@koreanhole/opencodex 2.95.7 → 2.95.9

package/src/generated/compatibility-version.json

@@ -6,11 +6,11 @@
   "files": [
     {
       "path": "bun.lock",
-      "sha256": "a4d60237892ad287400974341fdbe82e926305b24d1c7f32a0cf1952c2849323"
+      "sha256": "09c7bbe9dc3bf8baf2864b58623fa0b83d3d04d36b88e5d184dbbcb0ee786f98"
     },
     {
       "path": "package.json",
-      "sha256": "8ecbf498d8a269479c9b4615c49e16304c65e0c97ead951aea8d3cb6e96c9c54"
+      "sha256": "a723f45df8d85b0d092b883a2dc688ea438d0328c42f2d20c10237e97efa5b3d"
     },
     {
       "path": "scripts/model-metadata.source.json",
@@ -120,17 +120,29 @@
       "path": "src/adapters/claude-cli/usage-admission.ts",
       "sha256": "3f92b6ce1be7f10c357c194d313052963b5fa4cd842595fe3267654184cd8a31"
     },
+    {
+      "path": "src/adapters/cli-agent/cline/acp.ts",
+      "sha256": "82e071c941aa45efc4fd61fe1b765ac9cf1167f4784b16f61457fd891ac9e41c"
+    },
     {
       "path": "src/adapters/cli-agent/cline/adapter.ts",
-      "sha256": "c5aaf47ef190c43f0ac7bd6479b7ef98fdc3ede5e4be162e213bb7f13357700d"
+      "sha256": "3d3a1121059b7e1c4efca8fc113a9f7cc17c417b4a8946fbb94763de0aa9ddcd"
+    },
+    {
+      "path": "src/adapters/cli-agent/cline/binary.ts",
+      "sha256": "ddd73654346314cdedf2945901f56be97bbdf1f8bc6fd558ddb6885e6254debc"
+    },
+    {
+      "path": "src/adapters/cli-agent/cline/live-models.ts",
+      "sha256": "e8d48c1ab19de149dd8060b6eb3073dad625ae5c258e9e28ee03e6f1a8244b83"
     },
     {
       "path": "src/adapters/cli-agent/cline/settings.ts",
-      "sha256": "8c0fed2a6738515f7935d851277962722be01906631267d29f355a5ecbef196f"
+      "sha256": "51b5298e54aee0b254fb688c9cfc619f88587f8fba769855334d2c4bf695253b"
     },
     {
       "path": "src/adapters/cli-agent/cline/stream.ts",
-      "sha256": "b8a92b460817f3b2c8ee29e6306cec92d6bf2129d4281a6044868433a4419e30"
+      "sha256": "16b05de07ffdec6c315cc35e09e9b4b5eb2f5cb1c9d1d3d39e5b17f396b761c9"
     },
     {
       "path": "src/adapters/cli-agent/gemini/adapter.ts",
@@ -1650,7 +1662,7 @@
     },
     {
       "path": "src/cli/dispatch.ts",
-      "sha256": "def180199b8c16faf88c295ba36cc1a06d2a8560e1344daa64baea3633d6c2ad"
+      "sha256": "071a0f20cb2c70a294e312c5739270234906c36accae811a3bc2da57c17d4d89"
     },
     {
       "path": "src/cli/doctor.ts",
@@ -1922,7 +1934,7 @@
     },
     {
       "path": "src/cli/registry.ts",
-      "sha256": "4e3e9f42ff1083c6489db67e1be98c1242f165034a3d51f53a5e628b0a21f059"
+      "sha256": "e0bcb8e21320139d0838a81e7c1b6bd302237219fa647d8d6d811138d88b7127"
     },
     {
       "path": "src/cli/remote-workspace-hub.ts",
@@ -2626,7 +2638,7 @@
     },
     {
       "path": "src/codex/catalog/model-hints.ts",
-      "sha256": "9707a32e1b6544b6014c0880443e99edbe6d96103b0314998df60a617f28dc82"
+      "sha256": "7c9a178a56c10b17a31f5778c062f05250e8768922038d111951f1be1cf18df1"
     },
     {
       "path": "src/codex/catalog/model-visibility.ts",
@@ -2666,7 +2678,7 @@
     },
     {
       "path": "src/codex/catalog/provider-models.ts",
-      "sha256": "963f29685d97408a6e3ee52b29200efe950e073d822bd08002f81c8cc7830fb3"
+      "sha256": "ce46a16111e62365fd5f00840243b1c138db9efbba508320915829cac748f32b"
     },
     {
       "path": "src/codex/catalog/publication-observer.ts",
@@ -5758,7 +5770,7 @@
     },
     {
       "path": "src/oauth/login-cli.ts",
-      "sha256": "2e31627198667b78bec9f8c8d2bffd773539d3ff868e5e0aaa842a6320e0811f"
+      "sha256": "43d7cea3433ccda4918242f93aaadcc8f022dc1c756dd701299ef18729ae8ce1"
     },
     {
       "path": "src/oauth/login-flow-state.ts",
@@ -6402,7 +6414,7 @@
     },
     {
       "path": "src/providers/registry/entries-extended.ts",
-      "sha256": "c0d12982dbcd6e515d00242c1e747a020078acb94e5568d3169191fec1cd8b6c"
+      "sha256": "8cfaa43bedc609b3c56ff1b0f1145b7b854b1b79b31d85f4f99f96e8a920a8c1"
     },
     {
       "path": "src/providers/registry/model-ids.ts",
@@ -6914,7 +6926,7 @@
     },
     {
       "path": "src/router.ts",
-      "sha256": "904cd0cd300be4efc1dd26ba5b3df886534276d7b15949f6b09842913b81fdae"
+      "sha256": "62ace260aadab1aaea98310c0f9ce9a9f35b0d78e39bc8ffb0e383dcda4be998"
     },
     {
       "path": "src/routing/analytics.ts",

package/src/oauth/login-cli.ts

@@ -121,16 +121,22 @@ export function loginUsageMessage(): string {
     + `  Codex / ChatGPT: ocx login codex   (account pool, needs a running proxy; 'chatgpt' and\n`
     + `                   'openai' are the same route. An OpenAI platform key is 'openai-apikey'.)\n`
     + `  OAuth login:   ${listOAuthProviders().join(", ")}\n`
-    + `  API-key login: ${Object.keys(KEY_LOGIN_PROVIDERS).join(", ")}`;
+    + `  API-key login: ${Object.keys(KEY_LOGIN_PROVIDERS).join(", ")}\n`
+    + `  ACP login:     cline-cli`;
 }
 
 export interface LoginCliOptions {
   /** `--headless`: no callback server, no browser launch — print the URL and read back the code. */
   codeMode?: boolean;
+  /** `--json`: one bounded machine-readable result for the Cline ACP login. */
+  json?: boolean;
+  /** `--no-wait`: return after relaying ACP instructions without claiming completion. */
+  noWait?: boolean;
 }
 
 export async function handleLogin(provider?: string, deps: LoginCliDeps = {}, opts: LoginCliOptions = {}): Promise<void> {
   const name = (provider ?? "").trim().toLowerCase();
+  if (name === "cline-cli") return handleClineAcpLogin(opts);
   try {
     // Check raw ownership before tolerant loading can print diagnostics or fall back to defaults.
     if (name === "anthropic2") assertAnthropicInstanceLoginConfig({ providers: {} }, name);
@@ -155,6 +161,50 @@ export async function handleLogin(provider?: string, deps: LoginCliDeps = {}, op
   process.exit(1);
 }
 
+async function handleClineAcpLogin(opts: LoginCliOptions): Promise<void> {
+  const { loginClineAcp } = await import("../adapters/cli-agent/cline/acp");
+  let instructions = "";
+  try {
+    const result = await loginClineAcp({
+      noWait: opts.noWait,
+      onInstruction: text => {
+        instructions += text;
+        if (!opts.json && text.trim()) console.log(text.trimEnd());
+      },
+    });
+    if (opts.json) {
+      console.log(JSON.stringify({
+        ok: true,
+        provider: "cline-cli",
+        methods: result.methods.map(method => ({ id: method.id, name: method.name })),
+        selectedMethod: result.method.id,
+        complete: result.complete,
+        instructions: result.instructions,
+      }));
+      return;
+    }
+    console.log(`\n🔐 Cline ACP auth methods: ${result.methods.map(method => `${method.name} (${method.id})`).join(", ")}`);
+    if (!result.complete) {
+      console.log(`Started ${result.method.name}; completion was not awaited. Re-run \`ocx login cline-cli\` after approving the sign-in.`);
+      return;
+    }
+    console.log(`\n✅ Logged in to cline-cli through ACP (${result.method.id}).`);
+    console.log("OpenCodex stored no Cline credential. Run: ocx sync");
+  } catch (error) {
+    const code = error && typeof error === "object" && "code" in error && typeof error.code === "string"
+      ? error.code
+      : "cline_acp_login_failed";
+    const message = error instanceof Error ? error.message : String(error);
+    if (opts.json) {
+      console.log(JSON.stringify({ ok: false, provider: "cline-cli", code, message, instructions }));
+    } else {
+      console.error(`\n❌ cline-cli ACP login failed (${code}): ${message}`);
+      if (instructions.trim()) console.error(instructions.trimEnd());
+    }
+    process.exit(1);
+  }
+}
+
 /** OAuth providers that accept `ocx login <provider> --headless`. */
 export function listCodeLoginProviders(): string[] {
   return listOAuthProviders().filter(supportsCodeLoginMode);

package/src/providers/registry/entries-extended.ts

@@ -1616,9 +1616,9 @@ export const PROVIDER_REGISTRY_EXTENDED: readonly ProviderRegistryEntry[] = [
     dashboardUrl: "https://docs.cline.bot/cli/getting-started",
     defaultModel: "default",
     models: ["default"],
-    liveModels: false,
+    liveModels: true,
     noVisionModels: ["default"],
-    note: "Uses the operator's existing Cline CLI session and current provider/model. OpenCodex stores no Cline credential and never sends an API key from this row. The CLI runs headless with built-in tools, plugins, hooks, user rules, and user MCP servers disabled; request tools are captured through an isolated MCP catalog and executed only by Codex. Requires the signed-in CLI (`npm install -g cline`, then `cline auth`).",
+    note: "Uses the operator's existing Cline CLI session through ACP when the installed binary advertises `--acp`, otherwise the real-HOME one-shot fallback. OpenCodex stores no Cline credential and never sends an API key from this row. Live models come from ACP session setup; `default` remains the compatibility alias. ACP denies vendor permissions and advertises only a capture-only MCP catalog, so request tools are returned to Codex for approval and execution. Requires the signed-in CLI (`npm install -g cline`, then `ocx login cline-cli`).",
   },
   {
     // Local Gemini CLI transport. The CLI owns Google sign-in and model choice; opencodex

package/src/router.ts

@@ -46,6 +46,7 @@ import { getRoutingProfile, resolvePolicyProfileId, POLICY_NAMESPACE } from "./r
 import { evaluatePolicyProfile, type PolicyRequestEvidence } from "./routing/evaluator";
 import { assemblePolicyCandidateEvidence } from "./routing/compatibility/assemble";
 import { resolveModelPolicy, type ResolvedModelPolicy } from "./providers/resolved-model-policy";
+import { clineBinaryFingerprintSync, resolveClineBinary } from "./adapters/cli-agent/cline/binary";
 
 /** Explicit Pool 2 admission refusal; ingress must not recover it through default routing. */
 export class AnthropicSecondaryInstanceUnavailableError extends Error {
@@ -181,6 +182,10 @@ export function knownModelIdsForProvider(
       if (provName === "workbuddy-ai") return workBuddyCatalogIdentity(key, account.credential.workbuddy);
       if (routed.adapter === "devin") destination = validateDevinApiBaseUrl(account.credential.apiBaseUrl) ?? routed.baseUrl;
     }
+    if (routed.adapter === "cline-cli") {
+      const binary = resolveClineBinary(undefined, process.env);
+      return binary ? clineBinaryFingerprintSync(binary) : undefined;
+    }
     if (!key) return undefined;
     return createHash("sha256")
       .update(routed.adapter === "devin"