b2c7148cd9
* feat(desktop): render Mermaid diagrams in chat Render model-authored Mermaid fences as interactive SVGs in Desktop without depending on model image-input support. - extract the strict lazy Mermaid DiagramPlugin into @cline/ui - keep shared defaults diagram-free and add explicit opt-in controls - enable copy, download, fullscreen, and pan/zoom in Desktop - preserve initial bundle size through dynamic Mermaid imports - cover lazy loading, strict security, failures, and streaming fences Refs #13568 * test(desktop): harden Mermaid rendering coverage * test(desktop): stub scrollTo for streamdown 2.6 in Markdown interaction tests streamdown 2.6 (pulled in by main) scrolls streaming code blocks with element.scrollTo, which jsdom does not implement. Stub it the same way chat-messages.test.tsx and channels-view.test.tsx already do. * fix(ui): stop Mermaid diagram links from bypassing host link policy Mermaid's `securityLevel: "strict"` blocks script execution and dangerous URL schemes, but still renders a `click <node> "https://…"` directive as a live `<a xlink:href>` anchor inside the SVG. Streamdown injects that SVG with `dangerouslySetInnerHTML`, so those anchors never pass through the `a` component a product supplies — bypassing the deceptive-link confirmation and the external-open routing that ordinary Markdown links go through, with no rel="noreferrer", and letting a click navigate the desktop webview away from the app itself. A diagram label is authored independently of its destination, so these links are deceptive by construction: the desktop app's own isDeceptiveLink rule would flag every one of them. - neutralize rendered diagram links in @cline/ui so they cannot navigate on their own, preserving an http(s) destination on data-cline-diagram-href - reattach them in Desktop to the existing confirmation modal, which shows the real destination before anything opens - recover the anchor from pointerdown: Streamdown's pan/zoom surface takes pointer capture, so a real click is retargeted away from the anchor; a press that moves more than a few pixels is treated as a pan, not a link click - drop non-http(s) destinations rather than surfacing them, so a renderer change cannot widen what the app will open - assert the packed Mermaid control shape instead of a "not false" check that also accepted undefined or an empty object Verified against real Mermaid 11.16.1 in a browser: script, event-handler, iframe, foreignObject and javascript:/data:/vbscript:/file: payloads are all neutralized by strict mode, and `%%{init}%%` / YAML frontmatter cannot downgrade securityLevel. The http(s) `click` anchor was the one live escape. Stacked on #13721, which adds the shared lazy Mermaid plugin this hardens. Refs #13568 Co-authored-by: yiaany <ilyaantonievich@gmail.com> Co-authored-by: yiheng-kkk <lij921093@gmail.com> * feat(ui): theme Mermaid diagrams with the Cline design system Replace Streamdown's built-in Mermaid block in Desktop with an owned `@cline/ui` block (`createMermaidRenderer` from `@cline/ui/components/mermaid-block`): - Mermaid's `base` theme with variables resolved from the live design tokens (`--card`, `--foreground`, `--primary`, ...), following light/dark and the accent palette and re-rendering when either changes; a diagram's own `%%{init}%%`, frontmatter `config:`, `classDef` and `style` still win - a filename header from the fence title (```mermaid title="my-diagram"), frontmatter `title:`, or a name derived from the diagram - zoom, fullscreen, copy, and PNG / `.mmd` downloads; PNGs are opaque, 2-3x, capped at 4096px and kept under the image attachment limit - renders are serialized through one queue, since Mermaid is a process-wide singleton that is not safe to render concurrently The owned block injects the SVG itself, so diagram link neutralization moves into the shared render service and covers both this block and the Streamdown diagram plugin. Desktop keeps routing diagram link clicks through the existing confirmation modal. Refs #13568 * fix(ui): avoid polynomial backtracking in Mermaid helpers * fix(ui): make diagram label extraction linear-time Replaces the backtracking label-regexes CodeQL flagged (ReDoS, PR #14757) with single-pass scanners and line-column parsing. * refactor(ui): share the Mermaid render service and drop dead naming helper createLazyMermaidPlugin now delegates import/retry/queueing/link-neutralization to createMermaidService instead of duplicating that path, keeping only theme-keyed config. Removes deriveMermaidDiagramName, which had no consumer outside its own tests. --------- Co-authored-by: harrisonofcline <harrison@cline.bot> Co-authored-by: yiheng-kkk <lij921093@gmail.com>
Cline
The open source coding agent in your IDE, terminal, & desktop.
CLIRun Cline in your terminal. Interactive chat or fully headless for CI/CD and scripting. |
Desktop AppCline as a native app for macOS and Windows. Run agent sessions in any folder, schedule routines, and manage models, plugins, and MCP servers. |
VS Code ExtensionAI coding assistant in your editor. Create files, run commands, browse the web, and use tools with human-in-the-loop approval. |
JetBrains PluginThe same Cline experience in IntelliJ IDEA, PyCharm, WebStorm, GoLand, and the rest of the JetBrains family. |
SDKBuild your own AI agents and integrations powered by the same engine that runs the CLI, desktop app, VS Code extension, and JetBrains plugin. Custom tools, multi-agent teams, connectors, scheduled automations, and more. |
Index
| Product | Description | Location | CHANGELOG |
|---|---|---|---|
| SDK | Node.js programmatic agent API and extension exports. | sdk/ |
CHANGELOG.md |
| CLI | Terminal UI, headless mode, shell commands, and CLI-specific flows. | apps/cli/ |
CHANGELOG.md |
| VS Code Extension | The Marketplace extension and extension host integration. | / (WIP migrating) |
CHANGELOG.md |
| Desktop App | Native macOS and Windows app (Tauri shell, Bun sidecar, Next.js UI). | apps/examples/desktop-app/ |
CHANGELOG.md |
| JetBrains Plugin | JetBrains-hosted client that talks to the shared agent core. | Currently we are not open-sourcing JetBrains plugins | - |
| Docs site | Public documentation pages. | docs/ |
- |
Edits Code Across Your Project
Cline reads your project structure, understands the relationships between files, and makes coordinated changes across your codebase. It monitors linter and compiler errors as it works, fixing issues like missing imports, type mismatches, and syntax errors before you even see them. In VS Code and JetBrains, every edit shows up as a diff you can review, modify, or revert. All changes are tracked with checkpoints, so you can easily undo the agent's work.
Runs Bash Commands
Cline executes commands directly in your terminal and watches the output in real time. Install packages, run build scripts, execute tests, deploy applications, manage databases. For long-running processes like dev servers, Cline continues working in the background and reacts to new output as it appears, catching compile errors, test failures, and server crashes as they happen.
Plan and Act
Toggle between Plan mode and Act mode. In Plan mode, Cline explores your codebase, asks clarifying questions, and lays out a strategy. Once you're aligned, switch to Act mode and Cline executes the plan. Every file edit and terminal command requires your approval, so you stay in control of what actually changes. Or toggle auto-approve and let Cline run autonomously.
Rules and Skills
Define project-specific rules in .clinerules files that guide how Cline works in your codebase: coding standards, architecture conventions, deployment procedures, testing requirements. Rules are picked up automatically by the CLI, VS Code extension, and JetBrains plugin. Use skills to let the model load specific rules when needed.
Works With Every Model
Cline is not locked to a single AI provider. Use whichever model fits your workflow:
| Provider | Models |
|---|---|
| Anthropic | Claude Opus, Sonnet, Haiku |
| OpenAI | GPT series models |
| Gemini series models | |
| OpenRouter | 200+ models from any provider |
| Vercel AI Gateway | Route to many providers through one gateway |
| AWS Bedrock | Claude, Llama, and more |
| Azure / GCP Vertex | All hosted models |
| Cerebras / Groq | Fast inference models |
| Ollama / LM Studio | Run local models on your machine |
| Any OpenAI-compatible API | Self-hosted or third-party endpoints |
Extend With Plugins or MCP Servers
Extend Cline's capabilities with plugins. Using the SDK, register tools and lifecycle hooks programmatically through the plugin system for logging, auditing, policy enforcement, or adding domain-specific capabilities. Simple plugin example below.
import { Agent, createTool } from "@cline/sdk"
const deployTool = createTool({
name: "deploy",
description: "Deploy the current branch to staging.",
inputSchema: { type: "object", properties: { env: { type: "string" } }, required: ["env"] },
execute: async (input) => {
// your deployment logic
},
})
const agent = new Agent({ tools: [deployTool], /* ... */ })
...or use MCPs to connect to databases, query APIs, manage cloud infrastructure, and interact with external systems. Use community-built servers or ask Cline to create custom tools on the fly. In the CLI, manage servers with cline mcp.
Multi-Agent Teams
Coordinate multiple agents working together on complex tasks. A coordinator agent breaks the work into subtasks and delegates to specialist agents, each with their own tools and context. Team state persists across sessions so you can pick up where you left off.
cline --team-name auth-sprint "Plan and implement user authentication with tests"
Scheduled Agents
Run agents on cron schedules for recurring automations. Daily PR summaries, weekly dependency checks, codebase health reports. Schedules persist across restarts and run independently of any terminal session.
cline schedule create "PR summary" \
--cron "0 9 * * MON-FRI" \
--prompt "List all open PRs and their review status" \
--workspace /path/to/repo
Connect to Slack, Telegram, Discord, and More
Chat with your agent from any messaging platform: Telegram, Slack, Discord, Google Chat, WhatsApp, and Linear. Each conversation thread maps to an agent session with full context. Set up access control to restrict who can interact with your agent.
# Connect to Telegram
cline connect telegram -k $BOT_TOKEN
# Connect to Slack through webhook
cline connect slack --bot-token $SLACK_TOKEN --signing-secret $SECRET --base-url $URL
# Connect to Slack using socket mode
cline connect slack --bot-token $SLACK_TOKEN --app-token $SLACK_APP_TOKEN
Headless CLI for CI/CD
Run Cline with zero interaction for scripting and automation. Pipe input, get JSON output, chain commands, integrate into CI/CD pipelines.
cline "Run tests and fix any failures"
git diff origin/main | cline "Review these changes for issues"
cline --json "List all TODO comments" | jq -r 'select(.type == "agent_event" and .event.text) | .event.text'
Contributing
Start with the Contributing Guide. Join our Discord and head to the #contributors channel to connect with other contributors. Check our careers page for full-time roles.