Cline v4.1.3 リリースCline Releases v4.1.3

Cline has released version 4.1.3, a maintenance update that resolves an authentication bug in which two bundles from a combined rollout package could invalidate each other's account session. For users of the AI coding assistant, the fix matters because the underlying fault produced spurious authentication errors that could interrupt work without an obvious cause.

The problem stemmed from how account sessions were handled during a transition between extension bundles. Cline appears to have shipped a combined rollout package containing two bundles—likely a legacy build and a newer one—so that a machine could be gradually promoted from the old extension to the new one. Both bundles drew on the same shared refresh token to keep an account signed in.

The trouble arose when a legacy window remained open after the machine had already been promoted to the new extension. According to the release notes, that still-open legacy window would refresh its token and, in doing so, consume the shared refresh token. Because the token was shared, the newer extension's session was left holding an invalidated credential, producing spurious authentication errors—reported as unauthorized-style messages—even though the user's account itself was valid.

To understand why a single stale window could break sign-in, it helps to know how token-based authentication typically works. Many services issue a short-lived access token alongside a longer-lived refresh token. When the access token expires, the client presents the refresh token to obtain a new one. A common security practice called refresh token rotation invalidates the old refresh token each time it is used and issues a replacement. If two processes share one refresh token and both try to rotate it, the first to redeem it wins, and the second is left holding a token the server no longer recognizes—exactly the kind of race condition the release describes.

Version 4.1.3 addresses this by stopping the two bundles from invalidating each other's session. The release is categorized as a bug fix rather than a feature update, and the practical effect is that users who were mid-migration—running both a legacy window and the promoted extension at the same time—should no longer be signed out unexpectedly or see the erroneous authentication messages.

Cline is an open-source AI coding agent that runs inside editors such as Visual Studio Code, where it can read and edit files, run commands, and work through multi-step tasks under user supervision. Account-based sign-in underpins hosted features and billing, so a broken session does more than inconvenience users; it can block access to model providers routed through the account. That elevates a session-handling defect from a cosmetic annoyance to something that can halt an active coding session.

Staged or combined rollouts are common for widely deployed extensions because they let maintainers move users onto a new codebase incrementally while keeping a fallback in place. The tradeoff is that overlapping installations can share state—here, a single refresh token—in ways that create edge cases. Bugs of this kind tend to surface only for the subset of users who keep multiple editor windows open across an update, which likely explains why the issue was intermittent and difficult to reproduce.

Users who encountered unexplained authentication failures during the migration should update to 4.1.3 and, if problems persist, sign out and back in to force a clean token exchange. Because the release is narrowly scoped to the session-invalidation defect, it is unlikely to alter other behavior, and there is no indication that it changes pricing, supported platforms, or the rollout plan itself. As with any authentication-related change, users running the extension in shared or multi-window setups are the most likely to notice the improvement, while single-window users may see no visible difference beyond a more reliable sign-in experience.