The AI Toolchain — issue 001, August 19, 2026

Adds codex exec fork to fork a previous session by UUID or thread name into a new session, with an optional --image/-i attachment flag and optional prompt argument; adds archive and restore actions to the TUI resume picker; names new sessions with /new or /clear, and allows naming forked chats; adds isPinned on thread responses with thread/metadata/update to pin/unpin threads and an isPinned filter on thread/list with cursor-based pagination; supports excludeTurns: true in thread/fork to create ephemeral forks not exposed via thread/list.

$ codex exec fork

$ codex exec fork session-123 'continue refactoring the auth module'

features.guardianv2 now accepts either a boolean toggle or a structured object specifying classifier instructions, review threshold, reasoning effort, action/instruction token limits, transcript source controls, per-entry and total token budgets, and the number of recent non-user entries; adds per-thread risk samplers recording risk-score snapshots and requiring automatic review for high-risk actions; isolates Guardian reviewer sessions from parent extensions; enforces strict auto-review for MCP tool calls even when approval policy, tool annotations, or a remembered decision would otherwise skip review; gives Guardian full tool action context (transcript plus a structured planned-action object with tool name and arguments) and includes node_repl images and policy approval reasons in review evidence; adds a circuit-breaker that interrupts turns after the first Guardian denial for models whose catalog specialty is cyber; switches API-key session reviews to the gpt-5.6-luna model (retaining codex-auto-review for ChatGPT auth) routed through Responses Lite with fallback to the bundled Guardian policy.

Expands codex doctor with desktop app diagnostics, desktop update diagnostics, and desktop security enforcement diagnostics (app-server handshake status, macOS Gatekeeper/XProtect and Windows enforcement, update state); adds dedicated network diagnostics via a new network module covering proxy environment details, macOS system proxy detection, and rejection of proxy auth challenges (HTTP 407); adds sandbox checks via new sandbox_check; adds storage diagnostics reporting free space for CODEX_HOME and the worktree with a 5 GiB warning and 1 GiB failure threshold, plus Windows Dev Drive health checks.

Adds migrate-rollouts with --apply, --thread <THREAD_ID>, --max-mib-per-second <MIB>, --json, and --verbose flags to inspect or migrate legacy local sessions to paginated thread history.

$ codex migrate-rollouts

$ codex migrate-rollouts --verbose --json

$ codex migrate-rollouts --apply --thread <THREAD_ID> --max-mib-per-second 50

Adds --code-mode-host accepting a wss:// WebSocket URL (invalid schemes like http:// or bare ws:// are rejected at parse time) to connect the app server to a remote code-mode host over WebSocket; adds a dual-WebSocket transport routing frames via transport_lane(); supports gRPC code-mode hosts with automatic reconnection after restarts and removes the gRPC code-mode open session limit so more than MAX_IN_FLIGHT_REQUESTS concurrent sessions are allowed; disables Nagle's algorithm for code-mode WebSockets; adds a features.code_mode_host config table with a disable_in_process_fallback key (still accepts a plain boolean), a code_mode_tool_names field in Responses Lite turn metadata, and timeout handling for stalled host requests.

$ codex-app-server --code-mode-host wss://example.com/code-mode --listen stdio://

Adds ExecServerSubcommand accessible as codex exec-server <subcommand>, a --remote <URL> flag (marked global) for registering the exec-server as a remote environment, and a global --strict-config; propagates W3C traceparent/tracestate trace context through exec-server relay frames, including fragmented encrypted Noise-protocol requests; adds --concurrent-requests (default 1) for opt-in concurrent request dispatch; reports temporary directories in exec-server environment info, routes exec-server HTTP/WebSocket traffic through the configured proxy policy, and adds executor-local config layer loading.

$ codex exec-server --concurrent-requests 4 --listen ws://127.0.0.1:8080

Adds the built-in amazon-bedrock-runtime provider for regional OpenAI-compatible Bedrock endpoints with SigV4 auth, per-provider AWS profile/region/transport overrides, global and US cross-region model variants, and GPT-5.6 routing; adds experimental Amazon Bedrock login with managed authentication, custom endpoint configuration, and GPT-5.6 Sol as the default Bedrock model; enables cached web search (advertising hosted text web search while marking external live/indexed access unsupported, falling back to cached search or disabling the tool when managed requirements prohibit it) and remote conversation compaction; normalizes Bedrock model catalogs to text-only web search payloads by removing the search_content_types field; supports custom transports for non-default network/proxy configurations.

Adds oauth.callback_port to MCP server configuration so each server can override the global mcp_oauth_callback_port for CLI login, app-server, plugin installation, executor, and skill dependency OAuth flows; routes MCP OAuth discovery and auth status through each server's runtime HTTP client, capping local discovery at 5 seconds while preserving explicit login timeouts; isolates MCP OAuth credentials by environment and restricts hosted MCP credentials to local environments; distinguishes unknown MCP authentication status as a separate state; scopes MCP resource reads by connector to prevent cross-connector data access; restricts MCP HTTP redirects to the configured origin and isolates MCP resource headers during OAuth requests.

oauth:
  callback_port: 9876

Introduces installable portable Agent Plugins with search across local, personal, workspace, and remote plugin catalogs; supports the Agent Plugins 1.0 schema, recognizing root plugin.json files and mapping metadata, skills/, and mcp.json into Codex plugin manifests, with .codex-plugin/plugin.json as a fallback overlay; adds workspace plugin publishing and marketplaces for Amazon Bedrock and Claude Code, canPublishToWorkspace metadata on plugin share contexts and plugin/share/save responses, and publishing through share updates; caches remote plugin catalogs by scope, infers the bundled Claude Code marketplace automatically, and uses the API marketplace for Amazon Bedrock; fetches remote installed plugins across all scopes; skips symbolic links when copying/installing a plugin into the store so symlinked skill files or executables no longer fail installation.

Adds a configurable skill catalog token budget; simplifies skills.read so package is the only required argument, resolving the owning catalog automatically and defaulting omitted resource to the package's main SKILL.md; lets executor skill packages be passed directly to skills.read without a preceding skills.list lookup, including skill root aliases; honors per-directory bundled skill settings in skills/list requests; moves the host skills service into the skills extension with host skill root loading; generalizes skill locator aliases across providers and aliases resource-backed skill locators under context pressure; exposes executor skills through skill tools with resource reads for explicitly selected skills.

Adds a fail-closed Tree-sitter-based PowerShell lowerer that converts a conservative subset of literal PowerShell commands into argument vectors, rejecting dynamic expressions, #requires directives, and unrecognized syntax; enforces environment-specific command policies and per-environment shell variable policies; adds a per-environment allow_login_shell policy exposing the login argument for shell tools when any selected environment permits login shells; requires approval for commands with dynamic shell words and requires fresh approval beneath denied permission paths; restricts shell_command to a single local environment; enforces non-interactive approval policy for Codex delegate sessions.

Adds CodexOptions.configOverrides to the TypeScript SDK for passing ordered --config key=value arguments to Codex CLI unchanged, enabling TOML permission maps with literal path keys that the structured config API cannot represent.

const codex = new Codex({
  configOverrides: [
    '--config', 'sandbox.writable_roots."/var/myapp/data"=true'
  ]
});

Adds provider-owned authentication recovery so providers can handle their own auth refresh flow independently; integrates workload identity with Codex authentication; adds local requirements.toml allowlists for login methods and ChatGPT workspaces enforced before stored or environment-provided credentials are used, including during bootstrap before cloud requirements are fetched; supports CODEX_AGENT_IDENTITY_AUTHAPI_BASE_URL and CODEX_AGENT_IDENTITY_JWKS_BASE_URL to override agent identity registration and verification endpoints.

$ CODEX_AGENT_IDENTITY_AUTHAPI_BASE_URL=https://staging-auth.example.com CODEX_AGENT_IDENTITY_JWKS_BASE_URL=https://staging-jwks.example.com codex

Adds thread-credits and estimated-thread-cost as configurable terminal title items and shows estimated thread usage/cost in the /status command and TUI status surfaces for eligible workspaces, alongside new per-thread usage queries to the backend client.

$ /status

thread-credits, estimated-thread-cost

Adds CODEX_INSTALLER_USE_RELEASES_OPENAI_COM to control whether the installer pulls from https://releases.openai.com/codex or falls back to GitHub Releases; standalone installers now prefer releases.openai.com by default, with the variable set to false forcing GitHub Releases.

$ curl -fsSL https://chatgpt.com/codex/install.sh | CODEX_INSTALLER_USE_RELEASES_OPENAI_COM=false sh

$ curl -fsSL https://chatgpt.com/codex/install.sh | CODEX_INSTALLER_USE_RELEASES_OPENAI_COM=false sh

$ curl -fsSL https://chatgpt.com/codex/install.sh | CODEX_INSTALLER_USE_RELEASES_OPENAI_COM=false sh

Adds symlink-safe reading of sensitive files via read_sensitive_file_to_string, refusing to follow the final symlink component on Unix or reparse points on Windows; rejects symlinks used as memory workspace roots and removes links created during consolidation; isolates external editor buffers from sandbox-writable paths; drops capabilities from Linux sandbox processes and hardens Windows sandbox provisioning against reparse points; mounts a minimal /dev in full-filesystem Bubblewrap sandboxes; makes Windows PathUri equality/hashing ASCII-case-insensitive for drive and UNC paths while preserving case-sensitive POSIX behavior; validates images before returning view_image output; redacts secrets from app-server command execution items and improves bearer token redaction.

Adds an /export TUI command that exports the full conversation history to Markdown, either to the clipboard or a new file, with a default filename prompt and support for an explicit destination path argument.

$ /export

$ /export ~/projects/my-session.md

Expands /import to migrate Cursor and Claude Code settings, MCP servers, plugins, sessions, commands, and project-scoped memories, and to import Cursor-managed skills while syncing imported Claude/Cursor conversations without duplicates; bounds Cursor project path resolution to 128 path candidates, rejecting ambiguous matches and unsafe encoded components; preserves timestamps when importing external agent sessions and detects connectors used in external agent sessions; adds maxSessionAgeDays and maxSessions fields to the external-agent config detection request (defaults 30 days, 50 sessions) plus an optional providerId field on externalAgentConfig/import for analytics attribution.

Adds --approve-for-me to codex to enable automatically reviewed approvals without manual confirmation prompts.

$ codex --approve-for-me 'refactor the auth module to use async/await'

Routes blocked network requests through the shared approval pipeline so permission hooks, automatic review, and user review all use the common flow, including for background terminals started by an earlier turn; persists deny amendments so denied requests stay denied across turns, and records the final applied network decision in telemetry without exposing the destination; scopes pending approvals to a turn and execution, coalesces duplicate requests within one execution, and cancels in-flight Guardian reviews when their owner is dropped; denies network access outright when an allow amendment fails; adds network policy metadata to environment configuration.

Adds experimental paginated thread history with efficient resume, search, persisted names, sub-agent support, and memories; adds includeTurns reads for incremental transcript access and durable reverts for paginated threads; uses paginated history for persistent exec threads to keep memory bounded across long sessions; supports paginated thread forks and paginated transcript loading in the TUI for large histories; speeds up exec resume --last by querying the state database first, falling back to a full rollout scan only on a complete miss, and prefers SQLite-backed names when resolving local archive, delete, and unarchive targets.

Instructs the model to use tool_search to discover relevant tools when an explicitly selected plugin has apps available, before falling back to built-in tools; reuses pending MCP server connections during reconciliation when identity, catalog limit, and protocol mode match; caches tool catalogs for streamable HTTP MCP servers and speeds up MCP OAuth credential reads; exposes plugin ownership in MCP server status; supports deferred loading for freeform and custom tools in tool search and custom tools in namespaces; adds tool registry collision policy configuration (#36954) enforcing strict tool name collision errors under a canonical functions namespace; includes tool namespace inventory in turn metadata and adds dynamic HTTP header helpers for MCP servers.

Adds codex agents as a dedicated interactive task dashboard command for monitoring and navigating agents in the TUI, with configurable keyboard shortcuts.

$ codex agents

Removes the codex exec --full-auto flag; use --sandbox workspace-write as the supported equivalent.

$ codex exec --sandbox workspace-write 'add unit tests for the payments service'

Adds RecoverTurnRequest and CodexThread::recover_turn_if_idle to resume an interrupted regular turn using its existing turn ID and updated thread settings, including Plan-mode recovery without injecting an empty user message.

Adds a nullable multiAgentVersion field to v2 model/list responses with supported values disabled, v1, or v2; adds leaf model support in multi-agent v2 and tracks context windows per agent; adds configurable developer instructions for v2 subagents; allows disabling the multi-agent wait tool and suppresses empty multi-agent mode messages in the TUI; identifies agents by name in token budget context with configurable identity; deduplicates current-time reminders when spawning full-history subagents, replacing inherited parent reminders with a single fresh reminder.

New sandbox masking options let commands read a sentinel value while a proxy substitutes the real secret on egress: extract and onExtractNoMatch for structured env values, decode: "jwt" with maskClaims for JWT-aware masking, awsPairs and sigv4 for AWS SigV4 re-signing (require network.tlsTerminate, honored only from user/managed/--settings settings), plus a new mode: "mask" for credential files on Linux and WSL serving a sentinel copy of the whole file or extract-captured spans, falling back to deny on macOS.

mode: "mask"

Claude Code sessions can now message each other across machines: the new SendMessage API and ListAgents discovery (macOS and Linux) were introduced, then extended with @-mention in the prompt to deliver directly to a named session, /config rows for 'Dialog expiry' and 'Messages from your other sessions' controlling accept/hold/refuse, and crossSessionInbound/dialogExpiry settings that hold messages to bypassed-permission sessions for approval. SendMessage now rejects oversized messages upfront, locks a confirmed Remote Control recipient by identity, can initiate conversations with remote sessions by name, and is routed through the auto-mode permission classifier before dispatch; ListAgents reports when a session list was too long to check and labels sessions offline/cloud. Messages now render sender and body inline instead of a collapsed line.

Remote Control gained auto-resume that continues a session automatically when a claude.ai usage limit resets (toggle in /config under 'Continue automatically at usage limit'), permission-mode and model sync to phones/Desktop/VS Code, and effort-level sync across connected clients. claude rc now applies the same enterprise-gateway availability check as interactive startup, claude remote-control --continue resumes the most recent session without an ID, reconnection persists for up to ~30 minutes across repeated blips, photos from the Claude app pass directly to Claude instead of a separate disk read, and attached web/mobile clients now see compaction progress, the post-compaction boundary, /clear resets, and a persistent connection-failure indicator with a reconnect shortcut instead of an 8-second toast.

$ claude remote-control --continue

/review is now a proper alias of /code-review, which supports /code-review <level> <pr#> to review a specific PR, /code-review ultra for a deep cloud review, and now remembers the last effort level used. /code-review runs as a background subagent across effort levels to keep review output from flooding the conversation, and its empty-diff message for ultra now names the exact base ref and suggests passing an explicit one.

$ /code-review ultra 4321

New CLAUDE_CODE_MAX_CONCURRENT_SUBAGENTS environment variable (default 20) caps concurrently-running subagents. CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH now controls nesting: subagents no longer spawn nested subagents by default, then max depth was raised to 3 (set the variable to 1 to disable nesting). The 200-subagent-per-session spawn cap was removed so long-running sessions aren't blocked from spawning new agents, though concurrency and depth limits still apply.

$ CLAUDE_CODE_MAX_CONCURRENT_SUBAGENTS=5 claude

$ CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH=2 claude

$ CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH=1 claude -p 'Run the full test suite and summarise failures'

Plugins can now come from three new source types: a local command source (e.g. from an IDE) that prints the plugin directory, is re-resolved each session, and applies without a restart (mode: "link" uses it in place); a new archive source that installs plugins from a zip over HTTPS without git or npm, with optional SHA-256 pinning; and GitLab marketplace support where bare gitlab.com repo URLs — including nested subgroups — clone the same way github.com URLs do.

$ /plugin install [email protected]/myorg/mygroup/my-marketplace

Managed settings gained additionalMarketplaces and allowedMarketplaces as friendlier aliases for extraKnownMarketplaces and strictKnownMarketplaces, a url-typed blockedMarketplaces entry that keeps blocking a bare repo URL even when classified as a git clone, and owner wildcard entries ("owner/*") in strictKnownMarketplaces/blockedMarketplaces to allow or block an entire GitHub org in one entry.

{
  "blockedMarketplaces": ["my-org/*"]
}

claude plugin validate now checks a bare .claude/skills directory, reports SKILL.md frontmatter parse failures, accepts '.' as a valid skills path, and warns when a name would be rejected by Claude Desktop's managed marketplace sync. /plugin install plugin@marketplace now refreshes a stale marketplace catalog and retries before reporting not-found, and plugins now activate immediately when safe without requiring /reload-plugins.

New claude self-hosted-runner subcommand turns your own machines or containers into execution environments for Claude Code web, mobile, and desktop sessions (Team and Enterprise plans). It gained server-supplied hook support matching managed environments, a faster session start (branch created without rewriting the working tree, eliminating two blocking server round trips), and now requires an explicit --base-dir for Windows startup since there is no default checkout directory on Windows.

New ANTHROPIC_BEDROCK_REGION_PREFIX environment variable lets Bedrock users prefer a specific cross-region inference profile instead of the AWS_REGION-derived default. Expired/missing Google Cloud credentials for Vertex AI now fail within seconds instead of minutes, tool search was re-enabled on Vertex AI for Claude 4.5-generation and newer models, and gateway streaming responses now send SSE keepalive pings during long thinking pauses to prevent idle-timeout disconnects on Vertex and Bedrock upstreams.

$ export ANTHROPIC_BEDROCK_REGION_PREFIX=us-east
claude

sandbox.ripgrep is now honored only from user, managed, and --settings settings — project settings can no longer override it. The managed-settings approval dialog now shows endpoint URLs and requires approval for server-managed sandbox binary overrides (sandbox.bwrapPath, sandbox.socatPath, sandbox.ripgrep), while benign feature and cost toggles no longer trigger that approval prompt.

The Gateway's desktop: overlay now accepts every released Desktop setting (previously 11 hand-listed keys) and is validated at boot against Desktop's schema, with unknown/invalid keys now failing boot. Empty managed.policies[].match.groups/admin.admin_groups entries and malformed email_domain values also now fail at boot instead of silently matching no one or granting admin access.

VS Code gained session groups in the sidebar (right-click to create, rename, or delete; Cmd/Ctrl- or Shift-click to move several at once), a resizable /btw side-question panel, and a Focus view (Ctrl+Alt+F or the 'Claude Code: Toggle Focus view' command) that hides tool activity behind an expandable per-turn summary with a live running-tool indicator.

Print mode now writes a [claude-code:unrecognized_model] line to stderr for unrecognized model IDs (silence with modelOverrides). Sessions on unrecognized model IDs are now enforced against the assumed context window via auto-compaction by default; set CLAUDE_CODE_DISABLE_UNKNOWN_MODEL_WINDOW_ENFORCEMENT=1 to restore prior behavior.

TaskCreate, TaskGet, TaskUpdate, TaskList, and TodoWrite are no longer available by default on Opus 4.8, Sonnet 5, Fable 5, Mythos 5, and newer models; set CLAUDE_CODE_ENABLE_TODO_TOOLS=1 to re-enable them.

$ CLAUDE_CODE_ENABLE_TODO_TOOLS=1 claude

New AWS reference deployment assets under examples/gateway/aws/ — including setup.sh, Dockerfile, gateway.yaml.example (Bedrock upstream, Okta IdP), and a terraform/ module — for running the Claude apps gateway on AWS with Amazon Bedrock.

New CLAUDE_CODE_TOOL_MEMORY_LIMIT environment variable (opt-in, Linux only) caps memory for Bash tool commands via cgroups, preventing a runaway build from stalling the session.

$ CLAUDE_CODE_TOOL_MEMORY_LIMIT=2g claude

Skill and plugin frontmatter now accepts yes/no/on/off/1/0 (case-insensitive) as boolean values alongside true/false. Skills with context: fork now run in the background by default; opt out per-skill with background: false.

context: fork
background: false

Adds secret redaction for GitLab token families glrt-, gloas-, glptt-, glagent-, glimt-, glsoat-, glcbt-, glft-, glffct-, plus full redaction of routable glpat-/gldt- tokens; the glab CLI config store now receives the same sandbox and credential-path protection as gh.

New CLAUDE_CODE_GOAL_CHECKIN_MINUTES environment variable (set to 0 to opt out) makes Claude check in when background tasks keep a /goal waiting 30+ minutes instead of indefinitely; /goal also now clears itself with a notice when a turn dies on an unrecoverable error (revoked auth, exhausted credit balance, or context overflow) instead of staying armed.

$ CLAUDE_CODE_GOAL_CHECKIN_MINUTES=15 claude

New sandbox.network.strictAllowlist setting denies non-allowlisted hosts for sandboxed commands outright, with no user prompt.

{
  "sandbox": {
    "network": {
      "strictAllowlist": true
    }
  }
}

New sandbox.filesystem.disabled setting skips filesystem isolation for sandboxed commands while keeping network egress control active.

sandbox.filesystem.disabled: true

Adds Claude Opus 5 (claude-opus-5) as the new default Opus model, with a 1M context window and fast mode at $10/$50 per Mtok. Opus 4.7 is removed from fast mode, so /fast now applies only to Opus 5 and Opus 4.8, and an announcement now appears when fast mode changes due to a model switch via /config model=<x> or Remote Control.

Workflow fan-outs now stagger same-prefix sibling agents so subsequent agents read the cached prompt prefix instead of re-paying it; set CLAUDE_CODE_WORKFLOW_PREFIX_STAGGER_MS=0 to disable it.

$ CLAUDE_CODE_WORKFLOW_PREFIX_STAGGER_MS=0 claude

New workflowSizeGuideline settings key lets the Dynamic workflow size guideline be set from any settings file (hiding the /config row while active); Dynamic workflows now default to a medium size guideline of fewer than 15 agents, changeable via Dynamic workflow size in /config.

{
  "workflowSizeGuideline": "medium"
}

New --teleport <session id> flag on claude, surfaced as a /teleport hint inside cloud sessions, lets practitioners seamlessly continue a cloud session locally.

$ claude --teleport <session id>

Repos with a GitLab remote and an authenticated glab CLI now show MR state: a footer/statusline badge displays !N with draft/pending/green states, and GitLab MR URLs are supported by the --worktree flag and the claude agents view.

claude mcp list and /mcp now show HTTP status codes and error text when a server fails to connect, plus a warning for MCP config values with hidden leading or trailing whitespace. The headless stream-json init event gained an mcp_server_errors field listing --mcp-config entries skipped by config validation, with terminal runs printing a startup warning.

New optional CLAUDE_CODE_PROJECT_DIR_NAME environment variable lets hosts that give each session its own config directory choose a short name for the per-project transcript directory.

$ CLAUDE_CODE_PROJECT_DIR_NAME=my-api-service claude

/permissions can now be opened while Claude is actively working, with rule changes applying immediately to the rest of the current turn; /add-dir <path> can now be invoked mid-turn, and /add-dir, /autocompact, /theme, /help, /config, and /advisor dialogs all now open mid-turn in the fullscreen TUI.

New CLAUDE_CODE_WEBFETCH_CACHE_TTL_MS environment variable overrides the WebFetch session URL cache TTL (default: 15 minutes).

$ CLAUDE_CODE_WEBFETCH_CACHE_TTL_MS=300000 claude

Background sessions now commit and push to preserve work, open a draft PR only when the task calls for one, follow CLAUDE.md git instructions, and always report where work lives; /status now shows the session kind (interactive, or a background job that is attached or unattended); and /mcp//install-github-app now park a 'needs input' request in the agent view when no client is attached.

Remote SSE MCP servers surface an OAuth authorization prompt on a 401 response instead of failing, supporting pre-registered OAuth clients (client ID/secret) where dynamic registration is unavailable, with stored tokens invalidated on config change. Settings → MCP lets you authorize a server, view auth status, and cancel or retry authorization. New cline mcp uninstall <name> (alias cline mcp rm <name>) removes a named server from cline_mcp_settings.json. The per-server timeout field in cline_mcp_settings.json is honored for initialize, tools/list, and tools/call, replacing hardcoded 1.5s/5s limits, defaulting to 60 seconds and clamped to 1–3600 seconds. A hung MCP server no longer blocks session creation; unconfigured stdio servers get a 30-second initialize budget. MCP tool results render as readable text in the TUI instead of escaped JSON, MCP errors surface on the individual server row instead of page-level, and server cards are consistent across marketplace views with a single uninstall action and setup guidance.

$ cline mcp uninstall

$ cline mcp uninstall docs
# or using the alias:
cline mcp rm docs

{
  "mcpServers": {
    "my-slow-server": {
      "command": "npx",
      "args": ["-y", "my-mcp-server"],
      "timeout": 30
    }
  }
}

{
  "mcpServers": {
    "my-slow-server": {
      "command": "node",
      "args": ["server.js"],
      "timeout": 120
    }
  }
}

Adds CLINE_THEME environment variable to override the persisted theme choice at startup, and a /theme command plus Theme row in /settings to select from 11 built-in themes (Auto, Cline Dark, Cline Light, Tokyo Night, Gruvbox Dark, Nord, Dracula, Catppuccin Mocha, One Dark, Solarized Dark, Solarized Light) with live preview in the interactive TUI.

$ CLINE_THEME='Tokyo Night' cline

$ /theme

Plan/act mode, tool auto-approve, and compaction mode are now persisted across CLI restarts in global settings via GlobalSettingsSchema fields planActMode, toolAutoApprove, and compactionEnabled, with cross-process-safe writes so two hosts no longer clobber each other's changes.

Adds --mode <act|plan|yolo> to cline schedule create and cline schedule update, with yolo now the default mode so headless routines run unattended without approval prompts; headless scheduled routines default to auto-approve and no longer prompt for interactive input.

$ cline schedule create 'Nightly dependency audit' --cron '0 2 * * *' --prompt 'Check for outdated npm dependencies and open a PR with updates' --workspace /path/to/repo --mode yolo

Plan mode now hard-blocks file-editing shell commands at the tool level via run_commands instead of relying on prompting alone: file-manipulation commands, in-place editors (sed -i, perl -i), output redirection, mutating git subcommands, package installs, and nested command strings (sh -c, eval, sudo, xargs) are rejected with a tool error on Linux, Windows, and PowerShell, while read-only investigation commands still run.

Enables web search during a task for models that support it, toggled via the 'Web Search' setting (the web_search model tool, off by default) in Settings/Feature Settings; search calls and results appear in the transcript/conversation and persist across session reopens and reloads. The Web Search toggle now shows which connected providers support built-in web search and warns with a link to Models when none do.

Adds getShellInvocation() to replace the now-deprecated getShellArgs(), routing PowerShell commands over UTF-8 stdin instead of the command line — fixing non-ASCII command corruption and lifting the Windows command-line length cap; stdin write failures now surface as a command error instead of hanging.

Adds cloud sessions (preview) — connect GitHub, pick a repository and branch, and run sessions in Cline's cloud with transcripts, approvals, and queued prompts synced across devices; enable via the Cloud sessions toggle in Settings. Supports renaming cloud sessions and switching models mid-session, gated behind an explicit settings toggle with a GitHub connect onboarding panel.

Streaming responses now coalesce token updates instead of re-rendering the entire chat per token, eliminating stutter during long generations. The animated background renders at a locked 60 fps (up from ~10 fps) and composer keystroke handling drops from 245 slow keystrokes to 3. App boot fetches the provider catalog once instead of three times, and the native folder picker and command execution no longer block the UI while the sidecar writes session logs or discovers the editor.

Adds Claude Fable 5 (claude-fable-5) to the Vertex AI model catalog (pricing shown as unknown since Vertex bills region-dependently); supports entering any Vertex model ID by hand, including models not yet in the catalog, with custom Vertex model IDs passed through unchanged so Claude-style IDs route to the Anthropic-on-Vertex path. Shows the full model catalog for every Vertex region instead of a hardcoded list of global-endpoint models; the global-region picker no longer hides catalog models, and unsupported region/model combinations now fail at request time with recovery guidance.

Compaction/summarization now respects an explicit max-output-tokens setting (also surfaced as the 'Max Output Tokens' setting in the desktop app), defaulting to 4096 and lowered when the model reports a lower cap, instead of a hardcoded 1024-token cap — unblocking reasoning models that previously exhausted the budget thinking with no summary produced; a diagnostic is now logged when a summary comes back empty.

Adds session forking and user-run message APIs so a host can edit an earlier prompt: fork the session before a selected user run, trim checkpoint history, and restore prior messages. Adds ClineCore.readLiveMessages to read a resident session's in-memory transcript, so a plan/act rebuild during an in-flight turn starts from the full history instead of an empty one.

import { ClineCore } from "@cline/sdk"

const messages = await ClineCore.readLiveMessages(sessionId)

Connector threads across Slack, Discord, Telegram, Linear, Google Chat, and WhatsApp now automatically recover when their bound session is gone, dropping the stale binding and replaying the turn against a new session; connector sessions persist and automatically reconnect after a daemon or hub restart. Connector launch collisions are eliminated — an instance is claimed before socket mode opens, the hub supervises connector processes, doctor/connect skip connectors already starting, connector tools are enabled by default, and Slack's greeting is no longer replayed on reconnect. Telegram slash commands (e.g. /clear) are now delivered to the connector command host instead of being silently dropped.

Claude 4.6+ and 5.x (adaptive-era) models are now accepted without the 'thinking.type.enabled is not supported' rejection — the model catalog carries reasoning metadata and infers it for unlisted or hand-typed adaptive IDs. Bedrock prompt caching now correctly records cache reads and writes using Converse cachePoint markers, and Bedrock foundation models route through geo inference profiles. Reasoning models on OpenAI-compatible endpoints now receive max_completion_tokens instead of the previously rejected max_tokens.

Auto-approval settings are now honored over ACP, with a new auto_approve session config option (AUTO_APPROVE_CONFIG_ID) that ACP clients can set to approve all tool calls without prompting.

cline history now opens inside the existing TUI with resume and delete actions instead of spawning a second view; cline --help now reports the real default values for --config and --data-dir paths.

Releases Cline Code as a native macOS desktop app, signed and notarized for both Apple Silicon and Intel, for running and inspecting Cline agent sessions. The app checks for new versions on launch and every 2 hours, downloads them in the background, and prompts for a one-click restart; ignored updates apply on the next launch.

Adds a Cline API key path to onboarding and enables cancellation of a pending browser sign-in. A first-run onboarding flow guides setup on launch, with a setting to replay onboarding and redesigned channel setup as expandable cards. The welcome screen shows a 'Connect a model' notice with one-click access to onboarding or model settings when no provider has credentials, reacting live and recognizing Bedrock/Vertex and keyless local endpoints as connected. Welcome suggestions adapt to what's in the opened folder instead of assuming a code project, non-git folders no longer show git jargon, and the folder picker offers manual path entry as a fallback.

Session context is now durable across aborts and hub restarts, so interrupted sessions resume with prior state rather than resetting. Queued prompts survive user-initiated and self-triggered aborts and are drained after a turn aborts itself; failed queued turns now emit run.failed instead of completing silently. Checkpoint diffs include files that were untracked at snapshot time, and checkpoints are picked up when git is initialized mid-session. Mid-stream network interruptions before any model output are retried automatically instead of failing the turn. LiteLLM requests now route through Chat Completions instead of the Responses API, enabling calls against LiteLLM proxies.

Plugin settings and contributions are now managed centrally in the hub with host-aware snapshots and atomic plugin toggles; empty install directories are no longer listed as installed, a source host no longer runs a foreign compiled plugin-sandbox bootstrap, and installed plugins display their real package names instead of all appearing as 'index'. Plugins can now emit telemetry through ctx.telemetry from both the subprocess sandbox and in-process execution.

Managed Hub daemons now upgrade directionally: when another Cline install ships a newer Hub build, the CLI attaches to the newer daemon and prompts you to update and restart (via onHubUpdateRestart) instead of installs repeatedly retiring each other's daemons. Upgrading the CLI automatically retires the running Hub daemon and respawns it on the new code. Yolo and sandbox sessions, which never attach to the shared Hub, are exempt from these interruption prompts.

Adds end-to-end support for cline-free models, labeled '(free)' in model pickers and priced at zero; hitting the free-tier usage limit shows a dedicated error card with the reset time instead of a generic failure. A new system tray icon also shows the count of running agent sessions alongside app status.

Ollama's response-start timeout now defaults to 5 minutes (up from 30 seconds), letting large models finish cold-loading before timing out; requestTimeoutMs can still override this explicitly. The model layer was upgraded to AI SDK 7 and Ollama switched to the native AI SDK provider, removing image-bearing request deprecation warnings.

Adds Claude Opus 5 across the Anthropic, Claude Code, Bedrock, Vertex, Cline, and OpenRouter providers, including 1M context window variants; also adds Moonshot Kimi K3 model support.

Auto-updates now defer installation until no CLI is attached to the Hub, with cline update still installing immediately and noting the update applies on next start.

Session history can be filtered by origin — Desktop, CLI, extension, or scheduled — via a new filter control in the sidebar; sessions can be favorited and are ordered by most recent activity with consistent status-dot colors; history is paginated in ten-session pages, loading older history only when the end is reached; a new system tray icon shows app status and the count of running agent sessions; subagent and teammate runs from a session now appear with their status and results.

Images can be pasted directly from the clipboard into the composer. New keyboard shortcuts: Cmd/Ctrl+N for a new session and Cmd/Ctrl+, for settings; Esc stops the current turn. The composer displays a token usage ring for the active model's context window, including cumulative cost and a color change as the limit approaches. Settings, Sessions, Onboarding, and Diff views now load lazily for faster startup.

Every tool call now gets its own row in the transcript with its own icon, status, and expandable detail — commands render like a terminal ($ bun test) with captured output on expand, and edits show diffs inline per hunk. Running tool rows are highlighted in brand violet and settle to gray on completion; errors stay red. File diffs in chat rows and the diff panel now render through a shared syntax-highlighted renderer that follows the app theme. The thinking indicator remains visible during quiet stretches of a turn, such as while tool arguments are streaming.

Supports inline image generation in the transcript for models with image-generation capability (model-driven image generation). The CLI forwards generated images as ACP agent message chunks with type: image, data, and mimeType fields; non-image generated media (audio, video) is represented as a type: text placeholder chunk. Adds a media player in the desktop app capable of playing generated audio artifacts and displaying generated video.

Adds a mode field to StartSessionInput (values: user, automation, subagent, team) alongside the existing source field so sessions now record how they were initiated.