Files
cline/apps/cli
Mikołaj Kondratek 43bb575b6d fix(llms, cli): mark claude-code as local-auth and describe local CLIs in the provider spec (#13407)
* fix(llms): mark claude-code as local-auth so keyless entries are usable

The Claude Code provider authenticates from the local `claude` CLI's own
credential store (Pro/Max subscription login) and never reads an API key:
createClaudeCodeProviderModule builds its settings purely from
config.options, so any stored key is inert.

Without the local-auth capability, getProviderConfigFields reported
authMethod "api-key" with a single apiKey field. The CLI's onboarding gate
(isProviderConfigured -> isProviderSettingsUsable) therefore refused a
keyless claude-code entry and dropped straight to the sign-in wizard, and
configure dialogs asked for a key that does nothing. The workaround was to
store a dummy key.

Add local-auth to the spec, and derive the CLI's local-auth UX from the
capability instead of a hardcoded `openai-codex-cli` id check. The codex
descriptor generalizes into a small registry naming each provider's CLI,
probed executable, and install URL, so the readiness screen (previously
Codex-only copy) now serves both providers. Tests pin the registry against
the set of providers the SDK reports as local auth, in both directions.

Stored keys still short-circuit the readiness check, so anyone who saved a
placeholder key keeps working.

* fix(cli): ignore stale local-CLI readiness probes

The local-CLI setup screen shares one status slot across providers. Probing
spawns the CLI with a 3s timeout, so switching providers while a probe is in
flight let the previous provider's result land on the new provider's screen —
marking it ready off another CLI's success, or blocking it off another CLI's
failure.

Tag each probe and let only the newest one write the status, the checking
flag, and the error reason.

Unreachable before: codex was the only local-CLI provider, so there was no
second provider to switch to.

* refactor(cli): keep local-CLI provider ids module-private

Both id constants are only referenced by the registry literal in the same
file, so exporting them added public API with no callers.

* refactor(llms, cli): describe local CLI providers in the provider spec

The CLI kept its own table of which local CLIs back which providers, holding
the executable, install URL and display name. That duplicated facts the
provider spec already owns (name) and made a second place to update when a
provider changes.

Move the descriptor to the spec: `executable` is the CLI analogue of
`defaults.baseUrl` (the vendor-defined command that reaches the provider,
not a resolved path), and the install link reuses the existing `docsUrl`.
Both surface on the provider info the CLI already reads.

The CLI now derives everything from the capability plus the spec, so it holds
no provider list of its own and a new local-auth provider needs no change on
that side. Drops the id constants, the hardcoded registry, and the drift-guard
test that only existed to keep the two copies in sync.

* refactor(llms, core, cli): resolve local CLI facts from the provider catalog

Ports the shape from Bee's branch. The command a local-auth provider borrows
credentials from is declared as `metadata.localCliCommand` beside the existing
`docsUrl`, and `resolveProviderLocalCli` reads it, so hosts get both without a
new top-level spec field.

Splits two things this previously conflated. `isLocalAuthProvider` routes on
the capability alone, while the CLI descriptor is optional: a local-auth
provider whose credentials come from somewhere unprobeable now reaches the
local setup screen and can connect, instead of falling through to an API-key
form with no fields.

* fix(cli): declare localCli in the save callback deps

Relaxing the save gate to allow local-auth providers that name no CLI made
saveLocalCliConfig read localCli without listing it, so the callback could
decide against a stale value after switching providers.

* fix(cli): route local-auth setup on the capability and stop gating on the PATH probe

Two integration gaps between the capability and the screens it drives.

Onboarding and provider switching branched on whether a CLI descriptor was
found, so a provider that declares local-auth without naming a CLI fell
through to the API-key form, which renders no fields for it. Both call sites
now take the same resolveProviderSetupRoute decision, which reads the
capability; the descriptor is used only to decide whether there is anything
to probe.

The readiness probe only looks on PATH, while the runtime also accepts an
explicit pathToClaudeCodeExecutable and a bundled platform binary, and Codex
falls back through npx. A PATH miss therefore means 'not on PATH', not
'unusable', so the screens report it without blocking and a provider that
really cannot start says so on the first turn.
2026-09-08 20:40:57 +02:00
..
2026-06-03 01:49:57 +02:00
2026-06-25 18:17:16 +02:00
2026-09-01 21:18:16 -07:00
2026-06-03 01:49:57 +02:00

Cline CLI

Run Cline in your terminal. Interactive chat for paired sessions, or fully headless for CI/CD and scripting. The CLI shares its agent core with the Cline VS Code extension, JetBrains plugin, and SDK, so plan/act modes, MCP servers, checkpoints, rules, skills, and provider configuration all behave the same across surfaces.

Install

npm install -g cline

For nightly builds:

npm install -g cline@nightly

Platform binaries are published for macOS, Linux, and Windows on arm64 and x64. The cline package resolves the correct binary for your platform via optional dependencies, so no Node, Bun, or Zig runtime is required at install time.

Quick start

Run interactively:

cline

Run a single prompt:

cline "Audit this package and propose fixes"

Pipe input:

cat file.txt | cline "Summarize this"

See cline --help for the full flag reference.

Use any provider

Cline supports the same providers as the VS Code extension. You can sign in to Cline directly, use your ChatGPT Subscription through openai-codex, or bring an API key from Anthropic, OpenAI, Google Gemini, OpenRouter, AWS Bedrock, GCP Vertex, Cerebras, Groq, and any OpenAI-compatible endpoint.

cline auth                              # interactive sign-in
cline auth cline                        # OAuth sign-in
cline auth --provider anthropic --apikey sk-... --modelid claude-sonnet-4-6

cline auth without a provider opens the interactive auth setup TUI with the same options as the old CLI flow (Sign in with Cline, Sign in with ChatGPT Subscription, Sign in with OCA, or use your own API key).

OAuth-supported providers (cline, openai-codex, oca) do not auto-launch a browser on normal startup. Authenticate explicitly first with cline auth <provider>. For non-interactive runs, if an OAuth provider is selected and no saved credentials are available, cline fails fast with an authentication message instead of launching a hidden browser flow.

Modes

Cline CLI runs in a few different shapes depending on what you need:

  • Interactive TUI: cline or cline -i opens a full terminal UI with plan/act toggle, slash commands, file mentions, and live tool approvals
  • One-shot: cline "your prompt" runs a single turn and exits
  • JSON: cline --json "..." streams NDJSON events for piping into other tools
  • Yolo: cline --yolo "..." skips approval prompts and exits when the turn finishes
  • Zen: cline --zen "..." fires the task to the background hub daemon and exits immediately (see below)

Headless mode for CI/CD

Run Cline with zero interaction for scripting and automation. Pipe input, get JSON output, chain commands, integrate into CI/CD pipelines.

# One-shot prompt, auto-approve all tools
cline --yolo "Run tests and fix any failures"

# Pipe a diff in for review
git diff origin/main | cline "Review these changes for issues"

# NDJSON output for downstream tooling
cline --json "List all TODO comments" | jq -r 'select(.type == "agent_event" and .event.text) | .event.text'

Features

  • Streaming TUI built on OpenTUI with markdown rendering, syntax-highlighted diffs, scrollable chat, and mouse support
  • Plan/Act mode toggle for switching between planning and execution
  • Native MCP support for connecting custom tools
  • Checkpoints with /undo to rewind workspace state
  • Sub-agent spawning and agent teams for parallel work
  • OAuth login for Cline, ChatGPT Subscription (openai-codex), and OCA
  • Configurable thinking budgets per run
  • Cron and event-driven schedules for recurring agent work
  • Chat connectors for Telegram, Google Chat, and WhatsApp

Usage

# Start Cline CLI without a prompt to enter interactive mode
cline

# Single prompt (one-shot) - includes tools, spawn, and teams
cline "Audit this package and propose fixes"

# Interactive mode with a starting prompt
cline -i "Let's work on this together. First, analyze the current state."

# With a custom system prompt
cline -i -s "You are a pirate" "Tell me about the sea"

# Require approval before each tool call
cline --auto-approve false "Inspect and modify this repository"

# Explicit yolo: enables submit_and_exit and disables spawn/team tools by default
cline --yolo --retries 5 "Refactor this package"

# Override consecutive internal mistake (retry) limit (default: 3)
cline --retries 5 "Fix failing tests"

# Team workflow with persistent name
cline --team-name my-team "Plan, implement, and verify release checklist"
cline --team-name my-team "Continue yesterday's team workflow"

# Show verbose run stats (elapsed time, tokens, estimated cost when available)
cline -v "Explain quantum computing"

# Use a specific provider, model, and access token for a single prompt
cline -P openrouter -m google/gemini-3-pro -k sk-... "Set up a storybook"

# Use a different model with the last used provider
cline -m anthropic/claude-opus-4-6 "Explain string theory"

# Stream structured NDJSON output
cline --json "Summarize this repository"

# Quick provider setup
cline auth --provider anthropic --apikey sk-... --modelid claude-sonnet-4-6
cline auth --provider openai-native --apikey sk-... --modelid gpt-5 --baseurl https://api.example.com/v1

MCP servers

Manage MCP servers with the interactive wizard:

cline mcp
cline config mcp

Open the add-server wizard with the name, transport, and command or URL already filled in with cline mcp install (cline mcp add also works). Stdio servers use everything after -- as the command and arguments:

cline mcp install fs -- npx -y @modelcontextprotocol/server-filesystem /tmp

Remote HTTP and SSE servers take a name, transport, and URL. The wizard still asks for auth details before saving:

cline mcp install ctx7 --transport http https://mcp.context7.com/mcp
cline mcp install events --transport sse https://example.com/sse

Because this command opens the wizard, it requires a TTY.

Connectors

Bridge a chat surface into RPC-backed Cline sessions. Each conversation thread maps to a session with full context. Supported platforms: Telegram, Slack, Google Chat, WhatsApp, and Linear.

# Telegram (polling mode)
cline connect telegram -k 123456:ABCDEF...

# Slack (webhook mode)
cline connect slack --bot-token $SLACK_BOT_TOKEN --signing-secret $SLACK_SIGNING_SECRET --base-url https://your-domain.com

# Slack (socket mode)
cline connect slack --bot-token $SLACK_BOT_TOKEN --app-token $SLACK_APP_TOKEN

# Google Chat (webhook mode)
cline connect gchat --base-url https://your-domain.com

# WhatsApp (webhook mode)
cline connect whatsapp --base-url https://your-domain.com

# Linear (webhook mode)
cline connect linear --api-key $LINEAR_API_KEY --base-url https://your-domain.com

# Stop connector bridges and delete their sessions
cline connect --stop
cline connect --stop telegram

In chat surfaces, connector slash commands include /help, /start, /new, /clear, /whereami, /tools, /yolo, /cwd <path>, /schedule, /abort, and /exit. Run cline connect <adapter> --help to see the full flag list for any adapter.

Schedules

Schedule agents on cron-like intervals or external events.

If --provider and --model are omitted, schedules use the last configured provider and model. If only --provider is given, the schedule uses that provider's saved model.

cline schedule create "Daily code review" \
  --cron "0 9 * * MON-FRI" \
  --prompt "Review PRs opened yesterday and summarize issues." \
  --workspace /path/to/repo \
  --timeout 3600 \
  --tags automation,review

cline schedule list
cline schedule get <schedule-id>
cline schedule trigger <schedule-id>
cline schedule history <schedule-id> --limit 20
cline schedule export <schedule-id> > daily-review.yaml
cline schedule import ./daily-review.yaml

Schedules can route results back to chat surfaces with --delivery-adapter, --delivery-bot, and --delivery-thread.

Options

Flag Description
-s, --system <prompt> Override the system prompt
-P, --provider <id> Provider id (default: cline)
-m, --model <id> Model id (default: anthropic/claude-sonnet-4.6)
-k, --key <api-key> API key override for this run
-p, --plan Run in plan mode (default is act mode)
-i, --tui Interactive TUI multi-turn mode
-t, --timeout <seconds> Optional run timeout in seconds
-c, --cwd <path> Working directory for tools
--config <path> Configuration directory (used for CLI home resolution)
--hooks-dir <path> Additional hooks directory hint for runtime hook injection
--acp ACP (Agent Client Protocol) mode
--thinking [none|low|medium|high|xhigh] Model thinking level when supported. Defaults to medium when the flag is provided without a level; thinking is off when the flag is omitted.
--compaction <agentic|basic|off> Context compaction mode. Defaults to agentic; use basic for local truncation or off to disable.
--retries <count> Maximum consecutive mistakes (retries) before halting (default: 3)
--json Output NDJSON instead of styled text
--data-dir <path> Use isolated local state at <path> instead of ~/.cline/data (enables sandbox mode automatically)
--auto-approve [true|false] Set tool auto-approval for all tools
--kanban Run the external kanban app
-y, --yolo Skip tool approval prompts, enable submit_and_exit, and disable spawn/team tools by default
-z, --zen Dispatch the task to the background hub and exit the CLI immediately
--team-name <name> Override the runtime team state name
-h, --help Show help and exit
-v, --verbose Show verbose runtime diagnostics
-V, --version Show version and exit

--json is non-interactive and requires either a prompt argument or piped stdin. --key takes precedence over environment variables.

Top-level commands

  • cline config - Open the interactive config view
  • cline history|h [options] - List session history or manage saved sessions
  • cline version - Show CLI version
  • cline update [options] - Check for CLI and kanban updates
  • cline auth <provider> - Authenticate or seed provider credentials
  • cline connect <adapter> - Run a chat connector bridge (telegram, gchat, whatsapp)
  • cline connect --stop [adapter] - Stop connector bridge processes and their sessions
  • cline schedule <command> - Create and manage scheduled runs
  • cline doctor - Inspect local CLI health and stale processes
  • cline doctor fix - Kill stale local RPC listeners and old CLI processes
  • cline doctor log - Open the CLI runtime log file
  • cline hook - Handle a hook payload from stdin
  • cline hub - Manage the local hub daemon
  • cline kanban - Run the external kanban app, installing it first when needed

Zen mode

--zen (alias -z) runs a task in the background hub daemon and exits the CLI immediately. It is intended for long-running tasks you want to fire off and walk away from.

cline --zen "Refactor the authentication module and add unit tests"

Behavior:

  • The CLI starts (or reuses) the local hub daemon, submits the task, then exits. It does not stream output or stay attached to the session.
  • Because there is no human in the loop once the CLI exits, zen sessions run with full tool auto-approval (same semantics as --yolo). spawn/team tools are disabled by default for safety, consistent with yolo-mode defaults.
  • If the Cline menubar app is running, it subscribes to hub ui.notify events and will surface a system notification when the task completes.
  • If the menubar app is not running, there is no live UI for the task. Use cline history later to find the session and inspect the result.
  • --zen is incompatible with --data-dir (the implicit sandbox requires a local backend that exits with the CLI) and with --tui (there is no terminal UI to render into).

Tool approval

Tool calls are auto-approved by default. Use --auto-approve false to require review before tool execution.

cline --auto-approve false "Inspect and modify this repository"

When approval is required, the CLI prompts in TTY mode:

Approve tool "<tool_name>" with input <preview>? [y/N]
  • Enter y or yes to approve.
  • Enter anything else (or press Enter) to reject.
  • If stdin/stdout is not a TTY, required-approval calls are denied in terminal mode.

Desktop-integrated approval mode is also supported via env wiring (CLINE_TOOL_APPROVAL_MODE=desktop and CLINE_TOOL_APPROVAL_DIR=<path>). In desktop mode, CLI writes a request JSON file and waits for a matching decision JSON file.

Environment variables

  • ANTHROPIC_API_KEY - API key for Anthropic
  • CLINE_API_KEY - API key for Cline (when using -P cline)
  • OPENAI_API_KEY - API key for OpenAI (when using -P openai)
  • OPENROUTER_API_KEY - API key for OpenRouter (when using -P openrouter)
  • AI_GATEWAY_API_KEY - API key for Vercel AI Gateway (when using -P vercel-ai-gateway)
  • V0_API_KEY - API key for v0 (when using -P v0)
  • CLINE_DATA_DIR - Base data directory for sessions/settings/teams/hooks
  • CLINE_SANDBOX - Set to 1 to force sandbox mode
  • CLINE_SANDBOX_DATA_DIR - Override sandbox state directory
  • CLINE_TEAM_DATA_DIR - Override team persistence directory
  • CLINE_BUILD_ENV - Runtime build mode for SDK-owned subprocess launches
  • CLINE_DEBUG_HOST - Host for development inspector listeners (default 127.0.0.1)
  • CLINE_DEBUG_PORT_BASE - Base inspector port for development child processes
  • CLINE_TOOL_APPROVAL_MODE - Approval mode (desktop uses file IPC; unset uses terminal prompt)
  • CLINE_TOOL_APPROVAL_DIR - Directory for desktop approval request/decision files
  • CLINE_LOG_ENABLED - Set to 0/false to disable runtime file logging
  • CLINE_LOG_LEVEL - Runtime log level (trace|debug|info|warn|error|fatal|silent, default info)
  • CLINE_LOG_PATH - Runtime log file path (default <CLINE_DATA_DIR>/logs/cline.log)
  • CLINE_LOG_NAME - Logger name embedded in runtime log records
  • CLINE_DEBUG - Set to 1/true to print wrapper diagnostics (e.g. the CA bundle summary)

--key takes precedence over environment variables.

Certificate trust

The CLI automatically trusts your operating system's certificate store, so it works behind corporate TLS-inspecting proxies and with self-signed/internal endpoints without any setup. On launch the cline wrapper harvests the OS trust anchors and writes them to ~/.cline/cli-node-extra-ca-certs.pem, then points the runtime's NODE_EXTRA_CA_CERTS at that bundle. The file is regenerated when it changes and is safe to delete (it is rebuilt on the next run).

If you set NODE_EXTRA_CA_CERTS yourself, your certificates are merged into that bundle alongside the system store rather than replacing it. Run with CLINE_DEBUG=1 to see how many OS and user CAs were loaded and where the bundle was written.

Contributing

See DEVELOPMENT.md for local development setup, monorepo structure, and TUI architecture. See DISTRIBUTION.md for how the CLI is packaged and distributed.

License

Apache 2.0 © Cline Bot Inc.