Cline Lessons Learned + Feature Roadmap for Yee Easy Mode

Date: 2026-07-29 Source: cline.bot + docs.cline.bot + github.com/cline/cline (CHANGELOG through v4.0) + 2025-2026 reviews/HN — verified by a 10-agent orchestrated sweep (3 Cline researchers, 3 Yee code readers, 3 gap-analysis lenses, 1 completeness critic). All Yee claims below are grounded in code actually read this session (file:line cited). Status: ✅ Research complete — roadmap awaiting Ty's ranking pass Standing constraints honored: ⛔ no paid runs anywhere in this plan (every metric proposed comes from users' organic usage on their own keys) · no tab-completion · build ON existing modules, never rebuild · byte-stable system prompt (cache invariant) is inviolable · safety net sweeps everything, always.

TL;DR

Cline won 8M+ developers with three moves we should study: (1) trust ramps — Plan/Act hard-blocked modes, per-category approvals, checkpoints-in-the-chat — that let users dial autonomy up gradually; (2) context hygiene as first-class UX — Focus Chain, visible auto-compact, /newtask handoffs — their answer to long-run drift; (3) repo-resident extensibility — .clinerules, workflows, MCP — config that rides in git and spreads team-to-team. Their #1 documented churn driver is cost blowup despite transparency ($50–200/day team runs; the spend-limit UI came embarrassingly late, v3.78) — which is exactly the surface where Yee is structurally ahead (cache-aware pricing, 150k/300k budget gates, $0 local compaction).

Where Yee is ahead (double down, market it): the shadow-git DAG with real merge/rebase/safety-net (Cline's shadow git is branch-per-task restore; it's disabled entirely in multi-root workspaces), preview-anchored verification (error scrape → fix loop → Lighthouse → pre-push deploy fact-check), cost honesty with gates not just meters, and the farm→forge→split-test measured-tuning loop Cline has no equivalent of.

Where Cline is ahead (the gaps to close): recovery lives in a separate canvas instead of inline in the chat; our loop dead-ends silently at the iteration cap; compaction/degradation is invisible; easy mode has no read-only mode and silently overrides the user's auto-apply preference; approval grants are exact-string and session-only (and concurrent approvals race — a real bug); nothing we read rides in the user's repo (no rules files, no workflows); the model picker is a hardcoded 16-model list despite the OpenAI-compat plumbing existing; and there's no MCP story at all.

1. What Cline is (verified inventory, compressed)

Positioning (their words): "transparency over convenience, developer control over vendor lock-in, full model power over margin optimization, open source over proprietary black boxes." Apache 2.0, BYO-key, 40+ providers incl. local (Ollama/LM Studio) and OAuth piggybacking on ChatGPT/Claude Code subscriptions. $32M raised July 2025; enterprise tier Oct 2025; ClinePass ($9.99/mo open-weight models) June 2026.

Core loop features (all shipped, VS Code + CLI):

• Plan & Act modes — Plan is hard-blocked from edits/commands (structural, not behavioral); history carries across the flip; optional per-mode model pairing. The single most user-cited trust feature; Cursor and Copilot copied it.
• Checkpoints via shadow git — commit after every tool op; bookmark in the chat with Compare + Restore; three restore scopes (Restore Files / Restore Task Only / Restore Files & Task — i.e. they can rewind the conversation too, which we can't). Branch-per-task since v3.6. Disabled in multi-root workspaces; slows on huge repos.
• Auto-approve + YOLO — per-category toggles (reads/edits/safe-commands/all-commands/browser/MCP), model-assigned requires_approval per command, OS notifications when blocked ≥30s. YOLO = everything approved (v3.31, enterprise-disableable).
• Focus Chain (v3.25, default-on) — auto-maintained markdown checklist re-injected every 6 messages, n/m progress in the task header. Their fix for long-horizon drift.
• Auto Compact (v3.25) — visible summarization tool-call with its cost shown near the context ceiling; manual /smol; documented fallback to rule-based truncation. Their answer to "5M-token task in a 200k window."
• Slash commands — /newtask (package progress+plan+files into a fresh clean-context task), /deep-planning (silent explore → questions → implementation_plan.md → spawn fresh implementation task), /newrule, /smol, /reportbug.
• Diff editing — replace_in_file with order-invariant apply, continuously tuned against a public evals/diff-edits harness; they credit >10% gains to treating diffEditSuccess as the loop's core health metric. v4.0 moved toward apply_patch/editor tools.
• Loop detection + auto-retry with backoff (v3.76) and an experimental completion double-check pass (v3.58): every hard limit has a continuation ramp.

Extensibility (the ecosystem layer):

• .clinerules/ — repo-resident, version-controlled, team-shared rules; per-file toggle UI; conditional path-glob frontmatter; auto-detects .cursorrules / .windsurfrules / AGENTS.md (competitors' installed base = their onboarding funnel).
• Workflows — markdown files → /name slash commands, injected once as explicit_instructions (no persistent prompt tax); "generate a workflow from what we just did."
• Skills (v3.48) — progressive disclosure: ~100-token metadata always, <5k loaded on activation.
• Hooks (v3.36) — PreToolUse/PostToolUse scripts, fail_open/fail_closed. Notably: .clineignore is being deprecated because advisory filters got bypassed (mentions, shell) — replaced by hook-enforced runtime blocking. Enforce at the boundary or don't bother.
• MCP — STDIO servers, per-tool autoApprove arrays, in-product marketplace (Feb 2025), routed through the same approval system as built-ins.
• Subagents — read-only research fan-out (use_subagents) keeping the main context clean, per-subagent cost rolled into the task total.

Breadth we are explicitly NOT chasing (see §5): CLI/TUI, Kanban (parallel agents on worktrees), Agent Teams, Slack/Discord/Linear connectors, cron scheduling, enterprise SSO/governance, dictation, marketplace.

Their documented weaknesses (as valuable as the features):

1. Cost blowup — the persistent 2024-2026 complaint: $52–187/mo typical, "$50-200/day in team settings," 9× a Cursor seat; spend-limit UI only in v3.78 (Apr 2026). Transparency ≠ affordability. Gates matter.
2. Context regressions — the no-throttle philosophy produced token churn / context-loss regressions (issue #5616; users restarting every ~10 messages). Our cache-stability discipline is the countermeasure they lack.
3. No autocomplete + rougher polish — structural, acknowledged in most 2026 reviews. (Irrelevant to us: tab-completion is explicitly not our priority.)
4. Forkability — Roo Code forked them, iterated faster, siphoned power users through 2025 (archived May 2026). The durable moat was the eval-tuned harness + steadiness, not any copyable feature. Our equivalent moat is the measured substrate (farm→forge→split-test on the user's own keys) — any sharing feature must carry that discipline, never bypass it.

2. Lessons learned

Where Yee is AHEAD — double down, don't dilute

• L1. The checkpoint DAG is a marketable differentiator. Cline's whole autonomy thesis rests on "checkpoints drop the cost of a mistake to near zero" — and our engine is stronger where it counts: real merge/rebase, safety-net commits that sweep everything (incl. gitignored/stranger files), ignored-clobber guards, authored-only push staging ([lib/checkpoints.js](../building_block/editor/lib/checkpoints.js), [app/branchGraph.js](../building_block/editor/app/branchGraph.js), [app/pushSelect.js](../building_block/editor/app/pushSelect.js)). Cline's checkpoints are disabled in multi-root workspaces — an easy honest marketing line for us. One caveat where they lead: their three restore scopes include conversation rewind; ours is files-only (→ CL-01).
• L2. Cost honesty with GATES is the brand working. Cline proves per-loop cost display alone doesn't retain users — the churn came anyway, and the gate came late. Our cache-aware per-token-type pricing, ⚡cache-hit%, 150k soft / 300k hard per-turn pause with keep-going/stop ([app/synthwave.js](../building_block/editor/app/synthwave.js) BUDGET/budgetGate), and $0 local-mlx compaction are the preemptive version of their retrofit. Rule going forward: every new surface gets metered and gated on day one (MCP calls, compat endpoints, workflows) — and when pricing is unknown, show tokens + an explicit "$ unknown," never a fabricated figure.
• L3. Preview-anchored verification is our lane. Cline verifies via terminal watching + a heavyweight browser tool + an experimental double-check pass; our chain (noise-filtered preview error scrape → fix-in-chat through the same synthSend path → reverify → real Lighthouse pills → two-tier pre-push deploy fact-check that caught a real production failure) verifies at the surface the user ships. Nothing in their inventory has the pre-push deploy fact-check. But the critic's catch stands: this lane currently only covers web repos (→ CL-11).
• L4. Byte-stable-system-prompt discipline is a moat. Cline's context-regression record is what happens without it. Our invariant — EASY_QUALITY_PROMPT byte-identical, volatile context rides user turns, repo map pinned in the turn-1 pair surviving eviction, <30% cache-read tripwire — is the stricter, more honest version of their rules/skills tiering. Every feature in §4 injects via the turn-1 rider or follow-up prompts, never the system prompt. That's the design contract.
• L5. The measured substrate is the unforkable part. Promotion-requires-measured-score (on the user's own keys) is the discipline Cline's marketplace lacks and the reason a fork can't take the moat. Shared/imported anything arrives unmeasured and only earns default status through the user's own measured runs.

What Cline teaches us — the gaps

• L6. Never dead-end silently; every hard limit needs a visible exit ramp. Cline pairs every ceiling with a continuation (auto-compact, retry-with-backoff, loop detection, /newtask). Our runAgentLoop exhausts MAX_ITERATIONS=10 and just… returns — possibly with an unexecuted `tool block rendered as prose — even though we already built exactly the right UX for the spend limit. (→ CL-02)
• L7. Recovery must live where the panic happens — inline in the chat. Cline puts Compare/Restore bookmarks on every tool op in the conversation. Our stronger engine hides behind a separate canvas and a small 🛟 toggle — and our own 2026-07-18 "unrecoverable files" scare was explicitly a discoverability failure while the data sat safe in the shadow repo. An undo engine users can't find at panic-moment is functionally no undo engine. (→ CL-01)
• L8. Show the machinery: compaction, degradation, and dial-turns are trust surfaces. Their auto-compact is a visible tool call with a cost; our _capTurnsCompacted distills invisibly and — when local mlx is down — silently drops the conversation middle with no note. Also: easy mode force-calls setAutoApplyEdits(true) over the user's persisted preference with zero disclosure. The honest-instrument posture must cover internal state, not just dollars. (→ CL-06, CL-05)
• L9. A hard-blocked read-only mode is an onboarding ramp, not a power-user nicety. Plan/Act is Cline's most user-cited trust feature because the block is structural. We already have persisted edit/plan/auto behavior modes as "the canonical source of truth" ([app/agentLoop.js:1966](../building_block/editor/app/agentLoop.js)) — but they're main-editor only; the flagship easy-mode surface always runs full-act, force-auto-apply. First-run experience = maximum autonomy, no ramp. (→ CL-05)
• L10. Approval policy should key on what a command IS, not its exact bytes — and concurrent approvals must queue, never supersede. Their model-assigned requires_approval + persistent per-category toggles vs. our exact-string, session-only allowlist that re-prompts on one-char variation (training users to click through). Worse, requestCommandApproval denies a pending modal when a new one arrives — at PLAN_CONCURRENCY=3 an orchestrated step's command can be silently denied. That's a bug, not a preference. (→ CL-03, CL-04)
• L11. Long-horizon reliability = a persisted north-star artifact re-injected on a cadence. Focus Chain, mechanically: checklist, re-inject every 6 messages, n/m in the header. We have the artifact machinery (agentPlan checklists, steeringQueue's proven single-drain-point injection) and re-inject no task artifact (the repo map's MAP_REFRESH_EDITS drift refresh is the only rider refresh). (→ CL-08)
• L12. Context handoff is a first-class loop operation. /newtask forks the task state, not just the tree state. Our fork moves the workspace to a sha but the new chat inherits only the repo map — the accumulated understanding, which our local distiller could package for $0, is discarded exactly when it's most valuable. (→ CL-09)
• L13. Repo-resident config is the unit of ecosystem propagation. Rules/workflows that ride in git spread team-to-team; honoring competitors' formats (.cursorrules, AGENTS.md, CLAUDE.md) converts their installed base into your onboarding funnel free. Everything we read today lives in SQLite/localStorage — personal and machine-local; repos already carrying AGENTS.md are silently ignored. (→ CL-07, CL-13)
• L14. Extension tools must enter through the one choke point. Our safety-and-honesty spine (approvals, s.activity trace → PR bodies, farm capture, addTok metering) keys on the fixed tool vocabulary dispatched in executeTool. Any tool path that bypasses it forks the safety story and starves the meter/farm/PR surfaces. That's the MCP integration contract. (→ CL-16)
• L15. Enforce exclusion at the tool-call boundary, fail closed. Cline is deprecating .clineignore because advisory filters were bypassed. We currently have no exclusion mechanism at all — every repo file is readable, mappable, and farmable into the SFT warehouse, .env included. We get to skip their advisory mistake entirely. Scoping rule: ignore governs model access + training capture, never the safety net's recovery sweep. (→ CL-17)
• L16. Edit-apply success is the loop's core health metric — and its failures are free training data. They publish an evals/diff-edits harness and credit >10% gains to it. We already persist the per-tool-call ok bit in s.activity and farm only successful edits — the failure half of exactly this signal is discarded today, and it costs zero paid runs to keep (it's organic usage). (→ CL-12)
• L17. Provider breadth is the no-lock-in adoption wedge, and most of it is one generic OpenAI-compatible endpoint. (Not all — their subscription-OAuth piggybacking is a separate mechanism a compat endpoint can't reach; that stays a watch item.) Our mlx: path already speaks OpenAI-compat HTTP to a configurable URL; the lockout is just the hardcoded 16-model picker and pricing table. (→ CL-14)
• L18. Community rituals become product. Memory Bank is a docs-canonized pattern where the frontier model re-reads six markdown files every task — a recurring token tax. We can ship the same continuity as a near-zero-cost built-in because we already persist the raw material (sessions, s.activity, s.authored, tok, DAG) and own a local distiller — PR-body synthesis already proved zero-token composition works. (→ CL-22)

3. The backlog, ranked by need

Legend: P0 = trust/correctness gap users hit now · P1 = high leverage next · P2 = valuable, after P1 · P3 = someday/watchlist. Effort S/M/L/XL. Every item builds on named existing modules; none needs a paid run; all injection is cache-safe (rider/user-prompt only).

P0 — close the trust gaps now

CL-01 · Inline turn-restore chips in the chat stream — Every assistant message whose turn produced edits gets a hover affordance: "⎌ restore to before this turn" + "view changes." Restore calls the existing restoreTo (already safety-commits live state, re-places strangers, guards ignored clobbers) against the turn's baseline sha the DAG already stores; confirmation is the existing swap system-note with one-click undo; "view changes" reuses the branch-graph node's lazy diff card. The canvas stays the power surface; this puts the panic path where the panic happens (L7 — and the 2026-07-18 scare is the receipt). Restore scopes (critic catch, and the one axis Cline leads on): after a files-only restore the conversation still "remembers" edits that no longer exist — v1 must at minimum stamp an honest system note into the transcript ("workspace restored to before turn N; edits after that point are no longer on disk") that also rides the model context; a full Cline-style "rewind conversation too" is a fast-follow once the note pattern proves out. Acceptance: click restore on a mid-chat turn → files revert, safety node appears in the canvas, note visible to user AND model, undo works — verified in the live app, not just tests.

CL-02 · Iteration-cap continue gate + loop detector — When MAX_ITERATIONS exhausts with apparent unfinished work (trailing unexecuted `tool block, or edit-intent detected but unapplied), pause with the exact budgetGate UX: "hit the 10-round safety cap" + keep-going (buys another leg) / stop. Render any unexecuted trailing tool block as an honest "planned but not executed" block, never prose. Companion (critic catch): a repeated-tool-call loop detector (same tool + args N times, or no-progress heuristic) — without it, "keep going" can repeatedly fund an infinite loop; with it, the gate message says "the agent appears to be repeating itself" so the user's choice is informed. (L6) Acceptance: a deliberately over-long task pauses with the gate instead of ending silently; a synthetic repeat-loop trips the detector message.

CL-03 · Approval FIFO queue (straight bug fix) — requestCommandApproval currently denies a pending modal when a new request arrives; orchestrated plan steps at PLAN_CONCURRENCY=3 can race and silently lose commands. Queue FIFO. Ship independently of CL-04 — it's a correctness fix, not a feature. (L10)

CL-07 · Repo rules rider — At chat creation, discover rules at repo root in priority order .yee/rules.md → AGENTS.md → CLAUDE.md → .cursorrules → .clinerules/.md, concatenate with per-file caps, inject as a labeled section of the turn-1 user prompt beside the repo map (pinned pair survives eviction; refresh on the existing MAP_REFRESH_EDITS drift path when the file hash changes). Header pill names which file loaded, with a toggle-off — the user sees exactly what rides the prompt. Never touches the system prompt (L4). Honoring the competitor formats converts Cursor/Claude-Code-convention repos into instant-onboarding repos (L13). Verified: zero rules-file support exists today. Also builds the shared repo-config loader that CL-13/16/17/22 reuse. Acceptance:* drop an AGENTS.md into a repo → pill appears, instruction observably honored in output, cache-hit% unchanged across turns (the tripwire is the regression test).

P1 — control, continuity, and the first open doors

CL-04 · Persistent classified command allowlist — Third approval tier: "always allow <class> in this repo," keyed on the existing classifyCommandPurpose class + normalized command family, persisted per-repo in chatStore. Canonical constraints (the critic forced this to be explicit): the gateway evaluateTerminalSecurity blocklist always wins; destructive classes (delete, install, git-mutating) are never offered for standing approval; the tool block shows which tier auto-approved ("auto-approved: run-tests allowlist") so grants stay auditable; a header chip lists/revokes grants. Exact-string session tier stays. (L10)

CL-05 · Plan/Act toggle in easy mode + honest Act disclosure — Surface the already-persisted behavior modes as a two-state header switch. Plan: executeTool hard-blocks EDIT_TOOLS + run_terminal with a structured "planning mode — read and propose" tool result (the existing rejection-as-tool-result pattern, so the model adapts instead of erroring). Act: current behavior, but with the missing disclosure line: "Act auto-applies edits — every turn is checkpointed and restorable" — fixing the silent setAutoApplyEdits(true) override (L8, L9). Optional fast-follow: per-mode model memory via the existing per-conversation picker (cheap model for planning, user's choice, user's key). Acceptance: in Plan, zero file mutations across a full multi-iteration turn (checkpoint diff is empty); flip to Act mid-conversation carries history; disclosure visible on first Act turn.

CL-06 · Visible compaction + manual compact + context meter — (a) _capTurnsCompacted emits over the existing usage-normalization channel; renders a one-line system note: "condensed 12 older turns into a summary (local model · $0)." (b) When mlx is down and plain eviction drops the middle: say so — "older turns dropped without summary — local compactor offline." (c) "Compact now" affordance. (d) Small context-fill pill beside the token meter (last input tokens vs model window, from a per-model window table next to MODEL_PRICING — same honest-rough posture, and note the shared maintenance debt: neither table has a reconciliation mechanism; keep them adjacent so one update pass covers both). Extends honest-instrument from dollars to context state (L8). Notes ride the chat surface, never the prompt.

CL-08 · Task ledger (focus-chain-lite) — Turn-1 drafts a ≤10-item checklist for multi-step asks; the loop appends it compactly to follow-up prompts every Nth iteration via the steeringQueue's proven single-drain-point; model checks items off; header shows n/m. Persisted with the session so it survives eviction and restarts; rides follow-up prompts only (L4, L11). Reuses the agentPlan checklist schema — this is prompt mechanics, not new machinery.

CL-09 · Fork-with-context handoff — "Hand off to fresh chat" node action on the branch graph: distill the conversation via the local compactor ($0) into task-state bullets, carry s.authored + repo map + ledger, run the existing fork flow with the new session pre-seeded. The handoff is itself a DAG node, so lineage stays visible. mlx-down degrades to extractive bullets with an honest note. (L12)

CL-10 · OS notifications — Electron Notification (window-unfocused only): approval modal opened (loop is blocked on you), budget/iteration gate paused (spend frozen), long turn finished, Lighthouse queue done/stalled. Click focuses the window; one quiet-mode toggle. Today a user who tabs away leaves the agent frozen at a modal. (Cline fires these at approval-needed and 30s-running marks.) The fix-queue trigger ships only after the queue's own end-to-end click-through — it's marked untested on the system map; don't build notification UX on an unverified sequencer.

CL-11 · Easy-mode verification for non-web repos — The critic's best catch: our verification moat (L3) covers only running web apps; for CLIs/libraries/Python repos, easy mode verifies nothing after an edit. Bring projectVerify/lintCheck into the easy-mode turn lifecycle: after the turn's edits, run the repo's detected check (typecheck/test/lint) and surface pass/fail as a chip; failures offer the same fix-in-chat path as preview errors. Do the debt fixes on the way in — they directly cause wasted paid fix-turns: package-manager detection (npm hardcoded breaks pnpm/yarn), and lintCheck's new Function() false syntax errors on any import/export (most modern source). Scope v1 to JS/TS + Python detection; cargo/gradle later. Acceptance: in a pnpm TS repo with no dev server, an easy-mode edit turn ends with a real typecheck verdict chip; no false syntax errors on ESM files.

CL-12 · Edit-apply success meter + farm negatives — Aggregate persisted s.activity {t,p,ok} into per-model, per-edit-tool apply-success rates with always-visible n counts in the under-the-hood pipeline popup (upgrading the n=2-12 MODEL_BEST strings toward defensible numbers as organic n grows). Capture FAILED search_replace/multi_edit attempts as negative rows for the forge's negative-weighting pipeline — the failure half of the signal is discarded today (L16). Zero paid runs by construction. Prerequisites (critic): fix s.activity honesty first — the 400-entry cap and 80-char path truncation currently lose early activity with no "and N more" marker, which would silently understate this meter, the receipt line, and PR bodies. Also label truncation-induced mismatches (model edited text it never fully read due to 8000-char read caps) so tool-caused failures don't pollute model-attributed negatives.

CL-13 · /workflows — Markdown files in .yee/workflows/ (repo) + a userData global folder become /name commands with autocomplete in the prompt box; on invoke, wrapped in a short explicit-instructions preamble and dispatched through synthSend's existing forced-prompt parameter as one message. The dispatch engine already exists — fixPreviewErrors, fixPythonErrors, deploy fix-in-chat, and the Lighthouse queue are four shipped internal workflows with no user authoring surface. Plus zero-token "save as workflow" from the current turn's prompt + s.activity tally (authoring from data in hand, no model call). (L13)

CL-14 · Generic OpenAI-compat provider — compat: model prefix resolved to a user-configured base URL + optional safeStorage key, reusing the mlx path's OpenAI-compat client. Settings CRUD: name, URL, optional user-entered $/Mtok. The meter always shows tokens; $ only when the user priced it — explicit "$ unknown — set a price" otherwise, never fabricated (L2, L17). Opens OpenRouter/Groq/DeepSeek/LM-Studio/self-hosted without shipping 40 integrations. (Subscription-OAuth piggybacking — Cline's other adoption lever — is not reachable this way; it stays on the watchlist, see §5.)

CL-15 · Renderer↔main version handshake — The critic generalized our "pervasive" restart-required gotcha (push, staging, checkpoints, chatStore columns — and CL-06/16/18/21 each add new IPC): a build stamp exchanged at boot; mismatch shows one "Yee needs a full restart" banner everywhere, instead of per-feature tripwires and mystery staleness. Small, and it should land before the IPC-adding features.

P2 — open doors, wider capture

CL-16 · MCP client v1 — STDIO-only, local servers from .yee/mcp.json + global config; main-process lifecycle patterned on devServer.js; tools mirrored into the text-protocol vocabulary, frozen at chat creation (same fixed-at-creation cache invariant as language groups). Every call dispatches through executeTool behind a new gate class: default always-ask modal labeled server:tool, per-tool session allow, results through compactResult, every call in s.activity (PR bodies honestly show third-party tool use) and metered (L14, L2). Manual JSON config + 1-2 documented example servers; explicitly no marketplace. Default-off until the approval UX is click-through verified. Sequencing (critic): the nativeTools.js mirror path is marked untested on the system map — v1 rides the text-vocabulary path only; native mirroring waits for native mode's own verification. Retires the README's honest "no plugin system" gap.

CL-17 · .yee/ignore enforced at the boundary — Gitignore-syntax exclusion (secret-pattern defaults on) enforced inside executeToolDirect for read/grep/list/write, in repoMapFor, and in captureEdit so excluded paths never enter the SFT warehouse. Blocked access returns a structured "path excluded" tool result so the model reroutes. The safety net still sweeps everything — ignore governs model access and training capture, never recovery (guard-test this; the 2026-07-18 scare makes sweep completeness sacred). Skips Cline's advisory-phase mistake entirely (L15). Header disclosure when active.

CL-18 · Resume interrupted turn — Tiny in-flight marker per session; on load after a mid-turn death, an honest note + one-click resume building a continuation prompt from the s.activity tail + dirty-diff against the turn's baseline checkpoint, through the normal synthSend path.

CL-19 · Per-turn receipt line — Collapsed one-liner in the message footer: tokens in/out, cache-hit%, ~$, N tool calls (M edits), files touched — all from data the turn already counts, formatted to match the PR body's stat line so the live chat and the PR reviewer read the same numbers (the instrument agreeing with itself across surfaces).

CL-20 · fetch_web tool — Text-based HTML→markdown fetch through the executeTool choke point: gated (approval class "network read"), metered, compacted. The light alternative to a browser tool; Cline ships this (v3.48) and we have no web retrieval at all. No search API dependency in v1 — URL fetch only (search needs a provider and is a separate decision).

CL-21 · Multimodal attach — Drag-drop/paste an image into the chat (mockups, bug screenshots — a core easy-mode use case the critic flagged). Rides the existing screenshot→chat vision path incl. the honest token-estimate chip (⌈w/28⌉×⌈h/28⌉); non-image files deferred.

CL-22 · Portable .yeepack bundles — Export a stream/pack (wd/rm/pa + params + lineage) as versioned JSON, committable to .yee/packs/; import shows as a fork labeled "imported — unmeasured", excluded from default until the user's own measured promotion clears it (L5). Author scores display as advisory only; local promotion always re-measures. Marketplace-lite with the discipline Cline's marketplace lacks; pairs with the data library's export-bundle direction.

P3 — someday / watchlist

• CL-23 · Zero-cost repo memory brief — "Previously in this repo" composed from persisted sessions/activity/authored/DAG, optionally distilled by local mlx; rides the turn-1 rider; user-visible + toggleable. Memory Bank's value without its per-task frontier tax (L18 — and per the critic: the honest claim is "zero-config built-in over data we already persist," not "structurally impossible for Cline").
• CL-24 · Read-only research subagents — fan out exploration to read-only agents with own budgets, results summarized into the main context. Real value for repo exploration burning the 24-turn window, but heavy; after ledger + handoff prove out.
• CL-25 · Skills-style progressive disclosure — tier-3 instruction packages loading on demand via the user prompt (cache-safe). After CL-07/13 establish the config-loader + authoring habits.
• CL-26 · General pre/post-tool hooks — the single choke point makes this cheap someday; CL-17 is the concrete instance first. fail_closed semantics from day one.
• Watchlist, no commitment: subscription-OAuth piggybacking (adoption lever, but ToS/complexity-fraught; revisit if BYO-key friction shows up in real usage) · Python Space/Jupyter completion (Cline ships cell-granularity notebooks; ours is PARTIAL — explicitly deferred, not forgotten, pending Ty's call) · local-whisper dictation · edit-and-regenerate of past messages.

Explicitly NOT pursuing (decided, with reasons)

• Tab completion — Ty's standing call; Cline's reviews confirm agent-does-the-work can win without it.
• CLI/TUI, Kanban, Agent Teams, connectors (Slack/Discord/Linear), cron, enterprise SSO — Cline's breadth wave serves their platform play; our thesis is depth on the local-first editor + Forge ecosystem.
• YOLO mode as a labeled feature — easy mode already auto-applies within a checkpointed sandbox; what we need is the disclosure (CL-05), not more throttle.
• MCP marketplace — manual config first (Cline's own maturity order); a marketplace without the measured-substrate discipline would dilute L5.
• Anything requiring a paid eval run to build or justify — standing rule; every metric above is organic-usage-derived.

4. Suggested milestones (sequencing, not new scope)

• M1 — Trust the loop (all S/M, ~quick): CL-03 (bug), CL-02, CL-01, CL-07, CL-10, CL-15. Outcome: no silent dead-ends, recovery inline, rules honored, walk-away-able runs.
• M2 — Long-run control: CL-05, CL-04, CL-06, CL-08, CL-09, CL-19. Outcome: onboarding ramp + honest machinery + context continuity.
• M3 — Verify everywhere, measure honestly: CL-11, CL-12 (+ s.activity honesty fix), deploy-check manifest reuse (Cargo/poetry via pushSelect's LOCKFILE_PAIRS — cheap, critic-flagged), Lighthouse route context. Outcome: the verification moat covers non-web repos; apply-success becomes our public-grade health metric.
• M4 — Open doors: CL-13, CL-14, CL-21, CL-20, CL-17. Outcome: repo-resident ecosystem + any-endpoint BYOK, exclusion enforced before capture widens.
• M5 — Ecosystem bets: CL-16, CL-22, CL-23, then P3 re-rank. Outcome: MCP behind the spine; sharing with the measured-substrate discipline.

Candidates for the 🗺 PRIORITY TRACKER (Ty's call): CL-01, CL-02+03, CL-07 as the P0 block; CL-11 as the thesis-completing P1.

5. Standing engineering contracts every item above obeys

1. Cache invariant: nothing ever mutates the byte-stable system prompt; injection = turn-1 pinned rider or follow-up prompts; per-chat vocabulary freezes at creation. The <30% cache-read tripwire is the regression alarm.
2. Choke-point contract: every tool — built-in or MCP — dispatches through executeTool, so gates, s.activity, farm, and the meter see everything.
3. Safety-net completeness: the shadow-git sweep captures everything, always; no ignore/exclusion feature may narrow recovery. Guard-tested.
4. Honest degradation: when a subsystem is down or a limit is hit, say so in the chat surface; never silently degrade (compaction, iteration caps, unknown pricing, truncated activity).
5. Verify at the product surface: each shipped item's acceptance criterion is a live-app click-through, not a green unit test (SHIPPED_PACKS rule). Items building on system-map untested nodes (native tools, Lighthouse fix queue) sequence that verification first.
6. No paid runs: all metrics are organic-usage-derived on users' own keys; imported/shared config is unmeasured until the user's own promotion clears it.

Appendix: primary sources

• https://docs.cline.bot — core-workflows (plan-and-act, checkpoints, using-commands, working-with-files), features (auto-approve, auto-compact, focus chain, multiroot), enterprise docs
• https://github.com/cline/cline — README + CHANGELOG (v3.1 → v4.0, Jan 2025 → Jun 2026)
• https://cline.bot/blog — v3.25 (Focus Chain, Auto Compact, /deep-planning), v3.31 (YOLO, task header), v3.48 (Skills, websearch), v4.0 (SDK re-platform)
• Reviews/community 2025-2026: cost-blowup complaint record, context-regression issue #5616, Roo Code fork arc (archived May 2026), Plan/Act reception threads