fix(cli): handle provider auth special errors

* fix(cli): show Cline credits refill link

* fix(cli): simplify Cline credits error matcher

* fix(cli): keep credits handling in TUI

* fix(cli): rename credits error matcher

* fix(cli): render credits dashboard as link

* fix(cli): remove credits redirect param

* fix(cli): document temporary credits matcher

.cline/skills/publish-cli/SKILL.md

@@ -9,12 +9,13 @@ Use this skill when the user asks to release the CLI, publish `cline`, bump the
 
 The CLI is npm-only. Do not add alternate distribution or signing steps.
 
-> Working directory: this skill lives in the SDK sub-monorepo. Run `cd sdk` (from the repo root) before any of the shell commands below. Paths in commands and instructions (e.g. `apps/cli/package.json`, `bun release cli`) are written relative to `sdk/`.
+> Working directory: run every command below from the repository root. Paths and scripts (e.g. `apps/cli/package.json`, `sdk/packages/`, `bun release cli`, `bun run version`) are written relative to the repo root.
 
 The skill should guide the user through one release preparation flow, then offer the publish path options. The two normal publish paths are GitHub Actions and local publishing from an authenticated machine.
 
 ## Release contract
 
+- SDK prerequisite: the CLI depends on the SDK via `workspace:*` (`@cline/core`, `@cline/shared`, and friends). If the SDK changed since its last release, release the SDK first and wait for it to finish publishing before releasing the CLI. See "Step 0: Release the SDK first if it changed" below.
 - Version source: `apps/cli/package.json`.
 - Main release tag: `cli-vX.Y.Z`, where `X.Y.Z` matches `apps/cli/package.json`.
 - Nightly release version: `X.Y.Z-nightly.TIMESTAMP`.
@@ -30,8 +31,93 @@ The skill should guide the user through one release preparation flow, then offer
 - Always ask before pushing commits or tags.
 - Do not amend commits unless explicitly requested.
 
+## Step 0: Release the SDK first if it changed
+
+Do this before anything else in the Workflow below.
+
+The CLI builds and ships against the SDK source in the monorepo (`workspace:*` for `@cline/core`, `@cline/shared`, and the rest), so a CLI release always contains the latest SDK code whether or not the SDK was released. The build and tests use that source too, not anything from npm. Releasing the SDK alongside the CLI is still worth doing for two reasons:
+
+- Hub freshness. The hub daemon lives in `@cline/core` and stamps a `buildId` that defaults to the `@cline/core` package version (`resolveHubBuildId` in `sdk/packages/core/src/hub/discovery/index.ts`). A running hub is only retired and respawned when that `buildId` changes (`isCompatibleHubRecord` / `retireIncompatibleHub` in `sdk/packages/core/src/hub/daemon/index.ts`). So if the SDK code changed but the version did not, a user who upgrades the CLI keeps talking to their already-running hub, which is still executing the old SDK code. Bumping the SDK version makes the new CLI's `buildId` differ, so the stale hub is detected as incompatible and respawned with the fresh code.
+- Release hygiene. We want regular SDK releases; cutting one whenever we cut a CLI release keeps the published SDK in step with what the CLI ships.
+
+So when the SDK has changed, release it first (which bumps the `@cline/core` version), then cut the CLI release on top of that bump. Leave the CLI's SDK dependency as `workspace:*` — the fix is to release the SDK, not to pin the CLI.
+
+1. Check for unreleased SDK changes.
+
+```sh
+git fetch origin --tags
+git tag --list 'sdk/sdk/v*' 'sdk-v*' --sort=-v:refname | head -1
+git log <last-sdk-tag>..origin/main --oneline --no-merges -- sdk/packages
+```
+
+`sdk/<pkg>/v*` tags are created by the `sdk-publish.yml` workflow; `sdk-v*` tags are created by the local `bun release sdk` helper. Use whichever is newest as the baseline.
+
+If `git log` prints no commits, the SDK is already up to date. Skip the rest of Step 0 and continue with the Workflow below.
+
+If it prints commits, sanity-check the diff (ignore entries that are only the previous version-bump commit's lockfile or generated files), then release the SDK.
+
+2. Decide the SDK version bump.
+
+All SDK packages share one version, read from `sdk/packages/llms/package.json`. Ask whether this is patch, minor, major, or an explicit version. Patch is the default. Do not guess if the user has not made it clear.
+
+3. Draft the SDK release notes and update the changelog.
+
+Draft user-facing notes from the SDK commits found in step 1, translating commit messages into user-facing language (same approach as the CLI release notes below). Prepend a new `## <version>` section with those notes to the top of `sdk/CHANGELOG.md`, using the header format `## <version>` with no date — the same flat, newest-on-top format as `apps/cli/CHANGELOG.md`. This is the SDK changelog (all SDK packages share one version) and it is maintained by hand; the `sdk-publish.yml` workflow does not read it.
+
+4. Bump versions and regenerate.
+
+```sh
+bun run version <version>
+```
+
+This bumps every SDK `package.json` to the new version, regenerates the lockfile and the generated model catalog, formats, and builds. Review the result.
+
+5. Commit and push the bump to `main`.
+
+The `sdk-publish.yml` workflow publishes the version that is committed on `main` and tags that commit, so the bump must land on `main` before the workflow runs.
+
+```sh
+git add -A
+git commit -m "chore(sdk): release v<version>"
+```
+
+Ask before pushing:
+
+```sh
+git push origin HEAD
+```
+
+6. Trigger the SDK publish workflow on the `latest` channel.
+
+```sh
+gh workflow run sdk-publish.yml -f channel=latest -f confirm_publish=publish
+gh run list --workflow=sdk-publish.yml --limit=1 --json databaseId,url,status,createdAt --jq '.[0]'
+```
+
+The workflow runs the SDK tests, publishes `@cline/shared`, `@cline/llms`, `@cline/agents`, `@cline/core`, and `@cline/sdk` to npm with the `latest` dist-tag in dependency order, and pushes `sdk/<pkg>/v<version>` git tags.
+
+7. Wait for the SDK workflow to succeed before starting the CLI release.
+
+```sh
+gh run watch <run-id> --exit-status
+```
+
+Do not start the CLI release until this run has finished successfully. The CLI does not install the SDK from npm, but cutting the CLI release on top of a clean, completed SDK release keeps the two in step: the CLI release commit then sits on top of the `@cline/core` version bump, so the shipped CLI carries the new version that forces a running hub to respawn with the new code, and you are not building a CLI release on top of an SDK release that failed midway.
+
+After the SDK release succeeds, pull `main` so the CLI release is prepared on top of the SDK version bump:
+
+```sh
+git checkout main && git pull --ff-only
+```
+
+Then continue with the Workflow below.
+
+For a local SDK publish from an authenticated machine instead of the workflow, `bun release sdk <version>` exists, but prefer the `sdk-publish.yml` workflow for normal releases so the CLI release can gate on a single GitHub Actions run.
+
 ## Workflow
 
+Complete Step 0 first. Only proceed once the SDK is released (or you confirmed no SDK release was needed).
+
 1. Gather context.
 
 ```sh
@@ -46,10 +132,10 @@ Find the latest CLI tag. If there is no `cli-v*` tag, use the first relevant CLI
 2. Collect release commits.
 
 ```sh
-git log <last-cli-tag>..HEAD --oneline --no-merges -- apps/cli packages scripts .github/workflows/cli-publish.yml
+git log <last-cli-tag>..HEAD --oneline --no-merges -- apps/cli sdk/packages sdk/scripts .github/workflows/cli-publish.yml
 ```
 
-If the release includes broader SDK changes that affect the CLI, also inspect commits outside `apps/cli`.
+The `sdk/packages` commits matter here even though the SDK was released separately in Step 0: the CLI bundles the SDK, so SDK changes ship in this CLI release too. Read those commits and fold anything user-relevant to the CLI into the release notes (provider/model updates, behavior changes, fixes the CLI inherits). Skip SDK changes that are purely internal or have no CLI-visible effect.
 
 3. Draft user-facing release notes.
 

.clinerules/general.md

@@ -140,12 +140,10 @@ Adding a new key to global state requires updates in multiple places. Missing an
 
 Required steps:
 1. Type definition in `src/shared/storage/state-keys.ts` - Add to `GlobalState` or `Settings` interface
-2. Read from globalState in `src/core/storage/utils/state-helpers.ts`:
-   - Add `const myKey = context.globalState.get<GlobalStateAndSettings["myKey"]>("myKey")` in `readGlobalStateFromDisk()`
-   - Add to the return object: `myKey: myKey ?? defaultValue,`
-3. StateManager handles read/write via `setGlobalState()`/`getGlobalStateKey()` after initialization
+2. Add any default value or transform in `src/shared/storage/state-keys.ts` if the key needs one
+3. Read and write the value through `StateManager` (`setGlobalState()` / `getGlobalStateKey()`) after initialization
 
-Common mistake: Adding only the return value without the `context.globalState.get()` call. This compiles but the value is always `undefined` on load.
+Persistent state is file-backed through `StateManager`; do not add new runtime reads or writes against VS Code `ExtensionContext` storage. That storage is only a legacy migration source.
 
 Settings plumbing gotcha: if a key is user-toggleable from settings, wire both controller update paths:
 - `src/core/controller/state/updateSettings.ts` for webview `updateSetting(...)`
@@ -159,22 +157,20 @@ Webview toggle gotcha: settings changes must also round-trip back in state paylo
 If this round-trip wiring is missing, the backend value can update but the toggle in webview appears stuck or reverts.
 
 ## StateManager Cache vs Direct globalState Access
-StateManager uses an in-memory cache populated during `StateManager.initialize(context)` in `common.ts`. For most state, use `controller.stateManager.setGlobalState()`/`getGlobalStateKey()`.
+StateManager uses an in-memory cache populated during `StateManager.initialize()` from file-backed storage. For most state, use `controller.stateManager.setGlobalState()`/`getGlobalStateKey()`.
 
-Exception: State needed immediately at extension startup (before cache is ready)
+Exception: host migration code may read legacy VS Code storage before file-backed storage is initialized.
 
-When Window A sets state and immediately opens Window B, the new window's StateManager cache is populated from `context.globalState` during initialization. If you need to read state in Window B right at startup (e.g., in `common.ts` during `initialize()`), read directly from `context.globalState.get()` instead of StateManager's cache.
-
-Example pattern (see `lastShownAnnouncementId` and `worktreeAutoOpenPath`):
+Example pattern:
 ```typescript
 // Writing (normal pattern)
 controller.stateManager.setGlobalState("myKey", value)
 
-// Reading at startup in common.ts (bypass cache)
-const value = context.globalState.get<string>("myKey")
+// Reading after initialization
+const value = controller.stateManager.getGlobalStateKey("myKey")
 ```
 
-This is only needed for cross-window state read during the brief startup window before StateManager cache is fully usable. Normal state access after initialization should use StateManager.
+Use `context.globalState` only in VS Code migration code that copies legacy ExtensionContext values into the shared file-backed stores.
 
 ## ChatRow Cancelled/Interrupted States
 When a ChatRow displays a loading/in-progress state (spinner), you must handle what happens when the task is cancelled. This is non-obvious because cancellation doesn't update the message content—you have to infer it from context.

.github/copilot-instructions.md

@@ -44,7 +44,7 @@ For Responses API providers: add to `isNextGenModelProvider()` in `src/utils/mod
 Modular: `components/` (shared) + `variants/` (model-specific) + `templates/` (`{{PLACEHOLDER}}`). Variants override components via `componentOverrides` in `config.ts` or custom `template.ts`. XS variant is heavily condensed inline. Always regenerate snapshots after changes.
 
 ## Global State Keys (silent failure risk)
-Adding a key requires: type in `src/shared/storage/state-keys.ts`, read via `context.globalState.get()` in `src/core/storage/utils/state-helpers.ts` `readGlobalStateFromDisk()`, and add to return object. Missing the `.get()` call compiles fine but value is always `undefined`.
+Adding a key requires updating the typed storage definitions in `src/shared/storage/state-keys.ts`; runtime reads and writes should go through `StateManager`, not VS Code `ExtensionContext` storage. Persistent state is file-backed so it works across VS Code, CLI, and JetBrains hosts.
 
 ## Slash Commands (3 places)
 - `src/core/slash-commands/index.ts` — definitions.

CHANGELOG.md

@@ -1,5 +1,30 @@
 # Changelog
 
+## [3.88.1]
+
+### Added
+
+- Add a debug section in settings for Cline testers.
+
+### Fixed
+
+- Include the walkthrough markdown files in the VS Code extension package so the first-run walkthrough steps load correctly.
+
+## [3.88.0]
+
+### Added
+
+- Add the latest Fireworks AI serverless models and update the default Fireworks model to Kimi K2.6.
+
+### Fixed
+
+- Fix MCP server delete/add flows so settings writes do not cause the MCP server list to be emptied by the file watcher.
+- Remove stale Fireworks AI models and correct Fireworks model metadata and cache pricing.
+
+### Changed
+
+- Always use the upstream Cline recommended models endpoint instead of gating it behind a feature flag.
+
 ## [3.87.0]
 
 ### Added

README.md

@@ -212,8 +212,12 @@ cline schedule create "PR summary" \
 Chat with your agent from any messaging platform: Telegram, Slack, Discord, Google Chat, WhatsApp, and Linear. Each conversation thread maps to an agent session with full context. Set up access control to restrict who can interact with your agent.
 
 ```bash
+# Connect to Telegram
 cline connect telegram -k $BOT_TOKEN
-cline connect slack --token $SLACK_TOKEN --signing-secret $SECRET --base-url $URL
+# Connect to Slack through webhook
+cline connect slack --bot-token $SLACK_TOKEN --signing-secret $SECRET --base-url $URL
+# Connect to Slack using socket mode
+cline connect slack --bot-token $SLACK_TOKEN --app-token $SLACK_APP_TOKEN
 ```
 
 ## Headless CLI for CI/CD

apps/cli/CHANGELOG.md

@@ -1,5 +1,38 @@
 # Cline CLI Changelog
 
+## 3.0.20
+
+- Installed plugin wrappers are now named from their source (npm package name, git repo, remote filename, official slug, or local directory) instead of an opaque hash, making installed plugins easier to identify.
+
+## 3.0.19
+
+- Fixed CLI auto-update to use `npm update` so updates apply reliably, while preserving the installed release channel (e.g. nightly).
+
+## 3.0.18
+
+- Fix Slack channel mentions so replies post in the original message's thread.
+- Fix the abort indicator to clear immediately when a task is cancelled.
+- Sync the Fireworks AI model registry and refresh the bundled model catalog with current platform offerings.
+- Bump the bundled SDK to v0.0.43, which forces a running Cline Hub to restart so it picks up the latest SDK code.
+
+## 3.0.17
+
+- Fix a regression introduced in 3.0.15 where the interactive CLI could get stuck after stopping and restarting Cline Hub and then pressing Escape to cancel a request. The CLI now detects stale or missing sessions, recovers any pending messages, and starts a fresh session instead of failing with "session not found".
+- Fix Ctrl+C and Hub shutdown races that surfaced as "hook dispatch failed" and WebSocket connection errors from late hook events racing against Hub shutdown.
+- Fix the Hub daemon being shut down prematurely when a runtime request was aborted, so the daemon now stays alive.
+- Improve the Telegram connector with a new `--allowed-user-id` flag to restrict which Telegram users are authorized to interact with the agent.
+
+## 3.0.16
+
+- Install official Cline plugins by slug off the new github.com/cline/plugins collection.
+- Uninstall plugins using `cline plugin uninstall <plugin>` or in the TUI.
+- Plugins can now bundle skills, and plugin skills are grouped together in settings.
+- Add Slack socket mode support.
+- Allow a custom base URL for Anthropic vendor-type providers.
+- Fix OAuth token migration for users signed in through the old extension.
+- Use a union schema for read-files tool input validation.
+- Add a `CLINE_PLUGIN_IMPORT_TIMEOUT_MS` env override to control the plugin import timeout.
+
 ## 3.0.15
 
 - Add Cline Hub, a web app for monitoring connected clients, viewing and driving sessions, streaming assistant output, and restarting the local hub, with local, LAN, and tunnel usage gated by a room secret.

apps/cli/DEVELOPMENT.md

@@ -416,7 +416,7 @@ Then attach VS Code or Chrome DevTools to `ws://127.0.0.1:6499`.
 
 ## Publishing
 
-The CLI is published as the `cline` wrapper package on npm with platform-specific binaries under `@cline/cli-*`. The release flow lives in the `publish-cli` skill (`apps/cli/.cline/skills/publish-cli/SKILL.md`).
+The CLI is published as the `cline` wrapper package on npm with platform-specific binaries under `@cline/cli-*`. The release flow lives in the `publish-cli` skill (`.cline/skills/publish-cli/SKILL.md` at the repo root).
 
 From the `apps/cli` workspace:
 

apps/cli/README.md

@@ -174,6 +174,9 @@ cline connect telegram -k 123456:ABCDEF...
 # Slack (webhook mode)
 cline connect slack --bot-token $SLACK_BOT_TOKEN --signing-secret $SLACK_SIGNING_SECRET --base-url https://your-domain.com
 
+# Slack (socket mode)
+cline connect slack --bot-token $SLACK_BOT_TOKEN --app-token $SLACK_APP_TOKEN
+
 # Google Chat (webhook mode)
 cline connect gchat --base-url https://your-domain.com
 

apps/cli/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "@cline/cli",
 	"displayName": "cline",
-	"version": "3.0.15",
+	"version": "3.0.20",
 	"description": "Autonomous coding agent CLI - capable of creating/editing files, running commands, using the browser, and more",
 	"type": "module",
 	"publishConfig": {

apps/cli/src/commands/plugin.test.ts

@@ -21,6 +21,7 @@ import {
 	isOfficialPluginSlug,
 	parsePluginSource,
 	runPluginInstallCommand,
+	runPluginUninstallCommand,
 } from "./plugin";
 
 type FetchCall = (
@@ -238,6 +239,10 @@ describe("plugin install command", () => {
 		expect(readFileSync(result.entryPaths[0] ?? "", "utf8")).toContain(
 			"official-web-search",
 		);
+		const wrapperManifest = JSON.parse(
+			readFileSync(join(result.installPath, "package.json"), "utf8"),
+		) as { name?: string };
+		expect(wrapperManifest.name).toBe("web-search");
 		expect(existsSync(join(result.installPath, "repo"))).toBe(false);
 		expect(
 			existsSync(join(result.installPath, "package", "other-plugin")),
@@ -327,6 +332,10 @@ describe("plugin install command", () => {
 		expect(result.installPath).toContain(
 			join(workspace, ".cline", "plugins", "_installed", "local"),
 		);
+		const wrapperManifest = JSON.parse(
+			readFileSync(join(result.installPath, "package.json"), "utf8"),
+		) as { name?: string };
+		expect(wrapperManifest.name).toBe("web-search");
 		expect(readFileSync(result.entryPaths[0] ?? "", "utf8")).toContain(
 			"local-web-search",
 		);
@@ -455,7 +464,8 @@ describe("plugin install command", () => {
 
 		const wrapperManifest = JSON.parse(
 			readFileSync(join(result.installPath, "package.json"), "utf8"),
-		) as { cline?: { plugins?: Array<{ paths?: string[] }> } };
+		) as { name?: string; cline?: { plugins?: Array<{ paths?: string[] }> } };
+		expect(wrapperManifest.name).toBe("plugin-package");
 		expect(wrapperManifest.cline?.plugins?.[0]?.paths).toHaveLength(1);
 		expect(wrapperManifest.cline?.plugins?.[0]?.paths?.[0]).toContain(
 			"package/index.ts",
@@ -593,6 +603,54 @@ describe("plugin install command", () => {
 		).toContain("installed-v1");
 	});
 
+	it("uninstalls a package plugin by package name", async () => {
+		const source = join(root, "uninstall-package");
+		const npmCommandPath = join(root, "fake-npm.sh");
+		await mkdir(source, { recursive: true });
+		await writeFile(
+			join(source, "package.json"),
+			JSON.stringify(
+				{
+					name: "cli-uninstall-plugin",
+					cline: {
+						plugins: [{ paths: ["./index.ts"], capabilities: ["tools"] }],
+					},
+				},
+				null,
+				2,
+			),
+			"utf8",
+		);
+		await writeFile(
+			join(source, "index.ts"),
+			"export default { name: 'cli-uninstall-plugin', manifest: { capabilities: ['tools'] } };",
+			"utf8",
+		);
+		writeFileSync(npmCommandPath, "#!/bin/sh\nexit 0\n", {
+			encoding: "utf8",
+			mode: 0o755,
+		});
+
+		const installed = await installPlugin({
+			source,
+			npmCommand: npmCommandPath,
+		});
+		const output: string[] = [];
+		const code = await runPluginUninstallCommand({
+			name: "cli-uninstall-plugin",
+			io: {
+				writeln: (text = "") => output.push(text),
+				writeErr: (text) => output.push(text),
+			},
+		});
+
+		expect(code).toBe(0);
+		expect(existsSync(installed.installPath)).toBe(false);
+		expect(output.join("\n")).toContain(
+			"Uninstalled plugin cli-uninstall-plugin",
+		);
+	});
+
 	it("prints JSON output for command callers", async () => {
 		const source = join(root, "json.ts");
 		writeFileSync(

apps/cli/src/commands/plugin.ts

@@ -12,7 +12,16 @@ import {
 } from "node:fs";
 import { cp, mkdir, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
-import { basename, dirname, join, relative, resolve, sep } from "node:path";
+import {
+	basename,
+	dirname,
+	extname,
+	join,
+	relative,
+	resolve,
+	sep,
+} from "node:path";
+import { type PluginUninstallOptions, uninstallPlugin } from "@cline/core";
 import {
 	isPluginModulePath,
 	resolveClineDir,
@@ -468,6 +477,25 @@ function getInstallSourceKey(
 	return `local:${resolve(cwd, resolveHomePath(parsed.path))}`;
 }
 
+function getWrapperPackageName(
+	parsed: ParsedPluginSource,
+	cwd: string,
+): string {
+	if (parsed.type === "npm") {
+		return parsed.name;
+	}
+	if (parsed.type === "git") {
+		return sanitizeSegment(basename(parsed.path));
+	}
+	if (parsed.type === "remote") {
+		return sanitizeSegment(basename(parsed.filename, extname(parsed.filename)));
+	}
+	if (parsed.type === "official") {
+		return parsed.slug;
+	}
+	return sanitizeSegment(basename(resolve(cwd, resolveHomePath(parsed.path))));
+}
+
 async function runCommand(
 	command: string,
 	args: string[],
@@ -664,6 +692,7 @@ function toWrapperEntryPaths(
 async function writeWrapperManifest(
 	wrapperRoot: string,
 	packageRoot: string,
+	packageName: string,
 ): Promise<string[]> {
 	const entryPaths = toWrapperEntryPaths(wrapperRoot, packageRoot);
 	await writeFile(
@@ -671,7 +700,7 @@ async function writeWrapperManifest(
 		JSON.stringify(
 			{
 				...WRAPPER_PACKAGE_JSON,
-				name: `cline-installed-plugin-${hashSource(wrapperRoot)}`,
+				name: packageName,
 				cline: {
 					plugins: [{ paths: entryPaths }],
 				},
@@ -987,6 +1016,7 @@ export async function installPlugin(
 	);
 	const sourceKey = getInstallSourceKey(parsed, cwd, officialPluginsRepo);
 	const installPath = getInstallPath(pluginRoot, parsed, sourceKey);
+	const wrapperPackageName = getWrapperPackageName(parsed, cwd);
 	const stagingParent = join(pluginRoot, INSTALLS_DIRECTORY_NAME, ".tmp");
 	const stagingRoot = join(
 		stagingParent,
@@ -1029,7 +1059,11 @@ export async function installPlugin(
 				? collectPluginEntries(stagingRoot).map(
 						(entry) => `./${toPosixPath(relative(stagingRoot, entry))}`,
 					)
-				: await writeWrapperManifest(stagingRoot, packageRoot);
+				: await writeWrapperManifest(
+						stagingRoot,
+						packageRoot,
+						wrapperPackageName,
+					);
 		if (entryPaths.length === 0) {
 			throw new Error(`No plugin entry files found for ${source}`);
 		}
@@ -1064,3 +1098,22 @@ export async function runPluginInstallCommand(
 		return 1;
 	}
 }
+
+export async function runPluginUninstallCommand(
+	options: PluginUninstallOptions & { json?: boolean; io?: PluginInstallIo },
+): Promise<number> {
+	try {
+		const result = await uninstallPlugin(options);
+		if (options.json) {
+			process.stdout.write(JSON.stringify(result));
+			return 0;
+		}
+		options.io?.writeln(`Uninstalled plugin ${result.name}`);
+		options.io?.writeln(`  Removed: ${result.installPath}`);
+		return 0;
+	} catch (error) {
+		const message = error instanceof Error ? error.message : String(error);
+		options.io?.writeErr(message);
+		return 1;
+	}
+}

apps/cli/src/commands/update.test.ts

@@ -45,7 +45,7 @@ describe("getInstallationInfo", () => {
 		expect(getInstallationInfo("1.2.3")).toEqual({
 			packageManager: PackageManager.NPM,
 			packageName: "cline",
-			updateCommand: "npm install -g cline@latest",
+			updateCommand: "npm update -g cline --tag latest",
 		});
 	});
 
@@ -57,7 +57,7 @@ describe("getInstallationInfo", () => {
 		expect(getInstallationInfo("1.2.3-nightly.456")).toEqual({
 			packageManager: PackageManager.NPM,
 			packageName: "cline",
-			updateCommand: "npm install -g cline@nightly",
+			updateCommand: "npm update -g cline --tag nightly",
 		});
 	});
 
@@ -76,10 +76,10 @@ describe("withMinimumReleaseAgeBypass", () => {
 	it("adds the package-manager-specific cooldown bypass", () => {
 		expect(
 			withMinimumReleaseAgeBypass(
-				"npm install -g cline@latest",
+				"npm update -g cline --tag latest",
 				PackageManager.NPM,
 			).command,
-		).toBe("npm install -g cline@latest --min-release-age=0");
+		).toBe("npm update -g cline --tag latest --min-release-age=0");
 		expect(
 			withMinimumReleaseAgeBypass("bun add -g cline@latest", PackageManager.BUN)
 				.command,

apps/cli/src/commands/update.ts

@@ -126,7 +126,7 @@ export function getInstallationInfo(currentVersion: string): InstallationInfo {
 			return {
 				packageManager: PackageManager.NPM,
 				packageName: DEFAULT_PACKAGE_NAME,
-				updateCommand: `npm install -g ${DEFAULT_PACKAGE_NAME}@${tag}`,
+				updateCommand: `npm update -g ${DEFAULT_PACKAGE_NAME} --tag ${tag}`,
 			};
 		}
 	} catch {
@@ -341,18 +341,25 @@ export function autoUpdateOnStartup(): void {
 	if (process.env.IS_DEV === "true") return;
 	if (process.env.CLINE_NO_AUTO_UPDATE === "1") return;
 
-	const { packageName, updateCommand } = getInstallationInfo(version);
+	const { packageName, packageManager, updateCommand } =
+		getInstallationInfo(version);
 	if (!updateCommand) return;
 
 	void (async () => {
 		try {
 			const latest = await getLatestVersion(packageName, version);
 			if (!latest || compareVersions(version, latest) >= 0) return;
-			const child = spawn(updateCommand, {
+			const autoUpdateCommand = withMinimumReleaseAgeBypass(
+				updateCommand,
+				packageManager,
+			);
+			const child = spawn(autoUpdateCommand.command, {
 				shell: true,
 				detached: true,
 				stdio: "ignore",
-				env: process.env,
+				env: autoUpdateCommand.env
+					? { ...process.env, ...autoUpdateCommand.env }
+					: process.env,
 			});
 			const exitCode = await waitForProcessExit(child);
 			if (exitCode === 0) {

apps/cli/src/connectors/adapters/discord.test.ts

@@ -228,7 +228,7 @@ describe("discordConnector", () => {
 		});
 	});
 
-	it("switches Discord thread state to the incoming participant without reusing the previous participant session", async () => {
+	it("updates Discord participant metadata without changing the thread session", async () => {
 		const dir = await mkdtemp(join(tmpdir(), "discord-participants-"));
 		const bindingsPath = join(dir, "threads.json");
 		const thread = createThread({
@@ -278,11 +278,13 @@ describe("discordConnector", () => {
 			errorLabel: "Discord",
 		});
 
-		const bob =
-			readBindings<TestDiscordState>(bindingsPath)["discord:user:bob"];
-		expect(bob?.state?.participantKey).toBe("discord:user:bob");
-		expect(bob?.state?.participantLabel).toBe("Bob");
-		expect(bob?.state?.sessionId).toBeUndefined();
+		const binding =
+			readBindings<TestDiscordState>(bindingsPath)[
+				"discord:guild:channel:thread"
+			];
+		expect(binding?.state?.participantKey).toBe("discord:user:bob");
+		expect(binding?.state?.participantLabel).toBe("Bob");
+		expect(binding?.state?.sessionId).toBe("session-alice");
 		expect(
 			readBindings<TestDiscordState>(bindingsPath)["discord:user:alice"]?.state
 				?.sessionId,

apps/cli/src/connectors/adapters/discord.ts

@@ -50,10 +50,9 @@ import {
 	type ConnectorMuteTarget,
 	type ConnectorThreadState,
 	clearBindingSessionIds,
-	findBindingForParticipantKey,
+	findBindingForDeliveryTarget,
 	findBindingForThread,
 	loadThreadState,
-	mergeThreadState,
 	persistMergedThreadState,
 	readBindings,
 } from "../thread-bindings";
@@ -564,45 +563,17 @@ async function postDiscordResolvedText(input: {
 	});
 }
 
-function resolveParticipantState(input: {
-	bindingsPath: string;
-	baseStartRequest: ChatStartSessionRequest;
+function resolveCurrentStateWithParticipant(input: {
+	currentState: DiscordThreadState;
 	participant: DiscordParticipant;
 }): DiscordThreadState {
-	const existing = findBindingForParticipantKey(
-		readBindings<DiscordThreadState>(input.bindingsPath),
-		input.participant.key,
-	)?.binding.state;
 	return {
-		...mergeThreadState<DiscordThreadState>(
-			undefined,
-			existing,
-			input.baseStartRequest,
-		),
+		...input.currentState,
 		participantKey: input.participant.key,
 		participantLabel: input.participant.label,
 	};
 }
 
-function resolveCurrentStateWithParticipant(input: {
-	currentState: DiscordThreadState;
-	bindingsPath: string;
-	baseStartRequest: ChatStartSessionRequest;
-	participant: DiscordParticipant;
-}): DiscordThreadState {
-	if (input.currentState.participantKey === input.participant.key) {
-		return {
-			...input.currentState,
-			participantLabel: input.participant.label,
-		};
-	}
-	return resolveParticipantState({
-		bindingsPath: input.bindingsPath,
-		baseStartRequest: input.baseStartRequest,
-		participant: input.participant,
-	});
-}
-
 async function persistDiscordThreadContext(input: {
 	thread: Thread<DiscordThreadState>;
 	bindingsPath: string;
@@ -624,8 +595,6 @@ async function persistDiscordThreadContext(input: {
 	);
 	const nextState = resolveCurrentStateWithParticipant({
 		currentState,
-		bindingsPath: input.bindingsPath,
-		baseStartRequest: input.baseStartRequest,
 		participant,
 	});
 	if (
@@ -669,20 +638,20 @@ async function deliverScheduledResult(input: {
 	const threadId =
 		typeof delivery.threadId === "string" ? delivery.threadId.trim() : "";
 	const bindingKey =
-		typeof delivery.bindingKey === "string"
-			? delivery.bindingKey.trim()
-			: typeof delivery.participantKey === "string"
-				? delivery.participantKey.trim()
-				: "";
-	if (!threadId && !bindingKey) {
+		typeof delivery.bindingKey === "string" ? delivery.bindingKey.trim() : "";
+	const participantKey =
+		typeof delivery.participantKey === "string"
+			? delivery.participantKey.trim()
+			: "";
+	if (!threadId && !bindingKey && !participantKey) {
 		return;
 	}
 	const bindings = readBindings<DiscordThreadState>(input.bindingsPath);
-	const match = bindingKey
-		? findBindingForParticipantKey(bindings, bindingKey)
-		: threadId
-			? { key: threadId, binding: bindings[threadId] }
-			: undefined;
+	const match = findBindingForDeliveryTarget(bindings, {
+		bindingKey,
+		threadId,
+		participantKey,
+	});
 	const binding = match?.binding;
 	if (!binding?.serializedThread) {
 		return;
@@ -1133,9 +1102,7 @@ class DiscordConnector extends ConnectorBase<
 				isSubscribedThreadMessage?: boolean;
 			},
 		) => {
-			const queueKey =
-				(await loadThreadState(thread, bindingsPath, startRequest))
-					.participantKey || thread.id;
+			const queueKey = thread.id;
 			const runTurn = async () => {
 				try {
 					await handleConnectorUserTurn({

apps/cli/src/connectors/adapters/gchat.test.ts

@@ -2,7 +2,7 @@ import { describe, expect, it } from "vitest";
 import { __test__ } from "./gchat";
 
 describe("gchat binding lookup", () => {
-	it("falls back to channel identity when a restarted connector gets a new thread id", () => {
+	it("does not fall back to channel identity for a different space thread id", () => {
 		const result = __test__.findBindingForThread(
 			{
 				legacy_thread_id: {
@@ -21,17 +21,7 @@ describe("gchat binding lookup", () => {
 			},
 		);
 
-		expect(result).toEqual({
-			key: "legacy_thread_id",
-			binding: {
-				channelId: "space-123",
-				isDM: false,
-				serializedThread: "{}",
-				sessionId: "sess-1",
-				state: { sessionId: "sess-1", cwd: "/tmp/work" },
-				updatedAt: "2026-03-17T00:00:00.000Z",
-			},
-		});
+		expect(result).toBeUndefined();
 	});
 
 	it("prefers an exact thread id match over a channel fallback", () => {
@@ -65,7 +55,7 @@ describe("gchat binding lookup", () => {
 		expect(result?.binding.sessionId).toBe("sess-2");
 	});
 
-	it("reuses a binding by participant key across different spaces", () => {
+	it("does not reuse a binding by participant key across different spaces", () => {
 		const result = __test__.findBindingForThread(
 			{
 				"gchat:email:alice@example.com": {
@@ -91,7 +81,6 @@ describe("gchat binding lookup", () => {
 			},
 		);
 
-		expect(result?.key).toBe("gchat:email:alice@example.com");
-		expect(result?.binding.sessionId).toBe("sess-1");
+		expect(result).toBeUndefined();
 	});
 });

apps/cli/src/connectors/adapters/gchat.ts

@@ -46,7 +46,7 @@ import {
 	type ConnectorBindingStore,
 	type ConnectorThreadState,
 	clearBindingSessionIds,
-	findBindingForParticipantKey,
+	findBindingForDeliveryTarget,
 	findBindingForThread,
 	loadThreadState,
 	persistMergedThreadState,
@@ -191,20 +191,20 @@ async function deliverScheduledResult(input: {
 	const threadId =
 		typeof delivery.threadId === "string" ? delivery.threadId.trim() : "";
 	const bindingKey =
-		typeof delivery.bindingKey === "string"
-			? delivery.bindingKey.trim()
-			: typeof delivery.participantKey === "string"
-				? delivery.participantKey.trim()
-				: "";
-	if (!threadId && !bindingKey) {
+		typeof delivery.bindingKey === "string" ? delivery.bindingKey.trim() : "";
+	const participantKey =
+		typeof delivery.participantKey === "string"
+			? delivery.participantKey.trim()
+			: "";
+	if (!threadId && !bindingKey && !participantKey) {
 		return;
 	}
 	const bindings = readBindings<GoogleChatThreadState>(input.bindingsPath);
-	const match = bindingKey
-		? findBindingForParticipantKey(bindings, bindingKey)
-		: threadId
-			? { key: threadId, binding: bindings[threadId] }
-			: undefined;
+	const match = findBindingForDeliveryTarget(bindings, {
+		bindingKey,
+		threadId,
+		participantKey,
+	});
 	const binding = match?.binding;
 	if (!binding?.serializedThread) {
 		return;
@@ -590,9 +590,7 @@ class GoogleChatConnector extends ConnectorBase<
 			thread: Thread<GoogleChatThreadState>,
 			text: string,
 		) => {
-			const queueKey =
-				(await loadThreadState(thread, bindingsPath, startRequest))
-					.participantKey || thread.id;
+			const queueKey = thread.id;
 			const runTurn = async () => {
 				try {
 					await handleConnectorUserTurn({

apps/cli/src/connectors/adapters/linear.test.ts

@@ -2,7 +2,7 @@ import { describe, expect, it } from "vitest";
 import { __test__ } from "./linear";
 
 describe("linear binding lookup", () => {
-	it("falls back to channel identity when a restarted connector gets a new thread id", () => {
+	it("does not fall back to channel identity for a different issue thread id", () => {
 		const result = __test__.findBindingForThread(
 			{
 				legacy_thread_id: {
@@ -21,17 +21,7 @@ describe("linear binding lookup", () => {
 			},
 		);
 
-		expect(result).toEqual({
-			key: "legacy_thread_id",
-			binding: {
-				channelId: "linear:issue:ISS-123",
-				isDM: false,
-				serializedThread: "{}",
-				sessionId: "sess-1",
-				state: { sessionId: "sess-1", cwd: "/tmp/work" },
-				updatedAt: "2026-03-17T00:00:00.000Z",
-			},
-		});
+		expect(result).toBeUndefined();
 	});
 
 	it("prefers an exact thread id match over a channel fallback", () => {
@@ -65,7 +55,7 @@ describe("linear binding lookup", () => {
 		expect(result?.binding.sessionId).toBe("sess-2");
 	});
 
-	it("reuses a binding by participant key across different issue threads", () => {
+	it("does not reuse a binding by participant key across different issue threads", () => {
 		const result = __test__.findBindingForThread(
 			{
 				"linear:user:user_123": {
@@ -91,7 +81,6 @@ describe("linear binding lookup", () => {
 			},
 		);
 
-		expect(result?.key).toBe("linear:user:user_123");
-		expect(result?.binding.sessionId).toBe("sess-1");
+		expect(result).toBeUndefined();
 	});
 });

apps/cli/src/connectors/adapters/linear.ts

@@ -42,7 +42,7 @@ import {
 	type ConnectorBindingStore,
 	type ConnectorThreadState,
 	clearBindingSessionIds,
-	findBindingForParticipantKey,
+	findBindingForDeliveryTarget,
 	findBindingForThread,
 	loadThreadState,
 	persistMergedThreadState,
@@ -229,20 +229,20 @@ async function deliverScheduledResult(input: {
 	const threadId =
 		typeof delivery.threadId === "string" ? delivery.threadId.trim() : "";
 	const bindingKey =
-		typeof delivery.bindingKey === "string"
-			? delivery.bindingKey.trim()
-			: typeof delivery.participantKey === "string"
-				? delivery.participantKey.trim()
-				: "";
-	if (!threadId && !bindingKey) {
+		typeof delivery.bindingKey === "string" ? delivery.bindingKey.trim() : "";
+	const participantKey =
+		typeof delivery.participantKey === "string"
+			? delivery.participantKey.trim()
+			: "";
+	if (!threadId && !bindingKey && !participantKey) {
 		return;
 	}
 	const bindings = readBindings<LinearThreadState>(input.bindingsPath);
-	const match = bindingKey
-		? findBindingForParticipantKey(bindings, bindingKey)
-		: threadId
-			? { key: threadId, binding: bindings[threadId] }
-			: undefined;
+	const match = findBindingForDeliveryTarget(bindings, {
+		bindingKey,
+		threadId,
+		participantKey,
+	});
 	const binding = match?.binding;
 	if (!binding?.serializedThread) {
 		return;
@@ -625,9 +625,7 @@ class LinearConnector extends ConnectorBase<
 			thread: Thread<LinearThreadState>,
 			text: string,
 		) => {
-			const queueKey =
-				(await loadThreadState(thread, bindingsPath, startRequest))
-					.participantKey || thread.id;
+			const queueKey = thread.id;
 			const runTurn = async () => {
 				try {
 					await handleConnectorUserTurn({

apps/cli/src/connectors/adapters/prompts.ts

@@ -29,7 +29,7 @@ export function getConnectorSystemRules(
 }
 
 const CONNECTOR_FIRST_CONTACT_MESSAGE = [
-	"Connected.",
+	"Connected to Cline.",
 	"Your chat history is kept separately for your account.",
 	"Send /new to start a fresh session or /whereami for thread details.",
 ].join("\n");

apps/cli/src/connectors/adapters/slack.test.ts

@@ -1,15 +1,74 @@
+import type { ConnectSlackOptions } from "@cline/shared";
+import { type Message, ThreadImpl } from "chat";
 import { describe, expect, it } from "vitest";
-import { __test__ } from "./slack";
+import { __test__, slackConnector } from "./slack";
+
+const parseSlackArgs = (rawArgs: string[]): ConnectSlackOptions =>
+	(
+		slackConnector as unknown as {
+			parseArgs(rawArgs: string[]): ConnectSlackOptions;
+		}
+	).parseArgs(rawArgs);
 
 describe("slack binding lookup", () => {
 	const participantKey = __test__.buildSlackParticipantKey("T123", "U123");
 
-	it("falls back to channel identity when a restarted connector gets a new thread id", () => {
+	it("infers Slack webhook mode from a base URL", () => {
+		expect(__test__.inferSlackConnectionMode("https://example.test")).toBe(
+			"webhook",
+		);
+		expect(__test__.inferSlackConnectionMode("  ")).toBe("socket");
+		expect(__test__.inferSlackConnectionMode(undefined)).toBe("socket");
+	});
+
+	it("uses webhook mode when Slack args include a base URL", () => {
+		const options = parseSlackArgs([
+			"--bot-token",
+			"xoxb-token",
+			"--signing-secret",
+			"secret",
+			"--app-token",
+			"xapp-ignored",
+			"--base-url",
+			"https://example.test",
+		]);
+
+		expect(options.connectionMode).toBe("webhook");
+		expect(options.baseUrl).toBe("https://example.test");
+		expect(options.signingSecret).toBe("secret");
+		expect(options.appToken).toBeUndefined();
+	});
+
+	it("uses socket mode when Slack args omit a base URL", () => {
+		const previousBaseUrl = process.env.BASE_URL;
+		delete process.env.BASE_URL;
+		let options: ConnectSlackOptions;
+		try {
+			options = parseSlackArgs([
+				"--bot-token",
+				"xoxb-token",
+				"--app-token",
+				"xapp-token",
+			]);
+		} finally {
+			if (previousBaseUrl === undefined) {
+				delete process.env.BASE_URL;
+			} else {
+				process.env.BASE_URL = previousBaseUrl;
+			}
+		}
+
+		expect(options.connectionMode).toBe("socket");
+		expect(options.baseUrl).toBeUndefined();
+		expect(options.appToken).toBe("xapp-token");
+	});
+
+	it("falls back to DM channel identity when a restarted connector gets a new thread id", () => {
 		const result = __test__.findBindingForThread(
 			{
 				legacy_thread_id: {
 					channelId: "slack:C123",
-					isDM: false,
+					isDM: true,
 					serializedThread: "{}",
 					sessionId: "sess-1",
 					state: { sessionId: "sess-1", cwd: "/tmp/work", teamId: "T123" },
@@ -19,7 +78,7 @@ describe("slack binding lookup", () => {
 			{
 				id: "new_thread_id",
 				channelId: "slack:C123",
-				isDM: false,
+				isDM: true,
 			},
 		);
 
@@ -27,7 +86,7 @@ describe("slack binding lookup", () => {
 			key: "legacy_thread_id",
 			binding: {
 				channelId: "slack:C123",
-				isDM: false,
+				isDM: true,
 				serializedThread: "{}",
 				sessionId: "sess-1",
 				state: { sessionId: "sess-1", cwd: "/tmp/work", teamId: "T123" },
@@ -67,7 +126,7 @@ describe("slack binding lookup", () => {
 		expect(result?.binding.sessionId).toBe("sess-2");
 	});
 
-	it("reuses a binding by participant key across different threads", () => {
+	it("does not reuse a binding by participant key across different threads", () => {
 		const result = __test__.findBindingForThread(
 			{
 				[participantKey]: {
@@ -94,8 +153,7 @@ describe("slack binding lookup", () => {
 			},
 		);
 
-		expect(result?.key).toBe(participantKey);
-		expect(result?.binding.sessionId).toBe("sess-1");
+		expect(result).toBeUndefined();
 	});
 
 	it("builds Slack participant keys with a team scope", () => {
@@ -157,6 +215,105 @@ describe("slack binding lookup", () => {
 		);
 	});
 
+	it("normalizes top-level channel mentions to the original Slack post thread", () => {
+		const original = new ThreadImpl({
+			adapterName: "slack",
+			channelId: "slack:C123",
+			id: "slack:C123:",
+			isDM: false,
+		});
+		const message = {
+			raw: {
+				channel: "C123",
+				text: "<@U999> help",
+				ts: "1710000000.123456",
+				type: "app_mention",
+				user: "U123",
+			},
+		} as Message;
+
+		const normalized = __test__.resolveSlackChannelMentionThread(
+			original,
+			message,
+		);
+
+		expect(normalized.id).toBe("slack:C123:1710000000.123456");
+		expect(normalized.channelId).toBe("slack:C123");
+		expect(normalized.isDM).toBe(false);
+	});
+
+	it("uses Slack thread_ts instead of reply ts for in-thread mentions", () => {
+		const original = new ThreadImpl({
+			adapterName: "slack",
+			channelId: "slack:C123",
+			id: "slack:C123:1710000001.654321",
+			isDM: false,
+		});
+		const message = {
+			raw: {
+				channel: "C123",
+				text: "<@U999> follow up",
+				thread_ts: "1710000000.123456",
+				ts: "1710000001.654321",
+				type: "app_mention",
+				user: "U123",
+			},
+		} as Message;
+
+		const normalized = __test__.resolveSlackChannelMentionThread(
+			original,
+			message,
+		);
+
+		expect(normalized.id).toBe("slack:C123:1710000000.123456");
+		expect(normalized.channelId).toBe("slack:C123");
+		expect(normalized.isDM).toBe(false);
+	});
+
+	it("keeps Slack mention threads that already target the original post", () => {
+		const original = new ThreadImpl({
+			adapterName: "slack",
+			channelId: "slack:C123",
+			id: "slack:C123:1710000000.123456",
+			isDM: false,
+		});
+		const message = {
+			raw: {
+				channel: "C123",
+				text: "<@U999> help",
+				ts: "1710000000.123456",
+				type: "app_mention",
+				user: "U123",
+			},
+		} as Message;
+
+		expect(__test__.resolveSlackChannelMentionThread(original, message)).toBe(
+			original,
+		);
+	});
+
+	it("does not rewrite Slack DM mention threads", () => {
+		const original = new ThreadImpl({
+			adapterName: "slack",
+			channelId: "slack:D123",
+			id: "slack:D123:",
+			isDM: true,
+		});
+		const message = {
+			raw: {
+				channel: "D123",
+				text: "help",
+				ts: "1710000000.123456",
+				type: "message",
+				user: "U123",
+			},
+		} as Message;
+
+		expect(__test__.resolveSlackChannelMentionThread(original, message)).toBe(
+			original,
+		);
+	});
+
 	it("routes Slack posts through the installation bot token for a team", async () => {
 		const calls: string[] = [];
 		const result = await __test__.withSlackTeamBotToken({

apps/cli/src/connectors/adapters/slack.ts

@@ -9,6 +9,7 @@ import {
 	type Adapter,
 	Chat,
 	ConsoleLogger,
+	type Message,
 	type Thread,
 	ThreadImpl,
 } from "chat";
@@ -50,7 +51,7 @@ import {
 	type ConnectorThreadBinding,
 	type ConnectorThreadState,
 	clearBindingSessionIds,
-	findBindingForParticipantKey,
+	findBindingForDeliveryTarget,
 	findBindingForThread,
 	loadThreadState,
 	persistMergedThreadState,
@@ -79,6 +80,14 @@ type SlackThreadState = ConnectorThreadState & {
 	teamId?: string;
 };
 
+type SlackConnectionMode = ConnectSlackOptions["connectionMode"];
+
+function inferSlackConnectionMode(
+	baseUrl: string | undefined,
+): SlackConnectionMode {
+	return baseUrl?.trim() ? "webhook" : "socket";
+}
+
 function truncateText(value: string, maxLength = 160): string {
 	return truncateConnectorText(value, maxLength);
 }
@@ -184,6 +193,56 @@ function extractSlackTeamId(raw: unknown): string | undefined {
 	return value?.trim() || undefined;
 }
 
+function extractSlackMessageRecord(
+	raw: unknown,
+): Record<string, unknown> | undefined {
+	const record = asRecord(raw);
+	return asRecord(record?.event) ?? asRecord(record?.message) ?? record;
+}
+
+function extractSlackChannelFromId(id: string): string | undefined {
+	const parts = id.split(":");
+	return parts[0] === "slack" ? readString(parts[1]) : undefined;
+}
+
+function resolveSlackChannelMentionThread(
+	thread: Thread<SlackThreadState>,
+	message: Message,
+): Thread<SlackThreadState> {
+	if (thread.isDM) {
+		return thread;
+	}
+	const event = extractSlackMessageRecord(message.raw);
+	const threadTs = readString(event?.thread_ts) ?? readString(event?.ts);
+	if (!threadTs) {
+		return thread;
+	}
+	const channel =
+		readString(event?.channel) ??
+		extractSlackChannelFromId(thread.id) ??
+		extractSlackChannelFromId(thread.channelId);
+	if (!channel) {
+		return thread;
+	}
+	const threadId = `slack:${channel}:${threadTs}`;
+	const channelId = `slack:${channel}`;
+	if (thread.id === threadId && thread.channelId === channelId) {
+		return thread;
+	}
+	return new ThreadImpl<SlackThreadState>({
+		adapterName: "slack",
+		channelId,
+		channelVisibility: thread.channelVisibility,
+		currentMessage: message,
+		fallbackStreamingPlaceholderText: null,
+		id: threadId,
+		initialMessage: message,
+		isDM: false,
+		isSubscribedContext: false,
+		streamingUpdateIntervalMs: 500,
+	});
+}
+
 async function withSlackBindingBotToken<T>(input: {
 	slack: Pick<SlackAdapter, "getInstallation" | "withBotToken">;
 	binding: ConnectorThreadBinding<SlackThreadState>;
@@ -317,20 +376,20 @@ async function deliverScheduledResult(input: {
 	const threadId =
 		typeof delivery.threadId === "string" ? delivery.threadId.trim() : "";
 	const bindingKey =
-		typeof delivery.bindingKey === "string"
-			? delivery.bindingKey.trim()
-			: typeof delivery.participantKey === "string"
-				? delivery.participantKey.trim()
-				: "";
-	if (!threadId && !bindingKey) {
+		typeof delivery.bindingKey === "string" ? delivery.bindingKey.trim() : "";
+	const participantKey =
+		typeof delivery.participantKey === "string"
+			? delivery.participantKey.trim()
+			: "";
+	if (!threadId && !bindingKey && !participantKey) {
 		return;
 	}
 	const bindings = readBindings<SlackThreadState>(input.bindingsPath);
-	const match = bindingKey
-		? findBindingForParticipantKey(bindings, bindingKey)
-		: threadId
-			? { key: threadId, binding: bindings[threadId] }
-			: undefined;
+	const match = findBindingForDeliveryTarget(bindings, {
+		bindingKey,
+		threadId,
+		participantKey,
+	});
 	const binding = match?.binding;
 	const deliveryThreadId = match?.key || threadId || bindingKey;
 	if (!binding?.serializedThread) {
@@ -380,7 +439,10 @@ class SlackConnector extends ConnectorBase<
 	SlackConnectorState
 > {
 	constructor() {
-		super("slack", "Slack webhook bridge backed by RPC runtime sessions");
+		super(
+			"slack",
+			"Slack webhook/socket bridge backed by RPC runtime sessions",
+		);
 	}
 
 	protected override createCommand(): Command {
@@ -393,6 +455,7 @@ class SlackConnector extends ConnectorBase<
 				"Slack bot token for single-workspace mode",
 			)
 			.option("--signing-secret <secret>", "Slack signing secret")
+			.option("--app-token <token>", "Slack app-level token for socket mode")
 			.option("--client-id <id>", "Slack OAuth client id")
 			.option("--client-secret <secret>", "Slack OAuth client secret")
 			.option(
@@ -433,6 +496,7 @@ class SlackConnector extends ConnectorBase<
 					"Environment:",
 					"  SLACK_BOT_TOKEN             Single-workspace bot token",
 					"  SLACK_SIGNING_SECRET        Slack signing secret",
+					"  SLACK_APP_TOKEN             App-level token for socket mode",
 					"  SLACK_CLIENT_ID             OAuth client id",
 					"  SLACK_CLIENT_SECRET         OAuth client secret",
 					"  SLACK_ENCRYPTION_KEY        Optional installation encryption key",
@@ -445,6 +509,7 @@ class SlackConnector extends ConnectorBase<
 			userName?: string;
 			botToken?: string;
 			signingSecret?: string;
+			appToken?: string;
 			clientId?: string;
 			clientSecret?: string;
 			encryptionKey?: string;
@@ -467,17 +532,50 @@ class SlackConnector extends ConnectorBase<
 			this.parseOptionalInteger(opts.port, "port") ??
 			Number.parseInt(process.env.PORT ?? "8787", 10);
 		const port = Number.isFinite(parsedPort) ? parsedPort : 8787;
+		const baseUrl = opts.baseUrl?.trim() || process.env.BASE_URL?.trim();
+		const connectionMode = inferSlackConnectionMode(baseUrl);
+		const isSocketMode = connectionMode === "socket";
+		if (isSocketMode && (opts.clientId?.trim() || opts.clientSecret?.trim())) {
+			throw new Error(
+				"Slack socket mode does not support --client-id or --client-secret",
+			);
+		}
+		const botToken =
+			opts.botToken?.trim() || process.env.SLACK_BOT_TOKEN?.trim();
+		const appToken = isSocketMode
+			? opts.appToken?.trim() || process.env.SLACK_APP_TOKEN?.trim()
+			: undefined;
+		if (isSocketMode && !appToken) {
+			throw new Error(
+				"Slack socket mode requires --app-token or SLACK_APP_TOKEN",
+			);
+		}
+		if (isSocketMode && !botToken) {
+			throw new Error(
+				"Slack socket mode requires --bot-token or SLACK_BOT_TOKEN",
+			);
+		}
 		return {
 			userName:
 				opts.userName?.trim() ||
 				process.env.SLACK_BOT_USERNAME?.trim() ||
 				"cline-slack",
-			botToken: opts.botToken?.trim() || process.env.SLACK_BOT_TOKEN?.trim(),
+			connectionMode,
+			botToken,
 			signingSecret:
-				opts.signingSecret?.trim() || process.env.SLACK_SIGNING_SECRET?.trim(),
-			clientId: opts.clientId?.trim() || process.env.SLACK_CLIENT_ID?.trim(),
+				connectionMode === "webhook"
+					? opts.signingSecret?.trim() ||
+						process.env.SLACK_SIGNING_SECRET?.trim()
+					: opts.signingSecret?.trim(),
+			appToken,
+			clientId:
+				connectionMode === "webhook"
+					? opts.clientId?.trim() || process.env.SLACK_CLIENT_ID?.trim()
+					: undefined,
 			clientSecret:
-				opts.clientSecret?.trim() || process.env.SLACK_CLIENT_SECRET?.trim(),
+				connectionMode === "webhook"
+					? opts.clientSecret?.trim() || process.env.SLACK_CLIENT_SECRET?.trim()
+					: undefined,
 			encryptionKey:
 				opts.encryptionKey?.trim() || process.env.SLACK_ENCRYPTION_KEY?.trim(),
 			installationKeyPrefix:
@@ -500,10 +598,7 @@ class SlackConnector extends ConnectorBase<
 				process.env.CLINE_CONNECT_HOOK_COMMAND?.trim(),
 			port,
 			host: opts.host?.trim() || process.env.HOST?.trim() || "0.0.0.0",
-			baseUrl:
-				opts.baseUrl?.trim() ||
-				process.env.BASE_URL?.trim() ||
-				`http://127.0.0.1:${port}`,
+			baseUrl,
 		};
 	}
 
@@ -599,9 +694,11 @@ class SlackConnector extends ConnectorBase<
 				readState: (path) => this.readConnectorState(path),
 				isRunning: (state) => isProcessRunning(state.pid),
 				formatAlreadyRunningMessage: (state) =>
-					`[slack] connector already running pid=${state.pid} rpc=${state.rpcAddress} url=${state.baseUrl}`,
+					state.connectionMode === "socket"
+						? `[slack] connector already running pid=${state.pid} rpc=${state.rpcAddress} mode=socket`
+						: `[slack] connector already running pid=${state.pid} rpc=${state.rpcAddress} url=${state.baseUrl}`,
 				formatBackgroundStartMessage: (pid) =>
-					`[slack] starting background connector pid=${pid} user=${options.userName}`,
+					`[slack] starting background connector pid=${pid} user=${options.userName} mode=${options.connectionMode}`,
 				foregroundHint:
 					"[slack] use `cline connect slack -i ...` to run in the foreground",
 				launchFailureMessage: "failed to launch Slack connector in background",
@@ -618,6 +715,7 @@ class SlackConnector extends ConnectorBase<
 		const consoleLogger = new ConsoleLogger("info", "slack-connect");
 		const slackConfig: Record<string, unknown> = {
 			logger: consoleLogger,
+			mode: options.connectionMode,
 			userName: options.userName,
 		};
 		if (options.botToken?.trim()) {
@@ -626,6 +724,9 @@ class SlackConnector extends ConnectorBase<
 		if (options.signingSecret?.trim()) {
 			slackConfig.signingSecret = options.signingSecret.trim();
 		}
+		if (options.appToken?.trim()) {
+			slackConfig.appToken = options.appToken.trim();
+		}
 		if (options.clientId?.trim()) {
 			slackConfig.clientId = options.clientId.trim();
 		}
@@ -694,10 +795,12 @@ class SlackConnector extends ConnectorBase<
 		await client.connect();
 		this.writeConnectorState(statePath, {
 			userName: options.userName,
+			connectionMode: options.connectionMode,
 			pid: process.pid,
 			rpcAddress,
-			port: options.port,
-			baseUrl: options.baseUrl,
+			...(options.connectionMode === "webhook"
+				? { port: options.port, baseUrl: options.baseUrl }
+				: {}),
 			startedAt: new Date().toISOString(),
 		});
 
@@ -723,7 +826,7 @@ class SlackConnector extends ConnectorBase<
 				bindingsPath,
 				startRequest,
 			);
-			const queueKey = currentState.participantKey || thread.id;
+			const queueKey = thread.id;
 			const runTurn = async () => {
 				try {
 					await withSlackTeamBotToken({
@@ -842,9 +945,10 @@ class SlackConnector extends ConnectorBase<
 		};
 
 		bot.onNewMention(async (thread, message) => {
-			await thread.subscribe();
+			const mentionThread = resolveSlackChannelMentionThread(thread, message);
+			await mentionThread.subscribe();
 			await persistSlackThreadContext({
-				thread,
+				thread: mentionThread,
 				bindingsPath,
 				baseStartRequest: startRequest,
 				rawMessage: message.raw,
@@ -852,7 +956,7 @@ class SlackConnector extends ConnectorBase<
 			});
 			if (
 				await maybeHandleConnectorApprovalReply({
-					thread,
+					thread: mentionThread,
 					text: message.text,
 					client,
 					clientId,
@@ -862,7 +966,7 @@ class SlackConnector extends ConnectorBase<
 			) {
 				return;
 			}
-			await handleTurn(thread, message.text);
+			await handleTurn(mentionThread, message.text);
 		});
 
 		bot.onSubscribedMessage(async (thread, message) => {
@@ -948,48 +1052,64 @@ class SlackConnector extends ConnectorBase<
 				},
 			});
 
-		const webhookUrl = `${options.baseUrl.replace(/\/$/, "")}/api/webhooks/slack`;
-		const oauthCallbackUrl = `${options.baseUrl.replace(/\/$/, "")}/api/oauth/slack/callback`;
-		const server = await startConnectorWebhookServer({
-			host: options.host,
-			port: options.port,
-			routes: {
-				"/api/webhooks/slack": async (request) => bot.webhooks.slack(request),
-				"/api/oauth/slack/callback": async (request) => {
-					try {
-						const result = await slack.handleOAuthCallback(request);
-						return new Response(
-							`Slack installation stored for team ${result.teamId}. You can return to Slack.`,
-						);
-					} catch (error) {
-						const message =
-							error instanceof Error ? error.message : String(error);
-						loggerAdapter.core.log("Slack OAuth callback failed", {
-							severity: "warn",
-							transport: "slack",
-							error: message,
+		let webhookUrl: string | undefined;
+		let oauthCallbackUrl: string | undefined;
+		const server =
+			options.connectionMode === "webhook"
+				? await (async () => {
+						const baseUrl = options.baseUrl?.trim();
+						if (!baseUrl) {
+							throw new Error(
+								"Slack webhook mode requires --base-url or BASE_URL",
+							);
+						}
+						webhookUrl = `${baseUrl.replace(/\/$/, "")}/api/webhooks/slack`;
+						oauthCallbackUrl = `${baseUrl.replace(/\/$/, "")}/api/oauth/slack/callback`;
+						return startConnectorWebhookServer({
+							host: options.host,
+							port: options.port,
+							routes: {
+								"/api/webhooks/slack": async (request) =>
+									bot.webhooks.slack(request),
+								"/api/oauth/slack/callback": async (request) => {
+									try {
+										const result = await slack.handleOAuthCallback(request);
+										return new Response(
+											`Slack installation stored for team ${result.teamId}. You can return to Slack.`,
+										);
+									} catch (error) {
+										const message =
+											error instanceof Error ? error.message : String(error);
+										loggerAdapter.core.log("Slack OAuth callback failed", {
+											severity: "warn",
+											transport: "slack",
+											error: message,
+										});
+										return new Response(`Slack OAuth error: ${message}`, {
+											status: 500,
+										});
+									}
+								},
+								"/health": () => new Response("ok"),
+								"/": () =>
+									new Response(
+										[
+											"Slack connector is running.",
+											"Connection mode: webhook",
+											`Webhook URL: ${webhookUrl}`,
+											`OAuth callback URL: ${oauthCallbackUrl}`,
+											options.botToken?.trim()
+												? "Auth mode: single workspace"
+												: options.clientId?.trim() &&
+														options.clientSecret?.trim()
+													? "Auth mode: multi-workspace OAuth"
+													: "Auth mode: incomplete (set bot token or OAuth credentials)",
+										].join("\n"),
+									),
+							},
 						});
-						return new Response(`Slack OAuth error: ${message}`, {
-							status: 500,
-						});
-					}
-				},
-				"/health": () => new Response("ok"),
-				"/": () =>
-					new Response(
-						[
-							"Slack connector is running.",
-							`Webhook URL: ${webhookUrl}`,
-							`OAuth callback URL: ${oauthCallbackUrl}`,
-							options.botToken?.trim()
-								? "Auth mode: single workspace"
-								: options.clientId?.trim() && options.clientSecret?.trim()
-									? "Auth mode: multi-workspace OAuth"
-									: "Auth mode: incomplete (set bot token or OAuth credentials)",
-						].join("\n"),
-					),
-			},
-		});
+					})()
+				: undefined;
 
 		const stopEventStream = client.streamEvents(
 			{ clientId: `${clientId}-server-events` },
@@ -1052,17 +1172,22 @@ class SlackConnector extends ConnectorBase<
 		process.once("SIGINT", () => requestStop("sigint"));
 		process.once("SIGTERM", () => requestStop("sigterm"));
 
-		io.writeln(`[slack] listening on ${options.host}:${options.port}`);
-		io.writeln(`[slack] configure Slack webhook URL: ${webhookUrl}`);
-		io.writeln(
-			`[slack] configure Slack OAuth callback URL: ${oauthCallbackUrl}`,
-		);
+		if (options.connectionMode === "webhook") {
+			io.writeln(`[slack] listening on ${options.host}:${options.port}`);
+			io.writeln(`[slack] configure Slack webhook URL: ${webhookUrl}`);
+			io.writeln(
+				`[slack] configure Slack OAuth callback URL: ${oauthCallbackUrl}`,
+			);
+		} else {
+			io.writeln("[slack] socket mode connected");
+		}
 
 		await stopPromise;
 		clearBindingSessionIds<SlackThreadState>(bindingsPath);
 		stopTaskUpdateStream();
 		stopEventStream();
-		await server.close();
+		await server?.close();
+		await bot.shutdown();
 		userInstructionService.stop();
 		client.close();
 		this.removeStateFile(statePath);
@@ -1073,9 +1198,11 @@ class SlackConnector extends ConnectorBase<
 export const slackConnector: ConnectCommandDefinition = new SlackConnector();
 
 export const __test__ = {
+	inferSlackConnectionMode,
 	buildSlackParticipantKey,
 	resolveSlackParticipant,
 	normalizeSlackMessageEventChannelType,
+	resolveSlackChannelMentionThread,
 	withSlackTeamBotToken,
 	isSlackInvalidThreadTsError,
 	findBindingForThread: (

apps/cli/src/connectors/adapters/telegram.md

@@ -76,7 +76,15 @@ cline connect telegram -k "$TELEGRAM_BOT_TOKEN" --no-tools
 
 When the connector starts with `--no-tools`, chat commands such as `/tools on` and `/yolo on` cannot re-enable tools for that connector run.
 
-For participant restrictions, run the interactive connector wizard with `cline connect` or pass a `--hook-command` that returns `{"action":"deny"}` for unauthorized `session.authorize` events. If no hook is configured, messages are allowed.
+For participant restrictions, run the interactive connector wizard with `cline connect`. The Telegram wizard asks whether to restrict access, points you to `@userinfobot`, and configures your numeric Telegram user ID.
+
+You can also pass the user ID directly:
+
+```bash
+cline connect telegram -k "$TELEGRAM_BOT_TOKEN" --allowed-user-id 12345
+```
+
+You can also pass a manual `--hook-command` that returns `{"action":"deny"}` for unauthorized `session.authorize` events. If neither access option is configured, messages are allowed.
 
 ## Message Delivery
 

apps/cli/src/connectors/adapters/telegram.test.ts

@@ -62,6 +62,72 @@ describe("telegramConnector", () => {
 		expect(options.enableTools).toBe(true);
 	});
 
+	it("builds an authorization hook from --allowed-user-id", () => {
+		const options = parseTelegramArgs([
+			"--bot-token",
+			"123:test",
+			"--cwd",
+			"/tmp/work",
+			"--allowed-user-id",
+			"1201547643",
+		]);
+
+		expect(options.hookCommand).toBe(
+			`jq -r ".payload.actor.participantKey" | grep -qx "telegram:id:1201547643" && echo '{"action":"allow"}' || echo '{"action":"deny","message":"unauthorized","reason":"not_on_allowlist"}'`,
+		);
+	});
+
+	it("rejects unsafe --allowed-user-id values", () => {
+		expect(() =>
+			parseTelegramArgs([
+				"--bot-token",
+				"123:test",
+				"--cwd",
+				"/tmp/work",
+				"--allowed-user-id",
+				"123; rm -rf /",
+			]),
+		).toThrow("digits only");
+	});
+
+	it("rejects mixing --allowed-user-id with --hook-command", () => {
+		expect(() =>
+			parseTelegramArgs([
+				"--bot-token",
+				"123:test",
+				"--cwd",
+				"/tmp/work",
+				"--allowed-user-id",
+				"1201547643",
+				"--hook-command",
+				"echo noop",
+			]),
+		).toThrow("either --allowed-user-id or --hook-command");
+	});
+
+	it("rejects mixing --allowed-user-id with the hook command env var", () => {
+		const originalHookCommand = process.env.CLINE_CONNECT_HOOK_COMMAND;
+		process.env.CLINE_CONNECT_HOOK_COMMAND = "echo noop";
+		try {
+			expect(() =>
+				parseTelegramArgs([
+					"--bot-token",
+					"123:test",
+					"--cwd",
+					"/tmp/work",
+					"--allowed-user-id",
+					"1201547643",
+				]),
+			).toThrow("either --allowed-user-id or --hook-command");
+		} finally {
+			if (originalHookCommand === undefined) {
+				delete process.env.CLINE_CONNECT_HOOK_COMMAND;
+			} else {
+				process.env.CLINE_CONNECT_HOOK_COMMAND = originalHookCommand;
+			}
+		}
+	});
+
 	it("does not require the bot username", () => {
 		const options = parseTelegramArgs([
 			"--bot-token",
@@ -297,7 +363,7 @@ describe("telegram binding lookup", () => {
 		expect(result?.binding.sessionId).toBe("sess-2");
 	});
 
-	it("reuses a binding by participant key across different chats", () => {
+	it("does not reuse a binding by participant key across different chats", () => {
 		const result = __test__.findBindingForThread(
 			{
 				"telegram:user:alice": {
@@ -323,7 +389,6 @@ describe("telegram binding lookup", () => {
 			},
 		);
 
-		expect(result?.key).toBe("telegram:user:alice");
-		expect(result?.binding.sessionId).toBe("sess-1");
+		expect(result).toBeUndefined();
 	});
 });

apps/cli/src/connectors/adapters/telegram.ts

@@ -42,7 +42,7 @@ import {
 	type ConnectorBindingStore,
 	type ConnectorThreadState,
 	clearBindingSessionIds,
-	findBindingForParticipantKey,
+	findBindingForDeliveryTarget,
 	findBindingForThread,
 	loadThreadState,
 	persistMergedThreadState,
@@ -89,6 +89,20 @@ function readTelegramBotId(botToken: string): string | undefined {
 	return /^\d+$/.test(botId) ? botId : undefined;
 }
 
+function normalizeAllowedTelegramUserId(value: string): string {
+	const userId = value.trim();
+	if (!/^\d+$/.test(userId)) {
+		throw new Error(
+			"connect telegram --allowed-user-id must contain digits only",
+		);
+	}
+	return userId;
+}
+
+function buildTelegramAllowedUserHookCommand(userId: string): string {
+	return `jq -r ".payload.actor.participantKey" | grep -qx "telegram:id:${userId}" && echo '{"action":"allow"}' || echo '{"action":"deny","message":"unauthorized","reason":"not_on_allowlist"}'`;
+}
+
 function describeTelegramGetMeFailure(
 	response: Response,
 	body: string,
@@ -279,20 +293,20 @@ async function deliverScheduledResult(input: {
 	const threadId =
 		typeof delivery.threadId === "string" ? delivery.threadId.trim() : "";
 	const bindingKey =
-		typeof delivery.bindingKey === "string"
-			? delivery.bindingKey.trim()
-			: typeof delivery.participantKey === "string"
-				? delivery.participantKey.trim()
-				: "";
-	if (!threadId && !bindingKey) {
+		typeof delivery.bindingKey === "string" ? delivery.bindingKey.trim() : "";
+	const participantKey =
+		typeof delivery.participantKey === "string"
+			? delivery.participantKey.trim()
+			: "";
+	if (!threadId && !bindingKey && !participantKey) {
 		return;
 	}
 	const bindings = readBindings<TelegramThreadState>(input.bindingsPath);
-	const match = bindingKey
-		? findBindingForParticipantKey(bindings, bindingKey)
-		: threadId
-			? { key: threadId, binding: bindings[threadId] }
-			: undefined;
+	const match = findBindingForDeliveryTarget(bindings, {
+		bindingKey,
+		threadId,
+		participantKey,
+	});
 	const binding = match?.binding;
 	const deliveryThreadId = match?.key || threadId;
 	if (!binding?.serializedThread) {
@@ -418,6 +432,10 @@ class TelegramConnector extends ConnectorBase<
 			.option("--mode <act|plan>", "Agent mode", "act")
 			.option("-i, --interactive", "Keep connector in foreground")
 			.option("--no-tools", "Disable tools for Telegram sessions")
+			.option(
+				"--allowed-user-id <id>",
+				"Only allow this Telegram user ID to use the bot",
+			)
 			.option(
 				"--hook-command <command>",
 				"Run a shell command for connector events",
@@ -434,6 +452,7 @@ class TelegramConnector extends ConnectorBase<
 					"Notes:",
 					"  - Without -i, the connector is launched in the background.",
 					"  - Tools are enabled by default for Telegram sessions.",
+					"  - Use --allowed-user-id or `cline connect` to restrict Telegram access.",
 					"  - Bot username is discovered from the Telegram bot token when omitted.",
 					"  - Provider/model default to the CLI's last-used provider settings.",
 				].join("\n"),
@@ -454,6 +473,7 @@ class TelegramConnector extends ConnectorBase<
 			tools?: boolean;
 			rpcAddress?: string;
 			hookCommand?: string;
+			allowedUserId?: string;
 		}>();
 		const botUsername =
 			normalizeTelegramBotUsername(opts.botUsername ?? "") ||
@@ -465,6 +485,15 @@ class TelegramConnector extends ConnectorBase<
 		if (!botToken) {
 			throw new Error("connect telegram requires -k/--bot-token <token>");
 		}
+		const hookCommand =
+			opts.hookCommand?.trim() ||
+			process.env.CLINE_CONNECT_HOOK_COMMAND?.trim();
+		const allowedUserId = opts.allowedUserId?.trim();
+		if (hookCommand && allowedUserId) {
+			throw new Error(
+				"connect telegram accepts either --allowed-user-id or --hook-command, not both",
+			);
+		}
 		return {
 			botToken,
 			...(botUsername ? { botUsername } : {}),
@@ -480,9 +509,11 @@ class TelegramConnector extends ConnectorBase<
 				opts.rpcAddress?.trim() ||
 				process.env.CLINE_RPC_ADDRESS?.trim() ||
 				resolveDefaultCliRpcAddress(),
-			hookCommand:
-				opts.hookCommand?.trim() ||
-				process.env.CLINE_CONNECT_HOOK_COMMAND?.trim(),
+			hookCommand: allowedUserId
+				? buildTelegramAllowedUserHookCommand(
+						normalizeAllowedTelegramUserId(allowedUserId),
+					)
+				: hookCommand,
 		};
 	}
 
@@ -757,9 +788,7 @@ class TelegramConnector extends ConnectorBase<
 			thread: Thread<TelegramThreadState>,
 			text: string,
 		) => {
-			const queueKey =
-				(await loadThreadState(thread, bindingsPath, startRequest))
-					.participantKey || thread.id;
+			const queueKey = thread.id;
 			const runTurn = async () => {
 				try {
 					await handleConnectorUserTurn({

apps/cli/src/connectors/adapters/whatsapp.test.ts

@@ -65,7 +65,7 @@ describe("whatsapp binding lookup", () => {
 		expect(result?.binding.sessionId).toBe("sess-2");
 	});
 
-	it("reuses a binding by participant key across different threads", () => {
+	it("does not reuse a binding by participant key across different threads", () => {
 		const result = __test__.findBindingForThread(
 			{
 				"whatsapp:user:15551234567": {
@@ -91,7 +91,6 @@ describe("whatsapp binding lookup", () => {
 			},
 		);
 
-		expect(result?.key).toBe("whatsapp:user:15551234567");
-		expect(result?.binding.sessionId).toBe("sess-1");
+		expect(result).toBeUndefined();
 	});
 });

apps/cli/src/connectors/adapters/whatsapp.ts

@@ -46,7 +46,7 @@ import {
 	type ConnectorBindingStore,
 	type ConnectorThreadState,
 	clearBindingSessionIds,
-	findBindingForParticipantKey,
+	findBindingForDeliveryTarget,
 	findBindingForThread,
 	loadThreadState,
 	persistMergedThreadState,
@@ -226,20 +226,20 @@ async function deliverScheduledResult(input: {
 	const threadId =
 		typeof delivery.threadId === "string" ? delivery.threadId.trim() : "";
 	const bindingKey =
-		typeof delivery.bindingKey === "string"
-			? delivery.bindingKey.trim()
-			: typeof delivery.participantKey === "string"
-				? delivery.participantKey.trim()
-				: "";
-	if (!threadId && !bindingKey) {
+		typeof delivery.bindingKey === "string" ? delivery.bindingKey.trim() : "";
+	const participantKey =
+		typeof delivery.participantKey === "string"
+			? delivery.participantKey.trim()
+			: "";
+	if (!threadId && !bindingKey && !participantKey) {
 		return;
 	}
 	const bindings = readBindings<WhatsAppThreadState>(input.bindingsPath);
-	const match = bindingKey
-		? findBindingForParticipantKey(bindings, bindingKey)
-		: threadId
-			? { key: threadId, binding: bindings[threadId] }
-			: undefined;
+	const match = findBindingForDeliveryTarget(bindings, {
+		bindingKey,
+		threadId,
+		participantKey,
+	});
 	const binding = match?.binding;
 	if (!binding?.serializedThread) {
 		return;
@@ -597,9 +597,7 @@ class WhatsAppConnector extends ConnectorBase<
 			thread: Thread<WhatsAppThreadState>,
 			text: string,
 		) => {
-			const queueKey =
-				(await loadThreadState(thread, bindingsPath, startRequest))
-					.participantKey || thread.id;
+			const queueKey = thread.id;
 			const runTurn = async () => {
 				try {
 					await handleConnectorUserTurn({

apps/cli/src/connectors/catalog.ts

@@ -19,7 +19,7 @@ export const CONNECTOR_CATALOG: ConnectorCatalogEntry[] = [
 	},
 	{
 		name: "slack",
-		description: "Slack webhook bridge backed by RPC runtime sessions",
+		description: "Slack webhook/socket bridge backed by RPC runtime sessions",
 	},
 	{
 		name: "telegram",

apps/cli/src/connectors/connector-host.test.ts

@@ -92,6 +92,11 @@ function createRuntimeClient(
 ) {
 	const startRuntimeSession = vi.fn(async () => ({ sessionId: "session-1" }));
 	const updateSession = vi.fn(async () => undefined);
+	const getSession = vi.fn(
+		async (sessionId: string): Promise<{ sessionId: string } | undefined> => ({
+			sessionId,
+		}),
+	);
 	const abortRuntimeSession = vi.fn(async () => undefined);
 	const deleteSession = vi.fn(async () => undefined);
 	const sendRuntimeSession = vi.fn(async () => ({
@@ -106,6 +111,7 @@ function createRuntimeClient(
 		client: {
 			startRuntimeSession,
 			updateSession,
+			getSession,
 			abortRuntimeSession,
 			stopRuntimeSession: abortRuntimeSession,
 			deleteSession,
@@ -115,6 +121,7 @@ function createRuntimeClient(
 		},
 		startRuntimeSession,
 		updateSession,
+		getSession,
 		sendRuntimeSession,
 		readMessages,
 	};
@@ -593,7 +600,8 @@ describe("handleConnectorUserTurn", () => {
 				metadata: expect.objectContaining({
 					delivery: expect.objectContaining({
 						adapter: "telegram",
-						bindingKey: "telegram:user:alice",
+						bindingKey: "thread-1",
+						participantKey: "telegram:user:alice",
 					}),
 				}),
 			}),
@@ -627,7 +635,8 @@ describe("handleConnectorUserTurn", () => {
 				metadata: {
 					delivery: {
 						adapter: "telegram",
-						bindingKey: "telegram:user:alice",
+						bindingKey: "thread-1",
+						participantKey: "telegram:user:alice",
 						threadId: "thread-1",
 					},
 				},
@@ -640,7 +649,8 @@ describe("handleConnectorUserTurn", () => {
 				metadata: {
 					delivery: {
 						adapter: "telegram",
-						bindingKey: "telegram:user:bob",
+						bindingKey: "thread-2",
+						participantKey: "telegram:user:bob",
 						threadId: "thread-2",
 					},
 				},
@@ -699,7 +709,8 @@ describe("handleConnectorUserTurn", () => {
 					delivery: expect.objectContaining({
 						adapter: "telegram",
 						threadId: "thread-1",
-						bindingKey: "telegram:user:alice",
+						bindingKey: "thread-1",
+						participantKey: "telegram:user:alice",
 						userName: "ClineAdapterBot",
 					}),
 				}),
@@ -1442,7 +1453,7 @@ describe("handleConnectorUserTurn", () => {
 		});
 		const runtime = createRuntimeClient("unused");
 		const activeTurns = new Map([
-			["other-turn-key", { sessionId: "session-1" }],
+			["other-turn-key", { sessionId: "session-1", threadId: "thread-1" }],
 		]);
 
 		await handleConnectorUserTurn({
@@ -1478,4 +1489,105 @@ describe("handleConnectorUserTurn", () => {
 		);
 		expect(posts.at(-1)).toEqual({ raw: "Steering current task." });
 	});
+
+	it("starts a normal turn when the active session is in a different thread", async () => {
+		const dir = mkdtempSync(join(tmpdir(), "connector-host-test-"));
+		tempDirs.push(dir);
+		const bindingsPath = join(dir, "threads.json");
+		const { thread, posts } = createThread({
+			enableTools: true,
+			autoApproveTools: true,
+			cwd: "/tmp/work",
+			workspaceRoot: "/tmp/work",
+			welcomeSentAt: new Date().toISOString(),
+		});
+		const runtime = createRuntimeClient("normal reply");
+		const activeTurns = new Map([
+			["other-thread", { sessionId: "session-1", threadId: "other-thread" }],
+		]);
+
+		await handleConnectorUserTurn({
+			thread: thread as never,
+			text: "start work in this thread",
+			client: runtime.client as never,
+			pendingApprovals: new Map(),
+			baseStartRequest: baseStartRequest() as never,
+			explicitSystemPrompt: undefined,
+			clientId: "client-1",
+			logger: {
+				core: { debug: vi.fn(), log: vi.fn(), error: vi.fn() },
+			} as never,
+			transport: "telegram",
+			botUserName: "ClineAdapterBot",
+			requestStop: vi.fn(),
+			bindingsPath,
+			systemRules: "rules",
+			errorLabel: "Telegram",
+			getSessionMetadata: () => ({}),
+			reusedLogMessage: "reused",
+			activeTurns,
+			turnKey: "thread-1",
+		});
+
+		expect(runtime.startRuntimeSession).toHaveBeenCalled();
+		expect(runtime.sendRuntimeSession).toHaveBeenCalledWith(
+			"session-1",
+			expect.not.objectContaining({
+				delivery: "steer",
+			}),
+			{ timeoutMs: null },
+		);
+		expect(posts.at(-1)).toEqual({ raw: "normal reply" });
+	});
+
+	it("starts a fresh session when persisted thread session is missing from the hub", async () => {
+		const dir = mkdtempSync(join(tmpdir(), "connector-host-test-"));
+		tempDirs.push(dir);
+		const bindingsPath = join(dir, "threads.json");
+		const { thread, posts, getState } = createThread({
+			sessionId: "stale-session",
+			enableTools: true,
+			autoApproveTools: true,
+			cwd: "/tmp/work",
+			workspaceRoot: "/tmp/work",
+			welcomeSentAt: new Date().toISOString(),
+		});
+		const runtime = createRuntimeClient("fresh reply");
+		runtime.getSession.mockResolvedValueOnce(undefined);
+
+		await handleConnectorUserTurn({
+			thread: thread as never,
+			text: "continue after hub restart",
+			client: runtime.client as never,
+			pendingApprovals: new Map(),
+			baseStartRequest: baseStartRequest() as never,
+			explicitSystemPrompt: undefined,
+			clientId: "client-1",
+			logger: {
+				core: { debug: vi.fn(), log: vi.fn(), error: vi.fn() },
+			} as never,
+			transport: "telegram",
+			botUserName: "ClineAdapterBot",
+			requestStop: vi.fn(),
+			bindingsPath,
+			systemRules: "rules",
+			errorLabel: "Telegram",
+			getSessionMetadata: () => ({}),
+			reusedLogMessage: "reused",
+			startedLogMessage: "started",
+			turnKey: "thread-1",
+		});
+
+		expect(runtime.getSession).toHaveBeenCalledWith("stale-session");
+		expect(runtime.startRuntimeSession).toHaveBeenCalled();
+		expect(runtime.sendRuntimeSession).toHaveBeenCalledWith(
+			"session-1",
+			expect.not.objectContaining({
+				delivery: "steer",
+			}),
+			{ timeoutMs: null },
+		);
+		expect(getState().sessionId).toBe("session-1");
+		expect(posts.at(-1)).toEqual({ raw: "fresh reply" });
+	});
 });

apps/cli/src/connectors/connector-host.ts

@@ -749,9 +749,7 @@ export async function handleConnectorUserTurn<
 					`channelId=${input.thread.channelId}`,
 					`deliveryAdapter=${input.transport}`,
 					`deliveryThread=${input.thread.id}`,
-					...(effectiveCurrent.participantKey
-						? [`deliveryBindingKey=${effectiveCurrent.participantKey}`]
-						: []),
+					`deliveryBindingKey=${input.thread.id}`,
 					`deliveryChannel=${input.thread.channelId}`,
 					...(input.botUserName
 						? [`deliveryUserName=${input.botUserName}`]
@@ -789,11 +787,9 @@ export async function handleConnectorUserTurn<
 						delivery: {
 							adapter: input.transport,
 							threadId: input.thread.id,
+							bindingKey: input.thread.id,
 							...(current.participantKey
-								? {
-										bindingKey: current.participantKey,
-										participantKey: current.participantKey,
-									}
+								? { participantKey: current.participantKey }
 								: {}),
 							...(current.participantLabel
 								? { participantLabel: current.participantLabel }
@@ -832,11 +828,6 @@ export async function handleConnectorUserTurn<
 					].join("\n");
 				},
 				list: async () => {
-					const current = await loadThreadState(
-						input.thread,
-						input.bindingsPath,
-						input.baseStartRequest,
-					);
 					const schedules = await input.client.listSchedules({ limit: 200 });
 					const matching = schedules.filter((schedule) => {
 						const delivery = schedule.metadata?.delivery;
@@ -846,17 +837,9 @@ export async function handleConnectorUserTurn<
 							!Array.isArray(delivery)
 								? (delivery as Record<string, unknown>)
 								: undefined;
-						const deliveryBindingKey =
-							typeof deliveryRecord?.bindingKey === "string"
-								? deliveryRecord.bindingKey
-								: typeof deliveryRecord?.participantKey === "string"
-									? deliveryRecord.participantKey
-									: undefined;
 						return (
 							deliveryRecord?.adapter === input.transport &&
-							(current.participantKey
-								? deliveryBindingKey === current.participantKey
-								: deliveryRecord.threadId === input.thread.id)
+							deliveryRecord.threadId === input.thread.id
 						);
 					});
 					if (matching.length === 0) {
@@ -913,7 +896,9 @@ export async function handleConnectorUserTurn<
 		input.activeTurns?.get(turnKey) ??
 		(input.activeTurns && currentState.sessionId?.trim()
 			? Array.from(input.activeTurns.values()).find(
-					(turn) => turn.sessionId === currentState.sessionId?.trim(),
+					(turn) =>
+						turn.sessionId === currentState.sessionId?.trim() &&
+						turn.threadId === input.thread.id,
 				)
 			: undefined);
 	if (activeTurn?.sessionId?.trim()) {

apps/cli/src/connectors/session-runtime.ts

@@ -159,36 +159,57 @@ export async function getOrCreateSessionId<
 	);
 	const existing = threadState.sessionId?.trim();
 	if (existing) {
+		const existingSession = await input.client.getSession(existing);
+		if (existingSession) {
+			await persistMergedThreadState(
+				input.thread,
+				input.bindingsPath,
+				{
+					...threadState,
+					sessionId: existing,
+				},
+				input.errorLabel,
+			);
+			input.logger.core.log(input.reusedLogMessage, {
+				transport: input.transport,
+				threadId: input.thread.id,
+				sessionId: existing,
+			});
+			await dispatchConnectorHook(
+				input.hookCommand,
+				{
+					adapter: input.transport,
+					botUserName: input.hookBotUserName,
+					event: "session.reused",
+					payload: {
+						threadId: input.thread.id,
+						channelId: input.thread.channelId,
+						sessionId: existing,
+					},
+					ts: new Date().toISOString(),
+				},
+				input.logger,
+			);
+			return existing;
+		}
 		await persistMergedThreadState(
 			input.thread,
 			input.bindingsPath,
 			{
 				...threadState,
-				sessionId: existing,
+				sessionId: undefined,
 			},
 			input.errorLabel,
 		);
-		input.logger.core.log(input.reusedLogMessage, {
-			transport: input.transport,
-			threadId: input.thread.id,
-			sessionId: existing,
-		});
-		await dispatchConnectorHook(
-			input.hookCommand,
+		input.logger.core.log(
+			"Connector thread session missing; starting a new session",
 			{
-				adapter: input.transport,
-				botUserName: input.hookBotUserName,
-				event: "session.reused",
-				payload: {
-					threadId: input.thread.id,
-					channelId: input.thread.channelId,
-					sessionId: existing,
-				},
-				ts: new Date().toISOString(),
+				severity: "warn",
+				transport: input.transport,
+				threadId: input.thread.id,
+				sessionId: existing,
 			},
-			input.logger,
 		);
-		return existing;
 	}
 
 	const started = await input.client.startRuntimeSession(input.startRequest);

apps/cli/src/connectors/status.ts

@@ -26,6 +26,7 @@ export type ActiveConnectorRecord = {
 	phoneNumberId?: string;
 	port?: number;
 	baseUrl?: string;
+	connectionMode?: string;
 };
 
 function listConnectorStatePaths(
@@ -68,6 +69,8 @@ const connectorFieldExtractors: Record<
 	startedAt: (p) => (typeof p.startedAt === "string" ? p.startedAt : undefined),
 	port: (p) => (typeof p.port === "number" ? p.port : undefined),
 	baseUrl: (p) => (typeof p.baseUrl === "string" ? p.baseUrl : undefined),
+	connectionMode: (p) =>
+		typeof p.connectionMode === "string" ? p.connectionMode : undefined,
 	userName: (p) => (typeof p.userName === "string" ? p.userName : undefined),
 	botUsername: (p) =>
 		typeof p.botUsername === "string" ? p.botUsername : undefined,
@@ -91,7 +94,10 @@ const connectorConfigs: Record<
 		required: ["userName"],
 		optional: ["startedAt", "port", "baseUrl"],
 	},
-	slack: { required: ["userName"], optional: ["startedAt", "port", "baseUrl"] },
+	slack: {
+		required: ["userName"],
+		optional: ["startedAt", "connectionMode", "port", "baseUrl"],
+	},
 	whatsapp: {
 		required: ["userName"],
 		optional: ["startedAt", "phoneNumberId", "port", "baseUrl"],

apps/cli/src/connectors/thread-bindings.test.ts

@@ -6,6 +6,7 @@ import { afterEach, describe, expect, it } from "vitest";
 import {
 	type ConnectorThreadState,
 	clearBindingSessionIds,
+	findBindingForDeliveryTarget,
 	isParticipantMuted,
 	isThreadMuted,
 	readBindingForThread,
@@ -52,16 +53,16 @@ afterEach(() => {
 });
 
 describe("thread binding refresh", () => {
-	it("refreshes the serialized thread immediately when channel fallback rebinds a thread id", () => {
+	it("refreshes the serialized thread immediately when DM channel fallback rebinds a thread id", () => {
 		const path = createBindingsPath();
 		writeBindings<TestState>(path, {
 			legacy_thread_id: {
 				channelId: "slack:C123",
-				isDM: false,
+				isDM: true,
 				serializedThread: JSON.stringify({
 					id: "legacy_thread_id",
 					channelId: "slack:C123",
-					isDM: false,
+					isDM: true,
 				}),
 				sessionId: "sess-1",
 				state: { sessionId: "sess-1", teamId: "T123" },
@@ -74,7 +75,7 @@ describe("thread binding refresh", () => {
 			createThread({
 				id: "new_thread_id",
 				channelId: "slack:C123",
-				isDM: false,
+				isDM: true,
 			}),
 			"Slack",
 		);
@@ -85,7 +86,7 @@ describe("thread binding refresh", () => {
 		expect(bindings.new_thread_id?.serializedThread).toContain("new_thread_id");
 	});
 
-	it("refreshes the serialized thread when a participant-key binding matches a new thread id", () => {
+	it("does not rebind a different thread by participant key", () => {
 		const path = createBindingsPath();
 		const participantKey = "slack:team:T123:user:U123";
 		writeBindings<TestState>(path, {
@@ -119,10 +120,69 @@ describe("thread binding refresh", () => {
 			participantKey,
 		);
 
-		expect(binding?.serializedThread).toContain("new_thread_id");
+		expect(binding).toBeUndefined();
 		expect(
 			readBindings<TestState>(path)[participantKey]?.serializedThread,
-		).toContain("new_thread_id");
+		).toContain("legacy_thread_id");
+	});
+
+	it("resolves schedule delivery targets by exact binding key before participant metadata", () => {
+		const path = createBindingsPath();
+		writeBindings<TestState>(path, {
+			"slack:C123:111.222": {
+				kind: "conversation",
+				channelId: "slack:C123",
+				isDM: false,
+				participantKey: "slack:team:T123:user:U123",
+				serializedThread: "{}",
+				sessionId: "sess-thread",
+				state: {
+					sessionId: "sess-thread",
+					participantKey: "slack:team:T123:user:U123",
+				},
+				updatedAt: "2026-03-17T00:00:00.000Z",
+			},
+		});
+
+		const match = findBindingForDeliveryTarget<TestState>(
+			readBindings<TestState>(path),
+			{
+				bindingKey: "slack:C123:111.222",
+				threadId: "slack:C123:111.222",
+				participantKey: "slack:team:T123:user:U123",
+			},
+		);
+
+		expect(match?.key).toBe("slack:C123:111.222");
+		expect(match?.binding.sessionId).toBe("sess-thread");
+	});
+
+	it("resolves schedule delivery targets by participant key when no exact thread binding exists", () => {
+		const path = createBindingsPath();
+		writeBindings<TestState>(path, {
+			"slack:team:T123:user:U123": {
+				channelId: "slack:C123",
+				isDM: true,
+				participantKey: "slack:team:T123:user:U123",
+				serializedThread: "{}",
+				sessionId: "sess-participant",
+				state: {
+					sessionId: "sess-participant",
+					participantKey: "slack:team:T123:user:U123",
+				},
+				updatedAt: "2026-03-17T00:00:00.000Z",
+			},
+		});
+
+		const match = findBindingForDeliveryTarget<TestState>(
+			readBindings<TestState>(path),
+			{
+				participantKey: "slack:team:T123:user:U123",
+			},
+		);
+
+		expect(match?.key).toBe("slack:team:T123:user:U123");
+		expect(match?.binding.sessionId).toBe("sess-participant");
 	});
 
 	it("stores mute state at thread scope instead of participant scope", () => {

apps/cli/src/connectors/thread-bindings.ts

@@ -14,7 +14,7 @@ export type ConnectorThreadState = {
 };
 
 export type ConnectorThreadBinding<TState extends ConnectorThreadState> = {
-	kind?: "participant" | "thread" | "thread-participant-mute";
+	kind?: "conversation" | "participant" | "thread" | "thread-participant-mute";
 	channelId: string;
 	isDM: boolean;
 	participantKey?: string;
@@ -134,12 +134,9 @@ function clearSerializedThreadSessionId(serializedThread: string | undefined): {
 
 export function resolveThreadBindingKey(
 	thread: ConnectorBindingThreadIdentity,
-	state?: ConnectorThreadState | null,
+	_state?: ConnectorThreadState | null,
 ): string {
-	return (
-		normalizeParticipantKey(state?.participantKey ?? thread.participantKey) ??
-		thread.id
-	);
+	return thread.id;
 }
 
 export function readBindings<TState extends ConnectorThreadState>(
@@ -160,40 +157,13 @@ export function findBindingForThread<TState extends ConnectorThreadState>(
 	bindings: ConnectorBindingStore<TState>,
 	thread: ConnectorBindingThreadIdentity,
 ): { binding: ConnectorThreadBinding<TState>; key: string } | undefined {
-	const participantKey = normalizeParticipantKey(thread.participantKey);
-	if (participantKey) {
-		const exactThread = bindings[thread.id];
-		const exactThreadParticipantKey = normalizeParticipantKey(
-			exactThread?.participantKey ?? exactThread?.state?.participantKey,
-		);
-		if (
-			exactThread &&
-			!isControlBinding(exactThread) &&
-			exactThreadParticipantKey === participantKey
-		) {
-			return { key: thread.id, binding: exactThread };
-		}
-		const exactParticipant = bindings[participantKey];
-		if (exactParticipant && !isControlBinding(exactParticipant)) {
-			return { key: participantKey, binding: exactParticipant };
-		}
-		for (const [key, binding] of Object.entries(bindings)) {
-			if (isControlBinding(binding)) {
-				continue;
-			}
-			const bindingParticipantKey = normalizeParticipantKey(
-				binding.participantKey ?? binding.state?.participantKey,
-			);
-			if (bindingParticipantKey === participantKey) {
-				return { key, binding };
-			}
-		}
-		return undefined;
-	}
 	const exact = bindings[thread.id];
 	if (exact && !isControlBinding(exact)) {
 		return { key: thread.id, binding: exact };
 	}
+	if (!thread.isDM) {
+		return undefined;
+	}
 	for (const [key, binding] of Object.entries(bindings)) {
 		if (isControlBinding(binding)) {
 			continue;
@@ -282,29 +252,8 @@ export function persistThreadBinding<TState extends ConnectorThreadState>(
 		thread as ConnectorBindingThreadIdentity,
 		state,
 	);
-	for (const [key, binding] of Object.entries(bindings)) {
-		if (isControlBinding(binding)) {
-			continue;
-		}
-		const bindingParticipantKey = normalizeParticipantKey(
-			binding.participantKey ?? binding.state?.participantKey,
-		);
-		const matchesParticipant =
-			participantKey && bindingParticipantKey === participantKey;
-		const matchesLegacyKey = participantKey && key === thread.id;
-		const matchesLegacyThread =
-			!participantKey &&
-			binding.channelId === thread.channelId &&
-			binding.isDM === thread.isDM;
-		if (
-			key !== bindingKey &&
-			(matchesParticipant || matchesLegacyKey || matchesLegacyThread)
-		) {
-			delete bindings[key];
-		}
-	}
 	bindings[bindingKey] = {
-		kind: "participant",
+		kind: "conversation",
 		channelId: thread.channelId,
 		isDM: thread.isDM,
 		participantKey,
@@ -531,6 +480,37 @@ export function findBindingForParticipantKey<
 	return undefined;
 }
 
+export function findBindingForDeliveryTarget<
+	TState extends ConnectorThreadState,
+>(
+	bindings: ConnectorBindingStore<TState>,
+	input: {
+		bindingKey?: string;
+		threadId?: string;
+		participantKey?: string;
+	},
+): { binding: ConnectorThreadBinding<TState>; key: string } | undefined {
+	const bindingKey = normalizeParticipantKey(input.bindingKey);
+	if (bindingKey) {
+		const exact = bindings[bindingKey];
+		if (exact && !isControlBinding(exact)) {
+			return { key: bindingKey, binding: exact };
+		}
+		const participantMatch = findBindingForParticipantKey(bindings, bindingKey);
+		if (participantMatch) {
+			return participantMatch;
+		}
+	}
+	const threadId = input.threadId?.trim();
+	if (threadId) {
+		const exact = bindings[threadId];
+		if (exact && !isControlBinding(exact)) {
+			return { key: threadId, binding: exact };
+		}
+	}
+	return findBindingForParticipantKey(bindings, input.participantKey);
+}
+
 export async function persistMergedThreadState<
 	TState extends ConnectorThreadState,
 >(

apps/cli/src/main.ts

@@ -284,6 +284,30 @@ export async function runCli(): Promise<void> {
 				io,
 			});
 		});
+	const pluginUninstallCmd = pluginCmd
+		.command("uninstall")
+		.alias("remove")
+		.alias("rm")
+		.description("Uninstall a Cline Plugin by name or path")
+		.argument("<name>", "plugin package name, installed slug, or plugin path")
+		.option("--json", "Output as JSON")
+		.option(
+			"--cwd <path>",
+			"Search <path>/.cline/plugins before global plugins",
+		)
+		.action(async (name: string) => {
+			const opts = pluginUninstallCmd.opts<{
+				json?: boolean;
+				cwd?: string;
+			}>();
+			const { runPluginUninstallCommand } = await import("./commands/plugin");
+			ctx.exitCode = await runPluginUninstallCommand({
+				name,
+				cwd: opts.cwd,
+				json: opts.json === true || program.opts().json === true,
+				io,
+			});
+		});
 	const connectCmd = program
 		.command("connect")
 		.description("Connect to an external channel")

apps/cli/src/runtime/interactive/config-data.test.ts

@@ -455,6 +455,112 @@ Find installable skills.`,
 		).toBe(true);
 	});
 
+	it("deletes a package-backed plugin and refreshes bundled slash commands", async () => {
+		const tempRoot = await mkdtemp(join(tmpdir(), "cli-config-data-"));
+		tempRoots.push(tempRoot);
+		process.env.CLINE_GLOBAL_SETTINGS_PATH = join(
+			tempRoot,
+			"global-settings.json",
+		);
+		const packageDir = join(tempRoot, ".cline", "plugins", "delete-plugin");
+		const pluginPath = join(packageDir, "index.ts");
+		const skillPath = join(packageDir, "skills", "erase", "SKILL.md");
+		await mkdir(join(packageDir, "skills", "erase"), { recursive: true });
+		await writeFile(
+			join(packageDir, "package.json"),
+			JSON.stringify(
+				{
+					name: "delete-plugin",
+					cline: {
+						plugins: [{ paths: ["./index.ts"] }],
+					},
+				},
+				null,
+				2,
+			),
+		);
+		await writeFile(pluginPath, "export default {};\n");
+		await writeFile(
+			skillPath,
+			`---
+name: erase
+---
+Erase stale plugin commands.`,
+		);
+		await writeFile(
+			process.env.CLINE_GLOBAL_SETTINGS_PATH,
+			JSON.stringify({ disabledPlugins: [pluginPath] }, null, 2),
+		);
+		const refreshCalls: string[] = [];
+		let refreshed = false;
+		const userInstructionService = {
+			async refreshType(type: string) {
+				refreshCalls.push(type);
+				refreshed = true;
+			},
+			listRuntimeCommands() {
+				return refreshed
+					? []
+					: [
+							{
+								name: "erase",
+								instructions: "Erase stale plugin commands.",
+								description: "Erase",
+								kind: "skill",
+							},
+						];
+			},
+			listRecords(type: string) {
+				if (type !== "skill") {
+					return [];
+				}
+				return [
+					{
+						id: "erase",
+						type: "skill",
+						filePath: skillPath,
+						item: {
+							name: "erase",
+							disabled: false,
+							description: "Erase",
+							instructions: "Erase stale plugin commands.",
+							frontmatter: {},
+						},
+					},
+				];
+			},
+		} as unknown as UserInstructionConfigService;
+		const loader = createInteractiveConfigDataLoader({
+			config: createConfig(tempRoot),
+			userInstructionService,
+		});
+		const data = await loader.loadConfigData({ includePluginTools: false });
+		const plugin = data.plugins.find((item) => item.path === pluginPath);
+		if (!plugin) {
+			throw new Error("Expected package plugin to be listed");
+		}
+
+		const nextData = await loader.onDeleteConfigItem(plugin, {
+			includePluginTools: false,
+		});
+		const settings = JSON.parse(
+			await readFile(process.env.CLINE_GLOBAL_SETTINGS_PATH, "utf8"),
+		) as { disabledPlugins?: string[] };
+
+		await expect(readFile(pluginPath, "utf8")).rejects.toThrow();
+		await expect(readFile(skillPath, "utf8")).rejects.toThrow();
+		expect(settings.disabledPlugins).toBeUndefined();
+		expect(refreshCalls).toEqual(
+			expect.arrayContaining(["workflow", "rule", "skill"]),
+		);
+		expect(nextData?.plugins.some((item) => item.path === pluginPath)).toBe(
+			false,
+		);
+		expect(
+			nextData?.workflowSlashCommands.map((command) => command.name),
+		).not.toContain("erase");
+	});
+
 	it("uses the package name for package-backed plugin entries", async () => {
 		const tempRoot = await mkdtemp(join(tmpdir(), "cli-config-data-"));
 		tempRoots.push(tempRoot);

apps/cli/src/runtime/interactive/config-data.ts

@@ -3,6 +3,7 @@ import {
 	setDisabledPlugin,
 	setDisabledTools,
 	type UserInstructionConfigService,
+	uninstallPlugin,
 } from "@cline/core";
 import {
 	type InteractiveConfigData,
@@ -36,6 +37,18 @@ export function createInteractiveConfigDataLoader(input: {
 			includePluginTools: options.includePluginTools,
 		});
 
+	const refreshUserInstructionConfigs = async (): Promise<void> => {
+		const service = input.userInstructionService;
+		if (!service) {
+			return;
+		}
+		await Promise.all([
+			service.refreshType("workflow"),
+			service.refreshType("rule"),
+			service.refreshType("skill"),
+		]);
+	};
+
 	const onToggleConfigItem = async (
 		item: InteractiveConfigItem,
 		options: LoadInteractiveConfigDataOptions = {},
@@ -106,8 +119,26 @@ export function createInteractiveConfigDataLoader(input: {
 		return undefined;
 	};
 
+	const onDeleteConfigItem = async (
+		item: InteractiveConfigItem,
+		options: LoadInteractiveConfigDataOptions = {},
+	): Promise<InteractiveConfigData | undefined> => {
+		if (item.kind !== "plugin") {
+			return undefined;
+		}
+		await uninstallPlugin({
+			path: item.path,
+			name: item.name,
+			cwd: input.config.cwd,
+			workspaceRoot: workspaceRoot(),
+		});
+		await refreshUserInstructionConfigs();
+		return await loadConfigData(options);
+	};
+
 	return {
 		loadConfigData,
 		onToggleConfigItem,
+		onDeleteConfigItem,
 	};
 }

apps/cli/src/runtime/interactive/session-runtime.test.ts

@@ -5,7 +5,8 @@ import type {
 	ToolApprovalRequest,
 	ToolApprovalResult,
 } from "@cline/core";
-import type { AgentTool } from "@cline/shared";
+import { SessionNotFoundError } from "@cline/core";
+import type { AgentTool, Message } from "@cline/shared";
 import { beforeEach, describe, expect, it, vi } from "vitest";
 import type { ChatCommandState } from "../../utils/chat-commands";
 import type { Config } from "../../utils/types";
@@ -112,7 +113,7 @@ function makeManager() {
 		abort: vi.fn(),
 		dispose: vi.fn(),
 		get: vi.fn(),
-		readMessages: vi.fn(async () => []),
+		readMessages: vi.fn(async (): Promise<Message[]> => []),
 		readTranscript: vi.fn(),
 		ingestHookEvent: vi.fn(),
 		subscribe: vi.fn(),
@@ -124,6 +125,31 @@ function makeManager() {
 	};
 }
 
+function makeTurnResult() {
+	return {
+		text: "ok",
+		usage: { inputTokens: 0, outputTokens: 0 },
+		messages: [],
+		toolCalls: [],
+		iterations: 1,
+		finishReason: "completed" as const,
+		model: { id: "openai/gpt-5.3-codex", provider: "cline" },
+		startedAt: new Date("2026-01-01T00:00:00.000Z"),
+		endedAt: new Date("2026-01-01T00:00:00.100Z"),
+		durationMs: 100,
+	};
+}
+
+function deferred<T>() {
+	let resolve!: (value: T) => void;
+	let reject!: (error?: unknown) => void;
+	const promise = new Promise<T>((resolvePromise, rejectPromise) => {
+		resolve = resolvePromise;
+		reject = rejectPromise;
+	});
+	return { promise, resolve, reject };
+}
+
 function makeRuntime(
 	manager: ReturnType<typeof makeManager>,
 	options: { resumeSessionId?: string } = {},
@@ -231,4 +257,84 @@ describe("createInteractiveSessionRuntime", () => {
 		expect(manager.start).toHaveBeenCalledTimes(2);
 		expect(runtime.getActiveSessionId()).toBe("session-2");
 	});
+
+	it("recovers and retries when the active interactive session disappeared", async () => {
+		const manager = makeManager();
+		const messages = [
+			{
+				role: "user" as const,
+				content: [{ type: "text" as const, text: "hi" }],
+			},
+		];
+		manager.readMessages.mockResolvedValue(messages);
+		manager.send
+			.mockRejectedValueOnce(new SessionNotFoundError("session-1"))
+			.mockResolvedValueOnce(makeTurnResult());
+		const runtime = makeRuntime(manager);
+
+		await runtime.ensureReady();
+		const result = await runtime.sendCurrentTurn({
+			prompt: "second hi",
+			mode: "act",
+		});
+
+		expect(result?.finishReason).toBe("completed");
+		expect(manager.readMessages).toHaveBeenCalledWith("session-1");
+		expect(manager.start).toHaveBeenCalledTimes(2);
+		expect(manager.start).toHaveBeenNthCalledWith(
+			2,
+			expect.objectContaining({
+				initialMessages: messages,
+			}),
+		);
+		expect(manager.send).toHaveBeenNthCalledWith(
+			1,
+			expect.objectContaining({ sessionId: "session-1" }),
+		);
+		expect(manager.send).toHaveBeenNthCalledWith(
+			2,
+			expect.objectContaining({ sessionId: "session-2" }),
+		);
+		expect(runtime.getActiveSessionId()).toBe("session-2");
+	});
+
+	it("waits for missing-session recovery before cleanup disposes the manager", async () => {
+		const manager = makeManager();
+		const recoveryRead = deferred<Message[]>();
+		manager.readMessages
+			.mockImplementationOnce(() => recoveryRead.promise)
+			.mockResolvedValue([]);
+		manager.get.mockResolvedValue(undefined);
+		manager.getAccumulatedUsage.mockResolvedValue(undefined);
+		manager.send.mockRejectedValueOnce(new SessionNotFoundError("session-1"));
+		const runtime = makeRuntime(manager);
+
+		await runtime.ensureReady();
+		const sendPromise = runtime
+			.sendCurrentTurn({
+				prompt: "second hi",
+				mode: "act",
+			})
+			.catch((error) => error);
+		await vi.waitFor(() => {
+			expect(manager.readMessages).toHaveBeenCalledWith("session-1");
+		});
+
+		let cleanupSettled = false;
+		const cleanupPromise = runtime.cleanup().finally(() => {
+			cleanupSettled = true;
+		});
+		await new Promise((resolve) => setTimeout(resolve, 0));
+
+		expect(cleanupSettled).toBe(false);
+		expect(manager.get).not.toHaveBeenCalled();
+		expect(manager.dispose).not.toHaveBeenCalled();
+
+		recoveryRead.resolve([]);
+		await cleanupPromise;
+		const sendError = await sendPromise;
+
+		expect(sendError).toBeInstanceOf(SessionNotFoundError);
+		expect(manager.dispose).toHaveBeenCalledWith("cli_interactive_shutdown");
+	});
 });

apps/cli/src/runtime/interactive/session-runtime.ts

@@ -1,6 +1,7 @@
 import {
 	type AgentEvent,
 	type CheckpointEntry,
+	isSessionNotFoundError,
 	type PendingPromptMutationResult,
 	type ProviderSettingsManager,
 	readSessionCheckpointHistory,
@@ -74,6 +75,7 @@ export function createInteractiveSessionRuntime(input: {
 	let shutdownRequested = false;
 	let activeSessionId = "";
 	let abortRequested = false;
+	let missingSessionRecoveryPromise: Promise<void> | undefined;
 	// A reset can happen while an earlier manager.start() is still in flight.
 	// Bump this before resets and restarts so stale starts cannot become active.
 	let sessionStartGeneration = 0;
@@ -248,6 +250,37 @@ export function createInteractiveSessionRuntime(input: {
 		return (await sessionManager.readMessages(activeSessionId)) ?? [];
 	};
 
+	const recoverMissingActiveSession = async (error: unknown): Promise<void> => {
+		if (missingSessionRecoveryPromise) {
+			return await missingSessionRecoveryPromise;
+		}
+		missingSessionRecoveryPromise = (async () => {
+			const manager = sessionManager;
+			const missingSessionId = activeSessionId;
+			if (!manager || !missingSessionId || shutdownRequested) {
+				return;
+			}
+			const messages = await manager
+				.readMessages(missingSessionId)
+				.catch(() => []);
+			input.config.logger?.log("Recovering missing interactive session", {
+				sessionId: missingSessionId,
+				messageCount: messages.length,
+				error,
+				severity: "warn",
+			});
+			sessionStartGeneration += 1;
+			pendingResumeSessionId = undefined;
+			startupPromise = undefined;
+			startupError = undefined;
+			clearActiveSession();
+			await startFreshSession(messages);
+		})().finally(() => {
+			missingSessionRecoveryPromise = undefined;
+		});
+		return await missingSessionRecoveryPromise;
+	};
+
 	const stopCurrentSession = async (): Promise<void> => {
 		const sessionId = activeSessionId;
 		if (sessionManager && sessionId) {
@@ -334,10 +367,29 @@ export function createInteractiveSessionRuntime(input: {
 				? startupError
 				: new Error("interactive session manager is unavailable");
 		}
-		return await sessionManager.send({
-			sessionId: activeSessionId,
-			...turnInput,
-		});
+		const manager = sessionManager;
+		try {
+			return await manager.send({
+				sessionId: activeSessionId,
+				...turnInput,
+			});
+		} catch (error) {
+			if (
+				abortRequested ||
+				shutdownRequested ||
+				!isSessionNotFoundError(error)
+			) {
+				throw error;
+			}
+			await recoverMissingActiveSession(error);
+			if (!activeSessionId || abortRequested || shutdownRequested) {
+				throw error;
+			}
+			return await manager.send({
+				sessionId: activeSessionId,
+				...turnInput,
+			});
+		}
 	};
 
 	const updatePendingPrompt = async (input: {
@@ -550,20 +602,20 @@ export function createInteractiveSessionRuntime(input: {
 			let exitSummary: InteractiveExitSummary | undefined;
 			try {
 				await startupPromise?.catch(() => {});
+				await missingSessionRecoveryPromise?.catch(() => {});
 			} finally {
 				unsubscribeAgent();
 				unsubscribePendingPrompts();
 			}
 			try {
 				exitSummary = await getExitSummary();
+				// Mark hooks shut down before session disposal so late abort/stop
+				// emissions cannot dispatch over a closing hub transport.
+				await runtimeHooks?.shutdown();
 				await stopCurrentSession();
 			} finally {
-				try {
-					if (sessionManager) {
-						await sessionManager.dispose("cli_interactive_shutdown");
-					}
-				} finally {
-					await runtimeHooks?.shutdown();
+				if (sessionManager) {
+					await sessionManager.dispose("cli_interactive_shutdown");
 				}
 			}
 			return exitSummary;

apps/cli/src/runtime/run-agent.ts

@@ -228,11 +228,11 @@ export async function runAgent(
 			process.off("SIGINT", handleSigint);
 			process.off("SIGTERM", handleSigterm);
 			unsubscribe();
+			await runtimeHooks.shutdown().catch(() => {});
 			if (activeSessionId) {
 				await sessionManager.stop(activeSessionId).catch(() => {});
 			}
 			await sessionManager.dispose("cli_run_shutdown").catch(() => {});
-			await runtimeHooks.shutdown().catch(() => {});
 			setActiveRuntimeAbort(undefined);
 		})();
 		return cleanupDone;

apps/cli/src/runtime/run-interactive.ts

@@ -322,6 +322,18 @@ export async function runInteractive(
 		}
 		return data;
 	};
+	const onDeleteConfigItem = async (
+		item: InteractiveConfigItem,
+		options: LoadInteractiveConfigDataOptions = {},
+	): Promise<
+		Awaited<ReturnType<typeof configDataLoader.onDeleteConfigItem>>
+	> => {
+		const data = await configDataLoader.onDeleteConfigItem(item, options);
+		if (data && shouldRefreshInteractiveSessionForConfigItem(item)) {
+			await refreshInteractiveSessionPolicies();
+		}
+		return data;
+	};
 	const toQueuedPromptItem = (prompt: {
 		id: string;
 		prompt: string;
@@ -397,6 +409,7 @@ export async function runInteractive(
 			}),
 		loadConfigData: configDataLoader.loadConfigData,
 		onToggleConfigItem,
+		onDeleteConfigItem,
 		subscribeToEvents: ({
 			onAgentEvent: onAgent,
 			onTeamEvent: onTeam,

apps/cli/src/tui/cline-account.test.ts

@@ -24,6 +24,25 @@ vi.mock("@cline/core", () => {
 				coreMocks.serviceOptions.push(options);
 			}
 		},
+		createClineAccountAuthRequiredError: () => {
+			const error = new Error(
+				"Cline account authentication requires sign in.",
+			) as Error & {
+				errorInfo: {
+					kind: "auth";
+					providerId: "cline";
+					code: "cline_account_auth_required";
+					message: string;
+				};
+			};
+			error.errorInfo = {
+				kind: "auth",
+				providerId: "cline",
+				code: "cline_account_auth_required",
+				message: error.message,
+			};
+			return error;
+		},
 		ProviderSettingsManager: class {
 			getProviderSettings(providerId: string) {
 				return coreMocks.getProviderSettings(providerId);
@@ -129,8 +148,12 @@ describe("createClineAccountService", () => {
 
 		await expect(
 			createClineAccountService({ config: makeConfig() }),
-		).rejects.toThrow(
-			"Cline account requires re-authentication. Run cline auth cline.",
-		);
+		).rejects.toMatchObject({
+			errorInfo: {
+				kind: "auth",
+				providerId: "cline",
+				code: "cline_account_auth_required",
+			},
+		});
 	});
 });

apps/cli/src/tui/cline-account.ts

@@ -4,6 +4,7 @@ import {
 	type ClineAccountOrganizationBalance,
 	ClineAccountService,
 	type ClineAccountUser,
+	createClineAccountAuthRequiredError,
 	getValidClineCredentials,
 	type ProviderSettings,
 	ProviderSettingsManager,
@@ -30,14 +31,6 @@ export function formatClineCredits(value: number): string {
 	return formatCreditBalance(normalizeCreditBalance(value));
 }
 
-export function isClineAccountAuthErrorMessage(message: string): boolean {
-	const normalized = message.trim().toLowerCase();
-	return (
-		normalized === "no cline account auth token found" ||
-		normalized.includes("requires re-authentication")
-	);
-}
-
 function resolveAccountApiBaseUrl(input: {
 	clineApiBaseUrl?: string;
 	clineProviderSettings?: ProviderSettings;
@@ -100,9 +93,7 @@ async function resolveValidClineAccountAuthToken(input: {
 			{ apiBaseUrl: input.apiBaseUrl },
 		);
 		if (!credentials) {
-			throw new Error(
-				"Cline account requires re-authentication. Run cline auth cline.",
-			);
+			throw createClineAccountAuthRequiredError();
 		}
 		const nextAccessToken = toProviderApiKey("cline", credentials);
 		if (
@@ -167,7 +158,7 @@ export async function loadClineAccountSnapshot(input: {
 }): Promise<ClineAccountSnapshot> {
 	const service = await createClineAccountService(input);
 	if (!service) {
-		throw new Error("No Cline account auth token found");
+		throw createClineAccountAuthRequiredError();
 	}
 
 	const user = await service.fetchMe();
@@ -202,7 +193,7 @@ export async function switchClineAccount(input: {
 }): Promise<void> {
 	const service = await createClineAccountService(input);
 	if (!service) {
-		throw new Error("No Cline account auth token found");
+		throw createClineAccountAuthRequiredError();
 	}
 	await service.switchAccount(input.organizationId);
 }

apps/cli/src/tui/components/chat-entry.tsx

@@ -2,6 +2,10 @@ import { useTerminalDimensions } from "@opentui/react";
 import type React from "react";
 import { useState } from "react";
 import "opentui-spinner/react";
+import {
+	resolveSpecialErrorDisplay,
+	type SpecialErrorDisplay,
+} from "../../utils/special-errors";
 import { useTerminalBackground } from "../hooks/use-terminal-background";
 import {
 	getDefaultForeground,
@@ -256,6 +260,85 @@ function ToolCallView(props: {
 	);
 }
 
+function SpecialErrorBlock(props: {
+	display: SpecialErrorDisplay;
+	defaultFg?: string;
+}) {
+	const { display, defaultFg } = props;
+	const renderShell = (children: React.ReactNode) => (
+		<box flexDirection="row">
+			<text fg="red" content="* " />
+			<box
+				flexDirection="column"
+				border
+				borderStyle="rounded"
+				borderColor="red"
+				paddingX={1}
+			>
+				{children}
+			</box>
+		</box>
+	);
+	switch (display.kind) {
+		case "cline_credits_depleted":
+			return renderShell(
+				<>
+					<text fg="red">{display.title}</text>
+					<text fg={defaultFg} selectable>
+						{display.message}
+					</text>
+					{display.balanceText && (
+						<text fg="gray" selectable>
+							Current balance: {display.balanceText}
+						</text>
+					)}
+					<box flexDirection="row">
+						<text fg="gray">Dashboard: </text>
+						<text fg="cyan" selectable>
+							<a href={display.url}>{display.url}</a>
+						</text>
+					</box>
+				</>,
+			);
+		case "cline_account_auth_required":
+			return renderShell(
+				<>
+					<text fg="red">{display.title}</text>
+					<text fg={defaultFg} selectable>
+						{display.message}
+					</text>
+					<box flexDirection="row">
+						<text fg="gray">Open </text>
+						<text fg="cyan" selectable>
+							{display.command}
+						</text>
+						<text fg="gray"> to sign in, then retry.</text>
+					</box>
+				</>,
+			);
+	}
+}
+
+function GenericErrorBlock(props: { text: string }) {
+	return (
+		<box flexDirection="row">
+			<text fg="red" content="* " />
+			<text fg="red" selectable content={`Error: ${props.text}`} />
+		</box>
+	);
+}
+
+function ErrorBlock(props: {
+	entry: Extract<ChatEntry, { kind: "error" }>;
+	defaultFg?: string;
+}) {
+	const display = resolveSpecialErrorDisplay(props.entry.errorInfo);
+	if (!display) {
+		return <GenericErrorBlock text={props.entry.text} />;
+	}
+	return <SpecialErrorBlock display={display} defaultFg={props.defaultFg} />;
+}
+
 export function ChatEntryView(props: {
 	entry: ChatEntry;
 	accent?: string;
@@ -350,13 +433,9 @@ export function ChatEntryView(props: {
 				/>
 			);
 
-		case "error":
-			return (
-				<box flexDirection="row">
-					<text fg="red" content="* " />
-					<text fg="red" selectable content={`Error: ${entry.text}`} />
-				</box>
-			);
+		case "error": {
+			return <ErrorBlock entry={entry} defaultFg={defaultFg} />;
+		}
 
 		case "status":
 			return (

apps/cli/src/tui/components/dialogs/account-dialog.tsx

@@ -1,12 +1,15 @@
 // @jsxImportSource @opentui/react
-import type { ClineAccountOrganization } from "@cline/core";
+import {
+	type ClineAccountOrganization,
+	getSdkErrorInfo,
+	isClineAccountAuthRequiredErrorInfo,
+} from "@cline/core";
 import type { ChoiceContext } from "@opentui-ui/dialog";
 import { useDialogKeyboard } from "@opentui-ui/dialog/react";
 import { useCallback, useEffect, useMemo, useRef, useState } from "react";
 import {
 	type ClineAccountSnapshot,
 	formatClineCredits,
-	isClineAccountAuthErrorMessage,
 } from "../../cline-account";
 import { palette } from "../../palette";
 
@@ -256,10 +259,11 @@ export function AccountDialogContent(
 		} catch (error) {
 			const message = error instanceof Error ? error.message : String(error);
 			if (generation.current === currentGeneration) {
+				const authRequired = isClineAccountAuthRequiredErrorInfo(
+					getSdkErrorInfo(error),
+				);
 				setState({
-					status: isClineAccountAuthErrorMessage(message)
-						? "unauthenticated"
-						: "error",
+					status: authRequired ? "unauthenticated" : "error",
 					message,
 				});
 				setSelectedAction(0);

apps/cli/src/tui/components/dialogs/config-dialogs.tsx

@@ -137,3 +137,54 @@ export function ExtDetailContent(
 		</box>
 	);
 }
+
+export function DeleteConfigItemConfirmContent(
+	props: ChoiceContext<boolean> & {
+		item: InteractiveConfigItem;
+	},
+) {
+	useDialogKeyboard((key) => {
+		if (key.name === "return" || key.name === "y") {
+			props.resolve(true);
+		} else if (key.name === "escape" || key.name === "n") {
+			props.dismiss();
+		}
+	}, props.dialogId);
+
+	return (
+		<box flexDirection="column" paddingX={1}>
+			<text>Delete plugin {props.item.name}?</text>
+			<text fg="gray" marginTop={1}>
+				This removes the installed plugin files from {props.item.path}.
+			</text>
+			<text fg="gray" marginTop={1}>
+				<em>Y/Enter to confirm, N/Esc to cancel</em>
+			</text>
+		</box>
+	);
+}
+
+export function ConfigErrorContent(
+	props: ChoiceContext<void> & {
+		title: string;
+		message: string;
+	},
+) {
+	useDialogKeyboard((key) => {
+		if (key.name === "return" || key.name === "escape") {
+			props.dismiss();
+		}
+	}, props.dialogId);
+
+	return (
+		<box flexDirection="column" paddingX={1}>
+			<text fg="red">{props.title}</text>
+			<text fg="gray" marginTop={1}>
+				{props.message}
+			</text>
+			<text fg="gray" marginTop={1}>
+				<em>Enter/Esc to close</em>
+			</text>
+		</box>
+	);
+}

apps/cli/src/tui/components/inline-tool-response.tsx

@@ -1,5 +1,6 @@
+import type { ScrollBoxRenderable } from "@opentui/core";
 import { useKeyboard, useTerminalDimensions } from "@opentui/react";
-import { useCallback, useRef, useState } from "react";
+import { useCallback, useEffect, useRef, useState } from "react";
 import { palette } from "../palette";
 import type { RuntimeToolInteraction } from "../types";
 import { formatApprovalParams } from "./dialogs/tool-approval";
@@ -22,23 +23,129 @@ function keyToText(name: string): string {
 	return name === "space" ? " " : name;
 }
 
+function getToolShellMaxHeight(terminalHeight: number): number {
+	return Math.max(7, Math.min(14, Math.floor(terminalHeight * 0.38)));
+}
+
+function getAskQuestionShellMaxHeight(terminalHeight: number): number {
+	const preferredHeight = Math.max(11, Math.floor(terminalHeight * 0.58));
+	const availableHeight = Math.max(7, terminalHeight - 3);
+	return Math.min(18, preferredHeight, availableHeight);
+}
+
+function getAskQuestionBodyHeight(shellMaxHeight: number): number {
+	return Math.max(1, shellMaxHeight - 4);
+}
+
+function addWrappedWidth(input: {
+	rows: number;
+	lineWidth: number;
+	width: number;
+	maxWidth: number;
+}): { rows: number; lineWidth: number } {
+	if (input.width <= 0) {
+		return { rows: input.rows, lineWidth: input.lineWidth };
+	}
+
+	let rows = input.rows;
+	let remainingWidth = input.width;
+	let lineWidth = input.lineWidth;
+
+	if (lineWidth > 0) {
+		const availableWidth = input.maxWidth - lineWidth;
+		if (remainingWidth <= availableWidth) {
+			return { rows, lineWidth: lineWidth + remainingWidth };
+		}
+
+		remainingWidth -= Math.max(0, availableWidth);
+		rows += 1;
+		lineWidth = 0;
+	}
+
+	rows += Math.max(0, Math.ceil(remainingWidth / input.maxWidth) - 1);
+	lineWidth = remainingWidth % input.maxWidth || input.maxWidth;
+
+	return { rows, lineWidth };
+}
+
+function countWrappedRows(text: string, width: number): number {
+	const safeWidth = Math.max(1, width);
+	const paragraphs = text.split("\n");
+	let rows = 0;
+
+	for (const paragraph of paragraphs) {
+		rows += 1;
+		let lineWidth = 0;
+		const tokens = paragraph.match(/\s+|\S+/g) ?? [];
+
+		for (const token of tokens) {
+			const tokenWidth = Bun.stringWidth(token);
+			const isWhitespace = /^\s+$/.test(token);
+
+			if (
+				!isWhitespace &&
+				lineWidth > 0 &&
+				lineWidth + tokenWidth > safeWidth
+			) {
+				rows += 1;
+				lineWidth = 0;
+			}
+
+			const next = addWrappedWidth({
+				rows,
+				lineWidth,
+				width: tokenWidth,
+				maxWidth: safeWidth,
+			});
+			rows = next.rows;
+			lineWidth = next.lineWidth;
+		}
+	}
+
+	return rows;
+}
+
+function getAskQuestionContentHeight(input: {
+	terminalWidth: number;
+	question: string;
+	options: string[];
+	customText: string;
+}): number {
+	const questionWidth = Math.max(1, input.terminalWidth - 3);
+	const optionTextWidth = Math.max(1, input.terminalWidth - 7);
+	const questionRows = countWrappedRows(input.question, questionWidth);
+	const optionRows = input.options.reduce(
+		(rows, option) => rows + countWrappedRows(option, optionTextWidth),
+		0,
+	);
+	const customRows = countWrappedRows(input.customText, optionTextWidth);
+	return questionRows + 1 + optionRows + customRows;
+}
+
+function getAskQuestionChoiceId(interactionId: number, index: number): string {
+	return `ask-question-${interactionId.toString()}-choice-${index.toString()}`;
+}
+
 function Shell(
 	props: Pick<
 		InlineToolResponseProps,
 		"accent" | "inputBackground" | "inputForeground"
 	> & {
 		title: string;
+		maxHeight?: number;
+		overflow?: "hidden";
 		children: React.ReactNode;
 	},
 ) {
 	const { height } = useTerminalDimensions();
-	const maxHeight = Math.max(7, Math.min(14, Math.floor(height * 0.38)));
+	const maxHeight = props.maxHeight ?? getToolShellMaxHeight(height);
 
 	return (
 		<box
 			flexDirection="column"
 			width="100%"
 			maxHeight={maxHeight}
+			overflow={props.overflow}
 			backgroundColor={props.inputBackground}
 			paddingX={1}
 			paddingY={1}
@@ -59,6 +166,7 @@ function ChoiceButton(props: {
 	onPress: () => void;
 }) {
 	return (
+		// biome-ignore lint/a11y/noStaticElementInteractions: OpenTUI boxes handle terminal mouse input.
 		<box
 			paddingX={1}
 			backgroundColor={props.selected ? palette.selection : undefined}
@@ -155,9 +263,11 @@ function AskQuestionResponse(
 	},
 ) {
 	const { interaction } = props;
+	const { height, width } = useTerminalDimensions();
 	const [selected, setSelected] = useState(0);
 	const [customValue, setCustomValue] = useState("");
 	const [customEmptyAttempted, setCustomEmptyAttempted] = useState(false);
+	const scrollRef = useRef<ScrollBoxRenderable | null>(null);
 	const selectedRef = useRef(0);
 	const customValueRef = useRef("");
 	const interactionId = interaction.id;
@@ -165,6 +275,24 @@ function AskQuestionResponse(
 	const customIndex = interaction.options.length;
 	const isTyping = selected === customIndex;
 	const totalChoices = interaction.options.length + 1;
+	const shellMaxHeight = getAskQuestionShellMaxHeight(height);
+	const maxBodyHeight = getAskQuestionBodyHeight(shellMaxHeight);
+	const customText = isTyping
+		? customValue
+			? `${customValue}|`
+			: customEmptyAttempted
+				? "Type a response first..."
+				: "Type a response..."
+		: "Type a response...";
+	const bodyHeight = Math.min(
+		maxBodyHeight,
+		getAskQuestionContentHeight({
+			terminalWidth: width,
+			question: interaction.question,
+			options: interaction.options,
+			customText,
+		}),
+	);
 
 	const selectIndex = useCallback(
 		(index: number) => {
@@ -192,6 +320,26 @@ function AskQuestionResponse(
 		[interactionId, onResolveAskQuestion],
 	);
 
+	useEffect(() => {
+		const choiceId = getAskQuestionChoiceId(interactionId, selected);
+		let canceled = false;
+		const scrollSelectedChoiceIntoView = () => {
+			if (canceled) {
+				return;
+			}
+
+			scrollRef.current?.scrollChildIntoView(choiceId);
+		};
+
+		scrollSelectedChoiceIntoView();
+		queueMicrotask(scrollSelectedChoiceIntoView);
+		const timeout = setTimeout(scrollSelectedChoiceIntoView, 0);
+		return () => {
+			canceled = true;
+			clearTimeout(timeout);
+		};
+	}, [interactionId, selected]);
+
 	useKeyboard((key) => {
 		const typing = selectedRef.current === customIndex;
 		if (key.name === "escape") {
@@ -261,64 +409,91 @@ function AskQuestionResponse(
 			accent={props.accent}
 			inputBackground={props.inputBackground}
 			inputForeground={props.inputForeground}
+			maxHeight={shellMaxHeight}
+			overflow="hidden"
 		>
-			<text fg={props.inputForeground} selectable>
-				{interaction.question}
-			</text>
+			<scrollbox
+				ref={scrollRef}
+				height={bodyHeight}
+				width="100%"
+				scrollY
+				scrollX={false}
+				viewportOptions={{ overflow: "hidden" }}
+				contentOptions={{ flexDirection: "column" }}
+			>
+				<box flexDirection="column" gap={1} flexShrink={0} width="100%">
+					<text fg={props.inputForeground} selectable flexShrink={0}>
+						{interaction.question}
+					</text>
 
-			<box flexDirection="column">
-				{interaction.options.map((option, index) => {
-					const optionSelected = !isTyping && selected === index;
-					return (
+					<box flexDirection="column" flexShrink={0} width="100%">
+						{interaction.options.map((option, index) => {
+							const optionSelected = !isTyping && selected === index;
+							return (
+								// biome-ignore lint/a11y/noStaticElementInteractions: OpenTUI boxes handle terminal mouse input.
+								<box
+									id={getAskQuestionChoiceId(interactionId, index)}
+									key={`${index.toString()}:${option}`}
+									paddingX={1}
+									flexDirection="row"
+									gap={1}
+									flexShrink={0}
+									width="100%"
+									backgroundColor={
+										optionSelected ? palette.selection : undefined
+									}
+									onMouseDown={() => resolveAnswer(option)}
+								>
+									<text
+										fg={optionSelected ? palette.textOnSelection : "gray"}
+										flexShrink={0}
+									>
+										{optionSelected ? ">" : " "}
+									</text>
+									<text
+										fg={
+											optionSelected
+												? palette.textOnSelection
+												: props.inputForeground
+										}
+										flexGrow={1}
+										flexShrink={1}
+									>
+										{option}
+									</text>
+								</box>
+							);
+						})}
+						{/* biome-ignore lint/a11y/noStaticElementInteractions: OpenTUI boxes handle terminal mouse input. */}
 						<box
-							key={`${index.toString()}:${option}`}
+							id={getAskQuestionChoiceId(interactionId, customIndex)}
 							paddingX={1}
 							flexDirection="row"
 							gap={1}
-							backgroundColor={optionSelected ? palette.selection : undefined}
-							onMouseDown={() => resolveAnswer(option)}
+							flexShrink={0}
+							width="100%"
+							backgroundColor={isTyping ? palette.selection : undefined}
+							onMouseDown={() => selectIndex(customIndex)}
 						>
 							<text
-								fg={optionSelected ? palette.textOnSelection : "gray"}
+								fg={isTyping ? palette.textOnSelection : "gray"}
 								flexShrink={0}
 							>
-								{optionSelected ? ">" : " "}
-							</text>
-							<text
-								fg={
-									optionSelected
-										? palette.textOnSelection
-										: props.inputForeground
-								}
-							>
-								{option}
+								{isTyping ? ">" : " "}
 							</text>
+							{isTyping ? (
+								<text fg={palette.textOnSelection} flexGrow={1} flexShrink={1}>
+									{customText}
+								</text>
+							) : (
+								<text fg={props.inputPlaceholder} flexGrow={1} flexShrink={1}>
+									Type a response...
+								</text>
+							)}
 						</box>
-					);
-				})}
-				<box
-					paddingX={1}
-					flexDirection="row"
-					gap={1}
-					backgroundColor={isTyping ? palette.selection : undefined}
-					onMouseDown={() => selectIndex(customIndex)}
-				>
-					<text fg={isTyping ? palette.textOnSelection : "gray"} flexShrink={0}>
-						{isTyping ? ">" : " "}
-					</text>
-					{isTyping ? (
-						<text fg={palette.textOnSelection} flexGrow={1}>
-							{customValue
-								? `${customValue}|`
-								: customEmptyAttempted
-									? "Type a response first..."
-									: "Type a response..."}
-						</text>
-					) : (
-						<text fg={props.inputPlaceholder}>Type a response...</text>
-					)}
+					</box>
 				</box>
-			</box>
+			</scrollbox>
 		</Shell>
 	);
 }

apps/cli/src/tui/hooks/use-agent-events.ts

@@ -171,7 +171,11 @@ export function useAgentEventHandlers(deps: AgentEventDeps) {
 					turnErrorReportedRef.current = true;
 					onTurnErrorReported(true);
 					if (!event.recoverable || verbose) {
-						appendEntry({ kind: "error", text: event.error.message });
+						appendEntry({
+							kind: "error",
+							text: event.error.message,
+							errorInfo: event.errorInfo,
+						});
 					}
 					break;
 				case "notice":

apps/cli/src/tui/hooks/use-config-panel.tsx

@@ -9,7 +9,11 @@ import type {
 	LoadInteractiveConfigDataOptions,
 } from "../../tui/interactive-config";
 import type { CliCompactionMode, Config } from "../../utils/types";
-import { ExtDetailContent } from "../components/dialogs/config-dialogs";
+import {
+	ConfigErrorContent,
+	DeleteConfigItemConfirmContent,
+	ExtDetailContent,
+} from "../components/dialogs/config-dialogs";
 import { withLoadingDialog } from "../components/dialogs/loading-dialog";
 import { ConfigPanelContent } from "../views/config-view";
 import type { ConfigAction } from "../views/config-view-helpers";
@@ -35,6 +39,10 @@ export function useConfigPanel(opts: {
 		item: InteractiveConfigItem,
 		options?: LoadInteractiveConfigDataOptions,
 	) => Promise<InteractiveConfigData | undefined>;
+	onDeleteConfigItem?: (
+		item: InteractiveConfigItem,
+		options?: LoadInteractiveConfigDataOptions,
+	) => Promise<InteractiveConfigData | undefined>;
 	openModelSelector: (options?: OpenModelSelectorOptions) => Promise<void>;
 	openMcpManager: (options?: { refocus?: boolean }) => Promise<boolean>;
 	refocusTextarea: () => void;
@@ -90,6 +98,7 @@ export function useConfigPanel(opts: {
 								activeTab = tab;
 							}}
 							onToggleConfigItem={opts.onToggleConfigItem}
+							onDeleteConfigItem={opts.onDeleteConfigItem}
 							onToggleMode={opts.toggleMode}
 							onToggleAutoApprove={opts.toggleAutoApprove}
 							onSetCompactionMode={opts.setCompactionMode}
@@ -111,6 +120,38 @@ export function useConfigPanel(opts: {
 					await opts.openModelSelector({ onCancel: () => {} });
 				} else if (action.kind === "toggle-item") {
 					await opts.onToggleConfigItem?.(action.item);
+				} else if (action.kind === "delete-item") {
+					const confirmed = await opts.dialog.choice<boolean>({
+						closeOnEscape: true,
+						content: (ctx: ChoiceContext<boolean>) => (
+							<DeleteConfigItemConfirmContent {...ctx} item={action.item} />
+						),
+					});
+					if (confirmed && opts.onDeleteConfigItem) {
+						try {
+							await withLoadingDialog(
+								opts.dialog,
+								`Deleting ${action.item.name}...`,
+								async () =>
+									await opts.onDeleteConfigItem?.(action.item, {
+										includePluginTools: false,
+									}),
+							);
+						} catch (error) {
+							await opts.dialog.choice<void>({
+								closeOnEscape: true,
+								content: (ctx: ChoiceContext<void>) => (
+									<ConfigErrorContent
+										{...ctx}
+										title="Plugin delete failed"
+										message={
+											error instanceof Error ? error.message : String(error)
+										}
+									/>
+								),
+							});
+						}
+					}
 				} else if (action.kind === "ext-detail") {
 					await opts.dialog.choice<void>({
 						style: { maxHeight: opts.termHeight - 2 },

apps/cli/src/tui/hooks/use-prompt-input-controller.ts

@@ -1,3 +1,4 @@
+import { getSdkErrorInfo } from "@cline/shared";
 import { useCallback, useLayoutEffect, useRef, useState } from "react";
 import { shouldShowCliUsageCost } from "../../utils/usage-cost-display";
 import type { SlashCommandRegistry } from "../commands/slash-command-registry";
@@ -368,6 +369,7 @@ export function usePromptInputController(input: {
 					session.appendEntry({
 						kind: "error",
 						text: error instanceof Error ? error.message : String(error),
+						errorInfo: getSdkErrorInfo(error),
 					});
 				}
 			} finally {

apps/cli/src/tui/hooks/use-root-keyboard.ts

@@ -234,6 +234,8 @@ export function useRootKeyboard(input: {
 				const abortStarted = input.onAbort();
 				if (abortStarted) {
 					session.setAbortRequested(true);
+					session.setIsStreaming(false);
+					session.closeInlineStream();
 				}
 			} else if (selectedQueuedPromptId) {
 				queuedSelection.select(null);

apps/cli/src/tui/root.tsx

@@ -207,6 +207,19 @@ function App(props: TuiProps) {
 			return data;
 		};
 	}, [propsOnToggleConfigItem]);
+	const propsOnDeleteConfigItem = props.onDeleteConfigItem;
+	const onDeleteConfigItem = useMemo<TuiProps["onDeleteConfigItem"]>(() => {
+		if (!propsOnDeleteConfigItem) {
+			return undefined;
+		}
+		return async (item, options) => {
+			const data = await propsOnDeleteConfigItem(item, options);
+			if (data) {
+				setWorkflowSlashCommands(data.workflowSlashCommands);
+			}
+			return data;
+		};
+	}, [propsOnDeleteConfigItem]);
 
 	const openConfig = useConfigPanel({
 		dialog,
@@ -219,6 +232,7 @@ function App(props: TuiProps) {
 		termHeight,
 		loadConfigData: props.loadConfigData,
 		onToggleConfigItem,
+		onDeleteConfigItem,
 		openModelSelector,
 		openMcpManager,
 		refocusTextarea: () => refocusTextareaRef.current(),

apps/cli/src/tui/types.ts

@@ -6,6 +6,7 @@ import type {
 } from "@cline/core";
 import type {
 	Message,
+	SdkErrorInfo,
 	ToolApprovalRequest,
 	ToolApprovalResult,
 } from "@cline/shared";
@@ -41,7 +42,7 @@ export type ChatEntry =
 				error?: string;
 			};
 	  }
-	| { kind: "error"; text: string }
+	| { kind: "error"; text: string; errorInfo?: SdkErrorInfo }
 	| { kind: "status"; text: string }
 	| { kind: "team"; text: string }
 	| { kind: "user_submitted"; text: string; delivery?: "queue" | "steer" }
@@ -137,6 +138,10 @@ export interface TuiProps {
 		item: InteractiveConfigItem,
 		options?: LoadInteractiveConfigDataOptions,
 	) => Promise<InteractiveConfigData | undefined>;
+	onDeleteConfigItem?: (
+		item: InteractiveConfigItem,
+		options?: LoadInteractiveConfigDataOptions,
+	) => Promise<InteractiveConfigData | undefined>;
 	subscribeToEvents: (handlers: {
 		onAgentEvent: (event: AgentEvent) => void;
 		onTeamEvent: (event: TeamEvent) => void;

apps/cli/src/tui/views/config-view-helpers.ts

@@ -9,6 +9,7 @@ export type ConfigAction =
 	| { kind: "open-provider" }
 	| { kind: "open-model" }
 	| { kind: "toggle-item"; item: InteractiveConfigItem }
+	| { kind: "delete-item"; item: InteractiveConfigItem }
 	| {
 			kind: "ext-detail";
 			item: InteractiveConfigItem;
@@ -130,6 +131,10 @@ export function isToggleableConfigItem(item: InteractiveConfigItem): boolean {
 	return isToggleableInteractiveConfigItem(item);
 }
 
+export function isDeletableConfigItem(item: InteractiveConfigItem): boolean {
+	return item.kind === "plugin";
+}
+
 export function resolveConfigItemSelectAction(
 	item: InteractiveConfigItem,
 ): ConfigAction {
@@ -156,6 +161,15 @@ export function resolveConfigItemToggleAction(
 	return { kind: "toggle-item", item };
 }
 
+export function resolveConfigItemDeleteAction(
+	item: InteractiveConfigItem,
+): ConfigAction | undefined {
+	if (!isDeletableConfigItem(item)) {
+		return undefined;
+	}
+	return { kind: "delete-item", item };
+}
+
 export function isInlineConfigAction(
 	action: ConfigAction | undefined,
 ): boolean {
@@ -183,14 +197,33 @@ export function canToggleConfigFooterRow(
 	);
 }
 
+export function canDeleteConfigFooterRow(
+	row:
+		| { kind: "ext"; item: InteractiveConfigItem }
+		| { kind: string }
+		| undefined,
+): boolean {
+	return (
+		row?.kind === "ext" && "item" in row && isDeletableConfigItem(row.item)
+	);
+}
+
 export function getConfigFooterText({
 	canToggle = false,
+	canDelete = false,
 }: {
 	canToggle?: boolean;
+	canDelete?: boolean;
 } = {}): string {
-	return canToggle
-		? "←/→ switch tabs, ↑/↓ navigate, Tab/Enter select, Space toggle, Esc close"
-		: "←/→ switch tabs, ↑/↓ navigate, Tab/Enter select, Esc close";
+	const actions = ["←/→ switch tabs", "↑/↓ navigate", "Tab/Enter select"];
+	if (canToggle) {
+		actions.push("Space toggle");
+	}
+	if (canDelete) {
+		actions.push("D delete");
+	}
+	actions.push("Esc close");
+	return actions.join(", ");
 }
 
 export function getConfigItemDisplayName(name: string): string {

apps/cli/src/tui/views/config-view.tsx

@@ -18,6 +18,7 @@ import { resolveModelDisplayName } from "../components/status-bar";
 import { getModeAccent, palette } from "../palette";
 import {
 	type ConfigAction,
+	canDeleteConfigFooterRow,
 	canToggleConfigFooterRow,
 	getAdjacentConfigTab,
 	getConfigFooterText,
@@ -26,6 +27,7 @@ import {
 	isInlineConfigAction,
 	isToggleableConfigItem,
 	resolveActiveConfigItems,
+	resolveConfigItemDeleteAction,
 	resolveConfigItemSelectAction,
 	resolveConfigItemToggleAction,
 	resolveInitialConfigTab,
@@ -133,6 +135,10 @@ export interface ConfigPanelProps extends ChoiceContext<ConfigAction> {
 		item: InteractiveConfigItem,
 		options?: LoadInteractiveConfigDataOptions,
 	) => Promise<InteractiveConfigData | undefined>;
+	onDeleteConfigItem?: (
+		item: InteractiveConfigItem,
+		options?: LoadInteractiveConfigDataOptions,
+	) => Promise<InteractiveConfigData | undefined>;
 	onToggleMode: () => void;
 	onToggleAutoApprove: () => void;
 	onSetCompactionMode: (mode: CliCompactionMode) => void;
@@ -518,6 +524,9 @@ export function ConfigPanelContent(props: ConfigPanelProps) {
 	const selectedRowIdx = navIndices[clampedNavPos] ?? 0;
 	const selectedRow = rows[selectedRowIdx];
 	const canToggleSelectedRow = canToggleConfigFooterRow(selectedRow);
+	const canDeleteSelectedRow = Boolean(
+		props.onDeleteConfigItem && canDeleteConfigFooterRow(selectedRow),
+	);
 
 	const setNavPosition = (nextNavPos: number) => {
 		setNavPos(nextNavPos);
@@ -618,6 +627,20 @@ export function ConfigPanelContent(props: ConfigPanelProps) {
 		}
 	};
 
+	const handleDeleteSelected = () => {
+		if (!props.onDeleteConfigItem) {
+			return;
+		}
+		const row = rows[selectedRowIdx];
+		if (!row || row.kind !== "ext") {
+			return;
+		}
+		const action = resolveConfigItemDeleteAction(row.item);
+		if (action) {
+			resolve(action);
+		}
+	};
+
 	useDialogKeyboard((key) => {
 		if (key.name === "escape") {
 			dismiss();
@@ -648,6 +671,16 @@ export function ConfigPanelContent(props: ConfigPanelProps) {
 			handleToggleSelected();
 			return;
 		}
+		if (
+			key.name === "d" &&
+			!key.ctrl &&
+			!key.meta &&
+			!key.option &&
+			!key.shift
+		) {
+			handleDeleteSelected();
+			return;
+		}
 		if (key.name === "return" || key.name === "tab") {
 			handleSelect();
 		}
@@ -844,7 +877,10 @@ export function ConfigPanelContent(props: ConfigPanelProps) {
 				<em>
 					{togglingItemId
 						? "Applying settings"
-						: getConfigFooterText({ canToggle: canToggleSelectedRow })}
+						: getConfigFooterText({
+								canToggle: canToggleSelectedRow,
+								canDelete: canDeleteSelectedRow,
+							})}
 				</em>
 			</text>
 		</box>

apps/cli/src/utils/events.test.ts

@@ -6,14 +6,21 @@ import type { Config } from "./types";
 
 describe("handleEvent text formatting", () => {
 	let output = "";
+	let errorOutput = "";
 
 	beforeEach(() => {
+		vi.restoreAllMocks();
 		output = "";
+		errorOutput = "";
 		setCurrentOutputMode("text");
 		vi.spyOn(process.stdout, "write").mockImplementation((chunk: unknown) => {
 			output += String(chunk);
 			return true;
 		});
+		vi.spyOn(process.stderr, "write").mockImplementation((chunk: unknown) => {
+			errorOutput += String(chunk);
+			return true;
+		});
 	});
 
 	it("adds a ⎿ before text that follows a tool block", () => {
@@ -160,6 +167,122 @@ describe("handleEvent text formatting", () => {
 		expect(output).toContain("── aborted (2 iterations) ──");
 	});
 
+	it("prints Cline insufficient credits errors with a dashboard link", () => {
+		handleEvent(
+			{
+				type: "error",
+				error: new Error("Error: Insufficient balance"),
+				recoverable: false,
+				iteration: 1,
+				errorInfo: {
+					kind: "provider",
+					providerId: "cline",
+					modelId: "openai/gpt-5.4",
+					message: "Not enough credits available",
+					code: "insufficient_credits",
+					status: 402,
+					details: {
+						current_balance: -0,
+						buy_credits_url:
+							"https://app.cline.bot/dashboard/account?tab=credits",
+					},
+				},
+			} as unknown as AgentEvent,
+			{} as Config,
+		);
+
+		expect(errorOutput).toContain("Cline Credits depleted");
+		expect(errorOutput).toContain("You have run out of Cline credits");
+		expect(errorOutput).toContain("Current balance: $0.00");
+		expect(errorOutput).toContain(
+			"https://app.cline.bot/dashboard/account?tab=credits",
+		);
+		expect(errorOutput).not.toContain("Insufficient balance");
+	});
+
+	it("prints Cline account auth errors with an account command", () => {
+		handleEvent(
+			{
+				type: "error",
+				error: new Error("Cline account authentication requires sign in."),
+				recoverable: false,
+				iteration: 1,
+				errorInfo: {
+					kind: "auth",
+					providerId: "cline",
+					code: "cline_account_auth_required",
+					message: "Cline account authentication requires sign in.",
+				},
+			} as unknown as AgentEvent,
+			{} as Config,
+		);
+
+		expect(errorOutput).toContain("Cline account sign-in required");
+		expect(errorOutput).toContain("Sign in to your Cline account to continue");
+		expect(errorOutput).toContain("Open /account to sign in");
+		expect(errorOutput).not.toContain("authentication requires sign in.");
+	});
+
+	it("prints provider-stream Cline account auth errors with an account command", () => {
+		handleEvent(
+			{
+				type: "error",
+				error: new Error("Unauthorized"),
+				recoverable: false,
+				iteration: 1,
+				errorInfo: {
+					kind: "provider",
+					providerId: "cline",
+					modelId: "openai/gpt-5.4",
+					code: "cline_account_auth_required",
+					status: 401,
+					message: "Cline account authentication requires sign in.",
+				},
+			} as unknown as AgentEvent,
+			{} as Config,
+		);
+
+		expect(errorOutput).toContain("Cline account sign-in required");
+		expect(errorOutput).toContain("Sign in to your Cline account to continue");
+		expect(errorOutput).toContain("Open /account to sign in");
+		expect(errorOutput).not.toContain("Unauthorized");
+	});
+
+	it("emits special errors as structured agent events in JSON mode", () => {
+		setCurrentOutputMode("json");
+		handleEvent(
+			{
+				type: "error",
+				error: new Error("Error: Insufficient balance"),
+				recoverable: false,
+				iteration: 1,
+				errorInfo: {
+					kind: "provider",
+					providerId: "cline",
+					modelId: "openai/gpt-5.4",
+					message: "Not enough credits available",
+					code: "insufficient_credits",
+					status: 402,
+				},
+			} as unknown as AgentEvent,
+			{} as Config,
+		);
+
+		expect(errorOutput).toBe("");
+		const record: unknown = JSON.parse(output);
+		expect(record).toMatchObject({
+			type: "agent_event",
+			event: {
+				type: "error",
+				errorInfo: {
+					kind: "provider",
+					providerId: "cline",
+					code: "insufficient_credits",
+				},
+			},
+		});
+	});
+
 	it("suppresses heartbeat-only team progress messages", () => {
 		handleTeamEvent({
 			type: "run_progress",

apps/cli/src/utils/events.ts

@@ -5,8 +5,10 @@ import {
 	emitJsonLine,
 	getCurrentOutputMode,
 	write,
+	writeDiagnostic,
 	writeErr,
 } from "./output";
+import { formatSpecialErrorText } from "./special-errors";
 import type { Config } from "./types";
 
 // =============================================================================
@@ -176,7 +178,12 @@ export function handleEvent(event: AgentEvent, config: Config): void {
 		case "error":
 			closeInlineStreamIfNeeded();
 			if (!event.recoverable || config.verbose) {
-				writeErr(event.error.message);
+				const specialErrorText = formatSpecialErrorText(event.errorInfo);
+				if (specialErrorText) {
+					writeDiagnostic(specialErrorText);
+				} else {
+					writeErr(event.error.message);
+				}
 			}
 			break;
 		case "notice":

apps/cli/src/utils/hooks.test.ts

@@ -215,4 +215,21 @@ describe("createRuntimeHooks", () => {
 		expect(outputMocks.write).toHaveBeenCalledWith("\n[hook:prompt_submit]\n");
 		expect(eventMocks.closeInlineStreamIfNeeded).toHaveBeenCalledTimes(2);
 	});
+
+	it("does not dispatch hooks after shutdown", async () => {
+		const dispatchHookEvent = vi.fn().mockResolvedValue(undefined);
+		const runtimeHooks = createRuntimeHooks({
+			yolo: false,
+			cwd: "/workspace",
+			workspaceRoot: "/workspace",
+			verbose: true,
+			dispatchHookEvent,
+		});
+
+		await runtimeHooks.shutdown();
+		await emitRunStartAndPrompt(runtimeHooks.hooks!);
+
+		expect(dispatchHookEvent).not.toHaveBeenCalled();
+		expect(outputMocks.write).not.toHaveBeenCalled();
+	});
 });

apps/cli/src/utils/hooks.ts

@@ -138,13 +138,23 @@ async function dispatchHookPayload(
 	payload: HookEventPayload,
 	options: {
 		dispatchHookEvent: (payload: HookEventPayload) => Promise<void>;
+		isShuttingDown: () => boolean;
 		verbose: boolean;
 	},
 ): Promise<void> {
+	if (options.isShuttingDown()) {
+		return;
+	}
 	try {
 		await options.dispatchHookEvent(payload);
+		if (options.isShuttingDown()) {
+			return;
+		}
 		writeHookInvocation(payload, { verbose: options.verbose });
 	} catch (error) {
+		if (options.isShuttingDown()) {
+			return;
+		}
 		if (isDev) {
 			writeErr(
 				`hook dispatch failed: ${error instanceof Error ? error.message : String(error)}`,
@@ -172,6 +182,8 @@ export function createRuntimeHooks(options: {
 	const verbose = options.verbose === true;
 	const cwd = options.cwd?.trim() || process.cwd();
 	const workspaceRoot = options.workspaceRoot?.trim() || cwd;
+	let shuttingDown = false;
+	const isShuttingDown = () => shuttingDown;
 	return {
 		hooks: {
 			beforeRun: async (ctx) => {
@@ -197,6 +209,7 @@ export function createRuntimeHooks(options: {
 							},
 					{
 						dispatchHookEvent: options.dispatchHookEvent,
+						isShuttingDown,
 						verbose,
 					},
 				);
@@ -223,6 +236,7 @@ export function createRuntimeHooks(options: {
 					},
 					{
 						dispatchHookEvent: options.dispatchHookEvent,
+						isShuttingDown,
 						verbose,
 					},
 				);
@@ -261,6 +275,7 @@ export function createRuntimeHooks(options: {
 					},
 					{
 						dispatchHookEvent: options.dispatchHookEvent,
+						isShuttingDown,
 						verbose,
 					},
 				);
@@ -279,6 +294,7 @@ export function createRuntimeHooks(options: {
 						},
 						{
 							dispatchHookEvent: options.dispatchHookEvent,
+							isShuttingDown,
 							verbose,
 						},
 					);
@@ -306,6 +322,7 @@ export function createRuntimeHooks(options: {
 							},
 					{
 						dispatchHookEvent: options.dispatchHookEvent,
+						isShuttingDown,
 						verbose,
 					},
 				);
@@ -328,11 +345,14 @@ export function createRuntimeHooks(options: {
 					},
 					{
 						dispatchHookEvent: options.dispatchHookEvent,
+						isShuttingDown,
 						verbose,
 					},
 				);
 			},
 		},
-		shutdown: async () => {},
+		shutdown: async () => {
+			shuttingDown = true;
+		},
 	};
 }

apps/cli/src/utils/special-errors.ts

@@ -0,0 +1,189 @@
+import {
+	CLINE_ACCOUNT_AUTH_REQUIRED_CODE,
+	getClineEnvironmentConfig,
+	isClineAccountAuthRequiredErrorInfo,
+	isClineInsufficientCreditsErrorInfo,
+	type SdkErrorInfo,
+	type SdkProviderErrorInfo,
+} from "@cline/shared";
+import { formatCreditBalance } from "./output";
+
+export type SpecialErrorDisplay =
+	| {
+			kind: "cline_credits_depleted";
+			title: string;
+			message: string;
+			balanceText?: string;
+			url: string;
+	  }
+	| {
+			kind: "cline_account_auth_required";
+			title: string;
+			message: string;
+			command: string;
+	  };
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+	return Boolean(value && typeof value === "object" && !Array.isArray(value));
+}
+
+function getDetailsValue(
+	errorInfo: SdkProviderErrorInfo,
+	...keys: string[]
+): unknown {
+	const details = errorInfo.details;
+	if (!isRecord(details)) {
+		return undefined;
+	}
+	for (const key of keys) {
+		if (key in details) {
+			return details[key];
+		}
+	}
+	return undefined;
+}
+
+function getDetailsString(
+	errorInfo: SdkProviderErrorInfo,
+	...keys: string[]
+): string | undefined {
+	const value = getDetailsValue(errorInfo, ...keys);
+	return typeof value === "string" && value.trim().length > 0
+		? value.trim()
+		: undefined;
+}
+
+function getDetailsNumber(
+	errorInfo: SdkProviderErrorInfo,
+	...keys: string[]
+): number | undefined {
+	const value = getDetailsValue(errorInfo, ...keys);
+	if (typeof value === "number" && Number.isFinite(value)) {
+		return value;
+	}
+	if (
+		typeof value === "string" &&
+		value.trim().length > 0 &&
+		Number.isFinite(Number(value))
+	) {
+		return Number(value);
+	}
+	return undefined;
+}
+
+function isHttpUrl(value: string): boolean {
+	try {
+		const parsed = new URL(value);
+		return parsed.protocol === "https:" || parsed.protocol === "http:";
+	} catch {
+		return false;
+	}
+}
+
+function resolveClineCreditsUrl(errorInfo: SdkProviderErrorInfo): string {
+	const detailUrl = getDetailsString(
+		errorInfo,
+		"buy_credits_url",
+		"buyCreditsUrl",
+		"dashboard_url",
+		"dashboardUrl",
+	);
+	if (detailUrl && isHttpUrl(detailUrl)) {
+		return detailUrl;
+	}
+	const { appBaseUrl } = getClineEnvironmentConfig();
+	return `${appBaseUrl}/dashboard/account?tab=credits`;
+}
+
+function resolveClineCreditsDisplay(
+	errorInfo: SdkErrorInfo,
+): SpecialErrorDisplay | undefined {
+	if (!isClineInsufficientCreditsErrorInfo(errorInfo)) {
+		return undefined;
+	}
+	const currentBalance = getDetailsNumber(
+		errorInfo,
+		"current_balance",
+		"currentBalance",
+	);
+	const balance =
+		currentBalance === undefined
+			? undefined
+			: Object.is(currentBalance, -0)
+				? 0
+				: currentBalance;
+	return {
+		kind: "cline_credits_depleted",
+		title: "Cline Credits depleted",
+		message:
+			"You have run out of Cline credits. Add credits in the dashboard to continue.",
+		...(balance !== undefined
+			? { balanceText: formatCreditBalance(balance) }
+			: {}),
+		url: resolveClineCreditsUrl(errorInfo),
+	};
+}
+
+function resolveClineAccountAuthDisplay(
+	errorInfo: SdkErrorInfo,
+): SpecialErrorDisplay | undefined {
+	const isAuthRequired =
+		isClineAccountAuthRequiredErrorInfo(errorInfo) ||
+		(errorInfo.kind === "provider" &&
+			errorInfo.providerId === "cline" &&
+			errorInfo.code === CLINE_ACCOUNT_AUTH_REQUIRED_CODE);
+	if (!isAuthRequired) {
+		return undefined;
+	}
+	return {
+		kind: "cline_account_auth_required",
+		title: "Cline account sign-in required",
+		message: "Sign in to your Cline account to continue.",
+		command: "/account",
+	};
+}
+
+export function resolveSpecialErrorDisplay(
+	errorInfo: SdkErrorInfo | undefined,
+): SpecialErrorDisplay | undefined {
+	if (!errorInfo) {
+		return undefined;
+	}
+	switch (errorInfo.kind) {
+		case "provider":
+			return (
+				resolveClineCreditsDisplay(errorInfo) ??
+				resolveClineAccountAuthDisplay(errorInfo)
+			);
+		case "auth":
+			return resolveClineAccountAuthDisplay(errorInfo);
+	}
+}
+
+export function formatSpecialErrorText(
+	errorInfo: SdkErrorInfo | undefined,
+): string | undefined {
+	const display = resolveSpecialErrorDisplay(errorInfo);
+	if (!display) {
+		return undefined;
+	}
+	switch (display.kind) {
+		case "cline_credits_depleted":
+			return [
+				display.title,
+				display.message,
+				display.balanceText
+					? `Current balance: ${display.balanceText}`
+					: undefined,
+				`Dashboard: ${display.url}`,
+			]
+				.filter((line): line is string => Boolean(line))
+				.join("\n");
+		case "cline_account_auth_required":
+			return [
+				display.title,
+				display.message,
+				`Open ${display.command} to sign in, then retry your message.`,
+			].join("\n");
+	}
+}

apps/cli/src/wizards/connect/index.ts

@@ -1,6 +1,11 @@
 import * as p from "@clack/prompts";
 import { runConnectAdapter } from "../../commands/connect";
-import { PLATFORMS, type PlatformDef, type SecurityDef } from "./platforms";
+import {
+	PLATFORMS,
+	type PlatformDef,
+	type SecurityDef,
+	shouldIncludeField,
+} from "./platforms";
 
 function isCancel(value: unknown): value is symbol {
 	return p.isCancel(value);
@@ -10,6 +15,7 @@ const SENSITIVE_FLAGS = new Set([
 	"-k",
 	"--access-token",
 	"--api-key",
+	"--app-token",
 	"--app-secret",
 	"--bot-token",
 	"--credentials-json",
@@ -33,28 +39,40 @@ function redactCommandArgs(args: string[]): string {
 
 async function collectFields(platform: PlatformDef): Promise<string[] | null> {
 	const args: string[] = [];
+	const values: Record<string, string> = {};
 
 	for (const field of platform.fields) {
+		if (!shouldIncludeField(field, values)) {
+			continue;
+		}
 		if (field.help) {
 			for (const line of field.help) {
 				p.log.info(line);
 			}
 		}
 
-		const value = await p.text({
-			message: field.label,
-			placeholder: field.placeholder,
-			validate: field.required
-				? (v) => {
-						if (!v?.trim()) return `${field.label} is required`;
-						return undefined;
-					}
-				: undefined,
-		});
+		const value = field.options
+			? await p.select({
+					message: field.label,
+					options: field.options,
+					initialValue: field.initialValue,
+				})
+			: await p.text({
+					message: field.label,
+					placeholder: field.placeholder,
+					defaultValue: field.initialValue,
+					validate: field.required
+						? (v) => {
+								if (!v?.trim()) return `${field.label} is required`;
+								return undefined;
+							}
+						: undefined,
+				});
 
 		if (isCancel(value)) return null;
 
 		const trimmed = (value as string).trim();
+		values[field.flag] = trimmed;
 		if (trimmed) {
 			args.push(field.flag, trimmed);
 		}
@@ -103,9 +121,9 @@ async function collectSecurity(
 		values[field.key] = (value as string).trim();
 	}
 
-	const hookCmd = security.buildHookCommand(values);
+	const args = security.buildArgs(values);
 	p.log.success("Access restriction enabled");
-	return ["--hook-command", hookCmd];
+	return args;
 }
 
 export async function runConnectWizard(): Promise<number> {

apps/cli/src/wizards/connect/platforms.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, it } from "vitest";
-import { PLATFORMS } from "./platforms";
+import { PLATFORMS, shouldIncludeField } from "./platforms";
 
 describe("connect wizard platform security fields", () => {
 	it("does not ask Telegram users to re-enter the bot username", () => {
@@ -30,4 +30,52 @@ describe("connect wizard platform security fields", () => {
 		expect(slackUser?.validate?.("U01ABC123")).toBeUndefined();
 		expect(slackUser?.validate?.("U01$(bad)")).toContain("Slack member");
 	});
+
+	it("uses the Telegram allowed user ID flag for wizard security", () => {
+		const telegram = PLATFORMS.find((platform) => platform.id === "telegram");
+
+		const args = telegram?.security?.buildArgs({
+			userId: "123456",
+		});
+
+		expect(args).toEqual(["--allowed-user-id", "123456"]);
+	});
+
+	it("builds an exact-match Slack authorization hook", () => {
+		const slack = PLATFORMS.find((platform) => platform.id === "slack");
+
+		const args = slack?.security?.buildArgs({
+			teamId: "T01ABC123",
+			userId: "U01ABC123",
+		});
+
+		expect(args).toEqual([
+			"--hook-command",
+			`jq -r ".payload.actor.participantKey" | grep -qx "slack:team:T01ABC123:user:U01ABC123" && echo '{"action":"allow"}' || echo '{"action":"deny"}'`,
+		]);
+	});
+
+	it("asks Slack users for mode-specific setup fields", () => {
+		const slack = PLATFORMS.find((platform) => platform.id === "slack");
+		const fields = slack?.fields ?? [];
+		const webhookValues = { "--base-url": "https://example.test" };
+		const socketValues = { "--base-url": "" };
+
+		expect(fields.map((field) => field.flag)).toEqual([
+			"--bot-token",
+			"--base-url",
+			"--signing-secret",
+			"--app-token",
+		]);
+		expect(
+			fields
+				.filter((field) => shouldIncludeField(field, webhookValues))
+				.map((field) => field.flag),
+		).toEqual(["--bot-token", "--base-url", "--signing-secret"]);
+		expect(
+			fields
+				.filter((field) => shouldIncludeField(field, socketValues))
+				.map((field) => field.flag),
+		).toEqual(["--bot-token", "--base-url", "--app-token"]);
+	});
 });

apps/cli/src/wizards/connect/platforms.ts

@@ -1,7 +1,7 @@
 export interface PlatformDef {
 	id: string;
 	name: string;
-	type: "polling" | "webhook";
+	type: "polling" | "webhook" | "hybrid";
 	hint: string;
 	fields: FieldDef[];
 	security?: SecurityDef;
@@ -13,8 +13,17 @@ export interface FieldDef {
 	placeholder?: string;
 	required?: boolean;
 	help?: string[];
+	initialValue?: string;
+	options?: Array<{ value: string; label: string; hint?: string }>;
+	includeWhen?: FieldCondition;
 }
 
+export type FieldCondition = {
+	flag: string;
+	equals?: string;
+	notEquals?: string;
+};
+
 export interface SecurityFieldDef {
 	key: string;
 	label: string;
@@ -27,7 +36,25 @@ export interface SecurityFieldDef {
 export interface SecurityDef {
 	prompt: string;
 	fields: SecurityFieldDef[];
-	buildHookCommand: (values: Record<string, string>) => string;
+	buildArgs: (values: Record<string, string>) => string[];
+}
+
+export function shouldIncludeField(
+	field: FieldDef,
+	values: Record<string, string>,
+): boolean {
+	const condition = field.includeWhen;
+	if (!condition) {
+		return true;
+	}
+	const value = values[condition.flag] ?? "";
+	if (condition.equals !== undefined && value !== condition.equals) {
+		return false;
+	}
+	if (condition.notEquals !== undefined && value === condition.notEquals) {
+		return false;
+	}
+	return true;
 }
 
 function validateTelegramUserId(value: string): string | undefined {
@@ -84,15 +111,14 @@ export const PLATFORMS: PlatformDef[] = [
 					validate: validateTelegramUserId,
 				},
 			],
-			buildHookCommand: ({ userId }) =>
-				`jq -r ".payload.actor.participantKey" | grep -q "telegram:id:${userId}" && echo '{"action":"allow"}' || echo '{"action":"deny"}'`,
+			buildArgs: ({ userId }) => ["--allowed-user-id", userId ?? ""],
 		},
 	},
 	{
 		id: "slack",
 		name: "Slack",
-		type: "webhook",
-		hint: "Requires a Slack app and public URL.",
+		type: "hybrid",
+		hint: "Public URL for webhook mode; leave blank for socket mode.",
 		fields: [
 			{
 				flag: "--bot-token",
@@ -105,21 +131,32 @@ export const PLATFORMS: PlatformDef[] = [
 					"Install to workspace and copy the Bot Token",
 				],
 			},
+			{
+				flag: "--base-url",
+				label: "Public base URL",
+				placeholder: "leave blank for socket mode",
+				help: [
+					"Enter a publicly accessible URL for webhook mode",
+					"Leave blank to use Slack socket mode instead",
+				],
+			},
 			{
 				flag: "--signing-secret",
 				label: "Signing secret",
 				required: true,
 				help: ["Found in your app's Basic Information page"],
+				includeWhen: { flag: "--base-url", notEquals: "" },
 			},
 			{
-				flag: "--base-url",
-				label: "Public base URL",
-				placeholder: "https://example.com",
+				flag: "--app-token",
+				label: "App-level token",
+				placeholder: "xapp-...",
 				required: true,
 				help: [
-					"Your publicly accessible URL for webhook callbacks",
-					"Use ngrok or similar for local development",
+					"Enable Socket Mode in the Slack app",
+					"Generate an app-level token with the connections:write scope",
 				],
+				includeWhen: { flag: "--base-url", equals: "" },
 			},
 		],
 		security: {
@@ -148,8 +185,10 @@ export const PLATFORMS: PlatformDef[] = [
 					validate: validateSlackUserId,
 				},
 			],
-			buildHookCommand: ({ teamId, userId }) =>
-				`jq -r ".payload.actor.participantKey" | grep -q "slack:team:${teamId}:user:${userId}" && echo '{"action":"allow"}' || echo '{"action":"deny"}'`,
+			buildArgs: ({ teamId, userId }) => [
+				"--hook-command",
+				`jq -r ".payload.actor.participantKey" | grep -qx "slack:team:${teamId}:user:${userId}" && echo '{"action":"allow"}' || echo '{"action":"deny"}'`,
+			],
 		},
 	},
 	{

apps/cline-hub/src/server/connectors.ts

@@ -2,7 +2,10 @@ import { spawn } from "node:child_process";
 import process from "node:process";
 import { listConnectorCatalog } from "../../../cli/src/connectors/catalog";
 import { listActiveConnectors } from "../../../cli/src/connectors/status";
-import { PLATFORMS } from "../../../cli/src/wizards/connect/platforms";
+import {
+	PLATFORMS,
+	shouldIncludeField,
+} from "../../../cli/src/wizards/connect/platforms";
 import type {
 	WebviewConnectorChannel,
 	WebviewConnectorChannelsResponse,
@@ -27,6 +30,9 @@ export function connectorChannelsPayload(): WebviewConnectorChannelsResponse {
 			placeholder: field.placeholder,
 			required: field.required,
 			help: field.help,
+			initialValue: field.initialValue,
+			options: field.options,
+			includeWhen: field.includeWhen,
 		})),
 		security: platform.security
 			? {
@@ -104,9 +110,21 @@ function buildConnectorStartArgs(args?: Record<string, unknown>): string[] {
 		throw new Error(`connector channel is not available: ${channel}`);
 	}
 	const values = asRecord(args?.values) ?? {};
+	const fieldValues: Record<string, string> = {};
+	for (const field of platform.fields) {
+		const rawValue = values[field.flag];
+		if (typeof rawValue === "string") {
+			fieldValues[field.flag] = rawValue.trim();
+		} else if (field.initialValue) {
+			fieldValues[field.flag] = field.initialValue;
+		}
+	}
 	const cliArgs = [channel];
 	for (const field of platform.fields) {
-		const value = asString(values[field.flag]);
+		if (!shouldIncludeField(field, fieldValues)) {
+			continue;
+		}
+		const value = fieldValues[field.flag];
 		if (!value) {
 			if (field.required) throw new Error(`${field.label} is required`);
 			continue;
@@ -124,10 +142,7 @@ function buildConnectorStartArgs(args?: Record<string, unknown>): string[] {
 			if (validationError) throw new Error(validationError);
 			hookValues[field.key] = value;
 		}
-		cliArgs.push(
-			"--hook-command",
-			platform.security.buildHookCommand(hookValues),
-		);
+		cliArgs.push(...platform.security.buildArgs(hookValues));
 	}
 	return cliArgs;
 }

apps/cline-hub/src/webview-protocol.ts

@@ -134,6 +134,13 @@ export type WebviewConnectorField = {
 	placeholder?: string;
 	required?: boolean;
 	help?: string[];
+	initialValue?: string;
+	options?: Array<{ value: string; label: string; hint?: string }>;
+	includeWhen?: {
+		flag: string;
+		equals?: string;
+		notEquals?: string;
+	};
 };
 
 export type WebviewConnectorSecurityField = {
@@ -147,7 +154,7 @@ export type WebviewConnectorSecurityField = {
 export type WebviewConnectorChannel = {
 	id: string;
 	name: string;
-	type: "polling" | "webhook";
+	type: "polling" | "webhook" | "hybrid";
 	hint: string;
 	fields: WebviewConnectorField[];
 	security?: {
@@ -168,6 +175,7 @@ export type WebviewActiveConnector = {
 	phoneNumberId?: string;
 	port?: number;
 	baseUrl?: string;
+	connectionMode?: string;
 };
 
 export type WebviewConnectorChannelsResponse = {

apps/cline-hub/src/webview/src/components/views/settings/channels-view.tsx

@@ -42,6 +42,13 @@ type ConnectorField = {
 	placeholder?: string;
 	required?: boolean;
 	help?: string[];
+	initialValue?: string;
+	options?: Array<{ value: string; label: string; hint?: string }>;
+	includeWhen?: {
+		flag: string;
+		equals?: string;
+		notEquals?: string;
+	};
 };
 
 type ConnectorSecurityField = {
@@ -55,7 +62,7 @@ type ConnectorSecurityField = {
 type ConnectorChannel = {
 	id: string;
 	name: string;
-	type: "polling" | "webhook";
+	type: "polling" | "webhook" | "hybrid";
 	hint: string;
 	fields: ConnectorField[];
 	security?: {
@@ -76,6 +83,7 @@ type ActiveConnector = {
 	phoneNumberId?: string;
 	port?: number;
 	baseUrl?: string;
+	connectionMode?: string;
 };
 
 type ConnectorChannelsResponse = {
@@ -142,10 +150,41 @@ function isMultilineField(field: ConnectorField): boolean {
 	return label.includes("json") || field.flag.includes("credentials");
 }
 
+function shouldIncludeField(
+	field: ConnectorField,
+	values: Record<string, string>,
+): boolean {
+	const condition = field.includeWhen;
+	if (!condition) {
+		return true;
+	}
+	const value = values[condition.flag] ?? "";
+	if (condition.equals !== undefined && value !== condition.equals) {
+		return false;
+	}
+	if (condition.notEquals !== undefined && value === condition.notEquals) {
+		return false;
+	}
+	return true;
+}
+
+function initialValuesForChannel(
+	channel?: ConnectorChannel,
+): Record<string, string> {
+	const values: Record<string, string> = {};
+	for (const field of channel?.fields ?? []) {
+		if (field.initialValue) {
+			values[field.flag] = field.initialValue;
+		}
+	}
+	return values;
+}
+
 function createFormState(channels: ConnectorChannel[]): ConnectorFormState {
+	const channel = channels[0];
 	return {
-		channelId: channels[0]?.id ?? "",
-		values: {},
+		channelId: channel?.id ?? "",
+		values: initialValuesForChannel(channel),
 		securityEnabled: false,
 		securityValues: {},
 	};
@@ -175,6 +214,15 @@ export function ChannelsContent() {
 		() => channels.find((channel) => channel.id === formState.channelId),
 		[channels, formState.channelId],
 	);
+	const visibleFields = useMemo(() => {
+		const values = {
+			...initialValuesForChannel(selectedChannel),
+			...formState.values,
+		};
+		return (selectedChannel?.fields ?? []).filter((field) =>
+			shouldIncludeField(field, values),
+		);
+	}, [selectedChannel, formState.values]);
 
 	const applyResponse = useCallback((response: ConnectorChannelsResponse) => {
 		setChannels(response.available);
@@ -233,6 +281,9 @@ export function ChannelsContent() {
 			return;
 		}
 		for (const field of selectedChannel.fields) {
+			if (!visibleFields.includes(field)) {
+				continue;
+			}
 			if (field.required && !formState.values[field.flag]?.trim()) {
 				setFormError(`${field.label} is required`);
 				return;
@@ -376,6 +427,11 @@ export function ChannelsContent() {
 											<span className="rounded-md border bg-background px-1.5 py-0.5">
 												{formatDateTime(connector.startedAt)}
 											</span>
+											{connector.connectionMode ? (
+												<span className="rounded-md border bg-background px-1.5 py-0.5">
+													{connector.connectionMode}
+												</span>
+											) : null}
 										</div>
 									</div>
 									<Button
@@ -413,7 +469,9 @@ export function ChannelsContent() {
 									}
 									setFormState({
 										channelId: value,
-										values: {},
+										values: initialValuesForChannel(
+											channels.find((channel) => channel.id === value),
+										),
 										securityEnabled: false,
 										securityValues: {},
 									});
@@ -433,7 +491,7 @@ export function ChannelsContent() {
 							</Select>
 						</div>
 
-						{selectedChannel?.fields.map((field) => (
+						{visibleFields.map((field) => (
 							<div className="grid gap-2" key={field.flag}>
 								<Label>
 									{field.label}
@@ -441,7 +499,29 @@ export function ChannelsContent() {
 										<span className="text-destructive"> *</span>
 									) : null}
 								</Label>
-								{isMultilineField(field) ? (
+								{field.options ? (
+									<Select
+										onValueChange={(value) => {
+											if (value) {
+												updateFieldValue(field.flag, value);
+											}
+										}}
+										value={
+											formState.values[field.flag] ?? field.initialValue ?? ""
+										}
+									>
+										<SelectTrigger>
+											<SelectValue placeholder={field.placeholder} />
+										</SelectTrigger>
+										<SelectContent>
+											{field.options.map((option) => (
+												<SelectItem key={option.value} value={option.value}>
+													{option.label}
+												</SelectItem>
+											))}
+										</SelectContent>
+									</Select>
+								) : isMultilineField(field) ? (
 									<Textarea
 										onChange={(event) =>
 											updateFieldValue(field.flag, event.target.value)

apps/vscode/package-lock.json

@@ -1,12 +1,12 @@
 {
 	"name": "claude-dev",
-	"version": "3.87.0",
+	"version": "3.88.1",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "claude-dev",
-			"version": "3.87.0",
+			"version": "3.88.1",
 			"license": "Apache-2.0",
 			"dependencies": {
 				"@anthropic-ai/sdk": "^0.37.0",

apps/vscode/package.json

@@ -2,7 +2,7 @@
 	"name": "claude-dev",
 	"displayName": "Cline",
 	"description": "Autonomous coding agent right in your IDE, capable of creating/editing files, running commands, using the browser, and more with your permission every step of the way.",
-	"version": "3.87.0",
+	"version": "3.88.1",
 	"icon": "assets/icons/icon.png",
 	"engines": {
 		"vscode": "^1.84.0"

apps/vscode/src/core/controller/models/__tests__/refreshClineRecommendedModels.test.ts

@@ -5,9 +5,6 @@ import fs from "fs/promises"
 import { afterEach, beforeEach, describe, it } from "mocha"
 import sinon from "sinon"
 import { ClineEnv, Environment } from "@/config"
-import { getFeatureFlagsService } from "@/services/feature-flags"
-import { CLINE_RECOMMENDED_MODELS_FALLBACK } from "@/shared/cline/recommended-models"
-import { FeatureFlag } from "@/shared/services/feature-flags/feature-flags"
 import { Logger } from "@/shared/services/Logger"
 import { refreshClineRecommendedModels, resetClineRecommendedModelsCacheForTests } from "../refreshClineRecommendedModels"
 
@@ -26,20 +23,7 @@ describe("refreshClineRecommendedModels", () => {
 		sandbox.restore()
 	})
 
-	it("returns hardcoded models and skips upstream fetch when rollout flag is off", async () => {
-		sandbox.stub(getFeatureFlagsService(), "getBooleanFlagEnabled").returns(false)
-		const axiosGetStub = sandbox.stub(axios, "get")
-
-		const result = await refreshClineRecommendedModels()
-
-		expect(result).to.deep.equal(CLINE_RECOMMENDED_MODELS_FALLBACK)
-		expect(axiosGetStub.called).to.equal(false)
-	})
-
-	it("fetches from upstream when rollout flag is on", async () => {
-		sandbox.stub(getFeatureFlagsService(), "getBooleanFlagEnabled").callsFake((flag) => {
-			return flag === FeatureFlag.CLINE_RECOMMENDED_MODELS_UPSTREAM
-		})
+	it("fetches from upstream", async () => {
 		sandbox.stub(ClineEnv, "config").returns({
 			environment: Environment.production,
 			appBaseUrl: "https://app.cline-mock.bot",
@@ -78,10 +62,7 @@ describe("refreshClineRecommendedModels", () => {
 		})
 	})
 
-	it("uses hardcoded models when rollout flag is turned off after upstream cache is populated", async () => {
-		const flagStub = sandbox.stub(getFeatureFlagsService(), "getBooleanFlagEnabled")
-		flagStub.onFirstCall().returns(true)
-		flagStub.onSecondCall().returns(false)
+	it("uses the in-memory cache after upstream cache is populated", async () => {
 		sandbox.stub(ClineEnv, "config").returns({
 			environment: Environment.production,
 			appBaseUrl: "https://app.cline-mock.bot",
@@ -101,7 +82,6 @@ describe("refreshClineRecommendedModels", () => {
 		const secondResult = await refreshClineRecommendedModels()
 
 		expect(axiosGetStub.calledOnce).to.equal(true)
-		expect(firstResult).to.not.deep.equal(CLINE_RECOMMENDED_MODELS_FALLBACK)
-		expect(secondResult).to.deep.equal(CLINE_RECOMMENDED_MODELS_FALLBACK)
+		expect(secondResult).to.deep.equal(firstResult)
 	})
 })

apps/vscode/src/core/controller/models/refreshClineRecommendedModels.ts

@@ -3,10 +3,7 @@ import axios from "axios"
 import fs from "fs/promises"
 import path from "path"
 import { ClineEnv } from "@/config"
-import { featureFlagsService } from "@/services/feature-flags"
-import { CLINE_RECOMMENDED_MODELS_FALLBACK } from "@/shared/cline/recommended-models"
 import { getAxiosSettings } from "@/shared/net"
-import { FeatureFlag } from "@/shared/services/feature-flags/feature-flags"
 import { Logger } from "@/shared/services/Logger"
 
 export interface ClineRecommendedModelData {
@@ -26,14 +23,6 @@ const RECOMMENDED_MODELS_CACHE_TTL_MS = 60 * 60 * 1000
 let pendingRefresh: Promise<ClineRecommendedModelsData> | null = null
 let inMemoryCache: { data: ClineRecommendedModelsData; timestamp: number } | null = null
 
-function getHardcodedRecommendedModels(): ClineRecommendedModelsData {
-	return CLINE_RECOMMENDED_MODELS_FALLBACK
-}
-
-function useUpstreamRecommendedModels(): boolean {
-	return featureFlagsService.getBooleanFlagEnabled(FeatureFlag.CLINE_RECOMMENDED_MODELS_UPSTREAM)
-}
-
 function normalizeRecommendedModel(raw: unknown): ClineRecommendedModelData | null {
 	if (!raw || typeof raw !== "object") {
 		return null
@@ -80,10 +69,6 @@ function normalizeRecommendedModelsResponse(raw: unknown): ClineRecommendedModel
 }
 
 export async function refreshClineRecommendedModels(): Promise<ClineRecommendedModelsData> {
-	if (!useUpstreamRecommendedModels()) {
-		return getHardcodedRecommendedModels()
-	}
-
 	if (inMemoryCache && Date.now() - inMemoryCache.timestamp <= RECOMMENDED_MODELS_CACHE_TTL_MS) {
 		return inMemoryCache.data
 	}

apps/vscode/src/services/mcp/McpHub.ts

@@ -1421,6 +1421,8 @@ export class McpHub {
 	}
 
 	public async addRemoteServer(serverName: string, serverUrl: string, transportType = "streamableHttp"): Promise<McpServer[]> {
+		// Set flag to prevent file watcher from triggering during our update
+		this.isUpdatingClineSettings = true
 		try {
 			const settings = await this.readAndValidateMcpSettingsFile()
 			if (!settings) {
@@ -1468,6 +1470,11 @@ export class McpHub {
 		} catch (error) {
 			Logger.error("Failed to add remote MCP server:", error)
 			throw error
+		} finally {
+			// Clear flag after a delay to ensure file watcher event has been processed
+			setTimeout(() => {
+				this.isUpdatingClineSettings = false
+			}, 300)
 		}
 	}
 
@@ -1477,6 +1484,8 @@ export class McpHub {
 	 * @returns Array of remaining MCP servers
 	 */
 	public async deleteServerRPC(serverName: string): Promise<McpServer[]> {
+		// Set flag to prevent file watcher from triggering during our update
+		this.isUpdatingClineSettings = true
 		try {
 			// Clear OAuth data BEFORE removing from config (while we still have the connection/URL)
 			await this.clearOAuthForConnection(serverName)
@@ -1504,6 +1513,11 @@ export class McpHub {
 		} catch (error) {
 			Logger.error(`Failed to delete MCP server: ${error instanceof Error ? error.message : String(error)}`)
 			throw error
+		} finally {
+			// Clear flag after a delay to ensure file watcher event has been processed
+			setTimeout(() => {
+				this.isUpdatingClineSettings = false
+			}, 300)
 		}
 	}