cline-kit 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,113 @@
+# Changelog
+
+All notable changes to this project are documented here. The format follows
+[Keep a Changelog](https://keepachangelog.com/en/1.1.0/); dictionary data changes are versioned inside
+each `dictionaries/<locale>.json` rather than here.
+
+## [0.1.0] - 2026-09-20
+
+First public release. Windows only.
+
+### Added
+
+- **`sidebar-groups` feature** — keeps every registered Cline workspace visible in the sidebar's
+  project grouping. Cline natively lists only folders that already have sessions, so registered-but-empty
+  projects are simply absent. Empty projects get a native-styled group with an "open this project" action
+  that drives Cline's own workspace picker (chip → search → result row) rather than rewriting its storage.
+- `ckit` CLI: `start`, `stop`, `status`, `doctor`, `attach`, `install`, `uninstall`, `update`, `audit`,
+  `features`, `feature enable|disable`, `dict`, `config`.
+- Overlay engine (`src/engine.js`): whole-string text-node replacement plus `placeholder`, `aria-label`
+  and `title` attribute translation, driven by a `MutationObserver` with a 1.2 s rescan for portals.
+- Five locale dictionaries in `dictionaries/`: **zh-CN** (reference, 476 strings + 6 prefix rules +
+  24 regex rules, proofread against the running app), plus **zh-TW**, **ja**, **ko**, **vi** carrying the
+  same key set. Switch with `ckit config --dictionary=ja`; the change applies to the open window with no
+  reload, and `ckit update` follows whichever locale is selected.
+- Locale authoring pipeline: `scripts/new-locale.js` (skeleton copied from the reference key set),
+  `scripts/apply-locale.js` (fills values from a flat map so nobody hand-edits the JSON),
+  `scripts/build-zh-tw.js` (OpenCC s2tw plus a Taiwan software term table), and
+  `scripts/locale-switch-check.js` (proves each locale reaches the live DOM).
+- `scripts/selftest.js` (`npm test`, 24 dependency-free checks): path/label/container logic, registry
+  parsing and key-version discovery, dictionary schema validation, locale completeness against the
+  reference, payload versioning, and a ship-clean check that fails on a personal profile path, this
+  machine's username, a GitHub token or a stray e-mail inside shipped files.
+- `ckit doctor` — asks the live webview what is actually installed (payload build, per-feature build,
+  rows added vs registered workspaces, dictionary sources, idle DOM write rate) instead of trusting what
+  the launcher intended, so a Cline update that renames a class shows up as a FAIL rather than an empty
+  sidebar.
+- `ckit attach --port=N` — inject once into a Cline that already exposes a debug port, for anyone who
+  keeps their own launcher and does not want this tool to own the shortcut.
+- Feature-plugin mechanism: `src/features/` with per-feature toggles that hot-apply within ~4 s, and
+  shared pure helpers in `src/features/sidebar-groups.logic.js`.
+- Cline path auto-detection: running process → registry uninstall entries → common install directories →
+  `PATH`, with `ckit config --cline-path` as the override.
+- Random loopback debug port per session; never written as a system-wide environment variable.
+- Installer that repoints existing Start Menu / Desktop Cline shortcuts at a hidden launcher, storing the
+  original target so `ckit uninstall` restores it exactly.
+- Optional dictionary updates from a configurable raw GitHub URL, with strict validation and offline
+  fallback; `ckit config --auto-update=off` removes all network access.
+- Local override file (`%APPDATA%\cline-kit\<locale>.local.json`) that wins over bundled and cached data.
+- `ckit audit` — walks the screens over CDP, filters hidden-but-mounted panels by hit-testing each node,
+  and reports only strings the dictionary does not cover.
+- `ckit.cmd` so a release-zip download has an entry point without a global install.
+- CI: `npm test` plus a CLI smoke pass on tag, a portable Windows zip artifact, and npm publish gated on
+  an `NPM_TOKEN` secret.
+
+### Changed
+
+- Positioned as **Cline-kit**, an enhancement kit: the sidebar behaviour is the product and localisation
+  is one optional layer riding the same injection channel. The npm package, the checkout folder and the
+  `%APPDATA%` state directory stay lowercase `cline-kit` because npm ids cannot contain capitals.
+- `sidebar-groups` keeps project grouping on (Cline does not persist it), but yields for the rest of the
+  session as soon as the user touches Cline's own sort control, with a 6 s cooldown so a mode-detection
+  mismatch cannot turn into a click loop.
+- Workspaces are recognised as *projects* or *containers* by structure: a registered path that contains
+  other registered paths, or sits inside the detected install directory, is not a project. No per-machine
+  hardcoded paths; `ckit config --hide=<path>` adds an exception.
+- Registry access follows the highest `cline.code.workspace-selection.vN` key instead of pinning v2
+  (`ckit config --storage-key=` forces one), and drops non-string entries.
+- Project labels are generated across the whole registry: a duplicate folder name reads
+  `LLM (workspace)`, further collisions get a counter, and every row's tooltip is the full path. Rows we
+  cannot be certain are absent from the native list no longer claim "no sessions yet".
+- The workspace-chip lookup matches structurally (anything outside the sidebar container) instead of
+  guessing `left > 280px`, and the picker list matches `max-h-*` instead of `max-h-48`.
+- CLI output, help text and the feature title are English-first; Chinese instructions live in
+  `README.zh-CN.md` and `docs/`.
+- The injector no longer runs with `src/` as its working directory; that locked the checkout so files
+  could not be renamed or replaced while it was alive.
+
+### Fixed
+
+- Changing locale mid-session left the previous language on screen, because the overlay kept no record of
+  what it had replaced. The engine now stores the original text per node and attribute and re-translates
+  from English when the dictionary changes; a string the new locale lacks falls back to English instead
+  of staying translated.
+- An identical value is never written back. That one missing comparison was enough for the observer and
+  the translator to chase each other's mutations and freeze the webview; `ckit doctor`'s idle write-rate
+  check now surfaces that class of bug instead of hanging the app.
+- CDP commands time out. A wedged or navigating renderer used to hang `ckit status` / `doctor` / `audit`
+  indefinitely; they report FAIL now.
+- Two workspaces with the same folder name collapsed into a single row; they are now both listed.
+- Payload re-evaluation used to fail silently on the second injection of the same document
+  (`Identifier 'DICT' has already been declared`), which killed every hot update; the payload is wrapped
+  in its own closure and evaluate errors are logged and reported.
+- The engine's reload guard keyed on the dictionary version only, so editing the engine itself never took
+  effect; it now keys on the engine build hash plus the dictionary version and language.
+- Remote dictionaries are rejected when a rule pattern contains a nested quantifier (`(a+)+`), which
+  would otherwise be compiled inside the webview.
+- Launcher scripts are written with a BOM (`launch-cline-kit.ps1` UTF-8, `.vbs` UTF-16LE); without them
+  Windows read the install path as ANSI and the shortcut silently did nothing on non-ASCII paths.
+- PowerShell path comparisons used `JSON.stringify`, which leaves doubled backslashes that PowerShell
+  keeps literally, so shortcut detection matched nothing; paths are now single-quoted literals.
+
+### Known limitations
+
+- Windows only: the injection route relies on `WEBVIEW2_ADDITIONAL_BROWSER_ARGUMENTS`.
+- Launch through the kit. Opening `cline-app.exe` directly has no debug port, so you get plain Cline.
+- Selectors are Cline's internal class names, not a public API; a Cline redesign needs `sidebar-groups`
+  updated (`ckit doctor` tells you when it stopped matching).
+- zh-TW / ja / ko / vi are complete but machine-assisted and not reviewed by native speakers; zh-CN is the
+  only corpus proofread against the running app.
+- Per-model description strings from the remote provider catalogue stay English.
+- Provider, model, product and tool-identifier names are deliberately never translated.
+- Changing workspace makes Cline rebuild its window (new process, default geometry): that is Cline's own
+  behaviour, not the overlay's.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 chentaoxing
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/NOTICE

@@ -0,0 +1,60 @@
+# NOTICE
+
+Cline-kit
+Copyright (c) 2026 chentaoxing
+
+## Unofficial
+
+This project is **not** affiliated with, endorsed by, or supported by Cline or its contributors.
+"Cline" is a name/brand of its respective owners; it is used here descriptively to identify which
+application this tool patches at runtime.
+
+## What is under MIT
+
+All source code in `src/` and `scripts/`, all documentation, and the `zh-CN` translation content in
+`dictionaries/` are original work of this project's authors and are licensed under the MIT License
+(see `LICENSE`).
+
+## Where the English strings come from
+
+The dictionary keys are **English UI strings of the Cline desktop app**. They were obtained two ways:
+
+1. by walking the rendered UI of the shipping app (v0.0.32) with the overlay's own `audit` command;
+2. by reading the app's own source at `apps/examples/desktop-app` in the public repository
+   [`cline/cline`](https://github.com/cline/cline), which is distributed under the **Apache License
+   2.0**. The English text is quoted as-is because it is the lookup key; the Chinese values are
+   original translations written by this project and are not derived from any upstream translation.
+
+No source code, bundle, or binary from `cline/cline` is copied, distributed, or shipped in this
+repository. The tool never modifies `cline-app.exe`.
+
+## Design credit (ideas, not code)
+
+Two community projects in the same space shaped decisions here. **No code from either is included or
+translated**; both are cited so readers can compare approaches:
+
+* [`ExSchwi/cline-desktop-zh-cn`](https://github.com/ExSchwi/cline-desktop-zh-cn) (Apache-2.0) — the
+  idea of keying localisation data against the app version with a documented fallback strategy. This
+  project instead keys the injected payload on a content hash and treats `audit` as the regression
+  detector; see `docs/dictionary-pipeline.zh-CN.md` for the trade-off.
+* [`JACK5920/cline-desktop-zh`](https://github.com/JACK5920/cline-desktop-zh) (MIT) — confirmation
+  that a silent launcher plus a dictionary plus a DOM overlay is a workable shape, and the idea of
+  separating whole-element replacement from text-node replacement.
+
+## Icons
+
+No Cline logo or icon asset is bundled. The Start Menu shortcut created by `ckit install`
+references the icon **inside the user's own locally installed `cline-app.exe`** by path, so no image
+file is copied into this repository or into a release archive.
+
+## Locale dictionaries - provenance and review status
+
+`dictionaries/zh-CN.json` is the reference corpus: its English keys are strings read out of the running
+app and out of `apps/examples/desktop-app` in the Apache-2.0 `cline/cline` repository; its Chinese values
+are original work of this project.
+
+`zh-TW.json`, `ja.json`, `ko.json` and `vi.json` hold the same 476 keys, translated with machine
+assistance and then terminology-checked inside this project. zh-TW additionally went through a
+character-sense review rather than a simplified-to-traditional swap. None of the four has been reviewed
+by a native speaker of the target language, and each file says so in its own `note` field. They contain
+no code, no assets and no text taken from any third-party translation project.

package/README.md

@@ -0,0 +1,188 @@
+# Cline-kit
+
+Enhancements for the **Cline desktop app** on Windows, delivered as a runtime overlay — no patched
+binaries, no fork.
+
+[中文说明](README.zh-CN.md)
+
+*The product name is **Cline-kit**; the npm package, the on-disk folder and the `%APPDATA%` state
+directory are lowercase `cline-kit` because npm ids cannot contain capitals. The CLI is `ckit`.*
+
+**Flagship feature:** Cline's sidebar project groups only show folders that already have sessions.
+Every project you registered but have not opened yet is simply invisible. `cline-kit` keeps all of
+them listed, with the same styling as the native groups, and lets you switch into an empty project
+straight from the sidebar.
+
+**Secondary feature:** UI locale packs (简体中文 today; 繁體中文 / 日本語 / 한국어 / Tiếng Việt use the
+same format). Locales exist because the same injection channel can carry them — they are not what the
+project is for.
+
+## The sidebar problem
+
+Native Cline groups sessions by project (the `Sort sessions: Time ⇄ Project` toggle), but the group
+list is derived from *existing sessions*. Register 17 project folders, keep sessions in 3 of them, and
+the sidebar shows 3. The `sidebar-groups` feature fixes that:
+
+| | before | after |
+| --- | --- | --- |
+| registered projects shown | 3 | 17 |
+| projects without sessions | hidden | listed and expandable, marked "No sessions yet" |
+| switching into an empty project | not possible from the sidebar | one click, driven through Cline's own workspace picker |
+
+Nothing is written into Cline's storage: switching a project drives the app's own picker (chip →
+search → result row), so the behaviour is identical to doing it by hand.
+
+## How it works
+
+```
+ckit start
+  ├── launches cline-app.exe with WEBVIEW2_ADDITIONAL_BROWSER_ARGUMENTS=--remote-debugging-port=<random>
+  ├── connects to the DevTools endpoint on 127.0.0.1
+  └── a keep-alive injector installs engine.js + enabled features (+ locale data when a dictionary is loaded)
+        └── MutationObserver keeps the project groups present and, with a locale active,
+            replaces English text nodes and placeholder/aria-label/title attributes
+```
+
+`cline-app.exe` is never modified: signature, install directory and auto-update all stay as shipped.
+Feature code and locale data are independent — run cline-kit for the sidebar only, for locales only,
+or both.
+
+## Requirements
+
+* Windows 10/11 (macOS/Linux not supported yet — see [Limitations](#limitations))
+* [Node.js](https://nodejs.org) 20.10 or newer (global `WebSocket` and `fetch`)
+* The Cline desktop app installed (verified against v0.0.32)
+
+## Install
+
+Three routes, same tool. All of them need Node.js on `PATH`; none of them touch `cline-app.exe`.
+
+**1. npm (recommended, once the package is published)**
+
+```bash
+npm install -g cline-kit
+ckit install                # point your existing Cline shortcut at the kit launcher
+ckit start                  # launch Cline with the enhancements now
+```
+
+**2. Release zip (no global install)**
+
+Download `cline-kit-vX.Y.Z-win.zip` from [Releases](https://github.com/chentaoxing/Cline-kit/releases), unzip anywhere, and run the bundled
+shim once from that folder:
+
+```cmd
+ckit.cmd install
+ckit.cmd start
+```
+
+**3. From source (contributing)**
+
+```bash
+git clone https://github.com/chentaoxing/Cline-kit.git
+cd cline-kit
+npm install -g .            # or call it directly: node src/cli.js <command>
+npm test                    # 22 checks, no dependencies
+```
+
+Then in every case:
+
+```bash
+ckit doctor                 # confirms the overlay is live inside the running window
+```
+
+`ckit install` locates the Cline shortcut in the Start Menu / Desktop, saves its original target in
+`%APPDATA%\cline-kit\config.json`, and repoints it at a hidden launcher. Opening Cline the normal way
+then gives you the enhanced sidebar. If you would rather keep your own launcher, skip `install` and run
+`ckit start` (or `ckit attach --port=N` against a Cline you started with a debug port).
+
+## Usage
+
+| Command | What it does |
+| --- | --- |
+| `ckit start` | Launch Cline with the overlay attached (`--restart` closes the running instance first) |
+| `ckit stop` | Stop the background injector; Cline itself is untouched |
+| `ckit status` | Detected Cline path, debug port, injector process, loaded build version |
+| `ckit doctor` | Ask the live window what is really installed: payload build, rows added, native groups |
+| `ckit attach` | Inject once into a Cline you started yourself (`--port=N`), without owning the shortcut |
+| `ckit features` | List feature plugins and whether each is on |
+| `ckit feature enable\|disable <id>` | Toggle a feature (applies within ~4 s, no restart) |
+| `ckit install` / `uninstall` | Repoint / restore your Cline shortcut |
+| `ckit update` | Pull the latest locale dictionary from GitHub (`--force` to check now) |
+| `ckit audit` | Walk the UI and list strings still in English |
+| `ckit dict` | Dictionary statistics and the local override path |
+| `ckit config` | Inspect or set `--cline-path`, `--port`, `--auto-update=on\|off` |
+
+## Features
+
+`ckit features` shows the live list.
+
+* **`sidebar-groups`** (on by default) — the always-listed project groups described above. It decides
+  what counts as a project on its own: a registered path that contains other registered paths, or sits
+  inside the app's install directory, is treated as a container and not listed. No per-machine
+  configuration is needed. If you click Cline's own sort control, your choice wins for the rest of the
+  session; otherwise the kit keeps project grouping on. Two projects that share a folder name are
+  labelled with their parent folder - `LLM (workspace)` - and every row carries the full path as its
+  tooltip. Design notes: [`docs/features.zh-CN.md`](docs/features.zh-CN.md).
+* **locale packs** (`dictionaries/<locale>.json`) — whole-string text replacement only, so model
+  names, provider names, tool identifiers and code cannot be mangled. The corpus is 476 strings plus
+  30 pattern rules, built by combining a UI walk with extraction from the app's own source. Five
+  dictionaries ship: **zh-CN** (reference, proofread against the running app), **zh-TW**, **ja**,
+  **ko**, **vi** - complete but machine-assisted and *not* reviewed by native speakers, so a pull
+  request fixing a term is genuinely welcome. Switch with `ckit config --dictionary=ja`; the change
+  applies to the open window without a reload, and `ckit update` follows the locale you picked.
+  Authoring guide: [`docs/dictionary-pipeline.zh-CN.md`](docs/dictionary-pipeline.zh-CN.md).
+
+## Limitations
+
+* **Windows only.** The injection route relies on a WebView2 environment variable; macOS/Linux use
+  WKWebView/WebKitGTK and need a different mechanism.
+* **No standalone executable on purpose.** Packaging Node inside a `.exe` would remove the Node
+  requirement, but unsigned binaries attract SmartScreen and antivirus warnings, and the injector has
+  to keep talking to a local DevTools port anyway. npm or the zip are the supported routes.
+* **Launch through the kit.** Opening `cline-app.exe` directly (or via a shortcut that was never
+  repointed) has no debug port to attach to, so you get plain Cline.
+* **Cline updates can break things.** If the app renames a label, the locale leaves it in English; if
+  it restructures the sidebar, `sidebar-groups` needs updating. Run `ckit audit` and open an issue.
+* **Per-model description blurbs stay English** — free-form text from a remote provider catalogue.
+* **Same-named projects.** Cline's own group headers expose only the folder name, never the path, so if
+  the registry holds two different `LLM` folders and one already has a native group, the kit cannot tell
+  which one that is. It lists both, qualified with the parent folder, and drops the "no sessions yet"
+  line on those rows rather than asserting something it does not know.
+* Proper nouns are never translated: Cline, provider and model names, tool identifiers, paths.
+
+## Security
+
+`ckit start` opens a DevTools port on `127.0.0.1` for as long as Cline runs; any process running as
+you can drive the Cline UI through it. The port is random per session, loopback-only, and never set as
+a system-wide environment variable. Remote dictionaries are validated (shape, size, anchored regexes)
+and rejected outright if malformed. Details in [SECURITY.md](SECURITY.md).
+
+## Uninstall
+
+```bash
+ckit uninstall                    # restores the original Cline shortcut and stops the injector
+del /q "%APPDATA%\cline-kit"      # optional: remove config, cache, logs
+npm uninstall -g cline-kit
+```
+
+## Relationship to other projects
+
+[`JACK5920/cline-desktop-zh`](https://github.com/JACK5920/cline-desktop-zh) and
+[`ExSchwi/cline-desktop-zh-cn`](https://github.com/ExSchwi/cline-desktop-zh-cn) cover the **language**
+half of this well and are worth using if all you want is a Chinese UI;
+[`cline-chinese`](https://github.com/HybridTalentComputing/cline-chinese) is a fork of the **VS Code
+extension**, a different surface again. cline-kit overlaps them only on locales — its reason to exist
+is the sidebar/project behaviour, plus the packaging (reversible installer, path auto-detection,
+random port, feature toggles, `ckit audit`). Design credit is recorded in [NOTICE](NOTICE).
+
+The better long-term outcome is upstream: an official language setting, and a sidebar that lists all
+registered projects. See [`docs/upstream-i18n.md`](docs/upstream-i18n.md) for the threads we have
+engaged on ([#12518](https://github.com/cline/cline/issues/12518),
+[#13811](https://github.com/cline/cline/pull/13811)).
+
+## License
+
+MIT — see [LICENSE](LICENSE). [NOTICE](NOTICE) records provenance: unofficial project, no upstream code
+or assets shipped, English locale keys are Cline's own UI strings read from `apps/examples/desktop-app`
+in the Apache-2.0 [`cline/cline`](https://github.com/cline/cline) repository, translated values are
+original. Not affiliated with, endorsed by, or part of Cline.

package/README.zh-CN.md

@@ -0,0 +1,168 @@
+# Cline-kit（中文说明）
+
+给 **Cline 桌面版**（Windows）加功能的运行时覆盖层——不改二进制，不 fork。
+
+[English README](README.md)
+
+*产品名写作 **Cline-kit**；npm 包名、代码目录和 `%APPDATA%` 状态目录都是小写 `cline-kit`（npm 包名不允许大写）。命令行是 `ckit`。*
+
+**主打功能：** Cline 侧边栏的「项目分组」只显示**已经有会话**的文件夹。你登记过但还没打开过的项目，
+在界面上根本不存在。cline-kit 把所有已登记项目常驻列出，样式与原生分组一致，并且可以直接从侧边栏
+切进一个还没有会话的项目。
+
+**附属功能：** 界面语言包（目前简体中文；繁體中文 / 日本語 / 한국어 / Tiếng Việt 用同一套格式）。
+语言包之所以在这里，是因为同一条注入通道顺带能承载它——它不是这个项目存在的理由。
+
+## 要解决的问题
+
+Cline 原生其实有一半：侧边栏那个 `会话排序：时间 ⇄ 项目` 开关就是按项目分组。但分组列表是从
+*已有会话*推导出来的——登记 17 个项目文件夹、只在其中 3 个里建过会话，侧边栏就只有 3 个。
+`sidebar-groups` 补的就是这一段：
+
+| | 之前 | 之后 |
+| --- | --- | --- |
+| 显示的已登记项目 | 3 | 17 |
+| 没有会话的项目 | 完全不出现 | 列出、可展开，标注「暂无会话」 |
+| 切进空项目 | 侧边栏做不到 | 一键，走 Cline 自己的工作区选择器 |
+
+不写 Cline 的任何存储：切换项目是驱动它自己的选择器（chip → 搜索框填路径 → 点结果行），
+行为与你手动操作完全一致。
+
+## 工作原理
+
+```
+ckit start
+  ├── 以 WEBVIEW2_ADDITIONAL_BROWSER_ARGUMENTS=--remote-debugging-port=<随机端口> 启动 cline-app.exe
+  ├── 连接 127.0.0.1 上的 DevTools 接口
+  └── 常驻注入器装载 engine.js + 已启用插件（加载词典时一并装载语言数据）
+        └── MutationObserver 维持项目分组常驻；启用语言包时替换英文文本节点
+            与 placeholder / aria-label / title 属性
+```
+
+`cline-app.exe` 一个字节都没改：签名、安装目录、自动更新全部照旧。插件代码与语言数据彼此独立——
+可以只用项目栏、只用语言包，或两个都开。
+
+## 环境要求
+
+* Windows 10/11（macOS / Linux 暂不支持，见[已知限制](#已知限制)）
+* [Node.js](https://nodejs.org) 20.10 及以上（需要全局 `WebSocket` 与 `fetch`）
+* 已安装 Cline 桌面版（在 v0.0.32 上验证）
+
+## 安装
+
+三条路都是同一个工具，都要求 `PATH` 里有 Node.js，都不碰 `cline-app.exe`。
+
+**1. npm（推荐，发布后适用）**
+
+```bash
+npm install -g cline-kit
+```
+
+**2. Release 压缩包（不装到全局）**
+
+从 Releases 下载 `cline-kit-vX.Y.Z-win.zip`，解压到任意目录，在该目录里跑一次自带的启动脚本：
+
+```cmd
+ckit.cmd install
+ckit.cmd start
+```
+
+**3. 源码（要改代码时）**
+
+```bash
+git clone https://github.com/chentaoxing/Cline-kit.git
+cd cline-kit
+npm install -g .        # 或直接用：node src/cli.js <命令>
+npm test                # 22 项无依赖自检
+```
+
+装完统一确认一次：
+
+```bash
+ckit doctor             # 直接问运行中的窗口：增强层到底进没进去
+```
+
+`ckit install` 会在开始菜单 / 桌面找到 Cline 快捷方式，把原始目标备份进 `%APPDATA%\cline-kit\config.json`，
+再改为指向一个无黑框启动器。之后正常点开 Cline 就带增强功能。想继续用自己的启动方式，就跳过 `install`，
+用 `ckit start`，或者对一个已经开着调试端口的 Cline 用 `ckit attach --port=N`。
+
+## 命令
+
+| 命令 | 作用 |
+| --- | --- |
+| `ckit start` | 以增强层启动 Cline（`--restart` 先退出正在运行的实例） |
+| `ckit stop` | 结束后台注入器，不影响 Cline 本身 |
+| `ckit status` | 探测到的 Cline 路径、调试端口、注入器进程、已装载构建版本 |
+| `ckit doctor` | 直接问正在运行的窗口装了些什么：构建版本、补了几行、原生分组数 |
+| `ckit attach` | 往你自己启动、已开调试端口的 Cline 注入一次（`--port=N`），不接管快捷方式 |
+| `ckit features` | 列出功能插件与开关状态 |
+| `ckit feature enable\|disable <id>` | 开关某个插件（约 4 秒生效，无需重启） |
+| `ckit install` / `uninstall` | 改写 / 还原 Cline 快捷方式 |
+| `ckit update` | 从 GitHub 拉取最新语言词典（`--force` 立即检查） |
+| `ckit audit` | 走查界面，列出仍是英文的字符串 |
+| `ckit dict` | 词典统计与本地覆盖文件路径 |
+| `ckit config` | 查看或设置 `--cline-path`、`--port`、`--auto-update=on\|off`、`--dictionary=<语言>`、`--hide=<路径>` |
+
+## 功能
+
+`ckit features` 看实时列表。
+
+* **`sidebar-groups`**（默认开启）——上面说的常驻项目分组。它自己判断什么算项目：某个登记路径如果
+  包含着其他登记路径，或者位于应用安装目录内，就当作容器不显示，因此**不需要按机器配置**。
+  如果你亲手点了 Cline 的排序按钮，本会话内就以你的选择为准不再干预；否则增强层会持续保持分组模式。
+  两个同名项目（比如两块盘上都有 `LLM`）会带上上级目录名显示成 `LLM (workspace)`，仍然重名就加序号，
+  而鼠标悬停始终是完整路径。设计说明见 [`docs/features.zh-CN.md`](docs/features.zh-CN.md)。
+* **语言包**（`dictionaries/<locale>.json`）——只做**整串精确匹配**替换，因此不会误伤模型名、服务商名、
+  工具标识和代码。语料为 476 条词条 + 30 条规则，来源是「界面走查 + 从应用自身源码提取」两路合并。
+  现在随包附带 5 份词典：**zh-CN**（基准，逐条对着运行中的界面校对过）、**zh-TW**、**ja**、**ko**、
+  **vi** —— 后四份条目齐全但属于机器辅助翻译、未经母语者审校，术语有偏差欢迎提 PR 直接改。
+  切换：`ckit config --dictionary=ja`，正在打开的窗口**不需要重启或刷新**就会跟着变；
+  `ckit update` 也只更新你选的那一份。制作流程见
+  [`docs/dictionary-pipeline.zh-CN.md`](docs/dictionary-pipeline.zh-CN.md)。
+
+## 已知限制
+
+* **仅 Windows。** 注入依赖 WebView2 的环境变量；macOS/Linux 用 WKWebView / WebKitGTK，需要另一套机制。
+* **故意不出独立 exe。** 把 Node 打进可执行文件确实能省掉运行环境，但未签名的单文件程序会被
+  SmartScreen 和杀软拦，而注入器本来也要一直开着本地调试端口。npm 或 Release 压缩包就是官方路径。
+* **必须经由增强层启动。** 直接双击 `cline-app.exe`（或用没被改写的快捷方式）没有可注入的调试端口，
+  得到的是原版界面。
+* **Cline 升级可能失效。** 文案改了，语言包会留英文；侧边栏结构改了，`sidebar-groups` 需要跟进。
+  跑一次 `ckit audit` 并开 issue。
+* **模型下方的一句英文简介不覆盖**——来自云端目录的自由文本，条数随服务商变化。
+* **同名项目。** Cline 自己的分组标题只有文件夹名、没有路径，所以登记表里出现两个不同盘符下的 `LLM`
+  且其中一个已有原生分组时，无法判断哪一个才是它。此时两行都列出（带上级目录区分），并且不在这种行里
+  写「暂无会话」——不确定的事就不声明。
+* 专有名词一律不翻：Cline、服务商与模型名、工具标识、路径。
+
+## 安全说明
+
+`ckit start` 会在 Cline 运行期间于 `127.0.0.1` 开一个 DevTools 端口，本机以你身份运行的任意进程都能
+通过它操作 Cline 界面。端口每次启动随机、只绑定回环地址、不写成系统级环境变量。远端词典会做校验
+（结构、规模、正则必须锚定），不合规直接拒绝。详见 [SECURITY.md](SECURITY.md)。
+
+## 卸载
+
+```bash
+ckit uninstall                 # 还原原始快捷方式并结束注入器
+del /q "%APPDATA%\cline-kit"   # 可选：删除配置、缓存与日志
+npm uninstall -g cline-kit
+```
+
+## 与同类项目的关系
+
+[`JACK5920/cline-desktop-zh`](https://github.com/JACK5920/cline-desktop-zh) 和
+[`ExSchwi/cline-desktop-zh-cn`](https://github.com/ExSchwi/cline-desktop-zh-cn) 把**语言**这一半做得不错，
+只想要中文界面的话用它们就够了；[`cline-chinese`](https://github.com/HybridTalentComputing/cline-chinese)
+是 **VS Code 插件**的分叉，属于另一个界面。本项目与它们的交集只在语言包上——存在理由是侧边栏/项目行为，
+加上工程化部分（可逆安装、路径自动探测、随机端口、插件开关、`ckit audit`）。思路致谢记录在 [NOTICE](NOTICE)。
+
+更好的长期结果是官方支持：一个语言设置，以及一个列出全部已登记项目的侧边栏。我们已在
+[#12518](https://github.com/cline/cline/issues/12518) 与 [#13811](https://github.com/cline/cline/pull/13811)
+发言，脉络见 [`docs/upstream-i18n.md`](docs/upstream-i18n.md)。
+
+## 许可
+
+MIT，见 [LICENSE](LICENSE)。[NOTICE](NOTICE) 记录来源边界：非官方项目、不打包任何上游代码或图标资源、
+语言包的英文键取自 Apache-2.0 的 [`cline/cline`](https://github.com/cline/cline) 仓库中
+`apps/examples/desktop-app`（即应用自身界面文案），译文为原创。与 Cline 无隶属关系，也未获其背书。

package/SECURITY.md

@@ -0,0 +1,53 @@
+# Security Policy
+
+## What this tool does to your machine
+
+`ckit start` launches `cline-app.exe` with one extra environment variable, set **only for that
+process tree**:
+
+```
+WEBVIEW2_ADDITIONAL_BROWSER_ARGUMENTS=--remote-debugging-port=<random port>
+```
+
+That gives the Cline window a Chrome DevTools Protocol endpoint. Consequences worth stating plainly:
+
+1. **A local DevTools port is a local control channel.** While Cline is running, any process running as
+   your user can attach to `127.0.0.1:<port>` and read or drive the Cline UI — including anything the
+   window can see. This is not a vulnerability introduced by this tool (any `--remote-debugging-port`
+   user has the same exposure), but it *is* a wider local attack surface than Cline normally has.
+2. **The port is random per session** and bound to loopback only. It is not exposed to the network.
+3. **The port number and Cline path are stored** in `%APPDATA%\cline-kit\config.json` in plain text.
+4. **Injected code is local by default.** The overlay is `src/engine.js` plus a JSON dictionary read from
+   disk. Nothing is fetched or executed unless you enable dictionary updates.
+5. **Remote dictionaries are validated, not trusted.** `src/dict.js` rejects a file that is not an
+   object with the expected shape, has more than 20 000 entries, has any key/value longer than 400
+   characters, or contains a rule whose regex is longer than 200 characters, is not anchored with
+   `^…$`, or fails to compile. A rejected update is dropped and the local dictionary keeps working.
+   Note the residual risk: rule patterns do reach `new RegExp()` in the page, so a malicious dictionary
+   could at worst cause CPU waste via a pathological regex — it cannot execute code.
+6. **The installer edits your shortcuts.** `ckit install` rewrites the target of any Start Menu or
+   Desktop `.lnk` that points at your `cline-app.exe`, after saving the original target and arguments in
+   the config file so `ckit uninstall` can restore them.
+
+## Turning network updates off
+
+```bash
+ckit config --auto-update=off
+```
+
+With this set the tool never contacts GitHub; the dictionary only changes when you update the tool
+itself.
+
+## Not doing
+
+* No modification, patching, repacking or re-signing of `cline-app.exe`.
+* No system-wide environment variables.
+* No kernel/service components, no startup driver, no admin rights required.
+* No telemetry — the tool makes exactly one optional outbound HTTPS request, to the raw.githubusercontent.com
+  URL in your config.
+
+## Reporting a problem
+
+Open an issue. If your concern involves the DevTools port specifically, say so — the mitigation is to run
+`ckit stop` and use Cline in English, or to keep the tool installed but only launch Cline through it
+when you need Chinese.

package/ckit.cmd

@@ -0,0 +1,12 @@
+@echo off
+rem cline-kit launcher for people who downloaded the release zip instead of installing from npm.
+rem Runs the CLI straight out of this folder, so nothing is written to the global npm tree.
+setlocal
+set "HERE=%~dp0"
+where node >nul 2>nul
+if errorlevel 1 (
+  echo cline-kit needs Node.js 20.10 or newer on PATH.  https://nodejs.org
+  exit /b 1
+)
+node "%HERE%src\cli.js" %*
+exit /b %ERRORLEVEL%