Delegate bounded coding tasks to Cline agent and review diffs

Acts as an orchestrator that delegates a bounded coding task to a separate implementer, the Cline coding-agent CLI, then reviews what it produced and lands it itself: the orchestrator writes the brief and owns the judgment, the implementer makes changes in its own session in a clean working tree, and the orchestrator verifies and commits. The loop only needs a shell command and file access, so any comparable orchestrator can drive it. It skips tasks small enough to do inline where delegation overhead isn't worth it, cases where the cline CLI isn't installed or authenticated, and any requirement that the relay itself configure a sandbox, since Cline exposes sandbox controls but this relay leaves them to the CLI environment, using --plan instead when a run must stay read-only.

Prerequisites, checked once: installing cline via npm or a bundled binary (the relay probes cline --version); authenticating via cline auth interactive sign-in, or configuring ANTHROPIC_API_KEY or an OpenAI-compatible base URL; confirming cline --version succeeds; and working in, or pointing --cd at, the target git repository. Choosing a model is optional, Cline picks a default, but --model <id> or --provider <name> (such as anthropic, openai-native, or openrouter) can override it, with the relay restricting that value to letters, digits, and . _ : / - since it reaches a shell on Windows.

The loop runs five steps per task, of which writing the brief, reviewing, and landing require judgment while dispatching and waiting are mechanical. Writing the brief matters because Cline sees only the text sent and cannot read the orchestrator's conversation, so the brief must stand alone with the goal, current state, what to change, what to leave untouched, the project's real gates, and a report contract, kept to a single task per brief, written to a file and passed via the relay's --brief flag (structure detailed in references/writing-the-brief.md). Dispatch uses the bundled relay:

node "<skill-dir>/scripts/relay.mjs" --brief brief.txt --cd /path/to/repo

which runs cline --json -v, streams the brief on stdin behind a fixed positional instruction, captures the JSON event stream, and writes result.json; options add a model or provider choice, a read-only planning pass via --plan (which forces --auto-approve false), explicitly denying approval-required tools via --auto-approve false, and a watchdog timeout (the 30-minute default suits brief runs, with most implementation briefs better served by 1-2 hours). The child process's working directory pins the workspace, and the relay writes artifacts under the system temp directory by default and never commits (detailed in references/dispatch-and-poll.md).

Waiting for completion blocks until cline finishes, either through the orchestrator's background-command facility or by backgrounding it in the shell and polling for result.json; a pre-run usage error exits 2 with no result written, and a missing cline exits 127 with status: "cline_unavailable". Completion means the process exited and result.json exists, trusting process state and the working tree rather than any progress display, with Cline's final message available as the finalMessage field of result.json.

Review never trusts the self-report: the project's actual gates are re-run independently, the diff against the brief is read starting with touchedFiles, and any installed guard skills are run (checklist in references/review-and-land.md). Landing commits the work only if it's good, since the relay itself never commits, the diff and result.json are the record, and git status/git diff confirm exactly what changed before committing; if the group has a PR flow, the commit is pushed to a branch for human review, and if the diff is wrong or incomplete, a corrected brief is re-dispatched in a fresh run and reviewed again rather than patched in place.

Autonomy and permissions center on Cline's own --auto-approve flag, which the relay explicitly passes and which defaults to true in act mode; since Cline's plan mode can request a switch to act mode, --plan forces --auto-approve false, and the relay rejects the combination --plan --auto-approve true outright, making that pair the read-only gate. Cline also exposes a sandbox through --data-dir/CLINE_SANDBOX, but the relay does not configure or override it. The recommended pattern is plan-first for anything risky, reviewing the plan before a separate act-mode dispatch, since malformed or malicious briefs remain dangerous in act mode because commands run as the current user.

The authorization model treats delegation as something the human opts into: once briefed, cline works as an approved tool, but conclusions from its self-report are never accepted without verifying everything on disk, and anything touching credentials, production data, or irreversible operations stops for the human to decide first rather than being encoded into a brief.

Use it when a human explicitly asks for delegation of a bounded coding task to a separate Cline implementer that the orchestrator will review and land. Skip it for tasks small enough to do inline, when the cline CLI isn't installed or authenticated, or when the task requires the relay itself to configure a sandbox rather than relying on --plan for a read-only pass.

Input is a self-contained brief (goal, current state, what to change, what to leave untouched, real gates, report contract) plus the target repository path. Output is a result.json artifact with finalMessage and touchedFiles, plus the implementer's diff for the orchestrator to independently verify and, if it holds, commit.

Dispatches to a separate cline CLI session via scripts/relay.mjs, configured through ANTHROPIC_API_KEY or an OpenAI-compatible provider; references its own references/writing-the-brief.md, references/dispatch-and-poll.md, references/review-and-land.md, and references/multi-task-queues.md.

An orchestrating agent or human that wants to delegate a bounded coding task to an isolated Cline implementer while keeping independent review and commit authority.