@koreanhole/opencodex 3.2.10 → 3.2.12

package/AGENTS_INSTALL.md

@@ -43,11 +43,13 @@ or through the documented default path; unrelated Codex settings are not changed
 
 ## Credential rules
 
-- Use the operator's existing Cline or Gemini CLI sign-in. Do not copy vendor
+- Use the operator's existing Cline or Gemini CLI sign-in. Cline login is
+  vendor-managed through `cline auth`; the adapter has no ACP login or discovery
+  dependency. Do not copy vendor
   tokens into config, environment files, logs, prompts, or package content. The
   only exception is Cline's mode-0600 request-scoped staging copy.
 - Do not authenticate on a request path. If Cline reports `auth_required`, stop
-  and ask the operator to run `ocx login cline-cli`.
+  and ask the operator to run `ocx login cline-cli` or `cline auth` directly.
 - Do not edit the operator's real Cline provider store or legacy
   `globalState.json`/`secrets.json`. Read them only to create mode-0600
   request-scoped copies; remove those copies after the turn.

package/README.md

@@ -54,9 +54,11 @@ model management, service lifecycle, and restore behavior remain available
 through the same `ocx` command.
 
 The managed provider rows appear as `gemini-cli/...` and `cline-cli/...`.
-Cline model discovery and explicit login use ACP, while Cline model turns use
-the installed CLI's JSON transport across the 2.2.0 and current output contracts.
-Gemini runtime model discovery uses the
+Cline does not require ACP: it exposes a stable `default` selector that follows
+the model already selected in Cline, while Cline model turns use the installed
+CLI's JSON transport across the 2.2.0 and current output contracts. Explicit
+`ocx login cline-cli` delegates to the vendor `cline auth` command. Gemini runtime
+model discovery uses the
 installed CLI's ACP session, while reasoning metadata and model turns use the
 installed CLI's headless transport. Parent-declared tools are exposed through a
 request-scoped capture MCP server.
@@ -137,8 +139,9 @@ the blocker.
 - Cline runs with request-scoped, mode-0600 settings. Its built-in tools, user
   MCP servers, hooks, plugins, telemetry, updates, and self-approval are disabled.
   Modern provider state and legacy global/secrets state are copied privately;
-  the originals are never modified. Its turn options are used only after the
-  installed binary's `--help` output advertises them.
+  the originals are never modified. No Cline runtime path requires ACP. Its turn
+  options are used only after the installed binary's `--help` output advertises
+  them.
 - Gemini headless turns run in a request-scoped workspace with
   `GEMINI_CLI_TRUST_WORKSPACE=true`, `--skip-trust`, and
   `--approval-mode auto_edit`, but the generated isolated Gemini home settings

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@koreanhole/opencodex",
-  "version": "3.2.10",
+  "version": "3.2.12",
   "description": "Full opencodex runtime with Cline 2.2.0+ JSON and Gemini CLI headless provider adapters",
   "type": "module",
   "main": "./bin/package-main.mjs",

package/src/adapters/cli-agent/cline/adapter.ts

@@ -19,7 +19,7 @@ import {
   type ClineStagedTurn,
 } from "./settings";
 import { resolveClineBinary } from "./binary";
-import { buildClineAcpEnv } from "./acp";
+import { buildClineProbeEnv } from "./env";
 import {
   buildClineJsonArgs,
   ClineJsonError,
@@ -189,7 +189,7 @@ export async function runClineTurn(
     return;
   }
 
-  const probeEnv = buildClineAcpEnv(sourceEnv);
+  const probeEnv = buildClineProbeEnv(sourceEnv);
   let capabilities: ClineJsonCapabilities;
   try {
     capabilities = await (deps.probeJson ?? probeClineJsonCapabilities)(binary, probeEnv, deps);

package/src/adapters/cli-agent/cline/env.ts

@@ -0,0 +1,26 @@
+import { homedir } from "node:os";
+import { baseScopedEnv } from "../env";
+
+function nonEmpty(value: unknown): string | undefined {
+  return typeof value === "string" && value.trim() ? value.trim() : undefined;
+}
+
+/** Build a real-home environment for bounded Cline capability probes. */
+export function buildClineProbeEnv(sourceEnv: NodeJS.ProcessEnv = process.env): Record<string, string> {
+  const env = baseScopedEnv(sourceEnv);
+  const realHome = nonEmpty(sourceEnv.HOME) ?? nonEmpty(sourceEnv.USERPROFILE) ?? homedir();
+  env.HOME = realHome;
+  env.USERPROFILE = realHome;
+  for (const key of ["XDG_CONFIG_HOME", "XDG_CACHE_HOME", "CLINE_DIR", "CLINE_DATA_DIR", "CLINE_PROVIDER_SETTINGS_PATH"]) {
+    const value = nonEmpty(sourceEnv[key]);
+    if (value) env[key] = value;
+  }
+  Object.assign(env, {
+    CLINE_NO_AUTO_UPDATE: "1",
+    CLINE_TELEMETRY_DISABLED: "1",
+    CLINE_DISABLE_CLINE_PASS_NOTICE: "1",
+    NO_UPDATE_NOTIFIER: "1",
+    NO_COLOR: "1",
+  });
+  return env;
+}

package/src/adapters/cli-agent/cline/json.ts

@@ -8,7 +8,7 @@ import { redactSecretString } from "../../../lib/redact";
 import { commandInvocation } from "../../../lib/win-exec";
 import { CodingAgentProtocolError, readJsonLines } from "../protocol";
 import type { CliAgentTurnDeps } from "../types";
-import { buildClineAcpEnv } from "./acp";
+import { buildClineProbeEnv } from "./env";
 import type { ClineSelection } from "./settings";
 import {
   classifyClineFailure,
@@ -197,7 +197,7 @@ function probeFailure(code: string, detail: string): ClineJsonError {
 
 export async function probeClineJsonCapabilities(
   binary: string,
-  env: Record<string, string> = buildClineAcpEnv(),
+  env: Record<string, string> = buildClineProbeEnv(),
   deps: CliAgentTurnDeps = {},
 ): Promise<ClineJsonCapabilities> {
   const path = resolve(binary);

package/src/adapters/cli-agent/cline/live-models.ts

@@ -1,128 +1,21 @@
-import {
-  buildClineAcpEnv,
-  clineAcpEnabled,
-  clineModelSource,
-  probeClineAcpSupport,
-  stageClineAcpWorkspace,
-  type ClineAcpDeps,
-} from "./acp";
-import { clineBinaryFingerprintSync, resolveClineBinary } from "./binary";
-import { AcpClient, AcpError } from "../acp-client";
-
-export type ClineLiveModelsFailure = "not_found" | "unsupported" | "auth_required" | "backoff" | "transport";
+import { whichFromPath, type WhichFn } from "../../coding-agent/profile";
+import type { CliAgentTurnDeps } from "../types";
+import { resolveClineBinary } from "./binary";
 
 export type ClineLiveModelsResult =
-  | {
-      ok: true;
-      models: string[];
-      source: "models" | "configOptions" | "default";
-      fingerprint: string;
-      stale?: true;
-    }
-  | {
-      ok: false;
-      reason: ClineLiveModelsFailure;
-      detail: string;
-      fingerprint?: string;
-    };
+  | { ok: true; models: ["default"]; source: "default" }
+  | { ok: false; reason: "not_found"; detail: string };
 
 export interface ClineLiveModelsOptions {
   binary?: string;
   env?: NodeJS.ProcessEnv;
-  deps?: ClineAcpDeps;
-  ttlMs?: number;
-  failureBackoffMs?: number;
-  now?: () => number;
-}
-
-interface CacheEntry {
-  models: string[];
-  source: "models" | "configOptions" | "default";
-  fetchedAt: number;
-  lastFailureAt?: number;
+  which?: WhichFn;
+  deps?: CliAgentTurnDeps;
 }
 
-const cache = new Map<string, CacheEntry>();
-const failureCache = new Map<string, number>();
-
-export function resetClineLiveModelsCacheForTests(): void {
-  cache.clear();
-  failureCache.clear();
-}
-
-function staleResult(fingerprint: string, entry: CacheEntry | undefined): ClineLiveModelsResult | undefined {
-  if (!entry) return undefined;
-  return {
-    ok: true,
-    models: [...entry.models],
-    source: entry.source,
-    fingerprint,
-    stale: true,
-  };
-}
-
-/** Discover Cline's native model roster with TTL, stale fallback, and failure backoff. */
+/** Cline has no ACP-free model enumeration; default uses its persisted selection. */
 export async function discoverClineLiveModels(options: ClineLiveModelsOptions = {}): Promise<ClineLiveModelsResult> {
-  const sourceEnv = options.env ?? process.env;
-  const now = options.now ?? Date.now;
-  const ttlMs = options.ttlMs ?? 5 * 60_000;
-  const failureBackoffMs = options.failureBackoffMs ?? 60_000;
-  if (!clineAcpEnabled(sourceEnv)) {
-    return { ok: false, reason: "unsupported", detail: "ACP is disabled by OPENCODEX_CLINE_ACP=0." };
-  }
-  const binary = options.binary ?? resolveClineBinary(undefined, sourceEnv);
+  const binary = options.binary ?? resolveClineBinary(options.which ?? whichFromPath, options.env ?? process.env);
   if (!binary) return { ok: false, reason: "not_found", detail: "Cline CLI not found on PATH." };
-  const fingerprint = clineBinaryFingerprintSync(binary);
-  const current = cache.get(fingerprint);
-  const timestamp = now();
-  if (current && timestamp - current.fetchedAt < ttlMs) {
-    return { ok: true, models: [...current.models], source: current.source, fingerprint };
-  }
-  const lastFailure = failureCache.get(fingerprint) ?? current?.lastFailureAt;
-  if (lastFailure !== undefined && timestamp - lastFailure < failureBackoffMs) {
-    return staleResult(fingerprint, current)
-      ?? { ok: false, reason: "backoff", detail: "Cline model discovery is cooling down after a failure.", fingerprint };
-  }
-
-  const env = buildClineAcpEnv(sourceEnv);
-  const mode = await probeClineAcpSupport(binary, env, { ...options.deps, env: sourceEnv });
-  if (!mode.acp) {
-    failureCache.set(fingerprint, timestamp);
-    if (current) current.lastFailureAt = timestamp;
-    return staleResult(fingerprint, current)
-      ?? { ok: false, reason: "unsupported", detail: "Cline --help does not advertise --acp.", fingerprint };
-  }
-  const workspace = await stageClineAcpWorkspace();
-  let client: AcpClient | undefined;
-  try {
-    client = await AcpClient.connect({
-      binary,
-      env,
-      cwd: workspace.cwd,
-      args: mode.autoApproveFlag ? ["--acp", "--auto-approve", "false"] : ["--acp"],
-      label: "Cline ACP",
-      fallbackAllowed: true,
-    }, options.deps);
-    const session = await client.newSession({ cwd: workspace.cwd, mcpServers: [] });
-    const discovered = clineModelSource(session);
-    cache.set(fingerprint, { models: discovered.ids, source: discovered.source, fetchedAt: timestamp });
-    failureCache.delete(fingerprint);
-    return { ok: true, models: discovered.ids, source: discovered.source, fingerprint };
-  } catch (error) {
-    failureCache.set(fingerprint, timestamp);
-    if (current) current.lastFailureAt = timestamp;
-    const stale = staleResult(fingerprint, current);
-    if (error instanceof AcpError && error.authRequired) {
-      return stale ?? { ok: false, reason: "auth_required", detail: error.message, fingerprint };
-    }
-    return stale ?? {
-      ok: false,
-      reason: "transport",
-      detail: error instanceof Error ? error.message : String(error),
-      fingerprint,
-    };
-  } finally {
-    await client?.terminate();
-    await workspace.cleanup();
-  }
+  return { ok: true, models: ["default"], source: "default" };
 }

package/src/adapters/cli-agent/cline/login.ts

@@ -0,0 +1,85 @@
+import { spawn as nodeSpawn } from "node:child_process";
+import { homedir } from "node:os";
+import { commandInvocation } from "../../../lib/win-exec";
+import { whichFromPath, type WhichFn } from "../../coding-agent/profile";
+import type { CliAgentSpawnFn } from "../types";
+import { resolveClineBinary } from "./binary";
+
+const VENDOR_LOGIN_INSTRUCTION = "Cline authentication is managed by Cline CLI. Run `cline auth` in an interactive terminal.";
+
+export class ClineLoginError extends Error {
+  constructor(
+    message: string,
+    readonly status: number,
+    readonly code: string,
+  ) {
+    super(message);
+    this.name = "ClineLoginError";
+  }
+}
+
+export interface ClineLoginOptions {
+  instructionsOnly?: boolean;
+  env?: NodeJS.ProcessEnv;
+  which?: WhichFn;
+  spawn?: CliAgentSpawnFn;
+  platform?: NodeJS.Platform;
+}
+
+export interface ClineLoginResult {
+  mode: "vendor" | "instruction";
+  complete: boolean;
+  exitCode: number;
+  instructions?: string;
+}
+
+/** Explicit login delegates to the real vendor CLI and never uses ACP. */
+export async function loginCline(options: ClineLoginOptions = {}): Promise<ClineLoginResult> {
+  const env = options.env ?? process.env;
+  const binary = resolveClineBinary(options.which ?? whichFromPath, env);
+  if (!binary) {
+    throw new ClineLoginError(
+      "Cline CLI not found on PATH. Install it with `npm install -g cline` or set CLINE_BIN_PATH.",
+      500,
+      "cli_not_found",
+    );
+  }
+  if (options.instructionsOnly) {
+    return {
+      mode: "instruction",
+      complete: false,
+      exitCode: 0,
+      instructions: VENDOR_LOGIN_INSTRUCTION,
+    };
+  }
+
+  const invocation = commandInvocation(binary, ["auth"], options.platform ?? process.platform, { env });
+  const spawnFn = options.spawn ?? (nodeSpawn as unknown as CliAgentSpawnFn);
+  const cwd = env.HOME?.trim() || env.USERPROFILE?.trim() || homedir();
+  return await new Promise<ClineLoginResult>((resolvePromise, reject) => {
+    let child;
+    try {
+      child = spawnFn(invocation.file, invocation.args, {
+        ...invocation.options,
+        cwd,
+        env,
+        stdio: "inherit",
+        windowsHide: true,
+      });
+    } catch (error) {
+      reject(new ClineLoginError(
+        `Cline authentication could not start: ${error instanceof Error ? error.message : String(error)}`,
+        500,
+        "cli_spawn_failed",
+      ));
+      return;
+    }
+    child.once("error", error => {
+      reject(new ClineLoginError(`Cline authentication could not start: ${error.message}`, 500, "cli_spawn_failed"));
+    });
+    child.once("close", code => {
+      const exitCode = code ?? 1;
+      resolvePromise({ mode: "vendor", complete: exitCode === 0, exitCode });
+    });
+  });
+}

package/src/adapters/cli-agent/cline/stream.ts

@@ -30,7 +30,7 @@ export function createClineStreamState(): CliAgentStreamState {
   };
 }
 
-/** Map a validated Cline ACP tool intent into events owned by Codex. */
+/** Map a validated Cline tool intent into events owned by Codex. */
 export function mapClineToolIntent(
   vendorName: string,
   toolCallId: string | undefined,

package/src/cli/index.ts

@@ -17,7 +17,7 @@ import {
   type ProviderId,
 } from "../config";
 import { startServer } from "../server";
-import { loginClineAcp } from "../adapters/cli-agent/cline/acp";
+import { loginCline } from "../adapters/cli-agent/cline/login";
 import { runCodingAgentMcpServer } from "../adapters/cli-agent/mcp-server";
 import { syncCodexCatalog } from "../lib/codex-catalog";
 import { injectCodexConfig, recordCodexCatalogState, restoreCodexConfig } from "../lib/codex-inject";
@@ -154,21 +154,23 @@ async function loginCommand(args: string[]): Promise<number> {
   const json = takeFlag(args, "--json");
   const noWait = takeFlag(args, "--no-wait");
   if (args.length > 0) throw new ConfigError(`Unknown login option: ${args[0]}`);
-  const result = await loginClineAcp({ noWait });
+  const result = await loginCline({ instructionsOnly: noWait || json, env: process.env });
   if (json) {
     console.log(JSON.stringify({
       ok: true,
       provider: CLINE_PROVIDER_ID,
-      methods: result.methods,
-      selectedMethod: result.method.id,
+      selectedMethod: "vendor-cli",
       complete: result.complete,
       instructions: result.instructions,
     }));
   } else {
     if (result.instructions) process.stderr.write(result.instructions);
-    console.log(result.complete ? "Cline login complete." : "Cline login is waiting for completion.");
+    if (result.mode === "vendor") {
+      if (result.complete) console.log("Cline login complete.");
+      else console.error("Cline authentication did not complete.");
+    }
   }
-  return 0;
+  return result.exitCode;
 }
 
 async function startCommand(args: string[]): Promise<number> {

package/src/lib/codex-catalog.ts

@@ -7,7 +7,7 @@ import { discoverGeminiLiveModels } from "../adapters/cli-agent/gemini/live-mode
 import type { ClineTurnDeps } from "../adapters/cli-agent/cline/adapter";
 import type { GeminiTurnDeps } from "../adapters/cli-agent/gemini/adapter";
 
-// Cline ACP descriptors expose no context source; this fallback is Cline-only.
+// Cline exposes no runtime context source; this fallback is Cline-only.
 const CATALOG_FALLBACK_CONTEXT = 128_000;
 const BASE_INSTRUCTIONS = "You are a helpful coding assistant.";
 const MANAGED_PREFIXES = ["cline-cli/", "gemini-cli/"] as const;
@@ -131,7 +131,7 @@ export function buildCodexCatalogModel(providerId: "cline-cli" | "gemini-cli", m
     : 100;
   return {
     slug: `${providerId}/${encodeRoutedId(model.id)}`,
-    display_name: model.name ?? (isDefault ? `${providerLabel} default` : model.id),
+    display_name: model.name ?? (isDefault ? (providerId === "cline-cli" ? "Cline" : `${providerLabel} default`) : model.id),
     description: model.description ?? `Routed via opencodex -> ${providerLabel}.`,
     default_reasoning_level: levels.length > 0 ? defaultLevel : "low",
     supported_reasoning_levels: levels,
@@ -205,7 +205,7 @@ export async function discoverCodexCatalogModels(options: CodexCatalogDiscoveryO
     }),
   ]);
   const warnings: string[] = [];
-  if (!cline.ok && cline.reason !== "not_found" && env.OPENCODEX_CLINE_ACP?.trim() !== "0") warnings.push(`Cline: ${cline.detail}`);
+  if (!cline.ok && cline.reason !== "not_found") warnings.push(`Cline: ${cline.detail}`);
   if (!gemini.ok && gemini.reason !== "not_found" && env.OPENCODEX_GEMINI_ACP?.trim() !== "0") warnings.push(`Gemini: ${gemini.detail}`);
   if (gemini.ok && gemini.metadataWarning) warnings.push(`Gemini metadata: ${gemini.metadataWarning}`);
   const clineModels = normalizedModels(cline.ok ? cline.models.map(id => ({ id })) : []);

package/src/server/index.ts

@@ -106,9 +106,7 @@ async function discoverModels(
       ? discoverGeminiLiveModels({ env, ...(geminiDeps ? { deps: geminiDeps } : {}), ...(geminiPackageRoot ? { packageRoot: geminiPackageRoot } : {}) })
       : undefined,
   ]);
-  if (cline && !cline.ok && cline.reason !== "not_found" && env.OPENCODEX_CLINE_ACP?.trim() !== "0") {
-    console.warn(`[opencodex] Cline model discovery degraded [${cline.reason}]: ${cline.detail}`);
-  }
+  if (cline && !cline.ok && cline.reason !== "not_found") console.warn(`[opencodex] Cline model discovery degraded: ${cline.detail}`);
   if (gemini && !gemini.ok && gemini.reason !== "not_found" && env.OPENCODEX_GEMINI_ACP?.trim() !== "0") {
     console.warn(`[opencodex] Gemini model discovery degraded [${gemini.reason}]: ${gemini.detail}`);
   }

package/src/server/responses.ts

@@ -374,10 +374,9 @@ function modelIdOf(model: ProviderModelEntry): string {
   return typeof model === "string" ? model : model.id;
 }
 
-const PROVIDER_LABELS: Record<ProviderId, string> = {
-  [CLINE_PROVIDER_ID]: "Cline CLI",
-  [GEMINI_PROVIDER_ID]: "Gemini CLI",
-};
+function defaultModelDisplayName(providerId: ProviderId): string {
+  return providerId === CLINE_PROVIDER_ID ? "Cline" : "Gemini CLI default";
+}
 
 function listedProviderEntries(
   known: ProviderModels,
@@ -400,7 +399,7 @@ export function modelList(
       object: "model",
       created: 0,
       owned_by: CLINE_PROVIDER_ID,
-      display_name: id === "default" ? "Cline default" : id,
+      display_name: id === "default" ? "Cline" : id,
     }));
   }
   if (scope) {
@@ -418,7 +417,7 @@ export function modelList(
         object: "model",
         created: 0,
         owned_by: scope,
-        display_name: info.name ?? (id === "default" ? PROVIDER_LABELS[scope] + " default" : id),
+        display_name: info.name ?? (id === "default" ? defaultModelDisplayName(scope) : id),
         ...(info.description ? { description: info.description } : {}),
         ...(info.contextWindowTokens !== undefined
           ? {
@@ -462,7 +461,7 @@ export function modelList(
         object: "model",
         created: 0,
         owned_by: providerId,
-        display_name: info.name ?? (id === "default" ? `${PROVIDER_LABELS[providerId]} default` : id),
+        display_name: info.name ?? (id === "default" ? defaultModelDisplayName(providerId) : id),
         ...(info.description ? { description: info.description } : {}),
         ...(info.contextWindowTokens !== undefined
           ? {