chore(main): release 0.37.0 (#690)

🤖 I have created a release *beep* *boop*
---


##
[0.37.0](https://github.com/agentclientprotocol/claude-agent-acp/compare/v0.36.1...v0.37.0)
(2026-05-21)


### Features

* add 'Default' option to effort level config
([#701](https://github.com/agentclientprotocol/claude-agent-acp/issues/701))
([9e259d1](9e259d128a))
* **deps:** bump the claude-agent-sdk to 0.3.146
([#700](https://github.com/agentclientprotocol/claude-agent-acp/issues/700))
([72875b2](72875b248c))
* **deps:** bump the minor group with 13 updates
([#689](https://github.com/agentclientprotocol/claude-agent-acp/issues/689))
([f66bc31](f66bc31ae4))
* Emit tool calls for memory recall events
([#703](https://github.com/agentclientprotocol/claude-agent-acp/issues/703))
([a0bfb98](a0bfb98ba7)),
closes
[#650](https://github.com/agentclientprotocol/claude-agent-acp/issues/650)


### Bug Fixes

* Avoid cross-version model alias matches
([#702](https://github.com/agentclientprotocol/claude-agent-acp/issues/702))
([e1e1c69](e1e1c69029))
* Avoid redundant initial model sync
([#704](https://github.com/agentclientprotocol/claude-agent-acp/issues/704))
([b275f6f](b275f6ff7f)),
closes
[#646](https://github.com/agentclientprotocol/claude-agent-acp/issues/646)
* Don't expose /clear in commands
([#705](https://github.com/agentclientprotocol/claude-agent-acp/issues/705))
([cfce130](cfce130707))
* emit "cancelled" instead of "end_turn" when the session was
interrupted.
([#694](https://github.com/agentclientprotocol/claude-agent-acp/issues/694))
([2414a6f](2414a6f98b))
* Recover prompt stream after a failed turn
([#706](https://github.com/agentclientprotocol/claude-agent-acp/issues/706))
([2711f50](2711f506d5)),
closes
[#654](https://github.com/agentclientprotocol/claude-agent-acp/issues/654)

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: acp-release-bot[bot] <246668977+acp-release-bot[bot]@users.noreply.github.com>

.github/dependabot.yml

@@ -0,0 +1,18 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      # Check for updates to GitHub Actions every week
+      interval: "weekly"
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    allow:
+      - dependency-type: "all"
+    groups:
+      minor:
+        update-types:
+          - "minor"
+          - "patch"

.github/workflows/ci.yml

@@ -21,12 +21,12 @@ jobs:
     timeout-minutes: 5
 
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
 
       - name: Use Node.js
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
         with:
-          node-version: latest
+          node-version: "lts/*"
           cache: "npm"
 
       - name: Install dependencies

.github/workflows/publish.yml

@@ -1,19 +1,52 @@
-name: Publish Package to npmjs
+name: Publish and Release
 on:
   push:
-    tags:
-      - "v*.*.*"
+    branches:
+      - main
+
 jobs:
-  publish-npm:
+  release-please:
     runs-on: ubuntu-latest
     environment: release # Optional: for enhanced security
+    permissions:
+      contents: write
+      issues: write
+      pull-requests: write
+    steps:
+      # Generating a GitHub token, so that PRs and tags created by
+      # the release-please-action can trigger actions workflows.
+      - name: Generate GitHub token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
+        id: generate-token
+        with:
+          # GitHub App ID secret name
+          app-id: ${{ secrets.RELEASE_PLZ_APP_ID }}
+          # GitHub App private key secret name
+          private-key: ${{ secrets.RELEASE_PLZ_APP_PRIVATE_KEY }}
+      - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7
+        id: release
+        with:
+          token: ${{ steps.generate-token.outputs.token }}
+          release-type: node
+          config-file: release-please-config.json
+          manifest-file: .release-please-manifest.json
+    outputs:
+      release_created: ${{ steps.release.outputs.release_created }}
+      tag_name: ${{ steps.release.outputs.tag_name }}
+
+  publish-npm:
+    name: Publish to npm
+    runs-on: ubuntu-latest
+    needs: [release-please]
+    if: ${{ needs.release-please.outputs.release_created }}
+    environment: release # Optional: for enhanced security
     permissions:
       contents: read
       id-token: write
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
       # Setup .npmrc file to publish to npm
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
         with:
           node-version: "lts/*"
           registry-url: "https://registry.npmjs.org"
@@ -22,15 +55,3 @@ jobs:
       - run: npm ci
       - run: npm run build
       - run: npm publish
-  release:
-    runs-on: ubuntu-latest
-    needs: [publish-npm]
-    permissions:
-      contents: write
-    steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
-      - name: Create Release
-        id: create_release
-        uses: softprops/action-gh-release@6da8fa9354ddfdc4aeace5fc48d7f679b5214090
-        with:
-          generate_release_notes: true

.prettierignore

@@ -0,0 +1,7 @@
+node_modules
+dist
+.agent-shell
+
+.release-please-manifest.json
+release-please-config.json
+CHANGELOG.md

.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.37.0"
+}

CHANGELOG.md

@@ -1,5 +1,357 @@
 # Changelog
 
+## [0.37.0](https://github.com/agentclientprotocol/claude-agent-acp/compare/v0.36.1...v0.37.0) (2026-05-21)
+
+
+### Features
+
+* add 'Default' option to effort level config ([#701](https://github.com/agentclientprotocol/claude-agent-acp/issues/701)) ([9e259d1](https://github.com/agentclientprotocol/claude-agent-acp/commit/9e259d128aa58dbb8107e53362781ca4e8ee071e))
+* **deps:** bump the claude-agent-sdk to 0.3.146 ([#700](https://github.com/agentclientprotocol/claude-agent-acp/issues/700)) ([72875b2](https://github.com/agentclientprotocol/claude-agent-acp/commit/72875b248c7b90a89638de2f1709eec9e2153e7e))
+* **deps:** bump the minor group with 13 updates ([#689](https://github.com/agentclientprotocol/claude-agent-acp/issues/689)) ([f66bc31](https://github.com/agentclientprotocol/claude-agent-acp/commit/f66bc31ae4bea73b48eeeb7f1db90c7d69cc0dac))
+* Emit tool calls for memory recall events ([#703](https://github.com/agentclientprotocol/claude-agent-acp/issues/703)) ([a0bfb98](https://github.com/agentclientprotocol/claude-agent-acp/commit/a0bfb98ba73eaf37e9c071e886c054f90a5d5629)), closes [#650](https://github.com/agentclientprotocol/claude-agent-acp/issues/650)
+
+
+### Bug Fixes
+
+* Avoid cross-version model alias matches ([#702](https://github.com/agentclientprotocol/claude-agent-acp/issues/702)) ([e1e1c69](https://github.com/agentclientprotocol/claude-agent-acp/commit/e1e1c69029ef08579c841e6fbdffb32a5b94df06))
+* Avoid redundant initial model sync ([#704](https://github.com/agentclientprotocol/claude-agent-acp/issues/704)) ([b275f6f](https://github.com/agentclientprotocol/claude-agent-acp/commit/b275f6ff7f0f2e21adedbd8e63a6fc3d63cbbb8d)), closes [#646](https://github.com/agentclientprotocol/claude-agent-acp/issues/646)
+* Don't expose /clear in commands ([#705](https://github.com/agentclientprotocol/claude-agent-acp/issues/705)) ([cfce130](https://github.com/agentclientprotocol/claude-agent-acp/commit/cfce1307076e93f43a3ed8cc0134f9bb14a0f2d6))
+* emit  "cancelled" instead of "end_turn" when the session was interrupted. ([#694](https://github.com/agentclientprotocol/claude-agent-acp/issues/694)) ([2414a6f](https://github.com/agentclientprotocol/claude-agent-acp/commit/2414a6f98bec5bf50f3a13af528aa38d5a0fc974))
+* Recover prompt stream after a failed turn ([#706](https://github.com/agentclientprotocol/claude-agent-acp/issues/706)) ([2711f50](https://github.com/agentclientprotocol/claude-agent-acp/commit/2711f506d5799f0ae25160de311a4459ffb46c49)), closes [#654](https://github.com/agentclientprotocol/claude-agent-acp/issues/654)
+
+## [0.36.1](https://github.com/agentclientprotocol/claude-agent-acp/compare/v0.36.0...v0.36.1) (2026-05-18)
+
+
+### Bug Fixes
+
+* flaky authentication bypass for gateway ([#686](https://github.com/agentclientprotocol/claude-agent-acp/issues/686)) ([db852dc](https://github.com/agentclientprotocol/claude-agent-acp/commit/db852dcf7c8e3b461fabb1bdcf0c80a27d1da77d))
+
+## [0.36.0](https://github.com/agentclientprotocol/claude-agent-acp/compare/v0.35.0...v0.36.0) (2026-05-18)
+
+
+### Features
+
+* Add experimental session delete support ([#682](https://github.com/agentclientprotocol/claude-agent-acp/issues/682)) ([2162d5a](https://github.com/agentclientprotocol/claude-agent-acp/commit/2162d5af62d493a82381bd88bc8fc67d376e358b))
+* Support experimental additionalDirectories field ([#684](https://github.com/agentclientprotocol/claude-agent-acp/issues/684)) ([f37e9a0](https://github.com/agentclientprotocol/claude-agent-acp/commit/f37e9a0d47d8d201d98b2177083664a6781895cc))
+
+## [0.35.0](https://github.com/agentclientprotocol/claude-agent-acp/compare/v0.34.1...v0.35.0) (2026-05-16)
+
+
+### Features
+
+* **deps:** bump actions/create-github-app-token from 3.1.1 to 3.2.0 ([#669](https://github.com/agentclientprotocol/claude-agent-acp/issues/669)) ([47df1f2](https://github.com/agentclientprotocol/claude-agent-acp/commit/47df1f2a0be57ddb8873ae8e341f748471c7bc53))
+* **deps:** bump hono from 4.12.18 to 4.12.19 in the minor group ([#671](https://github.com/agentclientprotocol/claude-agent-acp/issues/671)) ([5d7165d](https://github.com/agentclientprotocol/claude-agent-acp/commit/5d7165d96158da2ddf3087676cdb0a19d1ff57aa))
+* **deps:** update to claude-agent-sdk 0.3.143 ([#664](https://github.com/agentclientprotocol/claude-agent-acp/issues/664)) ([27ca2e5](https://github.com/agentclientprotocol/claude-agent-acp/commit/27ca2e5d40917887671cc4c39a854fd8f92c01e6))
+* Use SDK settings resolution for defaults ([#677](https://github.com/agentclientprotocol/claude-agent-acp/issues/677)) ([eb1259c](https://github.com/agentclientprotocol/claude-agent-acp/commit/eb1259cf88375ca3c20a219ab99f12f5488fb360))
+
+
+### Bug Fixes
+
+* Add task hooks for plan state updates ([#676](https://github.com/agentclientprotocol/claude-agent-acp/issues/676)) ([5ff7d50](https://github.com/agentclientprotocol/claude-agent-acp/commit/5ff7d50f0ec7f34a7d9d901223aed73e2dbcce68))
+* render local-command-stdout messages instead of dropping them ([#649](https://github.com/agentclientprotocol/claude-agent-acp/issues/649)) ([3b9b7d5](https://github.com/agentclientprotocol/claude-agent-acp/commit/3b9b7d5a56defd925eb2038fa97b6484ad951587))
+
+## [0.34.1](https://github.com/agentclientprotocol/claude-agent-acp/compare/v0.34.0...v0.34.1) (2026-05-16)
+
+
+### Bug Fixes
+
+* load credential error for bedrock gateway ([#667](https://github.com/agentclientprotocol/claude-agent-acp/issues/667)) ([8d76be3](https://github.com/agentclientprotocol/claude-agent-acp/commit/8d76be356a3e74c58a7c93c3c201cca6a317d784))
+
+## [0.34.0](https://github.com/agentclientprotocol/claude-agent-acp/compare/v0.33.1...v0.34.0) (2026-05-15)
+
+
+### Features
+
+* add bedrock gateway authentication ([#665](https://github.com/agentclientprotocol/claude-agent-acp/issues/665)) ([002c63a](https://github.com/agentclientprotocol/claude-agent-acp/commit/002c63a78b844c168d3dfc744cf408362a6adf97))
+
+## [0.33.1](https://github.com/agentclientprotocol/claude-agent-acp/compare/v0.33.0...v0.33.1) (2026-05-07)
+
+
+### Bug Fixes
+
+* Honor availableModels settings allowlist ([#637](https://github.com/agentclientprotocol/claude-agent-acp/issues/637)) ([867a3a0](https://github.com/agentclientprotocol/claude-agent-acp/commit/867a3a0de2a050592d79aa76d7dd3dd5b478162d)), closes [#620](https://github.com/agentclientprotocol/claude-agent-acp/issues/620)
+
+## [0.33.0](https://github.com/agentclientprotocol/claude-agent-acp/compare/v0.32.0...v0.33.0) (2026-05-07)
+
+
+### Features
+
+* **deps:** bump the minor group with 14 updates ([#631](https://github.com/agentclientprotocol/claude-agent-acp/issues/631)) ([8b43ee8](https://github.com/agentclientprotocol/claude-agent-acp/commit/8b43ee813f05f5087a213a7f42154e39d6bc4a5a))
+* **deps:** Update to claude-agent-sdk 0.2.132 ([#636](https://github.com/agentclientprotocol/claude-agent-acp/issues/636)) ([0c8ff27](https://github.com/agentclientprotocol/claude-agent-acp/commit/0c8ff277f2af8d3085cc1b5cf33891630dede0b1))
+
+
+### Bug Fixes
+
+* Handle result origins in ACP agent ([#627](https://github.com/agentclientprotocol/claude-agent-acp/issues/627)) ([dba1998](https://github.com/agentclientprotocol/claude-agent-acp/commit/dba199839a25ba405f04b9d4409e647150fe0290))
+
+## [0.32.0](https://github.com/agentclientprotocol/claude-agent-acp/compare/v0.31.4...v0.32.0) (2026-05-03)
+
+
+### Features
+
+* **deps-dev:** Bump nanoid from 3.3.11 to 3.3.12 ([#622](https://github.com/agentclientprotocol/claude-agent-acp/issues/622)) ([c78ac62](https://github.com/agentclientprotocol/claude-agent-acp/commit/c78ac62d05283e5683b87b198923818f9f556a03))
+* **deps:** Bump the minor group with 2 updates ([#619](https://github.com/agentclientprotocol/claude-agent-acp/issues/619)) ([6ccd37c](https://github.com/agentclientprotocol/claude-agent-acp/commit/6ccd37ce947fbd55691f676344b15ef1266191ad))
+* **deps:** update to @anthropic-ai/claude-agent-sdk 0.2.126 ([#621](https://github.com/agentclientprotocol/claude-agent-acp/issues/621)) ([becc3b8](https://github.com/agentclientprotocol/claude-agent-acp/commit/becc3b86e60eb33e7823a0ef27d5aa99758750d7))
+* **deps:** Update to @anthropic-ai/claude-agent-sdk@0.2.123 ([#614](https://github.com/agentclientprotocol/claude-agent-acp/issues/614)) ([5b93119](https://github.com/agentclientprotocol/claude-agent-acp/commit/5b9311938d97f47400debd66f2b4792e50639c6b))
+
+
+### Bug Fixes
+
+* emit a real diff when Write overwrites an existing file ([#618](https://github.com/agentclientprotocol/claude-agent-acp/issues/618)) ([8d7e220](https://github.com/agentclientprotocol/claude-agent-acp/commit/8d7e22026e15d54208414bd9ad128eb86d41b451))
+
+## [0.31.4](https://github.com/agentclientprotocol/claude-agent-acp/compare/v0.31.3...v0.31.4) (2026-04-28)
+
+
+### Bug Fixes
+
+* gate auto mode on model support ([#604](https://github.com/agentclientprotocol/claude-agent-acp/issues/604)) ([ec47d34](https://github.com/agentclientprotocol/claude-agent-acp/commit/ec47d3446fa22e5895621f57c0a4497dbe044505))
+
+## [0.31.3](https://github.com/agentclientprotocol/claude-agent-acp/compare/v0.31.2...v0.31.3) (2026-04-28)
+
+
+### Bug Fixes
+
+* Rename effort config category to thought_level ([#609](https://github.com/agentclientprotocol/claude-agent-acp/issues/609)) ([76b4e96](https://github.com/agentclientprotocol/claude-agent-acp/commit/76b4e9650832e59a6b4915ad898fc66a065022fa))
+
+## [0.31.2](https://github.com/agentclientprotocol/claude-agent-acp/compare/v0.31.1...v0.31.2) (2026-04-28)
+
+
+### Bug Fixes
+
+* tolerate invalid values in settings.json ([#601](https://github.com/agentclientprotocol/claude-agent-acp/issues/601)) ([67af018](https://github.com/agentclientprotocol/claude-agent-acp/commit/67af018d0216238d8f3cd5bad04a55200518239b))
+
+## [0.31.1](https://github.com/agentclientprotocol/claude-agent-acp/compare/v0.31.0...v0.31.1) (2026-04-27)
+
+
+### Bug Fixes
+
+* detect glibc and use correct binary ([#599](https://github.com/agentclientprotocol/claude-agent-acp/issues/599)) ([f0801d5](https://github.com/agentclientprotocol/claude-agent-acp/commit/f0801d50b2390a3c48150b9b8507d30a70c18b84))
+
+## [0.31.0](https://github.com/agentclientprotocol/claude-agent-acp/compare/v0.30.0...v0.31.0) (2026-04-24)
+
+
+### Features
+
+* allow configuring models through env vars ([#586](https://github.com/agentclientprotocol/claude-agent-acp/issues/586)) ([1e15f3d](https://github.com/agentclientprotocol/claude-agent-acp/commit/1e15f3d8b0a06076ee62764ab576ac29fe056a38))
+* Support effort levels ([#464](https://github.com/agentclientprotocol/claude-agent-acp/issues/464)) ([9e1185b](https://github.com/agentclientprotocol/claude-agent-acp/commit/9e1185bfd55cbf83a653a0ff8c194f986cbd1574))
+* Update to acp sdk v0.20 ([#589](https://github.com/agentclientprotocol/claude-agent-acp/issues/589)) ([92adcbd](https://github.com/agentclientprotocol/claude-agent-acp/commit/92adcbd1ace2f2103742ffcf5c589eb1ca41b9b8))
+* Update to claude-agent-sdk 0.2.119 ([#587](https://github.com/agentclientprotocol/claude-agent-acp/issues/587)) ([ef1dbd1](https://github.com/agentclientprotocol/claude-agent-acp/commit/ef1dbd1cb457f0524d221ea07235abf49dc941a0))
+
+
+### Bug Fixes
+
+* Forward full systemPrompt preset options from _meta ([#591](https://github.com/agentclientprotocol/claude-agent-acp/issues/591)) ([b3ddfc3](https://github.com/agentclientprotocol/claude-agent-acp/commit/b3ddfc3b86703c23fe99d93611885c12b1e4812c))
+* Session Replay and Permission rendering ([#593](https://github.com/agentclientprotocol/claude-agent-acp/issues/593)) ([5faefab](https://github.com/agentclientprotocol/claude-agent-acp/commit/5faefab8ab9b725f7a3374808bf5579e411884bc)), closes [#579](https://github.com/agentclientprotocol/claude-agent-acp/issues/579)
+
+## [0.30.0](https://github.com/agentclientprotocol/claude-agent-acp/compare/v0.29.2...v0.30.0) (2026-04-20)
+
+
+### Features
+
+* Update to claude-agent-sdk 0.2.114 ([#572](https://github.com/agentclientprotocol/claude-agent-acp/issues/572)) ([e9dd452](https://github.com/agentclientprotocol/claude-agent-acp/commit/e9dd45207d396302f20de82561135bf9558c0e76))
+
+## [0.29.2](https://github.com/agentclientprotocol/claude-agent-acp/compare/v0.29.1...v0.29.2) (2026-04-17)
+
+
+### Bug Fixes
+
+* Guard against null usage tokens ([#565](https://github.com/agentclientprotocol/claude-agent-acp/issues/565)) ([f7dc300](https://github.com/agentclientprotocol/claude-agent-acp/commit/f7dc300a165e70f6426f53920f12e24c04033cdc)), closes [#564](https://github.com/agentclientprotocol/claude-agent-acp/issues/564)
+
+## [0.29.1](https://github.com/agentclientprotocol/claude-agent-acp/compare/v0.29.0...v0.29.1) (2026-04-17)
+
+
+### Bug Fixes
+
+* emit usage updates from Claude stream events ([#506](https://github.com/agentclientprotocol/claude-agent-acp/issues/506)) ([dd67450](https://github.com/agentclientprotocol/claude-agent-acp/commit/dd67450fd9bddc82db3e71273b535e07b2672804))
+* Remove dot from auto mode description ([#561](https://github.com/agentclientprotocol/claude-agent-acp/issues/561)) ([2ecfa83](https://github.com/agentclientprotocol/claude-agent-acp/commit/2ecfa83b26db58deaded210463fa6ff21d0dff70))
+* Update to claude-agent-sdk 0.2.112 to fix Auto bug with Opus 4.7 ([#562](https://github.com/agentclientprotocol/claude-agent-acp/issues/562)) ([079614a](https://github.com/agentclientprotocol/claude-agent-acp/commit/079614ab05afba17e2cce0d3d238df7b90e17389))
+
+## [0.29.0](https://github.com/agentclientprotocol/claude-agent-acp/compare/v0.28.0...v0.29.0) (2026-04-16)
+
+
+### Features
+
+* Update to claude-agent-sdk 0.2.111 (Opus 4.7) ([#557](https://github.com/agentclientprotocol/claude-agent-acp/issues/557)) ([85cd70c](https://github.com/agentclientprotocol/claude-agent-acp/commit/85cd70c9f3be47c9c404958547c4046d866db1c9))
+
+## [0.28.0](https://github.com/agentclientprotocol/claude-agent-acp/compare/v0.27.0...v0.28.0) (2026-04-15)
+
+
+### Features
+
+* Update to claude-agent-sdk 0.2.109 ([#549](https://github.com/agentclientprotocol/claude-agent-acp/issues/549)) ([07a0fbc](https://github.com/agentclientprotocol/claude-agent-acp/commit/07a0fbc2f6bc388541d064a436412bdd850772cb))
+
+## [0.27.0](https://github.com/agentclientprotocol/claude-agent-acp/compare/v0.26.0...v0.27.0) (2026-04-13)
+
+
+### Features
+
+* allow clients to opt into receiving raw SDK messages ([#527](https://github.com/agentclientprotocol/claude-agent-acp/issues/527)) ([403a668](https://github.com/agentclientprotocol/claude-agent-acp/commit/403a668078c067868062ed26cd4d3e36665b66b6))
+* Update to claude-agent-sdk 0.2.104 ([#537](https://github.com/agentclientprotocol/claude-agent-acp/issues/537)) ([6811943](https://github.com/agentclientprotocol/claude-agent-acp/commit/6811943f57ef08616be633a8197223d4072663cf))
+
+
+### Bug Fixes
+
+* Allow auto mode after plan mode and send description for auto mode ([#528](https://github.com/agentclientprotocol/claude-agent-acp/issues/528)) ([fb9aced](https://github.com/agentclientprotocol/claude-agent-acp/commit/fb9aced3151c40694f1f01fd95665c4f5d90eb67))
+* Better remote check for auth methods ([#538](https://github.com/agentclientprotocol/claude-agent-acp/issues/538)) ([93f58c0](https://github.com/agentclientprotocol/claude-agent-acp/commit/93f58c0d2fcf7365c7ca5a6e52f56663e2065ddb))
+* better shutdown logic ([#543](https://github.com/agentclientprotocol/claude-agent-acp/issues/543)) ([9fb631f](https://github.com/agentclientprotocol/claude-agent-acp/commit/9fb631f5d76a5c5f6f0a1b61bdef05fe368c754c))
+* exit process when ACP connection closes ([#530](https://github.com/agentclientprotocol/claude-agent-acp/issues/530)) ([5c81e99](https://github.com/agentclientprotocol/claude-agent-acp/commit/5c81e99fe5ccdf774819b7ff3a2bc78a6519d730))
+* guard tool info rendering when tool_use input is undefined ([#536](https://github.com/agentclientprotocol/claude-agent-acp/issues/536)) ([d627b8c](https://github.com/agentclientprotocol/claude-agent-acp/commit/d627b8c5e95be31ac03923ef67d91748ec8564c5))
+* Remove backup auth check from new session ([#544](https://github.com/agentclientprotocol/claude-agent-acp/issues/544)) ([32b16c1](https://github.com/agentclientprotocol/claude-agent-acp/commit/32b16c1ad99394238b0e5cd6c2f761c12debe142))
+
+## [0.26.0](https://github.com/agentclientprotocol/claude-agent-acp/compare/v0.25.3...v0.26.0) (2026-04-08)
+
+
+### Features
+
+* Update claude-agent-sdk to 0.2.96 ([#526](https://github.com/agentclientprotocol/claude-agent-acp/issues/526)) ([c073131](https://github.com/agentclientprotocol/claude-agent-acp/commit/c07313148808a55f27f385c10babbaf7511a7f12))
+
+
+### Bug Fixes
+
+* Remove bun builds from release ([#525](https://github.com/agentclientprotocol/claude-agent-acp/issues/525)) ([fcf5aaf](https://github.com/agentclientprotocol/claude-agent-acp/commit/fcf5aaf06dfe9f7d1b285b976eeb2d1e20ea8dec))
+* Use TUI login for remote environments ([#523](https://github.com/agentclientprotocol/claude-agent-acp/issues/523)) ([cc73e37](https://github.com/agentclientprotocol/claude-agent-acp/commit/cc73e37b41678aa67813c4fbef66ba33ca538743))
+
+## [0.25.3](https://github.com/agentclientprotocol/claude-agent-acp/compare/v0.25.2...v0.25.3) (2026-04-06)
+
+
+### Bug Fixes
+
+* Drop claude-agent-sdk back to 0.2.91 to fix broken import ([#513](https://github.com/agentclientprotocol/claude-agent-acp/issues/513)) ([26f3e8a](https://github.com/agentclientprotocol/claude-agent-acp/commit/26f3e8a5216295985fadb80fb3b977045c0c1b2c))
+* Recreate resumed sessions when params change ([#515](https://github.com/agentclientprotocol/claude-agent-acp/issues/515)) ([aa82193](https://github.com/agentclientprotocol/claude-agent-acp/commit/aa82193330026bae132fed8391c47dde777dcf5a))
+
+## [0.25.2](https://github.com/agentclientprotocol/claude-agent-acp/compare/v0.25.1...v0.25.2) (2026-04-06)
+
+
+### Bug Fixes
+
+* prioritize ANTHROPIC_MODEL env var over settings.model in model … ([#505](https://github.com/agentclientprotocol/claude-agent-acp/issues/505)) ([bea1a40](https://github.com/agentclientprotocol/claude-agent-acp/commit/bea1a40e9bfe1e06672b118a727f9339def3be23))
+
+## [0.25.1](https://github.com/agentclientprotocol/claude-agent-acp/compare/v0.25.0...v0.25.1) (2026-04-06)
+
+
+### Bug Fixes
+
+* add `auto` to valid modes in applySessionMode to fix mode cycling ([#507](https://github.com/agentclientprotocol/claude-agent-acp/issues/507)) ([15e91fb](https://github.com/agentclientprotocol/claude-agent-acp/commit/15e91fb5c3449de2600b583cb7a8d36b5b510443))
+
+## [0.25.0](https://github.com/agentclientprotocol/claude-agent-acp/compare/v0.24.2...v0.25.0) (2026-04-03)
+
+
+### Features
+
+* Add auto permission mode support ([#501](https://github.com/agentclientprotocol/claude-agent-acp/issues/501)) ([a161453](https://github.com/agentclientprotocol/claude-agent-acp/commit/a16145396fe2e6ead8734478961b2de65707e335))
+* Add separate Claude and Console terminal logins ([#502](https://github.com/agentclientprotocol/claude-agent-acp/issues/502)) ([063cd35](https://github.com/agentclientprotocol/claude-agent-acp/commit/063cd353809df8f3dda9e57d8ea848c0a6d44257))
+* Update to claude-agent-sdk 0.2.91 ([#500](https://github.com/agentclientprotocol/claude-agent-acp/issues/500)) ([65a2230](https://github.com/agentclientprotocol/claude-agent-acp/commit/65a223038576d72b74e1483fed10e982a1f842bd))
+
+
+### Bug Fixes
+
+* log warnings for malformed settings files instead of silent fallback ([#486](https://github.com/agentclientprotocol/claude-agent-acp/issues/486)) ([ae6c388](https://github.com/agentclientprotocol/claude-agent-acp/commit/ae6c38831415f9fc1de2d3dd1d4a247becbbd32f))
+* prevent race conditions in SettingsManager setCwd and debounce ([#485](https://github.com/agentclientprotocol/claude-agent-acp/issues/485)) ([7506223](https://github.com/agentclientprotocol/claude-agent-acp/commit/7506223cffb1aba4b4560feda11f69a1395a8c9d))
+* use current model's context window for usage_update size ([#412](https://github.com/agentclientprotocol/claude-agent-acp/issues/412)) ([d07799d](https://github.com/agentclientprotocol/claude-agent-acp/commit/d07799d7b3b4e438c8b158266c79723a0b592c07))
+
+## [0.24.2](https://github.com/agentclientprotocol/claude-agent-acp/compare/v0.24.1...v0.24.2) (2026-03-27)
+
+
+### Bug Fixes
+
+* Add explicit type checks for MCP servers (http/sse) ([#487](https://github.com/agentclientprotocol/claude-agent-acp/issues/487)) ([e00a439](https://github.com/agentclientprotocol/claude-agent-acp/commit/e00a43901fa2b4fd7d582e1de57277be88233007))
+
+## [0.24.1](https://github.com/agentclientprotocol/claude-agent-acp/compare/v0.24.0...v0.24.1) (2026-03-26)
+
+
+### Bug Fixes
+
+* Cleanup based on new idle state [#463](https://github.com/agentclientprotocol/claude-agent-acp/issues/463) ([#480](https://github.com/agentclientprotocol/claude-agent-acp/issues/480)) ([23b3073](https://github.com/agentclientprotocol/claude-agent-acp/commit/23b30730253752f0bc4e30b619a6236f16fafdb9))
+
+## 0.24.0
+
+Rename from `@zed-industries/claude-agent-acp` to `@agentclientprotocol/claude-agent-acp`.
+
+We are moving this to the main ACP org to better allow multiple teams to contribute and maintain this adapter.
+
+## 0.23.1
+
+- Add back error_during_execution break point (#469)
+
+## 0.23.0
+
+- Use idle session state as end of turn (#463)
+- Update claude-agent-sdk to 0.2.83 (#462)
+- Fix handling of local-only slash commands (#432)
+- fix: correct null check for gatewayAuthMeta in subscription validation (#455)
+- fix: include both stdout and stderr in Bash tool output (#456)
+- fix: prevent prompt loop hang when cancel races with first result (#458)
+- fix: dispose SettingsManager on session close to prevent resource leaks (#454)
+- fix: restore plan content in ExitPlanMode tool call (#451)
+
+## 0.22.2
+
+- Add experimental meta param for testing additional directories
+
+## 0.22.1
+
+- Fix: invalid auth required state in gateway mode
+
+## 0.22.0
+
+- Use stable list sessions method (#429)
+- Use correct Claude CLI path for static binaries (#428)
+- Update claude-agent-sdk to 0.2.76 (#427)
+- fix: resolve model aliases in setSessionConfigOption (#401) (#403)
+- Reuse existing sessions for load/resume if possible (#426)
+- Remove interrupt flag from deny responses (#425)
+- Allow Bypass permissions mode after Exiting plan (#410)
+- Don't get out of sync when background task creates new init/result (try 2) (#400)
+- Add session/close support (#409)
+
+## 0.21.0
+
+- Update to claude-agent-sdk 0.2.71
+- show project-relative paths in tool call titles
+- Lib: pass through tools array to control built-in tool availability
+- fix: skip user replay
+- fix: handle renamed Agent tool in toolInfoFromToolUse
+
+## 0.20.2
+
+- Update to @anthropic-ai/claude-agent-sdk@0.2.68
+
+## 0.20.1
+
+- fix: inherit process.env when spawning agent subprocess
+
+## 0.20.0
+
+- Update to @anthropic-ai/claude-agent-sdk@0.2.63
+- Respect user settings for permission mode and model selection
+- Better handling of concurrent prompts
+- Support --cli for node as well
+- Propagate max_tokens stop reason instead of throwing internal error
+- fix: throw resourceNotFound when loadSession fails to resume
+- fix: add missing zod dependency
+- Surface better error message when Claude Code process exits unexpectedly
+
+## 0.19.2
+
+- Fix for broken notifications when reloading session messages
+
+## 0.19.1
+
+- Support windows arm builds and clean up artifact files
+
+## 0.19.0
+
+- Update to @anthropic-ai/claude-agent-sdk@0.2.62
+- Use SDK functions for listing and loading session history
+- Build single-file executables using bun.
+- Fix for overwritten disallowed tools.
+
+## 0.18.0
+
+- Switch over to built-in Claude tools. We no longer replicate specific ACP tools and just rely on sending updates based on Claude's internal tools. This means it won't use client capabilities for files or terminals, but also means there will be less difference and hopefully issues arising from the differences in behavior.
+- Support ACP session config options: https://agentclientprotocol.com/protocol/session-config-options
+- Fix for image output from tool calls.
+
 ## 0.17.1
 
 - Update to @anthropic-ai/claude-agent-sdk@0.2.45 to add access to Sonnet 4.6

LICENSE

@@ -1,42 +1,18 @@
-Copyright 2022 - 2025 Zed Industries, Inc.
 
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-
-
-
-
-Apache License
+                                 Apache License
                            Version 2.0, January 2004
                         http://www.apache.org/licenses/
 
-
    TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
 
-
    1. Definitions.
 
-
       "License" shall mean the terms and conditions for use, reproduction,
       and distribution as defined by Sections 1 through 9 of this document.
 
-
       "Licensor" shall mean the copyright owner or entity authorized by
       the copyright owner that is granting the License.
 
-
       "Legal Entity" shall mean the union of the acting entity and all
       other entities that control, are controlled by, or are under common
       control with that entity. For the purposes of this definition,
@@ -45,28 +21,23 @@ Apache License
       otherwise, or (ii) ownership of fifty percent (50%) or more of the
       outstanding shares, or (iii) beneficial ownership of such entity.
 
-
       "You" (or "Your") shall mean an individual or Legal Entity
       exercising permissions granted by this License.
 
-
       "Source" form shall mean the preferred form for making modifications,
       including but not limited to software source code, documentation
       source, and configuration files.
 
-
       "Object" form shall mean any form resulting from mechanical
       transformation or translation of a Source form, including but
       not limited to compiled object code, generated documentation,
       and conversions to other media types.
 
-
       "Work" shall mean the work of authorship, whether in Source or
       Object form, made available under the License, as indicated by a
       copyright notice that is included in or attached to the work
       (an example is provided in the Appendix below).
 
-
       "Derivative Works" shall mean any work, whether in Source or Object
       form, that is based on (or derived from) the Work and for which the
       editorial revisions, annotations, elaborations, or other modifications
@@ -75,7 +46,6 @@ Apache License
       separable from, or merely link (or bind by name) to the interfaces of,
       the Work and Derivative Works thereof.
 
-
       "Contribution" shall mean any work of authorship, including
       the original version of the Work and any modifications or additions
       to that Work or Derivative Works thereof, that is intentionally
@@ -90,12 +60,10 @@ Apache License
       excluding communication that is conspicuously marked or otherwise
       designated in writing by the copyright owner as "Not a Contribution."
 
-
       "Contributor" shall mean Licensor and any individual or Legal Entity
       on behalf of whom a Contribution has been received by Licensor and
       subsequently incorporated within the Work.
 
-
    2. Grant of Copyright License. Subject to the terms and conditions of
       this License, each Contributor hereby grants to You a perpetual,
       worldwide, non-exclusive, no-charge, royalty-free, irrevocable
@@ -103,7 +71,6 @@ Apache License
       publicly display, publicly perform, sublicense, and distribute the
       Work and such Derivative Works in Source or Object form.
 
-
    3. Grant of Patent License. Subject to the terms and conditions of
       this License, each Contributor hereby grants to You a perpetual,
       worldwide, non-exclusive, no-charge, royalty-free, irrevocable
@@ -120,28 +87,23 @@ Apache License
       granted to You under this License for that Work shall terminate
       as of the date such litigation is filed.
 
-
    4. Redistribution. You may reproduce and distribute copies of the
       Work or Derivative Works thereof in any medium, with or without
       modifications, and in Source or Object form, provided that You
       meet the following conditions:
 
-
       (a) You must give any other recipients of the Work or
           Derivative Works a copy of this License; and
 
-
       (b) You must cause any modified files to carry prominent notices
           stating that You changed the files; and
 
-
       (c) You must retain, in the Source form of any Derivative Works
           that You distribute, all copyright, patent, trademark, and
           attribution notices from the Source form of the Work,
           excluding those notices that do not pertain to any part of
           the Derivative Works; and
 
-
       (d) If the Work includes a "NOTICE" text file as part of its
           distribution, then any Derivative Works that You distribute must
           include a readable copy of the attribution notices contained
@@ -159,7 +121,6 @@ Apache License
           that such additional attribution notices cannot be construed
           as modifying the License.
 
-
       You may add Your own copyright statement to Your modifications and
       may provide additional or different license terms and conditions
       for use, reproduction, or distribution of Your modifications, or
@@ -167,7 +128,6 @@ Apache License
       reproduction, and distribution of the Work otherwise complies with
       the conditions stated in this License.
 
-
    5. Submission of Contributions. Unless You explicitly state otherwise,
       any Contribution intentionally submitted for inclusion in the Work
       by You to the Licensor shall be under the terms and conditions of
@@ -176,13 +136,11 @@ Apache License
       the terms of any separate license agreement you may have executed
       with Licensor regarding such Contributions.
 
-
    6. Trademarks. This License does not grant permission to use the trade
       names, trademarks, service marks, or product names of the Licensor,
       except as required for reasonable and customary use in describing the
       origin of the Work and reproducing the content of the NOTICE file.
 
-
    7. Disclaimer of Warranty. Unless required by applicable law or
       agreed to in writing, Licensor provides the Work (and each
       Contributor provides its Contributions) on an "AS IS" BASIS,
@@ -193,7 +151,6 @@ Apache License
       appropriateness of using or redistributing the Work and assume any
       risks associated with Your exercise of permissions under this License.
 
-
    8. Limitation of Liability. In no event and under no legal theory,
       whether in tort (including negligence), contract, or otherwise,
       unless required by applicable law (such as deliberate and grossly
@@ -206,7 +163,6 @@ Apache License
       other commercial damages or losses), even if such Contributor
       has been advised of the possibility of such damages.
 
-
    9. Accepting Warranty or Additional Liability. While redistributing
       the Work or Derivative Works thereof, You may choose to offer,
       and charge a fee for, acceptance of support, warranty, indemnity,
@@ -218,5 +174,18 @@ Apache License
       incurred by, or claims asserted against, such Contributor by reason
       of your accepting any such warranty or additional liability.
 
-
    END OF TERMS AND CONDITIONS
+
+   Copyright 2025 Zed Industries, Inc. and contributors
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

README.md

@@ -1,8 +1,8 @@
 # ACP adapter for the Claude Agent SDK
 
-[![npm](https://img.shields.io/npm/v/%40zed-industries%2Fclaude-agent-acp)](https://www.npmjs.com/package/@zed-industries/claude-agent-acp)
+[![npm](https://img.shields.io/npm/v/%40agentclientprotocol%2Fclaude-agent-acp)](https://www.npmjs.com/package/@agentclientprotocol/claude-agent-acp)
 
-Use [Claude Agent SDK](https://platform.claude.com/docs/en/agent-sdk/overview#branding-guidelines) from [ACP-compatible](https://agentclientprotocol.com) clients such as [Zed](https://zed.dev)!
+Use [Claude Agent SDK](https://platform.claude.com/docs/en/agent-sdk/overview#branding-guidelines) from [ACP-compatible](https://agentclientprotocol.com) clients!
 
 This tool implements an ACP agent by using the official [Claude Agent SDK](https://platform.claude.com/docs/en/agent-sdk/overview), supporting:
 
@@ -18,36 +18,8 @@ This tool implements an ACP agent by using the official [Claude Agent SDK](https
 
 Learn more about the [Agent Client Protocol](https://agentclientprotocol.com/).
 
-## How to use
+## Contribution Policy
 
-### Zed
+This project does not require a Contributor License Agreement (CLA). Instead, contributions are accepted under the following terms:
 
-The latest version of Zed can already use this adapter out of the box.
-
-To use Claude Agent, open the Agent Panel and click "New Claude Agent Thread" from the `+` button menu in the top-right:
-
-https://github.com/user-attachments/assets/ddce66c7-79ac-47a3-ad59-4a6a3ca74903
-
-Read the docs on [External Agent](https://zed.dev/docs/ai/external-agents) support.
-
-### Other clients
-
-Or try it with any of the other [ACP compatible clients](https://agentclientprotocol.com/overview/clients)!
-
-#### Installation
-
-Install the adapter from `npm`:
-
-```bash
-npm install -g @zed-industries/claude-agent-acp
-```
-
-You can then use `claude-agent-acp` as a regular ACP agent:
-
-```
-ANTHROPIC_API_KEY=sk-... claude-agent-acp
-```
-
-## License
-
-Apache-2.0
+> By contributing to this project, you agree that your contributions will be licensed under the [Apache License, Version 2.0](https://www.apache.org/licenses/LICENSE-2.0). You affirm that you have the legal right to submit your work, that you are not including code you do not have rights to, and that you understand contributions are made without requiring a Contributor License Agreement (CLA).

docs/model-configuration.md

@@ -0,0 +1,56 @@
+# Model Configuration
+
+When using claude-agent-acp with alternative providers (e.g. AWS Bedrock), model IDs differ from the direct Anthropic API. The `CLAUDE_MODEL_CONFIG` environment variable lets you configure model overrides and availability at the deployment level.
+
+## `CLAUDE_MODEL_CONFIG`
+
+A JSON string with two optional fields:
+
+| Field             | Type                     | Description                                                                                                   |
+| ----------------- | ------------------------ | ------------------------------------------------------------------------------------------------------------- |
+| `modelOverrides`  | `Record<string, string>` | Maps Anthropic model IDs to provider-specific model IDs (e.g. Bedrock model IDs or ARNs)                      |
+| `availableModels` | `string[]`               | Restricts which models are offered to users. Accepts aliases (`"opus"`), prefixes (`"opus-4-5"`), or full IDs |
+
+### Examples
+
+**Bedrock model overrides:**
+
+```bash
+CLAUDE_MODEL_CONFIG='{"modelOverrides":{"claude-opus-4-6":"us.anthropic.claude-opus-4-6-v1","claude-sonnet-4-5":"us.anthropic.claude-sonnet-4-5-v1"}}'
+```
+
+**Restrict available models:**
+
+```bash
+CLAUDE_MODEL_CONFIG='{"availableModels":["opus","sonnet"]}'
+```
+
+**Both together:**
+
+```bash
+CLAUDE_MODEL_CONFIG='{"modelOverrides":{"claude-opus-4-6":"us.anthropic.claude-opus-4-6-v1","claude-sonnet-4-5":"us.anthropic.claude-sonnet-4-5-v1"},"availableModels":["opus","sonnet"]}'
+```
+
+**Full Bedrock example:**
+
+```bash
+CLAUDE_CODE_USE_BEDROCK=1 \
+AWS_REGION=us-west-2 \
+CLAUDE_MODEL_CONFIG='{"modelOverrides":{"claude-opus-4-6":"us.anthropic.claude-opus-4-6-v1"}}' \
+node dist/index.js
+```
+
+## Precedence
+
+When an ACP caller provides `settings` via `_meta.claudeCode.options.settings` in the `sessions/create` request, `CLAUDE_MODEL_CONFIG` is ignored entirely. The env var is a deployment-level fallback for cases where the caller does not configure model settings itself.
+
+| Source                                       | Priority                                              |
+| -------------------------------------------- | ----------------------------------------------------- |
+| `_meta.claudeCode.options.settings` (caller) | Highest — used if present                             |
+| `CLAUDE_MODEL_CONFIG` (env var)              | Fallback — used only when caller provides no settings |
+
+## Format details
+
+- The value must be valid JSON. Invalid JSON will cause session creation to fail with a parse error.
+- Only `modelOverrides` and `availableModels` keys are read; other keys in the JSON are ignored.
+- Both fields map directly to the Claude Agent SDK's `Settings` type.

package.json

@@ -1,9 +1,9 @@
 {
-  "name": "@zed-industries/claude-agent-acp",
+  "name": "@agentclientprotocol/claude-agent-acp",
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.17.1",
+  "version": "0.37.0",
   "description": "An ACP-compatible coding agent powered by the Claude Agent SDK (TypeScript)",
   "main": "dist/lib.js",
   "types": "dist/lib.d.ts",
@@ -49,35 +49,33 @@
     "sdk",
     "code"
   ],
-  "homepage": "https://github.com/zed-industries/claude-agent-acp#readme",
+  "homepage": "https://github.com/agentclientprotocol/claude-agent-acp#readme",
   "bugs": {
-    "url": "https://github.com/zed-industries/claude-agent-acp/issues"
+    "url": "https://github.com/agentclientprotocol/claude-agent-acp/issues"
   },
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/zed-industries/claude-agent-acp.git"
+    "url": "git+https://github.com/agentclientprotocol/claude-agent-acp.git"
   },
   "author": "Zed Industries",
   "license": "Apache-2.0",
   "dependencies": {
-    "@agentclientprotocol/sdk": "0.14.1",
-    "@anthropic-ai/claude-agent-sdk": "0.2.45",
-    "@modelcontextprotocol/sdk": "1.26.0",
-    "diff": "8.0.3",
-    "minimatch": "10.2.1"
+    "@agentclientprotocol/sdk": "0.22.1",
+    "@anthropic-ai/claude-agent-sdk": "0.3.146",
+    "zod": "^3.25.0 || ^4.0.0"
   },
   "devDependencies": {
-    "@anthropic-ai/sdk": "0.75.0",
+    "@anthropic-ai/sdk": "0.97.1",
     "@eslint/js": "10.0.1",
-    "@types/node": "25.2.3",
-    "@typescript-eslint/eslint-plugin": "8.56.0",
-    "@typescript-eslint/parser": "8.56.0",
-    "eslint": "10.0.0",
+    "@types/node": "25.9.1",
+    "@typescript-eslint/eslint-plugin": "8.59.4",
+    "@typescript-eslint/parser": "8.59.4",
+    "eslint": "10.4.0",
     "eslint-config-prettier": "10.1.8",
-    "globals": "17.3.0",
-    "prettier": "3.8.1",
+    "globals": "17.6.0",
+    "prettier": "3.8.3",
     "ts-node": "10.9.2",
-    "typescript": "5.9.3",
-    "vitest": "4.0.18"
+    "typescript": "6.0.3",
+    "vitest": "4.1.7"
   }
 }

release-please-config.json

@@ -0,0 +1,13 @@
+{
+  "bump-minor-pre-major": true,
+  "bump-patch-for-minor-pre-major": true,
+  "packages": {
+    ".": {
+      "changelog-path": "CHANGELOG.md",
+      "release-type": "node",
+      "bump-minor-pre-major": true,
+      "bump-patch-for-minor-pre-major": true
+    }
+  },
+  "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json"
+}

src/index.ts

@@ -1,26 +1,76 @@
 #!/usr/bin/env node
 
-// Load managed settings and apply environment variables
-import { loadManagedSettings, applyEnvironmentSettings } from "./utils.js";
+import { resolveSettings } from "@anthropic-ai/claude-agent-sdk";
+import { claudeCliPath, runAcp } from "./acp-agent.js";
 
-const managedSettings = loadManagedSettings();
-if (managedSettings) {
-  applyEnvironmentSettings(managedSettings);
+if (process.argv.includes("--cli")) {
+  const { spawn } = await import("node:child_process");
+  const args = process.argv.slice(2).filter((arg) => arg !== "--cli");
+  const child = spawn(await claudeCliPath(), args, { stdio: "inherit" });
+
+  const signals =
+    process.platform === "win32"
+      ? (["SIGINT", "SIGTERM"] as const)
+      : (["SIGINT", "SIGTERM", "SIGHUP"] as const);
+  for (const sig of signals) {
+    process.on(sig, () => {
+      if (!child.killed) child.kill(sig);
+    });
+  }
+
+  child.on("exit", (code, signal) => {
+    if (signal && process.platform !== "win32") {
+      // Remove our listener so re-raising actually terminates instead of
+      // re-entering the no-op handler, which would let us exit with code 0
+      // instead of the signal's conventional 128+N.
+      process.removeAllListeners(signal);
+      process.kill(process.pid, signal);
+    } else {
+      process.exit(code ?? 1);
+    }
+  });
+  child.on("error", (err) => {
+    console.error(err);
+    process.exit(1);
+  });
+} else {
+  // Apply env vars from the managed-policy tier before any SDK call so the
+  // SDK subprocess inherits them. Going through resolveSettings (vs. a raw
+  // read of managed-settings.json) also picks up MDM sources on macOS and
+  // HKLM/HKCU on Windows.
+  const policy = await resolveSettings({ settingSources: [] });
+  for (const [key, value] of Object.entries(policy.effective.env ?? {})) {
+    process.env[key] = value;
+  }
+
+  // stdout is used to send messages to the client
+  // we redirect everything else to stderr to make sure it doesn't interfere with ACP
+  console.log = console.error;
+  console.info = console.error;
+  console.warn = console.error;
+  console.debug = console.error;
+
+  process.on("unhandledRejection", (reason, promise) => {
+    console.error("Unhandled Rejection at:", promise, "reason:", reason);
+  });
+
+  const { connection, agent } = runAcp();
+
+  async function shutdown() {
+    await agent.dispose().catch((err) => {
+      console.error("Error during cleanup:", err);
+    });
+    process.exit(0);
+  }
+
+  // Exit cleanly when the ACP connection closes (e.g. stdin EOF, transport
+  // error). Without this, `process.stdin.resume()` keeps the event loop
+  // alive indefinitely, causing orphan process accumulation in oneshot mode.
+  connection.closed.then(shutdown);
+
+  process.on("SIGTERM", shutdown);
+  process.on("SIGINT", shutdown);
+
+  // Keep process alive while connection is open
+  process.stdin.resume();
 }
-
-// stdout is used to send messages to the client
-// we redirect everything else to stderr to make sure it doesn't interfere with ACP
-console.log = console.error;
-console.info = console.error;
-console.warn = console.error;
-console.debug = console.error;
-
-process.on("unhandledRejection", (reason, promise) => {
-  console.error("Unhandled Rejection at:", promise, "reason:", reason);
-});
-
-import { runAcp } from "./acp-agent.js";
-runAcp();
-
-// Keep process alive
-process.stdin.resume();

src/lib.ts

@@ -1,36 +1,23 @@
 // Export the main agent class and utilities for library usage
 export {
   ClaudeAcpAgent,
+  isLocalCommandMetadata,
+  stripLocalCommandMetadata,
   runAcp,
   toAcpNotifications,
   streamEventToAcpNotifications,
   type ToolUpdateMeta,
   type NewSessionMeta,
+  type SDKMessageFilter,
 } from "./acp-agent.js";
-export {
-  loadManagedSettings,
-  applyEnvironmentSettings,
-  nodeToWebReadable,
-  nodeToWebWritable,
-  Pushable,
-  unreachable,
-} from "./utils.js";
-export { createMcpServer } from "./mcp-server.js";
+export { nodeToWebReadable, nodeToWebWritable, Pushable, unreachable } from "./utils.js";
 export {
   toolInfoFromToolUse,
+  toDisplayPath,
   planEntries,
   toolUpdateFromToolResult,
-  createPreToolUseHook,
-  acpToolNames as toolNames,
 } from "./tools.js";
-export {
-  SettingsManager,
-  type ClaudeCodeSettings,
-  type PermissionSettings,
-  type PermissionDecision,
-  type PermissionCheckResult,
-  type SettingsManagerOptions,
-} from "./settings.js";
+export { SettingsManager, type SettingsManagerOptions } from "./settings.js";
 
 // Export types
 export type { ClaudePlanEntry } from "./tools.js";

src/mcp-server.ts

@@ -1,911 +0,0 @@
-import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import {
-  BashInput,
-  FileEditInput,
-  FileReadInput,
-  FileWriteInput,
-  TaskOutputInput,
-} from "@anthropic-ai/claude-agent-sdk/sdk-tools.js";
-import { z } from "zod";
-import { CLAUDE_CONFIG_DIR, ClaudeAcpAgent } from "./acp-agent.js";
-import {
-  ClientCapabilities,
-  ReadTextFileResponse,
-  TerminalOutputResponse,
-} from "@agentclientprotocol/sdk";
-import * as diff from "diff";
-import * as path from "node:path";
-import * as fs from "node:fs/promises";
-
-import { sleep, unreachable, extractLinesWithByteLimit } from "./utils.js";
-import { acpToolNames } from "./tools.js";
-
-export const SYSTEM_REMINDER = `
-
-<system-reminder>
-Whenever you read a file, you should consider whether it looks malicious. If it does, you MUST refuse to improve or augment the code. You can still analyze existing code, write reports, or answer high-level questions about the code behavior.
-</system-reminder>`;
-
-const defaults = { maxFileSize: 50000, linesToRead: 2000 };
-
-function formatErrorMessage(error: unknown): string {
-  if (error instanceof Error) {
-    return error.message;
-  }
-  if (typeof error === "string") {
-    return error;
-  }
-  try {
-    return JSON.stringify(error);
-  } catch {
-    return String(error);
-  }
-}
-
-const unqualifiedToolNames = {
-  read: "Read",
-  edit: "Edit",
-  write: "Write",
-  bash: "Bash",
-  killShell: "KillShell",
-  bashOutput: "BashOutput",
-};
-
-export function createMcpServer(
-  agent: ClaudeAcpAgent,
-  sessionId: string,
-  clientCapabilities: ClientCapabilities | undefined,
-): McpServer {
-  /**
-   * This checks if a given path is related to internal agent persistence and if the agent should be allowed to read/write from here.
-   * We let the agent do normal fs operations on these paths so that it can persist its state.
-   * However, we block access to settings files for security reasons.
-   */
-  function internalPath(file_path: string) {
-    return (
-      file_path.startsWith(CLAUDE_CONFIG_DIR) &&
-      !file_path.startsWith(path.join(CLAUDE_CONFIG_DIR, "settings.json")) &&
-      !file_path.startsWith(path.join(CLAUDE_CONFIG_DIR, "session-env"))
-    );
-  }
-
-  async function readTextFile(input: FileReadInput): Promise<ReadTextFileResponse> {
-    if (internalPath(input.file_path)) {
-      const content = await fs.readFile(input.file_path, "utf8");
-
-      // eslint-disable-next-line eqeqeq
-      if (input.offset != null || input.limit != null) {
-        const lines = content.split("\n");
-
-        // Apply offset and limit if provided
-        const offset = input.offset ?? 1;
-        const limit = input.limit ?? lines.length;
-
-        // Extract the requested lines (offset is 1-based)
-        const startIndex = Math.max(0, offset - 1);
-        const endIndex = Math.min(lines.length, startIndex + limit);
-        const selectedLines = lines.slice(startIndex, endIndex);
-
-        return { content: selectedLines.join("\n") };
-      } else {
-        return { content };
-      }
-    }
-
-    return agent.readTextFile({
-      sessionId,
-      path: input.file_path,
-      line: input.offset,
-      limit: input.limit,
-    });
-  }
-
-  async function writeTextFile(input: FileWriteInput): Promise<void> {
-    if (internalPath(input.file_path)) {
-      await fs.writeFile(input.file_path, input.content, "utf8");
-    } else {
-      await agent.writeTextFile({
-        sessionId,
-        path: input.file_path,
-        content: input.content,
-      });
-    }
-  }
-
-  // Create MCP server
-  const server = new McpServer({ name: "acp", version: "1.0.0" }, { capabilities: { tools: {} } });
-
-  if (clientCapabilities?.fs?.readTextFile) {
-    server.registerTool(
-      unqualifiedToolNames.read,
-      {
-        title: unqualifiedToolNames.read,
-        description: `Reads the content of the given file in the project.
-
-In sessions with ${acpToolNames.read} always use it instead of Read as it contains the most up-to-date contents.
-
-Reads a file from the local filesystem. If the User provides a path to a file assume that path is valid. It is okay to read a file that does not exist; an error will be returned.
-
-Usage:
-- The file_path parameter must be an absolute path, not a relative path
-- By default, it reads up to ${defaults.linesToRead} lines starting from the beginning of the file
-- You can optionally specify a line offset and limit (especially handy for long files), but it's recommended to read the whole file by not providing these parameters
-- Any files larger than ${defaults.maxFileSize} bytes will be truncated
-- This tool allows Claude Code to read images (eg PNG, JPG, etc). When reading an image file the contents are presented visually as Claude Code is a multimodal LLM.
-- This tool can only read files, not directories. To read a directory, use an ls command via the ${acpToolNames.bash} tool.
-- You have the capability to call multiple tools in a single response. It is always better to speculatively read multiple files as a batch that are potentially useful.`,
-        inputSchema: {
-          file_path: z.string().describe("The absolute path to the file to read"),
-          offset: z
-            .number()
-            .optional()
-            .default(1)
-            .describe(
-              "The line number to start reading from. Only provide if the file is too large to read at once",
-            ),
-          limit: z
-            .number()
-            .optional()
-            .default(defaults.linesToRead)
-            .describe(
-              `The number of lines to read. Only provide if the file is too large to read at once.`,
-            ),
-        },
-        annotations: {
-          title: "Read file",
-          readOnlyHint: true,
-          destructiveHint: false,
-          openWorldHint: false,
-          idempotentHint: false,
-        },
-      },
-      async (input: FileReadInput) => {
-        try {
-          const session = agent.sessions[sessionId];
-          if (!session) {
-            return {
-              content: [
-                {
-                  type: "text",
-                  text: "The user has left the building",
-                },
-              ],
-            };
-          }
-
-          const readResponse = await readTextFile(input);
-
-          if (typeof readResponse?.content !== "string") {
-            throw new Error(`No file contents for ${input.file_path}.`);
-          }
-
-          // Extract lines with byte limit enforcement
-          const result = extractLinesWithByteLimit(readResponse.content, defaults.maxFileSize);
-
-          // Construct informative message about what was read
-          let readInfo = "";
-          if ((input.offset && input.offset > 1) || result.wasLimited) {
-            readInfo = "\n\n<file-read-info>";
-
-            if (result.wasLimited) {
-              readInfo += `Read ${result.linesRead} lines (hit 50KB limit). `;
-            } else if (input.offset && input.offset > 1) {
-              readInfo += `Read lines ${input.offset}-${input.offset + result.linesRead}.`;
-            }
-
-            if (result.wasLimited) {
-              readInfo += `Continue with offset=${result.linesRead}.`;
-            }
-
-            readInfo += "</file-read-info>";
-          }
-
-          return {
-            content: [
-              {
-                type: "text",
-                text: result.content + readInfo + SYSTEM_REMINDER,
-              },
-            ],
-          };
-        } catch (error) {
-          return {
-            isError: true,
-            content: [
-              {
-                type: "text",
-                text: "Reading file failed: " + formatErrorMessage(error),
-              },
-            ],
-          };
-        }
-      },
-    );
-  }
-
-  if (clientCapabilities?.fs?.writeTextFile) {
-    server.registerTool(
-      unqualifiedToolNames.write,
-      {
-        title: unqualifiedToolNames.write,
-        description: `Writes a file to the local filesystem..
-
-In sessions with ${acpToolNames.write} always use it instead of Write as it will
-allow the user to conveniently review changes.
-
-Usage:
-- This tool will overwrite the existing file if there is one at the provided path.
-- If this is an existing file, you MUST use the ${acpToolNames.read} tool first to read the file's contents. This tool will fail if you did not read the file first.
-- ALWAYS prefer editing existing files in the codebase. NEVER write new files unless explicitly required.
-- NEVER proactively create documentation files (*.md) or README files. Only create documentation files if explicitly requested by the User.
-- Only use emojis if the user explicitly requests it. Avoid writing emojis to files unless asked.`,
-        inputSchema: {
-          file_path: z
-            .string()
-            .describe("The absolute path to the file to write (must be absolute, not relative)"),
-          content: z.string().describe("The content to write to the file"),
-        },
-        annotations: {
-          title: "Write file",
-          readOnlyHint: false,
-          destructiveHint: false,
-          openWorldHint: false,
-          idempotentHint: false,
-        },
-      },
-      async (input: FileWriteInput) => {
-        try {
-          const session = agent.sessions[sessionId];
-          if (!session) {
-            return {
-              content: [
-                {
-                  type: "text",
-                  text: "The user has left the building",
-                },
-              ],
-            };
-          }
-          await writeTextFile(input);
-
-          return {
-            content: [
-              {
-                type: "text",
-                text: `The file ${input.file_path} has been updated successfully.`,
-              },
-            ],
-          };
-        } catch (error) {
-          return {
-            isError: true,
-            content: [
-              {
-                type: "text",
-                text: "Writing file failed: " + formatErrorMessage(error),
-              },
-            ],
-          };
-        }
-      },
-    );
-
-    server.registerTool(
-      unqualifiedToolNames.edit,
-      {
-        title: unqualifiedToolNames.edit,
-        description: `Performs exact string replacements in files.
-
-In sessions with ${acpToolNames.edit} always use it instead of Edit as it will
-allow the user to conveniently review changes.
-
-Usage:
-- You must use your \`${acpToolNames.read}\` tool at least once in the conversation before editing. This tool will error if you attempt an edit without reading the file.
-- When editing text from Read tool output, ensure you preserve the exact indentation (tabs/spaces) as it appears.
-- ALWAYS prefer editing existing files in the codebase. NEVER write new files unless explicitly required.
-- Only use emojis if the user explicitly requests it. Avoid adding emojis to files unless asked.
-- The edit will FAIL if \`old_string\` is not unique in the file. Either provide a larger string with more surrounding context to make it unique or use \`replace_all\` to change every instance of \`old_string\`.
-- Use \`replace_all\` for replacing and renaming strings across the file. This parameter is useful if you want to rename a variable for instance.`,
-        inputSchema: {
-          file_path: z.string().describe("The absolute path to the file to modify"),
-          old_string: z.string().describe("The text to replace"),
-          new_string: z
-            .string()
-            .describe("The text to replace it with (must be different from old_string)"),
-          replace_all: z
-            .boolean()
-            .default(false)
-            .optional()
-            .describe("Replace all occurrences of old_string (default false)"),
-        },
-        annotations: {
-          title: "Edit file",
-          readOnlyHint: false,
-          destructiveHint: false,
-          openWorldHint: false,
-          idempotentHint: false,
-        },
-      },
-      async (input: FileEditInput) => {
-        try {
-          const session = agent.sessions[sessionId];
-          if (!session) {
-            return {
-              content: [
-                {
-                  type: "text",
-                  text: "The user has left the building",
-                },
-              ],
-            };
-          }
-
-          const readResponse = await readTextFile({
-            file_path: input.file_path,
-          });
-
-          if (typeof readResponse?.content !== "string") {
-            throw new Error(`No file contents for ${input.file_path}.`);
-          }
-
-          const { newContent } = replaceAndCalculateLocation(readResponse.content, [
-            {
-              oldText: input.old_string,
-              newText: input.new_string,
-              replaceAll: input.replace_all,
-            },
-          ]);
-
-          const patch = diff.createPatch(input.file_path, readResponse.content, newContent);
-
-          await writeTextFile({ file_path: input.file_path, content: newContent });
-
-          return {
-            content: [
-              {
-                type: "text",
-                text: patch,
-              },
-            ],
-          };
-        } catch (error) {
-          return {
-            isError: true,
-            content: [
-              {
-                type: "text",
-                text: "Editing file failed: " + formatErrorMessage(error),
-              },
-            ],
-          };
-        }
-      },
-    );
-  }
-
-  if (agent.clientCapabilities?.terminal) {
-    server.registerTool(
-      unqualifiedToolNames.bash,
-      {
-        title: unqualifiedToolNames.bash,
-        description: `Executes a bash command
-
-In sessions with ${acpToolNames.bash} always use it instead of Bash`,
-        inputSchema: {
-          command: z.string().describe("The command to execute"),
-          timeout: z.number().describe(`Optional timeout in milliseconds (max ${2 * 60 * 1000})`),
-          description: z.string().optional()
-            .describe(`Clear, concise description of what this command does in 5-10 words, in active voice. Examples:
-Input: ls
-Output: List files in current directory
-
-Input: git status
-Output: Show working tree status
-
-Input: npm install
-Output: Install package dependencies
-
-Input: mkdir foo
-Output: Create directory 'foo'`),
-          run_in_background: z
-            .boolean()
-            .default(false)
-            .describe(
-              `Set to true to run this command in the background. The tool returns an \`id\` that can be used with the \`${acpToolNames.bashOutput}\` tool to retrieve the current output, or the \`${acpToolNames.killShell}\` tool to stop it early.`,
-            ),
-        },
-      },
-      async (input: BashInput, extra) => {
-        try {
-          const session = agent.sessions[sessionId];
-          if (!session) {
-            return {
-              content: [
-                {
-                  type: "text",
-                  text: "The user has left the building",
-                },
-              ],
-            };
-          }
-
-          const toolCallId = extra._meta?.["claudecode/toolUseId"];
-
-          if (typeof toolCallId !== "string") {
-            throw new Error("No tool call ID found");
-          }
-
-          if (!agent.clientCapabilities?.terminal || !agent.client.createTerminal) {
-            throw new Error("unreachable");
-          }
-
-          const handle = await agent.client.createTerminal({
-            command: input.command,
-            env: [{ name: "CLAUDECODE", value: "1" }],
-            sessionId,
-            outputByteLimit: 32_000,
-          });
-
-          await agent.client.sessionUpdate({
-            sessionId,
-            update: {
-              sessionUpdate: "tool_call_update",
-              toolCallId,
-              status: "in_progress",
-              title: input.description,
-              content: [{ type: "terminal", terminalId: handle.id }],
-            },
-          });
-
-          const abortPromise = new Promise((resolve) => {
-            if (extra.signal.aborted) {
-              resolve(null);
-            } else {
-              extra.signal.addEventListener("abort", () => {
-                resolve(null);
-              });
-            }
-          });
-
-          const statusPromise = Promise.race([
-            handle.waitForExit().then((exitStatus) => ({ status: "exited" as const, exitStatus })),
-            abortPromise.then(() => ({ status: "aborted" as const, exitStatus: null })),
-            sleep(input.timeout ?? 2 * 60 * 1000).then(async () => {
-              if (agent.backgroundTerminals[handle.id]?.status === "started") {
-                await handle.kill();
-              }
-              return { status: "timedOut" as const, exitStatus: null };
-            }),
-          ]);
-
-          if (input.run_in_background) {
-            agent.backgroundTerminals[handle.id] = {
-              handle,
-              lastOutput: null,
-              status: "started",
-            };
-
-            statusPromise.then(async ({ status, exitStatus }) => {
-              const bgTerm = agent.backgroundTerminals[handle.id];
-
-              if (bgTerm.status !== "started") {
-                return;
-              }
-
-              const currentOutput = await handle.currentOutput();
-
-              agent.backgroundTerminals[handle.id] = {
-                status,
-                pendingOutput: {
-                  ...currentOutput,
-                  output: stripCommonPrefix(bgTerm.lastOutput?.output ?? "", currentOutput.output),
-                  exitStatus: exitStatus ?? currentOutput.exitStatus,
-                },
-              };
-
-              return handle.release();
-            });
-
-            return {
-              content: [
-                {
-                  type: "text",
-                  text: `Command started in background with id: ${handle.id}`,
-                },
-              ],
-            };
-          }
-
-          await using terminal = handle;
-
-          const { status } = await statusPromise;
-
-          if (status === "aborted") {
-            return {
-              content: [{ type: "text", text: "Tool cancelled by user" }],
-            };
-          }
-
-          const output = await terminal.currentOutput();
-
-          return {
-            content: [{ type: "text", text: toolCommandOutput(status, output) }],
-          };
-        } catch (error) {
-          return {
-            isError: true,
-            content: [
-              {
-                type: "text",
-                text: "Running bash command failed: " + formatErrorMessage(error),
-              },
-            ],
-          };
-        }
-      },
-    );
-
-    server.registerTool(
-      unqualifiedToolNames.bashOutput,
-      {
-        title: unqualifiedToolNames.bashOutput,
-        description: `- Retrieves output from a running or completed background bash shell
-- Takes a bash_id parameter identifying the shell
-- Always returns only new output since the last check
-- Returns stdout and stderr output along with shell status
-- Use this tool when you need to monitor or check the output of a long-running shell
-
-In sessions with ${acpToolNames.bashOutput} always use it for output from Bash commands instead of TaskOutput.`,
-        inputSchema: {
-          task_id: z
-            .string()
-            .describe(
-              `The id of the background bash command as returned by \`${acpToolNames.bash}\``,
-            ),
-          block: z.boolean().describe("Whether to wait for completion"),
-          timeout: z.number().describe("Max wait time in ms"),
-        },
-      },
-      async (input: TaskOutputInput) => {
-        try {
-          const bgTerm = agent.backgroundTerminals[input.task_id];
-
-          if (!bgTerm) {
-            throw new Error(`Unknown shell ${input.task_id}`);
-          }
-
-          if (input.block && bgTerm.status === "started") {
-            const statusPromise = Promise.race([
-              bgTerm.handle
-                .waitForExit()
-                .then((exitStatus) => ({ status: "exited" as const, exitStatus })),
-              sleep(input.timeout ?? 2 * 60 * 1000).then(async () => {
-                if (bgTerm.status === "started") {
-                  await bgTerm.handle.kill();
-                }
-                return { status: "timedOut" as const, exitStatus: null };
-              }),
-            ]);
-
-            const { status, exitStatus } = await statusPromise;
-            const currentOutput = await bgTerm.handle.currentOutput();
-            const strippedOutput = stripCommonPrefix(
-              bgTerm.lastOutput?.output ?? "",
-              currentOutput.output,
-            );
-
-            agent.backgroundTerminals[input.task_id] = {
-              status,
-              pendingOutput: {
-                ...currentOutput,
-                output: strippedOutput,
-                exitStatus: exitStatus ?? currentOutput.exitStatus,
-              },
-            };
-
-            await bgTerm.handle.release();
-
-            return {
-              content: [
-                {
-                  type: "text",
-                  text: toolCommandOutput(status, {
-                    ...currentOutput,
-                    output: strippedOutput,
-                    exitStatus: exitStatus ?? currentOutput.exitStatus,
-                  }),
-                },
-              ],
-            };
-          }
-
-          if (bgTerm.status === "started") {
-            const newOutput = await bgTerm.handle.currentOutput();
-            const strippedOutput = stripCommonPrefix(
-              bgTerm.lastOutput?.output ?? "",
-              newOutput.output,
-            );
-            bgTerm.lastOutput = newOutput;
-
-            return {
-              content: [
-                {
-                  type: "text",
-                  text: toolCommandOutput(bgTerm.status, {
-                    ...newOutput,
-                    output: strippedOutput,
-                  }),
-                },
-              ],
-            };
-          } else {
-            return {
-              content: [
-                {
-                  type: "text",
-                  text: toolCommandOutput(bgTerm.status, bgTerm.pendingOutput),
-                },
-              ],
-            };
-          }
-        } catch (error) {
-          return {
-            isError: true,
-            content: [
-              {
-                type: "text",
-                text: "Retrieving bash output failed: " + formatErrorMessage(error),
-              },
-            ],
-          };
-        }
-      },
-    );
-
-    server.registerTool(
-      unqualifiedToolNames.killShell,
-      {
-        title: unqualifiedToolNames.killShell,
-        description: `- Kills a running background bash shell by its ID
-- Takes a shell_id parameter identifying the shell to kill
-- Returns a success or failure status
-- Use this tool when you need to terminate a long-running shell
-
-In sessions with ${acpToolNames.killShell} always use it instead of KillShell.`,
-        inputSchema: {
-          shell_id: z
-            .string()
-            .describe(
-              `The id of the background bash command as returned by \`${acpToolNames.bash}\``,
-            ),
-        },
-      },
-      async (input) => {
-        try {
-          const bgTerm = agent.backgroundTerminals[input.shell_id];
-
-          if (!bgTerm) {
-            throw new Error(`Unknown shell ${input.shell_id}`);
-          }
-
-          switch (bgTerm.status) {
-            case "started": {
-              await bgTerm.handle.kill();
-              const currentOutput = await bgTerm.handle.currentOutput();
-              agent.backgroundTerminals[bgTerm.handle.id] = {
-                status: "killed",
-                pendingOutput: {
-                  ...currentOutput,
-                  output: stripCommonPrefix(bgTerm.lastOutput?.output ?? "", currentOutput.output),
-                },
-              };
-              await bgTerm.handle.release();
-
-              return {
-                content: [{ type: "text", text: "Command killed successfully." }],
-              };
-            }
-            case "aborted":
-              return {
-                content: [{ type: "text", text: "Command aborted by user." }],
-              };
-            case "exited":
-              return {
-                content: [{ type: "text", text: "Command had already exited." }],
-              };
-            case "killed":
-              return {
-                content: [{ type: "text", text: "Command was already killed." }],
-              };
-            case "timedOut":
-              return {
-                content: [{ type: "text", text: "Command killed by timeout." }],
-              };
-            default: {
-              unreachable(bgTerm);
-              throw new Error("Unexpected background terminal status");
-            }
-          }
-        } catch (error) {
-          return {
-            isError: true,
-            content: [
-              {
-                type: "text",
-                text: "Killing shell failed: " + formatErrorMessage(error),
-              },
-            ],
-          };
-        }
-      },
-    );
-  }
-
-  return server;
-}
-
-function stripCommonPrefix(a: string, b: string): string {
-  let i = 0;
-  while (i < a.length && i < b.length && a[i] === b[i]) {
-    i++;
-  }
-  return b.slice(i);
-}
-
-function toolCommandOutput(
-  status: "started" | "aborted" | "exited" | "killed" | "timedOut",
-  output: TerminalOutputResponse,
-): string {
-  const { exitStatus, output: commandOutput, truncated } = output;
-
-  let toolOutput = "";
-
-  switch (status) {
-    case "started":
-    case "exited": {
-      if (exitStatus && (exitStatus.exitCode ?? null) === null) {
-        toolOutput += `Interrupted by the user. `;
-      }
-      break;
-    }
-    case "killed":
-      toolOutput += `Killed. `;
-      break;
-    case "timedOut":
-      toolOutput += `Timed out. `;
-      break;
-    case "aborted":
-      break;
-    default: {
-      const unreachable: never = status;
-      return unreachable;
-    }
-  }
-
-  if (exitStatus) {
-    if (typeof exitStatus.exitCode === "number") {
-      toolOutput += `Exited with code ${exitStatus.exitCode}.`;
-    }
-
-    if (typeof exitStatus.signal === "string") {
-      toolOutput += `Signal \`${exitStatus.signal}\`. `;
-    }
-
-    toolOutput += "Final output:\n\n";
-  } else {
-    toolOutput += "New output:\n\n";
-  }
-
-  toolOutput += commandOutput;
-
-  if (truncated) {
-    toolOutput += `\n\nCommand output was too long, so it was truncated to ${commandOutput.length} bytes.`;
-  }
-
-  return toolOutput;
-}
-
-/**
- * Replace text in a file and calculate the line numbers where the edits occurred.
- *
- * @param fileContent - The full file content
- * @param edits - Array of edit operations to apply sequentially
- * @returns the new content and the line numbers where replacements occurred in the final content
- */
-export function replaceAndCalculateLocation(
-  fileContent: string,
-  edits: Array<{
-    oldText: string;
-    newText: string;
-    replaceAll?: boolean;
-  }>,
-): { newContent: string; lineNumbers: number[] } {
-  let currentContent = fileContent;
-
-  // Use unique markers to track where replacements happen
-  const markerPrefix = `__REPLACE_MARKER_${Math.random().toString(36).substr(2, 9)}_`;
-  let markerCounter = 0;
-  const markers: string[] = [];
-
-  // Apply edits sequentially, inserting markers at replacement positions
-  for (const edit of edits) {
-    // Skip empty oldText
-    if (edit.oldText === "") {
-      throw new Error(`The provided \`old_string\` is empty.\n\nNo edits were applied.`);
-    }
-
-    if (edit.replaceAll) {
-      // Replace all occurrences with marker + newText
-      const parts: string[] = [];
-      let lastIndex = 0;
-      let searchIndex = 0;
-
-      while (true) {
-        const index = currentContent.indexOf(edit.oldText, searchIndex);
-        if (index === -1) {
-          if (searchIndex === 0) {
-            throw new Error(
-              `The provided \`old_string\` does not appear in the file: "${edit.oldText}".\n\nNo edits were applied.`,
-            );
-          }
-          break;
-        }
-
-        // Add content before the match
-        parts.push(currentContent.substring(lastIndex, index));
-
-        // Add marker and replacement
-        const marker = `${markerPrefix}${markerCounter++}__`;
-        markers.push(marker);
-        parts.push(marker + edit.newText);
-
-        lastIndex = index + edit.oldText.length;
-        searchIndex = lastIndex;
-      }
-
-      // Add remaining content
-      parts.push(currentContent.substring(lastIndex));
-      currentContent = parts.join("");
-    } else {
-      // Replace first occurrence only
-      const index = currentContent.indexOf(edit.oldText);
-      if (index === -1) {
-        throw new Error(
-          `The provided \`old_string\` does not appear in the file: "${edit.oldText}".\n\nNo edits were applied.`,
-        );
-      } else {
-        const marker = `${markerPrefix}${markerCounter++}__`;
-        markers.push(marker);
-        currentContent =
-          currentContent.substring(0, index) +
-          marker +
-          edit.newText +
-          currentContent.substring(index + edit.oldText.length);
-      }
-    }
-  }
-
-  // Find line numbers where markers appear in the content
-  const lineNumbers: number[] = [];
-  for (const marker of markers) {
-    const index = currentContent.indexOf(marker);
-    if (index !== -1) {
-      const lineNumber = Math.max(
-        0,
-        currentContent.substring(0, index).split(/\r\n|\r|\n/).length - 1,
-      );
-      lineNumbers.push(lineNumber);
-    }
-  }
-
-  // Remove all markers from the final content
-  let finalContent = currentContent;
-  for (const marker of markers) {
-    finalContent = finalContent.replace(marker, "");
-  }
-
-  // Dedupe and sort line numbers
-  const uniqueLineNumbers = [...new Set(lineNumbers)].sort();
-
-  return { newContent: finalContent, lineNumbers: uniqueLineNumbers };
-}

src/settings.ts

@@ -1,8 +1,12 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
-import * as os from "node:os";
-import { minimatch } from "minimatch";
-import { ACP_TOOL_NAME_PREFIX, acpToolNames } from "./tools.js";
+// resolveSettings and filterEscalatingDefaultMode are marked @alpha in the
+// SDK; API may shift in a future release.
+import {
+  filterEscalatingDefaultMode,
+  resolveSettings,
+  type Settings,
+} from "@anthropic-ai/claude-agent-sdk";
 import { CLAUDE_CONFIG_DIR } from "./acp-agent.js";
 
 /**
@@ -17,219 +21,10 @@ import { CLAUDE_CONFIG_DIR } from "./acp-agent.js";
  * Docs: https://code.claude.com/docs/en/iam#tool-specific-permission-rules
  */
 
-export interface PermissionSettings {
-  allow?: string[];
-  deny?: string[];
-  ask?: string[];
-  additionalDirectories?: string[];
-  defaultMode?: string;
-}
-
-export interface ClaudeCodeSettings {
-  permissions?: PermissionSettings;
-  env?: Record<string, string>;
-  model?: string;
-}
-
-export type PermissionDecision = "allow" | "deny" | "ask";
-
-export interface PermissionCheckResult {
-  decision: PermissionDecision;
-  rule?: string;
-  source?: "allow" | "deny" | "ask";
-}
-
-interface ParsedRule {
-  toolName: string;
-  argument?: string;
-  isWildcard?: boolean;
-}
-
-/**
- * Shell operators that can be used for command chaining/injection
- * These should cause a prefix match to fail to prevent bypasses like:
- * - "safe-cmd && malicious-cmd"
- * - "safe-cmd; malicious-cmd"
- * - "safe-cmd | malicious-cmd"
- * - "safe-cmd || malicious-cmd"
- * - "$(malicious-cmd)"
- * - "`malicious-cmd`"
- */
-const SHELL_OPERATORS = ["&&", "||", ";", "|", "$(", "`", "\n"];
-
-/**
- * Checks if a string contains shell operators that could allow command chaining
- */
-function containsShellOperator(str: string): boolean {
-  return SHELL_OPERATORS.some((op) => str.includes(op));
-}
-
-/*
- * Tools that modify files. Per Claude Code docs:
- * "Edit rules apply to all built-in tools that edit files."
- * This means an Edit(...) rule should match Write, MultiEdit, etc.
- */
-const FILE_EDITING_TOOLS = [acpToolNames.edit, acpToolNames.write];
-
-/**
- * Tools that read files. Per Claude Code docs:
- * "Claude will make a best-effort attempt to apply Read rules to all built-in tools
- * that read files like Grep and Glob."
- * This means a Read(...) rule should match Grep, Glob, etc.
- */
-const FILE_READING_TOOLS = [acpToolNames.read];
-
-/**
- * Functions to extract the relevant argument from tool input for permission matching
- */
-const TOOL_ARG_ACCESSORS: Record<string, (input: unknown) => string | undefined> = {
-  mcp__acp__Read: (input) => (input as { file_path?: string })?.file_path,
-  mcp__acp__Edit: (input) => (input as { file_path?: string })?.file_path,
-  mcp__acp__Write: (input) => (input as { file_path?: string })?.file_path,
-  mcp__acp__Bash: (input) => (input as { command?: string })?.command,
-};
-
-/**
- * Parses a permission rule string into its components
- * Examples:
- *   "Read" -> { toolName: "Read" }
- *   "Read(./.env)" -> { toolName: "Read", argument: "./.env" }
- *   "Bash(npm run:*)" -> { toolName: "Bash", argument: "npm run", isWildcard: true }
- */
-function parseRule(rule: string): ParsedRule {
-  const match = rule.match(/^(\w+)(?:\((.+)\))?$/);
-  if (!match) {
-    return { toolName: rule };
-  }
-
-  const [, toolName, argument] = match;
-
-  if (argument && argument.endsWith(":*")) {
-    return {
-      toolName,
-      argument: argument.slice(0, -2),
-      isWildcard: true,
-    };
-  }
-
-  return { toolName, argument };
-}
-
-/**
- * Normalizes a path for comparison:
- * - Expands ~ to home directory
- * - Resolves relative paths against cwd
- * - Normalizes path separators
- */
-function normalizePath(filePath: string, cwd: string): string {
-  if (filePath.startsWith("~/")) {
-    filePath = path.join(os.homedir(), filePath.slice(2));
-  } else if (filePath.startsWith("./")) {
-    filePath = path.join(cwd, filePath.slice(2));
-  } else if (!path.isAbsolute(filePath)) {
-    filePath = path.join(cwd, filePath);
-  }
-  // Convert backslashes to forward slashes for minimatch compatibility on Windows
-  return path.normalize(filePath).replace(/\\/g, "/");
-}
-
-/**
- * Checks if a file path matches a glob pattern
- */
-function matchesGlob(pattern: string, filePath: string, cwd: string): boolean {
-  const normalizedPattern = normalizePath(pattern, cwd);
-  const normalizedPath = normalizePath(filePath, cwd);
-
-  return minimatch(normalizedPath, normalizedPattern, {
-    dot: true,
-    matchBase: false,
-    nocase: process.platform === "win32",
-  });
-}
-
-/**
- * Checks if a tool invocation matches a parsed permission rule
- */
-function matchesRule(rule: ParsedRule, toolName: string, toolInput: unknown, cwd: string): boolean {
-  // Per Claude Code docs:
-  // - "Edit rules apply to all built-in tools that edit files."
-  // - "Claude will make a best-effort attempt to apply Read rules to all built-in tools
-  //    that read files like Grep, Glob, and LS."
-  const ruleAppliesToTool =
-    (rule.toolName === "Bash" && toolName === acpToolNames.bash) ||
-    (rule.toolName === "Edit" && FILE_EDITING_TOOLS.includes(toolName)) ||
-    (rule.toolName === "Read" && FILE_READING_TOOLS.includes(toolName));
-
-  if (!ruleAppliesToTool) {
-    return false;
-  }
-
-  if (!rule.argument) {
-    return true;
-  }
-
-  const argAccessor = TOOL_ARG_ACCESSORS[toolName];
-  if (!argAccessor) {
-    return true;
-  }
-
-  const actualArg = argAccessor(toolInput);
-  if (!actualArg) {
-    return false;
-  }
-
-  if (toolName === acpToolNames.bash) {
-    // Per Claude Code docs: https://code.claude.com/docs/en/iam#tool-specific-permission-rules
-    // - Bash(npm run build) matches the EXACT command "npm run build"
-    // - Bash(npm run test:*) matches commands STARTING WITH "npm run test"
-    // The :* suffix enables prefix matching, without it the match is exact
-    //
-    // Also from docs: "Claude Code is aware of shell operators (like &&) so a prefix match
-    // rule like Bash(safe-cmd:*) won't give it permission to run the command safe-cmd && other-cmd"
-    if (rule.isWildcard) {
-      if (!actualArg.startsWith(rule.argument)) {
-        return false;
-      }
-      // Check that the matched prefix isn't followed by shell operators that could
-      // allow command chaining/injection
-      const remainder = actualArg.slice(rule.argument.length);
-      if (containsShellOperator(remainder)) {
-        return false;
-      }
-      return true;
-    }
-    return actualArg === rule.argument;
-  }
-
-  // For file-based tools (Read, Edit, Write), use glob matching
-  return matchesGlob(rule.argument, actualArg, cwd);
-}
-
-/**
- * Reads and parses a JSON settings file, returning an empty object if not found or invalid
- */
-async function loadSettingsFile(filePath: string | null): Promise<ClaudeCodeSettings> {
-  if (!filePath) {
-    return {};
-  }
-
-  try {
-    const content = await fs.promises.readFile(filePath, "utf-8");
-    return JSON.parse(content) as ClaudeCodeSettings;
-  } catch {
-    return {};
-  }
-}
-
-/**
- * Gets the enterprise settings path based on the current platform
- */
-export function getManagedSettingsPath(): string {
+function getManagedSettingsPath(): string {
   switch (process.platform) {
     case "darwin":
       return "/Library/Application Support/ClaudeCode/managed-settings.json";
-    case "linux":
-      return "/etc/claude-code/managed-settings.json";
     case "win32":
       return "C:\\Program Files\\ClaudeCode\\managed-settings.json";
     default:
@@ -243,28 +38,24 @@ export interface SettingsManagerOptions {
 }
 
 /**
- * Manages Claude Code settings from multiple sources with proper precedence.
+ * Manages Claude Code settings using the SDK's `resolveSettings` merge engine
+ * so the values we see match what `query()` would observe.
  *
- * Settings are loaded from (in order of increasing precedence):
- * 1. User settings (~/.claude/settings.json)
- * 2. Project settings (<cwd>/.claude/settings.json)
- * 3. Local project settings (<cwd>/.claude/settings.local.json)
- * 4. Enterprise managed settings (platform-specific path)
- *
- * The manager watches all settings files for changes and automatically reloads.
+ * Watches the user/project/local/managed settings files for changes and
+ * re-resolves through the SDK on update. Escalating `permissions.defaultMode`
+ * values from repo-committed sources are filtered out via
+ * `filterEscalatingDefaultMode`, matching the CLI's trust policy.
  */
 export class SettingsManager {
   private cwd: string;
-  private userSettings: ClaudeCodeSettings = {};
-  private projectSettings: ClaudeCodeSettings = {};
-  private localSettings: ClaudeCodeSettings = {};
-  private enterpriseSettings: ClaudeCodeSettings = {};
-  private mergedSettings: ClaudeCodeSettings = {};
+  private effective: Settings = {};
   private watchers: fs.FSWatcher[] = [];
   private onChange?: () => void;
   private logger: { log: (...args: any[]) => void; error: (...args: any[]) => void };
   private initialized = false;
+  private disposed = false;
   private debounceTimer: ReturnType<typeof setTimeout> | null = null;
+  private initPromise: Promise<void> | null = null;
 
   constructor(cwd: string, options?: SettingsManagerOptions) {
     this.cwd = cwd;
@@ -279,121 +70,53 @@ export class SettingsManager {
     if (this.initialized) {
       return;
     }
-
-    await this.loadAllSettings();
-    this.setupWatchers();
-    this.initialized = true;
-  }
-
-  /**
-   * Returns the path to the user settings file
-   */
-  private getUserSettingsPath(): string {
-    return path.join(CLAUDE_CONFIG_DIR, "settings.json");
-  }
-
-  /**
-   * Returns the path to the project settings file
-   */
-  private getProjectSettingsPath(): string {
-    return path.join(this.cwd, ".claude", "settings.json");
-  }
-
-  /**
-   * Returns the path to the local project settings file
-   */
-  private getLocalSettingsPath(): string {
-    return path.join(this.cwd, ".claude", "settings.local.json");
-  }
-
-  /**
-   * Loads settings from all sources
-   */
-  private async loadAllSettings(): Promise<void> {
-    const [userSettings, projectSettings, localSettings, enterpriseSettings] = await Promise.all([
-      loadSettingsFile(this.getUserSettingsPath()),
-      loadSettingsFile(this.getProjectSettingsPath()),
-      loadSettingsFile(this.getLocalSettingsPath()),
-      loadSettingsFile(getManagedSettingsPath()),
-    ]);
-
-    this.userSettings = userSettings;
-    this.projectSettings = projectSettings;
-    this.localSettings = localSettings;
-    this.enterpriseSettings = enterpriseSettings;
-
-    this.mergeSettings();
-  }
-
-  /**
-   * Merges all settings sources with proper precedence.
-   * For permissions, rules from all sources are combined.
-   * Deny rules always take precedence during permission checks.
-   */
-  private mergeSettings(): void {
-    const allSettings = [
-      this.userSettings,
-      this.projectSettings,
-      this.localSettings,
-      this.enterpriseSettings,
-    ];
-
-    const merged: ClaudeCodeSettings = {
-      permissions: {
-        allow: [],
-        deny: [],
-        ask: [],
-      },
-    };
-
-    for (const settings of allSettings) {
-      if (settings.permissions) {
-        if (settings.permissions.allow) {
-          merged.permissions!.allow!.push(...settings.permissions.allow);
-        }
-        if (settings.permissions.deny) {
-          merged.permissions!.deny!.push(...settings.permissions.deny);
-        }
-        if (settings.permissions.ask) {
-          merged.permissions!.ask!.push(...settings.permissions.ask);
-        }
-        if (settings.permissions.additionalDirectories) {
-          merged.permissions!.additionalDirectories = [
-            ...(merged.permissions!.additionalDirectories || []),
-            ...settings.permissions.additionalDirectories,
-          ];
-        }
-        if (settings.permissions.defaultMode) {
-          merged.permissions!.defaultMode = settings.permissions.defaultMode;
-        }
-      }
-
-      if (settings.env) {
-        merged.env = { ...merged.env, ...settings.env };
-      }
-
-      if (settings.model) {
-        merged.model = settings.model;
-      }
+    if (this.initPromise) {
+      return this.initPromise;
     }
 
-    this.mergedSettings = merged;
+    this.disposed = false;
+    this.initPromise = this.loadAllSettings().then(() => {
+      if (!this.disposed) {
+        this.setupWatchers();
+        this.initialized = true;
+      }
+      this.initPromise = null;
+    });
+    return this.initPromise;
+  }
+
+  /**
+   * Paths the SDK reads when resolving settings for this cwd. Watching the
+   * containing directories means we pick up file creation as well as edits.
+   */
+  private getWatchedPaths(): string[] {
+    return [
+      path.join(CLAUDE_CONFIG_DIR, "settings.json"),
+      path.join(this.cwd, ".claude", "settings.json"),
+      path.join(this.cwd, ".claude", "settings.local.json"),
+      getManagedSettingsPath(),
+    ];
+  }
+
+  /**
+   * Resolves the effective settings via the SDK and applies the CLI's trust
+   * filter for escalating `permissions.defaultMode` values.
+   */
+  private async loadAllSettings(): Promise<void> {
+    try {
+      const resolved = await resolveSettings({ cwd: this.cwd });
+      this.effective = filterEscalatingDefaultMode(resolved);
+    } catch (error) {
+      this.logger.error("Failed to resolve settings:", error);
+      this.effective = {};
+    }
   }
 
   /**
    * Sets up file watchers for all settings files
    */
   private setupWatchers(): void {
-    const paths = [
-      this.getUserSettingsPath(),
-      this.getProjectSettingsPath(),
-      this.getLocalSettingsPath(),
-      getManagedSettingsPath(),
-    ];
-
-    for (const filePath of paths) {
-      if (!filePath) continue;
-
+    for (const filePath of this.getWatchedPaths()) {
       try {
         const dir = path.dirname(filePath);
         const filename = path.basename(filePath);
@@ -427,66 +150,25 @@ export class SettingsManager {
 
     this.debounceTimer = setTimeout(async () => {
       this.debounceTimer = null;
+      if (this.disposed) {
+        return;
+      }
       try {
         await this.loadAllSettings();
-        this.onChange?.();
+        if (!this.disposed) {
+          this.onChange?.();
+        }
       } catch (error) {
         this.logger.error("Failed to reload settings:", error);
       }
     }, 100);
   }
 
-  /**
-   * Checks if a tool invocation is allowed based on the loaded settings.
-   *
-   * @param toolName - The tool name (can be ACP-prefixed like mcp__acp__Read or plain like Read)
-   * @param toolInput - The tool input object
-   * @returns The permission decision and matching rule info
-   */
-  checkPermission(toolName: string, toolInput: unknown): PermissionCheckResult {
-    if (!toolName.startsWith(ACP_TOOL_NAME_PREFIX)) {
-      return { decision: "ask" };
-    }
-
-    const permissions = this.mergedSettings.permissions;
-
-    if (!permissions) {
-      return { decision: "ask" };
-    }
-
-    // Check deny rules first (highest priority)
-    for (const rule of permissions.deny || []) {
-      const parsed = parseRule(rule);
-      if (matchesRule(parsed, toolName, toolInput, this.cwd)) {
-        return { decision: "deny", rule, source: "deny" };
-      }
-    }
-
-    // Check allow rules
-    for (const rule of permissions.allow || []) {
-      const parsed = parseRule(rule);
-      if (matchesRule(parsed, toolName, toolInput, this.cwd)) {
-        return { decision: "allow", rule, source: "allow" };
-      }
-    }
-
-    // Check ask rules
-    for (const rule of permissions.ask || []) {
-      const parsed = parseRule(rule);
-      if (matchesRule(parsed, toolName, toolInput, this.cwd)) {
-        return { decision: "ask", rule, source: "ask" };
-      }
-    }
-
-    // No matching rule - default to ask
-    return { decision: "ask" };
-  }
-
   /**
    * Returns the current merged settings
    */
-  getSettings(): ClaudeCodeSettings {
-    return this.mergedSettings;
+  getSettings(): Settings {
+    return this.effective;
   }
 
   /**
@@ -506,7 +188,6 @@ export class SettingsManager {
 
     this.dispose();
     this.cwd = cwd;
-    this.initialized = false;
     await this.initialize();
   }
 
@@ -514,6 +195,10 @@ export class SettingsManager {
    * Disposes of file watchers and cleans up resources
    */
   dispose(): void {
+    this.disposed = true;
+    this.initialized = false;
+    this.initPromise = null;
+
     if (this.debounceTimer) {
       clearTimeout(this.debounceTimer);
       this.debounceTimer = null;
@@ -523,6 +208,5 @@ export class SettingsManager {
       watcher.close();
     }
     this.watchers = [];
-    this.initialized = false;
   }
 }

src/tests/acp-agent-settings.test.ts

@@ -0,0 +1,782 @@
+import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import * as os from "node:os";
+import type { AgentSideConnection } from "@agentclientprotocol/sdk";
+import type { ClaudeAcpAgent as ClaudeAcpAgentType } from "../acp-agent.js";
+
+const { querySpy } = vi.hoisted(() => ({
+  querySpy: vi.fn(),
+}));
+
+vi.mock("@anthropic-ai/claude-agent-sdk", async () => {
+  const actual = await vi.importActual<any>("@anthropic-ai/claude-agent-sdk");
+  return {
+    ...actual,
+    query: querySpy,
+  };
+});
+
+describe("ClaudeAcpAgent settings", () => {
+  let tempDir: string;
+  let originalClaudeConfigDir: string | undefined;
+
+  function createMockClient(): AgentSideConnection {
+    return {
+      sessionUpdate: async () => {},
+      requestPermission: async () => ({ outcome: { outcome: "cancelled" } }),
+      readTextFile: async () => ({ content: "" }),
+      writeTextFile: async () => ({}),
+    } as unknown as AgentSideConnection;
+  }
+
+  function mockQuery() {
+    let capturedOptions: any;
+    const setModelSpy = vi.fn();
+    querySpy.mockImplementation(({ options }: any) => {
+      capturedOptions = options;
+      return {
+        initializationResult: async () => ({
+          models: [
+            {
+              value: "claude-sonnet-4-6",
+              displayName: "Claude Sonnet 4.5",
+              description: "Default",
+            },
+          ],
+        }),
+        setModel: setModelSpy,
+        supportedCommands: async () => [],
+      } as any;
+    });
+    return { getCapturedOptions: () => capturedOptions, setModelSpy };
+  }
+
+  beforeEach(async () => {
+    tempDir = await fs.promises.mkdtemp(path.join(os.tmpdir(), "acp-agent-settings-"));
+    originalClaudeConfigDir = process.env.CLAUDE_CONFIG_DIR;
+    process.env.CLAUDE_CONFIG_DIR = tempDir;
+    querySpy.mockReset();
+    vi.resetModules();
+  });
+
+  afterEach(async () => {
+    if (originalClaudeConfigDir) {
+      process.env.CLAUDE_CONFIG_DIR = originalClaudeConfigDir;
+    } else {
+      delete process.env.CLAUDE_CONFIG_DIR;
+    }
+    await fs.promises.rm(tempDir, { recursive: true, force: true });
+  });
+
+  it("uses permissions.defaultMode for new sessions", async () => {
+    await fs.promises.writeFile(
+      path.join(tempDir, "settings.json"),
+      JSON.stringify({
+        permissions: {
+          defaultMode: "dontAsk",
+        },
+      }),
+    );
+
+    const projectDir = path.join(tempDir, "project");
+    await fs.promises.mkdir(projectDir, { recursive: true });
+
+    const { getCapturedOptions } = mockQuery();
+
+    const { ClaudeAcpAgent } = await import("../acp-agent.js");
+    const agent: ClaudeAcpAgentType = new ClaudeAcpAgent(createMockClient());
+
+    const response = await (agent as any).createSession({
+      cwd: projectDir,
+      mcpServers: [],
+      _meta: { disableBuiltInTools: true },
+    });
+
+    expect(getCapturedOptions().permissionMode).toBe("dontAsk");
+    expect(getCapturedOptions().settingSources).toEqual(["user", "project", "local"]);
+    expect(response.modes.currentModeId).toBe("dontAsk");
+  });
+
+  it("supports acceptEdits mode defaults", async () => {
+    await fs.promises.writeFile(
+      path.join(tempDir, "settings.json"),
+      JSON.stringify({
+        permissions: {
+          defaultMode: "acceptEdits",
+        },
+      }),
+    );
+
+    const projectDir = path.join(tempDir, "project");
+    await fs.promises.mkdir(projectDir, { recursive: true });
+
+    const { getCapturedOptions } = mockQuery();
+
+    const { ClaudeAcpAgent } = await import("../acp-agent.js");
+    const agent: ClaudeAcpAgentType = new ClaudeAcpAgent(createMockClient());
+
+    const response = await (agent as any).createSession({
+      cwd: projectDir,
+      mcpServers: [],
+      _meta: { disableBuiltInTools: true },
+    });
+
+    expect(getCapturedOptions().permissionMode).toBe("acceptEdits");
+    expect(response.modes.currentModeId).toBe("acceptEdits");
+  });
+
+  it("drops escalating defaultMode when it comes from project-tier settings", async () => {
+    // bypassPermissions in .claude/settings.json (a repo-committed tier) is
+    // filtered by the SDK's trust policy and clamps to 'default'.
+    const projectDir = path.join(tempDir, "project");
+    await fs.promises.mkdir(path.join(projectDir, ".claude"), { recursive: true });
+    await fs.promises.writeFile(
+      path.join(projectDir, ".claude", "settings.json"),
+      JSON.stringify({ permissions: { defaultMode: "bypassPermissions" } }),
+    );
+
+    const { getCapturedOptions } = mockQuery();
+
+    const { ClaudeAcpAgent } = await import("../acp-agent.js");
+    const agent: ClaudeAcpAgentType = new ClaudeAcpAgent(createMockClient());
+
+    const response = await (agent as any).createSession({
+      cwd: projectDir,
+      mcpServers: [],
+      _meta: { disableBuiltInTools: true },
+    });
+
+    expect(getCapturedOptions().permissionMode).toBe("default");
+    expect(response.modes.currentModeId).toBe("default");
+  });
+
+  it("defaults to 'default' when no permissions.defaultMode is set", async () => {
+    const projectDir = path.join(tempDir, "project");
+    await fs.promises.mkdir(projectDir, { recursive: true });
+
+    const { getCapturedOptions } = mockQuery();
+
+    const { ClaudeAcpAgent } = await import("../acp-agent.js");
+    const agent: ClaudeAcpAgentType = new ClaudeAcpAgent(createMockClient());
+
+    const response = await (agent as any).createSession({
+      cwd: projectDir,
+      mcpServers: [],
+      _meta: { disableBuiltInTools: true },
+    });
+
+    expect(getCapturedOptions().permissionMode).toBe("default");
+    expect(response.modes.currentModeId).toBe("default");
+  });
+
+  it("falls back to 'default' when permissions.defaultMode is invalid", async () => {
+    await fs.promises.writeFile(
+      path.join(tempDir, "settings.json"),
+      JSON.stringify({
+        permissions: {
+          defaultMode: "not-a-real-mode",
+        },
+      }),
+    );
+
+    const projectDir = path.join(tempDir, "project");
+    await fs.promises.mkdir(projectDir, { recursive: true });
+
+    const { getCapturedOptions } = mockQuery();
+
+    const { ClaudeAcpAgent } = await import("../acp-agent.js");
+    const agent: ClaudeAcpAgentType = new ClaudeAcpAgent(createMockClient());
+
+    const response = await (agent as any).createSession({
+      cwd: projectDir,
+      mcpServers: [],
+      _meta: { disableBuiltInTools: true },
+    });
+
+    // Bad mode is ignored at the usage site; session creation must not throw.
+    expect(getCapturedOptions().permissionMode).toBe("default");
+    expect(response.modes.currentModeId).toBe("default");
+  });
+
+  it("ignores model from settings when it is not a string", async () => {
+    await fs.promises.writeFile(
+      path.join(tempDir, "settings.json"),
+      JSON.stringify({
+        model: 123,
+      }),
+    );
+
+    const projectDir = path.join(tempDir, "project");
+    await fs.promises.mkdir(projectDir, { recursive: true });
+
+    const { setModelSpy } = mockQuery();
+
+    const { ClaudeAcpAgent } = await import("../acp-agent.js");
+    const agent: ClaudeAcpAgentType = new ClaudeAcpAgent(createMockClient());
+
+    const response = await (agent as any).createSession({
+      cwd: projectDir,
+      mcpServers: [],
+      _meta: { disableBuiltInTools: true },
+    });
+
+    // Bad model is ignored at the usage site; falls back to the first SDK model.
+    // No setModel call is needed because no override was applied — the SDK is
+    // already on its own default.
+    expect(setModelSpy).not.toHaveBeenCalled();
+    expect(response.models.currentModelId).toBe("claude-sonnet-4-6");
+  });
+
+  describe("auto mode availability per model", () => {
+    function mockQueryWithModels(models: any[]): {
+      getCapturedOptions: () => any;
+      setModelSpy: ReturnType<typeof vi.fn>;
+      setPermissionModeSpy: ReturnType<typeof vi.fn>;
+    } {
+      let capturedOptions: any;
+      const setModelSpy = vi.fn();
+      const setPermissionModeSpy = vi.fn();
+      querySpy.mockImplementation(({ options }: any) => {
+        capturedOptions = options;
+        return {
+          initializationResult: async () => ({ models }),
+          setModel: setModelSpy,
+          setPermissionMode: setPermissionModeSpy,
+          supportedCommands: async () => [],
+        } as any;
+      });
+      return {
+        getCapturedOptions: () => capturedOptions,
+        setModelSpy,
+        setPermissionModeSpy,
+      };
+    }
+
+    it("omits `auto` from availableModes when the resolved model lacks supportsAutoMode", async () => {
+      const projectDir = path.join(tempDir, "project");
+      await fs.promises.mkdir(projectDir, { recursive: true });
+
+      mockQueryWithModels([
+        {
+          value: "claude-haiku-4-5",
+          displayName: "Claude Haiku",
+          description: "Fast",
+          // supportsAutoMode intentionally omitted
+        },
+      ]);
+
+      const { ClaudeAcpAgent } = await import("../acp-agent.js");
+      const agent: ClaudeAcpAgentType = new ClaudeAcpAgent(createMockClient());
+
+      const response = await (agent as any).createSession({
+        cwd: projectDir,
+        mcpServers: [],
+        _meta: { disableBuiltInTools: true },
+      });
+
+      const modeIds: string[] = response.modes.availableModes.map((m: any) => m.id);
+      expect(modeIds).not.toContain("auto");
+      expect(modeIds).toEqual(
+        expect.arrayContaining(["default", "acceptEdits", "plan", "dontAsk"]),
+      );
+    });
+
+    it("includes `auto` when the resolved model has supportsAutoMode: true", async () => {
+      const projectDir = path.join(tempDir, "project");
+      await fs.promises.mkdir(projectDir, { recursive: true });
+
+      mockQueryWithModels([
+        {
+          value: "claude-opus-4-5",
+          displayName: "Claude Opus",
+          description: "Most capable",
+          supportsAutoMode: true,
+        },
+      ]);
+
+      const { ClaudeAcpAgent } = await import("../acp-agent.js");
+      const agent: ClaudeAcpAgentType = new ClaudeAcpAgent(createMockClient());
+
+      const response = await (agent as any).createSession({
+        cwd: projectDir,
+        mcpServers: [],
+        _meta: { disableBuiltInTools: true },
+      });
+
+      const modeIds: string[] = response.modes.availableModes.map((m: any) => m.id);
+      expect(modeIds).toContain("auto");
+    });
+
+    it("clamps permissions.defaultMode='auto' to 'default' on a model that lacks supportsAutoMode", async () => {
+      await fs.promises.writeFile(
+        path.join(tempDir, "settings.json"),
+        JSON.stringify({ permissions: { defaultMode: "auto" } }),
+      );
+
+      const projectDir = path.join(tempDir, "project");
+      await fs.promises.mkdir(projectDir, { recursive: true });
+
+      const { getCapturedOptions, setPermissionModeSpy } = mockQueryWithModels([
+        {
+          value: "claude-haiku-4-5",
+          displayName: "Claude Haiku",
+          description: "Fast",
+          // supportsAutoMode intentionally omitted
+        },
+      ]);
+
+      const errorSpy = vi.spyOn(console, "error").mockImplementation(() => {});
+
+      try {
+        const { ClaudeAcpAgent } = await import("../acp-agent.js");
+        const agent: ClaudeAcpAgentType = new ClaudeAcpAgent(createMockClient());
+
+        const response = await (agent as any).createSession({
+          cwd: projectDir,
+          mcpServers: [],
+          _meta: { disableBuiltInTools: true },
+        });
+
+        // Options.permissionMode is built before init resolves, so it still
+        // carries the user-typed value; the SDK was synced via
+        // setPermissionMode after we discovered the model can't honor it.
+        expect(getCapturedOptions().permissionMode).toBe("auto");
+        expect(setPermissionModeSpy).toHaveBeenCalledWith("default");
+        expect(response.modes.currentModeId).toBe("default");
+        expect(response.modes.availableModes.map((m: any) => m.id)).not.toContain("auto");
+
+        // A descriptive warning was logged so operators see the clamp.
+        const messages = errorSpy.mock.calls.map((c) => c.join(" "));
+        expect(messages.some((m) => m.includes("auto") && m.includes("claude-haiku-4-5"))).toBe(
+          true,
+        );
+      } finally {
+        errorSpy.mockRestore();
+      }
+    });
+
+    it("does not clamp permissions.defaultMode='auto' on a model that supports auto", async () => {
+      await fs.promises.writeFile(
+        path.join(tempDir, "settings.json"),
+        JSON.stringify({ permissions: { defaultMode: "auto" } }),
+      );
+
+      const projectDir = path.join(tempDir, "project");
+      await fs.promises.mkdir(projectDir, { recursive: true });
+
+      const { getCapturedOptions, setPermissionModeSpy } = mockQueryWithModels([
+        {
+          value: "claude-opus-4-5",
+          displayName: "Claude Opus",
+          description: "Most capable",
+          supportsAutoMode: true,
+        },
+      ]);
+
+      const { ClaudeAcpAgent } = await import("../acp-agent.js");
+      const agent: ClaudeAcpAgentType = new ClaudeAcpAgent(createMockClient());
+
+      const response = await (agent as any).createSession({
+        cwd: projectDir,
+        mcpServers: [],
+        _meta: { disableBuiltInTools: true },
+      });
+
+      expect(getCapturedOptions().permissionMode).toBe("auto");
+      expect(setPermissionModeSpy).not.toHaveBeenCalled();
+      expect(response.modes.currentModeId).toBe("auto");
+    });
+  });
+
+  describe("availableModels allowlist from settings", () => {
+    function mockQueryWithModels(models: any[]): {
+      setModelSpy: ReturnType<typeof vi.fn>;
+    } {
+      const setModelSpy = vi.fn();
+      querySpy.mockImplementation(() => {
+        return {
+          initializationResult: async () => ({ models }),
+          setModel: setModelSpy,
+          supportedCommands: async () => [],
+        } as any;
+      });
+      return { setModelSpy };
+    }
+
+    it("restricts configOptions to the user's allowlist using their exact IDs", async () => {
+      // Reproduces the scenario from
+      // https://github.com/agentclientprotocol/claude-agent-acp/issues/620:
+      // user lists `claude-haiku-4-5` (no date pin) in availableModels, but
+      // the SDK still surfaces its `haiku` alias which resolves to a
+      // date-pinned variant the user doesn't have access to.
+      await fs.promises.writeFile(
+        path.join(tempDir, "settings.json"),
+        JSON.stringify({
+          availableModels: [
+            "claude-sonnet-4-6[1m]",
+            "claude-opus-4-6[1m]",
+            "claude-haiku-4-5",
+            "claude-opus-4-7[1m]",
+          ],
+        }),
+      );
+
+      const projectDir = path.join(tempDir, "project");
+      await fs.promises.mkdir(projectDir, { recursive: true });
+
+      mockQueryWithModels([
+        { value: "default", displayName: "Default", description: "Default model" },
+        {
+          value: "sonnet[1m]",
+          displayName: "Sonnet (1M context)",
+          description: "Sonnet 4.6 long context",
+        },
+        {
+          value: "opus[1m]",
+          displayName: "Opus (1M context)",
+          description: "Opus 1M context",
+        },
+        { value: "haiku", displayName: "Haiku", description: "Fast" },
+      ]);
+
+      const { ClaudeAcpAgent } = await import("../acp-agent.js");
+      const agent: ClaudeAcpAgentType = new ClaudeAcpAgent(createMockClient());
+
+      const response = await (agent as any).createSession({
+        cwd: projectDir,
+        mcpServers: [],
+        _meta: { disableBuiltInTools: true },
+      });
+
+      const modelOption = response.configOptions.find((o: any) => o.id === "model");
+      expect(modelOption.options.map((o: any) => o.value)).toEqual([
+        "default",
+        "claude-sonnet-4-6[1m]",
+        "claude-opus-4-6[1m]",
+        "claude-haiku-4-5",
+        "claude-opus-4-7[1m]",
+      ]);
+    });
+
+    it("unions availableModels across user and project settings", async () => {
+      // https://code.claude.com/docs/en/model-config#merge-behavior
+      await fs.promises.writeFile(
+        path.join(tempDir, "settings.json"),
+        JSON.stringify({ availableModels: ["claude-haiku-4-5"] }),
+      );
+
+      const projectDir = path.join(tempDir, "project");
+      await fs.promises.mkdir(path.join(projectDir, ".claude"), { recursive: true });
+      await fs.promises.writeFile(
+        path.join(projectDir, ".claude", "settings.json"),
+        JSON.stringify({
+          availableModels: ["claude-haiku-4-5", "claude-opus-4-7[1m]"],
+        }),
+      );
+
+      mockQueryWithModels([
+        { value: "default", displayName: "Default", description: "Default model" },
+        { value: "haiku", displayName: "Haiku", description: "Fast" },
+      ]);
+
+      const { ClaudeAcpAgent } = await import("../acp-agent.js");
+      const agent: ClaudeAcpAgentType = new ClaudeAcpAgent(createMockClient());
+
+      const response = await (agent as any).createSession({
+        cwd: projectDir,
+        mcpServers: [],
+        _meta: { disableBuiltInTools: true },
+      });
+
+      const modelOption = response.configOptions.find((o: any) => o.id === "model");
+      // User and project entries are unioned and deduplicated.
+      expect(modelOption.options.map((o: any) => o.value)).toEqual([
+        "default",
+        "claude-haiku-4-5",
+        "claude-opus-4-7[1m]",
+      ]);
+    });
+
+    it("returns only the default entry when availableModels is an empty array", async () => {
+      await fs.promises.writeFile(
+        path.join(tempDir, "settings.json"),
+        JSON.stringify({ availableModels: [] }),
+      );
+
+      const projectDir = path.join(tempDir, "project");
+      await fs.promises.mkdir(projectDir, { recursive: true });
+
+      mockQueryWithModels([
+        { value: "default", displayName: "Default", description: "Default model" },
+        { value: "haiku", displayName: "Haiku", description: "Fast" },
+      ]);
+
+      const { ClaudeAcpAgent } = await import("../acp-agent.js");
+      const agent: ClaudeAcpAgentType = new ClaudeAcpAgent(createMockClient());
+
+      const response = await (agent as any).createSession({
+        cwd: projectDir,
+        mcpServers: [],
+        _meta: { disableBuiltInTools: true },
+      });
+
+      const modelOption = response.configOptions.find((o: any) => o.id === "model");
+      expect(modelOption.options.map((o: any) => o.value)).toEqual(["default"]);
+    });
+
+    it("does not filter when availableModels is absent from settings", async () => {
+      const projectDir = path.join(tempDir, "project");
+      await fs.promises.mkdir(projectDir, { recursive: true });
+
+      mockQueryWithModels([
+        { value: "default", displayName: "Default", description: "Default model" },
+        { value: "haiku", displayName: "Haiku", description: "Fast" },
+      ]);
+
+      const { ClaudeAcpAgent } = await import("../acp-agent.js");
+      const agent: ClaudeAcpAgentType = new ClaudeAcpAgent(createMockClient());
+
+      const response = await (agent as any).createSession({
+        cwd: projectDir,
+        mcpServers: [],
+        _meta: { disableBuiltInTools: true },
+      });
+
+      const modelOption = response.configOptions.find((o: any) => o.id === "model");
+      expect(modelOption.options.map((o: any) => o.value)).toEqual(["default", "haiku"]);
+    });
+
+    it("passes the user's exact ID to setModel when it matches an SDK alias", async () => {
+      // Without the allowlist, the SDK would resolve `haiku` to a
+      // date-pinned variant. Forcing setModel to receive `claude-haiku-4-5`
+      // is exactly what the issue's workaround
+      // (`ANTHROPIC_DEFAULT_HAIKU_MODEL`) achieves manually.
+      await fs.promises.writeFile(
+        path.join(tempDir, "settings.json"),
+        JSON.stringify({
+          availableModels: ["claude-haiku-4-5"],
+          model: "claude-haiku-4-5",
+        }),
+      );
+
+      const projectDir = path.join(tempDir, "project");
+      await fs.promises.mkdir(projectDir, { recursive: true });
+
+      const { setModelSpy } = mockQueryWithModels([
+        { value: "default", displayName: "Default", description: "Default model" },
+        { value: "haiku", displayName: "Haiku", description: "Fast" },
+      ]);
+
+      const { ClaudeAcpAgent } = await import("../acp-agent.js");
+      const agent: ClaudeAcpAgentType = new ClaudeAcpAgent(createMockClient());
+
+      const response = await (agent as any).createSession({
+        cwd: projectDir,
+        mcpServers: [],
+        _meta: { disableBuiltInTools: true },
+      });
+
+      expect(setModelSpy).toHaveBeenCalledWith("claude-haiku-4-5");
+      expect(response.models.currentModelId).toBe("claude-haiku-4-5");
+    });
+
+    it("does not inherit display info across mismatched model family versions", async () => {
+      // https://github.com/agentclientprotocol/claude-agent-acp/issues/639:
+      // when the SDK's `opus` alias resolves to Opus 4.7, an allowlist entry
+      // of `claude-opus-4-6` (or `claude-opus-4-6[1m]`) used to substring-match
+      // `opus` and inherit the "Opus 4.7" display info. With version-aware
+      // matching, these entries fall back to showing their literal ID rather
+      // than a misleading newer name.
+      await fs.promises.writeFile(
+        path.join(tempDir, "settings.json"),
+        JSON.stringify({
+          availableModels: [
+            "claude-opus-4-6",
+            "claude-opus-4-6[1m]",
+            "claude-opus-4-7",
+            "claude-opus-4-7[1m]",
+          ],
+        }),
+      );
+
+      const projectDir = path.join(tempDir, "project");
+      await fs.promises.mkdir(projectDir, { recursive: true });
+
+      mockQueryWithModels([
+        { value: "default", displayName: "Default", description: "Default model" },
+        {
+          value: "opus",
+          displayName: "Opus 4.7",
+          description: "Claude Opus 4.7 — complex tasks, higher cost",
+        },
+        {
+          value: "opus[1m]",
+          displayName: "Opus 4.7 (1M context)",
+          description: "Opus 4.7 with 1M context",
+        },
+      ]);
+
+      const { ClaudeAcpAgent } = await import("../acp-agent.js");
+      const agent: ClaudeAcpAgentType = new ClaudeAcpAgent(createMockClient());
+
+      const response = await (agent as any).createSession({
+        cwd: projectDir,
+        mcpServers: [],
+        _meta: { disableBuiltInTools: true },
+      });
+
+      const modelOption = response.configOptions.find((o: any) => o.id === "model");
+      const byValue: Record<string, { name: string; description?: string }> = {};
+      for (const opt of modelOption.options) {
+        byValue[opt.value] = { name: opt.name, description: opt.description };
+      }
+
+      // 4-6 entries must NOT inherit the 4.7 SDK alias display info.
+      expect(byValue["claude-opus-4-6"].name).toBe("claude-opus-4-6");
+      expect(byValue["claude-opus-4-6"].description).toBe("");
+      expect(byValue["claude-opus-4-6[1m]"].name).toBe("claude-opus-4-6[1m]");
+      expect(byValue["claude-opus-4-6[1m]"].description).toBe("");
+
+      // 4-7 entries continue to inherit display info from a 4.7 SDK alias.
+      expect(byValue["claude-opus-4-7"].name).toBe("Opus 4.7");
+      expect(byValue["claude-opus-4-7[1m]"].name).toMatch(/Opus 4\.7/);
+    });
+  });
+
+  it("resolves model aliases like opus[1m] to the correct model", async () => {
+    await fs.promises.writeFile(
+      path.join(tempDir, "settings.json"),
+      JSON.stringify({
+        model: "opus[1m]",
+      }),
+    );
+
+    const projectDir = path.join(tempDir, "project");
+    await fs.promises.mkdir(projectDir, { recursive: true });
+
+    const setModelSpy = vi.fn();
+    querySpy.mockImplementation(({ options: _options }: any) => {
+      return {
+        initializationResult: async () => ({
+          models: [
+            {
+              value: "claude-opus-4-6",
+              displayName: "Claude Opus 4.6",
+              description: "Base",
+            },
+            {
+              value: "claude-opus-4-6-1m",
+              displayName: "Claude Opus 4.6 (1M)",
+              description: "Long context",
+            },
+          ],
+        }),
+        setModel: setModelSpy,
+        supportedCommands: async () => [],
+      } as any;
+    });
+
+    const { ClaudeAcpAgent } = await import("../acp-agent.js");
+    const agent: ClaudeAcpAgentType = new ClaudeAcpAgent(createMockClient());
+
+    const response = await (agent as any).createSession({
+      cwd: projectDir,
+      mcpServers: [],
+      _meta: { disableBuiltInTools: true },
+    });
+
+    expect(setModelSpy).toHaveBeenCalledWith("claude-opus-4-6-1m");
+    expect(response.models.currentModelId).toBe("claude-opus-4-6-1m");
+  });
+
+  it("skips the initial setModel when the resolved value matches the SDK's model list verbatim", async () => {
+    // Covers the launcher case from PR #646: the launcher bakes the model into
+    // ANTHROPIC_MODEL, the SDK already starts on that model, and a second
+    // setModel call would be a redundant round-trip (and on some launcher
+    // setups, more fragile than launch-time selection).
+    const originalEnv = process.env.ANTHROPIC_MODEL;
+    process.env.ANTHROPIC_MODEL = "claude-opus-4-6";
+
+    const projectDir = path.join(tempDir, "project");
+    await fs.promises.mkdir(projectDir, { recursive: true });
+
+    const setModelSpy = vi.fn();
+    querySpy.mockImplementation(() => {
+      return {
+        initializationResult: async () => ({
+          models: [
+            { value: "default", displayName: "Default", description: "" },
+            { value: "claude-sonnet-4-6", displayName: "Claude Sonnet 4.6", description: "" },
+            { value: "claude-opus-4-6", displayName: "Claude Opus 4.6", description: "" },
+          ],
+        }),
+        setModel: setModelSpy,
+        supportedCommands: async () => [],
+      } as any;
+    });
+
+    try {
+      const { ClaudeAcpAgent } = await import("../acp-agent.js");
+      const agent: ClaudeAcpAgentType = new ClaudeAcpAgent(createMockClient());
+
+      const response = await (agent as any).createSession({
+        cwd: projectDir,
+        mcpServers: [],
+        _meta: { disableBuiltInTools: true },
+      });
+
+      expect(setModelSpy).not.toHaveBeenCalled();
+      expect(response.models.currentModelId).toBe("claude-opus-4-6");
+    } finally {
+      if (originalEnv === undefined) {
+        delete process.env.ANTHROPIC_MODEL;
+      } else {
+        process.env.ANTHROPIC_MODEL = originalEnv;
+      }
+    }
+  });
+
+  it("still calls setModel when the allowlist synthesizes a value the SDK has not surfaced", async () => {
+    // The allowlist may rewrite a model's `value` to the user's literal ID
+    // (e.g., `claude-haiku-4-5`) even when the SDK only exposed an alias
+    // (`haiku`). In that case the SDK has not independently arrived at the
+    // user's preferred ID, so we must sync via setModel.
+    await fs.promises.writeFile(
+      path.join(tempDir, "settings.json"),
+      JSON.stringify({
+        availableModels: ["claude-haiku-4-5"],
+        model: "claude-haiku-4-5",
+      }),
+    );
+
+    const projectDir = path.join(tempDir, "project");
+    await fs.promises.mkdir(projectDir, { recursive: true });
+
+    const setModelSpy = vi.fn();
+    querySpy.mockImplementation(() => {
+      return {
+        initializationResult: async () => ({
+          models: [
+            { value: "default", displayName: "Default", description: "" },
+            { value: "haiku", displayName: "Haiku", description: "Fast" },
+          ],
+        }),
+        setModel: setModelSpy,
+        supportedCommands: async () => [],
+      } as any;
+    });
+
+    const { ClaudeAcpAgent } = await import("../acp-agent.js");
+    const agent: ClaudeAcpAgentType = new ClaudeAcpAgent(createMockClient());
+
+    const response = await (agent as any).createSession({
+      cwd: projectDir,
+      mcpServers: [],
+      _meta: { disableBuiltInTools: true },
+    });
+
+    expect(setModelSpy).toHaveBeenCalledWith("claude-haiku-4-5");
+    expect(response.models.currentModelId).toBe("claude-haiku-4-5");
+  });
+});

src/tests/additional-roots.test.ts

@@ -0,0 +1,108 @@
+import { mkdtemp, rm } from "node:fs/promises";
+import * as os from "node:os";
+import * as path from "node:path";
+import { AgentSideConnection, SessionNotification } from "@agentclientprotocol/sdk";
+import type { Options } from "@anthropic-ai/claude-agent-sdk";
+import type { ClaudeAcpAgent as ClaudeAcpAgentType } from "../acp-agent.js";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+let capturedOptions: Options | undefined;
+vi.mock("@anthropic-ai/claude-agent-sdk", async () => ({
+  ...(await vi.importActual<typeof import("@anthropic-ai/claude-agent-sdk")>(
+    "@anthropic-ai/claude-agent-sdk",
+  )),
+  query: ({ options }: { options: Options }) => {
+    capturedOptions = options;
+    return {
+      initializationResult: async () => ({
+        models: [
+          {
+            value: "claude-sonnet-4-6",
+            displayName: "Claude Sonnet",
+            description: "Fast",
+            supportsAutoMode: true,
+          },
+        ],
+      }),
+      setModel: async () => {},
+      setPermissionMode: async () => {},
+      supportedCommands: async () => [],
+      [Symbol.asyncIterator]: async function* () {},
+    };
+  },
+}));
+vi.mock("../tools.js", async () => ({
+  ...(await vi.importActual<typeof import("../tools.js")>("../tools.js")),
+  registerHookCallback: vi.fn(),
+}));
+
+describe("additionalRoots", () => {
+  let agent: ClaudeAcpAgentType;
+  const tempDirs: string[] = [];
+  const newSession = (meta: Record<string, unknown>, cwd = "/test") =>
+    agent.newSession({ cwd, mcpServers: [], _meta: meta });
+
+  beforeEach(async () => {
+    capturedOptions = undefined;
+    tempDirs.length = 0;
+    vi.resetModules();
+    const { ClaudeAcpAgent } = await import("../acp-agent.js");
+    agent = new ClaudeAcpAgent({
+      sessionUpdate: async (_notification: SessionNotification) => {},
+      requestPermission: async () => ({ outcome: { outcome: "cancelled" } }),
+      readTextFile: async () => ({ content: "" }),
+      writeTextFile: async () => ({}),
+    } as unknown as AgentSideConnection);
+  });
+
+  afterEach(
+    async () =>
+      void (await Promise.all(tempDirs.map((dir) => rm(dir, { recursive: true, force: true })))),
+  );
+
+  it("passes through relative roots as provided", async () => {
+    const projectRoot = await mkdtemp(path.join(os.tmpdir(), "claude-project-"));
+    tempDirs.push(projectRoot);
+    await newSession({ additionalRoots: ["."] }, projectRoot);
+    expect(capturedOptions!.additionalDirectories).toEqual(["."]);
+  });
+
+  it("merges additionalRoots with user additionalDirectories without normalization", async () => {
+    const root = await mkdtemp(path.join(os.tmpdir(), "claude-root-"));
+    tempDirs.push(root);
+    await newSession({
+      additionalRoots: ["", root],
+      claudeCode: { options: { additionalDirectories: ["/workspace/shared"] } },
+    });
+    expect(capturedOptions!.additionalDirectories).toEqual(["/workspace/shared", "", root]);
+  });
+
+  it("prefers the official ACP additionalDirectories field over _meta.additionalRoots", async () => {
+    await agent.newSession({
+      cwd: "/test",
+      mcpServers: [],
+      additionalDirectories: ["/from/official"],
+      _meta: { additionalRoots: ["/from/meta"] },
+    });
+    expect(capturedOptions!.additionalDirectories).toEqual(["/from/official"]);
+  });
+
+  it("merges official ACP additionalDirectories with claudeCode SDK additionalDirectories", async () => {
+    await agent.newSession({
+      cwd: "/test",
+      mcpServers: [],
+      additionalDirectories: ["/from/official"],
+      _meta: { claudeCode: { options: { additionalDirectories: ["/from/sdk"] } } },
+    });
+    expect(capturedOptions!.additionalDirectories).toEqual(["/from/sdk", "/from/official"]);
+  });
+
+  it("falls back to _meta.additionalRoots when the official field is omitted", async () => {
+    await agent.newSession({
+      cwd: "/test",
+      mcpServers: [],
+      _meta: { additionalRoots: ["/from/meta"] },
+    });
+    expect(capturedOptions!.additionalDirectories).toEqual(["/from/meta"]);
+  });
+});

src/tests/authorization.test.ts

@@ -0,0 +1,296 @@
+import { describe, expect, it, Mock, vi, afterEach, beforeEach } from "vitest";
+import { ClaudeAcpAgent } from "../acp-agent.js";
+import { AgentSideConnection } from "@agentclientprotocol/sdk";
+
+const mockQuery = vi.hoisted(() =>
+  vi.fn(() => ({
+    initializationResult: vi.fn().mockResolvedValue({
+      models: [
+        { value: "id", displayName: "name", description: "description", supportsAutoMode: true },
+      ],
+    }),
+    setModel: vi.fn(),
+    setPermissionMode: vi.fn(),
+    supportedCommands: vi.fn().mockResolvedValue([]),
+  })),
+);
+
+vi.mock("@anthropic-ai/claude-agent-sdk", () => ({
+  query: mockQuery,
+}));
+
+describe("authorization", () => {
+  beforeEach(() => {
+    vi.useFakeTimers();
+  });
+
+  afterEach(() => {
+    //await all pending events like
+    vi.runAllTimers();
+    vi.useRealTimers();
+
+    vi.unstubAllGlobals();
+    vi.resetAllMocks();
+  });
+
+  async function createAgentMock(): Promise<[ClaudeAcpAgent, Mock]> {
+    const connectionMock = {
+      sessionUpdate: async (_: any) => {},
+    } as AgentSideConnection;
+
+    const agent = new ClaudeAcpAgent(connectionMock);
+
+    return [agent, mockQuery];
+  }
+
+  it("gateway auth not offered without capability", async () => {
+    const [agent] = await createAgentMock();
+
+    const initializeResponse = await agent.initialize({
+      protocolVersion: 1,
+      clientCapabilities: {},
+    });
+    expect(initializeResponse.authMethods).not.toContainEqual(
+      expect.objectContaining({ id: "gateway" }),
+    );
+    expect(initializeResponse.authMethods).not.toContainEqual(
+      expect.objectContaining({ id: "gateway-bedrock" }),
+    );
+  });
+
+  it("gateway auth offered when client advertises auth._meta.gateway capability", async () => {
+    const [agent] = await createAgentMock();
+
+    const initializeResponse = await agent.initialize({
+      protocolVersion: 1,
+      clientCapabilities: {
+        auth: { _meta: { gateway: true } },
+      } as any,
+    });
+    expect(initializeResponse.authMethods).toContainEqual(
+      expect.objectContaining({
+        id: "gateway",
+        _meta: { gateway: { protocol: "anthropic" } },
+      }),
+    );
+    expect(initializeResponse.authMethods).toContainEqual(
+      expect.objectContaining({
+        id: "gateway-bedrock",
+        _meta: { gateway: { protocol: "bedrock" } },
+      }),
+    );
+  });
+
+  it("uses gateway env after anthropic gateway auth", async () => {
+    const [agent, mockQuery] = await createAgentMock();
+
+    const initializeResponse = await agent.initialize({
+      protocolVersion: 1,
+      clientCapabilities: {
+        auth: { terminal: true, _meta: { gateway: true } },
+      } as any,
+    });
+    expect(initializeResponse.authMethods).toContainEqual(
+      expect.objectContaining({ id: "gateway" }),
+    );
+
+    await agent.authenticate({
+      methodId: "gateway",
+      _meta: { gateway: { baseUrl: "https://gateway.example", headers: { "x-api-key": "test" } } },
+    });
+
+    await agent.newSession({
+      cwd: "testRoot",
+      mcpServers: [],
+      _meta: {
+        claudeCode: {
+          options: {
+            env: {
+              userEnv: "userEnv",
+            },
+          },
+        },
+      },
+    });
+
+    expect(mockQuery).toHaveBeenCalledWith(
+      expect.objectContaining({
+        options: expect.objectContaining({
+          env: expect.objectContaining({
+            ANTHROPIC_AUTH_TOKEN: " ",
+            ANTHROPIC_BASE_URL: "https://gateway.example",
+            ANTHROPIC_CUSTOM_HEADERS: "x-api-key: test",
+            userEnv: "userEnv",
+          }),
+        }),
+      }),
+    );
+  });
+
+  it("uses gateway env after gateway auth", async () => {
+    const [agent, mockQuery] = await createAgentMock();
+
+    await agent.initialize({
+      protocolVersion: 1,
+      clientCapabilities: {
+        auth: { terminal: true, _meta: { gateway: true } },
+      } as any,
+    });
+
+    await agent.authenticate({
+      methodId: "gateway-bedrock",
+      _meta: {
+        gateway: { baseUrl: "https://gateway.example", headers: { "custom-header": "test" } },
+      },
+    });
+
+    await agent.newSession({
+      cwd: "testRoot",
+      mcpServers: [],
+    });
+
+    expect(mockQuery).toHaveBeenCalledWith(
+      expect.objectContaining({
+        options: expect.objectContaining({
+          env: expect.objectContaining({
+            CLAUDE_CODE_USE_BEDROCK: "1",
+            AWS_BEARER_TOKEN_BEDROCK: " ",
+            ANTHROPIC_BEDROCK_BASE_URL: "https://gateway.example",
+            ANTHROPIC_CUSTOM_HEADERS: "custom-header: test",
+          }),
+        }),
+      }),
+    );
+  });
+
+  it("hide claude authentication without terminal-auth", async () => {
+    const [agent] = await createAgentMock();
+    vi.stubGlobal("process", { ...process, argv: ["--hide-claude-auth"] });
+
+    const initializeResponse = await agent.initialize({
+      protocolVersion: 1,
+      clientCapabilities: {
+        auth: { _meta: { gateway: true } },
+      } as any,
+    });
+    expect(initializeResponse.authMethods).not.toContainEqual(
+      expect.objectContaining({ id: "claude-ai-login" }),
+    );
+    expect(initializeResponse.authMethods).not.toContainEqual(
+      expect.objectContaining({ id: "console-login" }),
+    );
+    expect(initializeResponse.authMethods).toContainEqual(
+      expect.objectContaining({ id: "gateway" }),
+    );
+  });
+
+  it("hide claude auth but still show console login when terminal-auth is set", async () => {
+    const [agent] = await createAgentMock();
+    vi.stubGlobal("process", { ...process, argv: ["--hide-claude-auth"] });
+
+    const initializeResponse = await agent.initialize({
+      protocolVersion: 1,
+      clientCapabilities: {
+        _meta: { "terminal-auth": true },
+      },
+    });
+    expect(initializeResponse.authMethods).not.toContainEqual(
+      expect.objectContaining({ id: "claude-ai-login" }),
+    );
+    expect(initializeResponse.authMethods).toContainEqual(
+      expect.objectContaining({ id: "console-login" }),
+    );
+  });
+
+  it("hide claude auth but still show console login with terminal capability", async () => {
+    const [agent] = await createAgentMock();
+    vi.stubGlobal("process", { ...process, argv: ["--hide-claude-auth"] });
+
+    const initializeResponse = await agent.initialize({
+      protocolVersion: 1,
+      clientCapabilities: {
+        auth: { terminal: true },
+      },
+    });
+    expect(initializeResponse.authMethods).not.toContainEqual(
+      expect.objectContaining({ id: "claude-ai-login" }),
+    );
+    expect(initializeResponse.authMethods).toContainEqual(
+      expect.objectContaining({ id: "console-login" }),
+    );
+  });
+
+  it("SSH session falls back to single legacy login method", async () => {
+    const [agent] = await createAgentMock();
+    vi.stubGlobal("process", { ...process, env: { ...process.env, SSH_TTY: "/dev/pts/0" } });
+
+    const initializeResponse = await agent.initialize({
+      protocolVersion: 1,
+      clientCapabilities: { auth: { terminal: true } },
+    });
+
+    expect(initializeResponse.authMethods).toContainEqual(
+      expect.objectContaining({ id: "claude-login" }),
+    );
+    expect(initializeResponse.authMethods).not.toContainEqual(
+      expect.objectContaining({ id: "claude-ai-login" }),
+    );
+    expect(initializeResponse.authMethods).not.toContainEqual(
+      expect.objectContaining({ id: "console-login" }),
+    );
+  });
+
+  it("CLAUDE_CODE_REMOTE falls back to single legacy login method", async () => {
+    const [agent] = await createAgentMock();
+    vi.stubGlobal("process", { ...process, env: { ...process.env, CLAUDE_CODE_REMOTE: "1" } });
+
+    const initializeResponse = await agent.initialize({
+      protocolVersion: 1,
+      clientCapabilities: { auth: { terminal: true } },
+    });
+
+    expect(initializeResponse.authMethods).toContainEqual(
+      expect.objectContaining({ id: "claude-login" }),
+    );
+    expect(initializeResponse.authMethods).not.toContainEqual(
+      expect.objectContaining({ id: "claude-ai-login" }),
+    );
+    expect(initializeResponse.authMethods).not.toContainEqual(
+      expect.objectContaining({ id: "console-login" }),
+    );
+  });
+
+  it("remote environment respects hide-claude-auth", async () => {
+    const [agent] = await createAgentMock();
+    vi.stubGlobal("process", {
+      ...process,
+      argv: ["--hide-claude-auth"],
+      env: { ...process.env, SSH_CONNECTION: "192.168.1.1 12345 192.168.1.2 22" },
+    });
+
+    const initializeResponse = await agent.initialize({
+      protocolVersion: 1,
+      clientCapabilities: { auth: { terminal: true } },
+    });
+
+    expect(initializeResponse.authMethods).not.toContainEqual(
+      expect.objectContaining({ id: "claude-login" }),
+    );
+  });
+
+  it("show claude authentication", async () => {
+    const [agent] = await createAgentMock();
+
+    const initializeResponse = await agent.initialize({
+      protocolVersion: 1,
+      clientCapabilities: { auth: { terminal: true } },
+    });
+
+    expect(initializeResponse.authMethods).toContainEqual(
+      expect.objectContaining({ id: "claude-ai-login" }),
+    );
+    expect(initializeResponse.authMethods).toContainEqual(
+      expect.objectContaining({ id: "console-login" }),
+    );
+  });
+});

src/tests/create-session-options.test.ts

@@ -0,0 +1,476 @@
+import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
+import { AgentSideConnection, SessionNotification } from "@agentclientprotocol/sdk";
+import type { Options } from "@anthropic-ai/claude-agent-sdk";
+import type { ClaudeAcpAgent as ClaudeAcpAgentType } from "../acp-agent.js";
+
+let capturedOptions: Options | undefined;
+vi.mock("@anthropic-ai/claude-agent-sdk", async () => {
+  const actual = await vi.importActual<typeof import("@anthropic-ai/claude-agent-sdk")>(
+    "@anthropic-ai/claude-agent-sdk",
+  );
+  return {
+    ...actual,
+    query: (args: { prompt: unknown; options: Options }) => {
+      capturedOptions = args.options;
+      return {
+        initializationResult: async () => ({
+          models: [
+            {
+              value: "claude-sonnet-4-6",
+              displayName: "Claude Sonnet",
+              description: "Fast",
+              supportsAutoMode: true,
+            },
+          ],
+        }),
+        setModel: async () => {},
+        setPermissionMode: async () => {},
+        supportedCommands: async () => [],
+        [Symbol.asyncIterator]: async function* () {},
+      };
+    },
+  };
+});
+
+vi.mock("../tools.js", async () => {
+  const actual = await vi.importActual<typeof import("../tools.js")>("../tools.js");
+  return {
+    ...actual,
+    registerHookCallback: vi.fn(),
+  };
+});
+
+describe("createSession options merging", () => {
+  let agent: ClaudeAcpAgentType;
+  let ClaudeAcpAgent: typeof ClaudeAcpAgentType;
+
+  function createMockClient(): AgentSideConnection {
+    return {
+      sessionUpdate: async (_notification: SessionNotification) => {},
+      requestPermission: async () => ({ outcome: { outcome: "cancelled" } }),
+      readTextFile: async () => ({ content: "" }),
+      writeTextFile: async () => ({}),
+    } as unknown as AgentSideConnection;
+  }
+
+  beforeEach(async () => {
+    capturedOptions = undefined;
+
+    vi.resetModules();
+    const acpAgent = await import("../acp-agent.js");
+    ClaudeAcpAgent = acpAgent.ClaudeAcpAgent;
+
+    agent = new ClaudeAcpAgent(createMockClient());
+  });
+
+  it("merges user-provided disallowedTools with ACP internal list", async () => {
+    await agent.newSession({
+      cwd: "/test",
+      mcpServers: [],
+      _meta: {
+        claudeCode: {
+          options: {
+            disallowedTools: ["WebSearch", "WebFetch"],
+          },
+        },
+      },
+    });
+
+    // User-provided tools should be present
+    expect(capturedOptions!.disallowedTools).toContain("WebSearch");
+    expect(capturedOptions!.disallowedTools).toContain("WebFetch");
+    // ACP's internal disallowed tool should also be present
+    expect(capturedOptions!.disallowedTools).toContain("AskUserQuestion");
+  });
+
+  it("works when user provides no disallowedTools", async () => {
+    await agent.newSession({
+      cwd: "/test",
+      mcpServers: [],
+    });
+
+    expect(capturedOptions!.disallowedTools).toContain("AskUserQuestion");
+  });
+
+  it("works when user provides empty disallowedTools", async () => {
+    await agent.newSession({
+      cwd: "/test",
+      mcpServers: [],
+      _meta: {
+        claudeCode: {
+          options: {
+            disallowedTools: [],
+          },
+        },
+      },
+    });
+
+    expect(capturedOptions!.disallowedTools).toContain("AskUserQuestion");
+  });
+
+  it("sets tools to empty array when disableBuiltInTools is true", async () => {
+    await agent.newSession({
+      cwd: "/test",
+      mcpServers: [],
+      _meta: {
+        disableBuiltInTools: true,
+        claudeCode: {
+          options: {
+            disallowedTools: ["CustomTool"],
+          },
+        },
+      },
+    });
+
+    // disableBuiltInTools removes all built-in tools from context
+    expect(capturedOptions!.tools).toEqual([]);
+    // User-provided and ACP disallowedTools still apply
+    expect(capturedOptions!.disallowedTools).toContain("CustomTool");
+    expect(capturedOptions!.disallowedTools).toContain("AskUserQuestion");
+  });
+
+  it("merges user-provided hooks with ACP hooks", async () => {
+    const userPreToolUseHook = { hooks: [{ command: "echo pre" }] };
+
+    await agent.newSession({
+      cwd: "/test",
+      mcpServers: [],
+      _meta: {
+        claudeCode: {
+          options: {
+            hooks: {
+              PreToolUse: [userPreToolUseHook],
+              PostToolUse: [{ hooks: [{ command: "echo user-post" }] }],
+            },
+          },
+        },
+      },
+    });
+
+    // User's PreToolUse hooks should be preserved
+    expect(capturedOptions!.hooks?.PreToolUse).toEqual([userPreToolUseHook]);
+    // PostToolUse should contain both user and ACP hooks
+    expect(capturedOptions!.hooks?.PostToolUse).toHaveLength(2);
+  });
+
+  it("inherits HOME and PATH from process.env when no env is provided", async () => {
+    await agent.newSession({
+      cwd: "/test",
+      mcpServers: [],
+    });
+
+    expect(capturedOptions?.env?.HOME).toBe(process.env.HOME);
+    expect(capturedOptions?.env?.PATH).toBe(process.env.PATH);
+  });
+
+  it("merges user-provided env vars on top of process.env", async () => {
+    await agent.newSession({
+      cwd: "/test",
+      mcpServers: [],
+      _meta: {
+        claudeCode: {
+          options: {
+            env: {
+              CUSTOM_VAR: "custom-value",
+            },
+          },
+        },
+      },
+    });
+
+    expect(capturedOptions?.env?.HOME).toBe(process.env.HOME);
+    expect(capturedOptions?.env?.PATH).toBe(process.env.PATH);
+    expect(capturedOptions?.env?.CUSTOM_VAR).toBe("custom-value");
+  });
+
+  it("allows user-provided env vars to override process.env entries", async () => {
+    await agent.newSession({
+      cwd: "/test",
+      mcpServers: [],
+      _meta: {
+        claudeCode: {
+          options: {
+            env: {
+              HOME: "/custom/home",
+            },
+          },
+        },
+      },
+    });
+
+    expect(capturedOptions?.env?.HOME).toBe("/custom/home");
+  });
+
+  it("defaults tools to claude_code preset when not provided", async () => {
+    await agent.newSession({
+      cwd: "/test",
+      mcpServers: [],
+    });
+
+    expect(capturedOptions!.tools).toEqual({ type: "preset", preset: "claude_code" });
+  });
+
+  it("passes through user-provided tools string array", async () => {
+    await agent.newSession({
+      cwd: "/test",
+      mcpServers: [],
+      _meta: {
+        claudeCode: {
+          options: {
+            tools: ["Read", "Glob"],
+          },
+        },
+      },
+    });
+
+    expect(capturedOptions!.tools).toEqual(["Read", "Glob"]);
+  });
+
+  it("explicit tools array takes precedence over disableBuiltInTools", async () => {
+    await agent.newSession({
+      cwd: "/test",
+      mcpServers: [],
+      _meta: {
+        disableBuiltInTools: true,
+        claudeCode: {
+          options: {
+            tools: ["Read", "Glob"],
+          },
+        },
+      },
+    });
+
+    expect(capturedOptions!.tools).toEqual(["Read", "Glob"]);
+  });
+
+  it("passes through empty tools array to disable all built-in tools", async () => {
+    await agent.newSession({
+      cwd: "/test",
+      mcpServers: [],
+      _meta: {
+        claudeCode: {
+          options: {
+            tools: [],
+          },
+        },
+      },
+    });
+
+    expect(capturedOptions!.tools).toEqual([]);
+  });
+
+  describe("systemPrompt via _meta", () => {
+    it("defaults to the claude_code preset when not provided", async () => {
+      await agent.newSession({ cwd: "/test", mcpServers: [] });
+
+      expect(capturedOptions!.systemPrompt).toEqual({
+        type: "preset",
+        preset: "claude_code",
+      });
+    });
+
+    it("replaces the preset when a string is provided", async () => {
+      await agent.newSession({
+        cwd: "/test",
+        mcpServers: [],
+        _meta: { systemPrompt: "custom prompt" },
+      });
+
+      expect(capturedOptions!.systemPrompt).toBe("custom prompt");
+    });
+
+    it("forwards append", async () => {
+      await agent.newSession({
+        cwd: "/test",
+        mcpServers: [],
+        _meta: { systemPrompt: { append: "extra instructions" } },
+      });
+
+      expect(capturedOptions!.systemPrompt).toEqual({
+        type: "preset",
+        preset: "claude_code",
+        append: "extra instructions",
+      });
+    });
+
+    it("forwards excludeDynamicSections", async () => {
+      await agent.newSession({
+        cwd: "/test",
+        mcpServers: [],
+        _meta: { systemPrompt: { excludeDynamicSections: true } },
+      });
+
+      expect(capturedOptions!.systemPrompt).toEqual({
+        type: "preset",
+        preset: "claude_code",
+        excludeDynamicSections: true,
+      });
+    });
+
+    it("forwards append and excludeDynamicSections together", async () => {
+      await agent.newSession({
+        cwd: "/test",
+        mcpServers: [],
+        _meta: {
+          systemPrompt: {
+            append: "extra instructions",
+            excludeDynamicSections: true,
+          },
+        },
+      });
+
+      expect(capturedOptions!.systemPrompt).toEqual({
+        type: "preset",
+        preset: "claude_code",
+        append: "extra instructions",
+        excludeDynamicSections: true,
+      });
+    });
+
+    it("ignores caller-provided type/preset overrides", async () => {
+      await agent.newSession({
+        cwd: "/test",
+        mcpServers: [],
+        _meta: {
+          systemPrompt: {
+            type: "something-else",
+            preset: "other-preset",
+            append: "extra",
+          },
+        },
+      });
+
+      expect(capturedOptions!.systemPrompt).toEqual({
+        type: "preset",
+        preset: "claude_code",
+        append: "extra",
+      });
+    });
+  });
+
+  describe("CLAUDE_MODEL_CONFIG", () => {
+    let originalModelConfig: string | undefined;
+
+    beforeEach(() => {
+      originalModelConfig = process.env.CLAUDE_MODEL_CONFIG;
+      delete process.env.CLAUDE_MODEL_CONFIG;
+    });
+
+    afterEach(() => {
+      if (originalModelConfig !== undefined) {
+        process.env.CLAUDE_MODEL_CONFIG = originalModelConfig;
+      } else {
+        delete process.env.CLAUDE_MODEL_CONFIG;
+      }
+    });
+
+    it("passes modelOverrides as settings", async () => {
+      process.env.CLAUDE_MODEL_CONFIG = JSON.stringify({
+        modelOverrides: { "claude-opus-4-6": "us.anthropic.claude-opus-4-6-v1" },
+      });
+
+      await agent.newSession({ cwd: "/test", mcpServers: [] });
+
+      expect(capturedOptions!.settings).toEqual({
+        modelOverrides: { "claude-opus-4-6": "us.anthropic.claude-opus-4-6-v1" },
+      });
+    });
+
+    it("passes availableModels as settings", async () => {
+      process.env.CLAUDE_MODEL_CONFIG = JSON.stringify({
+        availableModels: ["opus", "sonnet"],
+      });
+
+      await agent.newSession({ cwd: "/test", mcpServers: [] });
+
+      expect(capturedOptions!.settings).toEqual({
+        availableModels: ["opus", "sonnet"],
+      });
+    });
+
+    it("passes both modelOverrides and availableModels", async () => {
+      process.env.CLAUDE_MODEL_CONFIG = JSON.stringify({
+        modelOverrides: { "claude-opus-4-6": "us.anthropic.claude-opus-4-6-v1" },
+        availableModels: ["opus"],
+      });
+
+      await agent.newSession({ cwd: "/test", mcpServers: [] });
+
+      expect(capturedOptions!.settings).toEqual({
+        modelOverrides: { "claude-opus-4-6": "us.anthropic.claude-opus-4-6-v1" },
+        availableModels: ["opus"],
+      });
+    });
+
+    it("does not add settings when env var is not set", async () => {
+      await agent.newSession({ cwd: "/test", mcpServers: [] });
+
+      expect(capturedOptions!.settings).toBeUndefined();
+    });
+
+    it("ignores env var when _meta provides settings", async () => {
+      process.env.CLAUDE_MODEL_CONFIG = JSON.stringify({
+        modelOverrides: { "claude-opus-4-6": "us.anthropic.claude-opus-4-6-v1" },
+      });
+
+      await agent.newSession({
+        cwd: "/test",
+        mcpServers: [],
+        _meta: {
+          claudeCode: {
+            options: {
+              settings: {
+                model: "claude-sonnet-4-6",
+                modelOverrides: { "claude-opus-4-6": "meta-value" },
+              },
+            },
+          },
+        },
+      });
+
+      // _meta settings take precedence; env var is ignored entirely
+      expect(capturedOptions!.settings).toEqual({
+        model: "claude-sonnet-4-6",
+        modelOverrides: { "claude-opus-4-6": "meta-value" },
+      });
+    });
+
+    it("throws on invalid JSON", async () => {
+      process.env.CLAUDE_MODEL_CONFIG = "not-json";
+
+      await expect(agent.newSession({ cwd: "/test", mcpServers: [] })).rejects.toThrow();
+    });
+  });
+
+  it("merges user-provided mcpServers with ACP mcpServers", async () => {
+    await agent.newSession({
+      cwd: "/test",
+      mcpServers: [
+        {
+          name: "acp-server",
+          command: "node",
+          args: ["acp-server.js"],
+          env: [],
+        },
+      ],
+      _meta: {
+        claudeCode: {
+          options: {
+            mcpServers: {
+              "user-server": {
+                type: "stdio",
+                command: "node",
+                args: ["server.js"],
+              },
+            },
+          },
+        },
+      },
+    });
+
+    // User-provided MCP server should be present
+    expect(capturedOptions!.mcpServers).toHaveProperty("user-server");
+    // ACP-provided MCP server should also be present
+    expect(capturedOptions!.mcpServers).toHaveProperty("acp-server");
+  });
+});

src/tests/extract-lines.test.ts

@@ -1,103 +0,0 @@
-import { describe, it, expect } from "vitest";
-import { extractLinesWithByteLimit } from "../utils.js";
-
-describe("extractLinesWithByteLimit", () => {
-  const simpleContent = "Line 1\nLine 2\nLine 3\nLine 4\nLine 5";
-
-  it("should extract all lines when under byte limit", () => {
-    const result = extractLinesWithByteLimit(simpleContent, 1000);
-
-    expect(result.content).toBe(simpleContent);
-    expect(result.wasLimited).toBe(false);
-    expect(result.linesRead).toBe(5);
-  });
-
-  it("should limit output when exceeding byte limit", () => {
-    // Create content that will exceed byte limit
-    const longLine = "x".repeat(100);
-    const manyLines = Array(10).fill(longLine).join("\n");
-
-    const result = extractLinesWithByteLimit(manyLines, 250);
-
-    expect(result.wasLimited).toBe(true);
-    expect(result.linesRead).toBe(2);
-  });
-
-  it("should handle empty content", () => {
-    const result = extractLinesWithByteLimit("", 1000);
-
-    expect(result.content).toBe("");
-    expect(result.wasLimited).toBe(false);
-    expect(result.linesRead).toBe(1); // We read the one empty line
-  });
-
-  it("should handle single line file", () => {
-    const singleLine = "This is a single line without newline";
-    const result = extractLinesWithByteLimit(singleLine, 1000);
-
-    expect(result.content).toBe(singleLine);
-    expect(result.wasLimited).toBe(false);
-    expect(result.linesRead).toBe(1);
-  });
-
-  it("should correctly count bytes with multi-byte characters", () => {
-    const unicodeContent = "Hello 世界\n你好 World\nEmoji: 🌍\nNormal line";
-    const result = extractLinesWithByteLimit(unicodeContent, 1000);
-
-    expect(result.content).toBe(unicodeContent);
-    expect(result.linesRead).toBe(4);
-  });
-
-  it("should stop at byte limit even with one more line available", () => {
-    // Create lines where adding one more would exceed limit
-    const line1 = "a".repeat(40);
-    const line2 = "b".repeat(40);
-    const line3 = "c".repeat(40);
-    const content = `${line1}\n${line2}\n${line3}`;
-
-    const result = extractLinesWithByteLimit(content, 85);
-
-    expect(result.content).toBe(`${line1}\n${line2}\n`);
-    expect(result.wasLimited).toBe(true);
-    expect(result.linesRead).toBe(2);
-  });
-
-  it("should read exactly to limit when possible", () => {
-    const exactContent = "12345\n67890\n12345"; // 17 bytes total
-    const result = extractLinesWithByteLimit(exactContent, 17);
-
-    expect(result.content).toBe(exactContent);
-    expect(result.wasLimited).toBe(false);
-    expect(result.linesRead).toBe(3);
-  });
-
-  it("should handle Windows-style line endings", () => {
-    const windowsContent = "Line 1\r\nLine 2\r\nLine 3";
-    const result = extractLinesWithByteLimit(windowsContent, 1000);
-
-    // Note: split("\n") will keep the \r characters
-    expect(result.content).toBe("Line 1\r\nLine 2\r\nLine 3");
-    expect(result.linesRead).toBe(3);
-  });
-
-  it("should handle very large files efficiently", () => {
-    // Create a 100KB file
-    const largeLine = "x".repeat(1000);
-    const largeContent = Array(110).fill(largeLine).join("\n");
-
-    const result = extractLinesWithByteLimit(largeContent, 50000);
-
-    expect(result.wasLimited).toBe(true);
-  });
-
-  it("should allow at least one line even if it exceeds byte limit", () => {
-    const veryLongLine = "x".repeat(100000); // 100KB line
-    const result = extractLinesWithByteLimit(veryLongLine, 50000);
-
-    // Should return the line even though it exceeds the byte limit
-    // because we always allow at least one line if no lines have been added yet
-    expect(result.content).toBe(veryLongLine);
-    expect(result.linesRead).toBe(1);
-    expect(result.wasLimited).toBe(false);
-  });
-});

src/tests/list-sessions.test.ts

@@ -1,596 +0,0 @@
-import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
-import * as fs from "node:fs";
-import * as path from "node:path";
-import * as os from "node:os";
-import { AgentSideConnection } from "@agentclientprotocol/sdk";
-import type { ClaudeAcpAgent as ClaudeAcpAgentType } from "../acp-agent.js";
-import { encodeProjectPath } from "../utils.js";
-
-describe("unstable_listSessions", () => {
-  let tempDir: string;
-  let originalClaudeConfigDir: string | undefined;
-  let agent: ClaudeAcpAgentType;
-  let ClaudeAcpAgent: typeof ClaudeAcpAgentType;
-
-  // Helper to create a mock AgentSideConnection
-  function createMockClient(): AgentSideConnection {
-    return {
-      sessionUpdate: async () => {},
-      requestPermission: async () => ({ outcome: { outcome: "cancelled" } }),
-      readTextFile: async () => ({ content: "" }),
-      writeTextFile: async () => ({}),
-    } as unknown as AgentSideConnection;
-  }
-
-  // Helper to write a session file
-  function writeSessionFile(
-    cwd: string,
-    sessionId: string,
-    options: {
-      userMessage?: string;
-      userMessageArray?: boolean;
-      mtime?: Date;
-      malformed?: boolean;
-      isAgentFile?: boolean;
-      omitCwdFromEntries?: boolean;
-    } = {},
-  ): void {
-    const encodedPath = encodeProjectPath(cwd);
-    const projectDir = path.join(tempDir, "projects", encodedPath);
-    fs.mkdirSync(projectDir, { recursive: true });
-
-    const filename = options.isAgentFile ? `agent-${sessionId}.jsonl` : `${sessionId}.jsonl`;
-    const filePath = path.join(projectDir, filename);
-
-    if (options.malformed) {
-      fs.writeFileSync(filePath, "not valid json\n{also bad");
-      return;
-    }
-
-    const lines: string[] = [];
-
-    // First line with sessionId
-    lines.push(JSON.stringify({ sessionId, type: "init" }));
-
-    // User message if provided
-    if (options.userMessage) {
-      const content = options.userMessageArray
-        ? [{ type: "text", text: options.userMessage }]
-        : options.userMessage;
-      lines.push(
-        JSON.stringify({
-          type: "user",
-          sessionId,
-          ...(options.omitCwdFromEntries ? {} : { cwd }),
-          message: { content },
-        }),
-      );
-    }
-
-    // Assistant response
-    lines.push(
-      JSON.stringify({
-        type: "assistant",
-        sessionId,
-        ...(options.omitCwdFromEntries ? {} : { cwd }),
-        message: { content: "Hello!" },
-      }),
-    );
-
-    fs.writeFileSync(filePath, lines.join("\n"));
-
-    // Set modification time if specified
-    if (options.mtime) {
-      fs.utimesSync(filePath, options.mtime, options.mtime);
-    }
-  }
-
-  beforeEach(async () => {
-    // Create temp directory to isolate tests from real filesystem.
-    // We set process.env.CLAUDE_CONFIG_DIR before importing the module so that
-    // CLAUDE_CONFIG_DIR is evaluated with our temp directory.
-    tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "claude-test-"));
-    originalClaudeConfigDir = process.env.CLAUDE_CONFIG_DIR;
-    process.env.CLAUDE_CONFIG_DIR = tempDir;
-
-    // Reset modules to pick up the new CLAUDE_CONFIG_DIR env var
-    vi.resetModules();
-
-    // Dynamic import after setting env var
-    const acpAgent = await import("../acp-agent.js");
-    ClaudeAcpAgent = acpAgent.ClaudeAcpAgent;
-
-    // Create agent instance
-    agent = new ClaudeAcpAgent(createMockClient());
-  });
-
-  afterEach(() => {
-    // Restore env and cleanup
-    if (originalClaudeConfigDir !== undefined) {
-      process.env.CLAUDE_CONFIG_DIR = originalClaudeConfigDir;
-    } else {
-      delete process.env.CLAUDE_CONFIG_DIR;
-    }
-    fs.rmSync(tempDir, { recursive: true, force: true });
-  });
-
-  it("returns empty array when projects directory does not exist", async () => {
-    const result = await agent.unstable_listSessions({});
-    expect(result.sessions).toEqual([]);
-    expect(result.nextCursor).toBeUndefined();
-  });
-
-  it("returns empty array when projects directory is empty", async () => {
-    fs.mkdirSync(path.join(tempDir, "projects"), { recursive: true });
-
-    const result = await agent.unstable_listSessions({});
-    expect(result.sessions).toEqual([]);
-  });
-
-  it("parses session files and returns correct metadata", async () => {
-    const cwd = "/Users/test/myproject";
-    const sessionId = "sess-123";
-    const mtime = new Date("2025-01-15T10:30:00Z");
-
-    writeSessionFile(cwd, sessionId, {
-      userMessage: "Hello, can you help me?",
-      mtime,
-    });
-
-    const result = await agent.unstable_listSessions({});
-
-    expect(result.sessions).toHaveLength(1);
-    expect(result.sessions[0]).toMatchObject({
-      sessionId: "sess-123",
-      cwd: "/Users/test/myproject",
-      title: "Hello, can you help me?",
-    });
-    expect(result.sessions[0]!.updatedAt).toBeDefined();
-  });
-
-  it("extracts title from array-style user message content", async () => {
-    writeSessionFile("/Users/test/project", "sess-456", {
-      userMessage: "Fix the bug in auth",
-      userMessageArray: true,
-    });
-
-    const result = await agent.unstable_listSessions({});
-
-    expect(result.sessions[0]!.title).toBe("Fix the bug in auth");
-  });
-
-  it("truncates long titles to 128 characters with ellipsis", async () => {
-    const longMessage = "A".repeat(150);
-    writeSessionFile("/Users/test/project", "sess-789", {
-      userMessage: longMessage,
-    });
-
-    const result = await agent.unstable_listSessions({});
-
-    expect(result.sessions[0]!.title).toBe("A".repeat(127) + "…");
-  });
-
-  it("replaces newlines with spaces in titles", async () => {
-    const messageWithNewlines = "First line\nSecond line\r\nThird line";
-    writeSessionFile("/Users/test/project", "sess-newlines", {
-      userMessage: messageWithNewlines,
-    });
-
-    const result = await agent.unstable_listSessions({});
-
-    expect(result.sessions[0]!.title).toBe("First line Second line Third line");
-  });
-
-  it("collapses multiple whitespace characters in titles", async () => {
-    const messageWithWhitespace = "Hello    world  \n\n  test";
-    writeSessionFile("/Users/test/project", "sess-whitespace", {
-      userMessage: messageWithWhitespace,
-    });
-
-    const result = await agent.unstable_listSessions({});
-
-    expect(result.sessions[0]!.title).toBe("Hello world test");
-  });
-
-  it("filters sessions by cwd parameter", async () => {
-    writeSessionFile("/Users/test/projectone", "sess-a", { userMessage: "Project A" });
-    writeSessionFile("/Users/test/projecttwo", "sess-b", { userMessage: "Project B" });
-
-    const result = await agent.unstable_listSessions({ cwd: "/Users/test/projectone" });
-
-    expect(result.sessions).toHaveLength(1);
-    expect(result.sessions[0]!.sessionId).toBe("sess-a");
-  });
-
-  it("uses per-entry cwd when filtering even if encoded folder collides", async () => {
-    const encodedPath = encodeProjectPath("/Users/test/a-b");
-    const projectDir = path.join(tempDir, "projects", encodedPath);
-    fs.mkdirSync(projectDir, { recursive: true });
-
-    fs.writeFileSync(
-      path.join(projectDir, "sess-a-b.jsonl"),
-      [
-        JSON.stringify({ sessionId: "sess-a-b", type: "init" }),
-        JSON.stringify({
-          type: "user",
-          sessionId: "sess-a-b",
-          cwd: "/Users/test/a-b",
-          message: { content: "A-B" },
-        }),
-      ].join("\n"),
-    );
-
-    fs.writeFileSync(
-      path.join(projectDir, "sess-a-slash-b.jsonl"),
-      [
-        JSON.stringify({ sessionId: "sess-a-slash-b", type: "init" }),
-        JSON.stringify({
-          type: "user",
-          sessionId: "sess-a-slash-b",
-          cwd: "/Users/test/a/b",
-          message: { content: "A/B" },
-        }),
-      ].join("\n"),
-    );
-
-    const result = await agent.unstable_listSessions({ cwd: "/Users/test/a-b" });
-
-    expect(result.sessions).toHaveLength(1);
-    expect(result.sessions[0]!.sessionId).toBe("sess-a-b");
-    expect(result.sessions[0]!.cwd).toBe("/Users/test/a-b");
-  });
-
-  it("returns the true cwd for paths containing hyphens", async () => {
-    const cwd = "/Users/test/claude-agent-acp";
-    writeSessionFile(cwd, "hyphen-session", { userMessage: "Hyphen test" });
-
-    const result = await agent.unstable_listSessions({});
-
-    expect(result.sessions).toHaveLength(1);
-    expect(result.sessions[0]!.cwd).toBe(cwd);
-    expect(result.sessions[0]!.sessionId).toBe("hyphen-session");
-  });
-
-  it("filters hyphenated paths by cwd correctly", async () => {
-    writeSessionFile("/Users/test/claude-agent-acp", "hyphen-a", { userMessage: "A" });
-    writeSessionFile("/Users/test/other-project", "hyphen-b", { userMessage: "B" });
-
-    const result = await agent.unstable_listSessions({ cwd: "/Users/test/claude-agent-acp" });
-
-    expect(result.sessions).toHaveLength(1);
-    expect(result.sessions[0]!.sessionId).toBe("hyphen-a");
-    expect(result.sessions[0]!.cwd).toBe("/Users/test/claude-agent-acp");
-  });
-
-  it("returns all sessions when cwd is not specified", async () => {
-    writeSessionFile("/Users/test/projectone", "sess-a", { userMessage: "A" });
-    writeSessionFile("/Users/test/projecttwo", "sess-b", { userMessage: "B" });
-
-    const result = await agent.unstable_listSessions({});
-
-    expect(result.sessions).toHaveLength(2);
-  });
-
-  it("sorts sessions by updatedAt descending (most recent first)", async () => {
-    writeSessionFile("/Users/test/project", "old-session", {
-      userMessage: "Old",
-      mtime: new Date("2025-01-01T00:00:00Z"),
-    });
-    writeSessionFile("/Users/test/project", "new-session", {
-      userMessage: "New",
-      mtime: new Date("2025-01-15T00:00:00Z"),
-    });
-
-    const result = await agent.unstable_listSessions({});
-
-    expect(result.sessions[0]!.sessionId).toBe("new-session");
-    expect(result.sessions[1]!.sessionId).toBe("old-session");
-  });
-
-  it("skips files starting with agent-", async () => {
-    writeSessionFile("/Users/test/project", "regular-session", { userMessage: "Regular" });
-    writeSessionFile("/Users/test/project", "hidden-session", {
-      userMessage: "Hidden",
-      isAgentFile: true,
-    });
-
-    const result = await agent.unstable_listSessions({});
-
-    expect(result.sessions).toHaveLength(1);
-    expect(result.sessions[0]!.sessionId).toBe("regular-session");
-  });
-
-  it("skips malformed session files gracefully", async () => {
-    writeSessionFile("/Users/test/project", "good-session", { userMessage: "Good" });
-    writeSessionFile("/Users/test/project", "bad-session", { malformed: true });
-
-    const result = await agent.unstable_listSessions({});
-
-    expect(result.sessions).toHaveLength(1);
-    expect(result.sessions[0]!.sessionId).toBe("good-session");
-  });
-
-  it("uses filename as sessionId when not in file content", async () => {
-    const cwd = "/Users/test/project";
-    const encodedPath = encodeProjectPath(cwd);
-    const projectDir = path.join(tempDir, "projects", encodedPath);
-    fs.mkdirSync(projectDir, { recursive: true });
-
-    // Write file without sessionId in content (uses filename fallback), but with cwd.
-    const filePath = path.join(projectDir, "fallback-id.jsonl");
-    fs.writeFileSync(
-      filePath,
-      [
-        JSON.stringify({ type: "init" }),
-        JSON.stringify({ type: "assistant", cwd, message: { content: "Hi" } }),
-      ].join("\n"),
-    );
-
-    const result = await agent.unstable_listSessions({});
-
-    expect(result.sessions[0]!.sessionId).toBe("fallback-id");
-  });
-
-  it("keeps sessionId stable from filename when later entries have different sessionId", async () => {
-    const cwd = "/Users/test/project";
-    const encodedPath = encodeProjectPath(cwd);
-    const projectDir = path.join(tempDir, "projects", encodedPath);
-    fs.mkdirSync(projectDir, { recursive: true });
-
-    const filePath = path.join(projectDir, "stable-id.jsonl");
-    fs.writeFileSync(
-      filePath,
-      [
-        JSON.stringify({ type: "init", sessionId: "stable-id" }),
-        JSON.stringify({
-          type: "user",
-          sessionId: "stable-id",
-          cwd,
-          message: { content: "Hello" },
-        }),
-        JSON.stringify({
-          type: "assistant",
-          sessionId: "other-id",
-          cwd,
-          message: { content: "Wrong session id from sidechain" },
-        }),
-      ].join("\n"),
-    );
-
-    const result = await agent.unstable_listSessions({});
-
-    expect(result.sessions).toHaveLength(1);
-    expect(result.sessions[0]!.sessionId).toBe("stable-id");
-  });
-
-  it("derives cwd from entries for the filename sessionId only", async () => {
-    const cwd = "/Users/test/project";
-    const encodedPath = encodeProjectPath(cwd);
-    const projectDir = path.join(tempDir, "projects", encodedPath);
-    fs.mkdirSync(projectDir, { recursive: true });
-
-    const filePath = path.join(projectDir, "target-session.jsonl");
-    fs.writeFileSync(
-      filePath,
-      [
-        JSON.stringify({
-          type: "user",
-          sessionId: "target-session",
-          cwd,
-          message: { content: "Correct cwd entry" },
-        }),
-      ].join("\n"),
-    );
-
-    const result = await agent.unstable_listSessions({});
-
-    expect(result.sessions).toHaveLength(1);
-    expect(result.sessions[0]!.sessionId).toBe("target-session");
-    expect(result.sessions[0]!.cwd).toBe(cwd);
-  });
-
-  it("keeps scanning after title to find later cwd in same session", async () => {
-    const cwd = "/Users/test/project";
-    const encodedPath = encodeProjectPath(cwd);
-    const projectDir = path.join(tempDir, "projects", encodedPath);
-    fs.mkdirSync(projectDir, { recursive: true });
-
-    const filePath = path.join(projectDir, "late-cwd.jsonl");
-    fs.writeFileSync(
-      filePath,
-      [
-        JSON.stringify({ type: "init", sessionId: "late-cwd" }),
-        JSON.stringify({
-          type: "user",
-          sessionId: "late-cwd",
-          message: { content: "Title from first user message" },
-        }),
-        JSON.stringify({
-          type: "assistant",
-          sessionId: "late-cwd",
-          cwd,
-          message: { content: "Assistant entry carries cwd" },
-        }),
-      ].join("\n"),
-    );
-
-    const result = await agent.unstable_listSessions({});
-
-    expect(result.sessions).toHaveLength(1);
-    expect(result.sessions[0]!.sessionId).toBe("late-cwd");
-    expect(result.sessions[0]!.cwd).toBe(cwd);
-    expect(result.sessions[0]!.title).toBe("Title from first user message");
-  });
-
-  it("ignores sidechain entries when deriving cwd and title", async () => {
-    const cwd = "/Users/test/project";
-    const encodedPath = encodeProjectPath(cwd);
-    const projectDir = path.join(tempDir, "projects", encodedPath);
-    fs.mkdirSync(projectDir, { recursive: true });
-
-    const filePath = path.join(projectDir, "sidechain-metadata.jsonl");
-    fs.writeFileSync(
-      filePath,
-      [
-        JSON.stringify({ type: "init", sessionId: "sidechain-metadata" }),
-        JSON.stringify({
-          type: "user",
-          sessionId: "sidechain-metadata",
-          isSidechain: true,
-          cwd: "/Users/test/wrong-project",
-          message: { content: "Wrong sidechain title" },
-        }),
-        JSON.stringify({
-          type: "user",
-          sessionId: "sidechain-metadata",
-          cwd,
-          message: { content: "Correct primary title" },
-        }),
-      ].join("\n"),
-    );
-
-    const result = await agent.unstable_listSessions({ cwd });
-
-    expect(result.sessions).toHaveLength(1);
-    expect(result.sessions[0]!.sessionId).toBe("sidechain-metadata");
-    expect(result.sessions[0]!.cwd).toBe(cwd);
-    expect(result.sessions[0]!.title).toBe("Correct primary title");
-  });
-
-  it("skips entries without cwd when cwd filter is not provided", async () => {
-    const cwd = "/Users/test/project";
-    const encodedPath = encodeProjectPath(cwd);
-    const projectDir = path.join(tempDir, "projects", encodedPath);
-    fs.mkdirSync(projectDir, { recursive: true });
-
-    const filePath = path.join(projectDir, "no-cwd.jsonl");
-    fs.writeFileSync(filePath, JSON.stringify({ sessionId: "no-cwd", type: "summary" }) + "\n");
-
-    const result = await agent.unstable_listSessions({});
-
-    expect(result.sessions).toHaveLength(0);
-  });
-
-  it("returns null title when no user message exists", async () => {
-    const cwd = "/Users/test/project";
-    const encodedPath = encodeProjectPath(cwd);
-    const projectDir = path.join(tempDir, "projects", encodedPath);
-    fs.mkdirSync(projectDir, { recursive: true });
-
-    // Write file with only init and assistant message
-    const filePath = path.join(projectDir, "no-user.jsonl");
-    fs.writeFileSync(
-      filePath,
-      [
-        JSON.stringify({ sessionId: "no-user", type: "init" }),
-        JSON.stringify({ type: "assistant", cwd, message: { content: "Hi" } }),
-      ].join("\n"),
-    );
-
-    const result = await agent.unstable_listSessions({});
-
-    expect(result.sessions[0]!.title).toBeNull();
-  });
-
-  describe("pagination", () => {
-    it("returns nextCursor when there are more results", async () => {
-      // Create 60 sessions (more than PAGE_SIZE of 50)
-      for (let i = 0; i < 60; i++) {
-        writeSessionFile("/Users/test/project", `sess-${i.toString().padStart(3, "0")}`, {
-          userMessage: `Session ${i}`,
-          mtime: new Date(Date.now() - i * 1000), // Each older by 1 second
-        });
-      }
-
-      const result = await agent.unstable_listSessions({});
-
-      expect(result.sessions).toHaveLength(50);
-      expect(result.nextCursor).toBeDefined();
-    });
-
-    it("does not return nextCursor when all results fit in one page", async () => {
-      for (let i = 0; i < 10; i++) {
-        writeSessionFile("/Users/test/project", `sess-${i}`, { userMessage: `Session ${i}` });
-      }
-
-      const result = await agent.unstable_listSessions({});
-
-      expect(result.sessions).toHaveLength(10);
-      expect(result.nextCursor).toBeUndefined();
-    });
-
-    it("returns next page when cursor is provided", async () => {
-      // Create 60 sessions
-      for (let i = 0; i < 60; i++) {
-        writeSessionFile("/Users/test/project", `sess-${i.toString().padStart(3, "0")}`, {
-          userMessage: `Session ${i}`,
-          mtime: new Date(Date.now() - i * 1000),
-        });
-      }
-
-      // Get first page
-      const firstPage = await agent.unstable_listSessions({});
-      expect(firstPage.sessions).toHaveLength(50);
-      expect(firstPage.nextCursor).toBeDefined();
-
-      // Get second page
-      const secondPage = await agent.unstable_listSessions({ cursor: firstPage.nextCursor });
-      expect(secondPage.sessions).toHaveLength(10);
-      expect(secondPage.nextCursor).toBeUndefined();
-    });
-
-    it("handles invalid cursor gracefully (starts from beginning)", async () => {
-      writeSessionFile("/Users/test/project", "sess-1", { userMessage: "Test" });
-
-      const result = await agent.unstable_listSessions({ cursor: "invalid-base64!" });
-
-      expect(result.sessions).toHaveLength(1);
-    });
-
-    it("handles malformed cursor JSON gracefully", async () => {
-      writeSessionFile("/Users/test/project", "sess-1", { userMessage: "Test" });
-
-      // Valid base64 but not valid JSON
-      const badCursor = Buffer.from("not json").toString("base64");
-      const result = await agent.unstable_listSessions({ cursor: badCursor });
-
-      expect(result.sessions).toHaveLength(1);
-    });
-  });
-
-  describe("Windows path support", () => {
-    it("decodes Windows-style paths correctly", async () => {
-      // Simulate a Windows path encoded as "C-Users-test-project"
-      const windowsCwd = "C:\\Users\\test\\project";
-      writeSessionFile(windowsCwd, "win-session", { userMessage: "Windows test" });
-
-      const result = await agent.unstable_listSessions({});
-
-      expect(result.sessions).toHaveLength(1);
-      expect(result.sessions[0]!.cwd).toBe("C:\\Users\\test\\project");
-      expect(result.sessions[0]!.sessionId).toBe("win-session");
-    });
-
-    it("filters Windows paths by cwd correctly", async () => {
-      writeSessionFile("C:\\Users\\test\\projectone", "win-a", { userMessage: "A" });
-      writeSessionFile("C:\\Users\\test\\projecttwo", "win-b", { userMessage: "B" });
-
-      const result = await agent.unstable_listSessions({ cwd: "C:\\Users\\test\\projectone" });
-
-      expect(result.sessions).toHaveLength(1);
-      expect(result.sessions[0]!.sessionId).toBe("win-a");
-    });
-
-    it("handles mixed Unix and Windows paths", async () => {
-      writeSessionFile("/Users/test/unixproject", "unix-session", { userMessage: "Unix" });
-      writeSessionFile("C:\\Users\\test\\winproject", "win-session", { userMessage: "Windows" });
-
-      const result = await agent.unstable_listSessions({});
-
-      expect(result.sessions).toHaveLength(2);
-      const cwds = result.sessions.map((s) => s.cwd);
-      expect(cwds).toContain("/Users/test/unixproject");
-      expect(cwds).toContain("C:\\Users\\test\\winproject");
-    });
-  });
-});

src/tests/load-session.test.ts

@@ -1,320 +0,0 @@
-import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
-import * as fs from "node:fs";
-import * as path from "node:path";
-import * as os from "node:os";
-import { AgentSideConnection, SessionNotification } from "@agentclientprotocol/sdk";
-import type { ClaudeAcpAgent as ClaudeAcpAgentType } from "../acp-agent.js";
-import { encodeProjectPath } from "../utils.js";
-
-const { registerHookCallbackSpy } = vi.hoisted(() => ({
-  registerHookCallbackSpy: vi.fn(),
-}));
-
-vi.mock("../tools.js", async () => {
-  const actual = await vi.importActual<typeof import("../tools.js")>("../tools.js");
-  return {
-    ...actual,
-    registerHookCallback: registerHookCallbackSpy,
-  };
-});
-
-describe("loadSession", () => {
-  let tempDir: string;
-  let originalClaudeConfigDir: string | undefined;
-  let agent: ClaudeAcpAgentType;
-  let ClaudeAcpAgent: typeof ClaudeAcpAgentType;
-  let sessionUpdates: SessionNotification[];
-  let createSessionSpy: ReturnType<typeof vi.fn>;
-
-  // Helper to create a mock AgentSideConnection
-  function createMockClient(): AgentSideConnection {
-    return {
-      sessionUpdate: async (notification: SessionNotification) => {
-        sessionUpdates.push(notification);
-      },
-      requestPermission: async () => ({ outcome: { outcome: "cancelled" } }),
-      readTextFile: async () => ({ content: "" }),
-      writeTextFile: async () => ({}),
-    } as unknown as AgentSideConnection;
-  }
-
-  function writeSessionFile(
-    cwd: string,
-    sessionId: string,
-    entries: Array<Record<string, unknown> | string>,
-  ): void {
-    const encodedPath = encodeProjectPath(cwd);
-    const projectDir = path.join(tempDir, "projects", encodedPath);
-    fs.mkdirSync(projectDir, { recursive: true });
-
-    const filePath = path.join(projectDir, `${sessionId}.jsonl`);
-    const lines = entries.map((entry) =>
-      typeof entry === "string" ? entry : JSON.stringify(entry),
-    );
-    fs.writeFileSync(filePath, lines.join("\n"));
-  }
-
-  beforeEach(async () => {
-    tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "claude-load-session-"));
-    originalClaudeConfigDir = process.env.CLAUDE_CONFIG_DIR;
-    process.env.CLAUDE_CONFIG_DIR = tempDir;
-    sessionUpdates = [];
-    registerHookCallbackSpy.mockClear();
-
-    vi.resetModules();
-
-    const acpAgent = await import("../acp-agent.js");
-    ClaudeAcpAgent = acpAgent.ClaudeAcpAgent;
-
-    agent = new ClaudeAcpAgent(createMockClient());
-    createSessionSpy = vi.fn(async () => ({ modes: null, models: null }));
-    (agent as unknown as { createSession: typeof createSessionSpy }).createSession =
-      createSessionSpy;
-  });
-
-  afterEach(() => {
-    if (originalClaudeConfigDir !== undefined) {
-      process.env.CLAUDE_CONFIG_DIR = originalClaudeConfigDir;
-    } else {
-      delete process.env.CLAUDE_CONFIG_DIR;
-    }
-    fs.rmSync(tempDir, { recursive: true, force: true });
-  });
-
-  it("throws when the session file does not exist", async () => {
-    await expect(
-      agent.loadSession({
-        cwd: "/Users/test/project",
-        sessionId: "missing-session",
-        mcpServers: [],
-      }),
-    ).rejects.toThrow("Session not found");
-
-    expect(createSessionSpy).not.toHaveBeenCalled();
-  });
-
-  it("replays history and returns modes/models from createSession", async () => {
-    const cwd = "/Users/test/project";
-    const sessionId = "session-123";
-
-    writeSessionFile(cwd, sessionId, [
-      { type: "summary", summary: "ignored" },
-      {
-        type: "user",
-        sessionId,
-        message: { role: "user", content: "Hello" },
-      },
-      {
-        type: "assistant",
-        sessionId,
-        message: {
-          role: "assistant",
-          content: [{ type: "thinking", thinking: "Thinking" }],
-        },
-      },
-      {
-        type: "assistant",
-        sessionId,
-        message: {
-          role: "assistant",
-          content: [{ type: "text", text: "Hi" }],
-        },
-      },
-      {
-        type: "assistant",
-        sessionId,
-        message: {
-          role: "assistant",
-          content: [
-            {
-              type: "tool_use",
-              id: "tool-1",
-              name: "Read",
-              input: { file_path: "/tmp/example.txt" },
-            },
-          ],
-        },
-      },
-      {
-        type: "user",
-        sessionId,
-        message: {
-          role: "user",
-          content: [{ type: "tool_result", tool_use_id: "tool-1", content: "ok" }],
-        },
-      },
-    ]);
-
-    const result = await agent.loadSession({ cwd, sessionId, mcpServers: [] });
-
-    expect(result).toEqual({ modes: null, models: null });
-    expect(createSessionSpy).toHaveBeenCalledWith(
-      expect.objectContaining({ cwd, mcpServers: [] }),
-      { resume: sessionId },
-    );
-    expect(registerHookCallbackSpy).not.toHaveBeenCalled();
-
-    expect(sessionUpdates.map((notification) => notification.update.sessionUpdate)).toEqual([
-      "user_message_chunk",
-      "agent_thought_chunk",
-      "agent_message_chunk",
-      "tool_call",
-      "tool_call_update",
-    ]);
-
-    expect(sessionUpdates[0]?.update).toMatchObject({
-      sessionUpdate: "user_message_chunk",
-      content: { type: "text", text: "Hello" },
-    });
-    expect(sessionUpdates[1]?.update).toMatchObject({
-      sessionUpdate: "agent_thought_chunk",
-      content: { type: "text", text: "Thinking" },
-    });
-    expect(sessionUpdates[2]?.update).toMatchObject({
-      sessionUpdate: "agent_message_chunk",
-      content: { type: "text", text: "Hi" },
-    });
-    expect(sessionUpdates[3]?.update).toMatchObject({
-      sessionUpdate: "tool_call",
-      toolCallId: "tool-1",
-      status: "pending",
-    });
-    expect(sessionUpdates[4]?.update).toMatchObject({
-      sessionUpdate: "tool_call_update",
-      toolCallId: "tool-1",
-      status: "completed",
-    });
-  });
-
-  it("skips sidechain, mismatched sessionId, invalid, and unsupported entries", async () => {
-    const cwd = "/Users/test/project";
-    const sessionId = "session-456";
-
-    writeSessionFile(cwd, sessionId, [
-      "{not valid json}",
-      { type: "summary", summary: "ignore" },
-      {
-        type: "user",
-        sessionId,
-        isSidechain: true,
-        message: { role: "user", content: "Sidechain" },
-      },
-      {
-        type: "assistant",
-        sessionId: "other-session",
-        message: { role: "assistant", content: "Wrong session" },
-      },
-      {
-        type: "assistant",
-        sessionId,
-        message: { role: "system", content: "Unsupported role" },
-      },
-      {
-        type: "user",
-        sessionId,
-        message: { role: "user", content: 123 },
-      },
-      {
-        type: "user",
-        sessionId,
-        message: { role: "user", content: "Keep me" },
-      },
-    ]);
-
-    await agent.loadSession({ cwd, sessionId, mcpServers: [] });
-
-    expect(sessionUpdates).toHaveLength(1);
-    expect(sessionUpdates[0]?.update).toMatchObject({
-      sessionUpdate: "user_message_chunk",
-      content: { type: "text", text: "Keep me" },
-    });
-  });
-
-  it("finds session file when cwd differs from the original session cwd", async () => {
-    const originalCwd = "/Users/test/original-project";
-    const differentCwd = "/Users/test/different-project";
-    const sessionId = "cross-cwd-session";
-
-    // Session was created in originalCwd
-    writeSessionFile(originalCwd, sessionId, [
-      {
-        type: "user",
-        sessionId,
-        cwd: originalCwd,
-        message: { role: "user", content: "Hello from original" },
-      },
-    ]);
-
-    // Load with a different cwd
-    await agent.loadSession({ cwd: differentCwd, sessionId, mcpServers: [] });
-
-    expect(sessionUpdates).toHaveLength(1);
-    expect(sessionUpdates[0]?.update).toMatchObject({
-      sessionUpdate: "user_message_chunk",
-      content: { type: "text", text: "Hello from original" },
-    });
-    expect(createSessionSpy).toHaveBeenCalledWith(expect.objectContaining({ cwd: differentCwd }), {
-      resume: sessionId,
-    });
-  });
-
-  it("sends available_commands_update after history replay, not during", async () => {
-    const cwd = "/Users/test/project";
-    const sessionId = "session-commands";
-
-    // Mock createSession to populate the sessions map with a mock query
-    createSessionSpy.mockImplementationOnce(async () => {
-      (agent as unknown as { sessions: Record<string, unknown> }).sessions[sessionId] = {
-        query: {
-          supportedCommands: async () => [{ name: "help", description: "Get help" }],
-        },
-      };
-      return { modes: null, models: null };
-    });
-
-    writeSessionFile(cwd, sessionId, [
-      {
-        type: "user",
-        sessionId,
-        message: { role: "user", content: "Hello" },
-      },
-      {
-        type: "assistant",
-        sessionId,
-        message: { role: "assistant", content: [{ type: "text", text: "Hi" }] },
-      },
-    ]);
-
-    await agent.loadSession({ cwd, sessionId, mcpServers: [] });
-
-    // Flush the setTimeout + async work inside sendAvailableCommandsUpdate
-    await new Promise((resolve) => setTimeout(resolve, 10));
-
-    const updateTypes = sessionUpdates.map((n) => n.update.sessionUpdate);
-
-    // available_commands_update should come AFTER all replay notifications
-    expect(updateTypes).toEqual([
-      "user_message_chunk",
-      "agent_message_chunk",
-      "available_commands_update",
-    ]);
-  });
-
-  it("handles Windows-style paths", async () => {
-    const cwd = "C:\\Users\\test\\project";
-    const sessionId = "win-session";
-
-    writeSessionFile(cwd, sessionId, [
-      {
-        type: "user",
-        sessionId,
-        message: { role: "user", content: "Hello" },
-      },
-    ]);
-
-    await agent.loadSession({ cwd, sessionId, mcpServers: [] });
-
-    expect(sessionUpdates).toHaveLength(1);
-    expect(sessionUpdates[0]?.sessionId).toBe(sessionId);
-  });
-});

src/tests/replace-and-calculate-location.test.ts

@@ -1,334 +0,0 @@
-import { describe, it, expect } from "vitest";
-import { replaceAndCalculateLocation } from "../mcp-server.js";
-
-describe("replaceAndCalculateLocation", () => {
-  it("should replace first occurrence and return correct line number", () => {
-    const content = "line 1\nline 2 with text\nline 3 with text\nline 4";
-    const result = replaceAndCalculateLocation(content, [{ oldText: "text", newText: "replaced" }]);
-
-    expect(result.newContent).toBe("line 1\nline 2 with replaced\nline 3 with text\nline 4");
-    expect(result.lineNumbers).toEqual([1]); // Line 2 (0-based indexing)
-  });
-
-  it("should replace all occurrences when replaceAll is true", () => {
-    const content = "line 1\nline 2 with text\nline 3 with text\nline 4";
-    const result = replaceAndCalculateLocation(content, [
-      { oldText: "text", newText: "replaced", replaceAll: true },
-    ]);
-
-    expect(result.newContent).toBe("line 1\nline 2 with replaced\nline 3 with replaced\nline 4");
-    expect(result.lineNumbers).toEqual([1, 2]); // Lines 2 and 3 (0-based)
-  });
-
-  it("should return empty line numbers array when no match found", () => {
-    const content = "line 1\nline 2\nline 3";
-    expect(() => {
-      replaceAndCalculateLocation(content, [{ oldText: "notfound", newText: "replaced" }]);
-    }).toThrow('The provided `old_string` does not appear in the file: "notfound"');
-  });
-
-  it("should handle Windows line endings (CRLF)", () => {
-    const content = "line 1\r\nline 2 with text\r\nline 3 with text\r\nline 4";
-    const result = replaceAndCalculateLocation(content, [
-      { oldText: "text", newText: "replaced", replaceAll: true },
-    ]);
-
-    expect(result.newContent).toBe(
-      "line 1\r\nline 2 with replaced\r\nline 3 with replaced\r\nline 4",
-    );
-    expect(result.lineNumbers).toEqual([1, 2]);
-  });
-
-  it("should handle old Mac line endings (CR)", () => {
-    const content = "line 1\rline 2 with text\rline 3 with text\rline 4";
-    const result = replaceAndCalculateLocation(content, [
-      { oldText: "text", newText: "replaced", replaceAll: true },
-    ]);
-
-    expect(result.newContent).toBe("line 1\rline 2 with replaced\rline 3 with replaced\rline 4");
-    expect(result.lineNumbers).toEqual([1, 2]);
-  });
-
-  it("should handle mixed line endings", () => {
-    const content = "line 1\nline 2 with text\r\nline 3 with text\rline 4";
-    const result = replaceAndCalculateLocation(content, [
-      { oldText: "text", newText: "replaced", replaceAll: true },
-    ]);
-
-    expect(result.newContent).toBe("line 1\nline 2 with replaced\r\nline 3 with replaced\rline 4");
-    expect(result.lineNumbers).toEqual([1, 2]);
-  });
-
-  it("should handle text at the beginning of file", () => {
-    const content = "text at start\nline 2\nline 3";
-    const result = replaceAndCalculateLocation(content, [{ oldText: "text", newText: "replaced" }]);
-
-    expect(result.newContent).toBe("replaced at start\nline 2\nline 3");
-    expect(result.lineNumbers).toEqual([0]); // First line (0-based)
-  });
-
-  it("should handle text at the end of file", () => {
-    const content = "line 1\nline 2\nlast line with text";
-    const result = replaceAndCalculateLocation(content, [{ oldText: "text", newText: "replaced" }]);
-
-    expect(result.newContent).toBe("line 1\nline 2\nlast line with replaced");
-    expect(result.lineNumbers).toEqual([2]); // Last line (0-based)
-  });
-
-  it("should handle multiple occurrences on the same line", () => {
-    const content = "line 1\ntext text text\nline 3";
-    const result = replaceAndCalculateLocation(content, [
-      { oldText: "text", newText: "replaced", replaceAll: true },
-    ]);
-
-    expect(result.newContent).toBe("line 1\nreplaced replaced replaced\nline 3");
-    expect(result.lineNumbers).toEqual([1]); // All on line 2 (0-based), deduplicated
-  });
-
-  it("should handle empty file content", () => {
-    expect(() => {
-      replaceAndCalculateLocation("", [{ oldText: "text", newText: "replaced" }]);
-    }).toThrowError(
-      'The provided `old_string` does not appear in the file: "text".\n\nNo edits were applied.',
-    );
-  });
-
-  it("should handle empty search text", () => {
-    // Test with replaceAll false (default)
-    const content1 = "line 1\nline 2\nline 3";
-    expect(() => {
-      replaceAndCalculateLocation(content1, [{ oldText: "", newText: "replaced" }]);
-    }).toThrowError("The provided `old_string` is empty.\n\nNo edits were applied.");
-
-    // Test with replaceAll true on single line
-    const content2 = "abc";
-    expect(() => {
-      replaceAndCalculateLocation(content2, [{ oldText: "", newText: "X", replaceAll: true }]);
-    }).toThrowError("The provided `old_string` is empty.\n\nNo edits were applied.");
-
-    // Test with replaceAll true on multiline content
-    const content3 = "ab\ncd";
-    expect(() => {
-      replaceAndCalculateLocation(content3, [{ oldText: "", newText: "X", replaceAll: true }]);
-    }).toThrowError("The provided `old_string` is empty.\n\nNo edits were applied.");
-  });
-
-  it("should handle single line content", () => {
-    const content = "single line with text here";
-    const result = replaceAndCalculateLocation(content, [{ oldText: "text", newText: "replaced" }]);
-
-    expect(result.newContent).toBe("single line with replaced here");
-    expect(result.lineNumbers).toEqual([0]); // Line 1 (0-based)
-  });
-
-  it("should handle special characters in search text", () => {
-    const content = "line 1\nline with $special.chars*\nline 3";
-    const result = replaceAndCalculateLocation(content, [
-      { oldText: "$special.chars*", newText: "replaced" },
-    ]);
-
-    expect(result.newContent).toBe("line 1\nline with replaced\nline 3");
-    expect(result.lineNumbers).toEqual([1]);
-  });
-
-  it("should handle newlines in search text", () => {
-    const content = "line 1\nline 2\nline 3";
-    const result = replaceAndCalculateLocation(content, [
-      { oldText: "1\nline", newText: "1\nmodified line" },
-    ]);
-
-    expect(result.newContent).toBe("line 1\nmodified line 2\nline 3");
-    expect(result.lineNumbers).toEqual([0]); // Match starts at line 1 (0-based)
-  });
-
-  it("should handle newlines in replacement text", () => {
-    const content = "line 1\nline 2\nline 3";
-    const result = replaceAndCalculateLocation(content, [
-      { oldText: "line 2", newText: "line 2a\nline 2b" },
-    ]);
-
-    expect(result.newContent).toBe("line 1\nline 2a\nline 2b\nline 3");
-    expect(result.lineNumbers).toEqual([1]);
-  });
-
-  it("should handle very long lines", () => {
-    const longLine = "a".repeat(10000) + "text" + "b".repeat(10000);
-    const content = `line 1\n${longLine}\nline 3`;
-    const result = replaceAndCalculateLocation(content, [{ oldText: "text", newText: "replaced" }]);
-
-    expect(result.newContent).toBe(
-      `line 1\n${"a".repeat(10000)}replaced${"b".repeat(10000)}\nline 3`,
-    );
-    expect(result.lineNumbers).toEqual([1]);
-  });
-
-  it("should handle many lines", () => {
-    const lines = Array.from({ length: 1000 }, (_, i) => `line ${i}`);
-    lines[500] = "line with text";
-    const content = lines.join("\n");
-
-    const result = replaceAndCalculateLocation(content, [{ oldText: "text", newText: "replaced" }]);
-
-    expect(result.lineNumbers).toEqual([500]);
-    expect(result.newContent).includes("line with replaced");
-  });
-
-  it("should handle overlapping matches correctly", () => {
-    const content = "aaaa\nbbbb\ncccc";
-    const result = replaceAndCalculateLocation(content, [
-      { oldText: "aa", newText: "xx", replaceAll: true },
-    ]);
-
-    // Should replace non-overlapping occurrences
-    expect(result.newContent).toBe("xxxx\nbbbb\ncccc");
-    expect(result.lineNumbers).toEqual([0]); // Two matches on first line, deduplicated
-  });
-
-  it("should preserve content after replacement with different lengths", () => {
-    const content = "short\nmedium line\nlong line here";
-
-    // Replacing with longer text
-    const result1 = replaceAndCalculateLocation(content, [
-      { oldText: "short", newText: "very very long text" },
-    ]);
-    expect(result1.newContent).toBe("very very long text\nmedium line\nlong line here");
-    expect(result1.lineNumbers).toEqual([0]);
-
-    // Replacing with shorter text
-    const result2 = replaceAndCalculateLocation(content, [
-      { oldText: "medium line", newText: "m" },
-    ]);
-    expect(result2.newContent).toBe("short\nm\nlong line here");
-    expect(result2.lineNumbers).toEqual([1]);
-  });
-
-  it("should handle consecutive replacements", () => {
-    const content = "text1 text2 text3";
-    const result = replaceAndCalculateLocation(content, [
-      { oldText: "text", newText: "replaced", replaceAll: true },
-    ]);
-
-    expect(result.newContent).toBe("replaced1 replaced2 replaced3");
-    expect(result.lineNumbers).toEqual([0]); // All on first line, deduplicated
-  });
-
-  it("should handle case-sensitive replacements", () => {
-    const content = "Text TEXT text";
-    const result = replaceAndCalculateLocation(content, [
-      { oldText: "text", newText: "replaced", replaceAll: true },
-    ]);
-
-    // Should only replace exact matches
-    expect(result.newContent).toBe("Text TEXT replaced");
-    expect(result.lineNumbers).toEqual([0]); // Only lowercase "text" matched
-  });
-
-  it("should handle replacement at exact end of line", () => {
-    const content = "line ends with text\nnext line";
-    const result = replaceAndCalculateLocation(content, [{ oldText: "text", newText: "replaced" }]);
-
-    expect(result.newContent).toBe("line ends with replaced\nnext line");
-    expect(result.lineNumbers).toEqual([0]);
-  });
-
-  it("should handle replacement spanning multiple lines", () => {
-    const content = "line 1\nspan\nacross\nlines\nline 5";
-    const result = replaceAndCalculateLocation(content, [
-      { oldText: "span\nacross\nlines", newText: "single" },
-    ]);
-
-    expect(result.newContent).toBe("line 1\nsingle\nline 5");
-    expect(result.lineNumbers).toEqual([1]); // Match starts at line 2 (0-based)
-  });
-
-  it("should default replaceAll to false", () => {
-    const content = "match match match";
-
-    // Without passing replaceAll parameter
-    const result = replaceAndCalculateLocation(content, [
-      { oldText: "match", newText: "replaced" },
-    ]);
-
-    expect(result.newContent).toBe("replaced match match");
-    expect(result.lineNumbers).toEqual([0]); // Only first match
-  });
-
-  it("should handle multiple edits with correct line numbers", () => {
-    const content = "line 1\nfoo bar\nline 3\nfoo baz\nline 5\nbar foo\nline 7";
-    const result = replaceAndCalculateLocation(content, [
-      { oldText: "foo", newText: "FOO", replaceAll: true },
-      { oldText: "bar", newText: "BAR", replaceAll: false },
-      { oldText: "line 3", newText: "LINE THREE" },
-    ]);
-
-    // Should replace:
-    // - All "foo" occurrences (lines 1, 3, 5 in original)
-    // - First "bar" occurrence (line 1 after first edit)
-    // - "line 3" (line 2 after previous edits)
-    expect(result.newContent).toBe("line 1\nFOO BAR\nLINE THREE\nFOO baz\nline 5\nbar FOO\nline 7");
-
-    // Line numbers reflect position in final content, deduplicated and sorted
-    expect(result.lineNumbers).toEqual([
-      1, // FOO and BAR on line 1
-      2, // LINE THREE on line 2
-      3, // FOO on line 3
-      5, // FOO on line 5
-    ]);
-  });
-
-  it("should handle multiple edits with overlapping text", () => {
-    const content = "hello world\nhello hello\nworld hello world";
-    const result = replaceAndCalculateLocation(content, [
-      { oldText: "hello", newText: "hi", replaceAll: false },
-      { oldText: "world", newText: "earth", replaceAll: true },
-      { oldText: "hello", newText: "greetings", replaceAll: true },
-    ]);
-
-    // First edit replaces first "hello" only
-    // Second edit replaces all "world" in the modified content
-    // Third edit replaces remaining "hello"s in the modified content
-    expect(result.newContent).toBe("hi earth\ngreetings greetings\nearth greetings earth");
-
-    // Line numbers reflect position in final content, deduplicated and sorted
-    expect(result.lineNumbers).toEqual([
-      0, // hi and earth on line 0
-      1, // greetings (multiple) on line 1
-      2, // earth and greetings on line 2
-    ]);
-  });
-
-  it("should handle complex scenarios with marker-like text", () => {
-    // Test that our marker approach doesn't get confused by similar text
-    const content = "line 1\n__MARKER__text\nline 3\n__REPLACE_MARKER_abc__\nline 5";
-    const result = replaceAndCalculateLocation(content, [
-      { oldText: "__MARKER__", newText: "REPLACED", replaceAll: true },
-      { oldText: "text", newText: "content" },
-      { oldText: "__REPLACE_MARKER_abc__", newText: "DONE" },
-    ]);
-
-    expect(result.newContent).toBe("line 1\nREPLACEDcontent\nline 3\nDONE\nline 5");
-
-    // Line numbers should be correct even with marker-like text
-    expect(result.lineNumbers).toEqual([
-      1, // REPLACED on line 1
-      3, // DONE on line 3
-    ]);
-  });
-
-  it("should handle edits where newText matches subsequent oldText", () => {
-    const content = "foo\nbar\nbaz";
-    const result = replaceAndCalculateLocation(content, [
-      { oldText: "foo", newText: "bar" },
-      { oldText: "bar", newText: "baz", replaceAll: true },
-      { oldText: "baz", newText: "qux", replaceAll: true },
-    ]);
-
-    // First edit: foo -> bar
-    // Second edit: both original bar and new bar -> baz
-    // Third edit: all baz instances -> qux
-    expect(result.newContent).toBe("qux\nqux\nqux");
-
-    // All replacements end up on their respective lines
-    expect(result.lineNumbers).toEqual([0, 1, 2]);
-  });
-});

src/tests/resolve-permission-mode.test.ts

@@ -0,0 +1,57 @@
+import { describe, it, expect, vi } from "vitest";
+import { resolvePermissionMode, type Logger } from "../acp-agent.js";
+
+function mockLogger() {
+  const error = vi.fn<(...args: any[]) => void>();
+  const log = vi.fn<(...args: any[]) => void>();
+  const logger: Logger = { log, error };
+  return { logger, error, log };
+}
+
+describe("resolvePermissionMode", () => {
+  it("returns 'default' when no mode is provided", () => {
+    expect(resolvePermissionMode()).toBe("default");
+    expect(resolvePermissionMode(undefined)).toBe("default");
+  });
+
+  it("resolves exact canonical modes", () => {
+    expect(resolvePermissionMode("default")).toBe("default");
+    expect(resolvePermissionMode("acceptEdits")).toBe("acceptEdits");
+    expect(resolvePermissionMode("dontAsk")).toBe("dontAsk");
+    expect(resolvePermissionMode("plan")).toBe("plan");
+    expect(resolvePermissionMode("bypassPermissions")).toBe("bypassPermissions");
+  });
+
+  it("resolves case-insensitive aliases", () => {
+    expect(resolvePermissionMode("DontAsk")).toBe("dontAsk");
+    expect(resolvePermissionMode("DONTASK")).toBe("dontAsk");
+    expect(resolvePermissionMode("AcceptEdits")).toBe("acceptEdits");
+    expect(resolvePermissionMode("bypass")).toBe("bypassPermissions");
+  });
+
+  it("trims whitespace", () => {
+    expect(resolvePermissionMode("  dontAsk  ")).toBe("dontAsk");
+  });
+
+  it("falls back to 'default' and logs on non-string values", () => {
+    for (const value of [123, true, {}]) {
+      const { logger, error } = mockLogger();
+      expect(resolvePermissionMode(value, logger)).toBe("default");
+      expect(error).toHaveBeenCalledWith(expect.stringContaining("expected a string"));
+    }
+  });
+
+  it("falls back to 'default' and logs on empty string", () => {
+    for (const value of ["", "  "]) {
+      const { logger, error } = mockLogger();
+      expect(resolvePermissionMode(value, logger)).toBe("default");
+      expect(error).toHaveBeenCalledWith(expect.stringContaining("expected a non-empty string"));
+    }
+  });
+
+  it("falls back to 'default' and logs on unknown mode", () => {
+    const { logger, error } = mockLogger();
+    expect(resolvePermissionMode("yolo", logger)).toBe("default");
+    expect(error).toHaveBeenCalledWith(expect.stringContaining("yolo"));
+  });
+});

src/tests/session-load.test.ts

@@ -0,0 +1,333 @@
+import { describe, it, expect } from "vitest";
+import { randomUUID } from "crypto";
+import { AgentSideConnection, RequestError, SessionNotification } from "@agentclientprotocol/sdk";
+import { query, getSessionMessages } from "@anthropic-ai/claude-agent-sdk";
+import { ClaudeAcpAgent } from "../acp-agent.js";
+import { Pushable } from "../utils.js";
+import type { SDKUserMessage } from "@anthropic-ai/claude-agent-sdk";
+
+function createMockClient(): AgentSideConnection {
+  return {
+    sessionUpdate: async (_notification: SessionNotification) => {},
+    requestPermission: async () => ({ outcome: { outcome: "cancelled" } }),
+    readTextFile: async () => ({ content: "" }),
+    writeTextFile: async () => ({}),
+  } as unknown as AgentSideConnection;
+}
+
+describe.skipIf(!process.env.RUN_INTEGRATION_TESTS)("session load/resume lifecycle", () => {
+  it("SDK: session created but never prompted has no messages and is not resumable", async () => {
+    // Create a session via the SDK, initialize it, but never send a prompt
+    const sessionId = randomUUID();
+    const input = new Pushable<SDKUserMessage>();
+
+    const q = query({
+      prompt: input,
+      options: {
+        systemPrompt: { type: "preset", preset: "claude_code" },
+        sessionId,
+        settingSources: ["user", "project", "local"],
+        includePartialMessages: true,
+      },
+    });
+
+    // initializationResult() works without needing a prompt pushed
+    const initResult = await q.initializationResult();
+    expect(initResult).toBeDefined();
+
+    // Close without ever prompting
+    input.end();
+    q.return(undefined);
+
+    // Verify no messages were stored
+    const messages = await getSessionMessages(sessionId);
+    expect(messages).toEqual([]);
+
+    // Verify the session is not resumable
+    const input2 = new Pushable<SDKUserMessage>();
+    const q2 = query({
+      prompt: input2,
+      options: {
+        systemPrompt: { type: "preset", preset: "claude_code" },
+        resume: sessionId,
+        settingSources: ["user", "project", "local"],
+        includePartialMessages: true,
+      },
+    });
+
+    await expect(q2.initializationResult()).rejects.toThrow(
+      /No conversation found with session ID/,
+    );
+
+    input2.end();
+    q2.return(undefined);
+  }, 30000);
+
+  it("ACP: loadSession throws resourceNotFound for a non-existent session", async () => {
+    const agent = new ClaudeAcpAgent(createMockClient());
+    const bogusSessionId = randomUUID();
+
+    try {
+      await expect(
+        agent.loadSession({
+          sessionId: bogusSessionId,
+          cwd: process.cwd(),
+          mcpServers: [],
+        }),
+      ).rejects.toThrow(RequestError);
+    } finally {
+      await agent.dispose();
+    }
+  }, 30000);
+
+  it("ACP: resumeSession throws resourceNotFound for a non-existent session", async () => {
+    const agent = new ClaudeAcpAgent(createMockClient());
+    const bogusSessionId = randomUUID();
+
+    try {
+      await expect(
+        agent.resumeSession({
+          sessionId: bogusSessionId,
+          cwd: process.cwd(),
+          mcpServers: [],
+        }),
+      ).rejects.toThrow(RequestError);
+    } finally {
+      await agent.dispose();
+    }
+  }, 30000);
+
+  it("ACP: newSession without prompt, then loadSession on fresh agent throws resourceNotFound", async () => {
+    // Step 1: Create a real session via ACP, never prompt, dispose
+    const agentA = new ClaudeAcpAgent(createMockClient());
+    const { sessionId } = await agentA.newSession({
+      cwd: process.cwd(),
+      mcpServers: [],
+    });
+    expect(sessionId).toBeDefined();
+    await agentA.dispose();
+
+    // Step 2: Fresh agent tries to load that session
+    const agentB = new ClaudeAcpAgent(createMockClient());
+
+    try {
+      await expect(
+        agentB.loadSession({
+          sessionId,
+          cwd: process.cwd(),
+          mcpServers: [],
+        }),
+      ).rejects.toThrow(RequestError);
+    } finally {
+      await agentB.dispose();
+    }
+  }, 30000);
+
+  it("ACP: newSession without prompt, then resumeSession on fresh agent throws resourceNotFound", async () => {
+    const agentA = new ClaudeAcpAgent(createMockClient());
+    const { sessionId } = await agentA.newSession({
+      cwd: process.cwd(),
+      mcpServers: [],
+    });
+    await agentA.dispose();
+
+    const agentB = new ClaudeAcpAgent(createMockClient());
+
+    try {
+      await expect(
+        agentB.resumeSession({
+          sessionId,
+          cwd: process.cwd(),
+          mcpServers: [],
+        }),
+      ).rejects.toThrow(RequestError);
+    } finally {
+      await agentB.dispose();
+    }
+  }, 30000);
+
+  // Regression test for https://github.com/zed-industries/claude-code-acp/issues/579
+  // The client (Zed) renders its own local slash commands — e.g. `/model` —
+  // by injecting user-message prompts whose text is wrapped in
+  // `<command-name>` / `<local-command-stdout>` markers. The Claude SDK
+  // persists those messages verbatim in the session transcript. Without
+  // filtering, `loadSession` replays the markers as user_message_chunks
+  // ahead of the real prompt, leaking CLI internals into the transcript.
+  it("ACP: loadSession does not replay local-command metadata user messages", async () => {
+    const recordedUserChunks: string[] = [];
+    const client = {
+      sessionUpdate: async (notification: SessionNotification) => {
+        if (notification.update.sessionUpdate === "user_message_chunk") {
+          const content = notification.update.content;
+          if (content.type === "text") recordedUserChunks.push(content.text);
+        }
+      },
+      requestPermission: async () => ({ outcome: { outcome: "cancelled" } }),
+      readTextFile: async () => ({ content: "" }),
+      writeTextFile: async () => ({}),
+    } as unknown as AgentSideConnection;
+
+    const commandName =
+      "<command-name>/model</command-name>\n            <command-message>model</command-message>\n            <command-args>opus</command-args>";
+    const commandStdout =
+      "<local-command-stdout>Set model to opus (claude-opus-4-7)</local-command-stdout>";
+
+    // Step 1: create a session via the SDK, push the marker user messages
+    // followed by a real "hi" prompt. We bypass the ACP agent's prompt loop
+    // so we're only testing what the loadSession replay path does, not how
+    // prompts get routed.
+    const sessionId = randomUUID();
+    const input = new Pushable<SDKUserMessage>();
+    const q = query({
+      prompt: input,
+      options: {
+        systemPrompt: { type: "preset", preset: "claude_code" },
+        sessionId,
+        settingSources: ["user", "project", "local"],
+        includePartialMessages: true,
+      },
+    });
+    await q.initializationResult();
+
+    // Zed renders its local slash commands by mixing the marker blocks into
+    // the user's prompt content array alongside the real text. The Claude
+    // SDK persists the message verbatim — including the marker blocks —
+    // which is what loadSession must filter when it replays.
+    input.push({
+      type: "user",
+      message: {
+        role: "user",
+        content: [
+          { type: "text", text: commandName },
+          { type: "text", text: commandStdout },
+          { type: "text", text: "hi" },
+        ],
+      },
+      session_id: sessionId,
+      parent_tool_use_id: null,
+    });
+
+    for await (const msg of q) {
+      if (msg.type === "result") break;
+    }
+    input.end();
+    q.return(undefined);
+
+    // Sanity check: the SDK transcript contains the metadata we're filtering.
+    const sdkMessages = await getSessionMessages(sessionId);
+    const sdkTexts = sdkMessages
+      .map((m) => {
+        const c = (m as { message?: { content?: unknown } }).message?.content;
+        if (typeof c === "string") return c;
+        if (Array.isArray(c))
+          return c
+            .map((b) =>
+              b && typeof b === "object" && "text" in b
+                ? String((b as { text: unknown }).text)
+                : "",
+            )
+            .join("");
+        return "";
+      })
+      .join("\n");
+    expect(sdkTexts).toContain("<command-name>");
+    expect(sdkTexts).toContain("<local-command-stdout>");
+    expect(sdkTexts).toContain("hi");
+
+    // Step 2: load the session through the ACP agent and confirm the markers
+    // never reach the client as user_message_chunks, while the real "hi"
+    // prompt does.
+    const agent = new ClaudeAcpAgent(client);
+    try {
+      await agent.loadSession({
+        sessionId,
+        cwd: process.cwd(),
+        mcpServers: [],
+      });
+    } finally {
+      await agent.dispose();
+    }
+
+    for (const chunk of recordedUserChunks) {
+      expect(chunk).not.toContain("<command-name>");
+      expect(chunk).not.toContain("<command-message>");
+      expect(chunk).not.toContain("<command-args>");
+      expect(chunk).not.toContain("<local-command-stdout>");
+      expect(chunk).not.toContain("<local-command-stderr>");
+    }
+    expect(recordedUserChunks.some((c) => c.includes("hi"))).toBe(true);
+  }, 60000);
+
+  // Second regression: the original issue showed the markers and the real
+  // "hi" prompt all concatenated into a single string ending with "hi".
+  // loadSession must strip the marker tags in-place rather than dropping the
+  // whole message.
+  it("ACP: loadSession strips marker tags from a concatenated single-string prompt", async () => {
+    const recordedUserChunks: string[] = [];
+    const client = {
+      sessionUpdate: async (notification: SessionNotification) => {
+        if (notification.update.sessionUpdate === "user_message_chunk") {
+          const content = notification.update.content;
+          if (content.type === "text") recordedUserChunks.push(content.text);
+        }
+      },
+      requestPermission: async () => ({ outcome: { outcome: "cancelled" } }),
+      readTextFile: async () => ({ content: "" }),
+      writeTextFile: async () => ({}),
+    } as unknown as AgentSideConnection;
+
+    // Exact shape from https://github.com/zed-industries/claude-code-acp/issues/579.
+    const concatenated =
+      "<command-name>/model</command-name>\n            <command-message>model</command-message>\n            <command-args>opus</command-args>" +
+      "<local-command-stdout>Set model to opus (claude-opus-4-7)</local-command-stdout>\n" +
+      "<command-name>/model</command-name>\n            <command-message>model</command-message>\n            <command-args>opus[1m]</command-args>" +
+      "<local-command-stdout>Set model to opus[1m] (claude-opus-4-7[1m])</local-command-stdout>" +
+      "hi";
+
+    const sessionId = randomUUID();
+    const input = new Pushable<SDKUserMessage>();
+    const q = query({
+      prompt: input,
+      options: {
+        systemPrompt: { type: "preset", preset: "claude_code" },
+        sessionId,
+        settingSources: ["user", "project", "local"],
+        includePartialMessages: true,
+      },
+    });
+    await q.initializationResult();
+
+    input.push({
+      type: "user",
+      message: { role: "user", content: concatenated },
+      session_id: sessionId,
+      parent_tool_use_id: null,
+    });
+    for await (const msg of q) {
+      if (msg.type === "result") break;
+    }
+    input.end();
+    q.return(undefined);
+
+    const agent = new ClaudeAcpAgent(client);
+    try {
+      await agent.loadSession({
+        sessionId,
+        cwd: process.cwd(),
+        mcpServers: [],
+      });
+    } finally {
+      await agent.dispose();
+    }
+
+    expect(recordedUserChunks.length).toBeGreaterThan(0);
+    for (const chunk of recordedUserChunks) {
+      expect(chunk).not.toContain("<command-name>");
+      expect(chunk).not.toContain("<command-message>");
+      expect(chunk).not.toContain("<command-args>");
+      expect(chunk).not.toContain("<local-command-stdout>");
+      expect(chunk).not.toContain("<local-command-stderr>");
+    }
+    expect(recordedUserChunks.some((c) => c.includes("hi"))).toBe(true);
+  }, 60000);
+});

src/tests/settings.test.ts

@@ -17,455 +17,7 @@ describe("SettingsManager", () => {
     await fs.promises.rm(tempDir, { recursive: true, force: true });
   });
 
-  describe("permission checking", () => {
-    it("should return 'ask' when no settings exist", async () => {
-      settingsManager = new SettingsManager(tempDir);
-      await settingsManager.initialize();
-
-      const result = settingsManager.checkPermission("mcp__acp__Read", {
-        file_path: "/some/file.txt",
-      });
-      expect(result.decision).toBe("ask");
-    });
-
-    it("should return 'ask' for non-ACP tools (permission checks only apply to mcp__acp__* tools)", async () => {
-      const claudeDir = path.join(tempDir, ".claude");
-      await fs.promises.mkdir(claudeDir, { recursive: true });
-      await fs.promises.writeFile(
-        path.join(claudeDir, "settings.json"),
-        JSON.stringify({
-          permissions: {
-            deny: ["Read"],
-          },
-        }),
-      );
-
-      settingsManager = new SettingsManager(tempDir);
-      await settingsManager.initialize();
-
-      // Non-ACP tools should always return 'ask' regardless of rules
-      const result = settingsManager.checkPermission("Read", { file_path: "/some/file.txt" });
-      expect(result.decision).toBe("ask");
-    });
-
-    it("should allow tool use when matching allow rule exists", async () => {
-      const claudeDir = path.join(tempDir, ".claude");
-      await fs.promises.mkdir(claudeDir, { recursive: true });
-      await fs.promises.writeFile(
-        path.join(claudeDir, "settings.json"),
-        JSON.stringify({
-          permissions: {
-            allow: ["Read"],
-          },
-        }),
-      );
-
-      settingsManager = new SettingsManager(tempDir);
-      await settingsManager.initialize();
-
-      const result = settingsManager.checkPermission("mcp__acp__Read", {
-        file_path: "/some/file.txt",
-      });
-      expect(result.decision).toBe("allow");
-      expect(result.rule).toBe("Read");
-    });
-
-    it("should deny tool use when matching deny rule exists", async () => {
-      const claudeDir = path.join(tempDir, ".claude");
-      await fs.promises.mkdir(claudeDir, { recursive: true });
-      await fs.promises.writeFile(
-        path.join(claudeDir, "settings.json"),
-        JSON.stringify({
-          permissions: {
-            deny: ["Read(./.env)"],
-          },
-        }),
-      );
-
-      settingsManager = new SettingsManager(tempDir);
-      await settingsManager.initialize();
-
-      const result = settingsManager.checkPermission("mcp__acp__Read", {
-        file_path: path.join(tempDir, ".env"),
-      });
-      expect(result.decision).toBe("deny");
-      expect(result.rule).toBe("Read(./.env)");
-    });
-
-    it("should prioritize deny rules over allow rules", async () => {
-      const claudeDir = path.join(tempDir, ".claude");
-      await fs.promises.mkdir(claudeDir, { recursive: true });
-      await fs.promises.writeFile(
-        path.join(claudeDir, "settings.json"),
-        JSON.stringify({
-          permissions: {
-            allow: ["Read"],
-            deny: ["Read(./.env)"],
-          },
-        }),
-      );
-
-      settingsManager = new SettingsManager(tempDir);
-      await settingsManager.initialize();
-
-      // .env should be denied
-      const envResult = settingsManager.checkPermission("mcp__acp__Read", {
-        file_path: path.join(tempDir, ".env"),
-      });
-      expect(envResult.decision).toBe("deny");
-
-      // other files should be allowed
-      const otherResult = settingsManager.checkPermission("mcp__acp__Read", {
-        file_path: path.join(tempDir, "other.txt"),
-      });
-      expect(otherResult.decision).toBe("allow");
-    });
-
-    it("should handle ACP-prefixed tool names", async () => {
-      const claudeDir = path.join(tempDir, ".claude");
-      await fs.promises.mkdir(claudeDir, { recursive: true });
-      await fs.promises.writeFile(
-        path.join(claudeDir, "settings.json"),
-        JSON.stringify({
-          permissions: {
-            allow: ["Read"],
-          },
-        }),
-      );
-
-      settingsManager = new SettingsManager(tempDir);
-      await settingsManager.initialize();
-
-      const result = settingsManager.checkPermission("mcp__acp__Read", {
-        file_path: "/some/file.txt",
-      });
-      expect(result.decision).toBe("allow");
-    });
-  });
-
-  describe("Bash permission rules", () => {
-    it("should match exact Bash commands without :* wildcard", async () => {
-      const claudeDir = path.join(tempDir, ".claude");
-      await fs.promises.mkdir(claudeDir, { recursive: true });
-      await fs.promises.writeFile(
-        path.join(claudeDir, "settings.json"),
-        JSON.stringify({
-          permissions: {
-            // Per docs: Bash(npm run build) matches the EXACT command "npm run build"
-            allow: ["Bash(npm run lint)"],
-          },
-        }),
-      );
-
-      settingsManager = new SettingsManager(tempDir);
-      await settingsManager.initialize();
-
-      // Exact match should be allowed
-      const exactResult = settingsManager.checkPermission("mcp__acp__Bash", {
-        command: "npm run lint",
-      });
-      expect(exactResult.decision).toBe("allow");
-
-      // Command with extra arguments should NOT match (exact match only)
-      const withArgsResult = settingsManager.checkPermission("mcp__acp__Bash", {
-        command: "npm run lint --fix",
-      });
-      expect(withArgsResult.decision).toBe("ask");
-
-      // Similar command should NOT match (exact match only)
-      const similarResult = settingsManager.checkPermission("mcp__acp__Bash", {
-        command: "npm run linting",
-      });
-      expect(similarResult.decision).toBe("ask");
-
-      // Different command should not match
-      const differentResult = settingsManager.checkPermission("mcp__acp__Bash", {
-        command: "npm run test",
-      });
-      expect(differentResult.decision).toBe("ask");
-    });
-
-    it("should match Bash commands with :* wildcard suffix (prefix matching)", async () => {
-      const claudeDir = path.join(tempDir, ".claude");
-      await fs.promises.mkdir(claudeDir, { recursive: true });
-      await fs.promises.writeFile(
-        path.join(claudeDir, "settings.json"),
-        JSON.stringify({
-          permissions: {
-            // The :* suffix is a convention to make prefix matching explicit
-            allow: ["Bash(npm run:*)"],
-          },
-        }),
-      );
-
-      settingsManager = new SettingsManager(tempDir);
-      await settingsManager.initialize();
-
-      // Any command starting with "npm run" should match (prefix matching with :*)
-      const lintResult = settingsManager.checkPermission("mcp__acp__Bash", {
-        command: "npm run lint",
-      });
-      expect(lintResult.decision).toBe("allow");
-
-      const testResult = settingsManager.checkPermission("mcp__acp__Bash", {
-        command: "npm run test",
-      });
-      expect(testResult.decision).toBe("allow");
-
-      // Commands with additional args also match
-      const withArgsResult = settingsManager.checkPermission("mcp__acp__Bash", {
-        command: "npm run test --watch",
-      });
-      expect(withArgsResult.decision).toBe("allow");
-
-      // Non-matching command
-      const installResult = settingsManager.checkPermission("mcp__acp__Bash", {
-        command: "npm install",
-      });
-      expect(installResult.decision).toBe("ask");
-    });
-
-    it("should not allow shell operators to bypass prefix matching", async () => {
-      const claudeDir = path.join(tempDir, ".claude");
-      await fs.promises.mkdir(claudeDir, { recursive: true });
-      await fs.promises.writeFile(
-        path.join(claudeDir, "settings.json"),
-        JSON.stringify({
-          permissions: {
-            allow: ["Bash(safe-cmd:*)"],
-          },
-        }),
-      );
-
-      settingsManager = new SettingsManager(tempDir);
-      await settingsManager.initialize();
-
-      // Normal prefix match should work
-      const normalResult = settingsManager.checkPermission("mcp__acp__Bash", {
-        command: "safe-cmd --flag",
-      });
-      expect(normalResult.decision).toBe("allow");
-
-      // Shell operators should NOT be allowed (per docs: Claude Code is aware of shell operators)
-      const andResult = settingsManager.checkPermission("mcp__acp__Bash", {
-        command: "safe-cmd && malicious-cmd",
-      });
-      expect(andResult.decision).toBe("ask");
-
-      const orResult = settingsManager.checkPermission("mcp__acp__Bash", {
-        command: "safe-cmd || malicious-cmd",
-      });
-      expect(orResult.decision).toBe("ask");
-
-      const semicolonResult = settingsManager.checkPermission("mcp__acp__Bash", {
-        command: "safe-cmd; malicious-cmd",
-      });
-      expect(semicolonResult.decision).toBe("ask");
-
-      const pipeResult = settingsManager.checkPermission("mcp__acp__Bash", {
-        command: "safe-cmd | malicious-cmd",
-      });
-      expect(pipeResult.decision).toBe("ask");
-
-      const subshellResult = settingsManager.checkPermission("mcp__acp__Bash", {
-        command: "safe-cmd $(malicious-cmd)",
-      });
-      expect(subshellResult.decision).toBe("ask");
-
-      const backtickResult = settingsManager.checkPermission("mcp__acp__Bash", {
-        command: "safe-cmd `malicious-cmd`",
-      });
-      expect(backtickResult.decision).toBe("ask");
-
-      const newlineResult = settingsManager.checkPermission("mcp__acp__Bash", {
-        command: "safe-cmd\nmalicious-cmd",
-      });
-      expect(newlineResult.decision).toBe("ask");
-    });
-
-    it("should deny dangerous Bash commands", async () => {
-      const claudeDir = path.join(tempDir, ".claude");
-      await fs.promises.mkdir(claudeDir, { recursive: true });
-      await fs.promises.writeFile(
-        path.join(claudeDir, "settings.json"),
-        JSON.stringify({
-          permissions: {
-            deny: ["Bash(curl:*)", "Bash(wget:*)"],
-          },
-        }),
-      );
-
-      settingsManager = new SettingsManager(tempDir);
-      await settingsManager.initialize();
-
-      const curlResult = settingsManager.checkPermission("mcp__acp__Bash", {
-        command: "curl https://example.com",
-      });
-      expect(curlResult.decision).toBe("deny");
-
-      const wgetResult = settingsManager.checkPermission("mcp__acp__Bash", {
-        command: "wget https://example.com",
-      });
-      expect(wgetResult.decision).toBe("deny");
-
-      const lsResult = settingsManager.checkPermission("mcp__acp__Bash", { command: "ls -la" });
-      expect(lsResult.decision).toBe("ask");
-    });
-  });
-
-  describe("file path glob matching", () => {
-    it("should match exact file paths", async () => {
-      const claudeDir = path.join(tempDir, ".claude");
-      await fs.promises.mkdir(claudeDir, { recursive: true });
-      await fs.promises.writeFile(
-        path.join(claudeDir, "settings.json"),
-        JSON.stringify({
-          permissions: {
-            deny: ["Read(./.env)"],
-          },
-        }),
-      );
-
-      settingsManager = new SettingsManager(tempDir);
-      await settingsManager.initialize();
-
-      const envResult = settingsManager.checkPermission("mcp__acp__Read", {
-        file_path: path.join(tempDir, ".env"),
-      });
-      expect(envResult.decision).toBe("deny");
-
-      const otherResult = settingsManager.checkPermission("mcp__acp__Read", {
-        file_path: path.join(tempDir, ".envrc"),
-      });
-      expect(otherResult.decision).toBe("ask");
-    });
-
-    it("should match glob patterns with single wildcard", async () => {
-      const claudeDir = path.join(tempDir, ".claude");
-      await fs.promises.mkdir(claudeDir, { recursive: true });
-      await fs.promises.writeFile(
-        path.join(claudeDir, "settings.json"),
-        JSON.stringify({
-          permissions: {
-            deny: ["Read(./.env.*)"],
-          },
-        }),
-      );
-
-      settingsManager = new SettingsManager(tempDir);
-      await settingsManager.initialize();
-
-      const envLocalResult = settingsManager.checkPermission("mcp__acp__Read", {
-        file_path: path.join(tempDir, ".env.local"),
-      });
-      expect(envLocalResult.decision).toBe("deny");
-
-      const envProdResult = settingsManager.checkPermission("mcp__acp__Read", {
-        file_path: path.join(tempDir, ".env.production"),
-      });
-      expect(envProdResult.decision).toBe("deny");
-
-      // Plain .env should not match .env.*
-      const plainEnvResult = settingsManager.checkPermission("mcp__acp__Read", {
-        file_path: path.join(tempDir, ".env"),
-      });
-      expect(plainEnvResult.decision).toBe("ask");
-    });
-
-    it("should match glob patterns with double wildcard (recursive)", async () => {
-      const claudeDir = path.join(tempDir, ".claude");
-      await fs.promises.mkdir(claudeDir, { recursive: true });
-      await fs.promises.writeFile(
-        path.join(claudeDir, "settings.json"),
-        JSON.stringify({
-          permissions: {
-            deny: ["Read(./secrets/**)"],
-          },
-        }),
-      );
-
-      settingsManager = new SettingsManager(tempDir);
-      await settingsManager.initialize();
-
-      const secretResult = settingsManager.checkPermission("mcp__acp__Read", {
-        file_path: path.join(tempDir, "secrets", "api-key.txt"),
-      });
-      expect(secretResult.decision).toBe("deny");
-
-      const nestedSecretResult = settingsManager.checkPermission("mcp__acp__Read", {
-        file_path: path.join(tempDir, "secrets", "deep", "nested", "key.txt"),
-      });
-      expect(nestedSecretResult.decision).toBe("deny");
-
-      const otherResult = settingsManager.checkPermission("mcp__acp__Read", {
-        file_path: path.join(tempDir, "public", "file.txt"),
-      });
-      expect(otherResult.decision).toBe("ask");
-    });
-
-    it("should handle home directory expansion", async () => {
-      const claudeDir = path.join(tempDir, ".claude");
-      await fs.promises.mkdir(claudeDir, { recursive: true });
-      await fs.promises.writeFile(
-        path.join(claudeDir, "settings.json"),
-        JSON.stringify({
-          permissions: {
-            allow: ["Read(~/.zshrc)"],
-          },
-        }),
-      );
-
-      settingsManager = new SettingsManager(tempDir);
-      await settingsManager.initialize();
-
-      const zshrcResult = settingsManager.checkPermission("mcp__acp__Read", {
-        file_path: path.join(os.homedir(), ".zshrc"),
-      });
-      expect(zshrcResult.decision).toBe("allow");
-    });
-  });
-
   describe("settings merging", () => {
-    it("should merge project and local settings", async () => {
-      const claudeDir = path.join(tempDir, ".claude");
-      await fs.promises.mkdir(claudeDir, { recursive: true });
-
-      // Project settings
-      await fs.promises.writeFile(
-        path.join(claudeDir, "settings.json"),
-        JSON.stringify({
-          permissions: {
-            allow: ["Read"],
-          },
-        }),
-      );
-
-      // Local settings
-      await fs.promises.writeFile(
-        path.join(claudeDir, "settings.local.json"),
-        JSON.stringify({
-          permissions: {
-            deny: ["Read(./.env)"],
-          },
-        }),
-      );
-
-      settingsManager = new SettingsManager(tempDir);
-      await settingsManager.initialize();
-
-      // Read should be allowed in general
-      const readResult = settingsManager.checkPermission("mcp__acp__Read", {
-        file_path: path.join(tempDir, "file.txt"),
-      });
-      expect(readResult.decision).toBe("allow");
-
-      // But .env should be denied (local settings take precedence)
-      const envResult = settingsManager.checkPermission("mcp__acp__Read", {
-        file_path: path.join(tempDir, ".env"),
-      });
-      expect(envResult.decision).toBe("deny");
-    });
-
     it("should merge model setting with later sources taking precedence", async () => {
       const claudeDir = path.join(tempDir, ".claude");
       await fs.promises.mkdir(claudeDir, { recursive: true });
@@ -500,100 +52,15 @@ describe("SettingsManager", () => {
       settings = settingsManager.getSettings();
       expect(settings.model).toBe("claude-3-5-haiku");
     });
-  });
 
-  describe("ask rules", () => {
-    it("should return 'ask' for matching ask rules", async () => {
+    it("should expose availableModels from settings", async () => {
       const claudeDir = path.join(tempDir, ".claude");
       await fs.promises.mkdir(claudeDir, { recursive: true });
+
       await fs.promises.writeFile(
         path.join(claudeDir, "settings.json"),
         JSON.stringify({
-          permissions: {
-            ask: ["Bash(git push:*)"],
-          },
-        }),
-      );
-
-      settingsManager = new SettingsManager(tempDir);
-      await settingsManager.initialize();
-
-      const result = settingsManager.checkPermission("mcp__acp__Bash", {
-        command: "git push origin main",
-      });
-      expect(result.decision).toBe("ask");
-      expect(result.rule).toBe("Bash(git push:*)");
-    });
-  });
-
-  describe("Edit and Write tools", () => {
-    it("should handle Edit tool permissions", async () => {
-      const claudeDir = path.join(tempDir, ".claude");
-      await fs.promises.mkdir(claudeDir, { recursive: true });
-      await fs.promises.writeFile(
-        path.join(claudeDir, "settings.json"),
-        JSON.stringify({
-          permissions: {
-            deny: ["Edit(./package-lock.json)"],
-          },
-        }),
-      );
-
-      settingsManager = new SettingsManager(tempDir);
-      await settingsManager.initialize();
-
-      const lockFileResult = settingsManager.checkPermission("mcp__acp__Edit", {
-        file_path: path.join(tempDir, "package-lock.json"),
-      });
-      expect(lockFileResult.decision).toBe("deny");
-
-      const otherResult = settingsManager.checkPermission("mcp__acp__Edit", {
-        file_path: path.join(tempDir, "package.json"),
-      });
-      expect(otherResult.decision).toBe("ask");
-    });
-
-    it("should handle mcp__acp__Edit and mcp__acp__Write tool names", async () => {
-      const claudeDir = path.join(tempDir, ".claude");
-      await fs.promises.mkdir(claudeDir, { recursive: true });
-      await fs.promises.writeFile(
-        path.join(claudeDir, "settings.json"),
-        JSON.stringify({
-          permissions: {
-            allow: ["Edit", "Write"],
-          },
-        }),
-      );
-
-      settingsManager = new SettingsManager(tempDir);
-      await settingsManager.initialize();
-
-      const editResult = settingsManager.checkPermission("mcp__acp__Edit", {
-        file_path: "/some/file.ts",
-      });
-      expect(editResult.decision).toBe("allow");
-
-      const writeResult = settingsManager.checkPermission("mcp__acp__Write", {
-        file_path: "/some/file.ts",
-      });
-      expect(writeResult.decision).toBe("allow");
-    });
-  });
-
-  describe("getSettings", () => {
-    it("should return merged settings", async () => {
-      const claudeDir = path.join(tempDir, ".claude");
-      await fs.promises.mkdir(claudeDir, { recursive: true });
-      await fs.promises.writeFile(
-        path.join(claudeDir, "settings.json"),
-        JSON.stringify({
-          permissions: {
-            allow: ["Read", "Bash(npm:*)"],
-            deny: ["Read(./.env)"],
-          },
-          env: {
-            FOO: "bar",
-          },
+          availableModels: ["claude-haiku-4-5", "claude-opus-4-7[1m]"],
         }),
       );
 
@@ -601,167 +68,139 @@ describe("SettingsManager", () => {
       await settingsManager.initialize();
 
       const settings = settingsManager.getSettings();
-      expect(settings.permissions?.allow).toContain("Read");
-      expect(settings.permissions?.allow).toContain("Bash(npm:*)");
-      expect(settings.permissions?.deny).toContain("Read(./.env)");
-      expect(settings.env?.FOO).toBe("bar");
+      expect(settings.availableModels).toEqual(["claude-haiku-4-5", "claude-opus-4-7[1m]"]);
+    });
+
+    it("should union and dedupe availableModels across sources", async () => {
+      // Per Claude Code docs: "When `availableModels` is set at multiple
+      // levels, such as user settings and project settings, arrays are
+      // merged and deduplicated."
+      // https://code.claude.com/docs/en/model-config#merge-behavior
+      const claudeDir = path.join(tempDir, ".claude");
+      await fs.promises.mkdir(claudeDir, { recursive: true });
+
+      await fs.promises.writeFile(
+        path.join(claudeDir, "settings.json"),
+        JSON.stringify({
+          availableModels: ["claude-haiku-4-5", "claude-opus-4-7[1m]"],
+        }),
+      );
+      await fs.promises.writeFile(
+        path.join(claudeDir, "settings.local.json"),
+        JSON.stringify({
+          // claude-opus-4-7[1m] overlaps with project; should be deduped.
+          availableModels: ["claude-opus-4-7[1m]", "claude-sonnet-4-6[1m]"],
+        }),
+      );
+
+      settingsManager = new SettingsManager(tempDir);
+      await settingsManager.initialize();
+
+      const settings = settingsManager.getSettings();
+      expect(settings.availableModels).toEqual([
+        "claude-haiku-4-5",
+        "claude-opus-4-7[1m]",
+        "claude-sonnet-4-6[1m]",
+      ]);
+    });
+
+    it("should merge permissions.defaultMode with later sources taking precedence", async () => {
+      const claudeDir = path.join(tempDir, ".claude");
+      await fs.promises.mkdir(claudeDir, { recursive: true });
+
+      await fs.promises.writeFile(
+        path.join(claudeDir, "settings.json"),
+        JSON.stringify({
+          permissions: {
+            defaultMode: "dontAsk",
+          },
+        }),
+      );
+
+      settingsManager = new SettingsManager(tempDir);
+      await settingsManager.initialize();
+
+      let settings = settingsManager.getSettings();
+      expect(settings.permissions?.defaultMode).toBe("dontAsk");
+
+      // Local settings override the mode
+      await fs.promises.writeFile(
+        path.join(claudeDir, "settings.local.json"),
+        JSON.stringify({
+          permissions: {
+            defaultMode: "plan",
+          },
+        }),
+      );
+
+      settingsManager.dispose();
+      settingsManager = new SettingsManager(tempDir);
+      await settingsManager.initialize();
+
+      settings = settingsManager.getSettings();
+      expect(settings.permissions?.defaultMode).toBe("plan");
     });
   });
 
-  describe("setCwd", () => {
-    it("should reload settings when cwd changes", async () => {
-      const claudeDir1 = path.join(tempDir, ".claude");
-      await fs.promises.mkdir(claudeDir1, { recursive: true });
-      await fs.promises.writeFile(
-        path.join(claudeDir1, "settings.json"),
-        JSON.stringify({
-          permissions: {
-            allow: ["Read"],
-          },
-        }),
-      );
+  describe("escalating defaultMode trust filter", () => {
+    // The SDK's filterEscalatingDefaultMode drops escalating values
+    // (bypassPermissions / auto / acceptEdits) that came from a repo-committed
+    // tier (.claude/settings.json), preventing a checked-in file from
+    // silently escalating permissions. Local (.claude/settings.local.json)
+    // and user-tier sources are not committed by convention, so escalating
+    // values from those tiers are preserved.
 
-      settingsManager = new SettingsManager(tempDir);
-      await settingsManager.initialize();
+    it.each(["bypassPermissions", "auto", "acceptEdits"] as const)(
+      "drops %s when set in project-tier settings",
+      async (mode) => {
+        const claudeDir = path.join(tempDir, ".claude");
+        await fs.promises.mkdir(claudeDir, { recursive: true });
 
-      let result = settingsManager.checkPermission("mcp__acp__Read", { file_path: "/file.txt" });
-      expect(result.decision).toBe("allow");
+        await fs.promises.writeFile(
+          path.join(claudeDir, "settings.json"),
+          JSON.stringify({ permissions: { defaultMode: mode } }),
+        );
 
-      // Create a new temp directory with different settings
-      const tempDir2 = await fs.promises.mkdtemp(path.join(os.tmpdir(), "settings-test-2-"));
-      const claudeDir2 = path.join(tempDir2, ".claude");
-      await fs.promises.mkdir(claudeDir2, { recursive: true });
-      await fs.promises.writeFile(
-        path.join(claudeDir2, "settings.json"),
-        JSON.stringify({
-          permissions: {
-            deny: ["Read"],
-          },
-        }),
-      );
+        settingsManager = new SettingsManager(tempDir);
+        await settingsManager.initialize();
 
-      await settingsManager.setCwd(tempDir2);
+        expect(settingsManager.getSettings().permissions?.defaultMode).toBeUndefined();
+      },
+    );
 
-      result = settingsManager.checkPermission("mcp__acp__Read", { file_path: "/file.txt" });
-      expect(result.decision).toBe("deny");
+    it.each(["plan", "dontAsk"] as const)(
+      "preserves non-escalating %s from project-tier settings",
+      async (mode) => {
+        const claudeDir = path.join(tempDir, ".claude");
+        await fs.promises.mkdir(claudeDir, { recursive: true });
 
-      // Cleanup second temp dir
-      await fs.promises.rm(tempDir2, { recursive: true, force: true });
-    });
-  });
+        await fs.promises.writeFile(
+          path.join(claudeDir, "settings.json"),
+          JSON.stringify({ permissions: { defaultMode: mode } }),
+        );
 
-  describe("cross-tool rule isolation", () => {
-    // These tests verify the fix in commit d471ccf:
-    // Permission rules should only match their intended tool type.
-    // A Bash rule should not match Edit/Write/Read operations, and vice versa.
+        settingsManager = new SettingsManager(tempDir);
+        await settingsManager.initialize();
 
-    it("should not apply Bash rules to Edit tool calls", async () => {
+        expect(settingsManager.getSettings().permissions?.defaultMode).toBe(mode);
+      },
+    );
+
+    it("preserves escalating defaultMode when it comes from local-tier settings", async () => {
+      // settings.local.json is git-ignored by convention, so the trust
+      // filter does not apply.
       const claudeDir = path.join(tempDir, ".claude");
       await fs.promises.mkdir(claudeDir, { recursive: true });
+
       await fs.promises.writeFile(
-        path.join(claudeDir, "settings.json"),
-        JSON.stringify({
-          permissions: {
-            // This Bash rule has an argument that looks like a glob pattern.
-            // Before the fix, it would incorrectly match Edit operations
-            // because the argument would be interpreted as a file glob.
-            allow: ["Bash(./**:*)"],
-          },
-        }),
+        path.join(claudeDir, "settings.local.json"),
+        JSON.stringify({ permissions: { defaultMode: "acceptEdits" } }),
       );
 
       settingsManager = new SettingsManager(tempDir);
       await settingsManager.initialize();
 
-      // Bash rule should NOT allow Edit operations
-      const result = settingsManager.checkPermission("mcp__acp__Edit", {
-        file_path: path.join(tempDir, "any-file.txt"),
-      });
-      expect(result.decision).toBe("ask");
-    });
-
-    it("should not apply Bash rules to Write tool calls", async () => {
-      const claudeDir = path.join(tempDir, ".claude");
-      await fs.promises.mkdir(claudeDir, { recursive: true });
-      await fs.promises.writeFile(
-        path.join(claudeDir, "settings.json"),
-        JSON.stringify({
-          permissions: {
-            allow: ["Bash(./**:*)"],
-          },
-        }),
-      );
-
-      settingsManager = new SettingsManager(tempDir);
-      await settingsManager.initialize();
-
-      const result = settingsManager.checkPermission("mcp__acp__Write", {
-        file_path: path.join(tempDir, "any-file.txt"),
-      });
-      expect(result.decision).toBe("ask");
-    });
-
-    it("should not apply Bash rules to Read tool calls", async () => {
-      const claudeDir = path.join(tempDir, ".claude");
-      await fs.promises.mkdir(claudeDir, { recursive: true });
-      await fs.promises.writeFile(
-        path.join(claudeDir, "settings.json"),
-        JSON.stringify({
-          permissions: {
-            allow: ["Bash(./**:*)"],
-          },
-        }),
-      );
-
-      settingsManager = new SettingsManager(tempDir);
-      await settingsManager.initialize();
-
-      const result = settingsManager.checkPermission("mcp__acp__Read", {
-        file_path: path.join(tempDir, "any-file.txt"),
-      });
-      expect(result.decision).toBe("ask");
-    });
-
-    it("should not apply Edit rules to Bash tool calls", async () => {
-      const claudeDir = path.join(tempDir, ".claude");
-      await fs.promises.mkdir(claudeDir, { recursive: true });
-      await fs.promises.writeFile(
-        path.join(claudeDir, "settings.json"),
-        JSON.stringify({
-          permissions: {
-            allow: ["Edit"],
-          },
-        }),
-      );
-
-      settingsManager = new SettingsManager(tempDir);
-      await settingsManager.initialize();
-
-      const result = settingsManager.checkPermission("mcp__acp__Bash", {
-        command: "echo hello",
-      });
-      expect(result.decision).toBe("ask");
-    });
-
-    it("should not apply Read rules to Bash tool calls", async () => {
-      const claudeDir = path.join(tempDir, ".claude");
-      await fs.promises.mkdir(claudeDir, { recursive: true });
-      await fs.promises.writeFile(
-        path.join(claudeDir, "settings.json"),
-        JSON.stringify({
-          permissions: {
-            allow: ["Read"],
-          },
-        }),
-      );
-
-      settingsManager = new SettingsManager(tempDir);
-      await settingsManager.initialize();
-
-      const result = settingsManager.checkPermission("mcp__acp__Bash", {
-        command: "ls -la",
-      });
-      expect(result.decision).toBe("ask");
+      expect(settingsManager.getSettings().permissions?.defaultMode).toBe("acceptEdits");
     });
   });
 });

src/tests/typescript-declarations.test.ts

@@ -1,558 +0,0 @@
-import { describe, it, expect, beforeAll, afterAll, beforeEach, afterEach } from "vitest";
-import * as fs from "node:fs";
-import * as path from "node:path";
-import * as os from "node:os";
-import { spawnSync } from "child_process";
-
-describe.skipIf(!process.env.RUN_INTEGRATION_TESTS)(
-  "TypeScript declaration files integration",
-  () => {
-    let tempDir: string;
-    let tarballPath: string;
-    const projectRoot = path.resolve(__dirname, "../..");
-
-    // Base configuration templates
-    const basePackageJson = {
-      name: "ts-declaration-test",
-      version: "1.0.0",
-      type: "module",
-      dependencies: {},
-      devDependencies: {
-        typescript: "5.9.3",
-        "@types/node": "25.0.3",
-      },
-    };
-
-    const baseTsConfig = {
-      compilerOptions: {
-        target: "ES2020",
-        module: "NodeNext",
-        moduleResolution: "NodeNext",
-        lib: ["ES2020"],
-        strict: true,
-        esModuleInterop: true,
-        skipLibCheck: true, // Skip checking dependency internals, focus on our types
-        noEmit: true,
-        declaration: false,
-      },
-      include: ["*.ts"],
-    };
-
-    // Build and pack the package once for all tests
-    beforeAll(async () => {
-      // Step 1: Clean dist folder to ensure fresh build
-      const distPath = path.join(projectRoot, "dist");
-      await fs.promises.rm(distPath, { recursive: true, force: true });
-      console.log("Cleaned dist folder");
-
-      console.log("Building package...");
-
-      // Step 2: Build the package
-      const buildResult = spawnSync("npm", ["run", "build"], {
-        cwd: projectRoot,
-        stdio: "pipe",
-        encoding: "utf-8",
-      });
-
-      if (buildResult.status !== 0) {
-        throw new Error(`Build failed: ${buildResult.stderr || buildResult.stdout}`);
-      }
-
-      console.log("Packing package...");
-
-      // Step 3: Pack to create tarball
-      const packResult = spawnSync("npm", ["pack", "--pack-destination", os.tmpdir()], {
-        cwd: projectRoot,
-        stdio: "pipe",
-        encoding: "utf-8",
-      });
-
-      if (packResult.status !== 0) {
-        throw new Error(`Pack failed: ${packResult.stderr || packResult.stdout}`);
-      }
-
-      // Get the tarball filename from stdout (npm pack outputs the filename)
-      const tarballName = packResult.stdout.trim().split("\n").pop();
-      if (!tarballName) {
-        throw new Error("Failed to get tarball name from npm pack output");
-      }
-      tarballPath = path.join(os.tmpdir(), tarballName);
-
-      console.log(`Tarball created at: ${tarballPath}`);
-    }, 60000); // 60 second timeout for build
-
-    // Clean up the tarball after all tests
-    afterAll(async () => {
-      if (tarballPath && fs.existsSync(tarballPath)) {
-        await fs.promises.unlink(tarballPath);
-        console.log("Cleaned up tarball");
-      }
-    });
-
-    // Create fresh temp directory for each test
-    beforeEach(async () => {
-      tempDir = await fs.promises.mkdtemp(path.join(os.tmpdir(), "ts-declaration-test-"));
-    });
-
-    // Clean up temp directory after each test
-    afterEach(async () => {
-      if (tempDir) {
-        await fs.promises.rm(tempDir, { recursive: true, force: true });
-      }
-    });
-
-    // Helper function to set up a test TypeScript project
-    async function setupTestProject(
-      packageJson: object = basePackageJson,
-      tsconfig: object = baseTsConfig,
-    ): Promise<void> {
-      // Write package.json
-      await fs.promises.writeFile(
-        path.join(tempDir, "package.json"),
-        JSON.stringify(packageJson, null, 2),
-      );
-
-      // Write tsconfig.json
-      await fs.promises.writeFile(
-        path.join(tempDir, "tsconfig.json"),
-        JSON.stringify(tsconfig, null, 2),
-      );
-
-      // Install all dependencies (TypeScript, @types/node, and the tarball)
-      console.log(`Installing dependencies in ${tempDir}...`);
-      const installResult = spawnSync("npm", ["install", tarballPath], {
-        cwd: tempDir,
-        stdio: "pipe",
-        encoding: "utf-8",
-        timeout: 60000, // 60 second timeout
-      });
-
-      if (installResult.status !== 0) {
-        throw new Error(`npm install failed: ${installResult.stderr || installResult.stdout}`);
-      }
-    }
-
-    // Helper function to run TypeScript type checking
-    function runTypeCheck(srcDir: string = tempDir): {
-      success: boolean;
-      output: string;
-    } {
-      const result = spawnSync("npx", ["tsc", "--noEmit"], {
-        cwd: srcDir,
-        stdio: "pipe",
-        encoding: "utf-8",
-        timeout: 30000, // 30 second timeout
-      });
-
-      return {
-        success: result.status === 0,
-        output: result.stdout + result.stderr,
-      };
-    }
-
-    // Helper function to write a test TypeScript file
-    async function writeTestFile(filename: string, content: string): Promise<void> {
-      await fs.promises.writeFile(path.join(tempDir, filename), content);
-    }
-
-    // Test 1: Main exports import verification
-    it("should successfully type-check main exports", async () => {
-      await setupTestProject();
-
-      await writeTestFile(
-        "test-main-exports.ts",
-        `
-import {
-  ClaudeAcpAgent,
-  runAcp,
-  toAcpNotifications,
-  streamEventToAcpNotifications,
-  SettingsManager,
-  createMcpServer,
-  loadManagedSettings,
-  applyEnvironmentSettings,
-  nodeToWebReadable,
-  nodeToWebWritable,
-  Pushable,
-  unreachable,
-  toolInfoFromToolUse,
-  planEntries,
-  toolUpdateFromToolResult,
-  createPreToolUseHook,
-  toolNames,
-} from "@zed-industries/claude-agent-acp";
-
-// Type-only imports
-import type {
-  ToolUpdateMeta,
-  NewSessionMeta,
-  ClaudeCodeSettings,
-  PermissionSettings,
-  PermissionDecision,
-  PermissionCheckResult,
-  SettingsManagerOptions,
-  ClaudePlanEntry,
-} from "@zed-industries/claude-agent-acp";
-
-// Verify exports exist and have expected types
-const _runAcp: typeof runAcp = runAcp;
-const _createMcpServer: typeof createMcpServer = createMcpServer;
-const _toolNames: typeof toolNames = toolNames;
-`,
-      );
-
-      const result = runTypeCheck();
-      if (!result.success) {
-        console.error("TypeScript errors:", result.output);
-      }
-      expect(result.success).toBe(true);
-    }, 120000);
-
-    // Test 2: Deep imports verification (backwards compatibility)
-    it("should successfully type-check deep imports", async () => {
-      await setupTestProject();
-
-      await writeTestFile(
-        "test-deep-imports.ts",
-        `
-// Deep import from dist/tools.js
-import {
-  acpToolNames,
-  EDIT_TOOL_NAMES,
-  ACP_TOOL_NAME_PREFIX,
-  toolInfoFromToolUse,
-  planEntries,
-} from "@zed-industries/claude-agent-acp/dist/tools.js";
-
-// Deep import from dist/settings.js
-import {
-  SettingsManager,
-  getManagedSettingsPath,
-} from "@zed-industries/claude-agent-acp/dist/settings.js";
-
-// Deep import from dist/utils.js
-import {
-  Pushable,
-  nodeToWebReadable,
-  nodeToWebWritable,
-  loadManagedSettings,
-} from "@zed-industries/claude-agent-acp/dist/utils.js";
-
-// Verify types work
-const prefix: string = ACP_TOOL_NAME_PREFIX;
-const editTools: readonly string[] = EDIT_TOOL_NAMES;
-`,
-      );
-
-      const result = runTypeCheck();
-      if (!result.success) {
-        console.error("TypeScript errors:", result.output);
-      }
-      expect(result.success).toBe(true);
-    }, 120000);
-
-    // Test 3: SettingsManager type shape verification
-    it("should verify SettingsManager has correct type shape", async () => {
-      await setupTestProject();
-
-      await writeTestFile(
-        "test-settings-manager.ts",
-        `
-import {
-  SettingsManager,
-  ClaudeCodeSettings,
-  PermissionCheckResult,
-  SettingsManagerOptions
-} from "@zed-industries/claude-agent-acp";
-
-// Test constructor signature
-const options: SettingsManagerOptions = {
-  onChange: () => {},
-  logger: { log: console.log, error: console.error },
-};
-declare const cwd: string;
-const manager = new SettingsManager(cwd, options);
-
-// Test method signatures
-async function testMethods() {
-  // initialize returns Promise<void>
-  await manager.initialize();
-
-  // checkPermission returns PermissionCheckResult
-  const result: PermissionCheckResult = manager.checkPermission(
-    "mcp__acp__Read",
-    { file_path: "/some/path" }
-  );
-
-  // Verify decision type
-  const decision: "allow" | "deny" | "ask" = result.decision;
-  const rule: string | undefined = result.rule;
-  const source: "allow" | "deny" | "ask" | undefined = result.source;
-
-  // getSettings returns ClaudeCodeSettings
-  const settings: ClaudeCodeSettings = manager.getSettings();
-
-  // getCwd returns string
-  const currentCwd: string = manager.getCwd();
-
-  // setCwd returns Promise<void>
-  await manager.setCwd("/new/path");
-
-  // dispose returns void
-  manager.dispose();
-}
-`,
-      );
-
-      const result = runTypeCheck();
-      if (!result.success) {
-        console.error("TypeScript errors:", result.output);
-      }
-      expect(result.success).toBe(true);
-    }, 120000);
-
-    // Test 4: ClaudeAcpAgent instantiation and type verification
-    it("should verify ClaudeAcpAgent has correct type shape", async () => {
-      await setupTestProject();
-
-      await writeTestFile(
-        "test-claude-acp-agent.ts",
-        `
-import { ClaudeAcpAgent } from "@zed-industries/claude-agent-acp";
-import type { AgentSideConnection } from "@agentclientprotocol/sdk";
-
-// ClaudeAcpAgent should be a class that can be instantiated
-declare const mockConnection: AgentSideConnection;
-declare const mockLogger: { log: (...args: any[]) => void; error: (...args: any[]) => void };
-
-// Test constructor - accepts AgentSideConnection and optional logger
-const agent = new ClaudeAcpAgent(mockConnection, mockLogger);
-
-// Verify it has sessions property
-const sessions: Record<string, any> = agent.sessions;
-
-// Verify it has client property
-const client: AgentSideConnection = agent.client;
-
-// Verify it has logger property
-const logger = agent.logger;
-`,
-      );
-
-      const result = runTypeCheck();
-      if (!result.success) {
-        console.error("TypeScript errors:", result.output);
-      }
-      expect(result.success).toBe(true);
-    }, 120000);
-
-    // Test 5: Type-only exports work correctly
-    it("should verify type-only exports are usable", async () => {
-      await setupTestProject();
-
-      await writeTestFile(
-        "test-type-exports.ts",
-        `
-import type {
-  ClaudeCodeSettings,
-  PermissionSettings,
-  PermissionDecision,
-  PermissionCheckResult,
-  SettingsManagerOptions,
-  ClaudePlanEntry,
-  ToolUpdateMeta,
-  NewSessionMeta,
-} from "@zed-industries/claude-agent-acp";
-
-// Test ClaudeCodeSettings shape
-const settings: ClaudeCodeSettings = {
-  permissions: {
-    allow: ["Read"],
-    deny: ["Read(./.env)"],
-    ask: ["Bash"],
-    additionalDirectories: ["/extra"],
-    defaultMode: "default",
-  },
-  env: {
-    API_KEY: "secret",
-  },
-};
-
-// Test PermissionSettings shape
-const perms: PermissionSettings = {
-  allow: ["Read"],
-  deny: ["Write"],
-};
-
-// Test PermissionDecision
-const decisions: PermissionDecision[] = ["allow", "deny", "ask"];
-
-// Test ClaudePlanEntry shape
-const planEntry: ClaudePlanEntry = {
-  content: "Do something",
-  status: "pending",
-  activeForm: "Doing something",
-};
-
-// Test valid status values
-const validStatuses: ClaudePlanEntry["status"][] = [
-  "pending",
-  "in_progress",
-  "completed",
-];
-
-// Test ToolUpdateMeta shape
-const toolMeta: ToolUpdateMeta = {
-  claudeCode: {
-    toolName: "Read",
-    toolResponse: { success: true },
-  },
-};
-
-// Test NewSessionMeta shape
-const sessionMeta: NewSessionMeta = {
-  claudeCode: {
-    options: {},
-  },
-};
-`,
-      );
-
-      const result = runTypeCheck();
-      if (!result.success) {
-        console.error("TypeScript errors:", result.output);
-      }
-      expect(result.success).toBe(true);
-    }, 120000);
-
-    // Test 6: Function signatures verification
-    it("should verify function signatures are correct", async () => {
-      await setupTestProject();
-
-      await writeTestFile(
-        "test-function-signatures.ts",
-        `
-import {
-  runAcp,
-  createMcpServer,
-  toolInfoFromToolUse,
-  planEntries,
-  createPreToolUseHook,
-  loadManagedSettings,
-  applyEnvironmentSettings,
-  SettingsManager,
-} from "@zed-industries/claude-agent-acp";
-
-import type { ClaudeCodeSettings } from "@zed-industries/claude-agent-acp";
-
-// runAcp should be a function with no parameters that returns void
-const runAcpType: () => void = runAcp;
-
-// toolInfoFromToolUse should accept any and return object with title and kind
-const info = toolInfoFromToolUse({ name: "Read", input: {} });
-const title: string = info.title;
-const kind: string = info.kind;
-
-// planEntries should accept todos array and return array
-const entries = planEntries({
-  todos: [
-    { content: "test", status: "pending", activeForm: "testing" }
-  ]
-});
-// entries should be an array
-const entriesArray: any[] = entries;
-
-// createPreToolUseHook should accept SettingsManager and optional logger
-declare const settingsManager: SettingsManager;
-const hook = createPreToolUseHook(settingsManager, console);
-
-// loadManagedSettings should return ClaudeCodeSettings | null
-const managedSettings: ClaudeCodeSettings | null = loadManagedSettings();
-
-// applyEnvironmentSettings should accept ClaudeCodeSettings and return void
-const applyResult: void = applyEnvironmentSettings({ permissions: {} });
-`,
-      );
-
-      const result = runTypeCheck();
-      if (!result.success) {
-        console.error("TypeScript errors:", result.output);
-      }
-      expect(result.success).toBe(true);
-    }, 120000);
-
-    // Test 7: Pushable generic class verification
-    it("should verify Pushable class works correctly", async () => {
-      await setupTestProject();
-
-      await writeTestFile(
-        "test-pushable.ts",
-        `
-import { Pushable } from "@zed-industries/claude-agent-acp";
-
-// Pushable should be a generic class
-const pushable = new Pushable<string>();
-
-// Should have push method
-pushable.push("test");
-
-// Should have end method
-pushable.end();
-
-// Should implement AsyncIterable
-async function consume() {
-  for await (const item of pushable) {
-    const str: string = item;
-  }
-}
-
-// Generic type parameter should work
-const numPushable = new Pushable<number>();
-numPushable.push(42);
-
-interface MyType { id: number; name: string; }
-const customPushable = new Pushable<MyType>();
-customPushable.push({ id: 1, name: "test" });
-`,
-      );
-
-      const result = runTypeCheck();
-      if (!result.success) {
-        console.error("TypeScript errors:", result.output);
-      }
-      expect(result.success).toBe(true);
-    }, 120000);
-
-    // Test 8: Verify incorrect types fail
-    it("should fail type-check with incorrect types", async () => {
-      await setupTestProject();
-
-      await writeTestFile(
-        "test-invalid-types.ts",
-        `
-import { SettingsManager, ClaudeCodeSettings } from "@zed-industries/claude-agent-acp";
-
-// This should fail - SettingsManager constructor requires string cwd
-// @ts-expect-error - Testing that wrong argument type fails
-const badManager = new SettingsManager(123);
-
-// This should fail - ClaudeCodeSettings permissions must be an object
-const badSettings: ClaudeCodeSettings = {
-  // @ts-expect-error - Testing that wrong type fails
-  permissions: "not-an-object",
-};
-`,
-      );
-
-      // This test should PASS because we expect tsc to catch these errors
-      // with @ts-expect-error directives
-      const result = runTypeCheck();
-      if (!result.success) {
-        // If it fails, it means @ts-expect-error didn't catch the error
-        // which could mean the types are too permissive
-        console.error("TypeScript errors (expected @ts-expect-error to catch):", result.output);
-      }
-      expect(result.success).toBe(true);
-    }, 120000);
-  },
-);

src/tools.ts

@@ -5,8 +5,22 @@ import {
   ToolCallLocation,
   ToolKind,
 } from "@agentclientprotocol/sdk";
-import { SYSTEM_REMINDER } from "./mcp-server.js";
-import * as diff from "diff";
+import { HookCallback } from "@anthropic-ai/claude-agent-sdk";
+import {
+  AgentInput,
+  BashInput,
+  FileEditInput,
+  FileReadInput,
+  FileWriteInput,
+  GlobInput,
+  GrepInput,
+  TaskCreateInput,
+  TaskCreateOutput,
+  TaskUpdateInput,
+  TodoWriteInput,
+  WebFetchInput,
+  WebSearchInput,
+} from "@anthropic-ai/claude-agent-sdk/sdk-tools.js";
 import {
   ImageBlockParam,
   TextBlockParam,
@@ -16,50 +30,31 @@ import {
   WebSearchToolResultError,
 } from "@anthropic-ai/sdk/resources";
 import {
-  BetaBashCodeExecutionToolResultBlockParam,
   BetaBashCodeExecutionResultBlock,
+  BetaBashCodeExecutionToolResultBlockParam,
   BetaBashCodeExecutionToolResultError,
-  BetaCodeExecutionToolResultBlockParam,
   BetaCodeExecutionResultBlock,
+  BetaCodeExecutionToolResultBlockParam,
   BetaCodeExecutionToolResultError,
+  BetaImageBlockParam,
   BetaRequestMCPToolResultBlockParam,
-  BetaTextEditorCodeExecutionToolResultBlockParam,
-  BetaTextEditorCodeExecutionViewResultBlock,
   BetaTextEditorCodeExecutionCreateResultBlock,
   BetaTextEditorCodeExecutionStrReplaceResultBlock,
+  BetaTextEditorCodeExecutionToolResultBlockParam,
   BetaTextEditorCodeExecutionToolResultError,
+  BetaTextEditorCodeExecutionViewResultBlock,
+  BetaToolReferenceBlock,
   BetaToolResultBlockParam,
   BetaToolSearchToolResultBlockParam,
-  BetaToolReferenceBlock,
-  BetaToolSearchToolSearchResultBlock,
   BetaToolSearchToolResultError,
-  BetaWebFetchToolResultBlockParam,
+  BetaToolSearchToolSearchResultBlock,
   BetaWebFetchBlock,
+  BetaWebFetchToolResultBlockParam,
   BetaWebFetchToolResultErrorBlock,
   BetaWebSearchToolResultBlockParam,
-  BetaImageBlockParam,
 } from "@anthropic-ai/sdk/resources/beta.mjs";
-
-const acpUnqualifiedToolNames = {
-  read: "Read",
-  edit: "Edit",
-  write: "Write",
-  bash: "Bash",
-  killShell: "KillShell",
-  bashOutput: "BashOutput",
-};
-
-export const ACP_TOOL_NAME_PREFIX = "mcp__acp__";
-export const acpToolNames = {
-  read: ACP_TOOL_NAME_PREFIX + acpUnqualifiedToolNames.read,
-  edit: ACP_TOOL_NAME_PREFIX + acpUnqualifiedToolNames.edit,
-  write: ACP_TOOL_NAME_PREFIX + acpUnqualifiedToolNames.write,
-  bash: ACP_TOOL_NAME_PREFIX + acpUnqualifiedToolNames.bash,
-  killShell: ACP_TOOL_NAME_PREFIX + acpUnqualifiedToolNames.killShell,
-  bashOutput: ACP_TOOL_NAME_PREFIX + acpUnqualifiedToolNames.bashOutput,
-};
-
-export const EDIT_TOOL_NAMES = [acpToolNames.edit, acpToolNames.write];
+import path from "node:path";
+import { Logger } from "./acp-agent.js";
 
 /**
  * Union of all possible content types that can appear in tool results from the Anthropic SDK.
@@ -84,9 +79,6 @@ type ToolResultContent =
   | BetaTextEditorCodeExecutionCreateResultBlock
   | BetaTextEditorCodeExecutionStrReplaceResultBlock
   | BetaTextEditorCodeExecutionToolResultError;
-import { HookCallback } from "@anthropic-ai/claude-agent-sdk";
-import { Logger } from "./acp-agent.js";
-import { SettingsManager } from "./settings.js";
 
 interface ToolInfo {
   title: string;
@@ -99,19 +91,52 @@ interface ToolUpdate {
   title?: string;
   content?: ToolCallContent[];
   locations?: ToolCallLocation[];
+  _meta?: {
+    terminal_info?: {
+      terminal_id: string;
+    };
+    terminal_output?: {
+      terminal_id: string;
+      data: string;
+    };
+    terminal_exit?: {
+      terminal_id: string;
+      exit_code: number;
+      signal: string | null;
+    };
+  };
 }
 
-export function toolInfoFromToolUse(toolUse: any): ToolInfo {
+/**
+ * Convert an absolute file path to a project-relative path for display.
+ * Returns the original path if it's outside the project directory or if no cwd is provided.
+ */
+export function toDisplayPath(filePath: string, cwd?: string): string {
+  if (!cwd) return filePath;
+  const resolvedCwd = path.resolve(cwd);
+  const resolvedFile = path.resolve(filePath);
+  if (resolvedFile.startsWith(resolvedCwd + path.sep) || resolvedFile === resolvedCwd) {
+    return path.relative(resolvedCwd, resolvedFile);
+  }
+  return filePath;
+}
+
+export function toolInfoFromToolUse(
+  toolUse: any,
+  supportsTerminalOutput: boolean = false,
+  cwd?: string,
+): ToolInfo {
   const name = toolUse.name;
-  const input = toolUse.input;
 
   switch (name) {
-    case "Task":
+    case "Agent":
+    case "Task": {
+      const input = toolUse.input as AgentInput | BashInput | undefined;
       return {
         title: input?.description ? input.description : "Task",
         kind: "think",
         content:
-          input && input.prompt
+          input && "prompt" in input
             ? [
                 {
                   type: "content",
@@ -120,38 +145,16 @@ export function toolInfoFromToolUse(toolUse: any): ToolInfo {
               ]
             : [],
       };
+    }
 
-    case "NotebookRead":
+    case "Bash": {
+      const input = toolUse.input as BashInput | undefined;
       return {
-        title: input?.notebook_path ? `Read Notebook ${input.notebook_path}` : "Read Notebook",
-        kind: "read",
-        content: [],
-        locations: input?.notebook_path ? [{ path: input.notebook_path }] : [],
-      };
-
-    case "NotebookEdit":
-      return {
-        title: input?.notebook_path ? `Edit Notebook ${input.notebook_path}` : "Edit Notebook",
-        kind: "edit",
-        content:
-          input && input.new_source
-            ? [
-                {
-                  type: "content",
-                  content: { type: "text", text: input.new_source },
-                },
-              ]
-            : [],
-        locations: input?.notebook_path ? [{ path: input.notebook_path }] : [],
-      };
-
-    case "Bash":
-    case acpToolNames.bash:
-      return {
-        title: input?.command ? "`" + input.command.replaceAll("`", "\\`") + "`" : "Terminal",
+        title: input?.command ? input.command : "Terminal",
         kind: "execute",
-        content:
-          input && input.description
+        content: supportsTerminalOutput
+          ? [{ type: "terminal" as const, terminalId: toolUse.id }]
+          : input && input.description
             ? [
                 {
                   type: "content",
@@ -160,39 +163,25 @@ export function toolInfoFromToolUse(toolUse: any): ToolInfo {
               ]
             : [],
       };
+    }
 
-    case "BashOutput":
-    case acpToolNames.bashOutput:
-      return {
-        title: "Tail Logs",
-        kind: "execute",
-        content: [],
-      };
-
-    case "KillShell":
-    case acpToolNames.killShell:
-      return {
-        title: "Kill Process",
-        kind: "execute",
-        content: [],
-      };
-
-    case acpToolNames.read: {
+    case "Read": {
+      const input = toolUse.input as FileReadInput | undefined;
       let limit = "";
-      if (input.limit) {
-        limit =
-          " (" + ((input.offset ?? 0) + 1) + " - " + ((input.offset ?? 0) + input.limit) + ")";
-      } else if (input.offset) {
-        limit = " (from line " + (input.offset + 1) + ")";
+      if (input?.limit && input.limit > 0) {
+        limit = " (" + (input.offset ?? 1) + " - " + ((input.offset ?? 1) + input.limit - 1) + ")";
+      } else if (input?.offset) {
+        limit = " (from line " + input.offset + ")";
       }
+      const displayPath = input?.file_path ? toDisplayPath(input.file_path, cwd) : "File";
       return {
-        title: "Read " + (input.file_path ?? "File") + limit,
+        title: "Read " + displayPath + limit,
         kind: "read",
-        locations: input.file_path
+        locations: input?.file_path
           ? [
               {
                 path: input.file_path,
-                line: input.offset ?? 0,
+                line: input.offset ?? 1,
               },
             ]
           : [],
@@ -200,52 +189,8 @@ export function toolInfoFromToolUse(toolUse: any): ToolInfo {
       };
     }
 
-    case "Read":
-      return {
-        title: "Read File",
-        kind: "read",
-        content: [],
-        locations: input.file_path
-          ? [
-              {
-                path: input.file_path,
-                line: input.offset ?? 0,
-              },
-            ]
-          : [],
-      };
-
-    case "LS":
-      return {
-        title: `List the ${input?.path ? "`" + input.path + "`" : "current"} directory's contents`,
-        kind: "search",
-        content: [],
-        locations: [],
-      };
-
-    case acpToolNames.edit:
-    case "Edit": {
-      const path = input?.file_path ?? input?.file_path;
-
-      return {
-        title: path ? `Edit \`${path}\`` : "Edit",
-        kind: "edit",
-        content:
-          input && path
-            ? [
-                {
-                  type: "diff",
-                  path,
-                  oldText: input.old_string ?? null,
-                  newText: input.new_string ?? "",
-                },
-              ]
-            : [],
-        locations: path ? [{ path }] : undefined,
-      };
-    }
-
-    case acpToolNames.write: {
+    case "Write": {
+      const input = toolUse.input as FileWriteInput | undefined;
       let content: ToolCallContent[] = [];
       if (input && input.file_path) {
         content = [
@@ -264,103 +209,110 @@ export function toolInfoFromToolUse(toolUse: any): ToolInfo {
           },
         ];
       }
+      const displayPath = input?.file_path ? toDisplayPath(input.file_path, cwd) : undefined;
       return {
-        title: input?.file_path ? `Write ${input.file_path}` : "Write",
+        title: displayPath ? `Write ${displayPath}` : "Write",
         kind: "edit",
         content,
         locations: input?.file_path ? [{ path: input.file_path }] : [],
       };
     }
 
-    case "Write":
+    case "Edit": {
+      const input = toolUse.input as FileEditInput | undefined;
+      let content: ToolCallContent[] = [];
+      if (input && input.file_path && (input.old_string || input.new_string)) {
+        content = [
+          {
+            type: "diff",
+            path: input.file_path,
+            oldText: input.old_string || null,
+            newText: input.new_string ?? "",
+          },
+        ];
+      }
+      const displayPath = input?.file_path ? toDisplayPath(input.file_path, cwd) : undefined;
       return {
-        title: input?.file_path ? `Write ${input.file_path}` : "Write",
+        title: displayPath ? `Edit ${displayPath}` : "Edit",
         kind: "edit",
-        content:
-          input && input.file_path
-            ? [
-                {
-                  type: "diff",
-                  path: input.file_path,
-                  oldText: null,
-                  newText: input.content,
-                },
-              ]
-            : [],
+        content,
         locations: input?.file_path ? [{ path: input.file_path }] : [],
       };
+    }
 
     case "Glob": {
+      const input = toolUse.input as GlobInput | undefined;
       let label = "Find";
-      if (input.path) {
+      if (input?.path) {
         label += ` \`${input.path}\``;
       }
-      if (input.pattern) {
+      if (input?.pattern) {
         label += ` \`${input.pattern}\``;
       }
       return {
         title: label,
         kind: "search",
         content: [],
-        locations: input.path ? [{ path: input.path }] : [],
+        locations: input?.path ? [{ path: input.path }] : [],
       };
     }
 
     case "Grep": {
+      const input = toolUse.input as GrepInput | undefined;
       let label = "grep";
 
-      if (input["-i"]) {
+      if (input?.["-i"]) {
         label += " -i";
       }
-      if (input["-n"]) {
+      if (input?.["-n"]) {
         label += " -n";
       }
 
-      if (input["-A"] !== undefined) {
+      if (input?.["-A"] !== undefined) {
         label += ` -A ${input["-A"]}`;
       }
-      if (input["-B"] !== undefined) {
+      if (input?.["-B"] !== undefined) {
         label += ` -B ${input["-B"]}`;
       }
-      if (input["-C"] !== undefined) {
+      if (input?.["-C"] !== undefined) {
         label += ` -C ${input["-C"]}`;
       }
 
-      if (input.output_mode) {
+      if (input?.output_mode) {
         switch (input.output_mode) {
-          case "FilesWithMatches":
+          case "files_with_matches":
             label += " -l";
             break;
-          case "Count":
+          case "count":
             label += " -c";
             break;
-          case "Content":
+          case "content":
           default:
             break;
         }
       }
 
-      if (input.head_limit !== undefined) {
+      if (input?.head_limit !== undefined) {
         label += ` | head -${input.head_limit}`;
       }
 
-      if (input.glob) {
+      if (input?.glob) {
         label += ` --include="${input.glob}"`;
       }
 
-      if (input.type) {
+      if (input?.type) {
         label += ` --type=${input.type}`;
       }
 
-      if (input.multiline) {
+      if (input?.multiline) {
         label += " -P";
       }
 
-      if (input.pattern) {
+      if (input?.pattern) {
         label += ` "${input.pattern}"`;
       }
 
-      if (input.path) {
+      if (input?.path) {
         label += ` ${input.path}`;
       }
 
@@ -371,7 +323,8 @@ export function toolInfoFromToolUse(toolUse: any): ToolInfo {
       };
     }
 
-    case "WebFetch":
+    case "WebFetch": {
+      const input = toolUse.input as WebFetchInput;
       return {
         title: input?.url ? `Fetch ${input.url}` : "Fetch",
         kind: "fetch",
@@ -385,15 +338,17 @@ export function toolInfoFromToolUse(toolUse: any): ToolInfo {
               ]
             : [],
       };
+    }
 
     case "WebSearch": {
-      let label = `"${input.query}"`;
+      const input = toolUse.input as WebSearchInput | undefined;
+      let label = input?.query ? `"${input.query}"` : "Web search";
 
-      if (input.allowed_domains && input.allowed_domains.length > 0) {
+      if (input?.allowed_domains && input.allowed_domains.length > 0) {
         label += ` (allowed: ${input.allowed_domains.join(", ")})`;
       }
 
-      if (input.blocked_domains && input.blocked_domains.length > 0) {
+      if (input?.blocked_domains && input.blocked_domains.length > 0) {
         label += ` (blocked: ${input.blocked_domains.join(", ")})`;
       }
 
@@ -404,7 +359,8 @@ export function toolInfoFromToolUse(toolUse: any): ToolInfo {
       };
     }
 
-    case "TodoWrite":
+    case "TodoWrite": {
+      const input = toolUse.input as TodoWriteInput | undefined;
       return {
         title: Array.isArray(input?.todos)
           ? `Update TODOs: ${input.todos.map((todo: any) => todo.content).join(", ")}`
@@ -412,18 +368,55 @@ export function toolInfoFromToolUse(toolUse: any): ToolInfo {
         kind: "think",
         content: [],
       };
+    }
 
-    case "ExitPlanMode":
+    case "TaskCreate": {
+      const input = toolUse.input as TaskCreateInput | undefined;
+      return {
+        title: input?.subject ? `Create task: ${input.subject}` : "Create task",
+        kind: "think",
+        content: [],
+      };
+    }
+
+    case "TaskUpdate": {
+      const input = toolUse.input as TaskUpdateInput | undefined;
+      return {
+        title: input?.subject ? `Update task: ${input.subject}` : "Update task",
+        kind: "think",
+        content: [],
+      };
+    }
+
+    case "TaskList": {
+      return {
+        title: "List tasks",
+        kind: "think",
+        content: [],
+      };
+    }
+
+    case "TaskGet": {
+      return {
+        title: "Get task",
+        kind: "think",
+        content: [],
+      };
+    }
+
+    case "ExitPlanMode": {
+      const planInput = toolUse.input as { plan?: string } | undefined;
       return {
         title: "Ready to code?",
         kind: "switch_mode",
-        content:
-          input && input.plan
-            ? [{ type: "content", content: { type: "text", text: input.plan } }]
-            : [],
+        content: planInput?.plan
+          ? [{ type: "content" as const, content: { type: "text" as const, text: planInput.plan } }]
+          : [],
       };
+    }
 
     case "Other": {
+      const input = toolUse.input;
       let output;
       try {
         output = JSON.stringify(input, null, 2);
@@ -467,6 +460,7 @@ export function toolUpdateFromToolResult(
     | BetaRequestMCPToolResultBlockParam
     | BetaToolSearchToolResultBlockParam,
   toolUse: any | undefined,
+  supportsTerminalOutput: boolean = false,
 ): ToolUpdate {
   if (
     "is_error" in toolResult &&
@@ -480,7 +474,6 @@ export function toolUpdateFromToolResult(
 
   switch (toolUse?.name) {
     case "Read":
-    case acpToolNames.read:
       if (Array.isArray(toolResult.content) && toolResult.content.length > 0) {
         return {
           content: toolResult.content.map((content: any) => ({
@@ -489,9 +482,9 @@ export function toolUpdateFromToolResult(
               content.type === "text"
                 ? {
                     type: "text",
-                    text: markdownEscape(content.text.replace(SYSTEM_REMINDER, "")),
+                    text: markdownEscape(content.text),
                   }
-                : content,
+                : toAcpContentBlock(content, false),
           })),
         };
       } else if (typeof toolResult.content === "string" && toolResult.content.length > 0) {
@@ -501,7 +494,7 @@ export function toolUpdateFromToolResult(
               type: "content",
               content: {
                 type: "text",
-                text: markdownEscape(toolResult.content.replace(SYSTEM_REMINDER, "")),
+                text: markdownEscape(toolResult.content),
               },
             },
           ],
@@ -509,59 +502,75 @@ export function toolUpdateFromToolResult(
       }
       return {};
 
-    case acpToolNames.edit: {
-      const content: ToolCallContent[] = [];
-      const locations: ToolCallLocation[] = [];
+    case "Bash": {
+      const result = toolResult.content;
+      const terminalId = "tool_use_id" in toolResult ? String(toolResult.tool_use_id) : "";
+      const isError = "is_error" in toolResult && toolResult.is_error;
+
+      // Extract output and exit code from either format:
+      // 1. BetaBashCodeExecutionResultBlock: { type: "bash_code_execution_result", stdout, stderr, return_code }
+      // 2. Plain string content from a regular tool_result
+      // 3. Array content (e.g. [{ type: "text", text: "..." }])
+      let output = "";
+      let exitCode = isError ? 1 : 0;
 
       if (
-        Array.isArray(toolResult.content) &&
-        toolResult.content.length > 0 &&
-        "text" in toolResult.content[0] &&
-        typeof toolResult.content[0].text === "string"
+        result &&
+        typeof result === "object" &&
+        "type" in result &&
+        result.type === "bash_code_execution_result"
       ) {
-        const patches = diff.parsePatch(toolResult.content[0].text);
-        console.error(JSON.stringify(patches));
-        for (const { oldFileName, newFileName, hunks } of patches) {
-          for (const { lines, newStart } of hunks) {
-            const oldText = [];
-            const newText = [];
-            for (const line of lines) {
-              if (line.startsWith("-")) {
-                oldText.push(line.slice(1));
-              } else if (line.startsWith("+")) {
-                newText.push(line.slice(1));
-              } else {
-                oldText.push(line.slice(1));
-                newText.push(line.slice(1));
-              }
-            }
-            if (oldText.length > 0 || newText.length > 0) {
-              locations.push({ path: newFileName || oldFileName, line: newStart });
-              content.push({
-                type: "diff",
-                path: newFileName || oldFileName,
-                oldText: oldText.join("\n") || null,
-                newText: newText.join("\n"),
-              });
-            }
-          }
-        }
+        const bashResult = result as BetaBashCodeExecutionResultBlock;
+        output = [bashResult.stdout, bashResult.stderr].filter(Boolean).join("\n");
+        exitCode = bashResult.return_code;
+      } else if (typeof result === "string") {
+        output = result;
+      } else if (
+        Array.isArray(result) &&
+        result.length > 0 &&
+        "text" in result[0] &&
+        typeof result[0].text === "string"
+      ) {
+        output = result.map((c: any) => c.text).join("\n");
       }
 
-      const result: ToolUpdate = {};
-      if (content.length > 0) {
-        result.content = content;
+      if (supportsTerminalOutput) {
+        return {
+          content: [{ type: "terminal" as const, terminalId }],
+          _meta: {
+            terminal_info: {
+              terminal_id: terminalId,
+            },
+            terminal_output: {
+              terminal_id: terminalId,
+              data: output,
+            },
+            terminal_exit: {
+              terminal_id: terminalId,
+              exit_code: exitCode,
+              signal: null,
+            },
+          },
+        };
       }
-      if (locations.length > 0) {
-        result.locations = locations;
+      // Fallback: format output as a code block without terminal _meta
+      if (output.trim()) {
+        return {
+          content: [
+            {
+              type: "content",
+              content: {
+                type: "text",
+                text: `\`\`\`console\n${output.trimEnd()}\n\`\`\``,
+              },
+            },
+          ],
+        };
       }
-      return result;
+      return {};
     }
 
-    case acpToolNames.bash:
-    case "edit":
-    case "Edit":
-    case acpToolNames.write:
+    case "Edit": // Edit is handled in hooks
     case "Write": {
       return {};
     }
@@ -570,20 +579,6 @@ export function toolUpdateFromToolResult(
       return { title: "Exited Plan Mode" };
     }
 
-    case "Task":
-    case "NotebookEdit":
-    case "NotebookRead":
-    case "TodoWrite":
-    case "exit_plan_mode":
-    case "Bash":
-    case "BashOutput":
-    case "KillBash":
-    case "LS":
-    case "Glob":
-    case "Grep":
-    case "WebFetch":
-    case "WebSearch":
-    case "Other":
     default: {
       return toAcpContentUpdate(
         toolResult.content,
@@ -703,10 +698,107 @@ export type ClaudePlanEntry = {
   activeForm: string;
 };
 
-export function planEntries(input: { todos: ClaudePlanEntry[] }): PlanEntry[] {
-  return input.todos.map((input) => ({
-    content: input.content,
-    status: input.status,
+export function planEntries(input: { todos: ClaudePlanEntry[] } | undefined): PlanEntry[] {
+  return (input?.todos ?? []).map((todo) => ({
+    content: todo.content,
+    status: todo.status,
+    priority: "medium",
+  }));
+}
+
+/**
+ * Per-session task list accumulated from Task* tool calls (TaskCreate /
+ * TaskUpdate). The headless/SDK session emits these as incremental tool
+ * calls keyed by task ID, replacing the snapshot-style TodoWrite tool.
+ * Iteration order is insertion order (Map semantics), matching the order
+ * tasks are created.
+ */
+export type TaskEntry = {
+  subject: string;
+  status: "pending" | "in_progress" | "completed";
+  activeForm?: string;
+  description?: string;
+};
+export type TaskState = Map<string, TaskEntry>;
+
+/**
+ * Best-effort parse of a TaskCreate tool_result content into the structured
+ * TaskCreateOutput. The SDK delivers tool outputs either as a string or as
+ * an array of TextBlockParam-like blocks containing JSON text; try both.
+ */
+export function parseTaskCreateOutput(content: unknown): TaskCreateOutput | undefined {
+  const tryParse = (text: string): TaskCreateOutput | undefined => {
+    try {
+      const parsed = JSON.parse(text);
+      if (
+        parsed &&
+        typeof parsed === "object" &&
+        parsed.task &&
+        typeof parsed.task.id === "string"
+      ) {
+        return parsed as TaskCreateOutput;
+      }
+    } catch {
+      // ignore
+    }
+    return undefined;
+  };
+
+  if (typeof content === "string") {
+    return tryParse(content);
+  }
+  if (Array.isArray(content)) {
+    for (const block of content) {
+      if (block && typeof block === "object" && "type" in block && block.type === "text") {
+        const text = (block as { text?: unknown }).text;
+        if (typeof text === "string") {
+          const parsed = tryParse(text);
+          if (parsed) return parsed;
+        }
+      }
+    }
+  }
+  return undefined;
+}
+
+export function applyTaskCreate(
+  state: TaskState,
+  input: TaskCreateInput | undefined,
+  output: TaskCreateOutput | undefined,
+): void {
+  const taskId = output?.task?.id;
+  if (!taskId || !input) return;
+  state.set(taskId, {
+    subject: input.subject,
+    status: "pending",
+    activeForm: input.activeForm,
+    description: input.description,
+  });
+}
+
+export function applyTaskUpdate(state: TaskState, input: TaskUpdateInput | undefined): void {
+  if (!input?.taskId) return;
+  if (input.status === "deleted") {
+    state.delete(input.taskId);
+    return;
+  }
+  const existing = state.get(input.taskId);
+  // Without a subject from either the existing entry or the update payload,
+  // we'd produce a plan entry with empty `content` — drop the update.
+  const subject = input.subject ?? existing?.subject;
+  if (!subject) return;
+  state.set(input.taskId, {
+    subject,
+    status: input.status ?? existing?.status ?? "pending",
+    activeForm: input.activeForm ?? existing?.activeForm,
+    description: input.description ?? existing?.description,
+  });
+}
+
+export function taskStateToPlanEntries(state: TaskState): PlanEntry[] {
+  return Array.from(state.values()).map((task) => ({
+    content: task.subject,
+    status: task.status,
     priority: "medium",
   }));
 }
@@ -721,6 +813,67 @@ export function markdownEscape(text: string): string {
   return escape + "\n" + text + (text.endsWith("\n") ? "" : "\n") + escape;
 }
 
+interface DiffToolResponseHunk {
+  oldStart: number;
+  oldLines: number;
+  newStart: number;
+  newLines: number;
+  lines: string[];
+}
+
+interface DiffToolResponse {
+  filePath?: string;
+  structuredPatch?: DiffToolResponseHunk[];
+}
+
+/**
+ * Builds diff ToolUpdate content from the structured toolResponse provided by
+ * the PostToolUse hook for diff-producing tools (Edit, Write). Unlike parsing
+ * the plain unified diff string, this uses the pre-parsed structuredPatch
+ * which supports multiple replacement sites (replaceAll) and always includes
+ * context lines for better readability.
+ */
+export function toolUpdateFromDiffToolResponse(toolResponse: unknown): {
+  content?: ToolCallContent[];
+  locations?: ToolCallLocation[];
+} {
+  if (!toolResponse || typeof toolResponse !== "object") return {};
+  const response = toolResponse as DiffToolResponse;
+  if (!response.filePath || !Array.isArray(response.structuredPatch)) return {};
+
+  const content: ToolCallContent[] = [];
+  const locations: ToolCallLocation[] = [];
+
+  for (const { lines, newStart } of response.structuredPatch) {
+    const oldText: string[] = [];
+    const newText: string[] = [];
+    for (const line of lines) {
+      if (line.startsWith("-")) {
+        oldText.push(line.slice(1));
+      } else if (line.startsWith("+")) {
+        newText.push(line.slice(1));
+      } else {
+        oldText.push(line.slice(1));
+        newText.push(line.slice(1));
+      }
+    }
+    if (oldText.length > 0 || newText.length > 0) {
+      locations.push({ path: response.filePath, line: newStart });
+      content.push({
+        type: "diff",
+        path: response.filePath,
+        oldText: oldText.join("\n") || null,
+        newText: newText.join("\n"),
+      });
+    }
+  }
+
+  const result: { content?: ToolCallContent[]; locations?: ToolCallLocation[] } = {};
+  if (content.length > 0) result.content = content;
+  if (locations.length > 0) result.locations = locations;
+  return result;
+}
+
 /* A global variable to store callbacks that should be executed when receiving hooks from Claude Code */
 const toolUseCallbacks: {
   [toolUseId: string]: {
@@ -780,52 +933,36 @@ export const createPostToolUseHook =
   };
 
 /**
- * Creates a PreToolUse hook that checks permissions using the SettingsManager.
- * This runs before the SDK's built-in permission rules, allowing us to enforce
- * our own permission settings for ACP-prefixed tools.
+ * Hook callback for `TaskCreated` / `TaskCompleted` events. The SDK fires
+ * these for both user-facing TaskCreate tool calls and subagent task
+ * creation, giving us `task_id` + `task_subject` without having to parse
+ * tool_result payloads.
+ *
+ * Populating `taskState` from the hook means a later `TaskUpdate` (which
+ * typically only carries `taskId` + `status`) finds an existing entry with
+ * a real subject, instead of synthesizing a placeholder with empty content.
  */
-export const createPreToolUseHook =
-  (settingsManager: SettingsManager, logger: Logger = console): HookCallback =>
-  async (input: any, _toolUseID: string | undefined) => {
-    if (input.hook_event_name !== "PreToolUse") {
-      return { continue: true };
-    }
-
-    const toolName = input.tool_name;
-    const toolInput = input.tool_input;
-
-    const permissionCheck = settingsManager.checkPermission(toolName, toolInput);
-
-    if (permissionCheck.decision !== "ask") {
-      logger.log(
-        `[PreToolUseHook] Tool: ${toolName}, Decision: ${permissionCheck.decision}, Rule: ${permissionCheck.rule}`,
-      );
-    }
-
-    switch (permissionCheck.decision) {
-      case "allow":
-        return {
-          continue: true,
-          hookSpecificOutput: {
-            hookEventName: "PreToolUse" as const,
-            permissionDecision: "allow" as const,
-            permissionDecisionReason: `Allowed by settings rule: ${permissionCheck.rule}`,
-          },
-        };
-
-      case "deny":
-        return {
-          continue: true,
-          hookSpecificOutput: {
-            hookEventName: "PreToolUse" as const,
-            permissionDecision: "deny" as const,
-            permissionDecisionReason: `Denied by settings rule: ${permissionCheck.rule}`,
-          },
-        };
-
-      case "ask":
-      default:
-        // Let the normal permission flow continue
-        return { continue: true };
+export const createTaskHook =
+  (options: { taskState: TaskState; onChange?: () => Promise<void> }): HookCallback =>
+  async (input): Promise<{ continue: boolean }> => {
+    const taskId =
+      "task_id" in input && typeof input.task_id === "string" ? input.task_id : undefined;
+    if (!taskId) return { continue: true };
+
+    if (input.hook_event_name === "TaskCreated") {
+      if (!input.task_subject) return { continue: true };
+      if (options.taskState.has(taskId)) return { continue: true };
+      options.taskState.set(taskId, {
+        subject: input.task_subject,
+        status: "pending",
+        description: input.task_description,
+      });
+      if (options.onChange) await options.onChange();
+    } else if (input.hook_event_name === "TaskCompleted") {
+      const existing = options.taskState.get(taskId);
+      if (!existing || existing.status === "completed") return { continue: true };
+      options.taskState.set(taskId, { ...existing, status: "completed" });
+      if (options.onChange) await options.onChange();
     }
+    return { continue: true };
   };

src/utils.ts

@@ -2,9 +2,7 @@
 
 import { Readable, Writable } from "node:stream";
 import { WritableStream, ReadableStream } from "node:stream/web";
-import { readFileSync } from "node:fs";
 import { Logger } from "./acp-agent.js";
-import { ClaudeCodeSettings, getManagedSettingsPath } from "./settings.js";
 
 // Useful for bridging push-based and async-iterator-based code.
 export class Pushable<T> implements AsyncIterable<T> {
@@ -89,89 +87,3 @@ export function unreachable(value: never, logger: Logger = console) {
 export function sleep(time: number): Promise<void> {
   return new Promise((resolve) => setTimeout(resolve, time));
 }
-
-export function loadManagedSettings(): ClaudeCodeSettings | null {
-  try {
-    return JSON.parse(readFileSync(getManagedSettingsPath(), "utf8")) as ClaudeCodeSettings;
-  } catch {
-    return null;
-  }
-}
-
-export function applyEnvironmentSettings(settings: ClaudeCodeSettings): void {
-  if (settings.env) {
-    for (const [key, value] of Object.entries(settings.env)) {
-      process.env[key] = value;
-    }
-  }
-}
-
-export interface ExtractLinesResult {
-  content: string;
-  wasLimited: boolean;
-  linesRead: number;
-}
-
-/**
- * Extracts lines from file content with byte limit enforcement.
- *
- * @param fullContent - The complete file content
- * @param maxContentLength - Maximum number of UTF-16 Code Units to return
- * @returns Object containing extracted content and metadata
- */
-export function extractLinesWithByteLimit(
-  fullContent: string,
-  maxContentLength: number,
-): ExtractLinesResult {
-  if (fullContent === "") {
-    return {
-      content: "",
-      wasLimited: false,
-      linesRead: 1,
-    };
-  }
-
-  let linesSeen = 0;
-  let index = 0;
-
-  let contentLength = 0;
-  let wasLimited = false;
-
-  while (true) {
-    const nextIndex = fullContent.indexOf("\n", index);
-
-    if (nextIndex < 0) {
-      // Last line in file (no trailing newline)
-      if (linesSeen > 0 && fullContent.length > maxContentLength) {
-        wasLimited = true;
-        break;
-      }
-      linesSeen += 1;
-      contentLength = fullContent.length;
-      break;
-    } else {
-      // Line with newline - include up to the newline
-      const newContentLength = nextIndex + 1;
-      if (linesSeen > 0 && newContentLength > maxContentLength) {
-        wasLimited = true;
-        break;
-      }
-      linesSeen += 1;
-      contentLength = newContentLength;
-      index = newContentLength;
-    }
-  }
-
-  return {
-    content: fullContent.slice(0, contentLength),
-    wasLimited,
-    linesRead: linesSeen,
-  };
-}
-
-// Helper to encode a path like Claude does:
-// - Unix: "/Users/test" -> "-Users-test"
-// - Windows: "C:\Users\test" -> "C--Users-test"
-export function encodeProjectPath(cwd: string): string {
-  return cwd.replace(/[^a-zA-Z0-9]/g, "-");
-}

tsconfig.json

@@ -1,9 +1,9 @@
 {
   "compilerOptions": {
-    "target": "ES2020",
+    "target": "ES2021",
     "module": "NodeNext",
     "moduleResolution": "NodeNext",
-    "lib": ["ES2020"],
+    "lib": ["ES2021"],
     "strict": true,
     "esModuleInterop": true,
     "forceConsistentCasingInFileNames": true,