SDK v0.0.84: Concurrent polling, run-start hooks, Windows security, and performance improvements

• Concurrent feature-flag polls for the same account now share one in-flight request. The cache was marked fresh before its network request finished, so a caller that raced the initial poll returned immediately with the default value — a flag that was actually enabled read as disabled until something triggered a later refresh. Failures now propagate so a subsequent call can retry, and switching accounts does not wait on the previous account's request
• Run-start hooks can now inject context. beforeRun returns a new AgentRunStartResult carrying an appendContext channel alongside stop/reason — AgentStopControl stays assignable, so existing implementors compile unchanged — and the runtime injects what it collects as a single <hook_context source="RunStart"> message placed after the run's input messages, so the model sees it on the run's first request. A resumed session seeded with a trailing unresolved tool_use gets the block immediately before that call instead, keeping the tool_use/tool_result pair adjacent, and a stopping hook's context is never injected. At the hook-file and subprocess layers, agent_start and agent_resume had always spawned detached with stdio ignored, discarding both contextModification and cancel outright; honoring them is now available behind a new blockingRunStartHooks option that defaults to today's fire-and-forget, since blocking by default would silently stall every run start for hosts whose existing scripts linger. With the flag on, a blocking run-start hook that backgrounds a child settles after a post-exit grace period and drops its stdio pipes, so a lingering grandchild can no longer hang the run — hook authors should give backgrounded children their own stdio. A new hooks.detached_runtime event reports each detached hook once, including a censored sample for hooks still running after a 30-second observation window
• On Windows, a program planted in the workspace can no longer run in place of the real one. libuv resolves a bare program name (rg, git, powershell, anything the model names) by searching the child's working directory before PATH, and Cline spawns those with the user's repo as cwd, so opening a repo containing an rg.exe executed it during file indexing, before any approval. New disableCurrentDirectoryExecutableSearch() in @cline/shared sets Windows' documented NoDefaultCurrentDirectoryInExePath opt-out, which libuv, Bun 1.4+, cmd.exe and the C runtime all honor, so one call at process startup covers every spawn and every child. Embedders hosting @cline/core in their own Windows process should call it before anything spawns; the Cline CLI, desktop sidecar, VS Code extension and JetBrains core do
• Compaction now triggers on the provider's reported input-token count, not just a character estimate. The trigger compared a ~3 chars/token estimate against the model's input budget, so dense content — disassembly, image dumps, minified sources — could reach the real context ceiling while the estimate stayed under the threshold and compaction never fired; affected runs filled the window and had their turns squeezed down to a handful of output tokens. The runtime now records the provider-reported input-token count for each request and threads it to the prepare-turn pipeline as previousRequestInputTokens, and the trigger uses max(estimate, actual), keeping the estimate as a floor so the very first oversized turn is still caught before any usage has been reported. The default summarizer output budget also goes from 4096 to 8192, since a model that reasons by default can spend a tight budget on thinking and return no summary text at all
• Subagent tool calls now run concurrently by default. spawn_agent and configured subagent_<name> tools opt into a new executionMode that createTool preserves and the agent runtime honors, so adjacent parallel calls execute together while sequential tools remain ordering boundaries; unmarked tools keep using the parent's execution setting. Preparation, hooks, and approvals still run sequentially and complete before execution begins, and the parent still waits for every tool result before its next model turn
• Configured subagents no longer inherit the parent session's tool approval policies and approval callback for their own tool calls, which aligns them with generic spawn_agent children and teammates. With manual approvals enabled, a configured child prompted for its own tool calls after the parent had already approved the delegation — and once siblings could run concurrently, multiple children reaching the one-shot terminal approval handler on the same stdin meant a single y could approve several pending operations. The parent's approval policy still governs the subagent_<name> delegation call itself, and configured tool allowlists and disabled-tool filtering are preserved
• Deleting a session that exists only as an on-disk manifest now actually removes it. History listing can recover a session from its manifest when the session index row is missing, but deletion checked only the index, so the request completed while the manifest survived and the next history refresh showed the session again. Shared session persistence — the path VS Code, JetBrains, and the CLI all use — now deletes valid manifest-backed sessions without rebuilding their missing index rows first, accepting only matching, path-safe session IDs and removing only the canonical session directory under the current Cline data root
• @cline/shared now exposes rules-path resolvers so hosts stop hardcoding one layout. resolveWorkspaceRulesConfigPaths() returns both supported workspace rule layouts (.clinerules and .cline/rules), and resolveGlobalRulesConfigPaths() returns every global rules location — now including OneDrive Known-Folder-Move Documents candidates, so global rules the VS Code extension created in a redirected Documents folder are finally found by the resolver the desktop app and CLI use
• A queued prompt can now be steered to the head of the queue atomically. Core gained a pending-prompt steering path wired through the runtime host and the hub's session handlers, so a client promoting the current queue head cannot race a turn that is already draining, and stale replies are rejected rather than applied late
• Requests to the Cline recommended-models endpoint now carry the client type, so recommendations can differ by client. @cline/shared exports a client-identity helper and @cline/llms a matching header builder
• Composio connectors, gated behind the account-scoped CLINE_COMPOSIO_BETA feature flag. A new core tools extension registers and executes connector tools through the authenticated Cline API, with the backend owning the Composio project key and scoping connections to the signed-in Cline account. Missing identity or flag configuration denies access, internal email domains do not bypass the gate, and disconnect stays available for cleanup after access is removed. The runtime OAuth token manager also gained a cross-process refresh lock
• afterModel hooks now receive the requestId of the model call that produced the turn, and core can emit a conversation-linked Git snapshot telemetry event, so a model request can be correlated with the repository state it ran against
• Traces no longer lose Langfuse user and session attribution. A dedicated span processor preserves those attributes through the OTLP pipeline
• Login-shell PATH probing gets a larger budget, from 2 seconds to 5 seconds per shell. nvm-style profiles regularly need more than 2 seconds on older machines, and a failed probe cascades into missing runtimes for everything the host spawns afterwards
• The hub client and run handlers now keep cloud-run state coherent across delayed snapshots and teardown: a settled run is not reopened by late-arriving running metadata regardless of publication order, while genuine queued submissions still restore live running state after prompt deduplication
• agent-ask-question in @cline/ui submits a single-choice question as soon as an option is picked, instead of requiring a separate Submit step, and gains a free-text input for answers the model did not offer. Multiple-choice questions keep the explicit Submit flow
• CoreWeave replaces the Weights & Biases branding, description, and docs link on the wandb provider. The persisted provider ID and stored credentials are unchanged, so existing configurations keep working
• Refreshed the model catalog, from 203 to 209 providers and 6,079 to 6,188 models. Kimi For Coding splits into separate kimi.com and kimi.ai providers, replacing the single kimi-for-coding entry; standardcompute is gone; and AI21 Labs, ainetcafe, Inco, OCI Generative AI, Tempr, and Vispark are new. The resolved default model also changes for 29 providers that do not pin one in builtins.ts — eight land on DeepSeek V4.1 Flash (Alibaba CN and its token plan, Nebius, Neuralwatt, SCNet, Synthetic, TensorX, Vancine) and six on GLM 5.3 Flash or FlashX (iteracompute, Privatemode AI, SiliconFlow, Volcengine, ZenMux, Zhipu AI), while GitHub Copilot moves from GPT-6 Astra to Grok 4.7 and StepFun to Step 5 Preview. If you use one of those providers without pinning a model, expect a different default

Full Changelog: sdk/sdk/v0.0.83...sdk/sdk/v0.0.84