@@ -1,5 +1,21 @@
 # Changelog
 
+## 0.24.0
+
+- Vendor CLI agent backends: spawn the official Claude, Codex, or Grok CLI in a
+  trusted workspace. ShadowCode never reads, stores, or proxies vendor OAuth
+  tokens. Login remains `claude auth login`, `codex login`, and `grok login`.
+- Codex uses `codex app-server` JSON-RPC, with `codex exec --json` only when
+  app-server is unavailable. Grok uses ACP (`grok agent stdio`). Claude uses
+  headless stream-json. Vendor tools and sandbox stay with the vendor; Pause
+  and Steer interrupt and follow up. Rewind does not apply.
+- Doctor reports not installed / not logged in / ready without printing
+  credentials. The model picker groups local vs vendor agents; knobs live in
+  Settings → Advanced, including a Claude adapter disable flag.
+- Anthropic policy note: third-party clients may not use Pro/Max OAuth tokens
+  directly (enforced 2026); driving the official `claude` binary with the
+  user's login is currently tolerated but not guaranteed.
+
 ## 0.23.0
 
 - Verification gate: the last test/build/lint command decides. A deliberately
 
@@ -4,7 +4,7 @@ default-members = ["native/core"]
 resolver = "2"
 
 [workspace.package]
-version = "0.23.0"
+version = "0.24.0"
 edition = "2021"
 rust-version = "1.95"
 license = "MIT"
 
@@ -1,6 +1,6 @@
 # ShadowCode
 
-![version](https://img.shields.io/badge/version-0.23.0-386c51) ![Rust](https://img.shields.io/badge/runtime-Rust%201.95-orange) ![license](https://img.shields.io/badge/license-MIT-green)
+![version](https://img.shields.io/badge/version-0.24.0-386c51) ![Rust](https://img.shields.io/badge/runtime-Rust%201.95-orange) ![license](https://img.shields.io/badge/license-MIT-green)
 
 **Your ideas. Your models. Your machine.**
 
@@ -10,7 +10,7 @@ context, tools, permissions, checkpoints, plans, and verification.
 
 ![ShadowCode workspace](docs/images/workspace-light.png)
 
-**Native 0.23 release:** the `main` branch builds a Rust/Tauri desktop window
+**Native 0.24 release:** the `main` branch builds a Rust/Tauri desktop window
 with the interface embedded in the executable. It needs no Python runtime or
 browser launcher. See the [native desktop guide](docs/NATIVE_DESKTOP.md)
 and the [goals](docs/NATIVE_GOALS.md) and [model routing](docs/NATIVE_ROUTING.md)
@@ -25,6 +25,7 @@ workflows, [managed background processes and model tools](docs/NATIVE_BACKGROUND
 [approved MCP stdio and HTTP tools](docs/NATIVE_MCP.md), a
 [native MCP stdio and authenticated HTTP server](docs/NATIVE_MCP.md#connect-another-coding-tool-to-shadowcode)
 with Codex/Claude Code/Cursor registration output, and a
+[vendor Claude / Codex / Grok CLI backends](docs/NATIVE_CLI_BACKENDS.md),
 [native CLI](docs/NATIVE_CLI.md) and [terminal interface](docs/NATIVE_TUI.md)
 that share the active desktop engine or run headlessly with their own profile.
 The [native desktop can also attach](docs/NATIVE_DESKTOP.md#attaching-to-a-running-engine)
@@ -35,16 +36,16 @@ Integrations and release checks are tracked under the [release gates](docs/NATIV
 
 ## Native AppImage
 
-Download the `v0.23.0` **x86_64 AppImage**
+Download the `v0.24.0` **x86_64 AppImage**
 and its `SHA256SUMS` file from [GitHub releases](https://github.com/Shadowfetchapps/ShadowCode/releases/latest).
 The native application embeds its interface; Python, Node.js and a browser
 launcher are not runtime dependencies. The release targets **Ubuntu 24.04 or
 newer / glibc 2.39+**. Git and a model provider such as Ollama remain external.
 
 ```bash
 sha256sum --ignore-missing -c SHA256SUMS
-chmod +x ShadowCode_0.23.0_amd64.AppImage
-./ShadowCode_0.23.0_amd64.AppImage --appimage-extract-and-run
+chmod +x ShadowCode_0.24.0_amd64.AppImage
+./ShadowCode_0.24.0_amd64.AppImage --appimage-extract-and-run
 ```
 
 Extraction mode works without FUSE. To install into `~/Applications`, add a
@@ -53,14 +54,20 @@ stable `shadow` and `shadowcode` commands, and replace the desktop launcher:
 ```bash
 git clone https://github.com/Shadowfetchapps/ShadowCode.git
 cd ShadowCode
-./scripts/install-appimage.sh /path/to/ShadowCode_0.23.0_amd64.AppImage
+./scripts/install-appimage.sh /path/to/ShadowCode_0.24.0_amd64.AppImage
 ```
 
 Keep `SHA256SUMS` beside the download and the installer verifies its matching
 entry automatically. It replaces older ShadowCode AppImages only after the new
 executable starts, preserves settings, keys, memory and task history, and refuses
 a changed download before it can alter the installed application.
 
+## Native 0.24 highlights
+
+- **Vendor CLI agents.** Run Claude, Codex, or Grok by spawning the official
+  CLI. ShadowCode never reads those OAuth tokens. See
+  [vendor CLI backends](docs/NATIVE_CLI_BACKENDS.md).
+
 ## Native 0.23 highlights
 
 - **A focused workspace.** Persistent projects and tasks, search, pinned tasks,
 
@@ -115,6 +115,14 @@ Protect the user account and filesystem accordingly. The configured model
 provider receives the task context sent by the harness. Cloud providers may
 therefore receive project content; local providers keep inference on the machine.
 
+Vendor CLI backends (Claude, Codex, Grok) spawn the official CLI after the user
+logs in with that vendor. ShadowCode holds no vendor credentials and never
+reads `~/.codex/auth.json`, `~/.grok/auth.json`, or Claude credential files.
+Anthropic forbids third-party clients from using Pro/Max OAuth tokens directly
+(enforced 2026); driving the official `claude` binary with the user's own login
+is currently tolerated but not guaranteed. See
+[vendor CLI backends](docs/NATIVE_CLI_BACKENDS.md).
+
 The UI renders Markdown without executing raw HTML. It does not automatically
 load remote images embedded in model responses. Only fragment links and
 absolute `http`/`https` URLs without embedded credentials stay clickable;
 
@@ -0,0 +1,93 @@
+# Vendor CLI agent backends
+
+ShadowCode can run a coding task by spawning the official Claude, Codex, or
+Grok CLI in a trusted workspace. In this mode the **vendor agent** owns the
+loop, its tools, and its sandbox. ShadowCode is the workspace, transcript,
+review, approval, and steering shell.
+
+This is distinct from a **local model (ShadowCode agent)**, where ShadowCode
+calls an OpenAI-compatible or Ollama HTTP API and injects its own tools.
+
+ShadowCode **never** reads, stores, proxies, or re-implements vendor OAuth
+tokens. Login is always:
+
+| Vendor | Login |
+| --- | --- |
+| Codex | `codex login` |
+| Grok | `grok login` |
+| Claude | `claude auth login` |
+
+Doctor only checks that the binary is on `PATH` and that a login *marker*
+exists (`~/.codex/auth.json`, `~/.grok/auth.json`, `~/.claude/.credentials.json`,
+or `claude auth status --json` → `loggedIn`). Credential contents are never
+opened, logged, or shown.
+
+## Adapters
+
+### Codex
+
+Primary: `codex app-server` — JSON-RPC 2.0 over stdio (`initialize` →
+`thread/start` → `turn/start`, streamed `item/*` notifications, approval
+requests such as `item/commandExecution/requestApproval`).
+
+Fallback: `codex exec --json` only when `app-server` is unavailable (unknown
+subcommand or missing help). Exec has no approval channel.
+
+References: [OpenAI Codex docs](https://developers.openai.com/codex),
+[openai/codex](https://github.com/openai/codex), and the T3 Code provider
+notes at
+[docs/internals/providers.md](https://github.com/pingdotgg/t3code/blob/main/docs/internals/providers.md).
+
+### Grok
+
+`grok agent stdio` speaks the [Agent Client Protocol](https://agentclientprotocol.com)
+(JSON-RPC over stdio). ShadowCode declares no `fs` / `terminal` client
+capabilities, so Grok performs its own I/O. See [xAI build docs](https://docs.x.ai/build).
+
+### Claude
+
+`claude -p --output-format stream-json --input-format stream-json --verbose --include-partial-messages --permission-prompts host`
+([Claude Code headless](https://code.claude.com/docs/en/headless)).
+Permission prompts become ShadowCode Allow/Deny cards.
+
+**Policy:** Anthropic forbids third-party clients from using Pro/Max OAuth
+tokens directly (enforced 2026). Driving the official `claude` binary with the
+user's own login is currently tolerated but not guaranteed. Settings → Advanced
+has `cli_agents.claude_enabled` to disable the adapter.
+
+## What ShadowCode does and does not do
+
+- Maps vendor text, tool start/finish, file-change reports, results, and errors
+  into the existing transcript.
+- Routes vendor permission prompts through the existing Allow/Deny flow.
+- Cancels by killing the child **process group**.
+- Applies the same redaction used for ShadowCode tool output.
+- Does **not** inject ShadowCode tools or bubblewrap into the vendor process.
+- **Pause / Steer** = interrupt the vendor turn (where the protocol supports it)
+  and send a follow-up prompt on Resume.
+- **Rewind does not apply.** Vendor CLIs write files with their own tools;
+  ShadowCode file-tool checkpoints do not cover those edits. Use Git or the
+  vendor CLI to undo.
+
+## Doctor states
+
+Each vendor reports one of:
+
+- `not_installed` — binary not on `PATH`
+- `not_logged_in` — installed, no login marker
+- `ready` — installed and login detected
+- `disabled` — turned off in Settings → Advanced
+
+## Settings
+
+Knobs live only in **Settings → Advanced**:
+
+- Enable vendor CLI backends
+- Enable Claude adapter
+- Binary names/paths
+- Approval and stall timeouts
+
+The composer model picker lists vendor backends under
+**Claude / Codex / Grok (vendor agent)** and local HTTP models under
+**Local model (ShadowCode agent)**. A Doctor status chip shows the three
+install/login states.
@@ -140,8 +140,8 @@ From the repository root, build both package formats with:
 ```sh
 node scripts/build-native.mjs
 node scripts/check-native-package.mjs \
-  target/release/bundle/appimage/ShadowCode_0.23.0_amd64.AppImage \
-  target/release/bundle/deb/ShadowCode_0.23.0_amd64.deb
+  target/release/bundle/appimage/ShadowCode_0.24.0_amd64.AppImage \
+  target/release/bundle/deb/ShadowCode_0.24.0_amd64.deb
 node scripts/test-native-runtime.mjs
 node --test scripts/test-native-source-fetch.mjs
 node scripts/test-native-runtime-sources.mjs
 
@@ -1,3 +1,23 @@
+ShadowCode 0.24.0 adds vendor CLI agent backends. You can run Claude, Codex, or
+Grok subscriptions by spawning the official CLI. ShadowCode never reads or
+stores those OAuth tokens.
+
+- **Codex:** `codex app-server` JSON-RPC, falling back to `codex exec --json`
+  only when app-server is unavailable.
+- **Grok:** `grok agent stdio` (Agent Client Protocol).
+- **Claude:** headless stream-json. Anthropic forbids third-party use of
+  Pro/Max OAuth tokens directly (enforced 2026); the official binary with the
+  user's own login is currently tolerated but not guaranteed.
+- Doctor, picker, and Settings → Advanced knobs. Rewind does not apply to
+  vendor-agent tasks.
+
+Downloads: `ShadowCode_0.24.0_amd64.AppImage`, `ShadowCode_0.24.0_amd64.deb`,
+the AppImage runtime source archive, and `SHA256SUMS`. Binaries target x86_64,
+Ubuntu 24.04+ / glibc 2.39+. Git and model providers such as Ollama remain
+external. Vendor CLIs are optional and are never bundled.
+
+---
+
 ShadowCode 0.23.0 hardens the verification gate, live steering and parallel
 workspace recovery. The Rust/Tauri app embeds its interface and needs no Python
 or Node runtime.
 
@@ -1,13 +1,13 @@
 # Native release procedure
 
-This procedure publishes the Rust/Tauri 0.23 application. The tag workflow is
+This procedure publishes the Rust/Tauri 0.24 application. The tag workflow is
 the release authority: it does not build, upload, or mention the legacy Python
 wheel, source distribution, portable archive, or browser launcher.
 
 ## Prepare the release
 
 1. Update the shared version in `Cargo.toml` and `src-tauri/tauri.conf.json`.
-   They must match the tag exactly, for example `v0.23.0`.
+   They must match the tag exactly, for example `v0.24.0`.
 2. Update `CHANGELOG.md`, `docs/RELEASE_NOTES.md`, README download commands and
    native migration/verification records with only evidence that is current for
    the tagged commit.
 
@@ -1,6 +1,6 @@
 # ShadowCode user guide
 
-This guide covers the supported 0.23 native release. The desktop, CLI, terminal
+This guide covers the supported 0.24 native release. The desktop, CLI, terminal
 interface, and integrations use the same Python-free Rust engine. See the
 [native desktop](NATIVE_DESKTOP.md), [native CLI](NATIVE_CLI.md), and
 [release gates](NATIVE_MIGRATION.md) guides for platform and integration details.
@@ -82,6 +82,13 @@ tool timeout before the worker exits.
 
 ## Models, settings, and goals
 
+The model selector groups **Local model (ShadowCode agent)** HTTP models and
+**Claude / Codex / Grok (vendor agent)** official CLIs. Vendor login stays with
+`claude auth login`, `codex login`, or `grok login`; ShadowCode never reads those
+credentials. Pause/Steer interrupts the vendor process and sends a follow-up.
+**Rewind does not apply** to vendor-agent tasks. Details:
+[vendor CLI backends](NATIVE_CLI_BACKENDS.md).
+
 The model selector accepts detected or configured models and a custom model ID.
 Settings covers provider connection, permissions, appearance, notifications,
 hooks, MCP, and plugins. API keys remain separate from YAML. Browser notifications