fix(wrap): route Cline custom upstreams

[JerrettDavis]

Description

Route Cline CLI requests for custom OpenAI-compatible providers back to the provider's original upstream instead of falling through to OpenAI. The wrapper now supports Cline's official CLI configuration flow as well as the VS Code extension.

Closes #1626

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Performance improvement
• Code refactoring (no functional changes)

Changes Made

• Add --openai-api-url to headroom wrap cline so the proxy retains the original custom-provider route.
• Print the official Cline CLI partial-auth command that changes only its base URL to Headroom while retaining the existing key and model.
• Keep the extension setup path and default OpenAI routing unchanged.
• Add regression coverage for upstream forwarding, actual fallback ports, and option ownership.
• Make the native-TLS release guard distinguish an unavailable Cargo tree from a dependency that is actually present, matching the adjacent OpenSSL guard.

Testing

• Unit tests pass (pytest)
• Linting passes (ruff check .)
• Type checking passes (mypy headroom)
• New tests added for new functionality
• Manual testing performed

Test Output

uv run pytest -q tests/test_cli
675 passed, 1 skipped in 10.70s

uv run pytest -q tests/test_cli/test_wrap_cline.py tests/test_cli/test_wrap_helpers.py
56 passed in 0.79s

uv run ruff check headroom/cli/wrap.py tests/test_cli/test_wrap_cline.py
All checks passed!

uv run ruff format --check headroom/cli/wrap.py tests/test_cli/test_wrap_cline.py
2 files already formatted

uv run mypy headroom/cli/wrap.py
Success: no issues found

pytest -q tests/test_release_workflows.py::test_no_native_tls_in_wheel_build_tree tests/test_release_workflows.py::test_no_openssl_in_wheel_build_tree
2 passed, 44 deselected in 0.82s

Real Behavior Proof

• Environment: macOS, Python 3.12, current origin/main at 2d88e31a4.
• Exact command / steps: invoke headroom wrap cline --openai-api-url https://api.example.com/v1 with the proxy watcher captured at fallback port 9123.
• Observed result: the watcher receives https://api.example.com/v1 as openai_api_url, and Cline is instructed to use http://127.0.0.1:9123/v1 while retaining its configured key and model.
• Not tested: a live request against a third-party provider because no provider credential is available in CI.

Runtime Rollout Safety

• Rollout-managed feature(s): none.
• Minimum rollout channel: stable.
• Stable/default behavior changed: only when --openai-api-url is explicitly supplied; the default route is unchanged.
• Kill switch / disable path: omit --openai-api-url to retain the previous default OpenAI route.
• Unsafe override required: no.
• Qualification impact: adds isolated wrapper CLI tests and hardens an existing release-tree assertion; no proxy pipeline or dependency changes.
• Rollback path: fix forward in the Cline option/routing path while retaining custom-upstream support; do not remove the route and recreate [BUG] Headroom cline cli doesnt work #1626.

Review Readiness

• I have performed a self-review
• This PR is ready for human review

Checklist

• My code follows the project's style guidelines
• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• I did not edit CHANGELOG.md — it is generated by release-please from my Conventional Commit PR title (a CI guard enforces this)

Screenshots (if applicable)

Not applicable; this is a terminal routing change.

Additional Notes

The full no-duration local shard exposed two pre-existing dependency-gate test-order failures after 2,873 passing tests. The focused and complete CLI suites are green; this PR remains draft until its exact hosted head is entirely green.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

❌ Patch coverage is 87.50000% with 1 line in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
headroom/cli/wrap.py	87.50%	0 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!

[github-actions]

PR governance

This PR follows the template and is marked ready for human review.