fix(core): add non-interactive command guidance

The remote-server JSON example omitted the `type` field. Because the
config schema's z.union lists the SSE branch before streamableHttp
(intentionally, for backward compat), an untyped remote entry silently
resolves to the deprecated legacy SSE transport — the opposite of the
docs' own "Streamable HTTP (recommended)" guidance.

Add `"type": "streamableHttp"` to the example, rename the heading to
match, and add a sentence explaining that omitting `type` defaults to
legacy SSE.

Fixes #11670

Co-authored-by: Minhkunn <minh.12072k6@gmail.com>

.claude/hooks/claude-code-for-web-setup.sh

@@ -41,11 +41,11 @@ fi
 
 # Install project dependencies
 echo "Installing dependencies..."
-npm run install:all
+bun run install:all
 
 # Generate gRPC/protobuf types (required for TypeScript)
 echo "Generating proto types..."
-npm run protos
+bun run protos
 
 echo ""
 echo "Session setup complete!"

.clinerules/bun-and-node.md

@@ -0,0 +1,55 @@
+# Bun (tooling) and Node (runtime)
+
+This repo uses **bun** for package management and task running, and **Node** as
+the execution runtime. Both are correct at the same time; the distinction is the
+source of most confusion, so keep it straight before editing scripts, configs,
+docs, or comments.
+
+## Use bun for tooling
+
+- `bun install` (never `npm install` / `npm ci`)
+- `bun run <script>` (never `npm run <script>`)
+- `bunx <bin>` (never `npx <bin>`)
+- `bun <file>.ts` to run a TS entrypoint directly (no `ts-node` / `tsx`)
+- `bun esbuild.mjs` to drive the build (esbuild/vite are still the bundlers)
+- `bun run --parallel ...` for parallel tasks
+
+The root `bun.lock` is the single lockfile for the whole workspace, including
+`apps/vscode`, `webview-ui`, and `testing-platform`. There are no per-package npm
+lockfiles.
+
+## Node is the runtime — do NOT rewrite these to bun
+
+The build product runs on Node: the VS Code extension host loads
+`dist/extension.js` as CommonJS under Node, and the standalone `cline-core` is a
+Node process. The following are Node runtime/ABI references and are correct as-is:
+
+| Reference | Why it is Node |
+|-----------|----------------|
+| esbuild `platform: "node"` / `target: "node..."` | The bundle targets the Node runtime (extension host, standalone core). |
+| `TARGET_NODE_VERSION` (`scripts/package-standalone.mjs`) | Pins the Node ABI of the bundled standalone runtime (matches the JetBrains-packaged Node). |
+| `prebuild-install --target=<node version>` | Downloads native `.node` binaries for that Node ABI. |
+| `NODE_PATH=... node cline-core.js` | The standalone core is launched by Node, not bun. |
+| `node:` import specifiers (e.g. `node:fs`) | Node builtin module scheme; unrelated to tooling. |
+| `process.versions.node`, `engines.node`, `@types/node` | Runtime version probe / declared runtime / its types. |
+| `ELECTRON_RUN_AS_NODE` | VS Code/Electron runs the extension host as Node. |
+
+When a file legitimately uses both bun and node (e.g. `package-standalone.mjs`
+does `bun install` but `prebuild-install --target=<node>`), the `node` token is
+the runtime/ABI target, not tooling. If unsure, leave it.
+
+## Tests: bun vs the VS Code host
+
+A test file's runner is decided by its import:
+
+- **`import ... from "bun:test"`** → runs under `bun test` (the node-side unit
+  suites + the SDK/model-catalog suites). `scripts/run-bun-unit-tests.ts`
+  discovers these by the `bun:test` import and runs one isolated bun process per
+  file. `build-tests.js` excludes them from the integration compile so the
+  `bun:test` builtin never reaches Node.
+- **`import ... from "mocha"`** → runs under `@vscode/test-cli` in a real VS Code
+  extension host (Node). These exercise the live `vscode` API and cannot run
+  under bun.
+
+So a file imports `bun:test` XOR `mocha`. Don't add `bun:test` to a test that
+needs the real extension host.

.clinerules/debug-harness.md

@@ -0,0 +1,128 @@
+# Debug Harness
+
+HTTP-controlled debugger for the VSCode extension at `src/dev/debug-harness/server.ts`.
+
+## Quick start
+
+```bash
+# Build extension first if needed (protos + esbuild):
+bun run protos && IS_DEV=true bun esbuild.mjs
+
+# Launch (skip-build if already built):
+bun src/dev/debug-harness/server.ts --skip-build --auto-launch
+
+# In another terminal:
+curl localhost:19229/api -d '{"method":"status"}'
+```
+
+## Data Isolation
+
+The debugee runs with `CLINE_DIR=~/.cline2` by default, separate from your real `~/.cline`.
+This prevents the debugee's logout from logging out the debugger, and vice versa.
+Override with `--cline-dir /tmp/test-dir`. Check with `status()` → `clineDir`.
+
+## Browser Capture & OAuth
+
+The debugee runs with `CLINE_CAPTURE_BROWSER=1`, which intercepts `openExternal()` in
+`src/utils/env.ts`. URLs are captured instead of opening a real browser:
+
+- Logged to `$CLINE_DIR/data/debug-captured-urls.jsonl`
+- POSTed in real-time to `/captured-url` on the harness server
+- Queryable via `oauth.captured_urls`
+
+### OAuth API
+
+- **`oauth.captured_urls`** `{clear?}` — URLs the debugee tried to open
+- **`oauth.read_stored_token`** — Check auth token presence in secrets.json
+- **`oauth.simulate_callback`** `{path, code?, state?, provider?, token?}` — Build vscode:// callback URI
+- **`oauth.read_captured_urls_file`** — Read on-disk JSONL of captured URLs
+
+### OAuth testing flow
+
+For **Cline OAuth** (SDK local callback): The SDK starts a local HTTP server, the auth URL
+is captured. To complete: open the captured URL in a real browser (it redirects back to the
+SDK's callback server), OR extract the callback port and `curl http://127.0.0.1:PORT/callback?code=...`.
+
+For **MCP/Provider OAuth** (vscode:// URI): The redirect goes to a vscode:// URI.
+`oauth.simulate_callback` only *builds* the URI — it does not deliver it, and the ESM
+extension host can't `require()` the handler. To actually deliver the callback, call the
+debug-only hook via `ext.evaluate` (with `awaitPromise: true`):
+`globalThis.__clineHandleUri("vscode://saoudrizwan.claude-dev/...?code=...&state=...")`.
+It runs the same `SharedUriHandler.handleUri` as VSCode's real URI handler and exists only
+when `CLINE_CAPTURE_BROWSER` is set (the harness always sets it; never ships in prod).
+For end-to-end MCP OAuth, get a real `code` from the local MCP OAuth test server
+(`bun run dev:mcp-oauth-test-server`).
+
+## Navigating Views — Use Commands, Not Clicks
+
+Don't try to find/click small sidebar icons. Use VSCode commands via command palette.
+Registered in `src/registry.ts`:
+
+| Command | View |
+|---------|------|
+| `cline.accountButtonClicked` | Account / sign-in |
+| `cline.historyButtonClicked` | Task history |
+| `cline.settingsButtonClicked` | Settings |
+| `cline.mcpButtonClicked` | MCP servers |
+| `cline.plusButtonClicked` | New task (chat) |
+| `cline.worktreesButtonClicked` | Worktrees |
+
+```bash
+curl localhost:19229/api -d '{"method":"ui.command_palette","params":{"command":"cline.accountButtonClicked"}}'
+```
+
+## Key commands
+
+All via `POST localhost:19229/api` with `{"method":"...", "params":{...}}`:
+
+- **`launch`** / **`shutdown`** — lifecycle
+- **`ui.screenshot`** — screenshot to `/tmp/cline-debug/`; returns `{path}` — **use `read_file` on the path to examine, do NOT `open` the file** (Preview.app covers the VSCode window)
+- **`ui.open_sidebar`** — open the Cline sidebar
+- **`ext.set_breakpoint`** `{file, line, condition?}` — breakpoint by source file (sourcemap-resolved)
+- **`ext.evaluate`** `{expression, callFrameId?}` — eval in extension host
+- **`ext.resume`** / **`ext.step_over`** / **`ext.step_into`** — stepping
+- **`ext.call_stack`** — inspect when paused
+- **`web.evaluate`** `{expression}` — eval in webview
+- **`web.post_message`** `{message}` — send postMessage to extension host via exposed vsCodeApi
+- **`wait_for_pause`** `{timeout?}` — block until breakpoint hit
+- **`ui.locator`** `{role?, testId?, text?, frame?}` — Playwright locator (auto-retries on stale sidebar frame)
+- **`ui.react_input`** `{text, selector?, clear?, submit?}` — set React textarea value via `execCommand('insertText')`; works reliably across multiple tasks
+- **`ui.send_message`** `{text, images?, files?, responseType?}` — send chat message bypassing the textarea entirely (via gRPC postMessage)
+- **`ui.command_palette`** `{command}` — run VSCode command
+
+## Typical Session
+
+```bash
+# 1. Launch
+curl localhost:19229/api -d '{"method":"launch","params":{"skipBuild":true}}'
+
+# 2. Open sidebar + dismiss overlays (ALWAYS do this first)
+curl localhost:19229/api -d '{"method":"ui.open_sidebar"}'
+curl localhost:19229/api -d '{"method":"web.evaluate","params":{"expression":"document.querySelectorAll(\".sr-only\").forEach(el => el.parentElement?.click())"}}'
+
+# 3. Navigate to view
+curl localhost:19229/api -d '{"method":"ui.command_palette","params":{"command":"cline.accountButtonClicked"}}'
+
+# 4. Check captured OAuth URLs if testing auth
+curl localhost:19229/api -d '{"method":"oauth.captured_urls"}'
+
+# 5. Verify
+curl localhost:19229/api -d '{"method":"ui.screenshot"}'
+```
+
+## Caveats
+
+- **⚠️ Dismiss promotional overlays FIRST**: On fresh launches, full-screen promo overlays block the sidebar. **Dismiss immediately after `ui.open_sidebar`**, before any other interaction or screenshot. May need to run twice:
+  ```bash
+  curl localhost:19229/api -d '{"method": "ui.open_sidebar"}'
+  curl localhost:19229/api -d '{"method": "web.evaluate", "params": {"expression": "document.querySelectorAll(\".sr-only\").forEach(el => el.parentElement?.click())"}}'
+  ```
+- **Screenshots — don't open the file**: `ui.screenshot` and `ui.sidebar_screenshot` save PNGs to `/tmp/cline-debug/` and return the `{path}`. Use `read_file` on that path to examine screenshots. Running `open <path>` launches Preview.app on macOS which covers the VSCode window.
+- **Scripts count = 0 after launch**: CDP connects after extension host starts, so scripts parsed during startup aren't tracked. Breakpoints still work via sourcemap resolution.
+- **Port 9230**: Extension host inspector. If another VSCode instance uses this port, the harness will fail to connect. Kill other debug instances first.
+- **macOS only** for now (Playwright Electron launch behavior).
+- **Webview CDP**: `connect_webview` may fail depending on Electron version. `web.evaluate` still works via Playwright's `frame.evaluate()` fallback.
+- **Sourcemap paths**: esbuild outputs relative paths like `../src/extension.ts` in the sourcemap. The resolver handles this, but if a file isn't found, use `ext.source_files` to see exact paths.
+- **OAuth with fake codes**: Browser capture intercepts the URL but doesn't provide a valid auth code. For real OAuth testing, open the captured URL in a browser. For unit testing, mock the token exchange.
+
+See `src/dev/debug-harness/README.md` for full API reference.

.clinerules/general.md

@@ -13,11 +13,56 @@ This file is the secret sauce for working effectively in this codebase. It captu
 **What NOT to add:** Stuff you can figure out from reading a few files, obvious patterns, or standard practices. This file should be high-signal, not comprehensive.
 
 ## Miscellaneous
-- This is a VS Code extension—check `package.json` for available scripts before trying to verify builds (e.g., `npm run compile`, not `npm run build`).
+- The whole repo (including `apps/vscode`) uses **bun** for package management and task running. Emit `bun run X` / `bun install` / `bunx <bin>` / `bun file.ts`, never npm/npx. Node remains the *runtime* (VS Code's extension host and the standalone cline-core are Node), so Node-runtime tokens are legitimate and must not be "fixed" to bun — see @.clinerules/bun-and-node.md for the keep-list vs rewrite-list.
+- Avoid provider-specific string matching / hardcoded provider branches when fixing provider/config plumbing. Prefer provider metadata, shared catalog/defaults, explicit protocol/client capabilities, or centralized normalization utilities that apply by data shape rather than `providerId === "..."`. If a provider exception seems necessary, stop and explain why instead of adding ad-hoc string matching.
+- This is a VS Code extension—check `package.json` for available scripts before trying to verify builds (e.g., `bun run compile`, not `bun run build`).
 - When creating PRs, contributors should not create changelog-entry files. Maintainers handle release versioning and changelog curation during the release process.
 - When adding new feature flags, see this PR as a reference https://github.com/cline/cline/pull/7566
 - Additional instructions about making requests: @.clinerules/network.md
 
+## Searching the Codebase — Avoiding Build Output
+
+Several directories contain build output or generated code that produces
+noisy or unusable results with `search_files` / `grep`:
+
+| Directory | What it is | Why it's a problem |
+|-----------|-----------|-------------------|
+| `out/` | esbuild bundle output | Mirrors `src/` structure as minified JS — every search gets duplicate hits on single-line files |
+| `dist/` | Packaged extension | Entire extension bundled into one minified `extension.js` (~1 long line) |
+| `dist-standalone/` | Standalone build output | Same minification issue |
+| `src/generated/` | Generated protobuf code | Auto-generated from `proto/`; not the source of truth |
+| `src/shared/proto/` | Generated proto type defs | Auto-generated from `proto/`; not the source of truth |
+| `node_modules/` | Dependencies | Huge, not project source |
+
+### How to skip build output
+
+**`search_files`** — Point at `src/` (not the project root) and use `file_pattern`:
+```
+search_files(path="src/core", regex="myFunction", file_pattern="*.ts")
+```
+The `file_pattern` parameter is the most effective filter — e.g. `"*.ts"`,
+`"*.tsx"`, `"*.proto"`.
+
+**`grep` directly** — Exclude build dirs and restrict to source extensions:
+```bash
+grep -rn "myFunction" src/ --include="*.ts" --exclude-dir={out,dist,node_modules,generated}
+```
+
+### When you must search minified files
+
+Sometimes you need to verify what got bundled (e.g., checking if a change
+made it into the build). Minified files are typically one long line, so
+normal `grep` shows the entire file as context. Use these approaches:
+
+- **`grep -oP`** to extract just the match with limited surrounding context:
+  ```bash
+  grep -oP '.{0,40}myFunction.{0,40}' dist/extension.js
+  ```
+- **`read_file`** on files in `out/src/` — these have source maps and are
+  more readable than `dist/extension.js` (which is the fully bundled output).
+- **Source maps** — `out/src/*.js.map` and `dist/extension.js.map` can be
+  used to trace minified output back to original source locations.
+
 ## gRPC/Protobuf Communication
 The extension and webview communicate via gRPC-like protocol over VS Code message passing.
 
@@ -28,7 +73,7 @@ The extension and webview communicate via gRPC-like protocol over VS Code messag
 - Naming: Services `PascalCaseService`, RPCs `camelCase`, Messages `PascalCase`
 - For streaming responses, use `stream` keyword (see `subscribeToAuthCallback` in `account.proto`)
 
-**Run `npm run protos`** after any proto changes—generates types in:
+**Run `bun run protos`** after any proto changes—generates types in:
 - `src/shared/proto/` - Shared type definitions
 - `src/generated/grpc-js/` - Service implementations
 - `src/generated/nice-grpc/` - Promise-based clients
@@ -48,93 +93,6 @@ The extension and webview communicate via gRPC-like protocol over VS Code messag
 - `src/core/controller/task/explainChanges.ts` - Handler implementation
 - `webview-ui/src/components/chat/ChatRow.tsx` - UI rendering
 
-## Adding a New API Provider
-When adding a new provider (e.g., "openai-codex"), you must update the proto conversion layer in THREE places or the provider will silently reset to Anthropic:
-
-1. `proto/cline/models.proto` - Add to the `ApiProvider` enum (e.g., `OPENAI_CODEX = 40;`)
-2. `convertApiProviderToProto()` in `src/shared/proto-conversions/models/api-configuration-conversion.ts` - Add case mapping string to proto enum
-3. `convertProtoToApiProvider()` in the same file - Add case mapping proto enum back to string
-
-**Why this matters:** Without these, the provider string hits the `default` case and returns `ANTHROPIC`. The webview, provider list, and handler all work fine, but the state silently resets when it round-trips through proto serialization. No error is thrown.
-
-**Other files to update when adding a provider:**
-- `src/shared/api.ts` - Add to `ApiProvider` union type, define models
-- `src/shared/providers/providers.json` - Add to provider list for dropdown
-- `src/core/api/index.ts` - Register handler in `createHandlerForProvider()`
-- `webview-ui/src/components/settings/utils/providerUtils.ts` - Add cases in `getModelsForProvider()` and `normalizeApiConfiguration()`
-- `webview-ui/src/utils/validate.ts` - Add validation case
-- `webview-ui/src/components/settings/ApiOptions.tsx` - Render provider component
-
-## Responses API Providers (OpenAI Codex, OpenAI Native)
-Providers using OpenAI's Responses API require native tool calling. XML tools don't work with the Responses API.
-
-**Symptoms of broken native tool calling:**
-- Tools get called multiple times (e.g., `ask_followup_question` asks the same question twice)
-- Tool arguments get duplicated or malformed
-- The model responds but tools aren't recognized
-
-**Root causes to check:**
-1. **Provider missing from `isNextGenModelProvider()`** in `src/utils/model-utils.ts`. The native variant matchers (e.g., `native-gpt-5/config.ts`) call this function. If your provider isn't in the list, the matcher returns false and falls back to XML tools.
-
-2. **Model missing `apiFormat: ApiFormat.OPENAI_RESPONSES`** in its model info (`src/shared/api.ts`). This property signals that the model requires native tool calling. The task runner in `src/core/task/index.ts` checks this and forces `enableNativeToolCalls: true` regardless of user settings.
-
-**When adding a new Responses API provider:**
-1. Add provider to `isNextGenModelProvider()` list in `src/utils/model-utils.ts`
-2. Set `apiFormat: ApiFormat.OPENAI_RESPONSES` on all models that use the Responses API
-3. The variant matcher and task runner will handle the rest automatically
-
-## Adding Tools to System Prompt
-This is tricky—multiple prompt variants and configs. **Always search for existing similar tools first and follow their pattern.** Look at the full chain from prompt definition → variant configs → handler → UI before implementing.
-
-1. **Add to `ClineDefaultTool` enum** in `src/shared/tools.ts`
-2. **Tool definition** in `src/core/prompts/system-prompt/tools/` (create file like `generate_explanation.ts`)
-   - Define variants for each `ModelFamily` (generic, next-gen, xs, etc.)
-   - Export variants array (e.g., `export const my_tool_variants = [GENERIC, NATIVE_NEXT_GEN, XS]`)
-   - **Fallback behavior**: If a variant isn't defined for a model family, `ClineToolSet.getToolByNameWithFallback()` automatically falls back to GENERIC. So you only need to export `[GENERIC]` unless the tool needs model-specific behavior.
-3. **Register in `src/core/prompts/system-prompt/tools/init.ts`** - Import and spread into `allToolVariants`
-4. **Add to variant configs** - Each model family has its own config in `src/core/prompts/system-prompt/variants/*/config.ts`. Add your tool's enum to the `.tools()` list:
-   - `generic/config.ts`, `next-gen/config.ts`, `gpt-5/config.ts`, `native-gpt-5/config.ts`, `native-gpt-5-1/config.ts`, `native-next-gen/config.ts`, `gemini-3/config.ts`, `glm/config.ts`, `hermes/config.ts`, `xs/config.ts`
-   - **Important**: If you add to a variant's config, make sure the tool spec exports a variant for that ModelFamily (or relies on GENERIC fallback)
-5. **Create handler** in `src/core/task/tools/handlers/`
-6. **Wire up in `ToolExecutor.ts`** if needed for execution flow
-7. **Add to tool parsing** in `src/core/assistant-message/index.ts` if needed
-8. **If tool has UI feedback**: add `ClineSay` enum in proto, update `src/shared/ExtensionMessage.ts`, update `src/shared/proto-conversions/cline-message.ts`, update `webview-ui/src/components/chat/ChatRow.tsx`
-
-## Modifying System Prompt
-**Read these first:** `src/core/prompts/system-prompt/README.md`, `tools/README.md`, `__tests__/README.md`
-
-System prompt is modular: **components** (reusable sections) + **variants** (model-specific configs) + **templates** (with `{{PLACEHOLDER}}` resolution).
-
-**Key directories:**
-- `components/` - Shared sections: `rules.ts`, `capabilities.ts`, `editing_files.ts`, etc.
-- `variants/` - Model-specific: `generic/`, `next-gen/`, `xs/`, `gpt-5/`, `gemini-3/`, `hermes/`, `glm/`, etc.
-- `templates/` - Template engine and placeholder definitions
-
-**Variant tiers (ask user which to modify):**
-- **Next-gen** (Claude 4, GPT-5, Gemini 2.5): `next-gen/`, `native-next-gen/`, `native-gpt-5/`, `native-gpt-5-1/`, `gemini-3/`, `gpt-5/`
-- **Standard** (default fallback): `generic/`
-- **Local/small models**: `xs/`, `hermes/`, `glm/`
-
-**How overrides work:** Variants can override components via `componentOverrides` in their `config.ts`, or provide a custom template in `template.ts` (e.g., `next-gen/template.ts` exports `rules_template`). If no override, the shared component from `components/` is used.
-
-**Example: Adding a rule to RULES section**
-1. Check if variant overrides rules: look for `rules_template` in `variants/*/template.ts` or `componentOverrides.RULES` in `config.ts`
-2. If shared: modify `components/rules.ts`
-3. If overridden: modify that variant's template
-4. XS variant is special—has heavily condensed inline content in `template.ts`
-
-**After any changes, regenerate snapshots:**
-```bash
-UPDATE_SNAPSHOTS=true npm run test:unit
-```
-Snapshots live in `__tests__/__snapshots__/`. Tests validate across model families and context variations (browser, MCP, focus chain).
-
-## Modifying Default Slash Commands
-Three places need updates:
-- `src/core/slash-commands/index.ts` - Command definitions
-- `src/core/prompts/commands.ts` - System prompt integration
-- `webview-ui/src/utils/slash-commands.ts` - Webview autocomplete
-
 ## Adding New Global State Keys
 Adding a new key to global state requires updates in multiple places. Missing any step causes silent failures.
 
@@ -151,7 +109,7 @@ Settings plumbing gotcha: if a key is user-toggleable from settings, wire both c
 Missing one path causes a toggle to appear to change in one surface while the backend state stays unchanged.
 
 Webview toggle gotcha: settings changes must also round-trip back in state payloads.
-- Add the field to `UpdateSettingsRequest` in `proto/cline/state.proto` (for webview update requests), then run `npm run protos`
+- Add the field to `UpdateSettingsRequest` in `proto/cline/state.proto` (for webview update requests), then run `bun run protos`
 - Include the key in `Controller.getStateToPostToWebview()` (`src/core/controller/index.ts`)
 - Ensure `ExtensionState` and webview defaults include the key (`src/shared/ExtensionMessage.ts`, `webview-ui/src/context/ExtensionStateContext.tsx`)
 If this round-trip wiring is missing, the backend value can update but the toggle in webview appears stuck or reverts.
@@ -199,3 +157,48 @@ const isGenerating = explanationInfo.status === "generating" && !wasCancelled
 **See also:** `BrowserSessionRow.tsx` uses similar pattern with `isLastApiReqInterrupted` and `isLastMessageResume`.
 
 **Backend side:** When streaming is cancelled, clean up properly (close tabs, clear comments, etc.) by checking `taskState.abort` after the streaming function returns.
+
+## Debug Harness: clear inherited VSCode/Electron env vars before launching
+
+The debug harness (`apps/vscode/src/dev/debug-harness/server.ts`) launches a child
+VSCode via Playwright's `_electron.launch({ env: { ...process.env, ... } })`. If you
+run the harness from a process that was itself spawned by VSCode (e.g. the Cline
+extension host, an integrated terminal, or an agent running inside VSCode), the
+parent's VSCode/Electron env vars leak into the child and break the launch.
+
+The fatal one is **`ELECTRON_RUN_AS_NODE=1`**: it makes the child VSCode binary run
+as plain Node, so it rejects every VSCode CLI flag. Symptom:
+
+```
+.../Visual Studio Code.app/Contents/MacOS/Code: bad option: --extensionDevelopmentPath=...
+Error: Process failed to launch!   (Playwright _electron.launch)
+```
+
+This is NOT the macOS Playwright flakiness mentioned in the harness README — it's
+env inheritance. Fix: strip the inherited vars before starting the harness:
+
+```bash
+env -u ELECTRON_RUN_AS_NODE -u ELECTRON_NO_ATTACH_CONSOLE \
+    -u VSCODE_CLI -u VSCODE_CODE_CACHE_PATH -u VSCODE_CRASH_REPORTER_PROCESS_TYPE \
+    -u VSCODE_CWD -u VSCODE_ESM_ENTRYPOINT -u VSCODE_HANDLES_UNCAUGHT_ERRORS \
+    -u VSCODE_IPC_HOOK -u VSCODE_NLS_CONFIG -u VSCODE_PID -u VSCODE_L10N_BUNDLE_LOCATION \
+    bun src/dev/debug-harness/server.ts --auto-launch --skip-build
+```
+
+Check your own env with `env | grep -iE 'electron|vscode_'` first; `ELECTRON_RUN_AS_NODE=1`
+present means you must scrub before launching.
+
+Other harness notes confirmed in practice:
+- The extension host is **ESM** (`VSCODE_ESM_ENTRYPOINT`), so `ext.evaluate` has no
+  `require` and module-internal functions aren't reachable as globals. To inspect
+  internal builders (e.g. `buildBedrockProviderConfig`), set a breakpoint with
+  `ext.set_breakpoint` and read locals via `ext.evaluate` with the paused `callFrameId`
+  — don't try to `require()` the bundle.
+- `web.evaluate` wraps the expression as a single returned expression; multi-statement
+  snippets must be an IIFE `(() => { ...; return x; })()`, otherwise you get
+  `SyntaxError: Unexpected token ';'`.
+- Webview settings inputs are `vscode-text-field` web components with debounced React
+  onChange. Setting `.value` + dispatching events via `web.evaluate` is unreliable for
+  some fields; focus the inner shadow `input` then use real keystrokes (`ui.type` +
+  `ui.press Tab`, or click the dropdown option) to make the value persist.
+

.clinerules/protobuf-development.md

@@ -42,7 +42,7 @@ Here, we use the common `StringRequest` and `KeyValuePair` types.
 
 After editing a `.proto` file, regenerate the TypeScript code. From the project root, run:
 ```bash
-npm run protos
+bun run protos
 ```
 This command compiles all `.proto` files and outputs the generated code to `src/generated/` and `src/shared/`. Do not edit these generated files manually.
 

.clinerules/sdk-migration.md

@@ -0,0 +1,26 @@
+# SDK Adapter
+
+The VSCode extension runs on the Cline SDK (`@cline/core`, `@cline/llms`,
+`@cline/shared`) through an adapter layer in `apps/vscode/src/sdk/`. The
+webview still talks gRPC; the adapter translates between gRPC handlers and SDK
+calls. See `apps/vscode/src/dev/debug-harness/README.md` for the debug harness.
+
+## Conventions
+
+1. **Look up SDK APIs, don't guess.** Use `kb_search(name="sdk", query="...")`
+   before implementing against an SDK surface.
+2. **Reference the pre-SDK implementation when replacing a module.** Add a
+   `// Replaces classic src/core/... (see origin/main)` header and use
+   `kb_search(name="cline", commit="origin/main")` or
+   `git show origin/main:path` to consult the prior implementation.
+3. **Single entry point.** There is one codepath — the SDK adapter. No
+   `CLINE_SDK` env flag.
+4. **Use `{appBaseUrl}`**, never hardcode `app.cline.bot`.
+5. **Avoid `as` casts.** Use explicit conversion functions with tests. The
+   branded types in `apps/vscode/src/sdk/model-catalog/contracts.ts` exist so
+   casts are unnecessary outside parse/compute boundaries.
+
+## Debug harness
+
+- **Dismiss the Kanban/promo overlay** before any debug harness interaction.
+- **Use the command palette** to navigate tabs in the debug harness.

.clinerules/workflows/hotfix-release.md

@@ -91,7 +91,7 @@ On the main branch, create a commit that updates:
 
 3. No changelog-entry file cleanup is needed. Contributors do not create changelog-entry files in this repo.
 
-**Skip running `npm run install:all`** - release automation handles lockfile consistency as needed.
+**No dependency install is needed.** A CHANGELOG + `version` bump does not change any dependency, and `bun.lock` does not pin workspace-package versions, so the lockfile stays consistent. The publish workflow runs `bun install --frozen-lockfile`, which would *fail* on an out-of-sync lock — so only run `bun install` here if you actually change dependencies (then commit the updated `bun.lock`).
 
 Commit with message format: `v{VERSION} Release Notes (hotfix)`
 

.github/copilot-instructions.md

@@ -9,14 +9,14 @@ This is a VS Code extension. Read `.clinerules/general.md` for tribal knowledge
 - **MCP**: `src/services/mcp/McpHub.ts`.
 
 ## Build & Test (Critical — non-obvious commands)
-- **Build**: `npm run compile` — NOT `npm run build`.
-- **Watch**: `npm run watch` (extension + webview).
-- **Protos**: `npm run protos` — run **immediately** after any `.proto` change. Generates into `src/shared/proto/`, `src/generated/`.
-- **Tests**: `npm run test:unit`. After prompt/tool changes: `UPDATE_SNAPSHOTS=true npm run test:unit`.
+- **Build**: `bun run compile` — NOT `bun run build`.
+- **Watch**: `bun run watch` (extension + webview).
+- **Protos**: `bun run protos` — run **immediately** after any `.proto` change. Generates into `src/shared/proto/`, `src/generated/`.
+- **Tests**: `bun run test:unit`. After prompt/tool changes: `UPDATE_SNAPSHOTS=true bun run test:unit`.
 
 ## Protobuf RPC Workflow (4 steps)
 1. **Define** in `proto/cline/*.proto`. Naming: `PascalCaseService`, `camelCase` RPCs, `PascalCase` Messages. Use `common.proto` shared types for simple data.
-2. **Generate**: `npm run protos`.
+2. **Generate**: `bun run protos`.
 3. **Backend handler**: `src/core/controller/<domain>/`. 
 4. **Frontend call**: `UiServiceClient.myMethod(Request.create({...}))`.
 - Adding enums (e.g. `ClineSay`) → also update `src/shared/proto-conversions/cline-message.ts`.
@@ -38,7 +38,7 @@ For Responses API providers: add to `isNextGenModelProvider()` in `src/utils/mod
 4. Whitelist in `src/core/prompts/system-prompt/variants/*/config.ts` for each model family.
 5. Handler in `src/core/task/tools/handlers/`, wire in `ToolExecutor.ts`.
 6. If tool has UI: add `ClineSay` enum in proto → `ExtensionMessage.ts` → `cline-message.ts` → `ChatRow.tsx`.
-7. Regenerate snapshots: `UPDATE_SNAPSHOTS=true npm run test:unit`.
+7. Regenerate snapshots: `UPDATE_SNAPSHOTS=true bun run test:unit`.
 
 ## Modifying System Prompt
 Modular: `components/` (shared) + `variants/` (model-specific) + `templates/` (`{{PLACEHOLDER}}`). Variants override components via `componentOverrides` in `config.ts` or custom `template.ts`. XS variant is heavily condensed inline. Always regenerate snapshots after changes.

.github/pull_request_template.md

@@ -59,7 +59,7 @@ We're not looking for exhaustive documentation - just evidence that you've thoug
 <!-- Put an 'x' in all boxes that apply -->
 
 -   [ ] Changes are limited to a single feature, bugfix or chore (split larger changes into separate PRs)
--   [ ] Tests are passing (`npm test`) and code is formatted and linted (`npm run format && npm run lint`)
+-   [ ] Tests are passing (`bun test`) and code is formatted and linted (`bun run format && bun run lint`)
 -   [ ] I have reviewed [contributor guidelines](https://github.com/cline/cline/blob/main/CONTRIBUTING.md)
 
 ### Screenshots

.github/workflows/ext-vscode-publish-nightly.yml

@@ -31,6 +31,9 @@ jobs:
     if: github.repository == 'cline/cline' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/dpc/sdk-migration-simpler-login')
     runs-on: ubuntu-latest
     environment: PublishNightly
+    # The VS Code extension's package.json and lockfiles live under apps/vscode/
+    # (the repo root has no package.json). Mirror ext-vscode-test.yml so install
+    # and publish steps run in the correct workspace.
     defaults:
       run:
         working-directory: apps/vscode
@@ -50,21 +53,47 @@ jobs:
           echo "Building sha: $GITHUB_SHA"
           git --no-pager log -1 --oneline
 
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: 1.3.14
+
+      # Node is still REQUIRED in the publish job (not just for install): the publish
+      # scripts run as `node ./scripts/publish-*.mjs` and shell out to `npx ovsx`.
+      # setup-bun does not provide a Node runtime, so keep setup-node here.
+      # Pinned to Node 22 because newer LTS (Node 24 / npm 11) can make vsce's
+      # `npm list` dependency detection fail with ELSPROBLEMS during packaging.
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          # Keep publish environment aligned with test workflow/tooling lockfile expectations.
-          # Newer LTS (Node 24 / npm 11) can make `npm list` fail with ELSPROBLEMS during vsce packaging.
           node-version: 22
 
-      - name: Install extension dependencies
+      # Single root install resolves the whole bun workspace at once (replaces the
+      # per-package `npm ci` steps for apps/vscode + webview-ui).
+      - name: Install workspace dependencies
         working-directory: ${{ github.workspace }}
-        run: npm --prefix apps/vscode ci --include=optional
+        run: bun install --frozen-lockfile
 
-      - name: Install webview-ui dependencies
+      # @cline/* are local workspace symlinks to source packages; build dist/ before
+      # packaging/publishing the extension.
+      - name: Build SDK packages
         working-directory: ${{ github.workspace }}
-        run: npm --prefix apps/vscode/webview-ui ci --include=optional
+        run: bun run build:sdk
 
+      - name: Assert better-sqlite3 native binary present
+        run: |
+          NODE_FILE="node_modules/better-sqlite3/build/Release/better_sqlite3.node"
+          if [ ! -f "$NODE_FILE" ]; then
+            echo "ERROR: better-sqlite3 native binary missing at apps/vscode/$NODE_FILE"
+            echo "(bun trustedDependencies postinstall likely did not run)"
+            exit 1
+          fi
+          echo "Found better-sqlite3 native binary: $NODE_FILE"
+
+      # vsce is now a workspace devDependency (on node_modules/.bin), but ovsx is not
+      # vendored and the publish script invokes it via `npx ovsx`, so install ovsx
+      # globally here (npm is available via setup-node). vsce is installed globally
+      # too to preserve the script's existing PATH expectations.
       - name: Install Publishing Tools
         run: npm install -g @vscode/vsce ovsx
 
@@ -82,7 +111,9 @@ jobs:
           OTEL_EXPORTER_OTLP_PROTOCOL: ${{ secrets.OTEL_EXPORTER_OTLP_PROTOCOL }}
           OTEL_EXPORTER_OTLP_ENDPOINT: ${{ secrets.OTEL_EXPORTER_OTLP_ENDPOINT }}
           OTEL_EXPORTER_OTLP_HEADERS: ${{ secrets.OTEL_EXPORTER_OTLP_HEADERS }}
-        run: npm run publish:marketplace:nightly
+        # The script itself runs under `node ./scripts/publish-nightly.mjs`; bun run
+        # just launches it. Node + npm (for `npx ovsx`) are provided by setup-node above.
+        run: bun run publish:marketplace:nightly
 
       - name: Tag published commit
         working-directory: ${{ github.workspace }}

.github/workflows/ext-vscode-publish-stable.yml

@@ -109,19 +109,48 @@ jobs:
                   echo "tag=$TAG" >> $GITHUB_OUTPUT
                   echo "resolved_sha=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
 
+            - name: Setup Bun
+              uses: oven-sh/setup-bun@v2
+              with:
+                  bun-version: 1.3.14
+
+            # Node is still REQUIRED in the publish job (not just for install): the
+            # publish scripts run as `node scripts/publish-*.mjs`, the version step uses
+            # `node -p`, and `npx ovsx` needs npm. setup-bun does not provide a Node
+            # runtime, so keep setup-node. Pinned to Node 22 because newer LTS
+            # (Node 24 / npm 11) can make vsce's `npm list` detection fail with
+            # ELSPROBLEMS during packaging.
             - name: Setup Node.js
               uses: actions/setup-node@v4
               with:
                   node-version: 22
 
-            - name: Install extension dependencies
+            # Single root install resolves the whole bun workspace at once (replaces the
+            # per-package `npm install` steps for apps/vscode + webview-ui).
+            - name: Install workspace dependencies
               working-directory: ${{ github.workspace }}
-              run: npm --prefix apps/vscode install --include=optional
+              run: bun install --frozen-lockfile
 
-            - name: Install webview-ui dependencies
+            # @cline/* are local workspace symlinks to source packages; build dist/ before
+            # packaging/publishing the extension.
+            - name: Build SDK packages
               working-directory: ${{ github.workspace }}
-              run: npm --prefix apps/vscode/webview-ui install --include=optional
+              run: bun run build:sdk
 
+            - name: Assert better-sqlite3 native binary present
+              run: |
+                  NODE_FILE="node_modules/better-sqlite3/build/Release/better_sqlite3.node"
+                  if [ ! -f "$NODE_FILE" ]; then
+                    echo "ERROR: better-sqlite3 native binary missing at apps/vscode/$NODE_FILE"
+                    echo "(bun trustedDependencies postinstall likely did not run)"
+                    exit 1
+                  fi
+                  echo "Found better-sqlite3 native binary: $NODE_FILE"
+
+            # vsce is a workspace devDependency (on node_modules/.bin), but ovsx is not
+            # vendored and the publish script invokes it via `npx ovsx`, so install ovsx
+            # globally (npm is available via setup-node). vsce is installed globally too
+            # to preserve the script's existing PATH expectations.
             - name: Install Publishing Tools
               run: npm install -g @vscode/vsce ovsx
 
@@ -164,14 +193,20 @@ jobs:
                   node scripts/marketplace-readme.mjs swap-in
                   trap 'node scripts/marketplace-readme.mjs restore' EXIT
 
-                  # Required to generate the .vsix
-                  vsce package  --allow-package-secrets sendgrid --out "cline-${{ steps.get_version.outputs.version }}.vsix"
+                  # Required to generate the .vsix. --no-dependencies: the extension
+                  # is fully esbuild-bundled, and under the bun workspace the @cline/*
+                  # deps are symlinks pointing outside the package, so without this vsce
+                  # would walk them and pull the whole monorepo into the .vsix.
+                  vsce package --no-dependencies --allow-package-secrets sendgrid --out "cline-${{ steps.get_version.outputs.version }}.vsix"
 
+                  # These scripts run under `node scripts/publish-marketplace.mjs`;
+                  # bun run just launches them. Node + npm (for `npx ovsx`) come from
+                  # setup-node above.
                   if [ "$RELEASE_TYPE" = "pre-release" ]; then
-                    npm run publish:marketplace:prerelease
+                    bun run publish:marketplace:prerelease
                     echo "Successfully published pre-release version ${{ steps.get_version.outputs.version }} to VS Code Marketplace and Open VSX Registry"
                   else
-                    npm run publish:marketplace
+                    bun run publish:marketplace
                     echo "Successfully published release version ${{ steps.get_version.outputs.version }} to VS Code Marketplace and Open VSX Registry"
                   fi
 

.github/workflows/ext-vscode-test-e2e.yml

@@ -45,12 +45,16 @@ jobs:
                           - 'apps/vscode/assets/**'
                           - 'apps/vscode/walkthrough/**'
                           - 'apps/vscode/package.json'
-                          - 'apps/vscode/package-lock.json'
+                          - 'apps/vscode/webview-ui/package.json'
+                          # Root bun lockfile is authoritative for the whole workspace (incl. apps/vscode).
+                          - 'bun.lock'
+                          # SDK source packages are local workspace symlinks (@cline/*), so SDK changes affect the build.
+                          - 'sdk/packages/**'
                           - 'apps/vscode/buf.yaml'
                           - 'apps/vscode/tsconfig*.json'
                           - 'apps/vscode/biome.jsonc'
                           - 'apps/vscode/esbuild.mjs'
-                          - 'apps/vscode/.mocharc.json'
+                          - 'apps/vscode/bunfig.toml'
                           - 'apps/vscode/.vscode-test.mjs'
                           - 'apps/vscode/.vscodeignore'
                           - 'apps/vscode/playwright*.ts'
@@ -84,26 +88,20 @@ jobs:
                 working-directory: apps/vscode
         steps:
             - uses: actions/checkout@v4
-            - name: Setup Node.js environment
-              uses: actions/setup-node@v4
+            - name: Setup Bun
+              uses: oven-sh/setup-bun@v2
               with:
-                  node-version: 22
+                  bun-version: 1.3.14
 
-            # Cache root dependencies - only reuse if package-lock.json exactly matches
-            - name: Cache root dependencies
+            # Cache Bun's global install cache - keyed on the authoritative root bun.lock.
+            - name: Cache Bun install cache
               uses: actions/cache@v4
-              id: root-cache
+              id: bun-cache
               with:
-                  path: apps/vscode/node_modules
-                  key: ${{ runner.os }}-npm-${{ hashFiles('apps/vscode/package-lock.json') }}
-
-            # Cache webview-ui dependencies - only reuse if package-lock.json exactly matches
-            - name: Cache webview-ui dependencies
-              uses: actions/cache@v4
-              id: webview-cache
-              with:
-                  path: apps/vscode/webview-ui/node_modules
-                  key: ${{ runner.os }}-npm-webview-${{ hashFiles('apps/vscode/webview-ui/package-lock.json') }}
+                  path: ~/.bun/install/cache
+                  key: ${{ runner.os }}-bun-${{ hashFiles('bun.lock') }}
+                  restore-keys: |
+                      ${{ runner.os }}-bun-
 
             # Cache VS Code installation
             - name: Cache VS Code
@@ -124,22 +122,41 @@ jobs:
                       ~/.cache/ms-playwright
                       ~/Library/Caches/ms-playwright
                       ~/AppData/Local/ms-playwright
-                  key: playwright-browsers-${{ runner.os }}-${{ hashFiles('apps/vscode/package-lock.json') }}
+                  key: playwright-browsers-${{ runner.os }}-${{ hashFiles('bun.lock') }}
                   restore-keys: |
                       playwright-browsers-${{ runner.os }}-
 
-            - name: Install extension dependencies
+            # Single root install resolves the entire bun workspace at once (replaces
+            # the per-package `npm ci` steps for apps/vscode + webview-ui).
+            - name: Install workspace dependencies
               working-directory: ${{ github.workspace }}
-              run: npm --prefix apps/vscode ci
+              run: bun install --frozen-lockfile
               env:
                   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-            - name: Install webview-ui dependencies
+            # @cline/* are local workspace symlinks to source packages; build dist/
+            # before building/packaging the extension for E2E.
+            - name: Build SDK packages
               working-directory: ${{ github.workspace }}
-              run: npm --prefix apps/vscode/webview-ui ci
+              run: bun run build:sdk
 
-            - name: Install vsce
-              run: npm install -g @vscode/vsce
+            - name: Assert better-sqlite3 native binary present
+              # Force bash: the Windows runner defaults to pwsh, which can't parse this
+              # POSIX test. Git Bash ships on GitHub's windows-latest images.
+              shell: bash
+              run: |
+                  NODE_FILE="node_modules/better-sqlite3/build/Release/better_sqlite3.node"
+                  if [ ! -f "$NODE_FILE" ]; then
+                    echo "ERROR: better-sqlite3 native binary missing at apps/vscode/$NODE_FILE"
+                    echo "(bun trustedDependencies postinstall likely did not run)"
+                    exit 1
+                  fi
+                  echo "Found better-sqlite3 native binary: $NODE_FILE"
+
+            # NOTE: vsce is no longer installed globally. @vscode/vsce is a workspace
+            # devDependency of apps/vscode (resolved into node_modules/.bin), and the
+            # `test:e2e:build` script invokes `vsce` via `bun run`, which puts the local
+            # .bin on PATH. No global install needed.
 
             - name: Install xvfb on Linux
               if: matrix.runner == 'ubuntu'
@@ -148,11 +165,11 @@ jobs:
             # Run optimized E2E tests (eliminates redundant builds)
             - name: Run E2E tests - Linux
               if: matrix.runner == 'ubuntu'
-              run: xvfb-run -a npm run test:e2e:optimal
+              run: xvfb-run -a bun run test:e2e:optimal
 
             - name: Run E2E tests - Non-Linux
               if: matrix.runner != 'ubuntu'
-              run: npm run test:e2e:optimal
+              run: bun run test:e2e:optimal
 
             - uses: actions/upload-artifact@v4
               if: ${{ failure() }}

.github/workflows/ext-vscode-test.yml

@@ -45,13 +45,16 @@ jobs:
                           - 'apps/vscode/assets/**'
                           - 'apps/vscode/walkthrough/**'
                           - 'apps/vscode/package.json'
-                          - 'apps/vscode/package-lock.json'
+                          - 'apps/vscode/webview-ui/package.json'
+                          # Root bun lockfile is authoritative for the whole workspace (incl. apps/vscode).
+                          - 'bun.lock'
+                          # SDK source packages are local workspace symlinks (@cline/*), so SDK changes affect the build.
+                          - 'sdk/packages/**'
                           - 'apps/vscode/buf.yaml'
                           - 'apps/vscode/tsconfig*.json'
                           - 'apps/vscode/biome.jsonc'
                           - 'apps/vscode/esbuild.mjs'
-                          - 'apps/vscode/.mocharc.json'
-                          - 'apps/vscode/.nycrc*.json'
+                          - 'apps/vscode/bunfig.toml'
                           - 'apps/vscode/.vscode-test.mjs'
                           - 'apps/vscode/test-setup.js'
                           - '.github/workflows/ext-vscode-test.yml'
@@ -60,9 +63,13 @@ jobs:
                           - 'apps/vscode/proto/**'
                           - 'apps/vscode/standalone/**'
                           - 'apps/vscode/testing-platform/**'
+                          - 'apps/vscode/testing-platform/package.json'
                           - 'apps/vscode/tests/specs/**'
                           - 'apps/vscode/package.json'
-                          - 'apps/vscode/package-lock.json'
+                          # Root bun lockfile is authoritative for the whole workspace (incl. apps/vscode).
+                          - 'bun.lock'
+                          # SDK source packages are local workspace symlinks (@cline/*), so SDK changes affect the build.
+                          - 'sdk/packages/**'
                           - 'apps/vscode/buf.yaml'
                           - 'apps/vscode/tsconfig*.json'
                           - 'apps/vscode/esbuild.mjs'
@@ -82,27 +89,38 @@ jobs:
             - name: Checkout code
               uses: actions/checkout@v4
 
-            - name: Setup Node.js environment
-              uses: actions/setup-node@v4
+            - name: Setup Bun
+              uses: oven-sh/setup-bun@v2
               with:
-                  node-version: 22
-                  cache: 'npm'
-                  cache-dependency-path: |
-                      apps/vscode/package-lock.json
-                      apps/vscode/webview-ui/package-lock.json
+                  bun-version: 1.3.14
 
-            - name: Install extension dependencies
+            # Single root install resolves the entire bun workspace (apps/vscode,
+            # webview-ui, testing-platform and the @cline/* SDK symlinks) at once,
+            # so the previous per-package `npm ci` steps collapse into one.
+            - name: Install workspace dependencies
               working-directory: ${{ github.workspace }}
-              run: npm --prefix apps/vscode ci
+              run: bun install --frozen-lockfile
               env:
                   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-            - name: Install webview-ui dependencies
+            # @cline/* are local workspace symlinks to source packages; their dist/
+            # output must be built before the extension can type-check/compile.
+            - name: Build SDK packages
               working-directory: ${{ github.workspace }}
-              run: npm --prefix apps/vscode/webview-ui ci
+              run: bun run build:sdk
+
+            - name: Assert better-sqlite3 native binary present
+              run: |
+                  NODE_FILE="node_modules/better-sqlite3/build/Release/better_sqlite3.node"
+                  if [ ! -f "$NODE_FILE" ]; then
+                    echo "ERROR: better-sqlite3 native binary missing at apps/vscode/$NODE_FILE"
+                    echo "(bun trustedDependencies postinstall likely did not run)"
+                    exit 1
+                  fi
+                  echo "Found better-sqlite3 native binary: $NODE_FILE"
 
             - name: Run Quality Checks (Parallel)
-              run: npm run ci:check-all
+              run: bun run ci:check-all
 
     vscode-test:
         needs: [detect-changes, quality-checks]
@@ -123,30 +141,43 @@ jobs:
             - name: Checkout code
               uses: actions/checkout@v4
 
-            - name: Setup Node.js environment
-              uses: actions/setup-node@v4
+            - name: Setup Bun
+              uses: oven-sh/setup-bun@v2
               with:
-                  node-version: 22
-                  cache: 'npm'
-                  cache-dependency-path: |
-                      apps/vscode/package-lock.json
-                      apps/vscode/webview-ui/package-lock.json
+                  bun-version: 1.3.14
 
-            - name: Install extension dependencies
+            # Single root install resolves the entire bun workspace at once (replaces
+            # the per-package `npm ci` steps for apps/vscode + webview-ui).
+            - name: Install workspace dependencies
               working-directory: ${{ github.workspace }}
-              run: npm --prefix apps/vscode ci
+              run: bun install --frozen-lockfile
               env:
                   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-            - name: Install webview-ui dependencies
+            # @cline/* are local workspace symlinks to source packages; build dist/
+            # before compiling/testing the extension.
+            - name: Build SDK packages
               working-directory: ${{ github.workspace }}
-              run: npm --prefix apps/vscode/webview-ui ci
+              run: bun run build:sdk
 
-            - name: Set up NPM on Windows
-              if: runner.os == 'Windows'
-              working-directory: ${{ github.workspace }}
+            - name: Assert better-sqlite3 native binary present
               run: |
-                  npm config set script-shell "C:\\Program Files\\Git\\bin\\bash.exe"
+                  NODE_FILE="node_modules/better-sqlite3/build/Release/better_sqlite3.node"
+                  if [ ! -f "$NODE_FILE" ]; then
+                    echo "ERROR: better-sqlite3 native binary missing at apps/vscode/$NODE_FILE"
+                    echo "(bun trustedDependencies postinstall likely did not run)"
+                    exit 1
+                  fi
+                  echo "Found better-sqlite3 native binary: $NODE_FILE"
+
+            # NOTE: The old `npm config set script-shell bash` step is intentionally
+            # removed. Scripts are now launched with `bun run`, which uses Bun's own
+            # built-in cross-platform shell rather than npm's configured script-shell,
+            # so that npm-specific Windows workaround no longer applies. Bash-dependent
+            # scripts (e.g. scripts/proto-lint.sh, standalone/runclinecore.sh) are
+            # invoked explicitly via `bash ...` from within the package scripts, and
+            # this job's `defaults.run.shell: bash` (Git Bash on Windows) still covers
+            # the workflow `run:` blocks below.
 
             - name: Cache VS Code test runtime
               if: runner.os == 'Windows'
@@ -158,24 +189,51 @@ jobs:
             # Build the extension and tests (without redundant checks)
             - name: Build Tests and Extension
               id: build_step
-              run: npm run ci:build
+              run: bun run ci:build
 
-            - name: Unit Tests with coverage - Linux
+            - name: Vitest Suites (SDK adapter + model catalog)
+              id: vitest_tests
+              if: ${{ !cancelled() && steps.build_step.outcome == 'success' }}
+              # The vitest config sets passWithNoTests: true, so a broken glob/alias
+              # would "pass" with zero tests. Capture output and assert a non-zero
+              # test count to guard against silent skips.
+              run: |
+                  set -o pipefail
+                  bun run test:vitest 2>&1 | tee vitest-output.log
+                  # Strip ANSI color codes before matching — vitest colorizes the
+                  # "Tests  N passed" summary, so the count is not adjacent to the
+                  # "Tests" label in the raw bytes.
+                  if ! sed -r 's/\x1b\[[0-9;]*m//g' vitest-output.log | grep -Eq 'Tests[[:space:]]+[0-9]*[1-9][0-9]* (passed|failed)'; then
+                    echo "ERROR: vitest reported zero tests (possible silent skip)."
+                    exit 1
+                  fi
+
+            - name: Unit Tests (bun) - Linux
               id: unit_tests_linux
               if: ${{ !cancelled() && steps.build_step.outcome == 'success' && runner.os == 'Linux' }}
+              # The node-side unit suite (.mocharc spec set) now runs under `bun test`
+              # via scripts/run-bun-unit-tests.ts (one isolated bun process per file).
+              # The runner exits non-zero on any failure and prints a final
+              # "Files: N  Pass: P  Fail: F" summary; assert a non-zero pass count to
+              # guard against an empty glob silently "passing".
               run: |
-                  npx nyc --nycrc-path .nycrc.unit.json --reporter=lcov npm run test:unit
+                  set -o pipefail
+                  bun run test:unit 2>&1 | tee unit-output.log
+                  if ! grep -Eq 'Pass:[[:space:]]+[0-9]*[1-9][0-9]*' unit-output.log; then
+                    echo "ERROR: bun unit runner reported zero passing tests (possible silent skip)."
+                    exit 1
+                  fi
 
-            - name: Unit Tests - Non-Linux
+            - name: Unit Tests (bun) - Non-Linux
               id: unit_tests_non_linux
               if: ${{ !cancelled() && steps.build_step.outcome == 'success' && runner.os != 'Linux' }}
               run: |
-                  npm run test:unit
+                  bun run test:unit
 
             - name: Extension Integration Tests - Linux
               id: integration_tests_linux
               if: ${{ !cancelled() && steps.build_step.outcome == 'success' && runner.os == 'Linux' }}
-              run: xvfb-run -a npm run test:coverage
+              run: xvfb-run -a bun run test:coverage
 
             - name: Extension Integration Tests - Non-Linux
               id: integration_tests_non_linux
@@ -183,7 +241,7 @@ jobs:
               run: |
                   for attempt in 1 2 3; do
                     echo "Running extension integration tests (attempt ${attempt}/3)"
-                    if npm run test:integration; then
+                    if bun run test:integration; then
                       exit 0
                     fi
 
@@ -201,7 +259,7 @@ jobs:
               if: ${{ !cancelled() && steps.build_step.outcome == 'success' }}
               run: |
                   cd webview-ui
-                  npm run test:coverage
+                  bun run test:coverage
 
             - name: Save Coverage Reports
               uses: actions/upload-artifact@v4
@@ -210,7 +268,6 @@ jobs:
               with:
                   name: pr-coverage-reports
                   path: |
-                      apps/vscode/coverage-unit/lcov.info
                       apps/vscode/webview-ui/coverage/lcov.info
 
     test-platform-integration:
@@ -224,39 +281,45 @@ jobs:
             - name: Checkout code
               uses: actions/checkout@v4
 
-            - name: Setup Node.js environment
-              uses: actions/setup-node@v4
+            - name: Setup Bun
+              uses: oven-sh/setup-bun@v2
               with:
-                  node-version: 22
-                  cache: 'npm'
-                  cache-dependency-path: |
-                      apps/vscode/package-lock.json
-                      apps/vscode/webview-ui/package-lock.json
-                      apps/vscode/testing-platform/package-lock.json
+                  bun-version: 1.3.14
 
-            - name: Install extension dependencies
+            # Single root install resolves the whole bun workspace, including the
+            # testing-platform package, so the separate per-package `npm ci` steps
+            # (extension + webview-ui + testing-platform) collapse into one.
+            - name: Install workspace dependencies
               working-directory: ${{ github.workspace }}
-              run: npm --prefix apps/vscode ci
+              run: bun install --frozen-lockfile
               env:
                   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-            - name: Install webview-ui dependencies
+            # @cline/* are local workspace symlinks to source packages; build dist/
+            # before compiling the standalone core.
+            - name: Build SDK packages
               working-directory: ${{ github.workspace }}
-              run: npm --prefix apps/vscode/webview-ui ci
+              run: bun run build:sdk
+
+            - name: Assert better-sqlite3 native binary present
+              run: |
+                  NODE_FILE="node_modules/better-sqlite3/build/Release/better_sqlite3.node"
+                  if [ ! -f "$NODE_FILE" ]; then
+                    echo "ERROR: better-sqlite3 native binary missing at apps/vscode/$NODE_FILE"
+                    echo "(bun trustedDependencies postinstall likely did not run)"
+                    exit 1
+                  fi
+                  echo "Found better-sqlite3 native binary: $NODE_FILE"
 
             - name: Download ripgrep binaries
-              run: npm run download-ripgrep
+              run: bun run download-ripgrep
 
             - name: Compile Standalone
-              run: npm run compile-standalone
-
-            - name: Install testing platform dependencies
-              working-directory: ${{ github.workspace }}
-              run: npm --prefix apps/vscode/testing-platform ci
+              run: bun run compile-standalone
 
             - name: Running testing platform integration spec tests
               timeout-minutes: 7
-              run: npm run test:tp-orchestrator -- tests/specs/ --count=1 --coverage
+              run: bun run test:tp-orchestrator -- tests/specs/ --count=1 --coverage
 
             - name: Save Coverage Reports
               uses: actions/upload-artifact@v4

.gitignore

@@ -13,6 +13,9 @@ tmp
 pnpm-lock.yaml
 
 .clineignore
+.cline/enterprise
+.cline/remote-config
+**/.cline/remote-config
 .venv
 .actrc
 CLAUDE.local.md
@@ -81,3 +84,4 @@ apps/vscode/webview-ui/src/**/*.js.map
 *.db-wal
 .cline/**/managed.json
 .cline/**/bundle.json
+apps/vscode/tsconfig.test.generated.json

.husky/pre-commit

@@ -7,4 +7,5 @@ fi
 
 gitleaks git --pre-commit --redact --staged --verbose || exit 1
 
-lint-staged
+cd apps/vscode && bunx lint-staged
+

.vscode/launch.json

@@ -126,10 +126,7 @@
 				"${workspaceFolder}/apps/vscode/dist-standalone/**/*.js"
 			],
 			"preLaunchTask": "compile-standalone",
-			"runtimeExecutable": "npx",
-			"runtimeArgs": [
-				"tsx"
-			],
+			"runtimeExecutable": "bun",
 			"program": "scripts/test-standalone-core-api-server.ts",
 			"envFile": "${workspaceFolder}/apps/vscode/.env",
 			"env": {
@@ -183,7 +180,7 @@
 			"name": "Open Storybook",
 			"type": "node",
 			"request": "launch",
-			"runtimeExecutable": "npm",
+			"runtimeExecutable": "bun",
 			"runtimeArgs": [
 				"run",
 				"storybook"

.vscode/tasks.json

@@ -6,7 +6,7 @@
 		{
 			"label": "compile-standalone",
 			"type": "shell",
-			"command": "npm run compile-standalone",
+			"command": "bun run compile-standalone",
 			"group": "build",
 			"problemMatcher": [],
 			"presentation": {
@@ -19,7 +19,7 @@
 		{
 			"label": "npm: protos",
 			"type": "shell",
-			"command": "npm run protos",
+			"command": "bun run protos",
 			"problemMatcher": [],
 			"isBackground": false,
 			"presentation": {
@@ -65,7 +65,7 @@
 		},
 		{
 			"type": "shell",
-			"command": "npm run build:webview",
+			"command": "bun run build:webview",
 			"group": "build",
 			"problemMatcher": [],
 			"isBackground": true,
@@ -86,7 +86,7 @@
 		},
 		{
 			"type": "shell",
-			"command": "npm run build:webview:test",
+			"command": "bun run build:webview:test",
 			"group": "build",
 			"problemMatcher": [],
 			"isBackground": true,
@@ -108,7 +108,7 @@
 		},
 		{
 			"type": "shell",
-			"command": "npm run dev:webview",
+			"command": "bun run dev:webview",
 			"group": "build",
 			"problemMatcher": [
 				{
@@ -145,7 +145,7 @@
 		},
 		{
 			"type": "shell",
-			"command": "npm run watch:esbuild",
+			"command": "bun run watch:esbuild",
 			"group": "build",
 			"problemMatcher": {
 				"pattern": [
@@ -169,7 +169,8 @@
 			"isBackground": true,
 			"label": "npm: watch:esbuild",
 			"dependsOn": [
-				"npm: protos"
+				"npm: protos",
+				"build-sdk:debug"
 			],
 			"presentation": {
 				"group": "watch",
@@ -184,7 +185,7 @@
 		},
 		{
 			"type": "shell",
-			"command": "npm run watch:esbuild:test",
+			"command": "bun run watch:esbuild:test",
 			"group": "build",
 			"problemMatcher": {
 				"pattern": [
@@ -208,7 +209,8 @@
 			"isBackground": true,
 			"label": "npm: watch:esbuild:test",
 			"dependsOn": [
-				"npm: protos"
+				"npm: protos",
+				"build-sdk:debug"
 			],
 			"presentation": {
 				"group": "watch",
@@ -224,7 +226,7 @@
 		},
 		{
 			"type": "shell",
-			"command": "npm run watch:tsc",
+			"command": "bun run watch:tsc",
 			"group": "build",
 			"problemMatcher": "$tsc-watch",
 			"isBackground": true,
@@ -242,7 +244,7 @@
 		},
 		{
 			"type": "shell",
-			"command": "npm run watch-tests",
+			"command": "bun run watch-tests",
 			"label": "npm: watch-tests",
 			"problemMatcher": "$tsc-watch",
 			"isBackground": true,
@@ -282,7 +284,7 @@
 		},
 		{
 			"type": "shell",
-			"command": "npm run storybook",
+			"command": "bun run storybook",
 			"group": "build",
 			"problemMatcher": [],
 			"isBackground": false,
@@ -311,6 +313,24 @@
 			"options": {
 				"cwd": "${workspaceFolder}"
 			}
+		},
+		{
+			"label": "build-sdk:debug",
+			"type": "shell",
+			"command": "bun run build:sdk",
+			"problemMatcher": [
+				"$tsc"
+			],
+			"presentation": {
+				"group": "watch",
+				"reveal": "always"
+			},
+			"options": {
+				"cwd": "${workspaceFolder}",
+				"env": {
+					"CLINE_SOURCEMAPS": "1"
+				}
+			}
 		}
 	],
 	"inputs": [

CLAUDE.md

@@ -1,2 +0,0 @@
-@.clinerules/general.md
-@.clinerules/network.md

CONTRIBUTING.md

@@ -45,7 +45,7 @@ We also welcome contributions to our [documentation](https://github.com/cline/cl
 3. Install [bun](https://bun.com)
 4. Install the necessary dependencies for the extension and webview-gui:
     ```bash
-    cd apps/vscode && npm run install:all && cd ../..
+    cd apps/vscode && bun run install:all && cd ../..
     cd sdk && bun run build && cd ..
     ```
 5. Generate Protocol Buffer files (required before first build):
@@ -61,8 +61,8 @@ We also welcome contributions to our [documentation](https://github.com/cline/cl
 2. Push your branch and create a PR on GitHub. Our CI will:
    - Run tests and checks
 3. Testing
-    - Run `cd apps/vscode && npm run test` to run tests locally. 
-    - Before submitting PR, run `npm run format:fix` to format your code
+    - Run `cd apps/vscode && bun run test` to run tests locally. 
+    - Before submitting PR, run `bun run format:fix` to format your code
 
 ### Extension
 
@@ -74,12 +74,12 @@ We also welcome contributions to our [documentation](https://github.com/cline/cl
 
 2. **Local Development**
     - cd into the vscode extension, `cd apps/vscode`
-    - Run `npm run install:all` to install dependencies
-    - Run `npm run protos` to generate Protocol Buffer files (required before first build)
-    - Run `npm run test` to run tests locally
+    - Run `bun run install:all` to install dependencies
+    - Run `bun run protos` to generate Protocol Buffer files (required before first build)
+    - Run `bun run test` to run tests locally
     - Run → Start Debugging or `>Debug: Select and Start Debugging` and wait for a new VS Code instance to open
-    - **Terminal Workflow**: Use `npm run dev` (generates protos + runs watch mode) or `npm run watch` (if protos already generated)
-    - Before submitting PR, run `npm run format:fix` to format your code
+    - **Terminal Workflow**: Use `bun run dev` (generates protos + runs watch mode) or `bun run watch` (if protos already generated)
+    - Before submitting PR, run `bun run format:fix` to format your code
 
 3. **Linux-specific Setup**
     VS Code extension tests on Linux require the following system libraries:
@@ -135,8 +135,8 @@ Anyone can contribute code to Cline, but we ask that you follow these guidelines
 
 2. **Code Quality**
 
-    - Run `npm run lint` to check code style
-    - Run `npm run format` to automatically format code
+    - Run `bun run lint` to check code style
+    - Run `bun run format` to automatically format code
     - All PRs must pass CI checks which include both linting and formatting
     - Address any warnings or errors from linter before submitting
     - Follow TypeScript best practices and maintain type safety
@@ -144,7 +144,7 @@ Anyone can contribute code to Cline, but we ask that you follow these guidelines
 3. **Testing**
 
     - Add tests for new features
-    - Run `npm test` to ensure all tests pass
+    - Run `bun test` to ensure all tests pass
     - Update existing tests if your changes affect them
     - Include both unit tests and integration tests where appropriate
 
@@ -154,9 +154,9 @@ Anyone can contribute code to Cline, but we ask that you follow these guidelines
     
     - **Running E2E tests:**
       ```bash
-      npm run test:e2e        # Build and run all E2E tests
-      npm run e2e             # Run tests without rebuilding
-      npm run test:e2e -- --debug  # Run with interactive debugger
+      bun run test:e2e        # Build and run all E2E tests
+      bun run e2e             # Run tests without rebuilding
+      bun run test:e2e -- --debug  # Run with interactive debugger
       ```
     
     - **Writing E2E tests:**

apps/cli/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Cline CLI Changelog
 
+## 3.0.29
+
+- Costs are now hidden for Cline free models
+- Fixed Z.ai model metadata resolution for Z.ai models accessed through the Cline provider
+- Reverted the model-name-only display change from v3.0.28; the model picker, selector, and status bar return to their previous display behavior
+
+## 3.0.28
+
+- Added a ClinePass onboarding flow with selectable ClinePass models, plus improved ClinePass error handling
+- Added hub primitive catalogs and refreshed the hub dashboard design with a dedicated customizations breakout
+- Auto-approve toggles now apply immediately when changed
+- Feature flags now resolve using your user ID on startup
+- Fixed Cline model display names so they resolve by model name
+- Truncate large tool results by default (including MCP and custom tool output) to keep requests within context budget
+- Hardened parallel tool-call guidance for faster, more reliable multi-tool execution
+
 ## 3.0.27
 
 - Added a `cline skill` command to install and manage skills, matching `cline plugin install` and `cline mcp` (installs default to the Cline agent directory)

apps/cli/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "@cline/cli",
 	"displayName": "cline",
-	"version": "3.0.27",
+	"version": "3.0.29",
 	"description": "Autonomous coding agent CLI - capable of creating/editing files, running commands, using the browser, and more",
 	"type": "module",
 	"publishConfig": {

apps/cli/src/connectors/catalog.ts

@@ -1,36 +1,2 @@
-export type ConnectorCatalogEntry = {
-	name: string;
-	description: string;
-};
-
-export const CONNECTOR_CATALOG: ConnectorCatalogEntry[] = [
-	{
-		name: "discord",
-		description:
-			"Discord interactions and gateway bridge backed by RPC runtime sessions",
-	},
-	{
-		name: "gchat",
-		description: "Google Chat webhook bridge backed by RPC runtime sessions",
-	},
-	{
-		name: "linear",
-		description: "Linear webhook bridge backed by RPC runtime sessions",
-	},
-	{
-		name: "slack",
-		description: "Slack webhook/socket bridge backed by RPC runtime sessions",
-	},
-	{
-		name: "telegram",
-		description: "Bridge Telegram bot messages into RPC chat sessions",
-	},
-	{
-		name: "whatsapp",
-		description: "Bridge WhatsApp webhook messages into RPC chat sessions",
-	},
-];
-
-export function listConnectorCatalog(): ConnectorCatalogEntry[] {
-	return CONNECTOR_CATALOG.map((entry) => ({ ...entry }));
-}
+export type { ConnectorCatalogEntry } from "@cline/shared";
+export { CONNECTOR_CATALOG, listConnectorCatalog } from "@cline/shared";

apps/cli/src/runtime/run-agent.test.ts

@@ -27,11 +27,25 @@ const outputMocks = vi.hoisted(() => ({
 	c: { dim: "", reset: "" },
 }));
 
+const sessionEventsMocks = vi.hoisted(() => ({
+	listener: undefined as ((event: unknown) => void) | undefined,
+	subscribeToAgentEvents: vi.fn(
+		(_: unknown, listener: (event: unknown) => void) => {
+			sessionEventsMocks.listener = listener;
+			return () => {};
+		},
+	),
+}));
+
 const CLINE_PASS_SUBSCRIPTION_URL =
-	"https://app.cline.bot/dashboard/subscription/";
+	"https://app.cline.bot/dashboard/subscription?personal=true";
 const CLINE_PASS_SUBSCRIPTION_MESSAGE = `No access to ClinePass subscription models yet. Subscribe to ClinePass, the low cost open weights model coding plan: ${CLINE_PASS_SUBSCRIPTION_URL}`;
+const CLINE_ORG_INDIVIDUAL_INFERENCE_SUBSCRIPTION_MESSAGE =
+	"Organization accounts cannot use ClinePass subscriptions. Go to /account -> change account to switch to your personal account for ClinePass";
 
 vi.mock("@cline/core", () => ({
+	getClineOrgIndividualInferenceSubscriptionMessage: () =>
+		CLINE_ORG_INDIVIDUAL_INFERENCE_SUBSCRIPTION_MESSAGE,
 	getClinePassSubscriptionUrl: () => CLINE_PASS_SUBSCRIPTION_URL,
 	isClineNotSubscribedError: (error: unknown) =>
 		error instanceof Error && error.name === "ClineNotSubscribedError",
@@ -39,6 +53,15 @@ vi.mock("@cline/core", () => ({
 		text
 			.toLowerCase()
 			.includes("the user is not subscribed to required model plan"),
+	isClineOrgIndividualInferenceSubscriptionError: (error: unknown) =>
+		error instanceof Error &&
+		error.name === "ClineOrgIndividualInferenceSubscriptionError",
+	isClineOrgIndividualInferenceSubscriptionMessage: (text: string) =>
+		text
+			.toLowerCase()
+			.includes(
+				"organization accounts cannot use individual model inference subscriptions",
+			),
 	prewarmFileIndex: vi.fn(async () => undefined),
 	SessionSource: {
 		CLI: "cli",
@@ -88,7 +111,7 @@ vi.mock("./prompt", () => ({
 }));
 
 vi.mock("./session-events", () => ({
-	subscribeToAgentEvents: vi.fn(() => () => {}),
+	subscribeToAgentEvents: sessionEventsMocks.subscribeToAgentEvents,
 }));
 
 describe("runAgent", () => {
@@ -112,6 +135,9 @@ describe("runAgent", () => {
 		outputMocks.writeln.mockReset();
 		outputMocks.emitJsonLine.mockReset();
 		outputMocks.setActiveCliSession.mockReset();
+		sessionEventsMocks.listener = undefined;
+		sessionEventsMocks.subscribeToAgentEvents.mockClear();
+		vi.unstubAllGlobals();
 	});
 
 	afterEach(() => {
@@ -938,4 +964,121 @@ describe("runAgent", () => {
 			expect.stringContaining("est. cost"),
 		);
 	});
+
+	it("zeros Cline free model costs in JSON results and agent events", async () => {
+		const startedAt = new Date("2026-03-22T00:00:00.000Z");
+		const endedAt = new Date("2026-03-22T00:00:01.000Z");
+		vi.stubGlobal(
+			"fetch",
+			vi.fn(async () => {
+				return new Response(
+					JSON.stringify({
+						free: [{ id: "deepseek/deepseek-v4-flash" }],
+					}),
+					{ status: 200, headers: { "content-type": "application/json" } },
+				);
+			}),
+		);
+		sessionManagerMocks.start.mockResolvedValue({
+			sessionId: "session-1",
+			manifestPath: "/tmp/manifest.json",
+			messagesPath: "/tmp/messages.json",
+			manifest: {
+				session_id: "session-1",
+			},
+			result: {
+				text: "completed text",
+				usage: {
+					inputTokens: 1,
+					outputTokens: 1,
+					cacheReadTokens: 0,
+					cacheWriteTokens: 0,
+					totalCost: 0.25,
+				},
+				messages: [],
+				toolCalls: [],
+				iterations: 1,
+				finishReason: "completed",
+				model: {
+					id: "deepseek/deepseek-v4-flash",
+					provider: "cline",
+					info: {},
+				},
+				startedAt,
+				endedAt,
+				durationMs: 1000,
+			},
+		});
+		sessionManagerMocks.getAccumulatedUsage.mockResolvedValue({
+			usage: {
+				inputTokens: 1,
+				outputTokens: 1,
+				cacheReadTokens: 0,
+				cacheWriteTokens: 0,
+				totalCost: 0.25,
+			},
+			aggregateUsage: {
+				inputTokens: 1,
+				outputTokens: 1,
+				cacheReadTokens: 0,
+				cacheWriteTokens: 0,
+				totalCost: 0.25,
+			},
+		});
+
+		const { runAgent } = await import("./run-agent");
+		const { handleEvent } = await import("../utils/events");
+
+		await expect(
+			runAgent("test prompt", {
+				baseUrl: "https://cline.test/api/v1",
+				cwd: process.cwd(),
+				enableAgentTeams: false,
+				enableSpawnAgent: false,
+				enableTools: [],
+				execution: {
+					maxConsecutiveMistakes: 3,
+				},
+				logger: undefined,
+				mode: "yolo",
+				modelId: "deepseek/deepseek-v4-flash",
+				outputMode: "json",
+				providerId: "cline",
+				systemPrompt: "system",
+				thinking: false,
+				toolPolicies: { "*": { autoApprove: true } },
+				verbose: false,
+				workspaceRoot: process.cwd(),
+			} as never),
+		).resolves.toBeUndefined();
+
+		const runResult = outputMocks.emitJsonLine.mock.calls.find(
+			([, payload]) =>
+				(payload as { type?: string } | undefined)?.type === "run_result",
+		)?.[1] as
+			| {
+					usage?: { totalCost?: number };
+					aggregateUsage?: { totalCost?: number };
+			  }
+			| undefined;
+		expect(runResult?.usage?.totalCost).toBe(0);
+		expect(runResult?.aggregateUsage?.totalCost).toBe(0);
+
+		sessionEventsMocks.listener?.({
+			type: "usage",
+			inputTokens: 1,
+			outputTokens: 1,
+			cost: 0.25,
+			totalCost: 0.25,
+		});
+
+		expect(handleEvent).toHaveBeenLastCalledWith(
+			expect.objectContaining({
+				type: "usage",
+				cost: 0,
+				totalCost: 0,
+			}),
+			expect.any(Object),
+		);
+	});
 });

apps/cli/src/runtime/run-agent.ts

@@ -18,6 +18,11 @@ import {
 } from "../utils/approval";
 import { formatCliErrorMessage } from "../utils/cline-pass-errors";
 import { handleEvent, handleTeamEvent } from "../utils/events";
+import {
+	shouldZeroClineFreeModelCost,
+	zeroCliAgentEventCost,
+	zeroCliUsageCost,
+} from "../utils/free-model-cost";
 import { createRuntimeHooks } from "../utils/hooks";
 import {
 	c,
@@ -184,8 +189,10 @@ export async function runAgent(
 	let reasoningChunkCount = 0;
 	let redactedReasoningChunkCount = 0;
 	const displayedErrorMessages = new Set<string>();
+	const shouldZeroCost = await shouldZeroClineFreeModelCost(config);
 
-	const onAgentEvent = (event: AgentEvent): void => {
+	const onAgentEvent = (rawEvent: AgentEvent): void => {
+		const event = zeroCliAgentEventCost(rawEvent, shouldZeroCost);
 		if (event.type === "content_start" && event.contentType === "reasoning") {
 			reasoningChunkCount += 1;
 			if (event.redacted) {
@@ -339,8 +346,14 @@ export async function runAgent(
 		const usageSummary = await sessionManager.getAccumulatedUsage(
 			started.sessionId,
 		);
-		const aggregateUsage = usageSummary?.aggregateUsage;
-		const usage = aggregateUsage ?? usageSummary?.usage ?? result.usage;
+		const aggregateUsage = zeroCliUsageCost(
+			usageSummary?.aggregateUsage,
+			shouldZeroCost,
+		);
+		const usage = zeroCliUsageCost(
+			aggregateUsage ?? usageSummary?.usage ?? result.usage,
+			shouldZeroCost,
+		);
 
 		if (config.outputMode === "json") {
 			emitJsonLine("stdout", {

apps/cli/src/runtime/run-interactive.ts

@@ -24,6 +24,11 @@ import { disableOpenTuiGraphicsProbe } from "../tui/opentui-env";
 import type { QueuedPromptItem } from "../tui/types";
 import { type ChatCommandState, chatCommandHost } from "../utils/chat-commands";
 import { applyCliCompactionMode } from "../utils/compaction-mode";
+import {
+	shouldZeroClineFreeModelCost,
+	zeroCliAgentEventCost,
+	zeroCliUsageCost,
+} from "../utils/free-model-cost";
 import {
 	prepareTerminalForPostTuiOutput,
 	writeErr,
@@ -153,6 +158,7 @@ export async function runInteractive(
 		askQuestionRef: tuiAskQuestion,
 	});
 	const providerSettingsManager = new ProviderSettingsManager();
+	let zeroCurrentTurnCost = false;
 
 	const sessionRuntime = createInteractiveSessionRuntime({
 		config,
@@ -166,7 +172,7 @@ export async function runInteractive(
 		resolveMistakeLimitDecision,
 		switchToActModeTool,
 		onAgentEvent: (event) => {
-			uiEvents.emit("agent", event);
+			uiEvents.emit("agent", zeroCliAgentEventCost(event, zeroCurrentTurnCost));
 		},
 		onTeamEvent: (event) => {
 			uiEvents.emit("team", event);
@@ -432,6 +438,7 @@ export async function runInteractive(
 		},
 		onSubmit: async (input, mode, delivery, attachments, onCommandOutput) => {
 			let commandOutput: string | undefined;
+			let zeroTurnCost = false;
 			try {
 				await sessionRuntime.ensureReady();
 				await waitForSubmittedMode(mode);
@@ -478,6 +485,8 @@ export async function runInteractive(
 				}
 				input = chatCommandResult.input;
 				commandOutput = chatCommandResult.commandOutput;
+				zeroTurnCost = await shouldZeroClineFreeModelCost(config);
+				zeroCurrentTurnCost = zeroTurnCost;
 				const {
 					prompt: userInput,
 					userImages,
@@ -519,8 +528,9 @@ export async function runInteractive(
 				}
 				if (result.finishReason !== "completed") {
 					if (result.finishReason === "aborted" || isAbortInProgress()) {
-						const usage = await sessionRuntime.getAccumulatedUsage(
-							result.usage,
+						const usage = zeroCliUsageCost(
+							await sessionRuntime.getAccumulatedUsage(result.usage),
+							zeroTurnCost,
 						);
 						return {
 							usage,
@@ -535,7 +545,10 @@ export async function runInteractive(
 						errorText || `Turn finished with ${result.finishReason}`,
 					);
 				}
-				const usage = await sessionRuntime.getAccumulatedUsage(result.usage);
+				const usage = zeroCliUsageCost(
+					await sessionRuntime.getAccumulatedUsage(result.usage),
+					zeroTurnCost,
+				);
 				return {
 					usage,
 					currentContextSize: getCurrentContextSize(result.messages),
@@ -559,6 +572,7 @@ export async function runInteractive(
 				});
 				throw error;
 			} finally {
+				zeroCurrentTurnCost = false;
 				if (!delivery) {
 					isRunning = false;
 					clearAbortInProgress();

apps/cli/src/tests/flags.test.ts

@@ -26,7 +26,6 @@ test.describe("root flag descriptions", () => {
 			"Set reasoning effort level",
 			"consecutive mistakes",
 			"Output messages as JSON",
-			"ACP",
 			"Check for updates and install if available",
 			"Run the kanban app",
 		]);

apps/cli/src/tui/components/chat-entry.tsx

@@ -3,7 +3,9 @@ import type React from "react";
 import { useState } from "react";
 import "opentui-spinner/react";
 import {
+	getClineOrgIndividualInferenceSubscriptionMessage,
 	getClinePassSubscriptionUrl,
+	isClineOrgIndividualInferenceSubscriptionErrorMessage,
 	isClinePassSubscriptionError,
 } from "../../utils/cline-pass-errors";
 import {
@@ -329,6 +331,30 @@ function ClinePassSubscriptionErrorView(props: { defaultFg?: string }) {
 	);
 }
 
+function ClineOrgIndividualInferenceSubscriptionErrorView(props: {
+	defaultFg?: string;
+}) {
+	return (
+		<box flexDirection="row">
+			<text fg="yellow" content="* " />
+			<box
+				flexDirection="column"
+				border
+				borderStyle="rounded"
+				borderColor="yellow"
+				paddingX={1}
+			>
+				<text fg="yellow">Personal ClinePass required</text>
+				<text
+					fg={props.defaultFg}
+					selectable
+					content={getClineOrgIndividualInferenceSubscriptionMessage()}
+				/>
+			</box>
+		</box>
+	);
+}
+
 export function ChatEntryView(props: {
 	entry: ChatEntry;
 	accent?: string;
@@ -427,6 +453,11 @@ export function ChatEntryView(props: {
 			if (isClineAccountCreditsErrorMessage(entry.text)) {
 				return <ClineCreditsErrorView defaultFg={defaultFg} />;
 			}
+			if (isClineOrgIndividualInferenceSubscriptionErrorMessage(entry.text)) {
+				return (
+					<ClineOrgIndividualInferenceSubscriptionErrorView defaultFg={defaultFg} />
+				);
+			}
 			if (isClinePassSubscriptionError(entry.text)) {
 				return <ClinePassSubscriptionErrorView defaultFg={defaultFg} />;
 			}

apps/cli/src/tui/components/model-selector/cline-model-picker.tsx

@@ -9,10 +9,6 @@ import type { ReactNode } from "react";
 import { useEffect, useState } from "react";
 import "opentui-spinner/react";
 import { palette } from "../../palette";
-import {
-	type KnownModels,
-	resolveModelDisplayName,
-} from "./model-display-name";
 
 export interface ClineModelPickerItem {
 	kind: "model";
@@ -34,6 +30,23 @@ function tagColor(tag: string): string {
 	return "cyan";
 }
 
+function resolveDisplayName(
+	modelId: string,
+	knownModels?: Record<string, unknown>,
+): string {
+	if (knownModels) {
+		const candidates = [modelId, modelId.split("/").pop()];
+		for (const key of candidates) {
+			if (!key) continue;
+			const hit = knownModels[key] as { name?: string } | undefined;
+			if (hit?.name) return hit.name;
+		}
+	}
+	return modelId.includes("/")
+		? (modelId.split("/").pop() ?? modelId)
+		: modelId;
+}
+
 export function useClineRecommendedModels() {
 	const [data, setData] = useState<ClineRecommendedModelsData | null>(null);
 	const [loading, setLoading] = useState(true);
@@ -73,7 +86,7 @@ export function ClineModelPicker(props: {
 	entries: ClineModelPickerEntry[];
 	selected: number;
 	loading?: boolean;
-	knownModels?: KnownModels;
+	knownModels?: Record<string, unknown>;
 	currentModelId?: string;
 }) {
 	const { entries, selected, loading, knownModels, currentModelId } = props;
@@ -113,11 +126,7 @@ export function ClineModelPicker(props: {
 			}
 
 			const tags = entry.model.tags;
-			const name = resolveModelDisplayName(
-				entry.model.id,
-				knownModels,
-				entry.model.name,
-			);
+			const name = resolveDisplayName(entry.model.id, knownModels);
 			const isCurrent = currentModelId === entry.model.id;
 			rows.push(
 				<box

apps/cli/src/tui/components/model-selector/cline-model-selector.tsx

@@ -4,10 +4,6 @@ import { useDialogKeyboard } from "@opentui-ui/dialog/react";
 import { useCallback, useEffect, useMemo, useRef, useState } from "react";
 import { palette } from "../../palette";
 import type { ClineModelPickerEntry } from "./cline-model-picker";
-import {
-	type KnownModels,
-	resolveModelDisplayName,
-} from "./model-display-name";
 import { CHANGE_PROVIDER_ACTION } from "./model-selector";
 import { ProviderRow } from "./provider-row";
 
@@ -24,11 +20,28 @@ function tagColor(tag: string): string {
 	return "cyan";
 }
 
+function resolveDisplayName(
+	modelId: string,
+	knownModels?: Record<string, unknown>,
+): string {
+	if (knownModels) {
+		const candidates = [modelId, modelId.split("/").pop()];
+		for (const key of candidates) {
+			if (!key) continue;
+			const hit = knownModels[key] as { name?: string } | undefined;
+			if (hit?.name) return hit.name;
+		}
+	}
+	return modelId.includes("/")
+		? (modelId.split("/").pop() ?? modelId)
+		: modelId;
+}
+
 export function ClineModelSelectorContent(
 	props: ChoiceContext<string> & {
 		currentModel: string;
 		currentProviderName: string;
-		knownModels?: KnownModels;
+		knownModels?: Record<string, unknown>;
 		entries: ClineModelPickerEntry[];
 	},
 ) {
@@ -72,11 +85,7 @@ export function ClineModelSelectorContent(
 				rows.push({
 					key: entry.model.id,
 					kind: "model",
-					label: resolveModelDisplayName(
-						entry.model.id,
-						knownModels,
-						entry.model.name,
-					),
+					label: resolveDisplayName(entry.model.id, knownModels),
 					tags: entry.model.tags,
 					isCurrent: currentModel === entry.model.id,
 					entryIndex: i,
@@ -209,7 +218,7 @@ export function ClineModelSelectorDialogContent(
 	props: ChoiceContext<string> & {
 		currentModel: string;
 		currentProviderName: string;
-		knownModels?: KnownModels;
+		knownModels?: Record<string, unknown>;
 		loadEntries: () => Promise<ClineModelPickerEntry[]>;
 	},
 ) {

apps/cli/src/tui/components/model-selector/model-display-name.test.ts

@@ -1,39 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { resolveModelDisplayName } from "./model-display-name";
-
-describe("resolveModelDisplayName", () => {
-	it("resolves display names by exact model id", () => {
-		expect(
-			resolveModelDisplayName("claude-sonnet", {
-				"claude-sonnet": { name: "Claude Sonnet" },
-			}),
-		).toBe("Claude Sonnet");
-	});
-
-	it("resolves display names by model slug when provider prefixes differ", () => {
-		expect(
-			resolveModelDisplayName("zai/glm-5.2", {
-				"z-ai/glm-5.2": { id: "z-ai/glm-5.2", name: "GLM-5.2" },
-			}),
-		).toBe("GLM-5.2");
-	});
-
-	it("prefers exact model id matches over slug matches", () => {
-		expect(
-			resolveModelDisplayName("zai/glm-5.2", {
-				"z-ai/glm-5.2": { id: "z-ai/glm-5.2", name: "OpenRouter GLM" },
-				"zai/glm-5.2": { id: "zai/glm-5.2", name: "Vercel GLM" },
-			}),
-		).toBe("Vercel GLM");
-	});
-
-	it("uses the fallback name when no catalog entry matches", () => {
-		expect(resolveModelDisplayName("zai/glm-5.2", {}, "GLM 5.2")).toBe(
-			"GLM 5.2",
-		);
-	});
-
-	it("falls back to the model slug without known models", () => {
-		expect(resolveModelDisplayName("zai/glm-5.2")).toBe("glm-5.2");
-	});
-});

apps/cli/src/tui/components/model-selector/model-display-name.ts

@@ -1,41 +0,0 @@
-export interface KnownModelInfo {
-	id?: string;
-	name?: string;
-	capabilities?: string[];
-	maxInputTokens?: number;
-	contextWindow?: number;
-}
-
-export type KnownModels = Record<string, KnownModelInfo>;
-
-export function resolveKnownModelInfo(
-	modelId: string,
-	knownModels?: KnownModels,
-): KnownModelInfo | undefined {
-	if (!knownModels) return undefined;
-
-	const exactMatch = knownModels[modelId];
-	if (exactMatch !== undefined) return exactMatch;
-
-	const modelSlug = modelId.split("/").pop();
-	return Object.entries(knownModels).find(([key, model]) => {
-		return (
-			key.split("/").pop() === modelSlug ||
-			model.id?.split("/").pop() === modelSlug
-		);
-	})?.[1];
-}
-
-export function resolveModelDisplayName(
-	modelId: string,
-	knownModels?: KnownModels,
-	fallbackName?: string,
-): string {
-	const modelInfo = resolveKnownModelInfo(modelId, knownModels);
-	if (modelInfo?.name) return modelInfo.name;
-
-	if (fallbackName) return fallbackName;
-	return modelId.includes("/")
-		? (modelId.split("/").pop() ?? modelId)
-		: modelId;
-}

apps/cli/src/tui/components/status-bar.test.ts

@@ -3,8 +3,6 @@ import {
 	createContextBar,
 	formatStatusBarUsageText,
 	resolveContextBarFilledForeground,
-	resolveModelDisplayName,
-	resolveModelMaxInputTokens,
 } from "./status-bar";
 
 vi.mock("@opentui/react", () => ({
@@ -59,7 +57,7 @@ describe("formatStatusBarUsageText", () => {
 				totalCost: 0.123,
 				showCost: true,
 			}),
-		).toBe("(12,345) $0.12");
+		).toBe("(12,345 tokens) $0.12");
 	});
 
 	it("omits cost when usage cost is hidden", () => {
@@ -69,34 +67,6 @@ describe("formatStatusBarUsageText", () => {
 				totalCost: 0.123,
 				showCost: false,
 			}),
-		).toBe("(12,345)");
-	});
-});
-
-describe("model display helpers", () => {
-	it("resolves status-bar model names by model slug when provider prefixes differ", () => {
-		expect(
-			resolveModelDisplayName({
-				modelId: "zai/glm-5.2",
-				knownModels: {
-					"z-ai/glm-5.2": { id: "z-ai/glm-5.2", name: "GLM-5.2" },
-				},
-			}),
-		).toBe("GLM-5.2");
-	});
-
-	it("resolves max input tokens by model slug when provider prefixes differ", () => {
-		expect(
-			resolveModelMaxInputTokens({
-				modelId: "zai/glm-5.2",
-				knownModels: {
-					"z-ai/glm-5.2": {
-						id: "z-ai/glm-5.2",
-						name: "GLM-5.2",
-						maxInputTokens: 262_144,
-					},
-				},
-			}),
-		).toBe(262_144);
+		).toBe("(12,345 tokens)");
 	});
 });

apps/cli/src/tui/components/status-bar.tsx

@@ -11,11 +11,6 @@ import {
 	getSuccessColor,
 } from "../palette";
 import { HOME_VIEW_MAX_WIDTH } from "../types";
-import {
-	type KnownModels,
-	resolveModelDisplayName as resolveKnownModelDisplayName,
-	resolveKnownModelInfo,
-} from "./model-selector/model-display-name";
 
 export function createContextBar(
 	used: number,
@@ -56,18 +51,36 @@ export function formatStatusBarUsageText(input: {
 	totalCost: number;
 	showCost: boolean;
 }): string {
-	const tokens = `(${input.totalTokens.toLocaleString()})`;
+	const tokens = `(${input.totalTokens.toLocaleString()} tokens)`;
 	if (!input.showCost) return tokens;
 	return `${tokens} ${formatCost(input.totalCost)}`;
 }
 
+// knownModels keys are bare IDs ("claude-sonnet-4-6") but config.modelId
+// may include a provider prefix ("anthropic/claude-sonnet-4-6"), so we
+// try the full ID first, then strip the prefix and retry.
+function lookupModelInfo(
+	modelId: string,
+	knownModels?: Record<string, unknown>,
+): { name?: string } | undefined {
+	if (!knownModels) return undefined;
+	const candidates = [modelId, modelId.split("/").pop()];
+	for (const key of candidates) {
+		if (!key) continue;
+		const hit = knownModels[key] as { name?: string } | undefined;
+		if (hit) return hit;
+	}
+	return undefined;
+}
+
 export function resolveModelDisplayName(config: {
 	modelId: string;
-	knownModels?: KnownModels;
+	knownModels?: Record<string, unknown>;
 	thinking?: boolean;
 	reasoningEffort?: string;
 }): string {
-	const name = resolveKnownModelDisplayName(config.modelId, config.knownModels);
+	const info = lookupModelInfo(config.modelId, config.knownModels);
+	const name = info?.name ?? config.modelId.split("/").pop() ?? config.modelId;
 	if (config.thinking && config.reasoningEffort) {
 		return `${name} (${config.reasoningEffort})`;
 	}
@@ -76,9 +89,12 @@ export function resolveModelDisplayName(config: {
 
 export function resolveModelMaxInputTokens(config: {
 	modelId: string;
-	knownModels?: KnownModels;
+	knownModels?: Record<string, unknown>;
 }): number | undefined {
-	const info = resolveKnownModelInfo(config.modelId, config.knownModels) ?? {};
+	const info = (lookupModelInfo(config.modelId, config.knownModels) ?? {}) as {
+		maxInputTokens?: number;
+		contextWindow?: number;
+	};
 	if (typeof info.maxInputTokens === "number" && info.maxInputTokens > 0) {
 		return info.maxInputTokens;
 	}

apps/cli/src/tui/hooks/use-model-selector.tsx

@@ -299,7 +299,7 @@ export function useModelSelector(opts: {
 								{...ctx}
 								currentModel={config.modelId}
 								currentProviderName={providerDisplayName}
-								knownModels={config.knownModels}
+								knownModels={config.knownModels as Record<string, unknown>}
 								loadEntries={async () =>
 									buildClineModelEntries(await fetchClineRecommendedModels())
 								}

apps/cli/src/tui/views/onboarding/controller.ts

@@ -25,7 +25,6 @@ import {
 	type ClineModelPickerEntry,
 	useClineRecommendedModels,
 } from "../../components/model-selector/cline-model-picker";
-import type { KnownModels } from "../../components/model-selector/model-display-name";
 import {
 	type SearchableItem,
 	useSearchableList,
@@ -195,7 +194,7 @@ export function useOnboardingController(props: OnboardingControllerProps) {
 		Set<string>
 	>(new Set());
 	const [clineKnownModels, setClineKnownModels] = useState<
-		KnownModels | undefined
+		Record<string, unknown> | undefined
 	>(undefined);
 
 	useEffect(() => {

apps/cli/src/tui/views/onboarding/screens.tsx

@@ -8,7 +8,6 @@ import {
 	ClineModelPicker,
 	type ClineModelPickerEntry,
 } from "../../components/model-selector/cline-model-picker";
-import type { KnownModels } from "../../components/model-selector/model-display-name";
 import {
 	type SearchableItem,
 	SearchableList,
@@ -434,7 +433,7 @@ export function OnboardingProviderPickerScreen(props: {
 
 export function OnboardingClineModelScreen(props: {
 	clineEntries: ClineModelPickerEntry[];
-	clineKnownModels: KnownModels | undefined;
+	clineKnownModels: Record<string, unknown> | undefined;
 	clineModelSelected: number;
 	compact: boolean;
 	contentWidth: number;

apps/cli/src/utils/cline-pass-errors.test.ts

@@ -1,7 +1,9 @@
 import { describe, expect, it } from "vitest";
 import {
 	formatCliErrorMessage,
+	getClineOrgIndividualInferenceSubscriptionMessage,
 	getClinePassSubscriptionUrl,
+	isClineOrgIndividualInferenceSubscriptionErrorMessage,
 	isClinePassSubscriptionError,
 } from "./cline-pass-errors";
 
@@ -20,7 +22,23 @@ describe("cline-pass-errors", () => {
 
 	it("formats the ClinePass subscription URL", () => {
 		expect(getClinePassSubscriptionUrl()).toBe(
-			"https://app.cline.bot/dashboard/subscription/",
+			"https://app.cline.bot/dashboard/subscription?personal=true",
 		);
 	});
+
+	it("recognizes and formats organization account individual subscription errors", () => {
+		const raw =
+			"403 Error 403: organization accounts cannot use individual model inference subscriptions";
+		const formatted = getClineOrgIndividualInferenceSubscriptionMessage();
+
+		expect(isClineOrgIndividualInferenceSubscriptionErrorMessage(raw)).toBe(
+			true,
+		);
+		expect(
+			isClineOrgIndividualInferenceSubscriptionErrorMessage(
+				new Error(formatted),
+			),
+		).toBe(true);
+		expect(formatCliErrorMessage(new Error(raw))).toBe(formatted);
+	});
 });

apps/cli/src/utils/cline-pass-errors.ts

@@ -1,10 +1,16 @@
 import {
+	getClineOrgIndividualInferenceSubscriptionMessage,
 	getClinePassSubscriptionUrl,
 	isClineNotSubscribedError,
 	isClineNotSubscribedMessage,
+	isClineOrgIndividualInferenceSubscriptionError,
+	isClineOrgIndividualInferenceSubscriptionMessage,
 } from "@cline/core";
 
-export { getClinePassSubscriptionUrl };
+export {
+	getClineOrgIndividualInferenceSubscriptionMessage,
+	getClinePassSubscriptionUrl,
+};
 
 function isFormattedClinePassSubscriptionMessage(message: string): boolean {
 	const normalized = message.trim().toLowerCase();
@@ -32,7 +38,30 @@ export function isClinePassSubscriptionError(error: unknown): boolean {
 	);
 }
 
+export function isClineOrgIndividualInferenceSubscriptionErrorMessage(
+	error: unknown,
+): boolean {
+	if (isClineOrgIndividualInferenceSubscriptionError(error)) {
+		return true;
+	}
+	if (error instanceof Error) {
+		return (
+			error.name === "ClineOrgIndividualInferenceSubscriptionError" ||
+			isClineOrgIndividualInferenceSubscriptionMessage(error.message) ||
+			error.message === getClineOrgIndividualInferenceSubscriptionMessage()
+		);
+	}
+	return (
+		typeof error === "string" &&
+		(isClineOrgIndividualInferenceSubscriptionMessage(error) ||
+			error === getClineOrgIndividualInferenceSubscriptionMessage())
+	);
+}
+
 export function formatCliErrorMessage(error: unknown): string {
+	if (isClineOrgIndividualInferenceSubscriptionErrorMessage(error)) {
+		return getClineOrgIndividualInferenceSubscriptionMessage();
+	}
 	if (error instanceof Error) {
 		return error.message;
 	}

apps/cli/src/utils/free-model-cost.test.ts

@@ -0,0 +1,162 @@
+import type { AgentEvent } from "@cline/core";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import {
+	clearClineFreeModelCostCache,
+	shouldZeroClineFreeModelCost,
+	zeroCliAgentEventCost,
+	zeroCliUsageCost,
+} from "./free-model-cost";
+
+afterEach(() => {
+	clearClineFreeModelCostCache();
+	vi.unstubAllGlobals();
+});
+
+describe("shouldZeroClineFreeModelCost", () => {
+	it("uses the Cline free model list", async () => {
+		const fetchMock = vi.fn(
+			async (_input: Parameters<typeof fetch>[0], _init?: RequestInit) => {
+				return new Response(
+					JSON.stringify({
+						free: [{ id: "deepseek/deepseek-v4-flash" }],
+					}),
+					{ status: 200, headers: { "content-type": "application/json" } },
+				);
+			},
+		);
+		vi.stubGlobal("fetch", fetchMock);
+
+		await expect(
+			shouldZeroClineFreeModelCost({
+				providerId: "cline",
+				modelId: "deepseek/deepseek-v4-flash",
+				baseUrl: "https://cline.test/api/v1",
+			}),
+		).resolves.toBe(true);
+
+		expect(fetchMock.mock.calls[0]?.[0]).toBe(
+			"https://cline.test/api/v1/ai/cline/recommended-models",
+		);
+	});
+
+	it("does not zero non-Cline providers", async () => {
+		const fetchMock = vi.fn();
+		vi.stubGlobal("fetch", fetchMock);
+
+		await expect(
+			shouldZeroClineFreeModelCost({
+				providerId: "openrouter",
+				modelId: "deepseek/deepseek-v4-flash",
+				baseUrl: "https://cline.test/api/v1",
+			}),
+		).resolves.toBe(false);
+		expect(fetchMock).not.toHaveBeenCalled();
+	});
+
+	it("does not match a paid model by only the final path segment", async () => {
+		vi.stubGlobal(
+			"fetch",
+			vi.fn(async () => {
+				return new Response(
+					JSON.stringify({
+						free: [{ id: "deepseek/deepseek-v4-flash" }],
+					}),
+					{ status: 200, headers: { "content-type": "application/json" } },
+				);
+			}),
+		);
+
+		await expect(
+			shouldZeroClineFreeModelCost({
+				providerId: "cline",
+				modelId: "acme/deepseek-v4-flash",
+				baseUrl: "https://cline.test/api/v1",
+			}),
+		).resolves.toBe(false);
+	});
+
+	it("retries after a failed free model list fetch", async () => {
+		const fetchMock = vi
+			.fn()
+			.mockResolvedValueOnce(new Response("unavailable", { status: 503 }))
+			.mockResolvedValueOnce(
+				new Response(
+					JSON.stringify({
+						free: [{ id: "deepseek/deepseek-v4-flash" }],
+					}),
+					{ status: 200, headers: { "content-type": "application/json" } },
+				),
+			);
+		vi.stubGlobal("fetch", fetchMock);
+
+		await expect(
+			shouldZeroClineFreeModelCost({
+				providerId: "cline",
+				modelId: "deepseek/deepseek-v4-flash",
+				baseUrl: "https://cline.test/api/v1",
+			}),
+		).resolves.toBe(false);
+		await expect(
+			shouldZeroClineFreeModelCost({
+				providerId: "cline",
+				modelId: "deepseek/deepseek-v4-flash",
+				baseUrl: "https://cline.test/api/v1",
+			}),
+		).resolves.toBe(true);
+		expect(fetchMock).toHaveBeenCalledTimes(2);
+	});
+});
+
+describe("zeroCliUsageCost", () => {
+	it("zeros total cost while preserving token usage", () => {
+		expect(
+			zeroCliUsageCost(
+				{
+					inputTokens: 10,
+					outputTokens: 5,
+					totalCost: 0.001,
+				},
+				true,
+			),
+		).toEqual({
+			inputTokens: 10,
+			outputTokens: 5,
+			totalCost: 0,
+		});
+	});
+});
+
+describe("zeroCliAgentEventCost", () => {
+	it("zeros usage event cost fields", () => {
+		const event = {
+			type: "usage",
+			inputTokens: 10,
+			outputTokens: 5,
+			cost: 0.001,
+			totalCost: 0.001,
+		} as AgentEvent;
+
+		expect(zeroCliAgentEventCost(event, true)).toMatchObject({
+			cost: 0,
+			totalCost: 0,
+		});
+	});
+
+	it("zeros done event usage cost", () => {
+		const event = {
+			type: "done",
+			reason: "completed",
+			text: "ok",
+			iterations: 1,
+			usage: {
+				inputTokens: 10,
+				outputTokens: 5,
+				totalCost: 0.001,
+			},
+		} as AgentEvent;
+
+		expect(zeroCliAgentEventCost(event, true)).toMatchObject({
+			usage: { totalCost: 0 },
+		});
+	});
+});

apps/cli/src/utils/free-model-cost.ts

@@ -0,0 +1,123 @@
+import type { AgentEvent } from "@cline/core";
+import { getClineEnvironmentConfig } from "@cline/shared";
+import type { Config } from "./types";
+
+const CLINE_RECOMMENDED_MODELS_TIMEOUT_MS = 5_000;
+const freeModelIdsByBaseUrl = new Map<
+	string,
+	Promise<readonly string[] | undefined>
+>();
+
+function normalizeModelId(modelId: string | undefined): string {
+	return modelId?.trim().toLowerCase() ?? "";
+}
+
+function modelIdsMatch(selectedModelId: string, freeModelId: string): boolean {
+	const selected = normalizeModelId(selectedModelId);
+	const free = normalizeModelId(freeModelId);
+	if (!selected || !free) return false;
+	return selected === free;
+}
+
+function resolveClineRecommendedModelsUrl(baseUrl: string): string {
+	const normalizedBaseUrl = baseUrl.trim().replace(/\/+$/, "");
+	const apiBaseUrl = normalizedBaseUrl.endsWith("/api/v1")
+		? normalizedBaseUrl.slice(0, -"/api/v1".length)
+		: normalizedBaseUrl;
+	return `${apiBaseUrl}/api/v1/ai/cline/recommended-models`;
+}
+
+async function fetchClineFreeModelIds(
+	baseUrl: string,
+): Promise<readonly string[] | undefined> {
+	const controller = new AbortController();
+	const timeout = setTimeout(
+		() => controller.abort(),
+		CLINE_RECOMMENDED_MODELS_TIMEOUT_MS,
+	);
+	try {
+		const response = await fetch(resolveClineRecommendedModelsUrl(baseUrl), {
+			signal: controller.signal,
+		});
+		if (!response.ok) return undefined;
+		const json = (await response.json()) as { free?: unknown };
+		return Array.isArray(json.free)
+			? json.free
+					.map((model) =>
+						model && typeof model === "object"
+							? (model as Record<string, unknown>).id
+							: undefined,
+					)
+					.filter((id): id is string => typeof id === "string" && id.length > 0)
+			: [];
+	} catch {
+		return undefined;
+	} finally {
+		clearTimeout(timeout);
+	}
+}
+
+function getClineFreeModelIds(baseUrl: string): Promise<readonly string[]> {
+	const cacheKey = baseUrl.trim();
+	let cached = freeModelIdsByBaseUrl.get(cacheKey);
+	if (!cached) {
+		cached = fetchClineFreeModelIds(cacheKey).then((ids) => {
+			if (!ids) freeModelIdsByBaseUrl.delete(cacheKey);
+			return ids;
+		});
+		freeModelIdsByBaseUrl.set(cacheKey, cached);
+	}
+	return cached.then((ids) => ids ?? []);
+}
+
+export async function shouldZeroClineFreeModelCost(
+	config: Pick<Config, "providerId" | "modelId" | "baseUrl">,
+): Promise<boolean> {
+	if (config.providerId !== "cline") return false;
+	const modelId = normalizeModelId(config.modelId);
+	if (!modelId) return false;
+
+	const baseUrl =
+		config.baseUrl?.trim() || getClineEnvironmentConfig().apiBaseUrl;
+	const freeModelIds = await getClineFreeModelIds(baseUrl);
+	return freeModelIds.some((freeModelId) =>
+		modelIdsMatch(modelId, freeModelId),
+	);
+}
+
+export function zeroCliUsageCost<T extends { totalCost?: number } | undefined>(
+	usage: T,
+	shouldZeroCost: boolean,
+): T {
+	if (
+		!shouldZeroCost ||
+		!usage ||
+		typeof usage.totalCost !== "number" ||
+		usage.totalCost === 0
+	) {
+		return usage;
+	}
+	return { ...usage, totalCost: 0 } as T;
+}
+
+export function zeroCliAgentEventCost(
+	event: AgentEvent,
+	shouldZeroCost: boolean,
+): AgentEvent {
+	if (!shouldZeroCost) return event;
+	if (event.type === "done" && event.usage) {
+		return {
+			...event,
+			usage: zeroCliUsageCost(event.usage, true),
+		};
+	}
+	if (event.type !== "usage") return event;
+	const next = { ...event } as Record<string, unknown>;
+	if (typeof next.cost === "number") next.cost = 0;
+	if (typeof next.totalCost === "number") next.totalCost = 0;
+	return next as unknown as AgentEvent;
+}
+
+export function clearClineFreeModelCostCache(): void {
+	freeModelIdsByBaseUrl.clear();
+}

apps/cli/src/wizards/connect/platforms.ts

@@ -1,325 +1,16 @@
-export interface PlatformDef {
-	id: string;
-	name: string;
-	type: "polling" | "webhook" | "hybrid";
-	hint: string;
-	fields: FieldDef[];
-	security?: SecurityDef;
-}
+import {
+	CONNECTOR_PLATFORMS,
+	shouldIncludeConnectorField,
+} from "@cline/shared";
 
-export interface FieldDef {
-	flag: string;
-	label: string;
-	placeholder?: string;
-	required?: boolean;
-	help?: string[];
-	initialValue?: string;
-	options?: Array<{ value: string; label: string; hint?: string }>;
-	includeWhen?: FieldCondition;
-}
+export type {
+	ConnectorFieldCondition as FieldCondition,
+	ConnectorFieldDef as FieldDef,
+	ConnectorPlatformDef as PlatformDef,
+	ConnectorSecurityDef as SecurityDef,
+	ConnectorSecurityFieldDef as SecurityFieldDef,
+} from "@cline/shared";
+export { CONNECTOR_PLATFORMS, shouldIncludeConnectorField };
 
-export type FieldCondition = {
-	flag: string;
-	equals?: string;
-	notEquals?: string;
-};
-
-export interface SecurityFieldDef {
-	key: string;
-	label: string;
-	placeholder?: string;
-	help?: string[];
-	requiredMessage: string;
-	validate?: (value: string) => string | undefined;
-}
-
-export interface SecurityDef {
-	prompt: string;
-	fields: SecurityFieldDef[];
-	buildArgs: (values: Record<string, string>) => string[];
-}
-
-export function shouldIncludeField(
-	field: FieldDef,
-	values: Record<string, string>,
-): boolean {
-	const condition = field.includeWhen;
-	if (!condition) {
-		return true;
-	}
-	const value = values[condition.flag] ?? "";
-	if (condition.equals !== undefined && value !== condition.equals) {
-		return false;
-	}
-	if (condition.notEquals !== undefined && value === condition.notEquals) {
-		return false;
-	}
-	return true;
-}
-
-function validateTelegramUserId(value: string): string | undefined {
-	return /^\d+$/.test(value)
-		? undefined
-		: "Telegram user ID must contain digits only";
-}
-
-function validateSlackTeamId(value: string): string | undefined {
-	return /^T[A-Z0-9]+$/.test(value)
-		? undefined
-		: "Slack workspace ID must start with T and contain uppercase letters or digits only";
-}
-
-function validateSlackUserId(value: string): string | undefined {
-	return /^[UW][A-Z0-9]+$/.test(value)
-		? undefined
-		: "Slack member ID must start with U or W and contain uppercase letters or digits only";
-}
-
-export const PLATFORMS: PlatformDef[] = [
-	{
-		id: "telegram",
-		name: "Telegram",
-		type: "polling",
-		hint: "Easiest to set up. No public URL needed.",
-		fields: [
-			{
-				flag: "-k",
-				label: "Bot token",
-				placeholder: "7123456789:AAH...",
-				required: true,
-				help: [
-					"Open Telegram and start a chat with @BotFather",
-					"Send /newbot and follow the prompts",
-					"BotFather gives you this after creating the bot",
-					"It looks like 7123456789:AAHxxx...",
-				],
-			},
-		],
-		security: {
-			prompt:
-				"By default, anyone who finds your bot can message it and run tasks on your machine. Restrict access to your Telegram user ID?",
-			fields: [
-				{
-					key: "userId",
-					label: "Your Telegram user ID",
-					placeholder: "123456789",
-					help: [
-						"Message @userinfobot on Telegram",
-						"It will reply with your numeric user ID",
-					],
-					requiredMessage: "User ID is required to restrict access",
-					validate: validateTelegramUserId,
-				},
-			],
-			buildArgs: ({ userId }) => ["--allowed-user-id", userId ?? ""],
-		},
-	},
-	{
-		id: "slack",
-		name: "Slack",
-		type: "hybrid",
-		hint: "Public URL for webhook mode; leave blank for socket mode.",
-		fields: [
-			{
-				flag: "--bot-token",
-				label: "Bot token",
-				placeholder: "xoxb-...",
-				required: true,
-				help: [
-					"Go to api.slack.com/apps and create a new app",
-					"Add Bot Token Scopes: chat:write, app_mentions:read, channels:history, channels:read, im:history, im:read, im:write, users:read",
-					"Install to workspace and copy the Bot Token",
-				],
-			},
-			{
-				flag: "--base-url",
-				label: "Public base URL",
-				placeholder: "leave blank for socket mode",
-				help: [
-					"Enter a publicly accessible URL for webhook mode",
-					"Leave blank to use Slack socket mode instead",
-				],
-			},
-			{
-				flag: "--signing-secret",
-				label: "Signing secret",
-				required: true,
-				help: ["Found in your app's Basic Information page"],
-				includeWhen: { flag: "--base-url", notEquals: "" },
-			},
-			{
-				flag: "--app-token",
-				label: "App-level token",
-				placeholder: "xapp-...",
-				required: true,
-				help: [
-					"Enable Socket Mode in the Slack app",
-					"Generate an app-level token with the connections:write scope",
-				],
-				includeWhen: { flag: "--base-url", equals: "" },
-			},
-		],
-		security: {
-			prompt: "Restrict which Slack users can interact with the bot?",
-			fields: [
-				{
-					key: "teamId",
-					label: "Allowed Slack workspace ID",
-					placeholder: "T01ABC123",
-					help: [
-						"Open your Slack workspace URL in a browser",
-						"The workspace ID is the segment after /client/, for example T01ABC123",
-					],
-					requiredMessage: "Workspace ID is required to restrict access",
-					validate: validateSlackTeamId,
-				},
-				{
-					key: "userId",
-					label: "Allowed Slack member ID",
-					placeholder: "U01ABC123",
-					help: [
-						"Click a user's name in Slack, then View full profile",
-						"Click ... and Copy member ID",
-					],
-					requiredMessage: "Member ID is required to restrict access",
-					validate: validateSlackUserId,
-				},
-			],
-			buildArgs: ({ teamId, userId }) => [
-				"--hook-command",
-				`jq -r ".payload.actor.participantKey" | grep -qx "slack:team:${teamId}:user:${userId}" && echo '{"action":"allow"}' || echo '{"action":"deny"}'`,
-			],
-		},
-	},
-	{
-		id: "discord",
-		name: "Discord",
-		type: "webhook",
-		hint: "Requires a Discord app and public URL.",
-		fields: [
-			{
-				flag: "--application-id",
-				label: "Application ID",
-				required: true,
-				help: [
-					"Go to discord.com/developers/applications",
-					"Create a new app, copy the Application ID",
-				],
-			},
-			{
-				flag: "--bot-token",
-				label: "Bot token",
-				required: true,
-				help: ["Go to Bot section, create a bot, copy the token"],
-			},
-			{
-				flag: "--public-key",
-				label: "Public key",
-				required: true,
-				help: ["Found in General Information of your app"],
-			},
-			{
-				flag: "--base-url",
-				label: "Public base URL",
-				placeholder: "https://example.com",
-				required: true,
-				help: [
-					"Base URL for the connector",
-					"For Discord, set the Interactions Endpoint URL to <base-url>/api/webhooks/discord",
-				],
-			},
-		],
-	},
-	{
-		id: "whatsapp",
-		name: "WhatsApp",
-		type: "webhook",
-		hint: "Requires Meta developer account and public URL.",
-		fields: [
-			{
-				flag: "--phone-number-id",
-				label: "Phone number ID",
-				required: true,
-				help: ["From your WhatsApp Business account in Meta Developer portal"],
-			},
-			{
-				flag: "--access-token",
-				label: "Access token",
-				required: true,
-				help: ["Generate a permanent token in Meta Developer portal"],
-			},
-			{
-				flag: "--app-secret",
-				label: "App secret",
-				required: true,
-				help: ["Found in App Settings > Basic"],
-			},
-			{
-				flag: "--verify-token",
-				label: "Webhook verify token",
-				placeholder: "my-verify-token",
-				required: true,
-				help: ["Any string you choose, used to verify webhook setup"],
-			},
-			{
-				flag: "--base-url",
-				label: "Public base URL",
-				placeholder: "https://example.com",
-				required: true,
-			},
-		],
-	},
-	{
-		id: "gchat",
-		name: "Google Chat",
-		type: "webhook",
-		hint: "Requires Google Cloud project and public URL.",
-		fields: [
-			{
-				flag: "--credentials-json",
-				label: "Service account credentials JSON",
-				required: true,
-				help: [
-					"Create a service account in Google Cloud Console",
-					"Download the credentials JSON file",
-					"Paste the JSON content here",
-				],
-			},
-			{
-				flag: "--base-url",
-				label: "Public base URL",
-				placeholder: "https://example.com",
-				required: true,
-			},
-		],
-	},
-	{
-		id: "linear",
-		name: "Linear",
-		type: "webhook",
-		hint: "React to Linear issues and comments.",
-		fields: [
-			{
-				flag: "--api-key",
-				label: "API key",
-				required: true,
-				help: ["Go to Linear Settings > API > Personal API keys"],
-			},
-			{
-				flag: "--webhook-secret",
-				label: "Webhook signing secret",
-				required: true,
-				help: [
-					"Go to Settings > API > Webhooks, create one",
-					"Copy the signing secret",
-				],
-			},
-			{
-				flag: "--base-url",
-				label: "Public base URL",
-				placeholder: "https://example.com",
-				required: true,
-			},
-		],
-	},
-];
+export const PLATFORMS = CONNECTOR_PLATFORMS;
+export const shouldIncludeField = shouldIncludeConnectorField;

apps/cli/src/wizards/mcp/settings.test.ts

@@ -57,6 +57,17 @@ describe("MCP wizard settings", () => {
 		expect(Object.keys(parsed.mcpServers ?? {})).toEqual(["added"]);
 	});
 
+	it("creates the settings file when adding a server to a missing path", async () => {
+		const settingsPath = await useTempSettingsPath();
+
+		addServer("added", { type: "stdio", command: "npx", args: ["server"] });
+
+		const parsed = JSON.parse(await readFile(settingsPath, "utf8")) as {
+			mcpServers?: Record<string, unknown>;
+		};
+		expect(Object.keys(parsed.mcpServers ?? {})).toEqual(["added"]);
+	});
+
 	it("parses quoted stdio command arguments", () => {
 		expect(
 			parseStdioCommand('npx -y "@scope/server name" --root "my dir"'),

apps/cli/src/wizards/mcp/settings.ts

@@ -1,8 +1,9 @@
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { dirname } from "node:path";
+import { existsSync, readFileSync } from "node:fs";
 import {
 	type McpServerOAuthState,
+	McpSettingsUpdateSkippedError,
 	resolveDefaultMcpSettingsPath,
+	updateMcpSettingsFileSync,
 } from "@cline/core";
 
 export interface McpServerEntry {
@@ -56,28 +57,6 @@ export function loadServers(): McpServerEntry[] {
 	}
 }
 
-function readRawSettings(): Record<string, unknown> {
-	const path = getSettingsPath();
-	if (!existsSync(path)) return {};
-	try {
-		const raw = readFileSync(path, "utf-8");
-		const parsed = JSON.parse(raw);
-		return parsed && typeof parsed === "object" && !Array.isArray(parsed)
-			? (parsed as Record<string, unknown>)
-			: {};
-	} catch {
-		return {};
-	}
-}
-
-function readRawServers(): Record<string, unknown> {
-	const settings = readRawSettings();
-	const servers = settings.mcpServers;
-	return servers && typeof servers === "object" && !Array.isArray(servers)
-		? { ...(servers as Record<string, unknown>) }
-		: {};
-}
-
 function getOwnServerRecord(
 	servers: Record<string, unknown>,
 	name: string,
@@ -92,62 +71,85 @@ function getOwnServerRecord(
 	return value as Record<string, unknown>;
 }
 
-function writeServers(servers: Record<string, unknown>): void {
-	const path = getSettingsPath();
-	const settings = readRawSettings();
-	mkdirSync(dirname(path), { recursive: true });
-	writeFileSync(
-		path,
-		`${JSON.stringify({ ...settings, mcpServers: servers }, null, 2)}\n`,
-	);
+/**
+ * Mutate the MCP settings file through @cline/core's locked read-update-write
+ * helper. The mutator must be synchronous and pure; the helper may call it more
+ * than once to verify deterministic output. Throw McpSettingsUpdateSkippedError
+ * for normal no-op cases instead of returning a boolean that callers can ignore.
+ */
+function mutateServers(mutate: (servers: Record<string, unknown>) => void): void {
+	updateMcpSettingsFileSync(getSettingsPath(), (settings) => {
+		const serversValue = settings.mcpServers;
+		const servers = serversValue && typeof serversValue === "object" && !Array.isArray(serversValue)
+			? { ...(serversValue as Record<string, unknown>) }
+			: {};
+		mutate(servers);
+		settings.mcpServers = servers;
+	});
 }
 
 export function addServer(name: string, transport: McpTransport): void {
-	const servers = readRawServers();
-	servers[name] = { transport };
-	writeServers(servers);
+	mutateServers((servers) => {
+		servers[name] = { transport };
+	});
 }
 
 export function removeServer(name: string): boolean {
-	const servers = readRawServers();
-	if (!(name in servers)) return false;
-	delete servers[name];
-	writeServers(servers);
-	return true;
+	try {
+		mutateServers((servers) => {
+			if (!(name in servers)) {
+				throw new McpSettingsUpdateSkippedError(`MCP server not found: ${name}`);
+			}
+			delete servers[name];
+		});
+		return true;
+	} catch (error) {
+		if (error instanceof McpSettingsUpdateSkippedError) {
+			return false;
+		}
+		throw error;
+	}
 }
 
 export function updateServer(name: string, transport: McpTransport): void {
-	const servers = readRawServers();
-	const existing =
-		servers[name] && typeof servers[name] === "object"
-			? (servers[name] as Record<string, unknown>)
-			: {};
-	servers[name] = { ...existing, transport };
-	writeServers(servers);
+	mutateServers((servers) => {
+		const existing =
+			servers[name] && typeof servers[name] === "object"
+				? (servers[name] as Record<string, unknown>)
+				: {};
+		servers[name] = { ...existing, transport };
+	});
 }
 
 export function clearServerOAuth(name: string): void {
-	const servers = readRawServers();
-	const existing = getOwnServerRecord(servers, name);
-	if (!existing) {
-		return;
+	try {
+		mutateServers((servers) => {
+			const existing = getOwnServerRecord(servers, name);
+			if (!existing) {
+				throw new McpSettingsUpdateSkippedError(`MCP server not found: ${name}`);
+			}
+			delete existing.oauth;
+			servers[name] = existing;
+		});
+	} catch (error) {
+		if (error instanceof McpSettingsUpdateSkippedError) {
+			return;
+		}
+		throw error;
 	}
-	delete existing.oauth;
-	servers[name] = existing;
-	writeServers(servers);
 }
 
 export function toggleServer(name: string, disabled: boolean): void {
-	const servers = readRawServers();
-	const existing =
-		servers[name] && typeof servers[name] === "object"
-			? (servers[name] as Record<string, unknown>)
-			: {};
-	if (disabled) {
-		existing.disabled = true;
-	} else {
-		delete existing.disabled;
-	}
-	servers[name] = existing;
-	writeServers(servers);
+	mutateServers((servers) => {
+		const existing =
+			servers[name] && typeof servers[name] === "object"
+				? (servers[name] as Record<string, unknown>)
+				: {};
+		if (disabled) {
+			existing.disabled = true;
+		} else {
+			delete existing.disabled;
+		}
+		servers[name] = existing;
+	});
 }

apps/cline-hub/src/options.ts

@@ -1,3 +1,5 @@
+import { isIP } from "node:net";
+
 export interface ClineHubServerOptions {
 	host: string;
 	port: number;
@@ -47,6 +49,9 @@ function normalizePublicUrl(
 			`PUBLIC_URL must use http: or https:, got ${parsed.protocol}`,
 		);
 	}
+	if (shouldAddDashboardPortToPublicUrl(parsed, port)) {
+		parsed.port = String(port);
+	}
 	parsed.hash = "";
 	return parsed.toString().replace(/\/$/, "");
 }
@@ -85,12 +90,26 @@ export function resolveClineHubServerOptions(
 	};
 }
 
+function isDefaultProtocolPort(url: URL, port: number): boolean {
+	return (
+		(url.protocol === "http:" && port === 80) ||
+		(url.protocol === "https:" && port === 443)
+	);
+}
+
+function shouldAddDashboardPortToPublicUrl(url: URL, port: number): boolean {
+	if (url.port || isDefaultProtocolPort(url, port)) return false;
+	const hostname = url.hostname.replace(/^\[|\]$/g, "");
+	return hostname === "localhost" || isIP(hostname) !== 0;
+}
+
 export function buildInviteUrl(
 	publicUrl: string,
 	roomSecret: string | undefined,
 ): string {
-	if (!roomSecret) return publicUrl;
 	const url = new URL(publicUrl);
-	url.searchParams.set("roomSecret", roomSecret);
+	if (roomSecret) {
+		url.searchParams.set("roomSecret", roomSecret);
+	}
 	return url.toString();
 }

apps/cline-hub/src/server.ts

@@ -4,6 +4,7 @@ import {
 	handleToolApprovalResponse,
 	rejectOrphanedApprovals,
 } from "./server/approvals";
+import { isAuthorizedBrowserToDesktopRequest } from "./server/browser-auth";
 import {
 	browserConfig,
 	host,
@@ -14,7 +15,11 @@ import {
 	webviewDistDir,
 } from "./server/deps";
 import { handleDesktopCommand } from "./server/desktop-commands";
-import { createJsonResponse, WebviewAssets } from "./server/http";
+import {
+	createJsonResponse,
+	isWebviewRoute,
+	WebviewAssets,
+} from "./server/http";
 import {
 	attachHub,
 	detachHub,
@@ -53,17 +58,33 @@ export interface ClineHubDashboardServer {
 	stop: () => Promise<void>;
 }
 
+const PUBLIC_BROWSER_PATHS = new Set([
+	"/version",
+	"/health",
+	"/config.json",
+	"/api/marketplace/catalog",
+	"/icon.png",
+	"/icon.svg",
+	"/icon.ico",
+	"/32x32.png",
+	"/cline-logo-filled.svg",
+	"/favicon.svg",
+]);
+
+function isPublicStaticAssetPath(pathname: string): boolean {
+	return pathname.startsWith("/assets/") || PUBLIC_BROWSER_PATHS.has(pathname);
+}
+
+function isPublicBrowserRoute(_req: Request, url: URL): boolean {
+	return isWebviewRoute(url.pathname) || isPublicStaticAssetPath(url.pathname);
+}
+
 export async function startClineHubDashboardServer(): Promise<ClineHubDashboardServer> {
 	const ctx = new HubContext();
 	const assets = new WebviewAssets(webviewDistDir);
 	const syncClientsAndSessions = () => syncHubClientsAndSessions(ctx);
 	let stopped = false;
 
-	function isAuthorizedBrowserRequest(url: URL): boolean {
-		if (!roomSecret) return true;
-		return url.searchParams.get("roomSecret") === roomSecret;
-	}
-
 	await attachHub(ctx);
 	const healthInterval = setInterval(() => {
 		void (async () => {
@@ -77,6 +98,21 @@ export async function startClineHubDashboardServer(): Promise<ClineHubDashboardS
 		hostname: host,
 		async fetch(req, server) {
 			const url = new URL(req.url);
+			if (
+				!isAuthorizedBrowserToDesktopRequest(
+					req,
+					url,
+					{
+						bindHost: host,
+						port,
+						publicUrl,
+						roomSecret,
+					},
+					isPublicBrowserRoute,
+				)
+			) {
+				return createJsonResponse({ error: "unauthorized_browser" }, 403);
+			}
 			if (url.pathname === "/version") {
 				return createJsonResponse({ coreVersion: CORE_BUILD_VERSION });
 			}
@@ -85,9 +121,6 @@ export async function startClineHubDashboardServer(): Promise<ClineHubDashboardS
 				return createJsonResponse(hubStatusPayload(ctx));
 			}
 			if (url.pathname === "/browser") {
-				if (!isAuthorizedBrowserRequest(url)) {
-					return createJsonResponse({ error: "invalid_room_secret" }, 401);
-				}
 				const displayName = `Browser ${Math.random().toString(36).slice(2, 6)}`;
 				const data = {
 					socket: undefined as never,

apps/cline-hub/src/server/browser-auth.test.ts

@@ -0,0 +1,359 @@
+import { describe, expect, it } from "vitest";
+import {
+	allowedBrowserHosts,
+	allowedBrowserOrigins,
+	isAuthorizedBrowserRequest,
+	isAuthorizedBrowserToDesktopRequest,
+	requiresBrowserRequestAuth,
+} from "./browser-auth";
+
+const defaultOptions = {
+	bindHost: "127.0.0.1",
+	port: 8787,
+	publicUrl: "http://127.0.0.1:8787",
+};
+
+const publicRoute = (_req: Request, url: URL) => url.pathname === "/public";
+
+function browserRequest(
+	origin?: string,
+	init?: Omit<RequestInit, "headers"> & {
+		headers?: Record<string, string>;
+	},
+): Request {
+	return new Request("http://127.0.0.1:8787/browser", {
+		...init,
+		headers: {
+			host: "127.0.0.1:8787",
+			...(origin === undefined ? {} : { origin }),
+			...(init?.headers ?? {}),
+		},
+	});
+}
+
+describe("allowedBrowserOrigins", () => {
+	it("allows the configured public URL origin and local aliases for local binds", () => {
+		expect([...allowedBrowserOrigins(defaultOptions)].sort()).toEqual([
+			"http://127.0.0.1:8787",
+			"http://[::1]:8787",
+			"http://localhost:8787",
+		]);
+	});
+
+	it("uses the configured public URL scheme for local aliases", () => {
+		expect(
+			[
+				...allowedBrowserOrigins({
+					...defaultOptions,
+					publicUrl: "https://127.0.0.1:8787",
+				}),
+			].sort(),
+		).toEqual([
+			"https://127.0.0.1:8787",
+			"https://[::1]:8787",
+			"https://localhost:8787",
+		]);
+	});
+
+	it("omits default protocol ports for local alias origins", () => {
+		expect(
+			[
+				...allowedBrowserOrigins({
+					bindHost: "127.0.0.1",
+					port: 80,
+					publicUrl: "http://localhost",
+				}),
+			].sort(),
+		).toEqual(["http://127.0.0.1", "http://[::1]", "http://localhost"]);
+
+		expect(
+			[
+				...allowedBrowserOrigins({
+					bindHost: "127.0.0.1",
+					port: 443,
+					publicUrl: "https://localhost",
+				}),
+			].sort(),
+		).toEqual(["https://127.0.0.1", "https://[::1]", "https://localhost"]);
+	});
+
+	it("allows the configured public URL origin and explicit bind origin for non-local binds", () => {
+		expect(
+			[
+				...allowedBrowserOrigins({
+					bindHost: "0.0.0.0",
+					port: 8787,
+					publicUrl: "https://example.ngrok-free.app",
+					roomSecret: "secret",
+				}),
+			].sort(),
+		).toEqual(["https://0.0.0.0:8787", "https://example.ngrok-free.app"]);
+	});
+});
+
+describe("allowedBrowserHosts", () => {
+	it("allows the configured public URL host and local aliases for local binds", () => {
+		expect([...allowedBrowserHosts(defaultOptions)].sort()).toEqual([
+			"127.0.0.1:8787",
+			"[::1]:8787",
+			"localhost:8787",
+		]);
+	});
+
+	it("omits default protocol ports for local alias hosts", () => {
+		expect(
+			[
+				...allowedBrowserHosts({
+					bindHost: "127.0.0.1",
+					port: 80,
+					publicUrl: "http://localhost",
+				}),
+			].sort(),
+		).toEqual(["127.0.0.1", "[::1]", "localhost"]);
+
+		expect(
+			[
+				...allowedBrowserHosts({
+					bindHost: "127.0.0.1",
+					port: 443,
+					publicUrl: "https://localhost",
+				}),
+			].sort(),
+		).toEqual(["127.0.0.1", "[::1]", "localhost"]);
+	});
+
+	it("allows the configured public URL host and explicit bind host for non-local binds", () => {
+		expect(
+			[
+				...allowedBrowserHosts({
+					bindHost: "0.0.0.0",
+					port: 8787,
+					publicUrl: "https://example.ngrok-free.app",
+					roomSecret: "secret",
+				}),
+			].sort(),
+		).toEqual(["0.0.0.0:8787", "example.ngrok-free.app"]);
+	});
+});
+
+describe("requiresBrowserRequestAuth", () => {
+	it("does not require browser auth for public GET routes", () => {
+		expect(
+			requiresBrowserRequestAuth(
+				new Request("http://127.0.0.1:8787/public"),
+				new URL("http://127.0.0.1:8787/public"),
+				publicRoute,
+			),
+		).toBe(false);
+	});
+
+	it("requires browser auth for unknown paths even when they use GET", () => {
+		expect(
+			requiresBrowserRequestAuth(
+				new Request("http://127.0.0.1:8787/future-api"),
+				new URL("http://127.0.0.1:8787/future-api"),
+				publicRoute,
+			),
+		).toBe(true);
+	});
+
+	it("requires browser auth for privileged paths even when they use GET", () => {
+		expect(
+			requiresBrowserRequestAuth(
+				new Request("http://127.0.0.1:8787/browser"),
+				new URL("http://127.0.0.1:8787/browser"),
+				publicRoute,
+			),
+		).toBe(true);
+	});
+
+	it("requires browser auth for every WebSocket upgrade path", () => {
+		expect(
+			requiresBrowserRequestAuth(
+				new Request("http://127.0.0.1:8787/future-socket", {
+					headers: { upgrade: "websocket" },
+				}),
+				new URL("http://127.0.0.1:8787/future-socket"),
+				publicRoute,
+			),
+		).toBe(true);
+	});
+
+	it("requires browser auth for every unsafe HTTP method", () => {
+		expect(
+			requiresBrowserRequestAuth(
+				new Request("http://127.0.0.1:8787/future-api", { method: "POST" }),
+				new URL("http://127.0.0.1:8787/future-api"),
+				publicRoute,
+			),
+		).toBe(true);
+	});
+});
+
+describe("isAuthorizedBrowserRequest", () => {
+	it.each([
+		"http://127.0.0.1:8787",
+		"http://localhost:8787",
+		"http://[::1]:8787",
+	])("accepts local dashboard origin %s without a room secret", (origin) => {
+		expect(
+			isAuthorizedBrowserRequest(
+				browserRequest(origin),
+				new URL("http://127.0.0.1:8787/browser"),
+				defaultOptions,
+			),
+		).toBe(true);
+	});
+
+	it.each([
+		undefined,
+		"",
+		"null",
+		"not a url",
+		"http://evil.attacker.example.com",
+		"http://127.0.0.1:9999",
+		"https://127.0.0.1:8787",
+	])("rejects untrusted origin %s", (origin) => {
+		expect(
+			isAuthorizedBrowserRequest(
+				browserRequest(origin),
+				new URL("http://127.0.0.1:8787/browser"),
+				defaultOptions,
+			),
+		).toBe(false);
+	});
+
+	it.each([
+		undefined,
+		"",
+		"evil.attacker.example.com",
+		"127.0.0.1:9999",
+		"localhost:9999",
+	])("rejects untrusted host %s", (host) => {
+		expect(
+			isAuthorizedBrowserRequest(
+				browserRequest("http://127.0.0.1:8787", {
+					headers: host === undefined ? { host: "" } : { host },
+				}),
+				new URL("http://127.0.0.1:8787/browser"),
+				defaultOptions,
+			),
+		).toBe(false);
+	});
+
+	it("allows explicit wildcard bind host and origin when a room secret is configured", () => {
+		expect(
+			isAuthorizedBrowserRequest(
+				browserRequest("http://0.0.0.0:8787", {
+					headers: { host: "0.0.0.0:8787" },
+				}),
+				new URL("http://0.0.0.0:8787/browser?roomSecret=invite-123"),
+				{
+					bindHost: "0.0.0.0",
+					port: 8787,
+					publicUrl: "http://127.0.0.1:8787",
+					roomSecret: "invite-123",
+				},
+			),
+		).toBe(true);
+	});
+
+	it("requires trusted origin, trusted host, and room secret when a room secret is configured", () => {
+		const options = { ...defaultOptions, roomSecret: "invite-123" };
+
+		expect(
+			isAuthorizedBrowserRequest(
+				browserRequest("http://127.0.0.1:8787"),
+				new URL("http://127.0.0.1:8787/browser?roomSecret=invite-123"),
+				options,
+			),
+		).toBe(true);
+		expect(
+			isAuthorizedBrowserRequest(
+				browserRequest("http://127.0.0.1:8787"),
+				new URL("http://127.0.0.1:8787/browser"),
+				options,
+			),
+		).toBe(false);
+		expect(
+			isAuthorizedBrowserRequest(
+				browserRequest("http://evil.attacker.example.com"),
+				new URL("http://127.0.0.1:8787/browser?roomSecret=invite-123"),
+				options,
+			),
+		).toBe(false);
+		expect(
+			isAuthorizedBrowserRequest(
+				browserRequest("http://127.0.0.1:8787", {
+					headers: { host: "evil.attacker.example.com" },
+				}),
+				new URL("http://127.0.0.1:8787/browser?roomSecret=invite-123"),
+				options,
+			),
+		).toBe(false);
+	});
+});
+
+describe("isAuthorizedBrowserToDesktopRequest", () => {
+	it("allows safe public GET routes without an origin", () => {
+		expect(
+			isAuthorizedBrowserToDesktopRequest(
+				new Request("http://127.0.0.1:8787/public"),
+				new URL("http://127.0.0.1:8787/public"),
+				defaultOptions,
+				publicRoute,
+			),
+		).toBe(true);
+	});
+
+	it("rejects future WebSocket paths from untrusted origins by default", () => {
+		expect(
+			isAuthorizedBrowserToDesktopRequest(
+				new Request("http://127.0.0.1:8787/future-socket", {
+					headers: {
+						host: "127.0.0.1:8787",
+						origin: "http://evil.attacker.example.com",
+						upgrade: "websocket",
+					},
+				}),
+				new URL("http://127.0.0.1:8787/future-socket"),
+				defaultOptions,
+				publicRoute,
+			),
+		).toBe(false);
+	});
+
+	it("rejects future unsafe HTTP routes from untrusted origins by default", () => {
+		expect(
+			isAuthorizedBrowserToDesktopRequest(
+				new Request("http://127.0.0.1:8787/future-api", {
+					method: "POST",
+					headers: {
+						host: "127.0.0.1:8787",
+						origin: "http://evil.attacker.example.com",
+					},
+				}),
+				new URL("http://127.0.0.1:8787/future-api"),
+				defaultOptions,
+				publicRoute,
+			),
+		).toBe(false);
+	});
+
+	it("allows future unsafe HTTP routes from trusted origins", () => {
+		expect(
+			isAuthorizedBrowserToDesktopRequest(
+				new Request("http://127.0.0.1:8787/future-api", {
+					method: "POST",
+					headers: {
+						host: "127.0.0.1:8787",
+						origin: "http://127.0.0.1:8787",
+					},
+				}),
+				new URL("http://127.0.0.1:8787/future-api"),
+				defaultOptions,
+				publicRoute,
+			),
+		).toBe(true);
+	});
+});

apps/cline-hub/src/server/browser-auth.ts

@@ -0,0 +1,134 @@
+import { isNonLocalBindHost } from "../options";
+
+export interface BrowserRequestAuthOptions {
+	bindHost: string;
+	port: number;
+	publicUrl: string;
+	roomSecret?: string;
+}
+
+const SAFE_HTTP_METHODS = new Set(["GET", "HEAD", "OPTIONS"]);
+
+export type PublicBrowserRoutePredicate = (req: Request, url: URL) => boolean;
+
+function isWebSocketUpgrade(req: Request): boolean {
+	return req.headers.get("upgrade")?.toLowerCase() === "websocket";
+}
+
+function parseOrigin(value: string | null): string | undefined {
+	const origin = parseHeader(value);
+	try {
+		return new URL(origin ?? "").origin;
+	} catch {
+		return undefined;
+	}
+}
+
+function parseHeader(value: string | null): string | undefined {
+	const host = value?.trim().toLowerCase();
+	return host || undefined;
+}
+
+function formatHostForOrigin(host: string): string {
+	return host.includes(":") && !host.startsWith("[") ? `[${host}]` : host;
+}
+
+function isDefaultProtocolPort(protocol: string, port: number): boolean {
+	return (
+		(protocol === "http:" && port === 80) ||
+		(protocol === "https:" && port === 443)
+	);
+}
+
+function originForHost(protocol: string, host: string, port: number): string {
+	return new URL(`${protocol}//${formatHostForOrigin(host)}:${port}`).origin;
+}
+
+function hostHeaderForHost(
+	protocol: string,
+	host: string,
+	port: number,
+): string {
+	const formattedHost = formatHostForOrigin(host).toLowerCase();
+	return isDefaultProtocolPort(protocol, port)
+		? formattedHost
+		: `${formattedHost}:${port}`;
+}
+
+export function allowedBrowserOrigins({
+	bindHost,
+	port,
+	publicUrl,
+}: BrowserRequestAuthOptions): Set<string> {
+	const publicUrlParts = new URL(publicUrl);
+	const origins = new Set<string>();
+	origins.add(publicUrlParts.origin);
+
+	origins.add(originForHost(publicUrlParts.protocol, bindHost, port));
+
+	if (!isNonLocalBindHost(bindHost)) {
+		for (const hostname of ["127.0.0.1", "localhost", "[::1]"]) {
+			origins.add(originForHost(publicUrlParts.protocol, hostname, port));
+		}
+	}
+
+	return origins;
+}
+
+export function allowedBrowserHosts({
+	bindHost,
+	port,
+	publicUrl,
+}: BrowserRequestAuthOptions): Set<string> {
+	const publicUrlParts = new URL(publicUrl);
+	const hosts = new Set<string>();
+	const publicHost = publicUrlParts.host.toLowerCase();
+	hosts.add(publicHost);
+
+	hosts.add(hostHeaderForHost(publicUrlParts.protocol, bindHost, port));
+
+	if (!isNonLocalBindHost(bindHost)) {
+		for (const hostname of ["127.0.0.1", "localhost", "[::1]"]) {
+			hosts.add(hostHeaderForHost(publicUrlParts.protocol, hostname, port));
+		}
+	}
+
+	return hosts;
+}
+
+export function requiresBrowserRequestAuth(
+	req: Request,
+	url: URL,
+	isPublicBrowserRoute: PublicBrowserRoutePredicate,
+): boolean {
+	if (isWebSocketUpgrade(req)) return true;
+	if (!SAFE_HTTP_METHODS.has(req.method.toUpperCase())) return true;
+	return !isPublicBrowserRoute(req, url);
+}
+
+export function isAuthorizedBrowserRequest(
+	req: Request,
+	url: URL,
+	options: BrowserRequestAuthOptions,
+): boolean {
+	const host = parseHeader(req.headers.get("host"));
+	if (!host || !allowedBrowserHosts(options).has(host)) return false;
+
+	const origin = parseOrigin(req.headers.get("origin"));
+	if (!origin || !allowedBrowserOrigins(options).has(origin)) return false;
+
+	if (!options.roomSecret) return true;
+	return url.searchParams.get("roomSecret") === options.roomSecret;
+}
+
+export function isAuthorizedBrowserToDesktopRequest(
+	req: Request,
+	url: URL,
+	options: BrowserRequestAuthOptions,
+	isPublicBrowserRoute: PublicBrowserRoutePredicate,
+): boolean {
+	return (
+		!requiresBrowserRequestAuth(req, url, isPublicBrowserRoute) ||
+		isAuthorizedBrowserRequest(req, url, options)
+	);
+}

apps/cline-hub/src/server/connectors.test.ts

@@ -0,0 +1,97 @@
+import { describe, expect, it } from "vitest";
+import { __test__ } from "./connectors";
+
+describe("connector launch command", () => {
+	it("uses Bun conditions when launching the source CLI from Bun", () => {
+		expect(
+			__test__.buildCliConnectCommand(["telegram", "--bot-token", "token"], {
+				execPath: "/Users/test/.bun/bin/bun",
+				cliPath: "/repo/apps/cli/src/index.ts",
+				exists: () => true,
+			}),
+		).toEqual({
+			launcher: "/Users/test/.bun/bin/bun",
+			childArgs: [
+				"--conditions=development",
+				"/repo/apps/cli/src/index.ts",
+				"connect",
+				"telegram",
+				"--bot-token",
+				"token",
+			],
+		});
+	});
+
+	it("uses compiled CLI subcommands without Bun flags", () => {
+		expect(
+			__test__.buildCliConnectCommand(["telegram", "--bot-token", "token"], {
+				execPath: "/Applications/Cline/bin/cline",
+				cliPath: "/repo/apps/cli/src/index.ts",
+				exists: () => true,
+			}),
+		).toEqual({
+			launcher: "/Applications/Cline/bin/cline",
+			childArgs: ["connect", "telegram", "--bot-token", "token"],
+		});
+	});
+
+	it("uses Bun conditions when launching the source CLI from Node", () => {
+		expect(
+			__test__.buildCliConnectCommand(["telegram", "--bot-token", "token"], {
+				execPath: "/usr/local/bin/node",
+				cliPath: "/repo/apps/cli/src/index.ts",
+				exists: () => true,
+			}),
+		).toEqual({
+			launcher: "bun",
+			childArgs: [
+				"--conditions=development",
+				"/repo/apps/cli/src/index.ts",
+				"connect",
+				"telegram",
+				"--bot-token",
+				"token",
+			],
+		});
+	});
+
+	it("detects Windows Node when launching the source CLI", () => {
+		expect(
+			__test__.buildCliConnectCommand(["telegram", "--bot-token", "token"], {
+				execPath: "node.exe",
+				cliPath: "C:\\repo\\apps\\cli\\src\\index.ts",
+				exists: () => true,
+			}),
+		).toEqual({
+			launcher: "bun",
+			childArgs: [
+				"--conditions=development",
+				"C:\\repo\\apps\\cli\\src\\index.ts",
+				"connect",
+				"telegram",
+				"--bot-token",
+				"token",
+			],
+		});
+	});
+
+	it("strips terminal color codes from connector command failures", () => {
+		expect(
+			__test__.normalizeConnectorError(
+				"\u001B[31merror:\u001B[0m error: unknown option '--conditions=development'",
+				"connector start failed",
+			),
+		).toBe("unknown option '--conditions=development'");
+	});
+
+	it("turns Telegram unauthorized responses into a token validation message", () => {
+		expect(
+			__test__.normalizeConnectorError(
+				"\u001B[31merror:\u001B[0m Telegram getMe failed (401 Unauthorized): Unauthorized",
+				"connector start failed",
+			),
+		).toBe(
+			"Telegram rejected this bot token. Copy the token from @BotFather and try again.",
+		);
+	});
+});

apps/cline-hub/src/server/connectors.ts

@@ -1,5 +1,8 @@
 import { spawn } from "node:child_process";
+import { existsSync } from "node:fs";
+import { basename } from "node:path";
 import process from "node:process";
+import { withResolvedClineBuildEnv } from "@cline/shared";
 import { listConnectorCatalog } from "../../../cli/src/connectors/catalog";
 import { listActiveConnectors } from "../../../cli/src/connectors/status";
 import {
@@ -13,6 +16,68 @@ import type {
 import { cliIndexPath, workspaceRoot } from "./deps";
 import { asRecord, asString } from "./utils";
 
+type CliConnectCommand = {
+	launcher: string;
+	childArgs: string[];
+};
+
+const ANSI_ESCAPE_PATTERN = new RegExp(
+	[
+		"[\\u001B\\u009B][[\\]()#;?]*",
+		"(?:(?:(?:[a-zA-Z\\d]*(?:;[a-zA-Z\\d]*)*)?\\u0007)",
+		"|(?:(?:\\d{1,4}(?:;\\d{0,4})*)?[\\dA-PR-TZcf-nq-uy=><~]))",
+	].join(""),
+	"g",
+);
+
+function stripAnsi(value: string): string {
+	return value.replace(ANSI_ESCAPE_PATTERN, "");
+}
+
+function normalizeConnectorError(rawMessage: string, fallback: string): string {
+	const message =
+		stripAnsi(rawMessage)
+			.replace(/\r\n/g, "\n")
+			.trim()
+			.replace(/^(?:error:\s*)+/i, "")
+			.trim() || fallback;
+
+	if (
+		/^Telegram getMe failed \(401 Unauthorized\): Unauthorized$/i.test(message)
+	) {
+		return "Telegram rejected this bot token. Copy the token from @BotFather and try again.";
+	}
+
+	return message.slice(0, 2_000);
+}
+
+function buildCliConnectCommand(
+	args: string[],
+	options: {
+		execPath?: string;
+		cliPath?: string;
+		exists?: (path: string) => boolean;
+	} = {},
+): CliConnectCommand {
+	const execPath = options.execPath ?? process.execPath;
+	const cliPath = options.cliPath ?? cliIndexPath;
+	const exists = options.exists ?? existsSync;
+	const runtimeName = basename(execPath).toLowerCase();
+	const isBunRuntime = runtimeName.includes("bun");
+	const isNodeRuntime = runtimeName === "node" || runtimeName === "node.exe";
+	const useBunSourceEntrypoint =
+		(isBunRuntime || isNodeRuntime) && exists(cliPath);
+	const launcher = isBunRuntime
+		? execPath
+		: useBunSourceEntrypoint
+			? "bun"
+			: execPath;
+	const childArgs = useBunSourceEntrypoint
+		? ["--conditions=development", cliPath, "connect", ...args]
+		: ["connect", ...args];
+	return { launcher, childArgs };
+}
+
 export function connectorChannelsPayload(): WebviewConnectorChannelsResponse {
 	const supported = new Set(
 		listConnectorCatalog().map((connector) => connector.name),
@@ -55,23 +120,14 @@ async function runCliConnectCommand(args: string[]): Promise<{
 	stdout: string;
 	stderr: string;
 }> {
-	const launcher = (process.versions as Record<string, string | undefined>).bun
-		? process.execPath
-		: "bun";
-	const child = spawn(
-		launcher,
-		["--conditions=development", cliIndexPath, "connect", ...args],
-		{
-			cwd: workspaceRoot,
-			env: {
-				...process.env,
-				CLINE_BUILD_ENV: process.env.CLINE_BUILD_ENV ?? "development",
-			},
-			stdio: ["ignore", "pipe", "pipe"],
-			// Prevent a console window from flashing on Windows.
-			windowsHide: true,
-		},
-	);
+	const { launcher, childArgs } = buildCliConnectCommand(args);
+	const child = spawn(launcher, childArgs, {
+		cwd: workspaceRoot,
+		env: withResolvedClineBuildEnv(process.env),
+		stdio: ["ignore", "pipe", "pipe"],
+		// Prevent a console window from flashing on Windows.
+		windowsHide: true,
+	});
 	let stdout = "";
 	let stderr = "";
 	child.stdout?.setEncoding("utf8");
@@ -157,9 +213,10 @@ export async function startConnectorChannel(
 	const result = await runCliConnectCommand(cliArgs);
 	if (result.code !== 0) {
 		throw new Error(
-			(result.stderr.trim() || result.stdout.trim() || "connector start failed")
-				.trim()
-				.slice(0, 2_000),
+			normalizeConnectorError(
+				result.stderr || result.stdout,
+				"connector start failed",
+			),
 		);
 	}
 	await waitForConnectorState(() =>
@@ -168,6 +225,11 @@ export async function startConnectorChannel(
 	return connectorChannelsPayload();
 }
 
+export const __test__ = {
+	buildCliConnectCommand,
+	normalizeConnectorError,
+};
+
 export async function stopConnectorChannel(
 	args?: Record<string, unknown>,
 ): Promise<WebviewConnectorChannelsResponse> {
@@ -182,9 +244,10 @@ export async function stopConnectorChannel(
 	const result = await runCliConnectCommand([channel, "--stop"]);
 	if (result.code !== 0) {
 		throw new Error(
-			(result.stderr.trim() || result.stdout.trim() || "connector stop failed")
-				.trim()
-				.slice(0, 2_000),
+			normalizeConnectorError(
+				result.stderr || result.stdout,
+				"connector stop failed",
+			),
 		);
 	}
 	await waitForConnectorState(

apps/cline-hub/src/server/mcp.ts

@@ -1,5 +1,5 @@
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { dirname } from "node:path";
+import { existsSync, readFileSync } from "node:fs";
+import { updateMcpSettingsFileSync } from "@cline/core";
 import { resolveMcpSettingsPath } from "@cline/shared/storage";
 import type { JsonRecord } from "./types";
 
@@ -65,9 +65,9 @@ export function readMcpServersResponse(): JsonRecord {
 }
 
 export function writeMcpServersMap(servers: JsonRecord): void {
-	const path = resolveMcpSettingsPath();
-	mkdirSync(dirname(path), { recursive: true });
-	writeFileSync(path, `${JSON.stringify({ mcpServers: servers }, null, 2)}\n`);
+	updateMcpSettingsFileSync(resolveMcpSettingsPath(), (settings) => {
+		settings.mcpServers = servers;
+	});
 }
 
 export function ensureMcpSettingsFile(): string {
@@ -78,23 +78,21 @@ export function ensureMcpSettingsFile(): string {
 	return path;
 }
 
-function readServersMap(): { path: string; servers: JsonRecord } {
-	const path = ensureMcpSettingsFile();
-	const parsed = JSON.parse(readFileSync(path, "utf8")) as JsonRecord;
-	return { path, servers: (parsed.mcpServers as JsonRecord | undefined) ?? {} };
-}
-
 export function setMcpServerDisabled(
 	name: string,
 	disabled: boolean,
 ): JsonRecord {
-	const { servers } = readServersMap();
-	const current = servers[name];
-	if (!current || typeof current !== "object") {
-		throw new Error(`unknown MCP server: ${name}`);
-	}
-	servers[name] = { ...(current as JsonRecord), disabled };
-	writeMcpServersMap(servers);
+	// Hold the cross-process lock across read-modify-write so a concurrent writer
+	// (the extension, the CLI) cannot clobber this change.
+	updateMcpSettingsFileSync(resolveMcpSettingsPath(), (settings) => {
+		const servers = ((settings.mcpServers as JsonRecord | undefined) ?? {}) as JsonRecord;
+		const current = servers[name];
+		if (!current || typeof current !== "object") {
+			throw new Error(`unknown MCP server: ${name}`);
+		}
+		servers[name] = { ...(current as JsonRecord), disabled };
+		settings.mcpServers = servers;
+	});
 	return readMcpServersResponse();
 }
 
@@ -127,19 +125,27 @@ export function upsertMcpServer(input: JsonRecord): JsonRecord {
 					},
 					disabled: input.disabled === true,
 				};
-	const { servers } = readServersMap();
-	if (previousName && previousName !== name) {
-		delete servers[previousName];
-	}
-	servers[name] = next;
-	writeMcpServersMap(servers);
+	// Hold the cross-process lock across read-modify-write so a concurrent writer
+	// cannot clobber this upsert.
+	updateMcpSettingsFileSync(resolveMcpSettingsPath(), (settings) => {
+		const servers = ((settings.mcpServers as JsonRecord | undefined) ?? {}) as JsonRecord;
+		if (previousName && previousName !== name) {
+			delete servers[previousName];
+		}
+		servers[name] = next;
+		settings.mcpServers = servers;
+	});
 	return readMcpServersResponse();
 }
 
 export function deleteMcpServer(name: string): JsonRecord {
 	if (!name) throw new Error("server name is required");
-	const { servers } = readServersMap();
-	delete servers[name];
-	writeMcpServersMap(servers);
+	// Hold the cross-process lock across read-modify-write so a concurrent writer
+	// cannot resurrect the deleted server from a stale snapshot.
+	updateMcpSettingsFileSync(resolveMcpSettingsPath(), (settings) => {
+		const servers = ((settings.mcpServers as JsonRecord | undefined) ?? {}) as JsonRecord;
+		delete servers[name];
+		settings.mcpServers = servers;
+	});
 	return readMcpServersResponse();
 }

apps/cline-hub/src/validate-options.ts

@@ -41,6 +41,23 @@ expectEqual(
 	"invite URL",
 );
 
+const tailscale = resolveClineHubServerOptions({
+	HOST: "0.0.0.0",
+	CLINE_HUB_DASHBOARD_PORT: "8787",
+	PUBLIC_URL: "http://100.82.5.118",
+	ROOM_SECRET: "invite-123",
+});
+expectEqual(
+	tailscale.publicUrl,
+	"http://100.82.5.118:8787",
+	"direct IP public URL gets dashboard port",
+);
+expectEqual(
+	buildInviteUrl(tailscale.publicUrl, tailscale.roomSecret),
+	"http://100.82.5.118:8787/?roomSecret=invite-123",
+	"invite URL for direct IP public URL",
+);
+
 expectThrows(
 	() => resolveClineHubServerOptions({ HOST: "0.0.0.0" }),
 	"non-local bind without ROOM_SECRET",

apps/cline-hub/src/webview/package.json

@@ -13,10 +13,9 @@
 		"@fontsource-variable/schibsted-grotesk": "^5.2.8",
 		"@radix-ui/react-use-controllable-state": "^1.2.2",
 		"@rive-app/react-webgl2": "^4.27.2",
+		"@shikijs/langs": "^4.2.0",
+		"@shikijs/themes": "^4.2.0",
 		"@streamdown/cjk": "^1.0.3",
-		"@streamdown/code": "^1.1.1",
-		"@streamdown/math": "^1.0.2",
-		"@streamdown/mermaid": "^1.0.2",
 		"@tailwindcss/vite": "^4.2.1",
 		"@xyflow/react": "^12.10.1",
 		"ai": "^6.0.116",
@@ -27,6 +26,7 @@
 		"embla-carousel-react": "^8.6.0",
 		"lucide-react": "^0.577.0",
 		"media-chrome": "^4.18.1",
+		"mermaid": "^11.15.0",
 		"motion": "^12.38.0",
 		"nanoid": "^5.1.7",
 		"next-themes": "^0.4.6",

apps/cline-hub/src/webview/src/App.tsx

@@ -22,7 +22,14 @@ import {
 	WrenchIcon,
 } from "lucide-react";
 import type { ReactNode } from "react";
-import { useCallback, useEffect, useMemo, useState } from "react";
+import {
+	lazy,
+	Suspense,
+	useCallback,
+	useEffect,
+	useMemo,
+	useState,
+} from "react";
 import {
 	AlertDialog,
 	AlertDialogAction,
@@ -53,19 +60,24 @@ import type {
 	WebviewOutboundMessage,
 	WebviewSessionSummary,
 } from "../../webview-protocol";
-import Chat from "./Chat";
 import { PageFrame, PageHeader } from "./components/views/page-layout";
-import {
-	type CustomizationSection,
-	CustomizationSectionView,
-} from "./components/views/settings/extensions-view";
-import {
-	type SettingsSection,
-	SettingsView,
-} from "./components/views/settings/settings-view";
+import type { CustomizationSection } from "./components/views/settings/extensions-view";
+import type { SettingsSection } from "./components/views/settings/settings-view";
 import { syncHubTheme } from "./lib/theme";
 import { postToHost } from "./vscode";
 
+const Chat = lazy(() => import("./Chat"));
+const SettingsView = lazy(() =>
+	import("./components/views/settings/settings-view").then((module) => ({
+		default: module.SettingsView,
+	})),
+);
+const CustomizationSectionView = lazy(() =>
+	import("./components/views/settings/extensions-view").then((module) => ({
+		default: module.CustomizationSectionView,
+	})),
+);
+
 type View =
 	| "home"
 	| "sessions"
@@ -238,6 +250,14 @@ function currentPathWithSearch(): string {
 	return `${window.location.pathname}${window.location.search}`;
 }
 
+function ViewLoading() {
+	return (
+		<PageFrame>
+			<p className="text-sm text-muted-foreground">Loading...</p>
+		</PageFrame>
+	);
+}
+
 function formatRelativeTime(timestamp?: number): string {
 	if (!timestamp) return "unknown";
 	const elapsed = Math.max(0, Date.now() - timestamp);
@@ -1333,7 +1353,7 @@ function App() {
 
 	return (
 		<Shell onNavigate={navigate} version={hubState.coreVersion} view={view}>
-			{content}
+			<Suspense fallback={<ViewLoading />}>{content}</Suspense>
 		</Shell>
 	);
 }

apps/cline-hub/src/webview/src/components/ai-elements/code-block.tsx

@@ -11,12 +11,13 @@ import {
 	useState,
 } from "react";
 import type {
-	BundledLanguage,
-	BundledTheme,
-	HighlighterGeneric,
+	HighlighterCore,
+	LanguageRegistration,
 	ThemedToken,
-} from "shiki";
-import { createHighlighter } from "shiki";
+	ThemeRegistration,
+} from "shiki/core";
+import { createHighlighterCore } from "shiki/core";
+import { createJavaScriptRegexEngine } from "shiki/engine/javascript";
 import { Button } from "@/components/ui/button";
 import {
 	Select,
@@ -36,6 +37,78 @@ const isUnderline = (fontStyle: number | undefined) =>
 	// oxlint-disable-next-line eslint(no-bitwise)
 	fontStyle && fontStyle & 4;
 
+const SUPPORTED_LANGUAGES = [
+	"bash",
+	"css",
+	"diff",
+	"html",
+	"javascript",
+	"json",
+	"jsonc",
+	"jsx",
+	"markdown",
+	"python",
+	"shellscript",
+	"tsx",
+	"typescript",
+	"yaml",
+] as const;
+
+export type SupportedCodeLanguage = (typeof SUPPORTED_LANGUAGES)[number];
+
+const SUPPORTED_LANGUAGE_SET = new Set<string>(SUPPORTED_LANGUAGES);
+
+const LANGUAGE_LOADERS: Record<
+	SupportedCodeLanguage,
+	() => Promise<LanguageRegistration[]>
+> = {
+	bash: () => import("@shikijs/langs/bash").then((module) => module.default),
+	css: () => import("@shikijs/langs/css").then((module) => module.default),
+	diff: () => import("@shikijs/langs/diff").then((module) => module.default),
+	html: () => import("@shikijs/langs/html").then((module) => module.default),
+	javascript: () =>
+		import("@shikijs/langs/javascript").then((module) => module.default),
+	json: () => import("@shikijs/langs/json").then((module) => module.default),
+	jsonc: () => import("@shikijs/langs/jsonc").then((module) => module.default),
+	jsx: () => import("@shikijs/langs/jsx").then((module) => module.default),
+	markdown: () =>
+		import("@shikijs/langs/markdown").then((module) => module.default),
+	python: () =>
+		import("@shikijs/langs/python").then((module) => module.default),
+	shellscript: () =>
+		import("@shikijs/langs/shellscript").then((module) => module.default),
+	tsx: () => import("@shikijs/langs/tsx").then((module) => module.default),
+	typescript: () =>
+		import("@shikijs/langs/typescript").then((module) => module.default),
+	yaml: () => import("@shikijs/langs/yaml").then((module) => module.default),
+};
+
+const LANGUAGE_ALIASES: Record<string, SupportedCodeLanguage> = {
+	console: "shellscript",
+	cjs: "javascript",
+	htm: "html",
+	js: "javascript",
+	json5: "jsonc",
+	md: "markdown",
+	mjs: "javascript",
+	py: "python",
+	sh: "shellscript",
+	shell: "shellscript",
+	ts: "typescript",
+	yml: "yaml",
+};
+
+const normalizeLanguage = (
+	language: string,
+): SupportedCodeLanguage | "text" => {
+	const normalized = language.trim().toLowerCase();
+	if (!normalized) {
+		return "text";
+	}
+	const aliased = LANGUAGE_ALIASES[normalized] ?? normalized;
+	return SUPPORTED_LANGUAGE_SET.has(aliased) ? aliased : "text";
+};
+
 // Transform tokens to include pre-computed keys to avoid noArrayIndexKey lint
 interface KeyedToken {
 	token: ThemedToken;
@@ -108,7 +181,7 @@ const LineSpan = ({
 // Types
 type CodeBlockProps = HTMLAttributes<HTMLDivElement> & {
 	code: string;
-	language: BundledLanguage;
+	language: string;
 	showLineNumbers?: boolean;
 };
 
@@ -128,10 +201,9 @@ const CodeBlockContext = createContext<CodeBlockContextType>({
 });
 
 // Highlighter cache (singleton per language)
-const highlighterCache = new Map<
-	string,
-	Promise<HighlighterGeneric<BundledLanguage, BundledTheme>>
->();
+let highlighterPromise: Promise<HighlighterCore> | undefined;
+let themesPromise: Promise<void> | undefined;
+const languagePromises = new Map<SupportedCodeLanguage, Promise<void>>();
 
 // Token cache
 const tokensCache = new Map<string, TokenizedCode>();
@@ -139,27 +211,44 @@ const tokensCache = new Map<string, TokenizedCode>();
 // Subscribers for async token updates
 const subscribers = new Map<string, Set<(result: TokenizedCode) => void>>();
 
-const getTokensCacheKey = (code: string, language: BundledLanguage) => {
+const getTokensCacheKey = (code: string, language: string) => {
 	const start = code.slice(0, 100);
 	const end = code.length > 100 ? code.slice(-100) : "";
 	return `${language}:${code.length}:${start}:${end}`;
 };
 
-const getHighlighter = (
-	language: BundledLanguage,
-): Promise<HighlighterGeneric<BundledLanguage, BundledTheme>> => {
-	const cached = highlighterCache.get(language);
+const getHighlighter = (): Promise<HighlighterCore> => {
+	if (!highlighterPromise) {
+		highlighterPromise = createHighlighterCore({
+			engine: createJavaScriptRegexEngine({ forgiving: true }),
+		});
+	}
+	return highlighterPromise;
+};
+
+const ensureThemes = (highlighter: HighlighterCore): Promise<void> => {
+	if (!themesPromise) {
+		themesPromise = Promise.all([
+			import("@shikijs/themes/github-light").then((module) => module.default),
+			import("@shikijs/themes/github-dark").then((module) => module.default),
+		]).then((themes: ThemeRegistration[]) => highlighter.loadTheme(...themes));
+	}
+	return themesPromise;
+};
+
+const ensureLanguage = (
+	highlighter: HighlighterCore,
+	language: SupportedCodeLanguage,
+): Promise<void> => {
+	const cached = languagePromises.get(language);
 	if (cached) {
 		return cached;
 	}
-
-	const highlighterPromise = createHighlighter({
-		langs: [language],
-		themes: ["github-light", "github-dark"],
-	});
-
-	highlighterCache.set(language, highlighterPromise);
-	return highlighterPromise;
+	const languagePromise = LANGUAGE_LOADERS[language]().then((registrations) =>
+		highlighter.loadLanguage(...registrations),
+	);
+	languagePromises.set(language, languagePromise);
+	return languagePromise;
 };
 
 // Create raw tokens for immediate display while highlighting loads
@@ -181,11 +270,16 @@ const createRawTokens = (code: string): TokenizedCode => ({
 // Synchronous highlight with callback for async results
 export const highlightCode = (
 	code: string,
-	language: BundledLanguage,
+	language: string,
 	// oxlint-disable-next-line eslint-plugin-promise(prefer-await-to-callbacks)
 	callback?: (result: TokenizedCode) => void,
 ): TokenizedCode | null => {
-	const tokensCacheKey = getTokensCacheKey(code, language);
+	const langToUse = normalizeLanguage(language);
+	if (langToUse === "text") {
+		return createRawTokens(code);
+	}
+
+	const tokensCacheKey = getTokensCacheKey(code, langToUse);
 
 	// Return cached result if available
 	const cached = tokensCache.get(tokensCacheKey);
@@ -202,11 +296,11 @@ export const highlightCode = (
 	}
 
 	// Start highlighting in background - fire-and-forget async pattern
-	getHighlighter(language)
+	getHighlighter()
 		// oxlint-disable-next-line eslint-plugin-promise(prefer-await-to-then)
-		.then((highlighter) => {
-			const availableLangs = highlighter.getLoadedLanguages();
-			const langToUse = availableLangs.includes(language) ? language : "text";
+		.then(async (highlighter) => {
+			await ensureThemes(highlighter);
+			await ensureLanguage(highlighter, langToUse);
 
 			const result = highlighter.codeToTokens(code, {
 				lang: langToUse,
@@ -376,7 +470,7 @@ export const CodeBlockContent = ({
 	showLineNumbers = false,
 }: {
 	code: string;
-	language: BundledLanguage;
+	language: string;
 	showLineNumbers?: boolean;
 }) => {
 	// Memoized raw tokens for immediate display

apps/cline-hub/src/webview/src/components/ai-elements/message.tsx

@@ -1,9 +1,5 @@
 "use client";
 
-import { cjk } from "@streamdown/cjk";
-import { code } from "@streamdown/code";
-import { math } from "@streamdown/math";
-import { mermaid } from "@streamdown/mermaid";
 import type { UIMessage } from "ai";
 import { ChevronLeftIcon, ChevronRightIcon } from "lucide-react";
 import type { ComponentProps, HTMLAttributes, ReactElement } from "react";
@@ -16,7 +12,6 @@ import {
 	useMemo,
 	useState,
 } from "react";
-import { Streamdown } from "streamdown";
 import { Button } from "@/components/ui/button";
 import { ButtonGroup, ButtonGroupText } from "@/components/ui/button-group";
 import {
@@ -26,6 +21,7 @@ import {
 	TooltipTrigger,
 } from "@/components/ui/tooltip";
 import { cn } from "@/lib/utils";
+import { HubStreamdown } from "./streamdown";
 
 export type MessageProps = HTMLAttributes<HTMLDivElement> & {
 	from: UIMessage["role"];
@@ -316,24 +312,18 @@ export const MessageBranchPage = ({
 	);
 };
 
-export type MessageResponseProps = ComponentProps<typeof Streamdown>;
-
-const streamdownPlugins = { cjk, code, math, mermaid };
+export type MessageResponseProps = ComponentProps<typeof HubStreamdown>;
 
 export const MessageResponse = memo(
 	({ className, ...props }: MessageResponseProps) => (
-		<Streamdown
+		<HubStreamdown
 			className={cn(
 				"size-full [&>*:first-child]:mt-0 [&>*:last-child]:mb-0",
 				className,
 			)}
-			plugins={streamdownPlugins}
 			{...props}
 		/>
 	),
-	(prevProps, nextProps) =>
-		prevProps.children === nextProps.children &&
-		nextProps.isAnimating === prevProps.isAnimating,
 );
 
 MessageResponse.displayName = "MessageResponse";

apps/cline-hub/src/webview/src/components/ai-elements/reasoning.tsx

@@ -1,10 +1,6 @@
 "use client";
 
 import { useControllableState } from "@radix-ui/react-use-controllable-state";
-import { cjk } from "@streamdown/cjk";
-import { code } from "@streamdown/code";
-import { math } from "@streamdown/math";
-import { mermaid } from "@streamdown/mermaid";
 import { BrainIcon, ChevronDownIcon } from "lucide-react";
 import type { ComponentProps, ReactNode } from "react";
 import {
@@ -17,7 +13,6 @@ import {
 	useRef,
 	useState,
 } from "react";
-import { Streamdown } from "streamdown";
 import {
 	Collapsible,
 	CollapsibleContent,
@@ -26,6 +21,7 @@ import {
 import { cn } from "@/lib/utils";
 
 import { Shimmer } from "./shimmer";
+import { HubStreamdown } from "./streamdown";
 
 interface ReasoningContextValue {
 	isStreaming: boolean;
@@ -204,8 +200,6 @@ export type ReasoningContentProps = ComponentProps<
 	children: string;
 };
 
-const streamdownPlugins = { cjk, code, math, mermaid };
-
 export const ReasoningContent = memo(
 	({ className, children, ...props }: ReasoningContentProps) => (
 		<CollapsibleContent
@@ -216,7 +210,7 @@ export const ReasoningContent = memo(
 			)}
 			{...props}
 		>
-			<Streamdown plugins={streamdownPlugins}>{children}</Streamdown>
+			<HubStreamdown>{children}</HubStreamdown>
 		</CollapsibleContent>
 	),
 );

apps/cline-hub/src/webview/src/components/ai-elements/streamdown.tsx

@@ -0,0 +1,170 @@
+import { cjk } from "@streamdown/cjk";
+import type { MermaidConfig } from "mermaid";
+import type { ComponentProps, ReactNode } from "react";
+import { isValidElement, memo } from "react";
+import {
+	type Components,
+	type DiagramPlugin,
+	Streamdown,
+	type StreamdownProps,
+} from "streamdown";
+import {
+	CodeBlock,
+	CodeBlockActions,
+	CodeBlockCopyButton,
+	CodeBlockFilename,
+	CodeBlockHeader,
+	CodeBlockTitle,
+} from "@/components/ai-elements/code-block";
+import { cn } from "@/lib/utils";
+
+type MarkdownCodeProps = ComponentProps<"code"> & {
+	"data-block"?: boolean | string;
+	node?: {
+		properties?: {
+			metastring?: string;
+		};
+	};
+};
+
+const LANGUAGE_CLASS_PATTERN = /(?:^|\s)language-([^\s]+)/;
+const START_LINE_PATTERN = /startLine=(\d+)/;
+const NO_LINE_NUMBERS_PATTERN = /\bnoLineNumbers\b/;
+
+function codeText(children: ReactNode): string {
+	if (typeof children === "string" || typeof children === "number") {
+		return String(children);
+	}
+	if (Array.isArray(children)) {
+		return children.map(codeText).join("");
+	}
+	if (isValidElement<{ children?: ReactNode }>(children)) {
+		return codeText(children.props.children);
+	}
+	return "";
+}
+
+const MarkdownCode = ({
+	children,
+	className,
+	node,
+	"data-block": dataBlock,
+	...props
+}: MarkdownCodeProps) => {
+	const language = className?.match(LANGUAGE_CLASS_PATTERN)?.[1] ?? "text";
+
+	if (!dataBlock) {
+		return (
+			<code
+				className={cn(
+					"rounded bg-muted px-1.5 py-0.5 font-mono text-sm",
+					className,
+				)}
+				{...props}
+			>
+				{children}
+			</code>
+		);
+	}
+
+	const meta = node?.properties?.metastring;
+	const startLineMatch = meta?.match(START_LINE_PATTERN);
+	const startLine = startLineMatch ? Number.parseInt(startLineMatch[1], 10) : 1;
+	const showLineNumbers = meta ? !NO_LINE_NUMBERS_PATTERN.test(meta) : true;
+
+	return (
+		<CodeBlock
+			code={codeText(children)}
+			data-start-line={startLine > 1 ? startLine : undefined}
+			language={language}
+			showLineNumbers={showLineNumbers}
+		>
+			<CodeBlockHeader>
+				<CodeBlockTitle>
+					<CodeBlockFilename>{language}</CodeBlockFilename>
+				</CodeBlockTitle>
+				<CodeBlockActions>
+					<CodeBlockCopyButton />
+				</CodeBlockActions>
+			</CodeBlockHeader>
+		</CodeBlock>
+	);
+};
+
+const markdownComponents = {
+	code: MarkdownCode,
+} satisfies Components;
+
+const DEFAULT_MERMAID_CONFIG = {
+	fontFamily: "monospace",
+	securityLevel: "strict",
+	startOnLoad: false,
+	suppressErrorRendering: true,
+	theme: "default",
+} satisfies MermaidConfig;
+
+interface LazyMermaidInstance {
+	initialize: (config: MermaidConfig) => void;
+	render: (
+		id: string,
+		source: string,
+	) => Promise<{
+		svg: string;
+	}>;
+}
+
+function createLazyMermaidPlugin(): DiagramPlugin {
+	let config: MermaidConfig = DEFAULT_MERMAID_CONFIG;
+	let initialized = false;
+
+	const instance: LazyMermaidInstance = {
+		initialize(nextConfig: MermaidConfig) {
+			config = { ...DEFAULT_MERMAID_CONFIG, ...config, ...nextConfig };
+			initialized = false;
+		},
+		async render(id: string, source: string) {
+			const mermaidModule = await import("mermaid");
+			const mermaid = mermaidModule.default;
+			if (!initialized) {
+				mermaid.initialize(config);
+				initialized = true;
+			}
+			return mermaid.render(id, source);
+		},
+	};
+
+	return {
+		getMermaid(nextConfig?: MermaidConfig) {
+			if (nextConfig) {
+				instance.initialize(nextConfig);
+			}
+			return instance;
+		},
+		language: "mermaid",
+		name: "mermaid",
+		type: "diagram",
+	};
+}
+
+const streamdownPlugins = { cjk, mermaid: createLazyMermaidPlugin() };
+
+export type HubStreamdownProps = StreamdownProps;
+
+export const HubStreamdown = memo(
+	({ className, components, ...props }: HubStreamdownProps) => {
+		const mergedComponents = components
+			? { ...markdownComponents, ...components }
+			: markdownComponents;
+
+		return (
+			<Streamdown
+				className={className}
+				components={mergedComponents}
+				plugins={streamdownPlugins}
+				{...props}
+			/>
+		);
+	},
+);
+
+HubStreamdown.displayName = "HubStreamdown";

apps/cline-hub/src/webview/vite.config.ts

@@ -3,6 +3,27 @@ import tailwindcss from "@tailwindcss/vite";
 import react from "@vitejs/plugin-react-swc";
 import { defineConfig } from "vite";
 
+const mermaidChunkGroups = [
+	{
+		name: "mermaid-parser",
+		maxSize: 450_000,
+		test: /node_modules[\\/](?:\.bun[\\/])?@mermaid-js[+]parser/,
+	},
+	{
+		name: "mermaid-langium",
+		test: /node_modules[\\/](?:\.bun[\\/])?langium/,
+	},
+	{
+		name: "mermaid-layout",
+		maxSize: 450_000,
+		test: /node_modules[\\/](?:\.bun[\\/])?(?:cytoscape|cytoscape-cose-bilkent|dagre|elkjs)/,
+	},
+	{
+		name: "mermaid-markup",
+		test: /node_modules[\\/](?:\.bun[\\/])?(?:katex|dompurify)/,
+	},
+];
+
 export default defineConfig({
 	plugins: [react(), tailwindcss()],
 	resolve: {
@@ -25,5 +46,13 @@ export default defineConfig({
 		outDir: "../../dist/webview",
 		emptyOutDir: true,
 		cssMinify: "esbuild",
+		chunkSizeWarningLimit: 600,
+		rolldownOptions: {
+			output: {
+				codeSplitting: {
+					groups: mermaidChunkGroups,
+				},
+			},
+		},
 	},
 });

apps/examples/desktop-app/sidecar/commands.ts

@@ -1,11 +1,9 @@
 import { execFileSync, spawn } from "node:child_process";
 import {
 	existsSync,
-	mkdirSync,
 	readdirSync,
 	readFileSync,
 	rmSync,
-	writeFileSync,
 } from "node:fs";
 import { basename, dirname, extname, join } from "node:path";
 import type {
@@ -45,6 +43,7 @@ import {
 	setDisabledPlugin,
 	setDisabledTools,
 	toggleDisabledTool,
+	updateMcpSettingsFileSync,
 } from "@cline/core";
 import { getClineEnvironmentConfig } from "@cline/shared";
 import { broadcastEvent, resolveSidecarAskQuestion } from "./context";
@@ -143,9 +142,9 @@ function readMcpServersResponse(): JsonRecord {
 }
 
 function writeMcpServersMap(servers: JsonRecord): void {
-	const path = resolveMcpSettingsPath();
-	mkdirSync(dirname(path), { recursive: true });
-	writeFileSync(path, `${JSON.stringify({ mcpServers: servers }, null, 2)}\n`);
+	updateMcpSettingsFileSync(resolveMcpSettingsPath(), (settings) => {
+		settings.mcpServers = servers;
+	});
 }
 
 function ensureMcpSettingsFile(): string {
@@ -1043,18 +1042,19 @@ export async function handleCommand(
 	}
 	if (command === "set_mcp_server_disabled") {
 		const path = ensureMcpSettingsFile();
-		const parsed = JSON.parse(readFileSync(path, "utf8")) as JsonRecord;
-		const servers = (parsed.mcpServers as JsonRecord | undefined) ?? {};
-		const name = String(args?.name ?? "").trim();
-		const current = servers[name];
-		if (!current || typeof current !== "object") {
-			throw new Error(`unknown MCP server: ${name}`);
-		}
-		servers[name] = {
-			...(current as JsonRecord),
-			disabled: Boolean(args?.disabled),
-		};
-		writeMcpServersMap(servers);
+		updateMcpSettingsFileSync(path, (settings) => {
+			const servers = ((settings.mcpServers as JsonRecord | undefined) ?? {}) as JsonRecord;
+			const name = String(args?.name ?? "").trim();
+			const current = servers[name];
+			if (!current || typeof current !== "object") {
+				throw new Error(`unknown MCP server: ${name}`);
+			}
+			servers[name] = {
+				...(current as JsonRecord),
+				disabled: Boolean(args?.disabled),
+			};
+			settings.mcpServers = servers;
+		});
 		return readMcpServersResponse();
 	}
 	if (command === "upsert_mcp_server") {
@@ -1093,21 +1093,23 @@ export async function handleCommand(
 						metadata: input.metadata,
 					};
 		const path = ensureMcpSettingsFile();
-		const parsed = JSON.parse(readFileSync(path, "utf8")) as JsonRecord;
-		const servers = (parsed.mcpServers as JsonRecord | undefined) ?? {};
-		if (previousName && previousName !== name) {
-			delete servers[previousName];
-		}
-		servers[name] = next;
-		writeMcpServersMap(servers);
+		updateMcpSettingsFileSync(path, (settings) => {
+			const servers = ((settings.mcpServers as JsonRecord | undefined) ?? {}) as JsonRecord;
+			if (previousName && previousName !== name) {
+				delete servers[previousName];
+			}
+			servers[name] = next;
+			settings.mcpServers = servers;
+		});
 		return readMcpServersResponse();
 	}
 	if (command === "delete_mcp_server") {
 		const path = ensureMcpSettingsFile();
-		const parsed = JSON.parse(readFileSync(path, "utf8")) as JsonRecord;
-		const servers = (parsed.mcpServers as JsonRecord | undefined) ?? {};
-		delete servers[String(args?.name ?? "")];
-		writeMcpServersMap(servers);
+		updateMcpSettingsFileSync(path, (settings) => {
+			const servers = ((settings.mcpServers as JsonRecord | undefined) ?? {}) as JsonRecord;
+			delete servers[String(args?.name ?? "")];
+			settings.mcpServers = servers;
+		});
 		return readMcpServersResponse();
 	}
 	if (command === "ensure_mcp_settings_file") {

apps/vscode/.mocharc.json

@@ -1,16 +0,0 @@
-{
-	"extension": [
-		"ts"
-	],
-	"spec": [
-		"src/**/__tests__/*.ts",
-		"src/test/services/**/*.test.ts"
-	],
-	"require": [
-		"ts-node/register",
-		"source-map-support/register",
-		"./src/test/requires.ts"
-	],
-	"recursive": true,
-	"exit": true
-}

apps/vscode/.nycrc.unit.json

@@ -1,48 +0,0 @@
-{
-	"all": true,
-	"check-coverage": false,
-	"reporter": [
-		"text",
-		"lcov"
-	],
-	"include": [
-		"src/**/*.ts"
-	],
-	"exclude": [
-		"**/*.d.ts",
-
-		"**/*.{test,spec}.{js,jsx,ts,tsx,mjs,cjs}",
-		"**/__tests__/**",
-		"**/test/**",
-		"**/tests/**",
-		"**/.nyc_output/**",
-		"**/.vscode-test/**",
-		"**/tests-results/**",
-		"src/test/**",
-
-		"src/generated/**",
-
-		"**/node_modules/**",
-		"**/dist/**",
-		"**/out/**",
-		"**/build/**",
-		"**/coverage/**",
-		"**/coverage-unit/**",
-		"**/proto/**",
-
-		"**/*.{config,setup}.{js,ts,mjs,cjs}",
-		"**/vite-env.d.ts",
-
-		"**/*.{css,scss,sass,less,styl}",
-		"**/*.{svg,png,jpg,jpeg,gif,ico}",
-		"**/*.{json,yaml,yml}"
-	],
-	"extension": [
-		".ts",
-		".js"
-	],
-	"cache": true,
-	"sourceMap": true,
-	"instrument": true,
-	"report-dir": "./coverage-unit"
-}

apps/vscode/.vscode-test.mjs

@@ -1,9 +1,20 @@
 import { defineConfig } from "@vscode/test-cli"
 import path from "path"
+
 const vscodeTestVersion = process.env.VSCODE_TEST_VERSION ?? "stable"
 
 export default defineConfig({
-	files: "{out/**/*.test.js,src/**/*.test.js,!src/test/e2e/**/*.test.js,!out/src/test/e2e/**/*.test.js}",
+	files: [
+		"out/src/{core,test,utils,shared,integrations,hosts,services}/**/*.test.js",
+		"src/{core,test,utils,shared,integrations,hosts,services}/**/*.test.js",
+		// The bun unit suite (src/**/__tests__/* and src/test/services/**) runs under
+		// `bun test` (run-bun-unit-tests.ts) and imports `bun:test`, which this
+		// Node-based runner cannot load. Exclude it here.
+		"!out/src/**/__tests__/**/*.test.js",
+		"!out/src/test/services/**/*.test.js",
+		"!src/**/__tests__/**/*.test.js",
+		"!src/test/services/**/*.test.js",
+	],
 	mocha: {
 		ui: "bdd",
 		timeout: 20000, // Maximum time (in ms) that a test can run before failing

apps/vscode/.vscodeignore

@@ -5,13 +5,31 @@
 # Agent tooling, never shipped in the VSIX
 .agents/**
 .claude/**
+.cline/**
 .codex/**
 CLAUDE.local.md
 out/
 dist-standalone/
 node_modules/
+# Nested workspace-member node_modules (bun links these under each package).
+# Scoped to the sub-package dirs so it doesn't shadow the top-level
+# node_modules/@vscode/codicons re-include below.
+webview-ui/node_modules/**
+testing-platform/node_modules/**
+standalone/**/node_modules/**
 src/**
 standalone/**
+# Build/dev tooling and inputs — bundled into dist/extension.js, not needed in the VSIX.
+bunfig.toml
+esbuild.mjs
+knip.json
+biome.jsonc
+test-setup.js
+.env.example
+scripts/**
+proto/**
+testing-platform/**
+tests/**
 .gitignore
 .yarnrc
 esbuild.js
@@ -34,6 +52,7 @@ sdk/**
 # only exists if a publish aborts mid-swap; neither should ship in the .vsix.
 README.marketplace.md
 .README.github.bak
+package.json.backup
 
 # Custom
 **/demo.gif
@@ -46,7 +65,6 @@ eslint-rules/
 old_docs/
 evals/
 .codespellrc
-.mocharc.json
 buf.yaml
 .clinerules/
 
@@ -78,6 +96,9 @@ old_docs/**
 e2e-build.mjs
 e2e.vsix
 test-results/
+coverage/**
+webview-ui/coverage/**
+webview-ui/.vite-port
 
 # Ignore Storybook files
 **/*.stories.tsx

apps/vscode/biome.jsonc

@@ -1,6 +1,11 @@
 {
-	"root": false,
+	"root": true,
 	"$schema": "./node_modules/@biomejs/biome/configuration_schema.json",
+	"vcs": {
+		"enabled": true,
+		"clientKind": "git",
+		"defaultBranch": "main"
+	},
 	"assist": {
 		"enabled": true,
 		"actions": {
@@ -124,14 +129,18 @@
 			"!!**/playwright",
 			"!!**/.vscode-test",
 			"!!**/test-results",
+			"!!**/coverage",
 			"!!**/node_modules",
 			"!!**/webview-ui/build",
 			"!!**/generated",
 			"!!**/proto",
-			"!!**/tests/specs"
+			"!!**/tests/specs",
+			"!!assets/icons/*.svg"
 		]
 	},
-	"plugins": ["src/dev/grit/process-env.grit"],
+	"plugins": [
+		"src/dev/grit/process-env.grit"
+	],
 	"overrides": [
 		{
 			"includes": [
@@ -146,11 +155,15 @@
 				"!!src/integrations/terminal/**",
 				"!!src/core/controller/ui/openWalkthrough.ts"
 			],
-			"plugins": ["src/dev/grit/vscode-api.grit"]
+			"plugins": [
+				"src/dev/grit/vscode-api.grit"
+			]
 		},
 		{
 			// Do not use console logging directly, use the Logger service instead.
-			"plugins": ["src/dev/grit/console-log.grit"],
+			"plugins": [
+				"src/dev/grit/console-log.grit"
+			],
 			"includes": [
 				"**",
 				"!!**/esbuild.*",
@@ -183,7 +196,9 @@
 				"!!src/core/storage/utils/state-helpers.ts",
 				"!!src/extension.ts"
 			],
-			"plugins": ["src/dev/grit/use-cache-service.grit"]
+			"plugins": [
+				"src/dev/grit/use-cache-service.grit"
+			]
 		}
 	]
 }

apps/vscode/bunfig.toml

@@ -0,0 +1,7 @@
+[test]
+# Module-substitution aliases for `bun test`. bun resolves tsconfig `paths`
+# (@/*, @core/*, @shared/*, …) and the real @cline/llms + @cline/shared dist
+# builds on its own; the preload only shadows `vscode` and `@cline/core` with
+# their unit-test stubs (mirrors vitest.config.ts resolve.alias). See
+# src/test/bun-test-preload.ts for details.
+preload = ["./src/test/bun-test-preload.ts"]

apps/vscode/esbuild.mjs

@@ -85,44 +85,6 @@ const esbuildProblemMatcherPlugin = {
 	},
 }
 
-const copyWasmFiles = {
-	name: "copy-wasm-files",
-	setup(build) {
-		build.onEnd(() => {
-			// tree sitter
-			const sourceDir = path.join(__dirname, "node_modules", "web-tree-sitter")
-			const targetDir = path.join(__dirname, destDir)
-
-			// Copy tree-sitter.wasm
-			fs.copyFileSync(path.join(sourceDir, "tree-sitter.wasm"), path.join(targetDir, "tree-sitter.wasm"))
-
-			// Copy language-specific WASM files
-			const languageWasmDir = path.join(__dirname, "node_modules", "tree-sitter-wasms", "out")
-			const languages = [
-				"typescript",
-				"tsx",
-				"python",
-				"rust",
-				"javascript",
-				"go",
-				"cpp",
-				"c",
-				"c_sharp",
-				"ruby",
-				"java",
-				"php",
-				"swift",
-				"kotlin",
-			]
-
-			languages.forEach((lang) => {
-				const filename = `tree-sitter-${lang}.wasm`
-				fs.copyFileSync(path.join(languageWasmDir, filename), path.join(targetDir, filename))
-			})
-		})
-	},
-}
-
 const buildEnvVars = {
 	"import.meta.url": "_importMetaUrl",
 	"process.env.IS_STANDALONE": JSON.stringify(standalone ? "true" : "false"),
@@ -176,7 +138,6 @@ const baseConfig = {
 	define: buildEnvVars,
 	tsconfig: path.resolve(__dirname, "tsconfig.json"),
 	plugins: [
-		copyWasmFiles,
 		aliasResolverPlugin,
 		/* add to the end of plugins array */
 		esbuildProblemMatcherPlugin,

apps/vscode/knip.json

@@ -1,23 +1,34 @@
 {
-	"entry": [
-		"src/extension.ts",
-		"src/standalone/cline-core.ts",
-		"src/generated/hosts/standalone/protobus-server-setup.ts",
-		"src/generated/hosts/standalone/host-bridge-clients.ts",
-		"src/generated/hosts/vscode/protobus-services.ts",
-		"src/generated/hosts/vscode/hostbridge-grpc-service-config.ts"
-	],
-	"project": [
-		"src/**/*.ts"
-	],
-	"ignore": [
-		"out/**",
-		"node_modules/**",
-		"*.d.ts",
-		"**/*.test.ts",
-		"**/__tests__",
-		"src/test/**",
-		"src/shared/**"
-	],
-	"vite": true
+	"$schema": "https://unpkg.com/knip@5/schema.json",
+	"workspaces": {
+		".": {
+			"entry": [
+				"src/extension.ts",
+				"src/standalone/cline-core.ts",
+				"src/generated/hosts/standalone/protobus-server-setup.ts",
+				"src/generated/hosts/standalone/host-bridge-clients.ts",
+				"src/generated/hosts/vscode/protobus-services.ts",
+				"src/generated/hosts/vscode/hostbridge-grpc-service-config.ts",
+				"src/**/*.test.ts",
+				"src/**/__tests__/**/*.ts",
+				"src/test/**/*.ts"
+			],
+			"project": [
+				"src/**/*.ts"
+			]
+		},
+		"webview-ui": {
+			"entry": [
+				"src/services/grpc-client.ts",
+				"src/**/*.test.{ts,tsx}",
+				"src/**/*.spec.{ts,tsx}",
+				"src/**/__tests__/**/*.{ts,tsx}"
+			],
+			"project": [
+				"src/**/*.{ts,tsx}",
+				"*.ts"
+			],
+			"vite": true
+		}
+	}
 }

apps/vscode/package.json

@@ -2,7 +2,7 @@
 	"name": "claude-dev",
 	"displayName": "Cline",
 	"description": "Autonomous coding agent right in your IDE, capable of creating/editing files, running commands, using the browser, and more with your permission every step of the way.",
-	"version": "3.89.2",
+	"version": "4.0.0",
 	"icon": "assets/icons/icon.png",
 	"engines": {
 		"vscode": "^1.84.0"
@@ -89,7 +89,7 @@
 					{
 						"id": "mcp",
 						"title": "Extend with Powerful Tools (MCP)",
-						"description": "Connect to databases, APIs, or discover new capabilities in the MCP Marketplace.",
+						"description": "Connect to databases, APIs, and other external tools through MCP.",
 						"media": {
 							"markdown": "walkthrough/step4.md"
 						}
@@ -229,26 +229,9 @@
 				"command": "cline.reconstructTaskHistory",
 				"title": "Reconstruct Task History",
 				"category": "Cline"
-			},
-			{
-				"command": "cline.reviewComment.reply",
-				"title": "Reply",
-				"category": "Cline",
-				"enablement": "!commentIsEmpty"
-			},
-			{
-				"command": "cline.reviewComment.addToChat",
-				"title": "Add to Cline Chat",
-				"category": "Cline",
-				"icon": "$(link-external)"
 			}
 		],
 		"keybindings": [
-			{
-				"command": "editor.action.submitComment",
-				"key": "enter",
-				"when": "commentEditorFocused && commentController == cline-ai-review && !commentIsEmpty"
-			},
 			{
 				"command": "cline.addToChat",
 				"key": "cmd+'",
@@ -350,24 +333,6 @@
 				{
 					"command": "cline.abortGitCommitMessage",
 					"when": "config.git.enabled && cline.isGeneratingCommit"
-				},
-				{
-					"command": "cline.reviewComment.reply",
-					"when": "false"
-				}
-			],
-			"comments/commentThread/context": [
-				{
-					"command": "cline.reviewComment.reply",
-					"group": "inline",
-					"when": "commentController == cline-ai-review"
-				}
-			],
-			"comments/commentThread/title": [
-				{
-					"command": "cline.reviewComment.addToChat",
-					"group": "inline",
-					"when": "commentController == cline-ai-review"
 				}
 			]
 		},
@@ -377,66 +342,74 @@
 		}
 	},
 	"scripts": {
-		"vscode:prepublish": "npm run package",
-		"compile": "npm run check-types && npm run lint && node esbuild.mjs",
-		"compile-standalone": "npm run check-types && npm run lint && node esbuild.mjs --standalone",
+		"vscode:prepublish": "bun run package",
+		"compile": "bun run check-types && bun run lint && bun esbuild.mjs",
+		"compile-standalone": "bun run check-types && bun run lint && bun esbuild.mjs --standalone",
 		"postcompile-standalone": "node scripts/package-standalone.mjs",
-		"dev": "npm run protos && npm run watch",
-		"watch": "npx npm-run-all -p watch:*",
-		"watch:esbuild": "node esbuild.mjs --watch",
+		"dev": "bun run protos && bun run watch",
+		"watch": "bun run --parallel watch:esbuild watch:tsc",
+		"watch:esbuild": "bun esbuild.mjs --watch",
 		"watch:tsc": "tsc --noEmit --watch --project tsconfig.json",
-		"package": "npm run check-types && npm run build:webview && npm run lint && node esbuild.mjs --production",
+		"package": "bun run check-types && bun run build:webview && bun run lint && bun esbuild.mjs --production",
 		"protos": "node scripts/build-proto.mjs",
 		"protos-python": "node scripts/build-python-proto.mjs",
 		"download-ripgrep": "node scripts/download-ripgrep.mjs",
-		"postprotos": "biome format --config-path ./biome.jsonc src/shared/proto src/generated webview-ui/src/services/grpc-client.ts --write --no-errors-on-unmatched",
+		"postprotos": "biome format --config-path ./biome.jsonc src/shared/proto src/core/controller src/hosts/ webview-ui/src/services src/generated --write --no-errors-on-unmatched",
 		"clean:build": "rimraf dist dist-standalone webview-ui/build src/generated out/",
 		"clean:deps": "rimraf node_modules webview-ui/node_modules",
-		"clean:all": "npm run clean:build && npm run clean:deps",
+		"clean:all": "bun run clean:build && bun run clean:deps",
 		"compile-tests": "node ./scripts/build-tests.js",
 		"watch-tests": "tsc -p . -w --outDir out",
-		"check-types": "npm run protos && tsc --noEmit && cd webview-ui && tsc --noEmit",
-		"lint": "biome lint --config-path ./biome.jsonc --no-errors-on-unmatched --files-ignore-unknown=true --diagnostic-level=error && npm run lint:proto",
+		"check-types": "bun run protos && bunx tsc --noEmit && cd webview-ui && bunx tsc --noEmit",
+		"lint": "biome lint --config-path ./biome.jsonc --no-errors-on-unmatched --files-ignore-unknown=true --diagnostic-level=error && bun run lint:proto",
 		"lint:proto": "bash ./scripts/proto-lint.sh",
-		"format": "biome format --config-path ./biome.jsonc --changed --since main --no-errors-on-unmatched --files-ignore-unknown=true --diagnostic-level=error",
-		"format:fix": "biome check --config-path ./biome.jsonc --changed --since main --no-errors-on-unmatched --files-ignore-unknown=true --write",
-		"fix:all": "biome check --config-path ./biome.jsonc --no-errors-on-unmatched --files-ignore-unknown=true --write --diagnostic-level=error --unsafe",
-		"ci:check-all": "npx npm-run-all -p check-types lint format",
-		"ci:build": "npm run protos && npm run build:webview && node esbuild.mjs && npm run compile-tests",
-		"pretest": "npm run compile && npm run compile-tests && npm run compile-standalone && npm run lint",
-		"test": "npx npm-run-all test:unit test:integration",
-		"test:integration": "vscode-test",
-		"test:unit": "cross-env TS_NODE_PROJECT=./tsconfig.unit-test.json mocha",
-		"test:coverage": "vscode-test --coverage",
-		"test:sca-server": "npx tsx watch scripts/test-standalone-core-api-server.ts",
-		"test:tp-orchestrator": "npx tsx scripts/testing-platform-orchestrator.ts",
+		"analyze:unused": "bunx --yes knip --config knip.json --include files,exports,types,enumMembers,duplicates",
+		"analyze:unused:prod": "bunx --yes knip --config knip.json --production --include files,exports,types,enumMembers,dependencies",
+		"analyze:unused:fix-exports": "node scripts/remove-unused-exports.mjs --apply",
+		"analyze:unused:fix-exports:dry": "node scripts/remove-unused-exports.mjs",
+		"format": "biome format --config-path ./biome.jsonc --changed --since main --no-errors-on-unmatched --files-ignore-unknown=true --diagnostic-level=error --semicolons=as-needed",
+		"format:fix": "biome check --config-path ./biome.jsonc --changed --since main --no-errors-on-unmatched --files-ignore-unknown=true --write --semicolons=as-needed",
+		"fix:all": "biome check --config-path ./biome.jsonc --no-errors-on-unmatched --files-ignore-unknown=true --write --diagnostic-level=error --unsafe --semicolons=as-needed",
+		"ci:check-all": "bun run --parallel check-types lint format",
+		"ci:build": "bun run protos && bun run build:webview && bun esbuild.mjs && bun run compile-tests",
+		"pretest": "bun run compile && bun run compile-tests && bun run compile-standalone && bun run lint",
+		"test": "bun run test:unit && bun run test:integration",
+		"test:integration": "bun run compile-tests && vscode-test",
+		"test:unit": "bun scripts/run-bun-unit-tests.ts",
+		"test:vitest": "vitest run --config vitest.config.ts",
+		"test:vitest:watch": "vitest --config vitest.config.ts",
+		"test:bun": "bun scripts/run-bun-tests.ts",
+		"test:bun:unit": "bun scripts/run-bun-unit-tests.ts",
+		"test:coverage": "bun run compile-tests && vscode-test --coverage",
+		"test:sca-server": "bun --watch scripts/test-standalone-core-api-server.ts",
+		"test:tp-orchestrator": "bun scripts/testing-platform-orchestrator.ts",
+		"dev:mcp-oauth-test-server": "bun src/dev/mcp-oauth-test-server/server.ts",
 		"e2e": "playwright test -c playwright.config.ts",
-		"test:e2e:build": "vsce package --allow-package-secrets sendgrid --out dist/e2e.vsix",
-		"test:e2e": "playwright install && npm run test:e2e:build && node src/test/e2e/utils/build.mjs && playwright test",
-		"test:e2e:optimal": "npm run test:e2e:build && node src/test/e2e/utils/build.mjs && playwright test",
-		"test:e2e:ui": "npx tsx scripts/interactive-playwright.ts",
-		"install:all": "npm install && cd webview-ui && npm install",
-		"dev:webview": "cd webview-ui && npm run dev",
-		"build:webview": "cd webview-ui && npm run build",
-		"test:webview": "cd webview-ui && npm run test",
+		"test:e2e:build": "vsce package --no-dependencies --allow-package-secrets sendgrid --out dist/e2e.vsix",
+		"test:e2e": "playwright install && bun run test:e2e:build && node src/test/e2e/utils/build.mjs && playwright test",
+		"test:e2e:optimal": "bun run test:e2e:build && node src/test/e2e/utils/build.mjs && playwright test",
+		"test:e2e:ui": "bun scripts/interactive-playwright.ts",
+		"install:all": "bun install",
+		"dev:webview": "cd webview-ui && bun run dev",
+		"build:webview": "cd webview-ui && bun run build",
+		"test:webview": "cd webview-ui && bun run test",
 		"publish:marketplace": "node scripts/publish-marketplace.mjs",
 		"publish:marketplace:prerelease": "node scripts/publish-marketplace.mjs --pre-release",
 		"publish:marketplace:nightly": "node ./scripts/publish-nightly.mjs",
-		"prepare": "npx husky",
-		"docs": "cd docs && npm run dev",
-		"docs:check-links": "cd docs && npm run check",
-		"docs:rename-file": "cd docs && npm run rename",
+		"docs": "cd docs && bun run dev",
+		"docs:check-links": "cd docs && bun run check",
+		"docs:rename-file": "cd docs && bun run rename",
 		"report-issue": "node scripts/report-issue.js",
-		"storybook": "cd webview-ui && npm run storybook",
-		"eval:smoke:run": "npx tsx evals/smoke-tests/run-smoke-tests.ts"
+		"storybook": "cd webview-ui && bun run storybook",
+		"eval:smoke:run": "bun evals/smoke-tests/run-smoke-tests.ts"
 	},
 	"lint-staged": {
 		"src/shared/storage/state-keys.ts": [
 			"node scripts/generate-state-proto.mjs",
-			"git add proto/cline/state.proto"
+			"git add apps/vscode/proto/cline/state.proto"
 		],
 		"*": [
-			"biome check --write --staged --no-errors-on-unmatched --files-ignore-unknown=true"
+			"biome check --write --staged --no-errors-on-unmatched --files-ignore-unknown=true --semicolons=as-needed"
 		]
 	},
 	"devDependencies": {
@@ -452,7 +425,6 @@
 		"@types/node": "20.x",
 		"@types/pdf-parse": "^1.1.4",
 		"@types/picomatch": "^4.0.2",
-		"@types/proxyquire": "^1.3.31",
 		"@types/shell-quote": "^1.7.5",
 		"@types/should": "^11.2.0",
 		"@types/sinon": "^21.0.0",
@@ -464,42 +436,41 @@
 		"c8": "^10.1.3",
 		"chai": "^4.3.10",
 		"chalk": "5.6.2",
-		"cross-env": "^10.1.0",
 		"dotenv": "^17.2.3",
 		"esbuild": "^0.25.0",
+		"glob": "^11.0.0",
 		"grpc-tools": "^1.13.0",
-		"husky": "^9.1.7",
 		"lint-staged": "^16.1.0",
 		"minimatch": "^3.0.3",
-		"npm-run-all": "^4.1.5",
-		"nyc": "^17.1.0",
+		"minimist": "^1.2.8",
+		"mocha": "^11.7.4",
+		"playwright": "^1.55.1",
 		"prebuild-install": "^7.1.3",
 		"protoc-gen-ts": "^0.8.7",
-		"proxyquire": "^2.1.3",
 		"rimraf": "^6.0.1",
 		"should": "^13.2.3",
 		"sinon": "^21.0.3",
+		"tar": "^7.5.2",
 		"tree-kill": "^1.2.2",
-		"ts-node": "^10.9.2",
 		"ts-proto": "^2.6.1",
 		"tsconfig-paths": "^4.2.0",
-		"typescript": "^5.4.5"
+		"typescript": "^5.4.5",
+		"vitest": "^4.0.17"
 	},
 	"dependencies": {
-		"@anthropic-ai/sdk": "^0.50.4",
-		"@anthropic-ai/vertex-sdk": "^0.11.5",
-		"@aws-sdk/client-bedrock-runtime": "^3.922.0",
-		"@aws-sdk/credential-providers": "^3.922.0",
-		"@azure/identity": "^4.13.0",
+		"@anthropic-ai/sdk": "^0.37.0",
 		"@bufbuild/protobuf": "^2.2.5",
-		"@cerebras/cerebras_cloud_sdk": "^1.35.0",
-		"@google-cloud/vertexai": "^1.9.3",
+		"@cline/agents": "workspace:*",
+		"@cline/core": "workspace:*",
+		"@cline/llms": "workspace:*",
+		"@cline/shared": "workspace:*",
 		"@google/genai": "^1.30.0",
 		"@grpc/grpc-js": "^1.9.15",
+		"@grpc/proto-loader": "^0.7.13",
 		"@grpc/reflection": "^1.0.4",
-		"@mistralai/mistralai": "^1.5.0",
 		"@modelcontextprotocol/sdk": "^1.25.1",
 		"@opentelemetry/api": "^1.9.0",
+		"@opentelemetry/api-logs": "^0.56.0",
 		"@opentelemetry/core": "^2.1.0",
 		"@opentelemetry/exporter-logs-otlp-grpc": "^0.56.0",
 		"@opentelemetry/exporter-logs-otlp-http": "^0.56.0",
@@ -519,9 +490,6 @@
 		"@opentelemetry/sdk-trace-node": "^1.30.1",
 		"@opentelemetry/semantic-conventions": "^1.37.0",
 		"@playwright/test": "^1.55.1",
-		"@sap-ai-sdk/ai-api": "^2.7.0",
-		"@sap-ai-sdk/orchestration": "^2.7.0",
-		"@sap-cloud-sdk/connectivity": "^4.6.0",
 		"@streamparser/json": "^0.0.22",
 		"@tailwindcss/vite": "^4.1.14",
 		"@types/uuid": "^10.0.0",
@@ -547,13 +515,15 @@
 		"ignore": "^7.0.3",
 		"image-size": "^2.0.2",
 		"isbinaryfile": "^5.0.2",
+		"js-yaml": "^4.1.1",
 		"jschardet": "^3.1.4",
 		"json5": "^2.2.3",
+		"jwt-decode": "^4.0.0",
 		"mammoth": "^1.11.0",
 		"nanoid": "^5.1.6",
 		"nice-grpc": "^2.1.12",
+		"nice-grpc-common": "^2.0.3",
 		"node-machine-id": "^1.1.12",
-		"ollama": "^0.5.13",
 		"open": "^10.1.2",
 		"open-graph-scraper": "^6.9.0",
 		"openai": "^6.21.0",
@@ -572,24 +542,13 @@
 		"simple-git": "3.36.0",
 		"strip-ansi": "^7.1.2",
 		"tailwindcss": "^4.1.14",
-		"tree-sitter-wasms": "^0.1.11",
 		"ts-morph": "^25.0.1",
 		"turndown": "^7.2.0",
 		"ulid": "^2.4.0",
 		"undici": "^7.26.0",
 		"uuid": "^11.1.0",
 		"vscode-uri": "^3.1.0",
-		"web-tree-sitter": "^0.22.6",
-		"zod": "^3.24.2"
-	},
-	"overrides": {
-		"tar-fs": ">=3.1.1",
-		"tar": "^7.5.2",
-		"vite": "^7.1.11",
-		"js-yaml": "^4.1.1",
-		"serialize-javascript": ">=7.0.3",
-		"protobufjs": "7.5.8",
-		"diff": "8.0.4"
+		"zod": "^4.3.6"
 	},
 	"c8": {
 		"reporter": [

apps/vscode/proto/cline/mcp.proto

@@ -12,16 +12,11 @@ service McpService {
   rpc toggleMcpServer(ToggleMcpServerRequest) returns (McpServers);
   rpc updateMcpTimeout(UpdateMcpTimeoutRequest) returns (McpServers);
   rpc addRemoteMcpServer(AddRemoteMcpServerRequest) returns (McpServers);
-  rpc downloadMcp(StringRequest) returns (McpDownloadResponse);
   rpc restartMcpServer(StringRequest) returns (McpServers);
   rpc deleteMcpServer(StringRequest) returns (McpServers);
   rpc toggleToolAutoApprove(ToggleToolAutoApproveRequest) returns (McpServers);
-  rpc refreshMcpMarketplace(EmptyRequest) returns (McpMarketplaceCatalog);
   rpc openMcpSettings(EmptyRequest) returns (Empty);
   rpc authenticateMcpServer(StringRequest) returns (Empty);
-
-  // Subscribe to MCP marketplace catalog updates
-  rpc subscribeToMcpMarketplaceCatalog(EmptyRequest) returns (stream McpMarketplaceCatalog);
   rpc getLatestMcpServers(Empty) returns (McpServers);
 
   // Subscribe to MCP server updates
@@ -114,40 +109,3 @@ message McpServer {
 message McpServers {
   repeated McpServer mcp_servers = 1;
 }
-
-message McpMarketplaceItem {
-  string mcp_id = 1;
-  string github_url = 2;
-  string name = 3;
-  string author = 4;
-  string description = 5;
-  string codicon_icon = 6;
-  string logo_url = 7;
-  string category = 8;
-  repeated string tags = 9;
-  bool requires_api_key = 10;
-  optional string readme_content = 11;
-  optional string llms_installation_content = 12;
-  bool is_recommended = 13;
-  int32 github_stars = 14;
-  int32 download_count = 15;
-  string created_at = 16;
-  string updated_at = 17;
-  string last_github_sync = 18;
-}
-
-message McpMarketplaceCatalog {
-  repeated McpMarketplaceItem items = 1;
-}
-
-message McpDownloadResponse {
-  string mcp_id = 1;
-  string github_url = 2;
-  string name = 3;
-  string author = 4;
-  string description = 5;
-  string readme_content = 6;
-  string llms_installation_content = 7;
-  bool requires_api_key = 8;
-  optional string error = 9;
-}

apps/vscode/proto/cline/models.proto

@@ -21,8 +21,6 @@ service ModelsService {
   rpc refreshOpenRouterModelsRpc(EmptyRequest) returns (OpenRouterCompatibleModelInfo);
   // Refreshes and returns recommended and free Cline models
   rpc refreshClineRecommendedModelsRpc(EmptyRequest) returns (ClineRecommendedModelsResponse);
-  // Refreshes and returns Cline provider models
-  rpc refreshClineModelsRpc(EmptyRequest) returns (OpenRouterCompatibleModelInfo);
   // Refreshes and returns Hugging Face models
   rpc refreshHuggingFaceModels(EmptyRequest) returns (OpenRouterCompatibleModelInfo);
   // Refreshes and returns OpenAI models
@@ -55,6 +53,18 @@ service ModelsService {
   rpc getAihubmixModels(EmptyRequest) returns (OpenRouterCompatibleModelInfo);
   // Refreshes and returns Vercel AI Gateway models
   rpc refreshVercelAiGatewayModelsRpc(EmptyRequest) returns (OpenRouterCompatibleModelInfo);
+  // Lists providers available from the unified SDK-backed catalog
+  rpc listProviders(Empty) returns (ProviderListingsResponse);
+  // Resolves model metadata for a provider through the unified SDK-backed catalog
+  rpc resolveProviderModels(ResolveProviderModelsRequest) returns (ProviderModelsResponse);
+  // Resolves model metadata for a provider/model without refreshing model lists
+  rpc resolveModelInfo(ResolveModelInfoRequest) returns (ResolveModelInfoResponse);
+  // Reads redacted effective provider configuration
+  rpc readProviderConfig(StringRequest) returns (ProviderConfigResponse);
+  // Writes provider configuration fields and returns redacted effective configuration
+  rpc writeProviderConfig(WriteProviderConfigRequest) returns (ProviderConfigResponse);
+  // Commits a mode-specific model selection atomically with its model metadata
+  rpc commitModelSelection(CommitModelSelectionRequest) returns (Empty);
 }
 
 // List of VS Code LM models
@@ -117,6 +127,142 @@ message OpenRouterCompatibleModelInfo {
   map<string, OpenRouterModelInfo> models = 1;
 }
 
+// Lightweight provider entry for the top-level model/provider picker.
+// Does not include the full model list; use resolveProviderModels for models.
+message ProviderListing {
+  string id = 1;
+  string name = 2;
+  optional string default_model_id = 3;
+  optional string family = 4;
+  optional string protocol = 5;
+  optional string auth_description = 6;
+  optional string base_url_description = 7;
+  bool allows_custom_model_ids = 8;
+
+  // SDK-driven hint for cost display. Values: "show" (default) or "hide".
+  // Sourced from `resolveProviderUsageCostDisplay(provider.metadata)` in
+  // `@cline/llms`. When "hide", consumers must suppress per-token pricing
+  // and total cost displays (matches the CLI's `shouldShowCliUsageCost`).
+  string usage_cost_display = 11;
+}
+
+message ProviderListingsResponse {
+  repeated ProviderListing providers = 1;
+}
+
+message ResolveProviderModelsRequest {
+  string provider_id = 1;
+  bool force_refresh = 2;
+  optional string request_id = 3;
+}
+
+message CatalogErrorInfo {
+  string kind = 1;
+  string message = 2;
+  optional string code = 3;
+  optional bool retryable = 4;
+}
+
+message ProviderModelsResponse {
+  string provider_id = 1;
+  string request_id = 2;
+  string config_fingerprint = 3;
+  int64 fetched_at = 4;
+  bool ok = 5;
+  map<string, OpenRouterModelInfo> models = 6;
+  optional string default_model_id = 7;
+  optional string source = 8;
+  optional CatalogErrorInfo error = 9;
+}
+
+message ResolveModelInfoRequest {
+  string provider_id = 1;
+  optional string model_id = 2;
+}
+
+message ResolveModelInfoResponse {
+  string provider_id = 1;
+  string model_id = 2;
+  optional OpenRouterModelInfo model_info = 3;
+  string source = 4;
+}
+
+message AwsProviderConfig {
+  optional string authentication = 1;
+  optional string profile = 2;
+  optional string access_key = 3;
+  int64 access_key_length = 4;
+  optional string secret_key = 5;
+  int64 secret_key_length = 6;
+  optional string session_token = 7;
+  int64 session_token_length = 8;
+  optional string endpoint = 9;
+  optional bool use_prompt_cache = 10;
+  optional string custom_model_base_id = 11;
+  optional bool use_cross_region_inference = 12;
+  optional bool use_global_inference = 13;
+}
+
+message GcpProviderConfig {
+  optional string project_id = 1;
+  optional string region = 2;
+}
+
+message ProviderConfigResponse {
+  string provider_id = 1;
+  optional string base_url = 2;
+  optional string api_line = 3;
+  map<string, string> headers = 4;
+  optional string region = 5;
+  int64 api_key_length = 6;
+  bool has_access_token = 7;
+  bool has_refresh_token = 8;
+  optional string account_id = 9;
+  optional CommittedModelSelection plan_selection = 10;
+  optional CommittedModelSelection act_selection = 11;
+  optional AwsProviderConfig aws = 12;
+  optional GcpProviderConfig gcp = 13;
+}
+
+message CommittedModelSelection {
+  string provider_id = 1;
+  string model_id = 2;
+  OpenRouterModelInfo model_info = 3;
+}
+
+message ProviderReasoningPatch {
+  optional bool enabled = 1;
+  optional string effort = 2; // "none" | "low" | "medium" | "high" | "xhigh"
+  optional int32 budget_tokens = 3;
+}
+
+message WriteProviderConfigPatch {
+  optional string api_key = 1;
+  optional string base_url = 2;
+  map<string, string> headers = 3;
+  optional string region = 4;
+  optional string api_line = 5;
+  optional string access_token = 6;
+  optional string refresh_token = 7;
+  optional string account_id = 8;
+  optional ProviderReasoningPatch reasoning = 9;
+  optional bool clear_headers = 10;
+  optional AwsProviderConfig aws = 11;
+  optional GcpProviderConfig gcp = 12;
+}
+
+message WriteProviderConfigRequest {
+  string provider_id = 1;
+  WriteProviderConfigPatch patch = 2;
+}
+
+message CommitModelSelectionRequest {
+  string provider_id = 1;
+  string mode = 2;
+  string model_id = 3;
+  OpenRouterModelInfo model_info = 4;
+}
+
 message ClineRecommendedModel {
   string id = 1;
   string name = 2;
@@ -467,6 +613,12 @@ enum ApiProvider {
   OPENAI_CODEX = 40;
   WANDB = 41;
   CLINE_PASS = 42;
+  POOLSIDE = 45;
+  V0 = 46;
+  XIAOMI = 47;
+  ZAI_CODING_PLAN = 49;
+  reserved 43, 44, 48;
+  reserved "OPENAI_CODEX_CLI", "OPENCODE", "KILO";
 }
 
 enum ApiFormat {

apps/vscode/proto/cline/remote_config.proto

@@ -0,0 +1,32 @@
+syntax = "proto3";
+
+package cline;
+
+import "cline/common.proto";
+
+option go_package = "github.com/cline/grpc-go/cline";
+option java_multiple_files = true;
+option java_package = "bot.cline.proto";
+
+enum RemoteConfigType {
+  RULE = 0;
+  WORKFLOW = 1;
+  SKILL = 2;
+}
+
+message RemoteConfigSetting {
+  RemoteConfigType type = 1;
+  string name = 2;
+  string content = 3;
+  bool enabled = 4;
+  bool locked = 5;
+}
+
+message RemoteConfigSettingsResponse {
+  repeated RemoteConfigSetting settings = 1;
+}
+
+service RemoteConfigService {
+  rpc getRemoteConfigSettings(Empty) returns (RemoteConfigSettingsResponse);
+  rpc toggleRemoteConfigSetting(StringRequest) returns (RemoteConfigSetting);
+}

apps/vscode/proto/cline/slash.proto

@@ -23,7 +23,7 @@ message SlashCommandInfo {
   string name = 1; // Command name without slash, e.g., "newtask", "smol"
   string description = 2; // Human-readable description
   string section = 3; // "default", "custom", or "cli"
-  bool cli_compatible = 4; // false for VS Code-only commands like explain-changes
+  bool cli_compatible = 4; // false for VS Code-only commands
 }
 
 // Response containing all available slash commands

apps/vscode/proto/cline/state.proto

@@ -250,7 +250,6 @@ message Settings {
   optional string default_terminal_profile = 137;
   optional int32 terminal_output_line_limit = 138;
   optional int32 max_consecutive_mistakes = 139;
-  optional bool strict_plan_mode_enabled = 141;
   optional bool yolo_mode_toggled = 142;
   optional bool use_auto_condense = 143;
   optional bool cline_web_tools_enabled = 144;
@@ -286,7 +285,6 @@ message Settings {
   optional string act_mode_cline_model_id = 180;
   optional OpenRouterModelInfo act_mode_cline_model_info = 181;
   optional bool show_feature_tips = 182;
-  optional bool lazy_teammate_mode_enabled = 183;
 }
 
 message State {
@@ -391,6 +389,7 @@ message UpdateSettingsRequest {
   reserved 15; // was openai_reasoning_effort (moved to mode-scoped reasoning effort)
   reserved 23; // was dictation_settings (dictation removed)
   reserved 38; // was skills_enabled (removed - now always enabled)
+  reserved 43; // was lazy_teammate_mode_enabled (removed)
 
   Metadata metadata = 1;
   optional ModelsApiConfiguration api_configuration = 2;
@@ -405,7 +404,7 @@ message UpdateSettingsRequest {
   optional int32 terminal_output_line_limit = 12;
   optional PlanActMode mode = 13;
   optional string preferred_language = 14;
-  optional bool strict_plan_mode_enabled = 16;
+  reserved 16; // was strict_plan_mode_enabled (removed)
   optional FocusChainSettings focus_chain_settings = 17;
   optional bool use_auto_condense = 18;
   optional string custom_prompt = 19;
@@ -429,7 +428,6 @@ message UpdateSettingsRequest {
   optional bool worktrees_enabled = 40;
   optional bool double_check_completion_enabled = 41;
   optional bool show_feature_tips = 42;
-  optional bool lazy_teammate_mode_enabled = 43;
 }
 
 message UpdateTerminalConnectionTimeoutRequest {
@@ -456,6 +454,11 @@ message OnboardingProgressRequest {
   optional string action = 2;
   optional bool completed = 3;
   optional string model_selected = 4;
+  optional string page = 5;
+  optional string page_variant = 6;
+  optional string user_type = 7;
+  optional int32 destination_step = 8;
+  optional string destination_page = 9;
 }
 
 message OnboardingModelGroup {

apps/vscode/proto/cline/task.proto

@@ -32,6 +32,8 @@ service TaskService {
   rpc getTaskHistory(GetTaskHistoryRequest) returns (TaskHistoryArray);
   // Sends a response to a previous ask operation
   rpc askResponse(AskResponseRequest) returns (Empty);
+  // Edits a previous user message, truncates following conversation, and regenerates
+  rpc editMessageAndRegenerate(EditMessageAndRegenerateRequest) returns (Empty);
   // Records task feedback (thumbs up/down)
   rpc taskFeedback(StringRequest) returns (Empty);
   // Shows task completion changes diff in a view
@@ -40,8 +42,6 @@ service TaskService {
   rpc executeQuickWin(ExecuteQuickWinRequest) returns (Empty);
   // Deletes all task history
   rpc deleteAllTaskHistory(EmptyRequest) returns (DeleteAllTaskHistoryCount);
-  // Explains changes with AI and adds inline comments to the diff view
-  rpc explainChanges(ExplainChangesRequest) returns (Empty);
 }
 
 // Request message for creating a new task
@@ -82,12 +82,14 @@ message GetTaskHistoryRequest {
   string search_query = 3;
   string sort_by = 4;
   bool current_workspace_only = 5;
+  int32 limit = 6;
+  int32 offset = 7;
 }
 
 // Response for task history
 message TaskHistoryArray {
   repeated TaskItem tasks = 1;
-  int32 total_count = 2;
+  bool has_more = 2;
 }
 
 // Task item details for history list
@@ -114,6 +116,16 @@ message AskResponseRequest {
   repeated string files = 5;
 }
 
+// Request for editing a past user message and regenerating the conversation after it
+message EditMessageAndRegenerateRequest {
+  Metadata metadata = 1;
+  int64 message_ts = 2;
+  string text = 3;
+  repeated string images = 4;
+  repeated string files = 5;
+  bool restore_workspace = 6;
+}
+
 // Request for executing a quick win task
 message ExecuteQuickWinRequest {
   Metadata metadata = 1;
@@ -125,10 +137,3 @@ message ExecuteQuickWinRequest {
 message DeleteAllTaskHistoryCount {
   int32 tasks_deleted = 1;
 }
-
-// Request for explaining changes with AI
-message ExplainChangesRequest {
-  Metadata metadata = 1;
-  // Timestamp of the completion message to explain changes for
-  int64 message_ts = 2;
-}

apps/vscode/proto/cline/ui.proto

@@ -67,7 +67,6 @@ enum ClineSay {
   INFO = 26;
   TASK_PROGRESS = 27;
   ERROR_RETRY = 28;
-  GENERATE_EXPLANATION = 29;
   HOOK_STATUS = 30;
   HOOK_OUTPUT_STREAM = 31;
   COMMAND_PERMISSION_DENIED = 32;
@@ -226,6 +225,12 @@ message ClineMessage {
   ClineAskNewTask ask_new_task = 21;
   ClineApiReqInfo api_req_info = 22;
   ClineModelInfo model_info = 23;
+
+  // Convergent-replica fields (see webview-message-state-design.md):
+  // seq = monotonic freshness (higher seq wins for the same ts/identity)
+  // epoch = conversation/replica fence (older epoch is dropped by the webview)
+  int64 seq = 24;
+  int64 epoch = 25;
 }
 
 message ShowWebviewEvent {

apps/vscode/scripts/build-proto.mjs

@@ -34,9 +34,26 @@ const GRPC_JS_OUT_DIR = path.resolve("src/generated/grpc-js")
 const NICE_JS_OUT_DIR = path.resolve("src/generated/nice-grpc")
 const DESCRIPTOR_OUT_DIR = path.resolve("dist-standalone/proto")
 
-const TS_PROTO_PLUGIN = isWindows
-	? path.resolve("node_modules/.bin/protoc-gen-ts_proto.cmd") // Use the .bin directory path for Windows
-	: require.resolve("ts-proto/protoc-gen-ts_proto")
+// protoc invokes the ts-proto plugin as a child process, so it needs a path it can
+// directly execute. On POSIX the package's JS bin (with its shebang) works. On
+// Windows protoc cannot exec a bare .js or bun's `.bunx` shim ("%1 is not a valid
+// Win32 application"), and the package manager's `.cmd` shim location/name varies
+// (npm vs bun's hoisted store). To be package-manager-agnostic, generate a tiny
+// .cmd wrapper that runs the resolved plugin JS via `node`.
+function resolveTsProtoPlugin() {
+	const pluginJs = require.resolve("ts-proto/protoc-gen-ts_proto")
+	if (!isWindows) {
+		return pluginJs
+	}
+	const wrapperDir = path.resolve("dist-standalone")
+	fsSync.mkdirSync(wrapperDir, { recursive: true })
+	const wrapperPath = path.join(wrapperDir, "protoc-gen-ts_proto.cmd")
+	// %* forwards protoc's plugin args/stdio to the JS entry run under node.
+	fsSync.writeFileSync(wrapperPath, `@echo off\r\nnode "${pluginJs}" %*\r\n`)
+	return wrapperPath
+}
+
+const TS_PROTO_PLUGIN = resolveTsProtoPlugin()
 
 const TS_PROTO_OPTIONS = [
 	"env=both",

apps/vscode/scripts/build-tests.js

@@ -1,5 +1,7 @@
 #!/usr/bin/env node
 const { execSync } = require("child_process")
+const fs = require("fs")
+const path = require("path")
 const esbuild = require("esbuild")
 
 const watch = process.argv.includes("--watch")
@@ -53,7 +55,43 @@ async function main() {
 	}
 }
 
-execSync("tsc -p ./tsconfig.test.json --outDir out", { encoding: "utf-8" })
+// tsc does not delete output for source/tests that were removed or are no longer
+// part of tsconfig.test.json. The VS Code test runner globs out/src/**/*.test.js,
+// so stale compiled tests can still run unless we clear the test build output first.
+fs.rmSync(path.join(__dirname, "..", "out", "src"), { recursive: true, force: true })
+fs.rmSync(path.join(__dirname, "..", "out", "packages"), { recursive: true, force: true })
+
+// Single source of truth for the bun-vs-integration test split: any *.test.ts that
+// imports from "bun:test" is owned by the bun runner (scripts/run-bun-unit-tests.ts)
+// and must NOT be compiled into the Node-based @vscode/test-cli `out/` tree (Node
+// cannot load the `bun:test` builtin, and these files use bun-only APIs like
+// `mock.module` / 3-arg `it`). Generate a tsconfig that excludes them so the
+// integration compile only ever sees mocha-owned tests.
+const projectRoot = path.join(__dirname, "..")
+const bunTestImport = /from\s+["']bun:test["']/
+function collectBunTestFiles(dir, acc) {
+	for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+		if (entry.name === "node_modules") continue
+		const full = path.join(dir, entry.name)
+		if (entry.isDirectory()) {
+			collectBunTestFiles(full, acc)
+		} else if (entry.isFile() && entry.name.endsWith(".test.ts")) {
+			if (bunTestImport.test(fs.readFileSync(full, "utf-8"))) {
+				acc.push(path.relative(projectRoot, full).split(path.sep).join("/"))
+			}
+		}
+	}
+	return acc
+}
+const bunOwnedTests = collectBunTestFiles(path.join(projectRoot, "src"), [])
+// tsconfig.test.json is JSONC (contains comments); parse with json5 (a project dep).
+const JSON5 = require("json5")
+const baseTestConfig = JSON5.parse(fs.readFileSync(path.join(projectRoot, "tsconfig.test.json"), "utf-8"))
+baseTestConfig.exclude = [...(baseTestConfig.exclude ?? []), ...bunOwnedTests]
+const generatedConfigPath = path.join(projectRoot, "tsconfig.test.generated.json")
+fs.writeFileSync(generatedConfigPath, JSON.stringify(baseTestConfig, null, "\t"))
+
+execSync(`tsc -p ${JSON.stringify(generatedConfigPath)} --outDir out`, { encoding: "utf-8" })
 
 main().catch((e) => {
 	console.error(e)

apps/vscode/scripts/find-dead-src.mjs

@@ -0,0 +1,129 @@
+// Dead-source finder: uses esbuild's own bundle reachability (the same analysis
+// that drives tree-shaking + minification mangling) to compute which src/ files
+// are reachable from BOTH shipped entry points:
+//   - src/extension.ts            (VS Code extension host)
+//   - src/standalone/cline-core.ts (standalone host used by JetBrains + CLI)
+//
+// A src/*.ts file that is NOT in the union of metafile inputs for those two
+// builds is unreachable from any shipped entry => dead (modulo dynamic import()
+// of computed specifiers, which esbuild surfaces separately).
+//
+// Run: node scripts/find-dead-src.mjs
+
+import fs from "node:fs"
+import path from "node:path"
+import { fileURLToPath } from "node:url"
+import * as esbuild from "esbuild"
+import { glob } from "glob"
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url))
+const root = path.resolve(__dirname, "..")
+
+const aliases = {
+	"@": path.join(root, "src"),
+	"@core": path.join(root, "src/core"),
+	"@integrations": path.join(root, "src/integrations"),
+	"@services": path.join(root, "src/services"),
+	"@shared": path.join(root, "src/shared"),
+	"@utils": path.join(root, "src/utils"),
+	"@packages": path.join(root, "src/packages"),
+}
+
+const aliasResolverPlugin = {
+	name: "alias-resolver",
+	setup(build) {
+		for (const [alias, aliasPath] of Object.entries(aliases)) {
+			const aliasRegex = new RegExp(`^${alias}($|/.*)`)
+			build.onResolve({ filter: aliasRegex }, (args) => {
+				const importPath = args.path.replace(alias, aliasPath)
+				const exts = [".ts", ".tsx", ".js", ".jsx"]
+				if (fs.existsSync(importPath)) {
+					const stats = fs.statSync(importPath)
+					if (stats.isDirectory()) {
+						for (const ext of exts) {
+							const idx = path.join(importPath, `index${ext}`)
+							if (fs.existsSync(idx)) return { path: idx }
+						}
+					} else {
+						return { path: importPath }
+					}
+				}
+				for (const ext of exts) {
+					if (fs.existsSync(`${importPath}${ext}`)) return { path: `${importPath}${ext}` }
+				}
+				return undefined
+			})
+		}
+	},
+}
+
+const common = {
+	bundle: true,
+	minify: false,
+	sourcemap: false,
+	logLevel: "silent",
+	format: "cjs",
+	platform: "node",
+	metafile: true,
+	write: false,
+	absWorkingDir: root,
+	tsconfig: path.join(root, "tsconfig.json"),
+	packages: "external",
+	plugins: [aliasResolverPlugin],
+	define: { "process.env.IS_DEV": "false", "process.env.IS_TEST": "false" },
+	banner: { js: "const _importMetaUrl=require('url').pathToFileURL(__filename)" },
+}
+
+async function inputsFor(entry, external) {
+	const r = await esbuild.build({ ...common, entryPoints: [entry], external })
+	return new Set(Object.keys(r.metafile.inputs).filter((f) => f.startsWith("src/") && /\.tsx?$/.test(f)))
+}
+
+const ext = await inputsFor("src/extension.ts", ["vscode"])
+const standalone = await inputsFor("src/standalone/cline-core.ts", [
+	"vscode",
+	"@grpc/reflection",
+	"grpc-health-check",
+	"better-sqlite3",
+])
+const live = new Set([...ext, ...standalone])
+
+// Third consumer: the webview (webview-ui/) is a separate Vite/React build that
+// imports extension code ONLY from src/shared (via "@shared/*" alias or relative
+// "../src/shared/*" paths). Any src/shared file referenced from webview-ui/src is
+// therefore live even if the extension-host/standalone bundles don't reach it.
+// Conservatively mark every src/shared file mentioned by the webview as live.
+const webviewFiles = await glob("webview-ui/src/**/*.{ts,tsx}", { cwd: root })
+const sharedMentionedByWebview = new Set()
+for (const wf of webviewFiles) {
+	const text = fs.readFileSync(path.join(root, wf), "utf8")
+	// Match @shared/X or .../src/shared/X import specifiers and map to src/shared/X
+	const re = /(?:@shared\/|src\/shared\/)([A-Za-z0-9_./-]+)/g
+	let m
+	while ((m = re.exec(text))) {
+		const rel = m[1].replace(/\.(ts|tsx|js|jsx)$/, "")
+		for (const cand of [`src/shared/${rel}.ts`, `src/shared/${rel}.tsx`, `src/shared/${rel}/index.ts`]) {
+			if (fs.existsSync(path.join(root, cand))) sharedMentionedByWebview.add(cand)
+		}
+	}
+}
+for (const f of sharedMentionedByWebview) live.add(f)
+console.log(`src/shared files referenced by webview: ${sharedMentionedByWebview.size}`)
+
+// All non-test, non-.d.ts source files on disk.
+const allSrc = (await glob("src/**/*.{ts,tsx}", { cwd: root }))
+	.filter((f) => !/\.test\.tsx?$/.test(f))
+	.filter((f) => !f.endsWith(".d.ts"))
+	.filter((f) => !f.includes("/__tests__/"))
+	.filter((f) => !f.startsWith("src/test/"))
+	.filter((f) => !f.startsWith("src/generated/")) // generated host glue
+	.filter((f) => !f.startsWith("src/dev/")) // dev-only tooling
+
+const dead = allSrc.filter((f) => !live.has(f)).sort()
+
+console.log(`extension inputs: ${ext.size}`)
+console.log(`standalone inputs: ${standalone.size}`)
+console.log(`union live src files: ${live.size}`)
+console.log(`candidate dead files: ${dead.length}`)
+fs.writeFileSync("/tmp/dead-src.json", JSON.stringify(dead, null, "\t"))
+console.log("--- dead candidates written to /tmp/dead-src.json ---")

apps/vscode/scripts/generate-state-proto.mjs

@@ -453,7 +453,7 @@ async function main() {
 	await fs.writeFile(STATE_PROTO_PATH, protoContent)
 	console.log(`Updated ${STATE_PROTO_PATH}`)
 
-	console.log("\nGeneration complete! Run 'npm run protos' to regenerate TypeScript from protos.")
+	console.log("\nGeneration complete! Run 'bun run protos' to regenerate TypeScript from protos.")
 }
 
 main().catch((error) => {

apps/vscode/scripts/interactive-playwright.ts

@@ -1,4 +1,4 @@
-#!/usr/bin/env npx tsx
+#!/usr/bin/env bun
 
 /**
  * Interactive Playwright launcher for the Cline VS Code extension.
@@ -15,10 +15,10 @@
  *
  * Usage:
  *   1. (Optional) Build and install the e2e extension:
- *        npm run test:e2e:build
+ *        bun run test:e2e:build
  *
  *   2. From the repo root, start the interactive session:
- *        npm run test:e2e:ui
+ *        bun run test:e2e:ui
  *
  *   3. VS Code will launch with the Cline extension loaded and gRPC recording enabled.
  *

apps/vscode/scripts/package-standalone.mjs

@@ -47,8 +47,13 @@ async function installNodeDependencies() {
 
 	await cpr(RUNTIME_DEPS_DIR, BUILD_DIR)
 
-	console.log("Running npm install in distribution directory...")
-	execSync("npm install", { stdio: "inherit", cwd: BUILD_DIR })
+	// This is an ISOLATED runtime install inside the standalone distribution
+	// directory (dist-standalone), driven by the "cline-core" runtime-files
+	// manifest — it is NOT part of the monorepo workspace install. TARGET_NODE_VERSION
+	// and the prebuild-install calls below target the Node ABI of the bundled
+	// runtime (matching the JetBrains-packaged Node), not the build tooling.
+	console.log("Running bun install in distribution directory...")
+	execSync("bun install", { stdio: "inherit", cwd: BUILD_DIR })
 
 	// Move the vscode directory into node_modules.
 	// It can't be installed using npm because it will create a symlink which cannot be unzipped correctly on windows.
@@ -92,7 +97,10 @@ async function packageAllBinaryDeps() {
 			const dest = path.join(binaryDir, module)
 			await cpr(src, dest)
 
-			// Download the binary libs
+			// Download the binary libs.
+			// `--target=${TARGET_NODE_VERSION}` selects the Node ABI of the bundled
+			// standalone runtime (NOT the bun/build tooling) so the prebuilt native
+			// `.node` binaries load in the Node that runs cline-core.
 			const v = IS_VERBOSE ? "--verbose" : ""
 			const cmd = `npx prebuild-install --platform=${platform} --arch=${arch} --target=${TARGET_NODE_VERSION} ${v}`
 			log_verbose(`${module}: ${cmd}`)

apps/vscode/scripts/publish-marketplace.mjs

@@ -37,13 +37,16 @@ process.on("SIGINT", cleanupOnSignal(130))
 process.on("SIGTERM", cleanupOnSignal(143))
 
 try {
-	const vsceArgs = ["publish", "--allow-package-secrets", "sendgrid"]
+	// --no-dependencies: the extension is fully esbuild-bundled into dist/extension.js,
+	// so vsce must not walk node_modules (the @cline/* workspace symlinks point out of
+	// the package and would drag the whole monorepo into the VSIX).
+	const vsceArgs = ["publish", "--no-dependencies", "--allow-package-secrets", "sendgrid"]
 	if (isPrerelease) {
 		vsceArgs.push("--pre-release")
 	}
 	execFileSync("vsce", vsceArgs, { stdio: "inherit" })
 
-	const ovsxArgs = ["ovsx", "publish"]
+	const ovsxArgs = ["ovsx", "publish", "--no-dependencies"]
 	if (isPrerelease) {
 		ovsxArgs.push("--pre-release")
 	}

apps/vscode/scripts/publish-nightly.mjs

@@ -35,9 +35,9 @@
  *   least as often as the scheduled release nightly runs.
  *
  * Usage:
- *   npm run publish:marketplace:nightly                    # release channel
- *   npm run publish:marketplace:nightly -- --pre-release   # pre-release channel
- *   npm run publish:marketplace:nightly -- --dry-run       # package only
+ *   bun run publish:marketplace:nightly                    # release channel
+ *   bun run publish:marketplace:nightly -- --pre-release   # pre-release channel
+ *   bun run publish:marketplace:nightly -- --dry-run       # package only
  *
  * Environment variables:
  *   VSCE_PAT  - Personal Access Token for VS Code Marketplace
@@ -388,6 +388,9 @@ class NightlyPublisher {
 		const args = [
 			"package",
 			...(isPreRelease ? ["--pre-release"] : []),
+			// The extension is fully esbuild-bundled, so vsce must not walk node_modules
+			// (the @cline/* workspace symlinks point outside the package).
+			"--no-dependencies",
 			"--no-update-package-json",
 			"--no-git-tag-version",
 			"--allow-package-secrets",
@@ -579,7 +582,7 @@ if (showHelp) {
 Nightly publish script for VS Code extension
 
 Usage:
-  npm run publish:marketplace:nightly [options]
+  bun run publish:marketplace:nightly [options]
 
 Options:
   --pre-release    Publish to the pre-release channel of cline-nightly.
@@ -593,10 +596,10 @@ Environment variables:
   OVSX_PAT         Personal Access Token for OpenVSX Registry
 
 Examples:
-  npm run publish:marketplace:nightly                      # Release channel publish
-  npm run publish:marketplace:nightly -- --pre-release     # Pre-release channel publish
-  npm run publish:marketplace:nightly -- --dry-run         # Package only
-  VSCE_PAT="token" npm run publish:marketplace:nightly     # Publish to VS Code only
+  bun run publish:marketplace:nightly                      # Release channel publish
+  bun run publish:marketplace:nightly -- --pre-release     # Pre-release channel publish
+  bun run publish:marketplace:nightly -- --dry-run         # Package only
+  VSCE_PAT="token" bun run publish:marketplace:nightly     # Publish to VS Code only
 `)
 	process.exit(0)
 }

apps/vscode/scripts/run-bun-tests.ts

@@ -0,0 +1,80 @@
+#!/usr/bin/env bun
+
+import { spawn } from "node:child_process"
+import path from "node:path"
+/**
+ * Runner for the SDK-adapter + model-catalog `bun test` suites (the same set
+ * `vitest.config.ts` covers; `test:vitest` runs them under vitest).
+ *
+ * Why a script instead of a bare `bun test <globs>`:
+ *
+ *  1. Curated include set. These suites are an explicit list (see
+ *     INCLUDE_PATTERNS, kept in sync with `vitest.config.ts` `test.include`),
+ *     not the whole tree, so the node-side unit and @vscode/test-cli suites are
+ *     not pulled in. `bun test`'s positional args don't expand `**` the way we
+ *     need, so we resolve the globs ourselves with bun's `Glob`.
+ *
+ *  2. One process per file. `bun test` runs all files in a single process by
+ *     default, so `mock.module(...)` registrations leak between files — suites
+ *     mocking the same specifier with different shapes (e.g.
+ *     `@/core/storage/StateManager`, `@cline/core`) clobber each other.
+ *     `--parallel` runs each file in its own worker process, giving each a fresh
+ *     module registry.
+ *
+ * Usage:
+ *   bun scripts/run-bun-tests.ts            # run the curated set, isolated
+ *   bun scripts/run-bun-tests.ts --list     # print the resolved file list only
+ */
+import { Glob } from "bun"
+
+// Mirror of vitest.config.ts `test.include`. Keep these in sync.
+const INCLUDE_PATTERNS = [
+	"src/sdk/**/*.test.ts",
+	"src/shared/vsCodeSelectorUtils.test.ts",
+	"src/core/storage/remote-config/**/*.test.ts",
+	"src/shared/model-catalog/provider-helpers.test.ts",
+	"src/core/controller/models/__tests__/providerCatalogHandlers.test.ts",
+	"src/core/controller/models/__tests__/providerSwitchNormalization.test.ts",
+	"src/core/controller/models/__tests__/resolveModelInfo.test.ts",
+	"src/core/controller/models/__tests__/providerCatalogSmoke.test.ts",
+	"src/core/controller/models/__tests__/refreshClineRecommendedModels.test.ts",
+]
+
+const projectRoot = path.resolve(import.meta.dir, "..")
+
+async function resolveFiles(): Promise<string[]> {
+	const seen = new Set<string>()
+	for (const pattern of INCLUDE_PATTERNS) {
+		const glob = new Glob(pattern)
+		for await (const match of glob.scan({ cwd: projectRoot, onlyFiles: true })) {
+			seen.add(match)
+		}
+	}
+	return [...seen].sort()
+}
+
+async function main(): Promise<void> {
+	const files = await resolveFiles()
+	if (files.length === 0) {
+		console.error("run-bun-tests: no test files matched the include patterns")
+		process.exit(1)
+	}
+
+	const passthrough = process.argv.slice(2)
+	if (passthrough.includes("--list")) {
+		console.log(files.join("\n"))
+		return
+	}
+
+	const args = ["test", "--parallel", ...passthrough.filter((arg) => arg !== "--list"), ...files]
+	const child = spawn("bun", args, { cwd: projectRoot, stdio: "inherit" })
+	child.on("exit", (code, signal) => {
+		if (signal) {
+			process.kill(process.pid, signal)
+			return
+		}
+		process.exit(code ?? 1)
+	})
+}
+
+void main()

apps/vscode/scripts/run-bun-unit-tests.ts

@@ -0,0 +1,198 @@
+#!/usr/bin/env bun
+
+import path from "node:path"
+/**
+ * Runner for the node-side `bun test` unit suites.
+ *
+ * A test file belongs to this runner iff it imports from "bun:test" (files that
+ * need the real VS Code extension host import from "mocha" and run under
+ * @vscode/test-cli instead). We glob all `*.test.ts` and keep only the
+ * bun:test ones; the SDK/model-catalog suites listed in IGNORED run through
+ * `run-bun-tests.ts`, so they're skipped here to avoid double-running.
+ *
+ * Why one process per file: `bun test --parallel <allFiles>` reuses a pool of
+ * worker processes, and `mock.module(...)` registrations accumulate across files
+ * sharing a worker. Suites that mock the same specifier with different shapes
+ * (e.g. `@core/storage/disk`, `@cline/core`, `fs/promises`, `os`) then clobber
+ * each other and fail only at scale. Spawning one `bun test` process per file
+ * (bounded by a small concurrency pool, via `Bun.spawn`) gives each file a fresh
+ * module registry.
+ *
+ * Usage:
+ *   bun scripts/run-bun-unit-tests.ts            # run the suite, isolated
+ *   bun scripts/run-bun-unit-tests.ts --list     # print the resolved file list
+ *   bun scripts/run-bun-unit-tests.ts --all      # include ELECTRON_HOST_ONLY
+ *   bun scripts/run-bun-unit-tests.ts -c 6       # concurrency (default 4)
+ */
+import { Glob } from "bun"
+
+const projectRoot = path.resolve(import.meta.dir, "..")
+
+// A file runs under `bun test` iff it imports "bun:test"; mocha-owned files are
+// skipped by the import filter in resolveFiles().
+const INCLUDE_PATTERNS = ["src/**/*.test.ts"]
+const BUN_TEST_IMPORT = /from\s+["']bun:test["']/
+
+// SDK + model-catalog suites run through `run-bun-tests.ts`; skip them here so
+// they aren't run twice.
+const IGNORED = new Set<string>([
+	"src/core/controller/models/__tests__/providerCatalogHandlers.test.ts",
+	"src/core/controller/models/__tests__/providerCatalogSmoke.test.ts",
+	"src/core/controller/models/__tests__/providerSwitchNormalization.test.ts",
+	"src/core/controller/models/__tests__/resolveModelInfo.test.ts",
+	"src/core/controller/models/__tests__/refreshClineRecommendedModels.test.ts",
+])
+
+// Files that require the real VSCode Electron host (@vscode/test-cli). Excluded
+// by default; they continue to run under @vscode/test-cli.
+const ELECTRON_HOST_ONLY = new Set<string>([])
+
+async function resolveFiles(includeHostOnly: boolean): Promise<string[]> {
+	const seen = new Set<string>()
+	for (const pattern of INCLUDE_PATTERNS) {
+		const glob = new Glob(pattern)
+		for await (const match of glob.scan({ cwd: projectRoot, onlyFiles: true })) {
+			const normalized = match.split(path.sep).join("/")
+			if (IGNORED.has(normalized)) {
+				continue
+			}
+			if (!includeHostOnly && ELECTRON_HOST_ONLY.has(normalized)) {
+				continue
+			}
+			// Only bun-runner-owned files (those importing "bun:test"). Files still on
+			// the @vscode/test-cli Electron host import from "mocha" and are skipped.
+			const source = await Bun.file(path.join(projectRoot, normalized)).text()
+			if (!BUN_TEST_IMPORT.test(source)) {
+				continue
+			}
+			seen.add(normalized)
+		}
+	}
+	return [...seen].sort()
+}
+
+type FileResult = {
+	file: string
+	code: number
+	pass: number
+	fail: number
+	output: string
+}
+
+// `bun test` prints its summary as e.g. " 12 pass\n  0 fail".
+function parseCounts(output: string): { pass: number; fail: number } {
+	let pass = 0
+	let fail = 0
+	for (const m of output.matchAll(/^\s*(\d+)\s+pass\b/gm)) {
+		pass += Number(m[1])
+	}
+	for (const m of output.matchAll(/^\s*(\d+)\s+fail\b/gm)) {
+		fail += Number(m[1])
+	}
+	return { pass, fail }
+}
+
+const PER_FILE_TIMEOUT_MS = 120_000
+
+async function runOne(file: string): Promise<FileResult> {
+	const proc = Bun.spawn(["bun", "test", file], {
+		cwd: projectRoot,
+		stdout: "pipe",
+		stderr: "pipe",
+		env: { ...process.env, FORCE_COLOR: "0" },
+	})
+	// Guard against a single hung file stalling the whole pool: kill it after a
+	// generous per-file budget and surface it as a failure.
+	let timedOut = false
+	const timer = setTimeout(() => {
+		timedOut = true
+		proc.kill()
+	}, PER_FILE_TIMEOUT_MS)
+	const [stdout, stderr, code] = await Promise.all([
+		new Response(proc.stdout).text(),
+		new Response(proc.stderr).text(),
+		proc.exited,
+	])
+	clearTimeout(timer)
+	const output = stdout + stderr + (timedOut ? `\n[runner] TIMEOUT after ${PER_FILE_TIMEOUT_MS}ms — killed\n` : "")
+	const { pass, fail } = parseCounts(output)
+	// A nonzero exit with no parsed counts (load/parse error, timeout) must count
+	// as a failure so the gate cannot pass silently.
+	const effectiveFail = timedOut && fail === 0 ? Math.max(fail, 1) : fail
+	return { file, code, pass, fail: effectiveFail, output }
+}
+
+async function runPool(files: string[], concurrency: number): Promise<FileResult[]> {
+	const results: FileResult[] = []
+	let next = 0
+	const launch = async (): Promise<void> => {
+		while (next < files.length) {
+			const file = files[next++]
+			const result = await runOne(file)
+			results.push(result)
+			const failed = result.fail > 0 || result.code !== 0
+			const status = failed ? "FAIL" : "ok"
+			const counts = `${result.pass} pass / ${result.fail} fail`
+			process.stdout.write(`[${results.length}/${files.length}] ${status.padEnd(4)} ${counts.padEnd(20)} ${file}\n`)
+			if (failed) {
+				process.stdout.write(result.output.trimEnd() + "\n")
+			}
+		}
+	}
+	const workers: Promise<void>[] = []
+	for (let i = 0; i < Math.min(concurrency, files.length); i++) {
+		workers.push(launch())
+	}
+	await Promise.all(workers)
+	return results
+}
+
+function parseConcurrency(argv: string[]): number {
+	const flagIdx = argv.findIndex((a) => a === "-c" || a === "--concurrency")
+	if (flagIdx !== -1 && argv[flagIdx + 1]) {
+		const n = Number(argv[flagIdx + 1])
+		if (Number.isFinite(n) && n > 0) {
+			return Math.floor(n)
+		}
+	}
+	return 4
+}
+
+async function main(): Promise<void> {
+	const passthrough = process.argv.slice(2)
+	const includeHostOnly = passthrough.includes("--all")
+	const files = await resolveFiles(includeHostOnly)
+	if (files.length === 0) {
+		console.error("run-bun-unit-tests: no test files matched")
+		process.exit(1)
+	}
+
+	if (passthrough.includes("--list")) {
+		console.log(files.join("\n"))
+		return
+	}
+
+	const concurrency = parseConcurrency(passthrough)
+	const started = Date.now()
+	console.log(`Running ${files.length} unit test files, isolated (concurrency ${concurrency})…\n`)
+
+	const results = await runPool(files, concurrency)
+
+	const totalPass = results.reduce((sum, r) => sum + r.pass, 0)
+	const totalFail = results.reduce((sum, r) => sum + r.fail, 0)
+	const failedFiles = results.filter((r) => r.fail > 0 || r.code !== 0).sort((a, b) => a.file.localeCompare(b.file))
+	const elapsed = ((Date.now() - started) / 1000).toFixed(1)
+
+	console.log("\n──────────────────────────────────────────────")
+	console.log(`Files: ${results.length}   Pass: ${totalPass}   Fail: ${totalFail}   Time: ${elapsed}s`)
+	if (failedFiles.length > 0) {
+		console.log(`\nFailing files (${failedFiles.length}):`)
+		for (const r of failedFiles) {
+			console.log(`  ${r.file}  (${r.pass} pass / ${r.fail} fail, exit ${r.code})`)
+		}
+		process.exit(1)
+	}
+	console.log("All unit test files passed.")
+}
+
+void main()

apps/vscode/scripts/run-extension-host.sh

@@ -18,11 +18,11 @@ fi
 
 # Step 1: Build protos (everything depends on this)
 echo "Building protos..."
-npm run protos || { echo "Protos build failed"; exit 1; }
+bun run protos || { echo "Protos build failed"; exit 1; }
 
 # Step 2: Build webview once
 echo "Building webview..."
-npm run build:webview || { echo "Webview build failed"; exit 1; }
+bun run build:webview || { echo "Webview build failed"; exit 1; }
 
 # Step 3: Kill existing session if one is running
 tmux kill-session -t "$SESSION" 2>/dev/null
@@ -44,9 +44,9 @@ tmux select-layout -t "$SESSION" even-horizontal
 # Ctrl+C kills the whole session
 tmux bind-key -T root C-c kill-session
 
-tmux send-keys -t "$SESSION:0.0" "npm run watch:esbuild" Enter
-tmux send-keys -t "$SESSION:0.1" "npm run watch:tsc" Enter
-tmux send-keys -t "$SESSION:0.2" "npm run dev:webview" Enter
+tmux send-keys -t "$SESSION:0.0" "bun run watch:esbuild" Enter
+tmux send-keys -t "$SESSION:0.1" "bun run watch:tsc" Enter
+tmux send-keys -t "$SESSION:0.2" "bun run dev:webview" Enter
 tmux send-keys -t "$SESSION:0.3" "while [ ! -f '$WORKSPACE/dist/extension.js' ]; do sleep 0.5; done && echo 'Launching Extension Host...' && code --extensionDevelopmentPath='$WORKSPACE' --disable-workspace-trust --disable-extension saoudrizwan.claude-dev --disable-extension saoudrizwan.cline-nightly '$WORKSPACE' && echo 'Extension Host launched.'" Enter
 
 # Attach to the session

apps/vscode/scripts/test-hostbridge-server.ts

@@ -1,4 +1,4 @@
-#!/usr/bin/env npx tsx
+#!/usr/bin/env bun
 import * as grpc from "@grpc/grpc-js"
 import { ReflectionService } from "@grpc/reflection"
 import * as health from "grpc-health-check"
@@ -87,6 +87,12 @@ function createMockService<T extends grpc.UntypedServiceImplementation>(serviceN
 						})
 						return
 
+					case "openExternal":
+						simulateOAuthBrowserCallback(call.request?.value || "")
+							.then(() => callback(null, {}))
+							.catch((error) => callback(error))
+						return
+
 					case "getWebviewHtml":
 						callback(null, {
 							html: "<html><body>Fake Webview</body></html>",
@@ -143,6 +149,41 @@ function createMockService<T extends grpc.UntypedServiceImplementation>(serviceN
 	return new Proxy({} as T, handler)
 }
 
+async function simulateOAuthBrowserCallback(urlString: string): Promise<void> {
+	let url: URL
+	try {
+		url = new URL(urlString)
+	} catch {
+		return
+	}
+
+	if (!isLoopbackHost(url.hostname) || url.pathname !== "/api/v1/auth/authorize") {
+		return
+	}
+
+	const callbackUrl = url.searchParams.get("callback_url") ?? url.searchParams.get("redirect_uri")
+	if (!callbackUrl) {
+		return
+	}
+
+	const callback = new URL(callbackUrl)
+	if (!isLoopbackHost(callback.hostname) || callback.pathname !== "/auth") {
+		return
+	}
+
+	callback.searchParams.set("code", "test-personal-token")
+	callback.searchParams.set("provider", "cline")
+
+	const response = await fetch(callback.toString())
+	if (!response.ok) {
+		throw new Error(`Mock OAuth callback failed: ${response.status} ${response.statusText}`)
+	}
+}
+
+function isLoopbackHost(hostname: string): boolean {
+	return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1"
+}
+
 if (require.main === module) {
 	startTestHostBridgeServer().catch((err) => {
 		console.error("Failed to start test host bridge server:", err)

apps/vscode/scripts/test-standalone-core-api-server.ts

@@ -1,4 +1,4 @@
-#!/usr/bin/env npx tsx
+#!/usr/bin/env bun
 
 /**
  * Simple Cline gRPC Server
@@ -7,13 +7,13 @@
  * without requiring the full installation, while automatically mocking all external services. Simply run:
  *
  *   # One-time setup (generates protobuf files)
- *	 npm run compile-standalone
- *   npm run test:sca-server
+ *	 bun run compile-standalone
+ *   bun run test:sca-server
  *
  * The following components are started automatically:
  *   1. HostBridge test server
  *   2. ClineApiServerMock (mock implementation of the Cline API)
- *   3. AuthServiceMock (activated if E2E_TEST="true")
+ *   3. SDK WorkOS device-auth flow, with WorkOS fetches mocked by testing-platform-workos-fetch-mock.cjs
  *
  * Environment Variables for Customization:
  *   PROJECT_ROOT - Override project root directory (default: parent of scripts dir)
@@ -22,7 +22,7 @@
  *   PROTOBUS_PORT - gRPC server port (default: 26040)
  *   HOSTBRIDGE_PORT - HostBridge server port (default: 26041)
  *   WORKSPACE_DIR - Working directory (default: current directory)
- *   E2E_TEST - Enable E2E test mode (default: true)
+ *   E2E_TEST - Enable legacy mock auth mode (default: false)
  *   CLINE_ENVIRONMENT - Environment setting (default: local)
  *
  * Ideal for local development, testing, or lightweight E2E scenarios.
@@ -38,7 +38,7 @@ import { ClineApiServerMock } from "../src/test/e2e/fixtures/server/index"
 const PROTOBUS_PORT = process.env.PROTOBUS_PORT || "26040"
 const HOSTBRIDGE_PORT = process.env.HOSTBRIDGE_PORT || "26041"
 const WORKSPACE_DIR = process.env.WORKSPACE_DIR || process.cwd()
-const E2E_TEST = process.env.E2E_TEST || "true"
+const E2E_TEST = process.env.E2E_TEST || "false"
 const CLINE_ENVIRONMENT = process.env.CLINE_ENVIRONMENT || "local"
 const USE_C8 = process.env.USE_C8 === "true"
 
@@ -66,7 +66,7 @@ async function main(): Promise<void> {
 		console.error("  CLINE_DIST_DIR - Override distribution directory")
 		console.error("  CLINE_CORE_FILE - Override core file name")
 		console.error("")
-		console.error("To build the standalone version, run: npm run compile-standalone")
+		console.error("To build the standalone version, run: bun run compile-standalone")
 		process.exit(1)
 	}
 
@@ -83,8 +83,8 @@ async function main(): Promise<void> {
 	const clineTestWorkspace = mkdtempSync(path.join(os.tmpdir(), "cline-test-workspace-"))
 
 	console.log("Starting HostBridge test server...")
-	const hostbridge: ChildProcess = spawn("npx", ["tsx", path.join(__dirname, "test-hostbridge-server.ts")], {
-		stdio: "pipe",
+	const hostbridge: ChildProcess = spawn("bun", [path.join(__dirname, "test-hostbridge-server.ts")], {
+		stdio: "inherit",
 		env: {
 			...process.env,
 			TEST_HOSTBRIDGE_WORKSPACE_DIR: clineTestWorkspace,
@@ -115,13 +115,16 @@ async function main(): Promise<void> {
 
 	const covDir = path.join(projectRoot, `coverage/coverage-core-${PROTOBUS_PORT}`)
 
-	const baseArgs = ["--enable-source-maps", path.join(distDir, "cline-core.js")]
+	const workosFetchMockPath = path.join(projectRoot, "scripts", "testing-platform-workos-fetch-mock.cjs")
+	const baseArgs = ["--enable-source-maps", "--require", workosFetchMockPath, path.join(distDir, "cline-core.js")]
 
-	const spawnArgs = USE_C8 ? ["c8", "--report-dir", covDir, "node", ...baseArgs] : ["node", ...baseArgs]
+	const c8Bin = path.join(projectRoot, "node_modules", ".bin", process.platform === "win32" ? "c8.cmd" : "c8")
+	const spawnCommand = USE_C8 ? c8Bin : "node"
+	const spawnArgs = USE_C8 ? ["--report-dir", covDir, "node", ...baseArgs] : baseArgs
 
 	console.log(`Starting Cline Core Service... (useC8=${USE_C8})`)
 
-	const coreService: ChildProcess = spawn("npx", spawnArgs, {
+	const coreService: ChildProcess = spawn(spawnCommand, spawnArgs, {
 		cwd: projectRoot,
 		env: {
 			...process.env,

apps/vscode/scripts/testing-platform-orchestrator.ts

@@ -1,15 +1,15 @@
-#!/usr/bin/env npx tsx
+#!/usr/bin/env bun
 /**
  * Test Orchestrator
  *
  * Automates server lifecycle for running spec files against the standalone server.
  *
  * Prerequisites:
- *   Build standalone first: `npm run compile-standalone`
+ *   Build standalone first: `bun run compile-standalone`
  *
  * Usage:
- *   - Single file:   `npm run test:tp-orchestrator path/to/spec.json`
- *   - All specs dir: `npm run test:tp-orchestrator tests/specs`
+ *   - Single file:   `bun run test:tp-orchestrator path/to/spec.json`
+ *   - All specs dir: `bun run test:tp-orchestrator tests/specs`
  *
  * Flags:
  *   --server-logs        Show server logs (hidden by default)
@@ -29,7 +29,7 @@ import kill from "tree-kill"
 let showServerLogs = false
 let fix = false
 let coverage = false
-const WAIT_SERVER_DEFAULT_TIMEOUT = 15000
+const WAIT_SERVER_DEFAULT_TIMEOUT = 60000
 const usedPorts = new Set<number>()
 
 /**
@@ -94,8 +94,10 @@ async function startServer(): Promise<{ server: ChildProcess; grpcPort: string }
 	const grpcPort = (await getAvailablePort()).toString()
 	const hostbridgePort = (await getAvailablePort()).toString()
 
-	const server = spawn("npx", ["tsx", "scripts/test-standalone-core-api-server.ts"], {
-		stdio: showServerLogs ? "inherit" : "pipe",
+	const server = spawn("bun", ["scripts/test-standalone-core-api-server.ts"], {
+		// When logs are hidden, ignore stdio instead of piping it without a reader:
+		// an unread pipe can fill and stall server startup/shutdown in CI.
+		stdio: showServerLogs ? "inherit" : "ignore",
 		env: {
 			...process.env,
 			PROTOBUS_PORT: grpcPort,
@@ -104,29 +106,50 @@ async function startServer(): Promise<{ server: ChildProcess; grpcPort: string }
 		},
 	})
 
-	// Wait for either the server to become ready or fail on spawn error
-	await Promise.race([
-		waitForPort(Number(grpcPort), "127.0.0.1", WAIT_SERVER_DEFAULT_TIMEOUT),
-		new Promise((_, reject) => server.once("error", reject)),
-	])
+	try {
+		// Wait for either the server to become ready or fail on spawn error.
+		await Promise.race([
+			waitForPort(Number(grpcPort), "127.0.0.1", WAIT_SERVER_DEFAULT_TIMEOUT),
+			new Promise((_, reject) => server.once("error", reject)),
+			new Promise((_, reject) =>
+				server.once("exit", (code, signal) => reject(new Error(`Server exited before ready: ${code ?? signal}`))),
+			),
+		])
+	} catch (error) {
+		await stopServer(server)
+		throw error
+	}
 
 	return { server, grpcPort }
 }
 
 function stopServer(server: ChildProcess): Promise<void> {
 	return new Promise((resolve) => {
-		if (!server.pid) return resolve()
+		if (!server.pid || server.exitCode !== null || server.signalCode !== null) return resolve()
 
+		let settled = false
+		const finish = () => {
+			if (!settled) {
+				settled = true
+				resolve()
+			}
+		}
+
+		server.once("exit", finish)
 		kill(server.pid, "SIGINT", (err) => {
 			if (err) console.warn("Failed to kill server process:", err)
-			server.once("exit", () => resolve())
 		})
+		setTimeout(() => {
+			if (!settled && server.pid) {
+				kill(server.pid, "SIGKILL", finish)
+			}
+		}, 5000).unref()
 	})
 }
 
 function runTestingPlatform(specFile: string, grpcPort: string): Promise<void> {
 	return new Promise((resolve, reject) => {
-		const testProcess = spawn("npx", ["ts-node", "index.ts", specFile, ...(fix ? ["--fix"] : [])], {
+		const testProcess = spawn("bun", ["index.ts", specFile, ...(fix ? ["--fix"] : [])], {
 			cwd: path.join(process.cwd(), "testing-platform"),
 			stdio: "inherit",
 			env: {
@@ -209,7 +232,7 @@ async function main() {
 
 	if (!inputPath) {
 		console.error(
-			"Usage: npx tsx scripts/testing-platform-orchestrator.ts <spec-file-or-folder> [--count=N] [--server-logs] [--fix] [--coverage]",
+			"Usage: bun scripts/testing-platform-orchestrator.ts <spec-file-or-folder> [--count=N] [--server-logs] [--fix] [--coverage]",
 		)
 		process.exit(1)
 	}

apps/vscode/scripts/testing-platform-workos-fetch-mock.cjs

@@ -0,0 +1,56 @@
+// Preload used by the standalone testing platform.
+// It makes the SDK WorkOS device-auth flow deterministic and fully local while
+// leaving production auth code on the same device-auth path used by users.
+
+const originalFetch = globalThis.fetch?.bind(globalThis)
+
+const WORKOS_ORIGIN = "https://api.workos.com"
+const DEVICE_CODE = "test-device-code"
+const USER_CODE = "PTBC-TXTP"
+const ACCESS_TOKEN = "test-personal-token"
+const REFRESH_TOKEN = "test-personal-token_refresh"
+
+function jsonResponse(body, init = {}) {
+	return new Response(JSON.stringify(body), {
+		status: init.status ?? 200,
+		headers: { "Content-Type": "application/json", ...(init.headers ?? {}) },
+	})
+}
+
+function inputUrl(input) {
+	if (typeof input === "string") return input
+	if (input instanceof URL) return input.toString()
+	if (input && typeof input === "object" && "url" in input) return input.url
+	return String(input)
+}
+
+globalThis.fetch = async (input, init) => {
+	const urlString = inputUrl(input)
+	let url
+	try {
+		url = new URL(urlString)
+	} catch {
+		return originalFetch(input, init)
+	}
+
+	if (url.origin === WORKOS_ORIGIN && url.pathname === "/user_management/authorize/device") {
+		return jsonResponse({
+			device_code: DEVICE_CODE,
+			user_code: USER_CODE,
+			verification_uri: "https://login.workos.test/device",
+			verification_uri_complete: `https://login.workos.test/device?user_code=${USER_CODE}`,
+			expires_in: 300,
+			interval: 1,
+		})
+	}
+
+	if (url.origin === WORKOS_ORIGIN && url.pathname === "/user_management/authenticate") {
+		return jsonResponse({
+			access_token: ACCESS_TOKEN,
+			refresh_token: REFRESH_TOKEN,
+			token_type: "Bearer",
+		})
+	}
+
+	return originalFetch(input, init)
+}

apps/vscode/src/__tests__/config.test.ts

@@ -1,9 +1,21 @@
-import { afterEach, beforeEach, describe, it } from "mocha"
+import { afterEach, beforeEach, describe, it, mock } from "bun:test"
 import "should"
 import fs from "fs/promises"
-import os from "os"
+import * as actualOs from "os"
 import path from "path"
 import sinon from "sinon"
+
+// The SUT does `import * as os from "os"; os.homedir()`. Under bun, sinon's
+// `stub(os, "homedir")` on the test's own `os` binding does NOT propagate to the
+// SUT's namespace import, so inject a module-level homedir stub via mock.module
+// (the rest of `os` — tmpdir() etc. — keeps its real behavior).
+const homedirStub = sinon.stub()
+const osMockNamespace = { ...actualOs, homedir: homedirStub }
+const osMock = () => ({ ...osMockNamespace, default: osMockNamespace })
+mock.module("os", osMock)
+mock.module("node:os", osMock)
+
+import os from "os"
 import { ClineConfigurationError, ClineEndpoint, ClineEnv, Environment } from "../config"
 
 describe("ClineEndpoint configuration", () => {
@@ -19,11 +31,10 @@ describe("ClineEndpoint configuration", () => {
 		// Create .cline directory
 		await fs.mkdir(path.join(tempDir, ".cline"), { recursive: true })
 
-		// Stub os.homedir to return our temp directory
+		// Stub os.homedir to return our temp directory (via mock.module homedirStub)
 		originalHomedir = os.homedir
-		sandbox
-			.stub(os, "homedir")
-			.returns(tempDir)
+		homedirStub.reset()
+		homedirStub.returns(tempDir)
 
 		// Reset the singleton state using internal method
 		;(ClineEndpoint as any)._instance = null

apps/vscode/src/common.ts

@@ -4,13 +4,13 @@ import "./utils/path" // necessary to have access to String.prototype.toPosix
 import { HostProvider } from "@/hosts/host-provider"
 import { Logger } from "@/shared/services/Logger"
 import type { StorageContext } from "@/shared/storage/storage-context"
-import { FileContextTracker } from "./core/context/context-tracking/FileContextTracker"
 import { clearOnboardingModelsCache } from "./core/controller/models/getClineOnboardingModels"
 import { HookDiscoveryCache } from "./core/hooks/HookDiscoveryCache"
 import { HookProcessRegistry } from "./core/hooks/HookProcessRegistry"
 import { StateManager } from "./core/storage/StateManager"
 import { AgentConfigLoader } from "./core/task/tools/subagent/AgentConfigLoader"
 import { ExtensionRegistryInfo } from "./registry"
+import { registerVsCodeLmHandler } from "./sdk/vscode-lm/register-vscode-lm"
 import { ErrorService } from "./services/error"
 import { featureFlagsService } from "./services/feature-flags"
 import { getDistinctId } from "./services/logging/distinctId"
@@ -52,6 +52,11 @@ export async function initialize(storageContext: StorageContext): Promise<Webvie
 		})
 	}
 
+	// Register host-only SDK provider handlers (e.g. VS Code Language Model API),
+	// which depend on the `vscode` module and cannot live in the SDK package.
+	// Must run before any handler is built (standalone utilities or task loop).
+	registerVsCodeLmHandler()
+
 	// =============== External services ===============
 	await ErrorService.initialize()
 	// Initialize PostHog client provider (skip in self-hosted mode)
@@ -74,8 +79,6 @@ export async function initialize(storageContext: StorageContext): Promise<Webvie
 	syncWorker().init({ ...blobStoreSettings, userDistinctId: getDistinctId() })
 	// Clean up old temp files in background (non-blocking) and start periodic cleanup every 24 hours
 	ClineTempManager.startPeriodicCleanup()
-	// Clean up orphaned file context warnings (startup cleanup)
-	FileContextTracker.cleanupOrphanedWarnings(stateManager)
 
 	telemetryService.captureExtensionActivated()
 
@@ -106,7 +109,7 @@ async function showVersionUpdateAnnouncement(stateManager: StateManager) {
 				})
 			}
 			// Always update the main version tracker for the next launch.
-			await stateManager.setGlobalState("clineVersion", currentVersion)
+			stateManager.setGlobalState("clineVersion", currentVersion)
 		}
 	} catch (error) {
 		const errorMessage = error instanceof Error ? error.message : String(error)

apps/vscode/src/config.ts

@@ -4,12 +4,11 @@ import * as path from "path"
 import { Environment, type EnvironmentConfig } from "./shared/config-types"
 import { Logger } from "./shared/services/Logger"
 
-export { Environment, type EnvironmentConfig }
-
-/**
+export { Environment } /**
  * Schema for the endpoints.json configuration file used in on-premise deployments.
  * All fields are required and must be valid URLs.
  */
+
 interface EndpointsFileSchema {
 	appBaseUrl: string
 	apiBaseUrl: string
@@ -36,7 +35,7 @@ class ClineEndpoint {
 	private onPremiseConfig: EndpointsFileSchema | null = null
 	private environment: Environment = Environment.production
 	// Track if config came from bundled file (enterprise distribution)
-	private isBundled: boolean = false
+	private isBundled = false
 
 	private constructor() {
 		// Set environment at module load. Use override if provided.

apps/vscode/src/core/api/adapters/diff-editors.ts

@@ -1,606 +0,0 @@
-import { ClineStorageMessage } from "@/shared/messages/content"
-
-const APPLY_PATCH_PATCH_REGEX = /\*\*\* Begin Patch\s+([\s\S]*?)\s+\*\*\* End Patch/m
-
-/**
- * Convert apply_patch tool calls to write_to_file and replace_in_file format
- */
-export function convertApplyPatchToolCalls(messages: Array<ClineStorageMessage>): Array<ClineStorageMessage> {
-	// Map to track tool_use_id to converted tool info and original input
-	const toolUseIdMap = new Map<string, { name: string; input: any; originalInput: any }>()
-
-	return messages.map((message) => {
-		if (!Array.isArray(message.content)) {
-			return message
-		}
-
-		const convertedContent = message.content.map((block) => {
-			// Handle tool_use blocks
-			if (block.type === "tool_use" && block.name === "apply_patch") {
-				const converted = convertApplyPatchToToolCalls(block.input)
-				// Store the conversion with original input for matching tool_result
-				toolUseIdMap.set(block.id, { ...converted, originalInput: block.input })
-
-				return {
-					...block,
-					name: converted.name,
-					input: converted.input,
-				}
-			}
-
-			// Handle tool_result blocks
-			if (block.type === "tool_result") {
-				const conversion = toolUseIdMap.get(block.tool_use_id)
-				if (conversion) {
-					// Reconstruct the tool_result content to match apply_patch format
-					const reconstructedContent = reconstructApplyPatchResult(
-						block,
-						conversion.name,
-						conversion.input,
-						conversion.originalInput,
-					)
-					return {
-						...block,
-						content: reconstructedContent,
-					}
-				}
-			}
-
-			return block
-		})
-
-		return {
-			...message,
-			content: convertedContent,
-		}
-	})
-}
-
-interface ConvertedTool {
-	name: string
-	input: any
-}
-
-/**
- * Parse apply_patch input and convert to write_to_file or replace_in_file format
- */
-function convertApplyPatchToToolCalls(input: any): ConvertedTool {
-	const patchInput = typeof input === "string" ? input : input?.input || ""
-
-	// Parse the patch format
-	const patchMatch = patchInput.match(APPLY_PATCH_PATCH_REGEX)
-	if (!patchMatch) {
-		// If we can't parse it, return as-is with write_to_file
-		return {
-			name: "write_to_file",
-			input: input,
-		}
-	}
-
-	const patchContent = patchMatch[1]
-
-	// Extract file operation (Add, Update, or Delete)
-	const fileMatch = patchContent.match(/\*\*\* (Add|Update|Delete) File: (.+?)(?:\n|$)/m)
-	if (!fileMatch) {
-		return {
-			name: "write_to_file",
-			input: input,
-		}
-	}
-
-	const action = fileMatch[1]
-	const filePath = fileMatch[2].trim()
-
-	// If it's an Add operation, convert to write_to_file
-	if (action === "Add") {
-		// Extract the content after the file line
-		const contentAfterFile = patchContent.substring(fileMatch.index! + fileMatch[0].length)
-		return {
-			name: "write_to_file",
-			input: {
-				absolutePath: filePath,
-				content: extractNewContentFromPatch(contentAfterFile),
-			},
-		}
-	}
-
-	// If it's Update or Delete, convert to replace_in_file
-	if (action === "Update" || action === "Delete") {
-		const diff = convertPatchToDiff(patchContent.substring(fileMatch.index! + fileMatch[0].length))
-		return {
-			name: "replace_in_file",
-			input: {
-				absolutePath: filePath,
-				diff: diff,
-			},
-		}
-	}
-
-	// Fallback
-	return {
-		name: "write_to_file",
-		input: input,
-	}
-}
-
-/**
- * Extract new content from add operation patch
- */
-function extractNewContentFromPatch(patchContent: string): string {
-	// For Add operations, the patch should contain lines starting with +
-	const lines = patchContent.split("\n")
-	const contentLines: string[] = []
-
-	for (const line of lines) {
-		if (line.startsWith("+")) {
-			// Remove the + prefix and exactly ONE space if present (but not if it's a tab)
-			let content = line.substring(1)
-			if (content.startsWith(" ") && !content.startsWith("\t")) {
-				content = content.substring(1)
-			}
-			contentLines.push(content)
-		}
-	}
-
-	return contentLines.join("\n")
-}
-
-/**
- * Convert V4A patch format to SEARCH/REPLACE format
- */
-function convertPatchToDiff(patchContent: string): string {
-	const diffBlocks: string[] = []
-	const lines = patchContent.split("\n")
-
-	let i = 0
-	while (i < lines.length) {
-		const line = lines[i]
-
-		// Skip empty lines at the start
-		if (!line.trim() && i === 0) {
-			i++
-			continue
-		}
-
-		// Check if this is the start of a hunk (@@) or a direct change line
-		if (line.trim().startsWith("@@") || line.startsWith("-") || line.startsWith("+")) {
-			const currentSearch: string[] = []
-			const currentReplace: string[] = []
-
-			// Collect @@ context marker lines
-			// @@ prefix marks context lines. If @@something, then "something" is context.
-			// If just @@, then it's an empty context line.
-			while (i < lines.length && lines[i].trim().startsWith("@@")) {
-				const trimmedLine = lines[i].trim()
-				// Extract the actual context content after @@
-				const contextLine = trimmedLine.substring(2)
-				// Always add the context line (even if empty)
-				currentSearch.push(contextLine)
-				currentReplace.push(contextLine)
-				i++
-			}
-
-			if (i >= lines.length) {
-				break
-			}
-
-			// Collect all remaining lines in this hunk until we hit end of content or next @@
-			const hunkLines: string[] = []
-			while (i < lines.length) {
-				// Check if this is a new hunk (starts with @@)
-				if (lines[i].trim().startsWith("@@")) {
-					break
-				}
-				hunkLines.push(lines[i])
-				i++
-			}
-
-			// Now process the hunk to build SEARCH/REPLACE
-			let hasChanges = false
-			for (let j = 0; j < hunkLines.length; j++) {
-				const hunkLine = hunkLines[j]
-
-				if (hunkLine.startsWith("-")) {
-					hasChanges = true
-					// Strip the - prefix and exactly ONE space if present (but not if it's a tab)
-					let content = hunkLine.substring(1)
-					if (content.startsWith(" ") && !content.startsWith(" \t")) {
-						content = content.substring(1)
-					}
-					currentSearch.push(content)
-				} else if (hunkLine.startsWith("+")) {
-					hasChanges = true
-					// Strip the + prefix and exactly ONE space if present (but not if it's a tab)
-					let content = hunkLine.substring(1)
-					if (content.startsWith(" ") && !content.startsWith(" \t")) {
-						content = content.substring(1)
-					}
-					currentReplace.push(content)
-				} else {
-					// Context line without @@ prefix - add to both sides
-					currentSearch.push(hunkLine)
-					currentReplace.push(hunkLine)
-				}
-			}
-
-			// Create the diff block if we have changes
-			if (hasChanges && (currentSearch.length > 0 || currentReplace.length > 0)) {
-				diffBlocks.push(
-					"------- SEARCH\n" +
-						currentSearch.join("\n") +
-						"\n=======\n" +
-						currentReplace.join("\n") +
-						"\n+++++++ REPLACE",
-				)
-			}
-		} else {
-			i++
-		}
-	}
-
-	return diffBlocks.join("\n")
-}
-
-/**
- * Reconstruct tool_result content to match apply_patch format by extracting
- * the final file content and converting it back to V4A patch format
- */
-function reconstructApplyPatchResult(
-	block: any,
-	convertedToolName: string,
-	_convertedInput: any,
-	originalInput: any,
-): string | any[] {
-	// Extract the content from the tool_result
-	const content = typeof block.content === "string" ? block.content : ""
-
-	// Try to extract the final_file_content
-	const finalContentMatch = content.match(/<final_file_content path="([^"]+)">\s*([\s\S]*?)\s*<\/final_file_content>/)
-
-	if (!finalContentMatch) {
-		// If no final_file_content found, return original content
-		return block.content
-	}
-
-	const filePath = finalContentMatch[1]
-	const finalContent = finalContentMatch[2]
-
-	// Reconstruct the result message based on the converted tool type
-	if (convertedToolName === "write_to_file") {
-		// For write_to_file, we just need to confirm the file was created/written
-		return `[apply_patch for '${filePath}'] Result:\nThe content was successfully saved to ${filePath}.\n\nThe file has been created/updated with the new content.`
-	}
-
-	if (convertedToolName === "replace_in_file") {
-		// For replace_in_file, we need to reconstruct the V4A patch format result
-		// Try to parse the original patch to get the action and build context
-		const patchInput = typeof originalInput === "string" ? originalInput : originalInput?.input || ""
-		const patchMatch = patchInput.match(APPLY_PATCH_PATCH_REGEX)
-
-		if (patchMatch) {
-			const patchContent = patchMatch[1]
-			const fileMatch = patchContent.match(/\*\*\* (Add|Update|Delete) File: (.+?)(?:\n|$)/m)
-
-			if (fileMatch) {
-				const action = fileMatch[1]
-				return `[apply_patch for '${filePath}'] Result:\nThe content was successfully updated in ${filePath}.\n\nThe file has been modified using ${action} operation.\n\n<final_file_content path="${filePath}">\n${finalContent}\n</final_file_content>\n\nIMPORTANT: For any future changes to this file, use the final_file_content shown above as your reference.`
-			}
-		}
-
-		// Fallback for replace_in_file
-		return `[apply_patch for '${filePath}'] Result:\nThe content was successfully updated in ${filePath}.\n\n<final_file_content path="${filePath}">\n${finalContent}\n</final_file_content>\n\nIMPORTANT: For any future changes to this file, use the final_file_content shown above as your reference.`
-	}
-
-	// Default fallback
-	return block.content
-}
-
-/**
- * Convert write_to_file and replace_in_file tool calls to apply_patch format
- */
-export function convertWriteToFileToolCalls(messages: Array<ClineStorageMessage>): Array<ClineStorageMessage> {
-	// Map to track tool_use_id to converted tool info and original input
-	const toolUseIdMap = new Map<string, { originalName: string; originalInput: any; patchInput?: string }>()
-
-	// First pass: collect tool_use blocks
-	for (const message of messages) {
-		if (!Array.isArray(message.content)) {
-			continue
-		}
-		for (const block of message.content) {
-			if (block.type === "tool_use" && (block.name === "write_to_file" || block.name === "replace_in_file")) {
-				toolUseIdMap.set(block.id, {
-					originalName: block.name,
-					originalInput: block.input,
-				})
-			}
-		}
-	}
-
-	// Second pass: find tool_results and extract final content to build proper patches
-	const finalContentMap = new Map<string, string>()
-	for (const message of messages) {
-		if (!Array.isArray(message.content)) {
-			continue
-		}
-		for (const block of message.content) {
-			if (block.type === "tool_result" && toolUseIdMap.has(block.tool_use_id)) {
-				const content = typeof block.content === "string" ? block.content : ""
-				const finalContentMatch = content.match(
-					/<final_file_content path="([^"]+)">\s*([\s\S]*?)\s*<\/final_file_content>/,
-				)
-				if (finalContentMatch) {
-					finalContentMap.set(block.tool_use_id, finalContentMatch[2])
-				}
-			}
-		}
-	}
-
-	// Third pass: convert messages
-	return messages.map((message) => {
-		if (!Array.isArray(message.content)) {
-			return message
-		}
-
-		const convertedContent = message.content.map((block) => {
-			// Handle tool_use blocks for write_to_file and replace_in_file
-			if (block.type === "tool_use" && (block.name === "write_to_file" || block.name === "replace_in_file")) {
-				const finalContent = finalContentMap.get(block.id)
-				const patchInput = convertToPatchFormat(block.name, block.input, finalContent)
-
-				// Update the map with the generated patch
-				const existingEntry = toolUseIdMap.get(block.id)
-				if (existingEntry) {
-					existingEntry.patchInput = patchInput
-				}
-
-				return {
-					...block,
-					name: "apply_patch",
-					input: {
-						input: patchInput,
-					},
-				}
-			}
-
-			// Handle tool_result blocks
-			if (block.type === "tool_result") {
-				const conversion = toolUseIdMap.get(block.tool_use_id)
-				if (conversion) {
-					// Reconstruct the tool_result content to match apply_patch format
-					const reconstructedContent = reconstructWriteToFileResult(
-						block,
-						conversion.originalName,
-						conversion.originalInput,
-					)
-					return {
-						...block,
-						content: reconstructedContent,
-					}
-				}
-			}
-
-			return block
-		})
-
-		return {
-			...message,
-			content: convertedContent,
-		}
-	})
-}
-
-/**
- * Convert write_to_file or replace_in_file input to apply_patch format
- */
-function convertToPatchFormat(toolName: string, input: any, finalContent?: string): string {
-	const filePath = input.absolutePath || input.path || ""
-
-	if (toolName === "write_to_file") {
-		// Convert write_to_file to Add operation
-		const content = input.content || ""
-		const lines = content.split("\n")
-		const patchLines = ["@@"]
-		patchLines.push(...lines.map((line: string) => `+ ${line}`))
-
-		return `apply_patch <<"EOF"
-*** Begin Patch
-*** Add File: ${filePath}
-${patchLines.join("\n")}
-*** End Patch
-EOF`
-	}
-
-	if (toolName === "replace_in_file") {
-		// Convert replace_in_file to Update operation
-		const diff = input.diff || ""
-
-		// Parse SEARCH/REPLACE blocks and convert to V4A format with context
-		const patchContent = convertDiffToPatchWithContext(diff, finalContent)
-
-		return `apply_patch <<"EOF"
-*** Begin Patch
-*** Update File: ${filePath}
-${patchContent}
-*** End Patch
-EOF`
-	}
-
-	return ""
-}
-
-/**
- * Convert SEARCH/REPLACE diff format to V4A patch format with additional context from final content
- */
-function convertDiffToPatchWithContext(diff: string, finalContent?: string): string {
-	const patchLines: string[] = []
-
-	// Match all SEARCH/REPLACE blocks
-	const blockRegex = /------- SEARCH\s*\n([\s\S]*?)\n=======\s*\n([\s\S]*?)\n\+{7} REPLACE/g
-	let match
-
-	while ((match = blockRegex.exec(diff)) !== null) {
-		const searchContent = match[1]
-		const replaceContent = match[2]
-
-		const searchLines = searchContent.split("\n")
-		const replaceLines = replaceContent.split("\n")
-
-		// Find common prefix and suffix between search and replace
-		let prefixEnd = 0
-		while (
-			prefixEnd < searchLines.length &&
-			prefixEnd < replaceLines.length &&
-			searchLines[prefixEnd] === replaceLines[prefixEnd]
-		) {
-			prefixEnd++
-		}
-
-		let suffixStart = searchLines.length
-		let replaceSuffixStart = replaceLines.length
-		while (
-			suffixStart > prefixEnd &&
-			replaceSuffixStart > prefixEnd &&
-			searchLines[suffixStart - 1] === replaceLines[replaceSuffixStart - 1]
-		) {
-			suffixStart--
-			replaceSuffixStart--
-		}
-
-		// If we have finalContent, extract additional context from it
-		if (finalContent) {
-			const finalLines = finalContent.split("\n")
-
-			// Find where the replaced content appears in the final file
-			let matchIndex = -1
-			for (let i = 0; i < finalLines.length; i++) {
-				// Try to match the first replace line
-				if (replaceLines.length > 0 && finalLines[i] === replaceLines[0]) {
-					// Check if subsequent lines also match
-					let allMatch = true
-					for (let j = 1; j < replaceLines.length && i + j < finalLines.length; j++) {
-						if (finalLines[i + j] !== replaceLines[j]) {
-							allMatch = false
-							break
-						}
-					}
-					if (allMatch) {
-						matchIndex = i
-						break
-					}
-				}
-			}
-
-			if (matchIndex >= 0) {
-				// Extract up to 3 lines before as context
-				const contextStart = Math.max(0, matchIndex - 3)
-				const contextLines: string[] = []
-				for (let i = contextStart; i < matchIndex; i++) {
-					contextLines.push(finalLines[i])
-				}
-
-				// Pad to 3 lines if needed (with empty strings)
-				while (contextLines.length < 3) {
-					contextLines.unshift("")
-				}
-
-				// Add @@ marker with the first context line
-				if (contextLines[0] === "") {
-					patchLines.push("@@")
-				} else {
-					patchLines.push(`@@${contextLines[0]}`)
-				}
-
-				// Add remaining context lines (without @@ marker)
-				for (let i = 1; i < contextLines.length; i++) {
-					patchLines.push(contextLines[i])
-				}
-
-				// Add common prefix lines (without +/- markers)
-				for (let i = 0; i < prefixEnd; i++) {
-					patchLines.push(searchLines[i])
-				}
-
-				// Add the actual changes (lines that differ)
-				for (let i = prefixEnd; i < suffixStart; i++) {
-					patchLines.push(`- ${searchLines[i]}`)
-				}
-				for (let i = prefixEnd; i < replaceSuffixStart; i++) {
-					patchLines.push(`+ ${replaceLines[i]}`)
-				}
-
-				// Add common suffix lines (without +/- markers)
-				for (let i = suffixStart; i < searchLines.length; i++) {
-					patchLines.push(searchLines[i])
-				}
-
-				// Extract up to 3 lines after as trailing context (without @@ markers)
-				const contextEnd = Math.min(finalLines.length, matchIndex + replaceLines.length + 3)
-				for (let i = matchIndex + replaceLines.length; i < contextEnd; i++) {
-					patchLines.push(finalLines[i])
-				}
-
-				continue
-			}
-		}
-
-		// Fallback: if no finalContent or couldn't find match, use the prefix/suffix from SEARCH/REPLACE
-		patchLines.push("@@")
-
-		// Add common prefix lines (without +/- markers)
-		for (let i = 0; i < prefixEnd; i++) {
-			patchLines.push(searchLines[i])
-		}
-
-		// Add the actual changes (lines that differ)
-		for (let i = prefixEnd; i < suffixStart; i++) {
-			patchLines.push(`- ${searchLines[i]}`)
-		}
-		for (let i = prefixEnd; i < replaceSuffixStart; i++) {
-			patchLines.push(`+ ${replaceLines[i]}`)
-		}
-
-		// Add common suffix lines (without +/- markers)
-		for (let i = suffixStart; i < searchLines.length; i++) {
-			patchLines.push(searchLines[i])
-		}
-	}
-
-	return patchLines.join("\n")
-}
-
-/**
- * Reconstruct tool_result content to match apply_patch result format
- */
-function reconstructWriteToFileResult(block: any, originalToolName: string, originalInput: any): string | any[] {
-	// Extract the content from the tool_result
-	const content = typeof block.content === "string" ? block.content : ""
-
-	// Try to extract the final_file_content
-	const finalContentMatch = content.match(/<final_file_content path="([^"]+)">\s*([\s\S]*?)\s*<\/final_file_content>/)
-
-	const filePath = originalInput.absolutePath || originalInput.path || ""
-
-	if (!finalContentMatch) {
-		// If no final_file_content found, create a simple success message
-		if (originalToolName === "write_to_file") {
-			return `[apply_patch for '${filePath}'] Result:\nThe content was successfully saved to ${filePath}.\n\nThe file has been created/updated with the new content.`
-		} else {
-			return `[apply_patch for '${filePath}'] Result:\nThe content was successfully updated in ${filePath}.\n\nThe file has been modified.`
-		}
-	}
-
-	const finalContent = finalContentMatch[2]
-
-	// Reconstruct the result message based on the original tool type
-	if (originalToolName === "write_to_file") {
-		return `[apply_patch for '${filePath}'] Result:\nThe content was successfully saved to ${filePath}.\n\nThe file has been created/updated with the new content.`
-	}
-
-	if (originalToolName === "replace_in_file") {
-		return `[apply_patch for '${filePath}'] Result:\nThe content was successfully updated in ${filePath}.\n\nThe file has been modified using Update operation.\n\n<final_file_content path="${filePath}">\n${finalContent}\n</final_file_content>\n\nIMPORTANT: For any future changes to this file, use the final_file_content shown above as your reference.`
-	}
-
-	// Default fallback
-	return block.content
-}

apps/vscode/src/core/api/adapters/index.ts

@@ -1,60 +0,0 @@
-import { ClineStorageMessage } from "@/shared/messages/content"
-import { ClineDefaultTool } from "@/shared/tools"
-import { convertApplyPatchToolCalls, convertWriteToFileToolCalls } from "./diff-editors"
-
-/**
- * Transforms tool call messages between different tool formats based on native tool support.
- * Converts between apply_patch and write_to_file/replace_in_file formats as needed.
- *
- * @param clineMessages - Array of messages containing tool calls to transform
- * @param nativeTools - Array of tools natively supported by the current provider
- * @returns Transformed messages array, or original if no transformation needed
- */
-export function transformToolCallMessages(
-	clineMessages: ClineStorageMessage[],
-	nativeTools?: ClineDefaultTool[],
-): ClineStorageMessage[] {
-	// Early return if no messages or native tools provided
-	if (!clineMessages?.length || !nativeTools?.length) {
-		return clineMessages
-	}
-
-	// Create Sets for O(1) lookup performance
-	const nativeToolSet = new Set(nativeTools)
-	const usedToolSet = new Set<string>()
-
-	// Single pass: collect all tools used in assistant messages
-	for (const msg of clineMessages) {
-		if (msg.role === "assistant" && Array.isArray(msg.content)) {
-			for (const block of msg.content) {
-				if (block.type === "tool_use" && block.name) {
-					usedToolSet.add(block.name)
-				}
-			}
-		}
-	}
-
-	// Early return if no tools were used
-	if (usedToolSet.size === 0) {
-		return clineMessages
-	}
-
-	// Determine which conversion to apply
-	const hasApplyPatchNative = nativeToolSet.has(ClineDefaultTool.APPLY_PATCH)
-	const hasFileEditNative = nativeToolSet.has(ClineDefaultTool.FILE_EDIT) || nativeToolSet.has(ClineDefaultTool.FILE_NEW)
-
-	const hasApplyPatchUsed = usedToolSet.has(ClineDefaultTool.APPLY_PATCH)
-	const hasFileEditUsed = usedToolSet.has(ClineDefaultTool.FILE_EDIT) || usedToolSet.has(ClineDefaultTool.FILE_NEW)
-
-	// Convert write_to_file/replace_in_file → apply_patch
-	if (hasApplyPatchNative && hasFileEditUsed) {
-		return convertWriteToFileToolCalls(clineMessages)
-	}
-
-	// Convert apply_patch → write_to_file/replace_in_file
-	if (hasFileEditNative && hasApplyPatchUsed) {
-		return convertApplyPatchToolCalls(clineMessages)
-	}
-
-	return clineMessages
-}

apps/vscode/src/core/api/index.ts

@@ -1,67 +1,18 @@
-import { ApiConfiguration, clinePassDefaultModelId, ModelInfo, QwenApiRegions, resolveClinePassModelInfo } from "@shared/api"
+import { ModelInfo } from "@shared/api"
 import { Mode } from "@shared/storage/types"
-import { featureFlagsService } from "@/services/feature-flags"
-import { ClineStorageMessage } from "@/shared/messages/content"
-import { FeatureFlag } from "@/shared/services/feature-flags/feature-flags"
-import { Logger } from "@/shared/services/Logger"
-import { ClineTool } from "@/shared/tools"
-import { AIhubmixHandler } from "./providers/aihubmix"
-import { AnthropicHandler } from "./providers/anthropic"
-import { AskSageHandler } from "./providers/asksage"
-import { BasetenHandler } from "./providers/baseten"
-import { AwsBedrockHandler } from "./providers/bedrock"
-import { CerebrasHandler } from "./providers/cerebras"
-import { ClaudeCodeHandler } from "./providers/claude-code"
-import { ClineHandler } from "./providers/cline"
-import { DeepSeekHandler } from "./providers/deepseek"
-import { DifyHandler } from "./providers/dify"
-import { DoubaoHandler } from "./providers/doubao"
-import { FireworksHandler } from "./providers/fireworks"
-import { GeminiHandler } from "./providers/gemini"
-import { GroqHandler } from "./providers/groq"
-import { HicapHandler } from "./providers/hicap"
-import { HuaweiCloudMaaSHandler } from "./providers/huawei-cloud-maas"
-import { HuggingFaceHandler } from "./providers/huggingface"
-import { LiteLlmHandler } from "./providers/litellm"
-import { LmStudioHandler } from "./providers/lmstudio"
-import { MinimaxHandler } from "./providers/minimax"
-import { MistralHandler } from "./providers/mistral"
-import { MoonshotHandler } from "./providers/moonshot"
-import { NebiusHandler } from "./providers/nebius"
-import { NousResearchHandler } from "./providers/nousresearch"
-import { OcaHandler } from "./providers/oca"
-import { OllamaHandler } from "./providers/ollama"
-import { OpenAiHandler } from "./providers/openai"
-import { OpenAiCodexHandler } from "./providers/openai-codex"
-import { OpenAiNativeHandler } from "./providers/openai-native"
-import { OpenRouterHandler } from "./providers/openrouter"
-import { QwenHandler } from "./providers/qwen"
-import { QwenCodeHandler } from "./providers/qwen-code"
-import { RequestyHandler } from "./providers/requesty"
-import { SambanovaHandler } from "./providers/sambanova"
-import { SapAiCoreHandler } from "./providers/sapaicore"
-import { TogetherHandler } from "./providers/together"
-import { VercelAIGatewayHandler } from "./providers/vercel-ai-gateway"
-import { VertexHandler } from "./providers/vertex"
-import { VsCodeLmHandler } from "./providers/vscode-lm"
-import { WandbHandler } from "./providers/wandb"
-import { XAIHandler } from "./providers/xai"
-import { ZAiHandler } from "./providers/zai"
-import { ApiStream, ApiStreamUsageChunk } from "./transform/stream"
 
-export type CommonApiHandlerOptions = {
-	onRetryAttempt?: ApiConfiguration["onRetryAttempt"]
-}
-export interface ApiHandler {
-	createMessage(systemPrompt: string, messages: ClineStorageMessage[], tools?: ClineTool[], useResponseApi?: boolean): ApiStream
-	getModel(): ApiHandlerModel
-	getApiStreamUsage?(): Promise<ApiStreamUsageChunk | undefined>
-	abort?(): void
-}
+// buildApiHandler now routes inference through the Cline SDK. It lives in
+// apps/vscode/src/sdk/sdk-api-handler.ts and callers import it directly from
+// there. It is deliberately NOT re-exported here: this barrel is imported
+// widely for *types* only, and re-exporting a value from the SDK module would
+// pull the entire SDK/session-factory runtime graph into every type importer
+// at module-eval time (which can break extension activation). Keep this file
+// types-only.
 
 export interface ApiHandlerModel {
 	id: string
 	info: ModelInfo
+	providerId?: string
 }
 
 export interface ApiProviderInfo {
@@ -70,467 +21,3 @@ export interface ApiProviderInfo {
 	mode: Mode
 	customPrompt?: string // "compact"
 }
-
-export interface SingleCompletionHandler {
-	completePrompt(prompt: string): Promise<string>
-}
-
-function createHandlerForProvider(
-	apiProvider: string | undefined,
-	options: Omit<ApiConfiguration, "apiProvider">,
-	mode: Mode,
-): ApiHandler {
-	const effectiveApiProvider =
-		apiProvider === "cline-pass" && !featureFlagsService.getBooleanFlagEnabled(FeatureFlag.CLINE_PASS) ? "cline" : apiProvider
-
-	switch (effectiveApiProvider) {
-		case "anthropic":
-			return new AnthropicHandler({
-				onRetryAttempt: options.onRetryAttempt,
-				apiKey: options.apiKey,
-				anthropicBaseUrl: options.anthropicBaseUrl,
-				apiModelId: mode === "plan" ? options.planModeApiModelId : options.actModeApiModelId,
-				reasoningEffort: mode === "plan" ? options.planModeReasoningEffort : options.actModeReasoningEffort,
-				thinkingBudgetTokens:
-					mode === "plan" ? options.planModeThinkingBudgetTokens : options.actModeThinkingBudgetTokens,
-			})
-		case "openrouter":
-			return new OpenRouterHandler({
-				onRetryAttempt: options.onRetryAttempt,
-				openRouterApiKey: options.openRouterApiKey,
-				openRouterModelId: mode === "plan" ? options.planModeOpenRouterModelId : options.actModeOpenRouterModelId,
-				openRouterModelInfo: mode === "plan" ? options.planModeOpenRouterModelInfo : options.actModeOpenRouterModelInfo,
-				openRouterProviderSorting: options.openRouterProviderSorting,
-				reasoningEffort: mode === "plan" ? options.planModeReasoningEffort : options.actModeReasoningEffort,
-				thinkingBudgetTokens:
-					mode === "plan" ? options.planModeThinkingBudgetTokens : options.actModeThinkingBudgetTokens,
-				enableParallelToolCalling: options.enableParallelToolCalling,
-			})
-		case "bedrock":
-			return new AwsBedrockHandler({
-				onRetryAttempt: options.onRetryAttempt,
-				apiModelId: mode === "plan" ? options.planModeApiModelId : options.actModeApiModelId,
-				awsAccessKey: options.awsAccessKey,
-				awsSecretKey: options.awsSecretKey,
-				awsSessionToken: options.awsSessionToken,
-				awsRegion: options.awsRegion,
-				awsAuthentication: options.awsAuthentication,
-				awsBedrockApiKey: options.awsBedrockApiKey,
-				awsUseCrossRegionInference: options.awsUseCrossRegionInference,
-				awsUseGlobalInference: options.awsUseGlobalInference,
-				awsBedrockUsePromptCache: options.awsBedrockUsePromptCache,
-				awsUseProfile: options.awsUseProfile,
-				awsProfile: options.awsProfile,
-				awsBedrockEndpoint: options.awsBedrockEndpoint,
-				awsBedrockCustomSelected:
-					mode === "plan" ? options.planModeAwsBedrockCustomSelected : options.actModeAwsBedrockCustomSelected,
-				awsBedrockCustomModelBaseId:
-					mode === "plan" ? options.planModeAwsBedrockCustomModelBaseId : options.actModeAwsBedrockCustomModelBaseId,
-				reasoningEffort: mode === "plan" ? options.planModeReasoningEffort : options.actModeReasoningEffort,
-				thinkingBudgetTokens:
-					mode === "plan" ? options.planModeThinkingBudgetTokens : options.actModeThinkingBudgetTokens,
-			})
-		case "vertex":
-			return new VertexHandler({
-				onRetryAttempt: options.onRetryAttempt,
-				vertexProjectId: options.vertexProjectId,
-				vertexRegion: options.vertexRegion,
-				apiModelId: mode === "plan" ? options.planModeApiModelId : options.actModeApiModelId,
-				thinkingBudgetTokens:
-					mode === "plan" ? options.planModeThinkingBudgetTokens : options.actModeThinkingBudgetTokens,
-				geminiApiKey: options.geminiApiKey,
-				geminiBaseUrl: options.geminiBaseUrl,
-				reasoningEffort: mode === "plan" ? options.planModeReasoningEffort : options.actModeReasoningEffort,
-				ulid: options.ulid,
-			})
-		case "openai":
-			return new OpenAiHandler({
-				onRetryAttempt: options.onRetryAttempt,
-				openAiApiKey: options.openAiApiKey,
-				openAiBaseUrl: options.openAiBaseUrl,
-				azureApiVersion: options.azureApiVersion,
-				azureIdentity: options.azureIdentity,
-				openAiHeaders: options.openAiHeaders,
-				openAiModelId: mode === "plan" ? options.planModeOpenAiModelId : options.actModeOpenAiModelId,
-				openAiModelInfo: mode === "plan" ? options.planModeOpenAiModelInfo : options.actModeOpenAiModelInfo,
-				reasoningEffort: mode === "plan" ? options.planModeReasoningEffort : options.actModeReasoningEffort,
-			})
-		case "ollama":
-			return new OllamaHandler({
-				onRetryAttempt: options.onRetryAttempt,
-				ollamaBaseUrl: options.ollamaBaseUrl,
-				ollamaApiKey: options.ollamaApiKey,
-				ollamaModelId: mode === "plan" ? options.planModeOllamaModelId : options.actModeOllamaModelId,
-				ollamaApiOptionsCtxNum: options.ollamaApiOptionsCtxNum,
-				requestTimeoutMs: options.requestTimeoutMs,
-			})
-		case "lmstudio":
-			return new LmStudioHandler({
-				onRetryAttempt: options.onRetryAttempt,
-				lmStudioBaseUrl: options.lmStudioBaseUrl,
-				lmStudioModelId: mode === "plan" ? options.planModeLmStudioModelId : options.actModeLmStudioModelId,
-				lmStudioMaxTokens: options.lmStudioMaxTokens,
-			})
-		case "gemini":
-			return new GeminiHandler({
-				onRetryAttempt: options.onRetryAttempt,
-				vertexProjectId: options.vertexProjectId,
-				vertexRegion: options.vertexRegion,
-				geminiApiKey: options.geminiApiKey,
-				geminiBaseUrl: options.geminiBaseUrl,
-				thinkingBudgetTokens:
-					mode === "plan" ? options.planModeThinkingBudgetTokens : options.actModeThinkingBudgetTokens,
-				reasoningEffort: mode === "plan" ? options.planModeReasoningEffort : options.actModeReasoningEffort,
-				apiModelId: mode === "plan" ? options.planModeApiModelId : options.actModeApiModelId,
-				ulid: options.ulid,
-			})
-		case "openai-native":
-			return new OpenAiNativeHandler({
-				onRetryAttempt: options.onRetryAttempt,
-				openAiNativeApiKey: options.openAiNativeApiKey,
-				reasoningEffort: mode === "plan" ? options.planModeReasoningEffort : options.actModeReasoningEffort,
-				apiModelId: mode === "plan" ? options.planModeApiModelId : options.actModeApiModelId,
-				thinkingBudgetTokens:
-					mode === "plan" ? options.planModeThinkingBudgetTokens : options.actModeThinkingBudgetTokens,
-			})
-		case "openai-codex":
-			return new OpenAiCodexHandler({
-				onRetryAttempt: options.onRetryAttempt,
-				reasoningEffort: mode === "plan" ? options.planModeReasoningEffort : options.actModeReasoningEffort,
-				apiModelId: mode === "plan" ? options.planModeApiModelId : options.actModeApiModelId,
-			})
-		case "deepseek":
-			return new DeepSeekHandler({
-				onRetryAttempt: options.onRetryAttempt,
-				deepSeekApiKey: options.deepSeekApiKey,
-				apiModelId: mode === "plan" ? options.planModeApiModelId : options.actModeApiModelId,
-			})
-		case "requesty":
-			return new RequestyHandler({
-				onRetryAttempt: options.onRetryAttempt,
-				requestyBaseUrl: options.requestyBaseUrl,
-				requestyApiKey: options.requestyApiKey,
-				reasoningEffort: mode === "plan" ? options.planModeReasoningEffort : options.actModeReasoningEffort,
-				thinkingBudgetTokens:
-					mode === "plan" ? options.planModeThinkingBudgetTokens : options.actModeThinkingBudgetTokens,
-				requestyModelId: mode === "plan" ? options.planModeRequestyModelId : options.actModeRequestyModelId,
-				requestyModelInfo: mode === "plan" ? options.planModeRequestyModelInfo : options.actModeRequestyModelInfo,
-			})
-		case "fireworks":
-			return new FireworksHandler({
-				onRetryAttempt: options.onRetryAttempt,
-				fireworksApiKey: options.fireworksApiKey,
-				fireworksModelId: mode === "plan" ? options.planModeFireworksModelId : options.actModeFireworksModelId,
-			})
-		case "together":
-			return new TogetherHandler({
-				onRetryAttempt: options.onRetryAttempt,
-				togetherApiKey: options.togetherApiKey,
-				togetherModelId: mode === "plan" ? options.planModeTogetherModelId : options.actModeTogetherModelId,
-			})
-		case "qwen":
-			return new QwenHandler({
-				onRetryAttempt: options.onRetryAttempt,
-				qwenApiKey: options.qwenApiKey,
-				qwenApiLine:
-					options.qwenApiLine === QwenApiRegions.INTERNATIONAL ? QwenApiRegions.INTERNATIONAL : QwenApiRegions.CHINA,
-				apiModelId: mode === "plan" ? options.planModeApiModelId : options.actModeApiModelId,
-				thinkingBudgetTokens:
-					mode === "plan" ? options.planModeThinkingBudgetTokens : options.actModeThinkingBudgetTokens,
-			})
-		case "qwen-code":
-			return new QwenCodeHandler({
-				onRetryAttempt: options.onRetryAttempt,
-				qwenCodeOauthPath: options.qwenCodeOauthPath,
-				apiModelId: mode === "plan" ? options.planModeApiModelId : options.actModeApiModelId,
-			})
-		case "doubao":
-			return new DoubaoHandler({
-				onRetryAttempt: options.onRetryAttempt,
-				doubaoApiKey: options.doubaoApiKey,
-				apiModelId: mode === "plan" ? options.planModeApiModelId : options.actModeApiModelId,
-			})
-		case "mistral":
-			return new MistralHandler({
-				onRetryAttempt: options.onRetryAttempt,
-				mistralApiKey: options.mistralApiKey,
-				apiModelId: mode === "plan" ? options.planModeApiModelId : options.actModeApiModelId,
-			})
-		case "vscode-lm":
-			return new VsCodeLmHandler({
-				onRetryAttempt: options.onRetryAttempt,
-				vsCodeLmModelSelector:
-					mode === "plan" ? options.planModeVsCodeLmModelSelector : options.actModeVsCodeLmModelSelector,
-			})
-		case "cline": {
-			const configuredClineModelId = mode === "plan" ? options.planModeClineModelId : options.actModeClineModelId
-			const configuredClineModelInfo = mode === "plan" ? options.planModeClineModelInfo : options.actModeClineModelInfo
-			const clineModelId =
-				configuredClineModelId || (mode === "plan" ? options.planModeOpenRouterModelId : options.actModeOpenRouterModelId)
-			const clineModelInfo =
-				configuredClineModelInfo ||
-				(mode === "plan" ? options.planModeOpenRouterModelInfo : options.actModeOpenRouterModelInfo)
-			return new ClineHandler({
-				onRetryAttempt: options.onRetryAttempt,
-				clineAccountId: options.clineAccountId,
-				clineApiKey: options.clineApiKey,
-				ulid: options.ulid,
-				reasoningEffort: mode === "plan" ? options.planModeReasoningEffort : options.actModeReasoningEffort,
-				thinkingBudgetTokens:
-					mode === "plan" ? options.planModeThinkingBudgetTokens : options.actModeThinkingBudgetTokens,
-				openRouterProviderSorting: options.openRouterProviderSorting,
-				openRouterModelId: clineModelId,
-				openRouterModelInfo: clineModelInfo,
-				enableParallelToolCalling: options.enableParallelToolCalling,
-			})
-		}
-		case "cline-pass": {
-			const configuredClinePassModelId =
-				mode === "plan" ? options.planModeClinePassModelId : options.actModeClinePassModelId
-			const configuredClinePassModelInfo =
-				mode === "plan" ? options.planModeClinePassModelInfo : options.actModeClinePassModelInfo
-			const clineModelId = configuredClinePassModelId?.startsWith("cline-pass/")
-				? configuredClinePassModelId
-				: clinePassDefaultModelId
-			const clineModelInfo = configuredClinePassModelInfo || resolveClinePassModelInfo(clineModelId)
-			return new ClineHandler({
-				onRetryAttempt: options.onRetryAttempt,
-				clineAccountId: options.clineAccountId,
-				clineApiKey: options.clineApiKey,
-				ulid: options.ulid,
-				reasoningEffort: mode === "plan" ? options.planModeReasoningEffort : options.actModeReasoningEffort,
-				thinkingBudgetTokens:
-					mode === "plan" ? options.planModeThinkingBudgetTokens : options.actModeThinkingBudgetTokens,
-				openRouterProviderSorting: options.openRouterProviderSorting,
-				openRouterModelId: clineModelId,
-				openRouterModelInfo: clineModelInfo,
-				enableParallelToolCalling: options.enableParallelToolCalling,
-			})
-		}
-		case "litellm":
-			return new LiteLlmHandler({
-				onRetryAttempt: options.onRetryAttempt,
-				liteLlmApiKey: options.liteLlmApiKey,
-				liteLlmBaseUrl: options.liteLlmBaseUrl,
-				liteLlmModelId: mode === "plan" ? options.planModeLiteLlmModelId : options.actModeLiteLlmModelId,
-				liteLlmModelInfo: mode === "plan" ? options.planModeLiteLlmModelInfo : options.actModeLiteLlmModelInfo,
-				reasoningEffort: mode === "plan" ? options.planModeReasoningEffort : options.actModeReasoningEffort,
-				thinkingBudgetTokens:
-					mode === "plan" ? options.planModeThinkingBudgetTokens : options.actModeThinkingBudgetTokens,
-				liteLlmUsePromptCache: options.liteLlmUsePromptCache,
-				ulid: options.ulid,
-			})
-		case "moonshot":
-			return new MoonshotHandler({
-				onRetryAttempt: options.onRetryAttempt,
-				moonshotApiKey: options.moonshotApiKey,
-				moonshotApiLine: options.moonshotApiLine,
-				apiModelId: mode === "plan" ? options.planModeApiModelId : options.actModeApiModelId,
-			})
-		case "huggingface":
-			return new HuggingFaceHandler({
-				onRetryAttempt: options.onRetryAttempt,
-				huggingFaceApiKey: options.huggingFaceApiKey,
-				huggingFaceModelId: mode === "plan" ? options.planModeHuggingFaceModelId : options.actModeHuggingFaceModelId,
-				huggingFaceModelInfo:
-					mode === "plan" ? options.planModeHuggingFaceModelInfo : options.actModeHuggingFaceModelInfo,
-			})
-		case "nebius":
-			return new NebiusHandler({
-				onRetryAttempt: options.onRetryAttempt,
-				nebiusApiKey: options.nebiusApiKey,
-				apiModelId: mode === "plan" ? options.planModeApiModelId : options.actModeApiModelId,
-			})
-		case "asksage":
-			return new AskSageHandler({
-				onRetryAttempt: options.onRetryAttempt,
-				asksageApiKey: options.asksageApiKey,
-				asksageApiUrl: options.asksageApiUrl,
-				apiModelId: mode === "plan" ? options.planModeApiModelId : options.actModeApiModelId,
-			})
-		case "xai":
-			return new XAIHandler({
-				onRetryAttempt: options.onRetryAttempt,
-				xaiApiKey: options.xaiApiKey,
-				reasoningEffort: mode === "plan" ? options.planModeReasoningEffort : options.actModeReasoningEffort,
-				apiModelId: mode === "plan" ? options.planModeApiModelId : options.actModeApiModelId,
-			})
-		case "sambanova":
-			return new SambanovaHandler({
-				onRetryAttempt: options.onRetryAttempt,
-				sambanovaApiKey: options.sambanovaApiKey,
-				apiModelId: mode === "plan" ? options.planModeApiModelId : options.actModeApiModelId,
-			})
-		case "cerebras":
-			return new CerebrasHandler({
-				onRetryAttempt: options.onRetryAttempt,
-				cerebrasApiKey: options.cerebrasApiKey,
-				apiModelId: mode === "plan" ? options.planModeApiModelId : options.actModeApiModelId,
-			})
-		case "groq":
-			return new GroqHandler({
-				onRetryAttempt: options.onRetryAttempt,
-				groqApiKey: options.groqApiKey,
-				groqModelId: mode === "plan" ? options.planModeGroqModelId : options.actModeGroqModelId,
-				groqModelInfo: mode === "plan" ? options.planModeGroqModelInfo : options.actModeGroqModelInfo,
-				apiModelId: mode === "plan" ? options.planModeApiModelId : options.actModeApiModelId,
-			})
-		case "baseten":
-			return new BasetenHandler({
-				onRetryAttempt: options.onRetryAttempt,
-				basetenApiKey: options.basetenApiKey,
-				basetenModelId: mode === "plan" ? options.planModeBasetenModelId : options.actModeBasetenModelId,
-				basetenModelInfo: mode === "plan" ? options.planModeBasetenModelInfo : options.actModeBasetenModelInfo,
-				apiModelId: mode === "plan" ? options.planModeApiModelId : options.actModeApiModelId,
-			})
-		case "sapaicore":
-			return new SapAiCoreHandler({
-				onRetryAttempt: options.onRetryAttempt,
-				sapAiCoreClientId: options.sapAiCoreClientId,
-				sapAiCoreClientSecret: options.sapAiCoreClientSecret,
-				sapAiCoreTokenUrl: options.sapAiCoreTokenUrl,
-				sapAiResourceGroup: options.sapAiResourceGroup,
-				sapAiCoreBaseUrl: options.sapAiCoreBaseUrl,
-				apiModelId: mode === "plan" ? options.planModeApiModelId : options.actModeApiModelId,
-				thinkingBudgetTokens:
-					mode === "plan" ? options.planModeThinkingBudgetTokens : options.actModeThinkingBudgetTokens,
-				reasoningEffort: mode === "plan" ? options.planModeReasoningEffort : options.actModeReasoningEffort,
-				deploymentId: mode === "plan" ? options.planModeSapAiCoreDeploymentId : options.actModeSapAiCoreDeploymentId,
-				sapAiCoreUseOrchestrationMode: options.sapAiCoreUseOrchestrationMode,
-			})
-		case "claude-code":
-			return new ClaudeCodeHandler({
-				onRetryAttempt: options.onRetryAttempt,
-				claudeCodePath: options.claudeCodePath,
-				apiModelId: mode === "plan" ? options.planModeApiModelId : options.actModeApiModelId,
-				thinkingBudgetTokens:
-					mode === "plan" ? options.planModeThinkingBudgetTokens : options.actModeThinkingBudgetTokens,
-			})
-		case "huawei-cloud-maas":
-			return new HuaweiCloudMaaSHandler({
-				onRetryAttempt: options.onRetryAttempt,
-				huaweiCloudMaasApiKey: options.huaweiCloudMaasApiKey,
-				huaweiCloudMaasModelId:
-					mode === "plan" ? options.planModeHuaweiCloudMaasModelId : options.actModeHuaweiCloudMaasModelId,
-				huaweiCloudMaasModelInfo:
-					mode === "plan" ? options.planModeHuaweiCloudMaasModelInfo : options.actModeHuaweiCloudMaasModelInfo,
-			})
-		case "dify": // Add Dify.ai handler
-			return new DifyHandler({
-				difyApiKey: options.difyApiKey,
-				difyBaseUrl: options.difyBaseUrl,
-			})
-		case "vercel-ai-gateway":
-			return new VercelAIGatewayHandler({
-				onRetryAttempt: options.onRetryAttempt,
-				vercelAiGatewayApiKey: options.vercelAiGatewayApiKey,
-				openRouterModelId:
-					mode === "plan" ? options.planModeVercelAiGatewayModelId : options.actModeVercelAiGatewayModelId,
-				openRouterModelInfo:
-					mode === "plan" ? options.planModeVercelAiGatewayModelInfo : options.actModeVercelAiGatewayModelInfo,
-				reasoningEffort: mode === "plan" ? options.planModeReasoningEffort : options.actModeReasoningEffort,
-				thinkingBudgetTokens:
-					mode === "plan" ? options.planModeThinkingBudgetTokens : options.actModeThinkingBudgetTokens,
-			})
-		case "zai":
-			return new ZAiHandler({
-				onRetryAttempt: options.onRetryAttempt,
-				zaiApiLine: options.zaiApiLine,
-				zaiApiKey: options.zaiApiKey,
-				apiModelId: mode === "plan" ? options.planModeApiModelId : options.actModeApiModelId,
-			})
-		case "oca":
-			return new OcaHandler({
-				ocaMode: options.ocaMode || "internal",
-				ocaBaseUrl: options.ocaBaseUrl,
-				ocaModelId: mode === "plan" ? options.planModeOcaModelId : options.actModeOcaModelId,
-				ocaModelInfo: mode === "plan" ? options.planModeOcaModelInfo : options.actModeOcaModelInfo,
-				ocaReasoningEffort: mode === "plan" ? options.planModeOcaReasoningEffort : options.actModeOcaReasoningEffort,
-				thinkingBudgetTokens:
-					mode === "plan" ? options.planModeThinkingBudgetTokens : options.actModeThinkingBudgetTokens,
-				ocaUsePromptCache:
-					mode === "plan"
-						? options.planModeOcaModelInfo?.supportsPromptCache
-						: options.actModeOcaModelInfo?.supportsPromptCache,
-				taskId: options.ulid,
-			})
-		case "aihubmix":
-			return new AIhubmixHandler({
-				onRetryAttempt: options.onRetryAttempt,
-				apiKey: options.aihubmixApiKey,
-				baseURL: options.aihubmixBaseUrl,
-				appCode: options.aihubmixAppCode,
-				modelId: mode === "plan" ? (options as any).planModeAihubmixModelId : (options as any).actModeAihubmixModelId,
-				modelInfo:
-					mode === "plan" ? (options as any).planModeAihubmixModelInfo : (options as any).actModeAihubmixModelInfo,
-			})
-		case "minimax":
-			return new MinimaxHandler({
-				onRetryAttempt: options.onRetryAttempt,
-				minimaxApiKey: options.minimaxApiKey,
-				minimaxApiLine: options.minimaxApiLine,
-				apiModelId: mode === "plan" ? options.planModeApiModelId : options.actModeApiModelId,
-				thinkingBudgetTokens:
-					mode === "plan" ? options.planModeThinkingBudgetTokens : options.actModeThinkingBudgetTokens,
-			})
-		case "hicap":
-			return new HicapHandler({
-				onRetryAttempt: options.onRetryAttempt,
-				hicapApiKey: options.hicapApiKey,
-				hicapModelId: mode === "plan" ? options.planModeHicapModelId : options.actModeHicapModelId,
-			})
-		case "nousResearch":
-			return new NousResearchHandler({
-				onRetryAttempt: options.onRetryAttempt,
-				nousResearchApiKey: options.nousResearchApiKey,
-				apiModelId: mode === "plan" ? options.planModeNousResearchModelId : options.actModeNousResearchModelId,
-			})
-		case "wandb":
-			return new WandbHandler({
-				onRetryAttempt: options.onRetryAttempt,
-				wandbApiKey: options.wandbApiKey,
-				apiModelId: mode === "plan" ? options.planModeApiModelId : options.actModeApiModelId,
-			})
-		default:
-			return new AnthropicHandler({
-				onRetryAttempt: options.onRetryAttempt,
-				apiKey: options.apiKey,
-				anthropicBaseUrl: options.anthropicBaseUrl,
-				apiModelId: mode === "plan" ? options.planModeApiModelId : options.actModeApiModelId,
-				reasoningEffort: mode === "plan" ? options.planModeReasoningEffort : options.actModeReasoningEffort,
-				thinkingBudgetTokens:
-					mode === "plan" ? options.planModeThinkingBudgetTokens : options.actModeThinkingBudgetTokens,
-			})
-	}
-}
-
-export function buildApiHandler(configuration: ApiConfiguration, mode: Mode): ApiHandler {
-	const { planModeApiProvider, actModeApiProvider, ...options } = configuration
-
-	const apiProvider = mode === "plan" ? planModeApiProvider : actModeApiProvider
-
-	// Validate thinking budget tokens against model's maxTokens to prevent API errors
-	// wrapped in a try-catch for safety, but this should never throw
-	try {
-		const thinkingBudgetTokens = mode === "plan" ? options.planModeThinkingBudgetTokens : options.actModeThinkingBudgetTokens
-		if (thinkingBudgetTokens && thinkingBudgetTokens > 0) {
-			const handler = createHandlerForProvider(apiProvider, options, mode)
-
-			const modelInfo = handler.getModel().info
-			if (modelInfo?.maxTokens && modelInfo.maxTokens > 0 && thinkingBudgetTokens > modelInfo.maxTokens) {
-				const clippedValue = modelInfo.maxTokens - 1
-				if (mode === "plan") {
-					options.planModeThinkingBudgetTokens = clippedValue
-				} else {
-					options.actModeThinkingBudgetTokens = clippedValue
-				}
-			} else {
-				return handler // don't rebuild unless its necessary
-			}
-		}
-	} catch (error) {
-		Logger.error("buildApiHandler error:", error)
-	}
-
-	return createHandlerForProvider(apiProvider, options, mode)
-}

apps/vscode/src/core/api/providers/__tests__/anthropic.test.ts

@@ -1,260 +0,0 @@
-import { afterEach, describe, it } from "mocha"
-import sinon from "sinon"
-import "should"
-import { anthropicModels } from "@shared/api"
-import { ANTHROPIC_FAST_MODE_BETA, AnthropicHandler } from "../anthropic"
-
-describe("AnthropicHandler", () => {
-	afterEach(() => {
-		sinon.restore()
-	})
-
-	const createAsyncIterable = (data: readonly unknown[] = []) => ({
-		[Symbol.asyncIterator]: async function* () {
-			yield* data
-		},
-	})
-
-	describe("getModel", () => {
-		it("should return the fast mode model when configured", () => {
-			const handler = new AnthropicHandler({
-				apiKey: "test-api-key",
-				apiModelId: "claude-opus-4-6:fast",
-			})
-
-			const result = handler.getModel()
-
-			result.id.should.equal("claude-opus-4-6:fast")
-			result.info.should.deepEqual(anthropicModels["claude-opus-4-6:fast"])
-		})
-
-		it("should return the 1m fast mode model when configured", () => {
-			const handler = new AnthropicHandler({
-				apiKey: "test-api-key",
-				apiModelId: "claude-opus-4-6:1m:fast",
-			})
-
-			const result = handler.getModel()
-
-			result.id.should.equal("claude-opus-4-6:1m:fast")
-			result.info.should.deepEqual(anthropicModels["claude-opus-4-6:1m:fast"])
-		})
-
-		it("should return the 4.7 model when configured", () => {
-			const handler = new AnthropicHandler({
-				apiKey: "test-api-key",
-				apiModelId: "claude-opus-4-7",
-			})
-
-			const result = handler.getModel()
-
-			result.id.should.equal("claude-opus-4-7")
-			result.info.should.deepEqual(anthropicModels["claude-opus-4-7"])
-		})
-
-		it("should return the 4.7 1m model when configured", () => {
-			const handler = new AnthropicHandler({
-				apiKey: "test-api-key",
-				apiModelId: "claude-opus-4-7:1m",
-			})
-
-			const result = handler.getModel()
-
-			result.id.should.equal("claude-opus-4-7:1m")
-			result.info.should.deepEqual(anthropicModels["claude-opus-4-7:1m"])
-		})
-
-		it("should return the 4.8 model when configured", () => {
-			const handler = new AnthropicHandler({
-				apiKey: "test-api-key",
-				apiModelId: "claude-opus-4-8",
-			})
-
-			const result = handler.getModel()
-
-			result.id.should.equal("claude-opus-4-8")
-			result.info.should.deepEqual(anthropicModels["claude-opus-4-8"])
-		})
-
-		it("should return the 4.8 1m model when configured", () => {
-			const handler = new AnthropicHandler({
-				apiKey: "test-api-key",
-				apiModelId: "claude-opus-4-8:1m",
-			})
-
-			const result = handler.getModel()
-
-			result.id.should.equal("claude-opus-4-8:1m")
-			result.info.should.deepEqual(anthropicModels["claude-opus-4-8:1m"])
-		})
-
-		it("should return the Fable 5 model when configured", () => {
-			const handler = new AnthropicHandler({
-				apiKey: "test-api-key",
-				apiModelId: "claude-fable-5",
-			})
-
-			const result = handler.getModel()
-
-			result.id.should.equal("claude-fable-5")
-			result.info.should.deepEqual(anthropicModels["claude-fable-5"])
-		})
-
-		it("should return the Fable 5 1m model when configured", () => {
-			const handler = new AnthropicHandler({
-				apiKey: "test-api-key",
-				apiModelId: "claude-fable-5:1m",
-			})
-
-			const result = handler.getModel()
-
-			result.id.should.equal("claude-fable-5:1m")
-			result.info.should.deepEqual(anthropicModels["claude-fable-5:1m"])
-		})
-	})
-
-	describe("createMessage", () => {
-		it("should route fast mode requests through the beta messages API", async () => {
-			const handler = new AnthropicHandler({
-				apiKey: "test-api-key",
-				apiModelId: "claude-opus-4-6:fast",
-			})
-
-			const standardCreate = sinon.stub().resolves(createAsyncIterable())
-			const betaCreate = sinon.stub().callsFake(function (this: { _client?: object }, _params: unknown) {
-				should.exist(this._client)
-				return Promise.resolve(createAsyncIterable())
-			})
-
-			sinon.stub(handler as unknown as { ensureClient: () => unknown }, "ensureClient").returns({
-				messages: {
-					create: standardCreate,
-				},
-				beta: {
-					messages: {
-						_client: {},
-						create: betaCreate,
-					},
-				},
-			})
-
-			for await (const _chunk of handler.createMessage("system prompt", [{ role: "user", content: "Hello" }])) {
-			}
-
-			sinon.assert.notCalled(standardCreate)
-			sinon.assert.calledOnce(betaCreate)
-			sinon.assert.calledWithMatch(betaCreate, {
-				model: "claude-opus-4-6",
-				betas: [ANTHROPIC_FAST_MODE_BETA],
-				speed: "fast",
-				stream: true,
-			})
-		})
-
-		it("should include the 1m beta when routing 1m fast mode requests through the beta messages API", async () => {
-			const handler = new AnthropicHandler({
-				apiKey: "test-api-key",
-				apiModelId: "claude-opus-4-6:1m:fast",
-			})
-
-			const standardCreate = sinon.stub().resolves(createAsyncIterable())
-			const betaCreate = sinon.stub().callsFake(function (this: { _client?: object }, _params: unknown) {
-				should.exist(this._client)
-				return Promise.resolve(createAsyncIterable())
-			})
-
-			sinon.stub(handler as unknown as { ensureClient: () => unknown }, "ensureClient").returns({
-				messages: {
-					create: standardCreate,
-				},
-				beta: {
-					messages: {
-						_client: {},
-						create: betaCreate,
-					},
-				},
-			})
-
-			for await (const _chunk of handler.createMessage("system prompt", [{ role: "user", content: "Hello" }])) {
-			}
-
-			sinon.assert.notCalled(standardCreate)
-			sinon.assert.calledOnce(betaCreate)
-			sinon.assert.calledWithMatch(betaCreate, {
-				model: "claude-opus-4-6",
-				betas: [ANTHROPIC_FAST_MODE_BETA, "context-1m-2025-08-07"],
-				speed: "fast",
-				stream: true,
-			})
-		})
-
-		it("should include the 1m beta header for Claude Opus 4.7 1m requests", async () => {
-			const handler = new AnthropicHandler({
-				apiKey: "test-api-key",
-				apiModelId: "claude-opus-4-7:1m",
-				reasoningEffort: "high",
-			})
-
-			const standardCreate = sinon.stub().resolves(createAsyncIterable())
-
-			sinon.stub(handler as unknown as { ensureClient: () => unknown }, "ensureClient").returns({
-				messages: {
-					create: standardCreate,
-				},
-				beta: {
-					messages: {
-						_client: {},
-						create: sinon.stub().resolves(createAsyncIterable()),
-					},
-				},
-			})
-
-			for await (const _chunk of handler.createMessage("system prompt", [{ role: "user", content: "Hello" }])) {
-			}
-
-			sinon.assert.calledOnce(standardCreate)
-			const requestBody = standardCreate.firstCall.args[0] as Record<string, any>
-			const requestOptions = standardCreate.firstCall.args[1] as Record<string, any>
-			requestBody.model.should.equal("claude-opus-4-7")
-			requestBody.thinking.should.deepEqual({ type: "adaptive" })
-			requestOptions.should.deepEqual({
-				headers: {
-					"anthropic-beta": "context-1m-2025-08-07",
-				},
-			})
-		})
-
-		it("should use adaptive thinking and output_config for Claude Opus adaptive models", async () => {
-			const handler = new AnthropicHandler({
-				apiKey: "test-api-key",
-				apiModelId: "claude-opus-4-7",
-				reasoningEffort: "xhigh",
-			})
-
-			const standardCreate = sinon.stub().resolves(createAsyncIterable())
-
-			sinon.stub(handler as unknown as { ensureClient: () => unknown }, "ensureClient").returns({
-				messages: {
-					create: standardCreate,
-				},
-				beta: {
-					messages: {
-						_client: {},
-						create: sinon.stub().resolves(createAsyncIterable()),
-					},
-				},
-			})
-
-			for await (const _chunk of handler.createMessage("system prompt", [{ role: "user", content: "Hello" }])) {
-			}
-
-			sinon.assert.calledOnce(standardCreate)
-			const requestBody = standardCreate.firstCall.args[0] as Record<string, any>
-			requestBody.should.have.property("thinking")
-			requestBody.thinking.should.deepEqual({ type: "adaptive" })
-			requestBody.should.have.property("output_config")
-			requestBody.output_config.should.deepEqual({ effort: "xhigh" })
-			should(requestBody.temperature).equal(undefined)
-		})
-	})
-})