@koreanhole/opencodex 2.95.8 → 2.95.9

package/src/adapters/cli-agent/cline/adapter.ts

@@ -1,7 +1,6 @@
 import { fileURLToPath } from "node:url";
-import { existsSync } from "node:fs";
 import { writeFile } from "node:fs/promises";
-import { dirname, join } from "node:path";
+import { join } from "node:path";
 import type { AdapterEvent, OcxParsedRequest, OcxProviderConfig } from "../../../types";
 import type { AdapterRequest, ProviderAdapter } from "../../base";
 import { buildCodingAgentToolCatalog, CodingAgentToolCatalogError } from "../../coding-agent/tool-catalog";
@@ -11,18 +10,26 @@ import { isStandaloneBinary } from "../../../lib/standalone";
 import { runCliAgentTurn } from "../turn";
 import type { CliAgentTurnDeps } from "../types";
 import {
-  assertClineSelectionSafe,
+  assertClineAdvisoryDestinationSafe,
   buildClineChildEnv,
   ClineSettingsError,
   mergeClineDisabledTools,
   preflightClineTools,
-  probeClineFlagCapabilities,
   resolveClineProviderSettingsPath,
   stageClineTurn,
-  type ClineFlagCapabilities,
-  type ClineSelection,
   type ClineStagedTurn,
 } from "./settings";
+import { resolveClineBinary } from "./binary";
+import {
+  buildClineAcpEnv,
+  ClineAcpError,
+  probeClineAcpSupport,
+  runClineAcpTurn,
+  stageClineAcpWorkspace,
+  type ClineAcpDeps,
+  type ClineAcpMode,
+  type ClineAcpTurnInput,
+} from "./acp";
 import {
   classifyClineFailure,
   createClineStreamState,
@@ -49,21 +56,13 @@ export interface ClineCliAdapterDeps extends CliAgentTurnDeps {
   providerSettingsPath?: string;
   stageTurn?: typeof stageClineTurn;
   preflightTools?: typeof preflightClineTools;
-  probeFlags?: typeof probeClineFlagCapabilities;
+  probeAcp?: typeof probeClineAcpSupport;
+  stageAcp?: typeof stageClineAcpWorkspace;
+  runAcp?: (input: ClineAcpTurnInput, emit: (event: AdapterEvent) => void, deps?: ClineAcpDeps) => Promise<void>;
+  acpDeps?: ClineAcpDeps;
 }
 
-/** Prefer the npm wrapper's cached native executable so stdin remains a regular file fd. */
-export function resolveClineBinary(
-  which: WhichFn = whichFromPath,
-  env: NodeJS.ProcessEnv = process.env,
-): string | undefined {
-  const explicit = env.CLINE_BIN_PATH?.trim();
-  if (explicit && existsSync(explicit)) return explicit;
-  const resolved = which("cline");
-  if (!resolved) return undefined;
-  const cached = join(dirname(resolved), ".cline");
-  return existsSync(cached) ? cached : resolved;
-}
+export { resolveClineBinary } from "./binary";
 
 function hasUnsupportedMedia(parsed: OcxParsedRequest): boolean {
   return parsed.context.messages.some(message =>
@@ -107,23 +106,12 @@ export function buildClinePrompt(
   ].filter(Boolean).join("\n\n");
 }
 
-export function buildClineArgs(
-  selection?: ClineSelection,
-  capabilities: ClineFlagCapabilities = {},
-): string[] {
+export function buildClineArgs(): string[] {
   // The CLI surface differs between Cline and its forks. Keep the invocation to the
-  // core JSON mode; config, data, hooks, provider/model, auto-approve, and compaction
-  // are carried by CLINE_* environment variables, staged settings, and the provider
-  // store. The fixed bridge text travels in the private stdin prompt.
-  const args = ["--json"];
-  if (capabilities.providerFlag && selection?.providerId) {
-    args.push(capabilities.providerFlag, selection.providerId);
-  }
-  if (capabilities.modelFlag && selection?.model) {
-    args.push(capabilities.modelFlag, selection.model);
-  }
-  args.push("Follow the piped conversation and instructions.");
-  return args;
+  // core JSON mode; staged CLINE_* paths and settings carry config/tool policy, while
+  // the real HOME and the vendor provider store remain advisory. The fixed bridge
+  // text travels in the private stdin prompt.
+  return ["--json", "Follow the piped conversation and instructions."];
 }
 
 function toolNameMap(catalog: ReturnType<typeof buildCodingAgentToolCatalog>): Map<string, string> {
@@ -171,6 +159,27 @@ function settingsError(error: unknown): Extract<AdapterEvent, { type: "error" }>
   };
 }
 
+function acpFailure(error: unknown): Extract<AdapterEvent, { type: "error" }> {
+  if (error instanceof ClineAcpError) {
+    return {
+      type: "error",
+      message: error.message,
+      status: error.status,
+      errorType: error.errorType,
+      code: error.code,
+      retryable: error.retryable,
+    };
+  }
+  return {
+    type: "error",
+    message: error instanceof Error ? error.message : String(error),
+    status: 502,
+    errorType: "upstream_error",
+    code: "acp_transport_error",
+    retryable: false,
+  };
+}
+
 /** Create the additive, keyless Cline CLI provider adapter. */
 export function createClineCliAdapter(
   provider: OcxProviderConfig,
@@ -199,10 +208,11 @@ export function createClineCliAdapter(
         });
         return;
       }
-      if (parsed.modelId !== CLINE_CLI_MODEL_ID) {
+      const requestedModel = typeof parsed.modelId === "string" ? parsed.modelId.trim() : "";
+      if (!requestedModel) {
         emit({
           type: "error",
-          message: `Cline CLI exposes only the ${CLINE_CLI_MODEL_ID} model.`,
+          message: "Cline CLI requires a model selector.",
           status: 400,
           errorType: "invalid_request_error",
           code: "model_not_found",
@@ -252,11 +262,106 @@ export function createClineCliAdapter(
         return;
       }
 
+      const vendorNames = toolNameMap(catalog);
+      const vendorNameByWire = new Map(
+        [...catalog.emittedNameMap.values()].map(wireName => [
+          wireName,
+          wireName.startsWith("opencodex__") ? wireName : `opencodex__${wireName}`,
+        ]),
+      );
+      const fixedSystem = systemPromptWithToolNames(catalog);
+      const acpDeps: ClineAcpDeps = {
+        ...deps.acpDeps,
+        env: sourceEnv,
+        ...(deps.spawn ? { spawn: deps.spawn as ClineAcpDeps["spawn"] } : {}),
+        ...(deps.platform ? { platform: deps.platform } : {}),
+        ...(deps.timeoutMs !== undefined ? { timeoutMs: deps.timeoutMs } : {}),
+        ...(deps.killGraceMs !== undefined ? { killGraceMs: deps.killGraceMs } : {}),
+        ...(deps.reapTimeoutMs !== undefined ? { reapTimeoutMs: deps.reapTimeoutMs } : {}),
+        ...(deps.killWindowsProcessTree ? { killWindowsProcessTree: deps.killWindowsProcessTree } : {}),
+      };
+      const acpEnv = buildClineAcpEnv(sourceEnv);
+      let acpMode: ClineAcpMode = { acp: false };
+      try {
+        acpMode = await (deps.probeAcp ?? probeClineAcpSupport)(binary, acpEnv, acpDeps);
+      } catch {
+        acpMode = { acp: false };
+      }
+
+      if (acpMode.acp) {
+        let workspace: Awaited<ReturnType<typeof stageClineAcpWorkspace>> | undefined;
+        try {
+          workspace = await (deps.stageAcp ?? stageClineAcpWorkspace)(catalog.tools);
+        } catch (error) {
+          emit(settingsError(error));
+          return;
+        }
+        const mcpServers = workspace.catalogPath && catalog.emittedNameMap.size > 0
+          ? [{
+            type: "stdio",
+            name: CLINE_MCP_SERVER_NAME,
+            command: process.execPath,
+            args: isStandaloneBinary()
+              ? ["__cli-agent-mcp", workspace.catalogPath]
+              : [CLINE_MCP_SERVER_PATH, workspace.catalogPath],
+            env: [],
+          }]
+          : [];
+        let acpOutput = false;
+        const acpEmit = (event: AdapterEvent): void => {
+          if (event.type === "text_delta" || event.type === "thinking_delta"
+            || event.type === "tool_call_start" || event.type === "tool_call_delta" || event.type === "tool_call_end") {
+            acpOutput = true;
+          }
+          emit(event);
+        };
+        try {
+          await (deps.runAcp ?? runClineAcpTurn)({
+            binary,
+            env: acpEnv,
+            cwd: workspace.cwd,
+            modelId: requestedModel,
+            prompt: buildClinePrompt(parsed, vendorNameByWire, fixedSystem),
+            toolNames: vendorNames,
+            mcpServers,
+            args: acpMode.autoApproveFlag ? ["--acp", "--auto-approve", "false"] : ["--acp"],
+            maxToolCalls: 16,
+            requireToolCall: catalog.requireToolCall,
+            incoming,
+            deps: acpDeps,
+          }, acpEmit, acpDeps);
+          return;
+        } catch (error) {
+          if (!(error instanceof ClineAcpError && error.fallbackAllowed && !acpOutput && requestedModel === "default")) {
+            emit(acpFailure(error));
+            return;
+          }
+          if (error.authRequired) {
+            console.warn("[opencodex] Cline ACP authentication required [code=acp_auth_required]; using one-shot fallback.");
+          } else {
+            console.warn("[opencodex] Cline ACP unavailable; using one-shot fallback.");
+          }
+        } finally {
+          await workspace.cleanup();
+        }
+      }
+
+      if (requestedModel !== CLINE_CLI_MODEL_ID) {
+        emit({
+          type: "error",
+          message: `Cline ACP is required to select model "${requestedModel}". Enable ACP or use the default model.`,
+          status: 400,
+          errorType: "invalid_request_error",
+          code: "cline_model_unsupported",
+          retryable: false,
+        });
+        return;
+      }
+
       const providerSettingsPath = deps.providerSettingsPath
         ?? resolveClineProviderSettingsPath(sourceEnv);
-      let selection: ClineSelection;
       try {
-        selection = await assertClineSelectionSafe(providerSettingsPath);
+        await assertClineAdvisoryDestinationSafe(providerSettingsPath);
       } catch (error) {
         emit(settingsError(error));
         return;
@@ -307,25 +412,14 @@ export function createClineCliAdapter(
           message: preflight.detail || "Cline tool preflight failed.",
           status: 502,
           errorType: "upstream_error",
-          code: "cline_tool_preflight_failed",
+          code: preflight.unsupported ? "cline_tool_preflight_unsupported" : "cline_tool_preflight_failed",
           retryable: false,
         });
         return;
       }
 
-      const vendorNames = toolNameMap(catalog);
-      const vendorNameByWire = new Map(
-        [...catalog.emittedNameMap.values()].map(wireName => [
-          wireName,
-          wireName.startsWith("opencodex__") ? wireName : `opencodex__${wireName}`,
-        ]),
-      );
-      const toolNames = vendorNames;
       const state = createClineStreamState();
-      const maxToolCalls = 16;
-      const fixedSystem = systemPromptWithToolNames(catalog);
-      const capabilities = await (deps.probeFlags ?? probeClineFlagCapabilities)(binary, env);
-      const args = buildClineArgs(selection, capabilities);
+      const capabilities = buildClineArgs();
       const promptFile = join(staged.root, "prompt.txt");
       try {
         await writeFile(promptFile, buildClinePrompt(parsed, vendorNameByWire, fixedSystem), {
@@ -349,7 +443,7 @@ export function createClineCliAdapter(
       await runCliAgentTurn({
         label: "Cline CLI",
         binary,
-        args,
+        args: capabilities,
         env,
         cwd: staged.workspaceDir,
         stdin: "",
@@ -358,8 +452,8 @@ export function createClineCliAdapter(
         requireToolCall: catalog.requireToolCall,
         classifyFailure: ({ exitCode, stderr }) => classifyClineFailure(exitCode, stderr),
         parseLine: (message, current) => mapClineMessage(message, current, {
-          toolNames,
-          maxToolCalls,
+          toolNames: vendorNames,
+          maxToolCalls: 16,
         }),
         cleanup: staged.cleanup,
       }, incoming, emit, deps);

package/src/adapters/cli-agent/cline/binary.ts

@@ -0,0 +1,29 @@
+import { createHash } from "node:crypto";
+import { existsSync, statSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { whichFromPath, type WhichFn } from "../../coding-agent/profile";
+
+/** Prefer the npm wrapper's cached native executable so stdio remains a regular file fd. */
+export function resolveClineBinary(
+  which: WhichFn = whichFromPath,
+  env: NodeJS.ProcessEnv = process.env,
+): string | undefined {
+  const explicit = env.CLINE_BIN_PATH?.trim();
+  if (explicit && existsSync(explicit)) return explicit;
+  const resolved = which("cline");
+  if (!resolved) return undefined;
+  const cached = join(dirname(resolved), ".cline");
+  return existsSync(cached) ? cached : resolved;
+}
+
+/** Irreversible cache authority for one installed Cline binary. */
+export function clineBinaryFingerprintSync(binary: string): string {
+  const path = resolve(binary);
+  try {
+    const value = statSync(path);
+    return createHash("sha256").update(JSON.stringify([path, value.mtimeMs, value.size])).digest("hex");
+  } catch {
+    return createHash("sha256").update(path).digest("hex");
+  }
+}
+

package/src/adapters/cli-agent/cline/live-models.ts

@@ -0,0 +1,68 @@
+import { ClineAcpClient, ClineAcpError, buildClineAcpEnv, clineAcpEnabled, clineModelSource, probeClineAcpSupport, stageClineAcpWorkspace, type ClineAcpDeps } from "./acp";
+import { clineBinaryFingerprintSync, resolveClineBinary } from "./binary";
+
+export type ClineLiveModelsFailure = "not_found" | "unsupported" | "auth_required" | "transport";
+
+export type ClineLiveModelsResult =
+  | {
+      ok: true;
+      models: string[];
+      source: "models" | "configOptions" | "default";
+      fingerprint: string;
+    }
+  | {
+      ok: false;
+      reason: ClineLiveModelsFailure;
+      detail: string;
+      fingerprint?: string;
+    };
+
+export interface ClineLiveModelsOptions {
+  binary?: string;
+  env?: NodeJS.ProcessEnv;
+  deps?: ClineAcpDeps;
+}
+
+/**
+ * One short ACP discovery session. The caller owns catalog freshness; this function only
+ * proves which native models the current binary and vendor account expose.
+ */
+export async function discoverClineLiveModels(options: ClineLiveModelsOptions = {}): Promise<ClineLiveModelsResult> {
+  const sourceEnv = options.env ?? process.env;
+  if (!clineAcpEnabled(sourceEnv)) {
+    return { ok: false, reason: "unsupported", detail: "ACP is disabled by OPENCODEX_CLINE_ACP=0." };
+  }
+  const binary = options.binary ?? resolveClineBinary(undefined, sourceEnv);
+  if (!binary) return { ok: false, reason: "not_found", detail: "Cline CLI not found on PATH." };
+  const fingerprint = clineBinaryFingerprintSync(binary);
+  const env = buildClineAcpEnv(sourceEnv);
+  const mode = await probeClineAcpSupport(binary, env, { ...options.deps, env: sourceEnv });
+  if (!mode.acp) return { ok: false, reason: "unsupported", detail: "Cline --help does not advertise --acp.", fingerprint };
+  const workspace = await stageClineAcpWorkspace();
+  let client: ClineAcpClient | undefined;
+  try {
+    client = await ClineAcpClient.connect({
+      binary,
+      env,
+      cwd: workspace.cwd,
+      args: mode.autoApproveFlag ? ["--acp", "--auto-approve", "false"] : ["--acp"],
+    }, options.deps);
+    const session = await client.newSession({ cwd: workspace.cwd, mcpServers: [] });
+    const discovered = clineModelSource(session);
+    return { ok: true, models: discovered.ids, source: discovered.source, fingerprint };
+  } catch (error) {
+    if (error instanceof ClineAcpError && error.authRequired) {
+      return { ok: false, reason: "auth_required", detail: error.message, fingerprint };
+    }
+    return {
+      ok: false,
+      reason: "transport",
+      detail: error instanceof Error ? error.message : String(error),
+      fingerprint,
+    };
+  } finally {
+    await client?.terminate();
+    await workspace.cleanup();
+  }
+}
+

package/src/adapters/cli-agent/cline/settings.ts

@@ -75,6 +75,7 @@ export interface ClineEnabledTool {
 
 export interface ClineToolPreflightResult {
   ok: boolean;
+  unsupported?: boolean;
   detail?: string;
   enabledTools?: readonly ClineEnabledTool[];
 }
@@ -278,6 +279,19 @@ export async function assertClineSelectionSafe(providerSettingsPath: string): Pr
   };
 }
 
+/**
+ * The vendor store is advisory in one-shot mode: absence or another schema is Cline's
+ * business. Only an explicit route back through this proxy remains a hard refusal.
+ */
+export async function assertClineAdvisoryDestinationSafe(providerSettingsPath: string): Promise<void> {
+  try {
+    await assertClineSelectionSafe(providerSettingsPath);
+  } catch (error) {
+    if (error instanceof ClineSettingsError && error.code === "cli_provider_recursion") throw error;
+    if (!(error instanceof ClineSettingsError)) throw error;
+  }
+}
+
 function clineGlobalSettings(): Record<string, unknown> {
   return {
     telemetryOptOut: true,
@@ -634,16 +648,16 @@ export async function preflightClineTools(input: {
   try {
     result = await runPreflightProcess(input.binary, ["config", "tools", "--json"], input.env, input.cwd);
   } catch (error) {
-    return { ok: false, detail: error instanceof Error ? error.message : String(error) };
+    return { ok: false, unsupported: true, detail: error instanceof Error ? error.message : String(error) };
   }
   if (result.exitCode !== 0) {
-    return { ok: false, detail: result.stderr.trim() || `Cline tool preflight exited with code ${result.exitCode}.` };
+    return { ok: false, unsupported: true, detail: result.stderr.trim() || `Cline tool preflight exited with code ${result.exitCode}.` };
   }
   let parsed: unknown;
   try {
     parsed = JSON.parse(result.stdout);
   } catch {
-    return { ok: false, detail: "Cline tool preflight returned non-JSON output." };
+    return { ok: false, unsupported: true, detail: "Cline tool preflight returned non-JSON output." };
   }
   return validateClineToolCatalog(parsed);
 }

package/src/adapters/cli-agent/cline/stream.ts

@@ -104,12 +104,14 @@ function toolArguments(input: unknown): string {
   return serialized;
 }
 
-function mapToolCall(
-  event: Record<string, unknown>,
+/** Map a validated tool intent from either Cline's NDJSON or ACP event shape. */
+export function mapClineToolIntent(
+  vendorName: string,
+  toolCallId: string | undefined,
+  input: unknown,
   state: CliAgentStreamState,
   options: ClineStreamOptions,
 ): AdapterEvent[] {
-  const vendorName = asString(event.toolName);
   if (!vendorName) throw new ClineStreamProtocolError("Cline returned a tool call without a name.");
   const wireName = options.toolNames.get(vendorName);
   if (!wireName) {
@@ -120,8 +122,8 @@ function mapToolCall(
     throw new ClineStreamProtocolError("Cline exceeded the per-turn tool-call limit.");
   }
   const ordinal = ++state.nextToolOrdinal;
-  const id = asString(event.toolCallId)?.trim() || `cline-tool-${ordinal}`;
-  const argumentsJson = toolArguments(event.input);
+  const id = toolCallId?.trim() || `cline-tool-${ordinal}`;
+  const argumentsJson = toolArguments(input);
   state.toolCalls++;
   return [
     { type: "tool_call_start", id, name: wireName },
@@ -130,6 +132,14 @@ function mapToolCall(
   ];
 }
 
+function mapToolCall(
+  event: Record<string, unknown>,
+  state: CliAgentStreamState,
+  options: ClineStreamOptions,
+): AdapterEvent[] {
+  return mapClineToolIntent(asString(event.toolName) ?? "", asString(event.toolCallId), event.input, state, options);
+}
+
 function mapAgentEvent(
   event: Record<string, unknown>,
   state: CliAgentStreamState,

package/src/cli/dispatch.ts

@@ -377,6 +377,8 @@ const commandRunners: Record<string, CommandRunner> = {
     // It is deliberately not `--code`: that name carries a secret value everywhere else in the
     // CLI (`ocx account login <provider> --code <value>`) and its operand is scrubbed from stderr.
     const codeMode = loginArgs.includes("--headless");
+    const json = loginArgs.includes("--json");
+    const noWait = loginArgs.includes("--no-wait");
     const positional = loginArgs.filter(arg => !arg.startsWith("--"));
     // 'ocx login codex' is the command people type first, and until now it answered with
     // the full provider wall because the Codex pool lives behind 'ocx account login'.
@@ -397,7 +399,11 @@ const commandRunners: Record<string, CommandRunner> = {
       return code ?? 1;
     }
     const { handleLogin } = await import("../oauth/login-cli");
-    await handleLogin(positional[0], {}, { codeMode });
+    if (positional[0] !== "cline-cli" && (json || noWait)) {
+      console.error("--json and --no-wait are only supported by `ocx login cline-cli`.");
+      return 1;
+    }
+    await handleLogin(positional[0], {}, { codeMode, json, noWait });
     return 0;
   },
   logout: async deps => {

package/src/cli/registry.ts

@@ -237,10 +237,11 @@ export const CLI_COMMANDS: CliCommandEntry[] = [
   },
   {
     name: "login",
-    usage: "ocx login <provider> [--headless]",
-    summary: "OAuth or API-key login for a provider.",
+    usage: "ocx login <provider> [--headless] [--json] [--no-wait]",
+    summary: "OAuth, API-key, or ACP login for a provider.",
     details: [
       "--headless (anthropic, anthropic2): no browser and no local port; approve in any browser and paste the displayed code.",
+      "cline-cli: ACP auth; --json emits bounded method/instruction state and --no-wait returns after relaying instructions.",
       "Codex/ChatGPT: ocx login codex runs the Codex account-pool login (same flow as ocx account login codex).",
       "That one needs a running proxy; the OAuth and API-key providers log in locally.",
       "'chatgpt' and 'openai' are the same route; an OpenAI platform API key is 'ocx login openai-apikey'.",

package/src/codex/catalog/model-hints.ts

@@ -500,6 +500,9 @@ export function suppressedSyntheticMaxCatalogSlugs(
 export const QUIET_AUTHORITATIVE_CATALOG_PROVIDERS = new Set(["kimi", "xai", "google-antigravity"]);
 
 export const CALLABLE_CONFIGURED_COMPATIBILITY_MODELS: Readonly<Record<string, ReadonlySet<string>>> = {
+  // Cline's live ACP roster names concrete native model ids, while `default` remains the
+  // callable compatibility selector for the vendor's current model.
+  "cline-cli": new Set(["default"]),
   // CodeBuddy's vendor defaults are real callable selectors — both the bundled manifests
   // (`product.json` / `product.internal.json`) and `--model` accept them — but the key-scoped
   // configuration roster omits them. Without this entry, a successful live roster

package/src/codex/catalog/provider-models.ts

@@ -67,6 +67,7 @@ import { fetchQoderModels } from "../../adapters/qoder/live-models";
 import { resolveQoderProfile } from "../../adapters/qoder/profiles";
 import { CODEBUDDY_PROFILES, type CodeBuddyProfile } from "../../adapters/codebuddy/profiles";
 import { fetchCodeBuddyModels } from "../../adapters/codebuddy/live-models";
+import { clineBinaryFingerprintSync, resolveClineBinary } from "../../adapters/cli-agent/cline/binary";
 import { resolveProfileByBaseUrl } from "../../adapters/coding-agent/profile";
 import { fetchDevinUsableModels } from "../../adapters/devin/live-models";
 import { resolveDevinApiBaseUrl } from "../../oauth/devin/api-base";
@@ -272,6 +273,50 @@ export async function fetchProviderModelsWithAuth(
     }
     return observed(configured, "authoritative");
   }
+  if (prov.adapter === "cline-cli") {
+    const binary = resolveClineBinary(undefined, process.env);
+    if (!binary) return observed(configured, "degraded");
+    const authorityIdentity = clineBinaryFingerprintSync(binary);
+    const fresh = getFreshCached(name, ttlMs, Date.now(), authorityIdentity);
+    if (fresh) {
+      return observed(withConfiguredRetention(
+        applyConfigHintsToCachedModels(name, prov, fresh, contextCap, metadataModelIdCaseFold, captured.effectiveAlias, metadataConfigDir, false),
+      ), "authoritative");
+    }
+    const stale = getStaleCached(name, authorityIdentity);
+    if (isModelsFetchCoolingDown(name, 60_000, Date.now(), authorityIdentity)) {
+      return observed(withConfiguredRetention(
+        stale
+          ? applyConfigHintsToCachedModels(name, prov, stale, contextCap, metadataModelIdCaseFold, captured.effectiveAlias, metadataConfigDir, false)
+          : configured,
+      ), "degraded");
+    }
+    const { discoverClineLiveModels } = await import("../../adapters/cli-agent/cline/live-models");
+    const live = await discoverClineLiveModels({ binary });
+    if (live.ok) {
+      const discovered = live.models.map(id => ({
+        id,
+        provider: name,
+        ...catalogHintsFromProviderConfig(name, prov, id, contextCap, metadataModelIdCaseFold, captured.effectiveAlias, metadataConfigDir, false),
+      }));
+      const forCache = withConfiguredRetention(discovered, { retainComboTargets: false });
+      if (!setCached(name, forCache, Date.now(), cacheGeneration, authorityIdentity)) {
+        return observed(withConfiguredRetention(configured), "degraded");
+      }
+      markProviderDiscoveryOk(name, live.models.length);
+      return observed(withConfiguredRetention(forCache, { warnDrops: true }), "authoritative");
+    }
+    if (isCurrentCacheGeneration()) {
+      markModelsFetchFailure(name, Date.now(), authorityIdentity);
+      markProviderDiscoveryFailed(name, { reason: "provider" });
+      console.warn(
+        `[opencodex] Cline ACP model discovery failed [${live.reason}]${live.detail ? `: ${live.detail}` : ""}; using stale/static catalog degradation.`,
+      );
+    }
+    return observed(withConfiguredRetention(
+      stale ? applyConfigHintsToCachedModels(name, prov, stale, contextCap, metadataModelIdCaseFold, captured.effectiveAlias, metadataConfigDir, false) : configured,
+    ), "degraded");
+  }
   const auth: ModelsAuthResolution = prov.authMode === "oauth" && !mayResolveModelsOAuth(name, prov)
     ? { apiKey: undefined, observed: resolveAuth.kind === "observed" }
     : captured.observedAuth ?? (resolveAuth.kind === "refreshing"