/fireworks"
+import { GeminiHandler } from "./providers/gemini"
+import { GroqHandler } from "./providers/groq"
+import { HicapHandler } from "./providers/hicap"
+import { HuaweiCloudMaaSHandler } from "./providers/huawei-cloud-maas"
+import { HuggingFaceHandler } from "./providers/huggingface"
+import { LiteLlmHandler } from "./providers/litellm"
+import { LmStudioHandler } from "./providers/lmstudio"
+import { MinimaxHandler } from "./providers/minimax"
+import { MistralHandler } from "./providers/mistral"
+import { MoonshotHandler } from "./providers/moonshot"
+import { NebiusHandler } from "./providers/nebius"
+import { NousResearchHandler } from "./providers/nousresearch"
+import { OcaHandler } from "./providers/oca"
+import { OllamaHandler } from "./providers/ollama"
+import { OpenAiHandler } from "./providers/openai"
+import { OpenAiCodexHandler } from "./providers/openai-codex"
+import { OpenAiNativeHandler } from "./providers/openai-native"
+import { OpenRouterHandler } from "./providers/openrouter"
+import { QwenHandler } from "./providers/qwen"
+import { QwenCodeHandler } from "./providers/qwen-code"
+import { RequestyHandler } from "./providers/requesty"
+import { SambanovaHandler } from "./providers/sambanova"
+import { SapAiCoreHandler } from "./providers/sapaicore"
+import { TogetherHandler } from "./providers/together"
+import { VercelAIGatewayHandler } from "./providers/vercel-ai-gateway"
+import { VertexHandler } from "./providers/vertex"
+import { VsCodeLmHandler } from "./providers/vscode-lm"
+import { WandbHandler } from "./providers/wandb"
+import { XAIHandler } from "./providers/xai"
+import { ZAiHandler } from "./providers/zai"
+import { ApiStream, ApiStreamUsageChunk } from "./transform/stream"
 
-// buildApiHandler now routes inference through the Cline SDK. It lives in
-// apps/vscode/src/sdk/sdk-api-handler.ts and callers import it directly from
-// there. It is deliberately NOT re-exported here: this barrel is imported
-// widely for *types* only, and re-exporting a value from the SDK module would
-// pull the entire SDK/session-factory runtime graph into every type importer
-// at module-eval time (which can break extension activation). Keep this file
-// types-only.
+export type CommonApiHandlerOptions = {
+	onRetryAttempt?: ApiConfiguration["onRetryAttempt"]
+}
+export interface ApiHandler {
+	createMessage(systemPrompt: string, messages: ClineStorageMessage[], tools?: ClineTool[], useResponseApi?: boolean): ApiStream
+	getModel(): ApiHandlerModel
+	getApiStreamUsage?(): Promise<ApiStreamUsageChunk | undefined>
+	abort?(): void
+}
 
 export interface ApiHandlerModel {
 	id: string
 	info: ModelInfo
-	providerId?: string
 }
 
 export interface ApiProviderInfo {
@@ -21,3 +70,467 @@ export interface ApiProviderInfo {
 	mode: Mode
 	customPrompt?: string // "compact"
 }
+
+export interface SingleCompletionHandler {
+	completePrompt(prompt: string): Promise<string>
+}
+
+function createHandlerForProvider(
+	apiProvider: string | undefined,
+	options: Omit<ApiConfiguration, "apiProvider">,
+	mode: Mode,
+): ApiHandler {
+	const effectiveApiProvider =
+		apiProvider === "cline-pass" && !featureFlagsService.getBooleanFlagEnabled(FeatureFlag.CLINE_PASS) ? "cline" : apiProvider
+
+	switch (effectiveApiProvider) {
+		case "anthropic":
+			return new AnthropicHandler({
+				onRetryAttempt: options.onRetryAttempt,
+				apiKey: options.apiKey,
+				anthropicBaseUrl: options.anthropicBaseUrl,
+				apiModelId: mode === "plan" ? options.planModeApiModelId : options.actModeApiModelId,
+				reasoningEffort: mode === "plan" ? options.planModeReasoningEffort : options.actModeReasoningEffort,
+				thinkingBudgetTokens:
+					mode === "plan" ? options.planModeThinkingBudgetTokens : options.actModeThinkingBudgetTokens,
+			})
+		case "openrouter":
+			return new OpenRouterHandler({
+				onRetryAttempt: options.onRetryAttempt,
+				openRouterApiKey: options.openRouterApiKey,
+				openRouterModelId: mode === "plan" ? options.planModeOpenRouterModelId : options.actModeOpenRouterModelId,
+				openRouterModelInfo: mode === "plan" ? options.planModeOpenRouterModelInfo : options.actModeOpenRouterModelInfo,
+				openRouterProviderSorting: options.openRouterProviderSorting,
+				reasoningEffort: mode === "plan" ? options.planModeReasoningEffort : options.actModeReasoningEffort,
+				thinkingBudgetTokens:
+					mode === "plan" ? options.planModeThinkingBudgetTokens : options.actModeThinkingBudgetTokens,
+				enableParallelToolCalling: options.enableParallelToolCalling,
+			})
+		case "bedrock":
+			return new AwsBedrockHandler({
+				onRetryAttempt: options.onRetryAttempt,
+				apiModelId: mode === "plan" ? options.planModeApiModelId : options.actModeApiModelId,
+				awsAccessKey: options.awsAccessKey,
+				awsSecretKey: options.awsSecretKey,
+				awsSessionToken: options.awsSessionToken,
+				awsRegion: options.awsRegion,
+				awsAuthentication: options.awsAuthentication,
+				awsBedrockApiKey: options.awsBedrockApiKey,
+				awsUseCrossRegionInference: options.awsUseCrossRegionInference,
+				awsUseGlobalInference: options.awsUseGlobalInference,
+				awsBedrockUsePromptCache: options.awsBedrockUsePromptCache,
+				awsUseProfile: options.awsUseProfile,
+				awsProfile: options.awsProfile,
+				awsBedrockEndpoint: options.awsBedrockEndpoint,
+				awsBedrockCustomSelected:
+					mode === "plan" ? options.planModeAwsBedrockCustomSelected : options.actModeAwsBedrockCustomSelected,
+				awsBedrockCustomModelBaseId:
+					mode === "plan" ? options.planModeAwsBedrockCustomModelBaseId : options.actModeAwsBedrockCustomModelBaseId,
+				reasoningEffort: mode === "plan" ? options.planModeReasoningEffort : options.actModeReasoningEffort,
+				thinkingBudgetTokens:
+					mode === "plan" ? options.planModeThinkingBudgetTokens : options.actModeThinkingBudgetTokens,
+			})
+		case "vertex":
+			return new VertexHandler({
+				onRetryAttempt: options.onRetryAttempt,
+				vertexProjectId: options.vertexProjectId,
+				vertexRegion: options.vertexRegion,
+				apiModelId: mode === "plan" ? options.planModeApiModelId : options.actModeApiModelId,
+				thinkingBudgetTokens:
+					mode === "plan" ? options.planModeThinkingBudgetTokens : options.actModeThinkingBudgetTokens,
+				geminiApiKey: options.geminiApiKey,
+				geminiBaseUrl: options.geminiBaseUrl,
+				reasoningEffort: mode === "plan" ? options.planModeReasoningEffort : options.actModeReasoningEffort,
+				ulid: options.ulid,
+			})
+		case "openai":
+			return new OpenAiHandler({
+				onRetryAttempt: options.onRetryAttempt,
+				openAiApiKey: options.openAiApiKey,
+				openAiBaseUrl: options.openAiBaseUrl,
+				azureApiVersion: options.azureApiVersion,
+				azureIdentity: options.azureIdentity,
+				openAiHeaders: options.openAiHeaders,
+				openAiModelId: mode === "plan" ? options.planModeOpenAiModelId : options.actModeOpenAiModelId,
+				openAiModelInfo: mode === "plan" ? options.planModeOpenAiModelInfo : options.actModeOpenAiModelInfo,
+				reasoningEffort: mode === "plan" ? options.planModeReasoningEffort : options.actModeReasoningEffort,
+			})
+		case "ollama":
+			return new OllamaHandler({
+				onRetryAttempt: options.onRetryAttempt,
+				ollamaBaseUrl: options.ollamaBaseUrl,
+				ollamaApiKey: options.ollamaApiKey,
+				ollamaModelId: mode === "plan" ? options.planModeOllamaModelId : options.actModeOllamaModelId,
+				ollamaApiOptionsCtxNum: options.ollamaApiOptionsCtxNum,
+				requestTimeoutMs: options.requestTimeoutMs,
+			})
+		case "lmstudio":
+			return new LmStudioHandler({
+				onRetryAttempt: options.onRetryAttempt,
+				lmStudioBaseUrl: options.lmStudioBaseUrl,
+				lmStudioModelId: mode === "plan" ? options.planModeLmStudioModelId : options.actModeLmStudioModelId,
+				lmStudioMaxTokens: options.lmStudioMaxTokens,
+			})
+		case "gemini":
+			return new GeminiHandler({
+				onRetryAttempt: options.onRetryAttempt,
+				vertexProjectId: options.vertexProjectId,
+				vertexRegion: options.vertexRegion,
+				geminiApiKey: options.geminiApiKey,
+				geminiBaseUrl: options.geminiBaseUrl,
+				thinkingBudgetTokens:
+					mode === "plan" ? options.planModeThinkingBudgetTokens : options.actModeThinkingBudgetTokens,
+				reasoningEffort: mode === "plan" ? options.planModeReasoningEffort : options.actModeReasoningEffort,
+				apiModelId: mode === "plan" ? options.planModeApiModelId : options.actModeApiModelId,
+				ulid: options.ulid,
+			})
+		case "openai-native":
+			return new OpenAiNativeHandler({
+				onRetryAttempt: options.onRetryAttempt,
+				openAiNativeApiKey: options.openAiNativeApiKey,
+				reasoningEffort: mode === "plan" ? options.planModeReasoningEffort : options.actModeReasoningEffort,
+				apiModelId: mode === "plan" ? options.planModeApiModelId : options.actModeApiModelId,
+				thinkingBudgetTokens:
+					mode === "plan" ? options.planModeThinkingBudgetTokens : options.actModeThinkingBudgetTokens,
+			})
+		case "openai-codex":
+			return new OpenAiCodexHandler({
+				onRetryAttempt: options.onRetryAttempt,
+				reasoningEffort: mode === "plan" ? options.planModeReasoningEffort : options.actModeReasoningEffort,
+				apiModelId: mode === "plan" ? options.planModeApiModelId : options.actModeApiModelId,
+			})
+		case "deepseek":
+			return new DeepSeekHandler({
+				onRetryAttempt: options.onRetryAttempt,
+				deepSeekApiKey: options.deepSeekApiKey,
+				apiModelId: mode === "plan" ? options.planModeApiModelId : options.actModeApiModelId,
+			})
+		case "requesty":
+			return new RequestyHandler({
+				onRetryAttempt: options.onRetryAttempt,
+				requestyBaseUrl: options.requestyBaseUrl,
+				requestyApiKey: options.requestyApiKey,
+				reasoningEffort: mode === "plan" ? options.planModeReasoningEffort : options.actModeReasoningEffort,
+				thinkingBudgetTokens:
+					mode === "plan" ? options.planModeThinkingBudgetTokens : options.actModeThinkingBudgetTokens,
+				requestyModelId: mode === "plan" ? options.planModeRequestyModelId : options.actModeRequestyModelId,
+				requestyModelInfo: mode === "plan" ? options.planModeRequestyModelInfo : options.actModeRequestyModelInfo,
+			})
+		case "fireworks":
+			return new FireworksHandler({
+				onRetryAttempt: options.onRetryAttempt,
+				fireworksApiKey: options.fireworksApiKey,
+				fireworksModelId: mode === "plan" ? options.planModeFireworksModelId : options.actModeFireworksModelId,
+			})
+		case "together":
+			return new TogetherHandler({
+				onRetryAttempt: options.onRetryAttempt,
+				togetherApiKey: options.togetherApiKey,
+				togetherModelId: mode === "plan" ? options.planModeTogetherModelId : options.actModeTogetherModelId,
+			})
+		case "qwen":
+			return new QwenHandler({
+				onRetryAttempt: options.onRetryAttempt,
+				qwenApiKey: options.qwenApiKey,
+				qwenApiLine:
+					options.qwenApiLine === QwenApiRegions.INTERNATIONAL ? QwenApiRegions.INTERNATIONAL : QwenApiRegions.CHINA,
+				apiModelId: mode === "plan" ? options.planModeApiModelId : options.actModeApiModelId,
+				thinkingBudgetTokens:
+					mode === "plan" ? options.planModeThinkingBudgetTokens : options.actModeThinkingBudgetTokens,
+			})
+		case "qwen-code":
+			return new QwenCodeHandler({
+				onRetryAttempt: options.onRetryAttempt,
+				qwenCodeOauthPath: options.qwenCodeOauthPath,
+				apiModelId: mode === "plan" ? options.planModeApiModelId : options.actModeApiModelId,
+			})
+		case "doubao":
+			return new DoubaoHandler({
+				onRetryAttempt: options.onRetryAttempt,
+				doubaoApiKey: options.doubaoApiKey,
+				apiModelId: mode === "plan" ? options.planModeApiModelId : options.actModeApiModelId,
+			})
+		case "mistral":
+			return new MistralHandler({
+				onRetryAttempt: options.onRetryAttempt,
+				mistralApiKey: options.mistralApiKey,
+				apiModelId: mode === "plan" ? options.planModeApiModelId : options.actModeApiModelId,
+			})
+		case "vscode-lm":
+			return new VsCodeLmHandler({
+				onRetryAttempt: options.onRetryAttempt,
+				vsCodeLmModelSelector:
+					mode === "plan" ? options.planModeVsCodeLmModelSelector : options.actModeVsCodeLmModelSelector,
+			})
+		case "cline": {
+			const configuredClineModelId = mode === "plan" ? options.planModeClineModelId : options.actModeClineModelId
+			const configuredClineModelInfo = mode === "plan" ? options.planModeClineModelInfo : options.actModeClineModelInfo
+			const clineModelId =
+				configuredClineModelId || (mode === "plan" ? options.planModeOpenRouterModelId : options.actModeOpenRouterModelId)
+			const clineModelInfo =
+				configuredClineModelInfo ||
+				(mode === "plan" ? options.planModeOpenRouterModelInfo : options.actModeOpenRouterModelInfo)
+			return new ClineHandler({
+				onRetryAttempt: options.onRetryAttempt,
+				clineAccountId: options.clineAccountId,
+				clineApiKey: options.clineApiKey,
+				ulid: options.ulid,
+				reasoningEffort: mode === "plan" ? options.planModeReasoningEffort : options.actModeReasoningEffort,
+				thinkingBudgetTokens:
+					mode === "plan" ? options.planModeThinkingBudgetTokens : options.actModeThinkingBudgetTokens,
+				openRouterProviderSorting: options.openRouterProviderSorting,
+				openRouterModelId: clineModelId,
+				openRouterModelInfo: clineModelInfo,
+				enableParallelToolCalling: options.enableParallelToolCalling,
+			})
+		}
+		case "cline-pass": {
+			const configuredClinePassModelId =
+				mode === "plan" ? options.planModeClinePassModelId : options.actModeClinePassModelId
+			const configuredClinePassModelInfo =
+				mode === "plan" ? options.planModeClinePassModelInfo : options.actModeClinePassModelInfo
+			const clineModelId = configuredClinePassModelId?.startsWith("cline-pass/")
+				? configuredClinePassModelId
+				: clinePassDefaultModelId
+			const clineModelInfo = configuredClinePassModelInfo || resolveClinePassModelInfo(clineModelId)
+			return new ClineHandler({
+				onRetryAttempt: options.onRetryAttempt,
+				clineAccountId: options.clineAccountId,
+				clineApiKey: options.clineApiKey,
+				ulid: options.ulid,
+				reasoningEffort: mode === "plan" ? options.planModeReasoningEffort : options.actModeReasoningEffort,
+				thinkingBudgetTokens:
+					mode === "plan" ? options.planModeThinkingBudgetTokens : options.actModeThinkingBudgetTokens,
+				openRouterProviderSorting: options.openRouterProviderSorting,
+				openRouterModelId: clineModelId,
+				openRouterModelInfo: clineModelInfo,
+				enableParallelToolCalling: options.enableParallelToolCalling,
+			})
+		}
+		case "litellm":
+			return new LiteLlmHandler({
+				onRetryAttempt: options.onRetryAttempt,
+				liteLlmApiKey: options.liteLlmApiKey,
+				liteLlmBaseUrl: options.liteLlmBaseUrl,
+				liteLlmModelId: mode === "plan" ? options.planModeLiteLlmModelId : options.actModeLiteLlmModelId,
+				liteLlmModelInfo: mode === "plan" ? options.planModeLiteLlmModelInfo : options.actModeLiteLlmModelInfo,
+				reasoningEffort: mode === "plan" ? options.planModeReasoningEffort : options.actModeReasoningEffort,
+				thinkingBudgetTokens:
+					mode === "plan" ? options.planModeThinkingBudgetTokens : options.actModeThinkingBudgetTokens,
+				liteLlmUsePromptCache: options.liteLlmUsePromptCache,
+				ulid: options.ulid,
+			})
+		case "moonshot":
+			return new MoonshotHandler({
+				onRetryAttempt: options.onRetryAttempt,
+				moonshotApiKey: options.moonshotApiKey,
+				moonshotApiLine: options.moonshotApiLine,
+				apiModelId: mode === "plan" ? options.planModeApiModelId : options.actModeApiModelId,
+			})
+		case "huggingface":
+			return new HuggingFaceHandler({
+				onRetryAttempt: options.onRetryAttempt,
+				huggingFaceApiKey: options.huggingFaceApiKey,
+				huggingFaceModelId: mode === "plan" ? options.planModeHuggingFaceModelId : options.actModeHuggingFaceModelId,
+				huggingFaceModelInfo:
+					mode === "plan" ? options.planModeHuggingFaceModelInfo : options.actModeHuggingFaceModelInfo,
+			})
+		case "nebius":
+			return new NebiusHandler({
+				onRetryAttempt: options.onRetryAttempt,
+				nebiusApiKey: options.nebiusApiKey,
+				apiModelId: mode === "plan" ? options.planModeApiModelId : options.actModeApiModelId,
+			})
+		case "asksage":
+			return new AskSageHandler({
+				onRetryAttempt: options.onRetryAttempt,
+				asksageApiKey: options.asksageApiKey,
+				asksageApiUrl: options.asksageApiUrl,
+				apiModelId: mode === "plan" ? options.planModeApiModelId : options.actModeApiModelId,
+			})
+		case "xai":
+			return new XAIHandler({
+				onRetryAttempt: options.onRetryAttempt,
+				xaiApiKey: options.xaiApiKey,
+				reasoningEffort: mode === "plan" ? options.planModeReasoningEffort : options.actModeReasoningEffort,
+				apiModelId: mode === "plan" ? options.planModeApiModelId : options.actModeApiModelId,
+			})
+		case "sambanova":
+			return new SambanovaHandler({
+				onRetryAttempt: options.onRetryAttempt,
+				sambanovaApiKey: options.sambanovaApiKey,
+				apiModelId: mode === "plan" ? options.planModeApiModelId : options.actModeApiModelId,
+			})
+		case "cerebras":
+			return new CerebrasHandler({
+				onRetryAttempt: options.onRetryAttempt,
+				cerebrasApiKey: options.cerebrasApiKey,
+				apiModelId: mode === "plan" ? options.planModeApiModelId : options.actModeApiModelId,
+			})
+		case "groq":
+			return new GroqHandler({
+				onRetryAttempt: options.onRetryAttempt,
+				groqApiKey: options.groqApiKey,
+				groqModelId: mode === "plan" ? options.planModeGroqModelId : options.actModeGroqModelId,
+				groqModelInfo: mode === "plan" ? options.planModeGroqModelInfo : options.actModeGroqModelInfo,
+				apiModelId: mode === "plan" ? options.planModeApiModelId : options.actModeApiModelId,
+			})
+		case "baseten":
+			return new BasetenHandler({
+				onRetryAttempt: options.onRetryAttempt,
+				basetenApiKey: options.basetenApiKey,
+				basetenModelId: mode === "plan" ? options.planModeBasetenModelId : options.actModeBasetenModelId,
+				basetenModelInfo: mode === "plan" ? options.planModeBasetenModelInfo : options.actModeBasetenModelInfo,
+				apiModelId: mode === "plan" ? options.planModeApiModelId : options.actModeApiModelId,
+			})
+		case "sapaicore":
+			return new SapAiCoreHandler({
+				onRetryAttempt: options.onRetryAttempt,
+				sapAiCoreClientId: options.sapAiCoreClientId,
+				sapAiCoreClientSecret: options.sapAiCoreClientSecret,
+				sapAiCoreTokenUrl: options.sapAiCoreTokenUrl,
+				sapAiResourceGroup: options.sapAiResourceGroup,
+				sapAiCoreBaseUrl: options.sapAiCoreBaseUrl,
+				apiModelId: mode === "plan" ? options.planModeApiModelId : options.actModeApiModelId,
+				thinkingBudgetTokens:
+					mode === "plan" ? options.planModeThinkingBudgetTokens : options.actModeThinkingBudgetTokens,
+				reasoningEffort: mode === "plan" ? options.planModeReasoningEffort : options.actModeReasoningEffort,
+				deploymentId: mode === "plan" ? options.planModeSapAiCoreDeploymentId : options.actModeSapAiCoreDeploymentId,
+				sapAiCoreUseOrchestrationMode: options.sapAiCoreUseOrchestrationMode,
+			})
+		case "claude-code":
+			return new ClaudeCodeHandler({
+				onRetryAttempt: options.onRetryAttempt,
+				claudeCodePath: options.claudeCodePath,
+				apiModelId: mode === "plan" ? options.planModeApiModelId : options.actModeApiModelId,
+				thinkingBudgetTokens:
+					mode === "plan" ? options.planModeThinkingBudgetTokens : options.actModeThinkingBudgetTokens,
+			})
+		case "huawei-cloud-maas":
+			return new HuaweiCloudMaaSHandler({
+				onRetryAttempt: options.onRetryAttempt,
+				huaweiCloudMaasApiKey: options.huaweiCloudMaasApiKey,
+				huaweiCloudMaasModelId:
+					mode === "plan" ? options.planModeHuaweiCloudMaasModelId : options.actModeHuaweiCloudMaasModelId,
+				huaweiCloudMaasModelInfo:
+					mode === "plan" ? options.planModeHuaweiCloudMaasModelInfo : options.actModeHuaweiCloudMaasModelInfo,
+			})
+		case "dify": // Add Dify.ai handler
+			return new DifyHandler({
+				difyApiKey: options.difyApiKey,
+				difyBaseUrl: options.difyBaseUrl,
+			})
+		case "vercel-ai-gateway":
+			return new VercelAIGatewayHandler({
+				onRetryAttempt: options.onRetryAttempt,
+				vercelAiGatewayApiKey: options.vercelAiGatewayApiKey,
+				openRouterModelId:
+					mode === "plan" ? options.planModeVercelAiGatewayModelId : options.actModeVercelAiGatewayModelId,
+				openRouterModelInfo:
+					mode === "plan" ? options.planModeVercelAiGatewayModelInfo : options.actModeVercelAiGatewayModelInfo,
+				reasoningEffort: mode === "plan" ? options.planModeReasoningEffort : options.actModeReasoningEffort,
+				thinkingBudgetTokens:
+					mode === "plan" ? options.planModeThinkingBudgetTokens : options.actModeThinkingBudgetTokens,
+			})
+		case "zai":
+			return new ZAiHandler({
+				onRetryAttempt: options.onRetryAttempt,
+				zaiApiLine: options.zaiApiLine,
+				zaiApiKey: options.zaiApiKey,
+				apiModelId: mode === "plan" ? options.planModeApiModelId : options.actModeApiModelId,
+			})
+		case "oca":
+			return new OcaHandler({
+				ocaMode: options.ocaMode || "internal",
+				ocaBaseUrl: options.ocaBaseUrl,
+				ocaModelId: mode === "plan" ? options.planModeOcaModelId : options.actModeOcaModelId,
+				ocaModelInfo: mode === "plan" ? options.planModeOcaModelInfo : options.actModeOcaModelInfo,
+				ocaReasoningEffort: mode === "plan" ? options.planModeOcaReasoningEffort : options.actModeOcaReasoningEffort,
+				thinkingBudgetTokens:
+					mode === "plan" ? options.planModeThinkingBudgetTokens : options.actModeThinkingBudgetTokens,
+				ocaUsePromptCache:
+					mode === "plan"
+						? options.planModeOcaModelInfo?.supportsPromptCache
+						: options.actModeOcaModelInfo?.supportsPromptCache,
+				taskId: options.ulid,
+			})
+		case "aihubmix":
+			return new AIhubmixHandler({
+				onRetryAttempt: options.onRetryAttempt,
+				apiKey: options.aihubmixApiKey,
+				baseURL: options.aihubmixBaseUrl,
+				appCode: options.aihubmixAppCode,
+				modelId: mode === "plan" ? (options as any).planModeAihubmixModelId : (options as any).actModeAihubmixModelId,
+				modelInfo:
+					mode === "plan" ? (options as any).planModeAihubmixModelInfo : (options as any).actModeAihubmixModelInfo,
+			})
+		case "minimax":
+			return new MinimaxHandler({
+				onRetryAttempt: options.onRetryAttempt,
+				minimaxApiKey: options.minimaxApiKey,
+				minimaxApiLine: options.minimaxApiLine,
+				apiModelId: mode === "plan" ? options.planModeApiModelId : options.actModeApiModelId,
+				thinkingBudgetTokens:
+					mode === "plan" ? options.planModeThinkingBudgetTokens : options.actModeThinkingBudgetTokens,
+			})
+		case "hicap":
+			return new HicapHandler({
+				onRetryAttempt: options.onRetryAttempt,
+				hicapApiKey: options.hicapApiKey,
+				hicapModelId: mode === "plan" ? options.planModeHicapModelId : options.actModeHicapModelId,
+			})
+		case "nousResearch":
+			return new NousResearchHandler({
+				onRetryAttempt: options.onRetryAttempt,
+				nousResearchApiKey: options.nousResearchApiKey,
+				apiModelId: mode === "plan" ? options.planModeNousResearchModelId : options.actModeNousResearchModelId,
+			})
+		case "wandb":
+			return new WandbHandler({
+				onRetryAttempt: options.onRetryAttempt,
+				wandbApiKey: options.wandbApiKey,
+				apiModelId: mode === "plan" ? options.planModeApiModelId : options.actModeApiModelId,
+			})
+		default:
+			return new AnthropicHandler({
+				onRetryAttempt: options.onRetryAttempt,
+				apiKey: options.apiKey,
+				anthropicBaseUrl: options.anthropicBaseUrl,
+				apiModelId: mode === "plan" ? options.planModeApiModelId : options.actModeApiModelId,
+				reasoningEffort: mode === "plan" ? options.planModeReasoningEffort : options.actModeReasoningEffort,
+				thinkingBudgetTokens:
+					mode === "plan" ? options.planModeThinkingBudgetTokens : options.actModeThinkingBudgetTokens,
+			})
+	}
+}
+
+export function buildApiHandler(configuration: ApiConfiguration, mode: Mode): ApiHandler {
+	const { planModeApiProvider, actModeApiProvider, ...options } = configuration
+
+	const apiProvider = mode === "plan" ? planModeApiProvider : actModeApiProvider
+
+	// Validate thinking budget tokens against model's maxTokens to prevent API errors
+	// wrapped in a try-catch for safety, but this should never throw
+	try {
+		const thinkingBudgetTokens = mode === "plan" ? options.planModeThinkingBudgetTokens : options.actModeThinkingBudgetTokens
+		if (thinkingBudgetTokens && thinkingBudgetTokens > 0) {
+			const handler = createHandlerForProvider(apiProvider, options, mode)
+
+			const modelInfo = handler.getModel().info
+			if (modelInfo?.maxTokens && modelInfo.maxTokens > 0 && thinkingBudgetTokens > modelInfo.maxTokens) {
+				const clippedValue = modelInfo.maxTokens - 1
+				if (mode === "plan") {
+					options.planModeThinkingBudgetTokens = clippedValue
+				} else {
+					options.actModeThinkingBudgetTokens = clippedValue
+				}
+			} else {
+				return handler // don't rebuild unless its necessary
+			}
+		}
+	} catch (error) {
+		Logger.error("buildApiHandler error:", error)
+	}
+
+	return createHandlerForProvider(apiProvider, options, mode)
+}

apps/vscode/src/core/api/providers/__tests__/anthropic.test.ts

@@ -0,0 +1,260 @@
+import { afterEach, describe, it } from "mocha"
+import sinon from "sinon"
+import "should"
+import { anthropicModels } from "@shared/api"
+import { ANTHROPIC_FAST_MODE_BETA, AnthropicHandler } from "../anthropic"
+
+describe("AnthropicHandler", () => {
+	afterEach(() => {
+		sinon.restore()
+	})
+
+	const createAsyncIterable = (data: readonly unknown[] = []) => ({
+		[Symbol.asyncIterator]: async function* () {
+			yield* data
+		},
+	})
+
+	describe("getModel", () => {
+		it("should return the fast mode model when configured", () => {
+			const handler = new AnthropicHandler({
+				apiKey: "test-api-key",
+				apiModelId: "claude-opus-4-6:fast",
+			})
+
+			const result = handler.getModel()
+
+			result.id.should.equal("claude-opus-4-6:fast")
+			result.info.should.deepEqual(anthropicModels["claude-opus-4-6:fast"])
+		})
+
+		it("should return the 1m fast mode model when configured", () => {
+			const handler = new AnthropicHandler({
+				apiKey: "test-api-key",
+				apiModelId: "claude-opus-4-6:1m:fast",
+			})
+
+			const result = handler.getModel()
+
+			result.id.should.equal("claude-opus-4-6:1m:fast")
+			result.info.should.deepEqual(anthropicModels["claude-opus-4-6:1m:fast"])
+		})
+
+		it("should return the 4.7 model when configured", () => {
+			const handler = new AnthropicHandler({
+				apiKey: "test-api-key",
+				apiModelId: "claude-opus-4-7",
+			})
+
+			const result = handler.getModel()
+
+			result.id.should.equal("claude-opus-4-7")
+			result.info.should.deepEqual(anthropicModels["claude-opus-4-7"])
+		})
+
+		it("should return the 4.7 1m model when configured", () => {
+			const handler = new AnthropicHandler({
+				apiKey: "test-api-key",
+				apiModelId: "claude-opus-4-7:1m",
+			})
+
+			const result = handler.getModel()
+
+			result.id.should.equal("claude-opus-4-7:1m")
+			result.info.should.deepEqual(anthropicModels["claude-opus-4-7:1m"])
+		})
+
+		it("should return the 4.8 model when configured", () => {
+			const handler = new AnthropicHandler({
+				apiKey: "test-api-key",
+				apiModelId: "claude-opus-4-8",
+			})
+
+			const result = handler.getModel()
+
+			result.id.should.equal("claude-opus-4-8")
+			result.info.should.deepEqual(anthropicModels["claude-opus-4-8"])
+		})
+
+		it("should return the 4.8 1m model when configured", () => {
+			const handler = new AnthropicHandler({
+				apiKey: "test-api-key",
+				apiModelId: "claude-opus-4-8:1m",
+			})
+
+			const result = handler.getModel()
+
+			result.id.should.equal("claude-opus-4-8:1m")
+			result.info.should.deepEqual(anthropicModels["claude-opus-4-8:1m"])
+		})
+
+		it("should return the Fable 5 model when configured", () => {
+			const handler = new AnthropicHandler({
+				apiKey: "test-api-key",
+				apiModelId: "claude-fable-5",
+			})
+
+			const result = handler.getModel()
+
+			result.id.should.equal("claude-fable-5")
+			result.info.should.deepEqual(anthropicModels["claude-fable-5"])
+		})
+
+		it("should return the Fable 5 1m model when configured", () => {
+			const handler = new AnthropicHandler({
+				apiKey: "test-api-key",
+				apiModelId: "claude-fable-5:1m",
+			})
+
+			const result = handler.getModel()
+
+			result.id.should.equal("claude-fable-5:1m")
+			result.info.should.deepEqual(anthropicModels["claude-fable-5:1m"])
+		})
+	})
+
+	describe("createMessage", () => {
+		it("should route fast mode requests through the beta messages API", async () => {
+			const handler = new AnthropicHandler({
+				apiKey: "test-api-key",
+				apiModelId: "claude-opus-4-6:fast",
+			})
+
+			const standardCreate = sinon.stub().resolves(createAsyncIterable())
+			const betaCreate = sinon.stub().callsFake(function (this: { _client?: object }, _params: unknown) {
+				should.exist(this._client)
+				return Promise.resolve(createAsyncIterable())
+			})
+
+			sinon.stub(handler as unknown as { ensureClient: () => unknown }, "ensureClient").returns({
+				messages: {
+					create: standardCreate,
+				},
+				beta: {
+					messages: {
+						_client: {},
+						create: betaCreate,
+					},
+				},
+			})
+
+			for await (const _chunk of handler.createMessage("system prompt", [{ role: "user", content: "Hello" }])) {
+			}
+
+			sinon.assert.notCalled(standardCreate)
+			sinon.assert.calledOnce(betaCreate)
+			sinon.assert.calledWithMatch(betaCreate, {
+				model: "claude-opus-4-6",
+				betas: [ANTHROPIC_FAST_MODE_BETA],
+				speed: "fast",
+				stream: true,
+			})
+		})
+
+		it("should include the 1m beta when routing 1m fast mode requests through the beta messages API", async () => {
+			const handler = new AnthropicHandler({
+				apiKey: "test-api-key",
+				apiModelId: "claude-opus-4-6:1m:fast",
+			})
+
+			const standardCreate = sinon.stub().resolves(createAsyncIterable())
+			const betaCreate = sinon.stub().callsFake(function (this: { _client?: object }, _params: unknown) {
+				should.exist(this._client)
+				return Promise.resolve(createAsyncIterable())
+			})
+
+			sinon.stub(handler as unknown as { ensureClient: () => unknown }, "ensureClient").returns({
+				messages: {
+					create: standardCreate,
+				},
+				beta: {
+					messages: {
+						_client: {},
+						create: betaCreate,
+					},
+				},
+			})
+
+			for await (const _chunk of handler.createMessage("system prompt", [{ role: "user", content: "Hello" }])) {
+			}
+
+			sinon.assert.notCalled(standardCreate)
+			sinon.assert.calledOnce(betaCreate)
+			sinon.assert.calledWithMatch(betaCreate, {
+				model: "claude-opus-4-6",
+				betas: [ANTHROPIC_FAST_MODE_BETA, "context-1m-2025-08-07"],
+				speed: "fast",
+				stream: true,
+			})
+		})
+
+		it("should include the 1m beta header for Claude Opus 4.7 1m requests", async () => {
+			const handler = new AnthropicHandler({
+				apiKey: "test-api-key",
+				apiModelId: "claude-opus-4-7:1m",
+				reasoningEffort: "high",
+			})
+
+			const standardCreate = sinon.stub().resolves(createAsyncIterable())
+
+			sinon.stub(handler as unknown as { ensureClient: () => unknown }, "ensureClient").returns({
+				messages: {
+					create: standardCreate,
+				},
+				beta: {
+					messages: {
+						_client: {},
+						create: sinon.stub().resolves(createAsyncIterable()),
+					},
+				},
+			})
+
+			for await (const _chunk of handler.createMessage("system prompt", [{ role: "user", content: "Hello" }])) {
+			}
+
+			sinon.assert.calledOnce(standardCreate)
+			const requestBody = standardCreate.firstCall.args[0] as Record<string, any>
+			const requestOptions = standardCreate.firstCall.args[1] as Record<string, any>
+			requestBody.model.should.equal("claude-opus-4-7")
+			requestBody.thinking.should.deepEqual({ type: "adaptive" })
+			requestOptions.should.deepEqual({
+				headers: {
+					"anthropic-beta": "context-1m-2025-08-07",
+				},
+			})
+		})
+
+		it("should use adaptive thinking and output_config for Claude Opus adaptive models", async () => {
+			const handler = new AnthropicHandler({
+				apiKey: "test-api-key",
+				apiModelId: "claude-opus-4-7",
+				reasoningEffort: "xhigh",
+			})
+
+			const standardCreate = sinon.stub().resolves(createAsyncIterable())
+
+			sinon.stub(handler as unknown as { ensureClient: () => unknown }, "ensureClient").returns({
+				messages: {
+					create: standardCreate,
+				},
+				beta: {
+					messages: {
+						_client: {},
+						create: sinon.stub().resolves(createAsyncIterable()),
+					},
+				},
+			})
+
+			for await (const _chunk of handler.createMessage("system prompt", [{ role: "user", content: "Hello" }])) {
+			}
+
+			sinon.assert.calledOnce(standardCreate)
+			const requestBody = standardCreate.firstCall.args[0] as Record<string, any>
+			requestBody.should.have.property("thinking")
+			requestBody.thinking.should.deepEqual({ type: "adaptive" })
+			requestBody.should.have.property("output_config")
+			requestBody.output_config.should.deepEqual({ effort: "xhigh" })
+			should(requestBody.temperature).equal(undefined)
+		})
+	})
+})

apps/vscode/src/core/api/providers/__tests__/claude-code.test.ts

@@ -0,0 +1,488 @@
+import { afterEach, beforeEach, describe, it } from "mocha"
+import sinon from "sinon"
+import "should"
+import { ClaudeCodeHandler } from "@core/api/providers/claude-code"
+import { ClineStorageMessage } from "@/shared/messages/content"
+
+describe("ClaudeCodeHandler", () => {
+	let handler: ClaudeCodeHandler
+	let sandbox: sinon.SinonSandbox
+
+	beforeEach(() => {
+		sandbox = sinon.createSandbox()
+		handler = new ClaudeCodeHandler({
+			claudeCodePath: "/mock/path",
+			apiModelId: "claude-opus-4-1-20250805",
+		})
+	})
+
+	afterEach(() => {
+		sandbox.restore()
+	})
+
+	describe("token counting", () => {
+		it("should correctly handle token usage from assistant messages", async () => {
+			// The 'input_tokens' field represents the TOTAL number of input tokens used.
+			// See https://docs.anthropic.com/en/api/messages#usage-object
+
+			// Mock the runClaudeCode function
+			const runClaudeCodeModule = await import("@/integrations/claude-code/run")
+			const runClaudeCodeStub = sandbox.stub(runClaudeCodeModule, "runClaudeCode")
+
+			// Create a proper async generator mock for the Claude Code response
+			async function* mockGenerator() {
+				// First yield the system init
+				yield {
+					type: "system",
+					subtype: "init",
+					apiKeySource: "api",
+				}
+
+				// Yield assistant message with usage data
+				// Example: If base input is 70 tokens, cache read is 20, and cache creation is 10,
+				// then input_tokens from Anthropic API will be 100 (70 + 20 + 10)
+				yield {
+					type: "assistant",
+					message: {
+						content: [
+							{
+								type: "text",
+								text: "Test response",
+							},
+						],
+						usage: {
+							input_tokens: 100, // Total including cache (per Anthropic docs)
+							output_tokens: 50,
+							cache_read_input_tokens: 20, // Already included in input_tokens
+							cache_creation_input_tokens: 10, // Already included in input_tokens
+						},
+						stop_reason: "end_turn",
+					},
+				}
+
+				// Yield result with cost
+				yield {
+					type: "result",
+					result: {},
+					total_cost_usd: 0.005,
+				}
+			}
+
+			runClaudeCodeStub.returns(mockGenerator() as any)
+
+			const systemPrompt = "You are a helpful assistant."
+			const messages: ClineStorageMessage[] = [{ role: "user", content: "Hello" }]
+
+			const usageData: any[] = []
+
+			// Collect the results
+			for await (const chunk of handler.createMessage(systemPrompt, messages)) {
+				if (chunk.type === "usage") {
+					usageData.push({
+						inputTokens: chunk.inputTokens,
+						outputTokens: chunk.outputTokens,
+						cacheReadTokens: chunk.cacheReadTokens,
+						cacheWriteTokens: chunk.cacheWriteTokens,
+						totalCost: chunk.totalCost,
+					})
+				}
+			}
+
+			// Verify token counting follows Anthropic API specification
+			usageData.should.have.length(1)
+			usageData[0].should.deepEqual({
+				inputTokens: 100, // Total including cache tokens (per Anthropic API docs)
+				outputTokens: 50,
+				cacheReadTokens: 20, // Tracked separately for reporting
+				cacheWriteTokens: 10, // Tracked separately for reporting
+				totalCost: 0.005,
+			})
+
+			// CRITICAL ASSERTION: Verify that input_tokens is NOT inflated by re-adding cache tokens
+			// The bug would have caused inputTokens to be incorrectly calculated as 130 (100 + 20 + 10)
+			// The fix ensures it remains 100, as per Anthropic's specification
+			usageData[0].inputTokens.should.equal(100) // Correct: matches API response
+			usageData[0].inputTokens.should.not.equal(130) // Would be wrong: double-counting cache tokens
+		})
+
+		it("should handle missing usage fields with nullish coalescing", async () => {
+			// Mock the runClaudeCode function
+			const runClaudeCodeModule = await import("@/integrations/claude-code/run")
+			const runClaudeCodeStub = sandbox.stub(runClaudeCodeModule, "runClaudeCode")
+
+			// Create a proper async generator mock with missing/undefined usage fields
+			async function* mockGenerator() {
+				yield {
+					type: "assistant",
+					message: {
+						content: [
+							{
+								type: "text",
+								text: "Test response",
+							},
+						],
+						usage: {
+							input_tokens: 100,
+							output_tokens: 50,
+							// cache fields are undefined/missing
+						},
+						stop_reason: "end_turn",
+					},
+				}
+
+				yield {
+					type: "result",
+					result: {},
+					total_cost_usd: 0.005,
+				}
+			}
+
+			runClaudeCodeStub.returns(mockGenerator() as any)
+
+			const systemPrompt = "You are a helpful assistant."
+			const messages: ClineStorageMessage[] = [{ role: "user", content: "Hello" }]
+
+			const usageData: any[] = []
+
+			// Collect the results
+			for await (const chunk of handler.createMessage(systemPrompt, messages)) {
+				if (chunk.type === "usage") {
+					usageData.push({
+						inputTokens: chunk.inputTokens,
+						outputTokens: chunk.outputTokens,
+						cacheReadTokens: chunk.cacheReadTokens,
+						cacheWriteTokens: chunk.cacheWriteTokens,
+					})
+				}
+			}
+
+			// Verify that undefined cache tokens default to 0
+			usageData.should.have.length(1)
+			usageData[0].should.deepEqual({
+				inputTokens: 100,
+				outputTokens: 50,
+				cacheReadTokens: 0, // Should default to 0
+				cacheWriteTokens: 0, // Should default to 0
+			})
+		})
+
+		it("should handle completely missing usage object", async () => {
+			// Mock the runClaudeCode function
+			const runClaudeCodeModule = await import("@/integrations/claude-code/run")
+			const runClaudeCodeStub = sandbox.stub(runClaudeCodeModule, "runClaudeCode")
+
+			// Create a proper async generator mock with missing usage object
+			async function* mockGenerator() {
+				yield {
+					type: "assistant",
+					message: {
+						content: [
+							{
+								type: "text",
+								text: "Test response",
+							},
+						],
+						// usage is undefined
+						usage: undefined,
+						stop_reason: "end_turn",
+					},
+				}
+
+				// Need to yield a result chunk to trigger usage data emission
+				yield {
+					type: "result",
+					result: {},
+					total_cost_usd: 0,
+				}
+			}
+
+			runClaudeCodeStub.returns(mockGenerator() as any)
+
+			const systemPrompt = "You are a helpful assistant."
+			const messages: ClineStorageMessage[] = [{ role: "user", content: "Hello" }]
+
+			const usageData: any[] = []
+
+			// Collect the results
+			for await (const chunk of handler.createMessage(systemPrompt, messages)) {
+				if (chunk.type === "usage") {
+					usageData.push({
+						inputTokens: chunk.inputTokens,
+						outputTokens: chunk.outputTokens,
+						cacheReadTokens: chunk.cacheReadTokens,
+						cacheWriteTokens: chunk.cacheWriteTokens,
+					})
+				}
+			}
+
+			// All token counts should default to 0 when usage is undefined
+			usageData.should.have.length(1)
+			usageData[0].should.deepEqual({
+				inputTokens: 0,
+				outputTokens: 0,
+				cacheReadTokens: 0,
+				cacheWriteTokens: 0,
+			})
+		})
+	})
+
+	describe("error handling", () => {
+		it("should not crash when assistant message has empty content array", async () => {
+			const runClaudeCodeModule = await import("@/integrations/claude-code/run")
+			const runClaudeCodeStub = sandbox.stub(runClaudeCodeModule, "runClaudeCode")
+
+			async function* mockGenerator() {
+				yield {
+					type: "assistant",
+					message: {
+						content: [], // empty content — triggered TypeError in older code
+						usage: {
+							input_tokens: 10,
+							output_tokens: 0,
+						},
+						stop_reason: "end_turn",
+					},
+				}
+
+				yield {
+					type: "result",
+					result: {},
+					total_cost_usd: 0,
+				}
+			}
+
+			runClaudeCodeStub.returns(mockGenerator() as any)
+
+			const chunks: any[] = []
+			// Should not throw
+			for await (const chunk of handler.createMessage("system", [{ role: "user", content: "hi" }])) {
+				chunks.push(chunk)
+			}
+
+			const usageChunk = chunks.find((c) => c.type === "usage")
+			usageChunk.should.be.ok()
+			usageChunk.inputTokens.should.equal(10)
+		})
+
+		it("should throw when result has is_error=true (e.g. rate limit with no assistant message)", async () => {
+			const runClaudeCodeModule = await import("@/integrations/claude-code/run")
+			const runClaudeCodeStub = sandbox.stub(runClaudeCodeModule, "runClaudeCode")
+
+			async function* mockGenerator() {
+				yield {
+					type: "system",
+					subtype: "init",
+					apiKeySource: "none",
+				}
+
+				yield {
+					type: "system",
+					subtype: "rate_limit_event",
+					message: "Rate limit hit",
+					retryAfterSeconds: 30,
+				}
+
+				// No assistant message — CLI hit rate limit and gave up
+				yield {
+					type: "result",
+					subtype: "error",
+					is_error: true,
+					result: "Rate limit exceeded",
+					total_cost_usd: 0,
+					duration_ms: 1000,
+					duration_api_ms: 500,
+					num_turns: 0,
+					session_id: "test",
+				}
+			}
+
+			runClaudeCodeStub.returns(mockGenerator() as any)
+
+			let thrownError: Error | undefined
+			try {
+				for await (const _ of handler.createMessage("system", [{ role: "user", content: "hi" }])) {
+					// consume
+				}
+			} catch (err) {
+				thrownError = err as Error
+			}
+
+			thrownError!.message.should.containEql("Rate limit exceeded")
+		})
+
+		it("should ignore rate_limit_event system messages without throwing", async () => {
+			const runClaudeCodeModule = await import("@/integrations/claude-code/run")
+			const runClaudeCodeStub = sandbox.stub(runClaudeCodeModule, "runClaudeCode")
+
+			async function* mockGenerator() {
+				yield {
+					type: "system",
+					subtype: "init",
+					apiKeySource: "none",
+				}
+
+				// Newer Claude Code CLI emits this during rate limiting
+				yield {
+					type: "system",
+					subtype: "rate_limit_event",
+					message: "Rate limit hit, retrying...",
+					retryAfterSeconds: 30,
+				}
+
+				yield {
+					type: "assistant",
+					message: {
+						content: [{ type: "text", text: "Response after retry" }],
+						usage: { input_tokens: 20, output_tokens: 10 },
+						stop_reason: "end_turn",
+					},
+				}
+
+				yield {
+					type: "result",
+					result: {},
+					total_cost_usd: 0,
+				}
+			}
+
+			runClaudeCodeStub.returns(mockGenerator() as any)
+
+			const textChunks: string[] = []
+			for await (const chunk of handler.createMessage("system", [{ role: "user", content: "hi" }])) {
+				if (chunk.type === "text") textChunks.push(chunk.text)
+			}
+
+			textChunks.should.deepEqual(["Response after retry"])
+		})
+	})
+
+	describe("getModel", () => {
+		it("should return the correct model when specified", () => {
+			const handler = new ClaudeCodeHandler({
+				apiModelId: "claude-sonnet-4-5-20250929",
+			})
+
+			const model = handler.getModel()
+			model.id.should.equal("claude-sonnet-4-5-20250929")
+		})
+
+		it("should support Opus 4.6 1m model id", () => {
+			const handler = new ClaudeCodeHandler({
+				apiModelId: "claude-opus-4-6[1m]",
+			})
+
+			const model = handler.getModel()
+			model.id.should.equal("claude-opus-4-6[1m]")
+			model.info.contextWindow.should.equal(1_000_000)
+		})
+
+		it("should support Opus 4.7 model id", () => {
+			const handler = new ClaudeCodeHandler({
+				apiModelId: "claude-opus-4-7",
+			})
+
+			const model = handler.getModel()
+			model.id.should.equal("claude-opus-4-7")
+			model.info.contextWindow.should.equal(200_000)
+		})
+
+		it("should support Opus 4.7 1m model id", () => {
+			const handler = new ClaudeCodeHandler({
+				apiModelId: "claude-opus-4-7[1m]",
+			})
+
+			const model = handler.getModel()
+			model.id.should.equal("claude-opus-4-7[1m]")
+			model.info.contextWindow.should.equal(1_000_000)
+		})
+
+		it("should support Opus 4.8 model id", () => {
+			const handler = new ClaudeCodeHandler({
+				apiModelId: "claude-opus-4-8",
+			})
+
+			const model = handler.getModel()
+			model.id.should.equal("claude-opus-4-8")
+			model.info.contextWindow.should.equal(200_000)
+		})
+
+		it("should support Opus 4.8 1m model id", () => {
+			const handler = new ClaudeCodeHandler({
+				apiModelId: "claude-opus-4-8[1m]",
+			})
+
+			const model = handler.getModel()
+			model.id.should.equal("claude-opus-4-8[1m]")
+			model.info.contextWindow.should.equal(1_000_000)
+		})
+
+		it("should support Fable 5 model id", () => {
+			const handler = new ClaudeCodeHandler({
+				apiModelId: "claude-fable-5",
+			})
+
+			const model = handler.getModel()
+			model.id.should.equal("claude-fable-5")
+			model.info.contextWindow.should.equal(200_000)
+		})
+
+		it("should support Fable 5 1m model id", () => {
+			const handler = new ClaudeCodeHandler({
+				apiModelId: "claude-fable-5[1m]",
+			})
+
+			const model = handler.getModel()
+			model.id.should.equal("claude-fable-5[1m]")
+			model.info.contextWindow.should.equal(1_000_000)
+		})
+
+		it("should support Opus 1m alias model id", () => {
+			const handler = new ClaudeCodeHandler({
+				apiModelId: "opus[1m]",
+			})
+
+			const model = handler.getModel()
+			model.id.should.equal("opus[1m]")
+			model.info.contextWindow.should.equal(1_000_000)
+		})
+
+		it("should support Sonnet 1m alias model id", () => {
+			const handler = new ClaudeCodeHandler({
+				apiModelId: "sonnet[1m]",
+			})
+
+			const model = handler.getModel()
+			model.id.should.equal("sonnet[1m]")
+			model.info.contextWindow.should.equal(1_000_000)
+		})
+
+		it("should support Sonnet 4.5 1m model id", () => {
+			const handler = new ClaudeCodeHandler({
+				apiModelId: "claude-sonnet-4-5-20250929[1m]",
+			})
+
+			const model = handler.getModel()
+			model.id.should.equal("claude-sonnet-4-5-20250929[1m]")
+			model.info.contextWindow.should.equal(1_000_000)
+		})
+
+		it("should support Sonnet 4.6 1m model id", () => {
+			const handler = new ClaudeCodeHandler({
+				apiModelId: "claude-sonnet-4-6[1m]",
+			})
+
+			const model = handler.getModel()
+			model.id.should.equal("claude-sonnet-4-6[1m]")
+			model.info.contextWindow.should.equal(1_000_000)
+		})
+
+		it("should return default model when not specified", () => {
+			const handler = new ClaudeCodeHandler({})
+
+			const model = handler.getModel()
+			// The default model should be set
+			model.id.should.be.type("string")
+			model.info.should.be.type("object")
+		})
+	})
+})

apps/vscode/src/core/api/providers/__tests__/cline.test.ts

@@ -0,0 +1,197 @@
+import "should"
+import { openRouterDefaultModelInfo } from "@shared/api"
+import sinon from "sinon"
+import { ClineAccountService } from "@/services/account/ClineAccountService"
+import { AuthService } from "@/services/auth/AuthService"
+import { ClineError, ClineErrorType } from "@/services/error/ClineError"
+import { ClineHandler } from "../cline"
+
+describe("ClineHandler", () => {
+	afterEach(() => {
+		sinon.restore()
+	})
+
+	const createAsyncIterable = (data: any[] = []) => ({
+		[Symbol.asyncIterator]: async function* () {
+			yield* data
+		},
+	})
+
+	const createHandler = (options: ConstructorParameters<typeof ClineHandler>[0]) => {
+		sinon.stub(ClineAccountService, "getInstance").returns({} as any)
+		sinon.stub(AuthService, "getInstance").returns({} as any)
+		return new ClineHandler(options)
+	}
+
+	it("should handle usage-only chunks when delta is missing", async () => {
+		const handler = createHandler({})
+		const fakeClient = {
+			chat: {
+				completions: {
+					create: sinon.stub().resolves(
+						createAsyncIterable([
+							{
+								choices: [{}],
+								usage: {
+									prompt_tokens: 17,
+									completion_tokens: 9,
+								},
+							},
+						]),
+					),
+				},
+			},
+		}
+		sinon.stub(handler as any, "ensureClient").resolves(fakeClient as any)
+		sinon.stub(handler, "getModel").returns({
+			id: "openai/gpt-4o-mini",
+			info: openRouterDefaultModelInfo,
+		})
+
+		const chunks: any[] = []
+		for await (const chunk of handler.createMessage("system", [{ role: "user", content: "hi" }])) {
+			chunks.push(chunk)
+		}
+
+		chunks.should.deepEqual([
+			{
+				type: "usage",
+				cacheWriteTokens: 0,
+				cacheReadTokens: 0,
+				inputTokens: 17,
+				outputTokens: 9,
+				totalCost: 0,
+			},
+		])
+	})
+
+	it("should read Anthropic-style cache creation and read tokens from usage chunks", async () => {
+		const handler = createHandler({})
+		const fakeClient = {
+			chat: {
+				completions: {
+					create: sinon.stub().resolves(
+						createAsyncIterable([
+							{
+								choices: [{}],
+								usage: {
+									prompt_tokens: 1000,
+									completion_tokens: 200,
+									prompt_tokens_details: {
+										cached_tokens: 500,
+									},
+									cache_creation_input_tokens: 300,
+								},
+							},
+						]),
+					),
+				},
+			},
+		}
+		sinon.stub(handler as any, "ensureClient").resolves(fakeClient as any)
+		sinon.stub(handler, "getModel").returns({
+			id: "anthropic/claude-sonnet-4.6",
+			info: openRouterDefaultModelInfo,
+		})
+
+		const chunks: any[] = []
+		for await (const chunk of handler.createMessage("system", [{ role: "user", content: "hi" }])) {
+			chunks.push(chunk)
+		}
+
+		chunks.should.deepEqual([
+			{
+				type: "usage",
+				cacheWriteTokens: 300,
+				cacheReadTokens: 500,
+				inputTokens: 200,
+				outputTokens: 200,
+				totalCost: 0,
+			},
+		])
+	})
+
+	it("should forward enableParallelToolCalling to OpenRouter payload", async () => {
+		const handler = createHandler({ enableParallelToolCalling: true })
+		const createStub = sinon.stub().resolves(createAsyncIterable([]))
+		const fakeClient = {
+			chat: {
+				completions: {
+					create: createStub,
+				},
+			},
+		}
+		sinon.stub(handler as any, "ensureClient").resolves(fakeClient as any)
+		sinon.stub(handler, "getModel").returns({
+			id: "openai/gpt-4o-mini",
+			info: openRouterDefaultModelInfo,
+		})
+
+		const tools = [
+			{ type: "function", function: { name: "read_file", description: "", parameters: { type: "object" } } },
+		] as any
+		for await (const _chunk of handler.createMessage("system", [{ role: "user", content: "hi" }], tools)) {
+			// drain stream
+		}
+
+		const payload = createStub.firstCall.args[0]
+		payload.parallel_tool_calls.should.equal(true)
+	})
+
+	it("should send cache_control for qwen3.7-max without changing the selected Cline model id", async () => {
+		const handler = createHandler({
+			openRouterModelId: "qwen/qwen3.7-max",
+			openRouterModelInfo: openRouterDefaultModelInfo,
+		})
+		const createStub = sinon.stub().resolves(createAsyncIterable([]))
+		const fakeClient = {
+			chat: {
+				completions: {
+					create: createStub,
+				},
+			},
+		}
+		sinon.stub(handler as any, "ensureClient").resolves(fakeClient as any)
+		sinon.stub(handler as any, "getFreeModelIdSet").resolves(new Set())
+
+		for await (const _chunk of handler.createMessage("system", [{ role: "user", content: "hi" }])) {
+			// drain stream
+		}
+
+		handler.getModel().id.should.equal("qwen/qwen3.7-max")
+		const payload = createStub.firstCall.args[0]
+		payload.model.should.equal("qwen/qwen3.7-max")
+		payload.messages[0].content[0].cache_control.should.deepEqual({ type: "ephemeral" })
+		payload.messages[1].content[0].cache_control.should.deepEqual({ type: "ephemeral" })
+	})
+
+	it("propagates a pre-stream 403 entitlement error so it classifies as Entitlement", async () => {
+		const handler = createHandler({})
+		// A 403 from ValidateModelEntitlement rejects completions.create() before streaming,
+		// matching the OpenAI SDK APIError shape (status + code + error body).
+		const apiError = Object.assign(new Error("403 the user is not subscribed to required model plan"), {
+			status: 403,
+			code: "ENTITLEMENT_ERROR",
+			error: {
+				code: "ENTITLEMENT_ERROR",
+				message: "Error 403: the user is not subscribed to required model plan",
+			},
+		})
+		const fakeClient = { chat: { completions: { create: sinon.stub().rejects(apiError) } } }
+		sinon.stub(handler as any, "ensureClient").resolves(fakeClient as any)
+		sinon.stub(handler as any, "getFreeModelIdSet").resolves(new Set())
+		sinon.stub(handler, "getModel").returns({ id: "cline-pass/glm-5.1", info: openRouterDefaultModelInfo })
+
+		let thrown: unknown
+		try {
+			for await (const _chunk of handler.createMessage("system", [{ role: "user", content: "hi" }])) {
+				// drain
+			}
+		} catch (e) {
+			thrown = e
+		}
+
+		const clineError = ClineError.transform(thrown, "cline-pass/glm-5.1", "cline-pass")
+		clineError.isErrorType(ClineErrorType.Entitlement).should.be.true()
+	})
+})

apps/vscode/src/core/api/providers/__tests__/fireworks.test.ts

@@ -0,0 +1,97 @@
+import "should"
+import sinon from "sinon"
+import { FireworksHandler } from "../fireworks"
+
+describe("FireworksHandler", () => {
+	afterEach(() => {
+		sinon.restore()
+	})
+
+	const createAsyncIterable = (data: any[] = []) => ({
+		[Symbol.asyncIterator]: async function* () {
+			yield* data
+		},
+	})
+
+	it("should handle usage-only chunks when delta is missing", async () => {
+		const handler = new FireworksHandler({
+			fireworksApiKey: "test-api-key",
+			fireworksModelId: "accounts/fireworks/models/llama-v3p1-8b-instruct",
+		})
+		const fakeClient = {
+			chat: {
+				completions: {
+					create: sinon.stub().resolves(
+						createAsyncIterable([
+							{
+								choices: [{}],
+								usage: {
+									prompt_tokens: 19,
+									completion_tokens: 4,
+								},
+							},
+						]),
+					),
+				},
+			},
+		}
+		sinon.stub(handler as any, "ensureClient").returns(fakeClient as any)
+
+		const chunks: any[] = []
+		for await (const chunk of handler.createMessage("system", [{ role: "user", content: "hi" }])) {
+			chunks.push(chunk)
+		}
+
+		chunks.should.deepEqual([
+			{
+				type: "usage",
+				inputTokens: 19,
+				outputTokens: 4,
+				cacheReadTokens: 0,
+				cacheWriteTokens: 0,
+			},
+		])
+	})
+
+	it("should read cache hits from prompt_tokens_details when hit tokens are not present", async () => {
+		const handler = new FireworksHandler({
+			fireworksApiKey: "test-api-key",
+			fireworksModelId: "accounts/fireworks/models/llama-v3p1-8b-instruct",
+		})
+		const fakeClient = {
+			chat: {
+				completions: {
+					create: sinon.stub().resolves(
+						createAsyncIterable([
+							{
+								choices: [{}],
+								usage: {
+									prompt_tokens: 60,
+									completion_tokens: 12,
+									prompt_tokens_details: { cached_tokens: 20 },
+									prompt_cache_miss_tokens: 40,
+								},
+							},
+						]),
+					),
+				},
+			},
+		}
+		sinon.stub(handler as any, "ensureClient").returns(fakeClient as any)
+
+		const chunks: any[] = []
+		for await (const chunk of handler.createMessage("system", [{ role: "user", content: "hi" }])) {
+			chunks.push(chunk)
+		}
+
+		chunks.should.deepEqual([
+			{
+				type: "usage",
+				inputTokens: 60,
+				outputTokens: 12,
+				cacheReadTokens: 20,
+				cacheWriteTokens: 40,
+			},
+		])
+	})
+})

apps/vscode/src/core/api/providers/__tests__/gemini.test.ts

@@ -0,0 +1,235 @@
+import "should"
+import sinon from "sinon"
+import { GeminiHandler } from "../gemini"
+
+describe("GeminiHandler", () => {
+	afterEach(() => {
+		sinon.restore()
+	})
+
+	const createAsyncIterable = (data: any[] = []) => ({
+		[Symbol.asyncIterator]: async function* () {
+			yield* data
+		},
+	})
+
+	it("caps maxOutputTokens to 8192 for Flash models", async () => {
+		const handler = new GeminiHandler({
+			geminiApiKey: "test-api-key",
+			apiModelId: "gemini-2.5-flash",
+		})
+
+		const generateContentStream = sinon.stub().resolves(
+			createAsyncIterable([
+				{
+					responseId: "resp-1",
+					usageMetadata: {
+						promptTokenCount: 10,
+						candidatesTokenCount: 20,
+						cachedContentTokenCount: 0,
+						thoughtsTokenCount: 0,
+					},
+				},
+			]),
+		)
+		sinon.stub(handler as any, "ensureClient").returns({
+			models: { generateContentStream },
+		} as any)
+
+		for await (const _chunk of handler.createMessage("system", [{ role: "user", content: "hi" }] as any)) {
+			// Consume stream to trigger request execution.
+		}
+
+		const requestArgs = generateContentStream.firstCall.args[0] as Record<string, any>
+		requestArgs.config.should.have.property("maxOutputTokens", 8_192)
+	})
+
+	it("supports Gemini 3.5 Flash model metadata", async () => {
+		const handler = new GeminiHandler({
+			geminiApiKey: "test-api-key",
+			apiModelId: "gemini-3.5-flash",
+		})
+
+		const model = handler.getModel()
+		model.id.should.equal("gemini-3.5-flash")
+		model.info.contextWindow!.should.equal(1_048_576)
+		model.info.inputPrice!.should.equal(1.5)
+		model.info.outputPrice!.should.equal(9)
+		model.info.cacheReadsPrice!.should.equal(0.15)
+		model.info.supportsReasoning!.should.equal(true)
+
+		const generateContentStream = sinon.stub().resolves(
+			createAsyncIterable([
+				{
+					responseId: "resp-35",
+					usageMetadata: {
+						promptTokenCount: 10,
+						candidatesTokenCount: 20,
+						cachedContentTokenCount: 0,
+						thoughtsTokenCount: 0,
+					},
+				},
+			]),
+		)
+		sinon.stub(handler as any, "ensureClient").returns({
+			models: { generateContentStream },
+		} as any)
+
+		for await (const _chunk of handler.createMessage("system", [{ role: "user", content: "hi" }] as any)) {
+			// Consume stream to trigger request execution.
+		}
+
+		const requestArgs = generateContentStream.firstCall.args[0] as Record<string, any>
+		requestArgs.model.should.equal("gemini-3.5-flash")
+		requestArgs.config.should.have.property("maxOutputTokens", 8_192)
+		requestArgs.config.thinkingConfig.should.deepEqual({
+			thinkingBudget: undefined,
+			thinkingLevel: "LOW",
+			includeThoughts: true,
+		})
+	})
+
+	it("does not set maxOutputTokens for non-Flash models", async () => {
+		const handler = new GeminiHandler({
+			geminiApiKey: "test-api-key",
+			apiModelId: "gemini-2.5-pro",
+		})
+
+		const generateContentStream = sinon.stub().resolves(
+			createAsyncIterable([
+				{
+					responseId: "resp-2",
+					usageMetadata: {
+						promptTokenCount: 10,
+						candidatesTokenCount: 20,
+						cachedContentTokenCount: 0,
+						thoughtsTokenCount: 0,
+					},
+				},
+			]),
+		)
+		sinon.stub(handler as any, "ensureClient").returns({
+			models: { generateContentStream },
+		} as any)
+
+		for await (const _chunk of handler.createMessage("system", [{ role: "user", content: "hi" }] as any)) {
+			// Consume stream to trigger request execution.
+		}
+
+		const requestArgs = generateContentStream.firstCall.args[0] as Record<string, any>
+		requestArgs.config.should.not.have.property("maxOutputTokens")
+	})
+
+	it("should emit unique tool call IDs when multiple function calls share one responseId", async () => {
+		const handler = new GeminiHandler({
+			geminiApiKey: "test-api-key",
+		})
+
+		const fakeClient = {
+			models: {
+				generateContentStream: sinon.stub().resolves(
+					createAsyncIterable([
+						{
+							responseId: "resp_1",
+							candidates: [
+								{
+									content: {
+										parts: [
+											{
+												functionCall: {
+													name: "read_file",
+													args: { path: ".nvmrc" },
+												},
+											},
+										],
+									},
+								},
+							],
+						},
+						{
+							responseId: "resp_1",
+							candidates: [
+								{
+									content: {
+										parts: [
+											{
+												functionCall: {
+													name: "read_file",
+													args: { path: ".gitattributes" },
+												},
+											},
+										],
+									},
+								},
+							],
+						},
+					]),
+				),
+			},
+		}
+		sinon.stub(handler as any, "ensureClient").returns(fakeClient as any)
+
+		const tools = [{ name: "read_file", description: "read file", parameters: { type: "OBJECT" } }] as any
+		const chunks: any[] = []
+		for await (const chunk of handler.createMessage("system", [{ role: "user", content: "hi" }], tools)) {
+			if (chunk.type === "tool_calls") {
+				chunks.push(chunk)
+			}
+		}
+
+		chunks.should.have.length(2)
+		chunks[0].tool_call.function.id.should.equal("resp_1-tool-0")
+		chunks[1].tool_call.function.id.should.equal("resp_1-tool-1")
+		chunks[0].tool_call.call_id.should.equal(chunks[0].tool_call.function.id)
+		chunks[1].tool_call.call_id.should.equal(chunks[1].tool_call.function.id)
+		JSON.parse(chunks[0].tool_call.function.arguments).path.should.equal(".nvmrc")
+		JSON.parse(chunks[1].tool_call.function.arguments).path.should.equal(".gitattributes")
+	})
+
+	it("should preserve Gemini-provided functionCall.id when present", async () => {
+		const handler = new GeminiHandler({
+			geminiApiKey: "test-api-key",
+		})
+
+		const fakeClient = {
+			models: {
+				generateContentStream: sinon.stub().resolves(
+					createAsyncIterable([
+						{
+							responseId: "resp_2",
+							candidates: [
+								{
+									content: {
+										parts: [
+											{
+												functionCall: {
+													id: "call_alpha",
+													name: "read_file",
+													args: { path: ".nvmrc" },
+												},
+											},
+										],
+									},
+								},
+							],
+						},
+					]),
+				),
+			},
+		}
+		sinon.stub(handler as any, "ensureClient").returns(fakeClient as any)
+
+		const tools = [{ name: "read_file", description: "read file", parameters: { type: "OBJECT" } }] as any
+		const chunks: any[] = []
+		for await (const chunk of handler.createMessage("system", [{ role: "user", content: "hi" }], tools)) {
+			if (chunk.type === "tool_calls") {
+				chunks.push(chunk)
+			}
+		}
+
+		chunks.should.have.length(1)
+		chunks[0].tool_call.function.id.should.equal("call_alpha")
+		chunks[0].tool_call.call_id.should.equal("call_alpha")
+		JSON.parse(chunks[0].tool_call.function.arguments).path.should.equal(".nvmrc")
+	})
+})