chore(main): release 0.36.0 (#683 )

🤖 I have created a release *beep* *boop* --- ## [0.36.0](https://github.com/agentclientprotocol/claude-agent-acp/compare/v0.35.0...v0.36.0) (2026-05-18) ### Features * Add experimental session delete support ([#682](https://github.com/agentclientprotocol/claude-agent-acp/issues/682)) ([2162d5a](2162d5af62)) * Support experimental additionalDirectories field ([#684](https://github.com/agentclientprotocol/claude-agent-acp/issues/684)) ([f37e9a0](f37e9a0d47)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: acp-release-bot[bot] <246668977+acp-release-bot[bot]@users.noreply.github.com>
feat: Support experimental additionalDirectories field (#684 )
2026-11-02 15:31:50 +00:00 · 2026-05-18 13:02:28 +02:00 · 2026-05-18 10:51:45 +00:00 · 2026-05-18 10:43:07 +00:00 · 2026-05-18 00:45:33 +02:00 · 2026-05-16 23:41:18 +02:00
19 changed files with 3129 additions and 665 deletions
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -16,7 +16,7 @@ jobs:
      # Generating a GitHub token, so that PRs and tags created by
      # the release-please-action can trigger actions workflows.
      - name: Generate GitHub token
-        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
        id: generate-token
        with:
          # GitHub App ID secret name
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "0.31.3"
+  ".": "0.36.0"
 }
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,85 @@
 # Changelog

+## [0.36.0](https://github.com/agentclientprotocol/claude-agent-acp/compare/v0.35.0...v0.36.0) (2026-05-18)
+
+
+### Features
+
+* Add experimental session delete support ([#682](https://github.com/agentclientprotocol/claude-agent-acp/issues/682)) ([2162d5a](https://github.com/agentclientprotocol/claude-agent-acp/commit/2162d5af62d493a82381bd88bc8fc67d376e358b))
+* Support experimental additionalDirectories field ([#684](https://github.com/agentclientprotocol/claude-agent-acp/issues/684)) ([f37e9a0](https://github.com/agentclientprotocol/claude-agent-acp/commit/f37e9a0d47d8d201d98b2177083664a6781895cc))
+
+## [0.35.0](https://github.com/agentclientprotocol/claude-agent-acp/compare/v0.34.1...v0.35.0) (2026-05-16)
+
+
+### Features
+
+* **deps:** bump actions/create-github-app-token from 3.1.1 to 3.2.0 ([#669](https://github.com/agentclientprotocol/claude-agent-acp/issues/669)) ([47df1f2](https://github.com/agentclientprotocol/claude-agent-acp/commit/47df1f2a0be57ddb8873ae8e341f748471c7bc53))
+* **deps:** bump hono from 4.12.18 to 4.12.19 in the minor group ([#671](https://github.com/agentclientprotocol/claude-agent-acp/issues/671)) ([5d7165d](https://github.com/agentclientprotocol/claude-agent-acp/commit/5d7165d96158da2ddf3087676cdb0a19d1ff57aa))
+* **deps:** update to claude-agent-sdk 0.3.143 ([#664](https://github.com/agentclientprotocol/claude-agent-acp/issues/664)) ([27ca2e5](https://github.com/agentclientprotocol/claude-agent-acp/commit/27ca2e5d40917887671cc4c39a854fd8f92c01e6))
+* Use SDK settings resolution for defaults ([#677](https://github.com/agentclientprotocol/claude-agent-acp/issues/677)) ([eb1259c](https://github.com/agentclientprotocol/claude-agent-acp/commit/eb1259cf88375ca3c20a219ab99f12f5488fb360))
+
+
+### Bug Fixes
+
+* Add task hooks for plan state updates ([#676](https://github.com/agentclientprotocol/claude-agent-acp/issues/676)) ([5ff7d50](https://github.com/agentclientprotocol/claude-agent-acp/commit/5ff7d50f0ec7f34a7d9d901223aed73e2dbcce68))
+* render local-command-stdout messages instead of dropping them ([#649](https://github.com/agentclientprotocol/claude-agent-acp/issues/649)) ([3b9b7d5](https://github.com/agentclientprotocol/claude-agent-acp/commit/3b9b7d5a56defd925eb2038fa97b6484ad951587))
+
+## [0.34.1](https://github.com/agentclientprotocol/claude-agent-acp/compare/v0.34.0...v0.34.1) (2026-05-16)
+
+
+### Bug Fixes
+
+* load credential error for bedrock gateway ([#667](https://github.com/agentclientprotocol/claude-agent-acp/issues/667)) ([8d76be3](https://github.com/agentclientprotocol/claude-agent-acp/commit/8d76be356a3e74c58a7c93c3c201cca6a317d784))
+
+## [0.34.0](https://github.com/agentclientprotocol/claude-agent-acp/compare/v0.33.1...v0.34.0) (2026-05-15)
+
+
+### Features
+
+* add bedrock gateway authentication ([#665](https://github.com/agentclientprotocol/claude-agent-acp/issues/665)) ([002c63a](https://github.com/agentclientprotocol/claude-agent-acp/commit/002c63a78b844c168d3dfc744cf408362a6adf97))
+
+## [0.33.1](https://github.com/agentclientprotocol/claude-agent-acp/compare/v0.33.0...v0.33.1) (2026-05-07)
+
+
+### Bug Fixes
+
+* Honor availableModels settings allowlist ([#637](https://github.com/agentclientprotocol/claude-agent-acp/issues/637)) ([867a3a0](https://github.com/agentclientprotocol/claude-agent-acp/commit/867a3a0de2a050592d79aa76d7dd3dd5b478162d)), closes [#620](https://github.com/agentclientprotocol/claude-agent-acp/issues/620)
+
+## [0.33.0](https://github.com/agentclientprotocol/claude-agent-acp/compare/v0.32.0...v0.33.0) (2026-05-07)
+
+
+### Features
+
+* **deps:** bump the minor group with 14 updates ([#631](https://github.com/agentclientprotocol/claude-agent-acp/issues/631)) ([8b43ee8](https://github.com/agentclientprotocol/claude-agent-acp/commit/8b43ee813f05f5087a213a7f42154e39d6bc4a5a))
+* **deps:** Update to claude-agent-sdk 0.2.132 ([#636](https://github.com/agentclientprotocol/claude-agent-acp/issues/636)) ([0c8ff27](https://github.com/agentclientprotocol/claude-agent-acp/commit/0c8ff277f2af8d3085cc1b5cf33891630dede0b1))
+
+
+### Bug Fixes
+
+* Handle result origins in ACP agent ([#627](https://github.com/agentclientprotocol/claude-agent-acp/issues/627)) ([dba1998](https://github.com/agentclientprotocol/claude-agent-acp/commit/dba199839a25ba405f04b9d4409e647150fe0290))
+
+## [0.32.0](https://github.com/agentclientprotocol/claude-agent-acp/compare/v0.31.4...v0.32.0) (2026-05-03)
+
+
+### Features
+
+* **deps-dev:** Bump nanoid from 3.3.11 to 3.3.12 ([#622](https://github.com/agentclientprotocol/claude-agent-acp/issues/622)) ([c78ac62](https://github.com/agentclientprotocol/claude-agent-acp/commit/c78ac62d05283e5683b87b198923818f9f556a03))
+* **deps:** Bump the minor group with 2 updates ([#619](https://github.com/agentclientprotocol/claude-agent-acp/issues/619)) ([6ccd37c](https://github.com/agentclientprotocol/claude-agent-acp/commit/6ccd37ce947fbd55691f676344b15ef1266191ad))
+* **deps:** update to @anthropic-ai/claude-agent-sdk 0.2.126 ([#621](https://github.com/agentclientprotocol/claude-agent-acp/issues/621)) ([becc3b8](https://github.com/agentclientprotocol/claude-agent-acp/commit/becc3b86e60eb33e7823a0ef27d5aa99758750d7))
+* **deps:** Update to @anthropic-ai/claude-agent-sdk@0.2.123 ([#614](https://github.com/agentclientprotocol/claude-agent-acp/issues/614)) ([5b93119](https://github.com/agentclientprotocol/claude-agent-acp/commit/5b9311938d97f47400debd66f2b4792e50639c6b))
+
+
+### Bug Fixes
+
+* emit a real diff when Write overwrites an existing file ([#618](https://github.com/agentclientprotocol/claude-agent-acp/issues/618)) ([8d7e220](https://github.com/agentclientprotocol/claude-agent-acp/commit/8d7e22026e15d54208414bd9ad128eb86d41b451))
+
+## [0.31.4](https://github.com/agentclientprotocol/claude-agent-acp/compare/v0.31.3...v0.31.4) (2026-04-28)
+
+
+### Bug Fixes
+
+* gate auto mode on model support ([#604](https://github.com/agentclientprotocol/claude-agent-acp/issues/604)) ([ec47d34](https://github.com/agentclientprotocol/claude-agent-acp/commit/ec47d3446fa22e5895621f57c0a4497dbe044505))
+
 ## [0.31.3](https://github.com/agentclientprotocol/claude-agent-acp/compare/v0.31.2...v0.31.3) (2026-04-28)


--- a/package-lock.json
+++ b/package-lock.json
--- a/package.json
+++ b/package.json
@@ -3,7 +3,7 @@
  "publishConfig": {
    "access": "public"
  },
-  "version": "0.31.3",
+  "version": "0.36.0",
  "description": "An ACP-compatible coding agent powered by the Claude Agent SDK (TypeScript)",
  "main": "dist/lib.js",
  "types": "dist/lib.d.ts",
@@ -60,22 +60,22 @@
  "author": "Zed Industries",
  "license": "Apache-2.0",
  "dependencies": {
-    "@agentclientprotocol/sdk": "0.21.0",
-    "@anthropic-ai/claude-agent-sdk": "0.2.121",
+    "@agentclientprotocol/sdk": "0.22.0",
+    "@anthropic-ai/claude-agent-sdk": "0.3.143",
    "zod": "^3.25.0 || ^4.0.0"
  },
  "devDependencies": {
-    "@anthropic-ai/sdk": "0.89.0",
+    "@anthropic-ai/sdk": "0.96.0",
    "@eslint/js": "10.0.1",
-    "@types/node": "25.6.0",
-    "@typescript-eslint/eslint-plugin": "8.59.1",
-    "@typescript-eslint/parser": "8.59.1",
-    "eslint": "10.2.1",
+    "@types/node": "25.8.0",
+    "@typescript-eslint/eslint-plugin": "8.59.3",
+    "@typescript-eslint/parser": "8.59.3",
+    "eslint": "10.4.0",
    "eslint-config-prettier": "10.1.8",
-    "globals": "17.5.0",
+    "globals": "17.6.0",
    "prettier": "3.8.3",
    "ts-node": "10.9.2",
    "typescript": "6.0.3",
-    "vitest": "4.1.5"
+    "vitest": "4.1.6"
  }
 }
--- a/src/acp-agent.ts
+++ b/src/acp-agent.ts
@@ -17,6 +17,7 @@ import {
  ndJsonStream,
  NewSessionRequest,
  NewSessionResponse,
+  PermissionOption,
  PromptRequest,
  PromptResponse,
  ReadTextFileRequest,
@@ -36,6 +37,8 @@ import {
  SetSessionModeResponse,
  CloseSessionRequest,
  CloseSessionResponse,
+  DeleteSessionRequest,
+  DeleteSessionResponse,
  TerminalHandle,
  TerminalOutputResponse,
  WriteTextFileRequest,
@@ -44,6 +47,7 @@ import {
 } from "@agentclientprotocol/sdk";
 import {
  CanUseTool,
+  deleteSession,
  getSessionMessages,
  listSessions,
  McpServerConfig,
@@ -56,6 +60,7 @@ import {
  query,
  Settings,
  SDKAssistantMessageError,
+  SDKMessageOrigin,
  SDKPartialAssistantMessage,
  SDKUserMessage,
  SlashCommand,
@@ -68,12 +73,18 @@ import * as path from "node:path";
 import packageJson from "../package.json" with { type: "json" };
 import { SettingsManager } from "./settings.js";
 import {
+  applyTaskCreate,
+  applyTaskUpdate,
  ClaudePlanEntry,
  createPostToolUseHook,
+  createTaskHook,
+  parseTaskCreateOutput,
  planEntries,
  registerHookCallback,
+  TaskState,
+  taskStateToPlanEntries,
  toolInfoFromToolUse,
-  toolUpdateFromEditToolResponse,
+  toolUpdateFromDiffToolResponse,
  toolUpdateFromToolResult,
 } from "./tools.js";
 import { nodeToWebReadable, nodeToWebWritable, Pushable, unreachable } from "./utils.js";
@@ -151,6 +162,9 @@ type Session = {
   *  DEFAULT_CONTEXT_WINDOW, refreshed from each result's modelUsage, and
   *  invalidated when the user switches the session's model. */
  contextWindowSize: number;
+  /** Accumulated task list for the session, keyed by task ID. Task IDs are
+   *  per-session, so this state must not be shared across sessions. */
+  taskState: TaskState;
 };

 /** Compute a stable fingerprint of the session-defining params so we can
@@ -179,6 +193,7 @@ type BackgroundTerminal =
 export type SDKMessageFilter = {
  type: string;
  subtype?: string;
+  origin?: SDKMessageOrigin["kind"];
 };

 /**
@@ -230,6 +245,8 @@ type GatewayAuthMeta = {
  };
 };

+type GatewayAuthRequest = AuthenticateRequest & { _meta?: GatewayAuthMeta };
+
 /**
 * Extra metadata that the agent provides for each tool_call / tool_update update.
 */
@@ -474,7 +491,7 @@ export class ClaudeAcpAgent implements Agent {
  backgroundTerminals: { [key: string]: BackgroundTerminal } = {};
  clientCapabilities?: ClientCapabilities;
  logger: Logger;
-  gatewayAuthMeta?: GatewayAuthMeta;
+  gatewayAuthRequest?: GatewayAuthRequest;

  constructor(client: AgentSideConnection, logger?: Logger) {
    this.sessions = {};
@@ -501,6 +518,17 @@ export class ClaudeAcpAgent implements Agent {
      },
    };

+    const gatewayBedrockAuthMethod: AuthMethod = {
+      id: "gateway-bedrock",
+      name: "Custom model gateway",
+      description: "Use a custom gateway to authenticate and access models",
+      _meta: {
+        gateway: {
+          protocol: "bedrock",
+        },
+      },
+    };
+
    const supportsTerminalAuth = request.clientCapabilities?.auth?.terminal === true;
    const supportsMetaTerminalAuth = request.clientCapabilities?._meta?.["terminal-auth"] === true;

@@ -600,10 +628,12 @@ export class ClaudeAcpAgent implements Agent {
        },
        loadSession: true,
        sessionCapabilities: {
+          additionalDirectories: {},
+          close: {},
+          delete: {},
          fork: {},
          list: {},
          resume: {},
-          close: {},
        },
      },
      agentInfo: {
@@ -611,7 +641,10 @@ export class ClaudeAcpAgent implements Agent {
        title: "Claude Agent",
        version: packageJson.version,
      },
-      authMethods: [...terminalAuthMethods, ...(supportsGatewayAuth ? [gatewayAuthMethod] : [])],
+      authMethods: [
+        ...terminalAuthMethods,
+        ...(supportsGatewayAuth ? [gatewayAuthMethod, gatewayBedrockAuthMethod] : []),
+      ],
    };
  }

@@ -632,6 +665,7 @@ export class ClaudeAcpAgent implements Agent {
      {
        cwd: params.cwd,
        mcpServers: params.mcpServers ?? [],
+        additionalDirectories: params.additionalDirectories,
        _meta: params._meta,
      },
      {
@@ -688,8 +722,8 @@ export class ClaudeAcpAgent implements Agent {
  }

  async authenticate(_params: AuthenticateRequest): Promise<void> {
-    if (_params.methodId === "gateway") {
-      this.gatewayAuthMeta = _params._meta as GatewayAuthMeta | undefined;
+    if (_params.methodId === "gateway" || _params.methodId === "gateway-bedrock") {
+      this.gatewayAuthRequest = _params as GatewayAuthRequest;
      return;
    }
    throw new Error("Method not implemented.");
@@ -848,6 +882,7 @@ export class ClaudeAcpAgent implements Agent {
              case "notification":
              case "api_retry":
              case "mirror_error":
+              case "permission_denied":
                // Todo: process via status api: https://docs.claude.com/en/docs/claude-code/hooks#hook-output
                break;
              default:
@@ -873,6 +908,12 @@ export class ClaudeAcpAgent implements Agent {
              session.contextWindowSize = matchingModelUsage.contextWindow;
            }

+            // Task-notification followups are autonomous work triggered by a
+            // task-notification system message, not by the user's prompt.
+            // They should not influence the user-turn lifecycle (stop reason,
+            // slash-command output forwarding) but their cost is real.
+            const isTaskNotification = message.origin?.kind === "task-notification";
+
            // Send usage_update notification
            if (lastAssistantTotalUsage !== null) {
              await this.client.sessionUpdate({
@@ -885,12 +926,17 @@ export class ClaudeAcpAgent implements Agent {
                    amount: message.total_cost_usd,
                    currency: "USD",
                  },
+                  ...(message.origin && {
+                    _meta: { "_claude/origin": message.origin },
+                  }),
                },
              });
            }

            if (session.cancelled) {
-              stopReason = "cancelled";
+              if (!isTaskNotification) {
+                stopReason = "cancelled";
+              }
              break;
            }

@@ -900,7 +946,9 @@ export class ClaudeAcpAgent implements Agent {
                  throw RequestError.authRequired();
                }
                if (message.stop_reason === "max_tokens") {
-                  stopReason = "max_tokens";
+                  if (!isTaskNotification) {
+                    stopReason = "max_tokens";
+                  }
                  break;
                }
                if (message.is_error) {
@@ -911,7 +959,9 @@ export class ClaudeAcpAgent implements Agent {
                }
                // For local-only commands (no model invocation), the result
                // text is the command output — forward it to the client.
-                if (isLocalOnlyCommand) {
+                // Task-notification followups never originate from a user
+                // slash command, so skip the forwarding for them.
+                if (isLocalOnlyCommand && !isTaskNotification) {
                  for (const notification of toAcpNotifications(
                    message.result,
                    "assistant",
@@ -927,7 +977,9 @@ export class ClaudeAcpAgent implements Agent {
              }
              case "error_during_execution": {
                if (message.stop_reason === "max_tokens") {
-                  stopReason = "max_tokens";
+                  if (!isTaskNotification) {
+                    stopReason = "max_tokens";
+                  }
                  break;
                }
                if (message.is_error) {
@@ -936,7 +988,9 @@ export class ClaudeAcpAgent implements Agent {
                    message.errors.join(", ") || message.subtype,
                  );
                }
-                stopReason = "end_turn";
+                if (!isTaskNotification) {
+                  stopReason = "end_turn";
+                }
                break;
              }
              case "error_max_budget_usd":
@@ -948,7 +1002,9 @@ export class ClaudeAcpAgent implements Agent {
                    message.errors.join(", ") || message.subtype,
                  );
                }
-                stopReason = "max_turn_requests";
+                if (!isTaskNotification) {
+                  stopReason = "max_turn_requests";
+                }
                break;
              default:
                unreachable(message, this.logger);
@@ -1017,6 +1073,7 @@ export class ClaudeAcpAgent implements Agent {
              {
                clientCapabilities: this.clientCapabilities,
                cwd: session.cwd,
+                taskState: session.taskState,
              },
            )) {
              await this.client.sessionUpdate(notification);
@@ -1065,13 +1122,36 @@ export class ClaudeAcpAgent implements Agent {
              }
            }

-            // Slash commands like /compact can generate invalid output... doesn't match
-            // their own docs: https://docs.anthropic.com/en/docs/claude-code/sdk/sdk-slash-commands#%2Fcompact-compact-conversation-history
+            // Strip <command-*>/<local-command-stdout> markers and render any
+            // remaining prose. Skill bodies and built-in slash commands (e.g.
+            // /usage, /status, /model) arrive wrapped in these tags; pure-marker
+            // payloads (e.g. /compact's malformed output) strip to null and are
+            // skipped. Mirrors the replay path at replaySessionHistory.
            if (
              typeof message.message.content === "string" &&
              message.message.content.includes("<local-command-stdout>")
            ) {
-              this.logger.log(message.message.content);
+              const stripped = stripLocalCommandMetadata(message.message.content);
+              if (typeof stripped === "string") {
+                for (const notification of toAcpNotifications(
+                  stripped,
+                  message.message.role,
+                  params.sessionId,
+                  this.toolUseCache,
+                  this.client,
+                  this.logger,
+                  {
+                    clientCapabilities: this.clientCapabilities,
+                    parentToolUseId: message.parent_tool_use_id,
+                    cwd: session.cwd,
+                    taskState: session.taskState,
+                  },
+                )) {
+                  await this.client.sessionUpdate(notification);
+                }
+              } else {
+                this.logger.log(message.message.content);
+              }
              break;
            }

@@ -1123,6 +1203,7 @@ export class ClaudeAcpAgent implements Agent {
                clientCapabilities: this.clientCapabilities,
                parentToolUseId: message.parent_tool_use_id,
                cwd: session.cwd,
+                taskState: session.taskState,
              },
            )) {
              await this.client.sessionUpdate(notification);
@@ -1222,6 +1303,16 @@ export class ClaudeAcpAgent implements Agent {
    return {};
  }

+  async unstable_deleteSession(params: DeleteSessionRequest): Promise<DeleteSessionResponse> {
+    // Tear down any active in-memory state first so the on-disk file isn't
+    // recreated by an outstanding query writing to it.
+    if (this.sessions[params.sessionId]) {
+      await this.teardownSession(params.sessionId);
+    }
+    await deleteSession(params.sessionId);
+    return {};
+  }
+
  async unstable_setSessionModel(
    params: SetSessionModelRequest,
  ): Promise<SetSessionModelResponse | void> {
@@ -1309,7 +1400,7 @@ export class ClaudeAcpAgent implements Agent {
    // effort changes and effort changes induced by a model switch go through
    // the same path.

-    await this.applyConfigOptionValue(session, params.configId, resolvedValue);
+    await this.applyConfigOptionValue(params.sessionId, session, params.configId, resolvedValue);

    return { configOptions: session.configOptions };
  }
@@ -1326,8 +1417,17 @@ export class ClaudeAcpAgent implements Agent {
      default:
        throw new Error("Invalid Mode");
    }
+
+    const session = this.sessions[sessionId];
+    if (!session) {
+      throw new Error("Session not found");
+    }
+    if (!session.modes.availableModes.some((mode) => mode.id === modeId)) {
+      throw new Error(`Mode ${modeId} is not available in this session`);
+    }
+
    try {
-      await this.sessions[sessionId].query.setPermissionMode(modeId);
+      await session.query.setPermissionMode(modeId);
    } catch (error) {
      if (error instanceof Error) {
        if (!error.message) {
@@ -1367,6 +1467,7 @@ export class ClaudeAcpAgent implements Agent {
          registerHooks: false,
          clientCapabilities: this.clientCapabilities,
          cwd: this.sessions[sessionId]?.cwd,
+          taskState: this.sessions[sessionId]?.taskState,
        },
      )) {
        await this.client.sessionUpdate(notification);
@@ -1397,7 +1498,7 @@ export class ClaudeAcpAgent implements Agent {
      }

      if (toolName === "ExitPlanMode") {
-        const options = [
+        const optionsAll: PermissionOption[] = [
          { kind: "allow_always", name: 'Yes, and use "auto" mode', optionId: "auto" },
          {
            kind: "allow_always",
@@ -1408,12 +1509,20 @@ export class ClaudeAcpAgent implements Agent {
          { kind: "reject_once", name: "No, keep planning", optionId: "plan" },
        ];
        if (ALLOW_BYPASS) {
-          options.unshift({
+          optionsAll.unshift({
            kind: "allow_always",
            name: "Yes, and bypass permissions",
            optionId: "bypassPermissions",
          });
        }
+        // Filter against the session's currently-advertised modes so we never
+        // present options the active model can't honor (e.g. `auto` on Haiku).
+        // `bypassPermissions` is already covered by `availableModes` via
+        // `buildAvailableModes`/`ALLOW_BYPASS`. The `plan` option is a
+        // "keep planning" reject path; it's always present in `availableModes`.
+        const options = optionsAll.filter((o) =>
+          session.modes.availableModes.some((m) => m.id === o.optionId),
+        );

        const response = await this.client.requestPermission({
          options,
@@ -1432,27 +1541,30 @@ export class ClaudeAcpAgent implements Agent {
        if (signal.aborted || response.outcome?.outcome === "cancelled") {
          throw new Error("Tool use aborted");
        }
+        const selectedMode =
+          response.outcome?.outcome === "selected" ? response.outcome.optionId : undefined;
+        const selectedModeWasOffered = options.some((option) => option.optionId === selectedMode);
        if (
-          response.outcome?.outcome === "selected" &&
-          (response.outcome.optionId === "default" ||
-            response.outcome.optionId === "acceptEdits" ||
-            response.outcome.optionId === "auto" ||
-            response.outcome.optionId === "bypassPermissions")
+          selectedModeWasOffered &&
+          (selectedMode === "default" ||
+            selectedMode === "acceptEdits" ||
+            selectedMode === "auto" ||
+            selectedMode === "bypassPermissions")
        ) {
          await this.client.sessionUpdate({
            sessionId,
            update: {
              sessionUpdate: "current_mode_update",
-              currentModeId: response.outcome.optionId,
+              currentModeId: selectedMode,
            },
          });
-          await this.updateConfigOption(sessionId, "mode", response.outcome.optionId);
+          await this.updateConfigOption(sessionId, "mode", selectedMode);

          return {
            behavior: "allow",
            updatedInput: toolInput,
            updatedPermissions: suggestions ?? [
-              { type: "setMode", mode: response.outcome.optionId, destination: "session" },
+              { type: "setMode", mode: selectedMode, destination: "session" },
            ],
          };
        } else {
@@ -1550,7 +1662,7 @@ export class ClaudeAcpAgent implements Agent {
    const session = this.sessions[sessionId];
    if (!session) return;

-    await this.applyConfigOptionValue(session, configId, value);
+    await this.applyConfigOptionValue(sessionId, session, configId, value);

    await this.client.sessionUpdate({
      sessionId,
@@ -1562,13 +1674,16 @@ export class ClaudeAcpAgent implements Agent {
  }

  private async applyConfigOptionValue(
+    sessionId: string,
    session: Session,
    configId: string,
    value: string,
  ): Promise<void> {
-    // Sync top-level session state
    if (configId === "mode") {
      session.modes = { ...session.modes, currentModeId: value };
+      session.configOptions = session.configOptions.map((o) =>
+        o.id === configId && typeof o.currentValue === "string" ? { ...o, currentValue: value } : o,
+      );
    } else if (configId === "model") {
      if (session.models.currentModelId !== value) {
        // The cached context window was learned for the previous model; reset
@@ -1578,10 +1693,38 @@ export class ClaudeAcpAgent implements Agent {
        session.contextWindowSize = inferContextWindowFromModel(value) ?? DEFAULT_CONTEXT_WINDOW;
      }
      session.models = { ...session.models, currentModelId: value };
-    }

-    // Update configOptions
-    if (configId === "model") {
+      // Recompute availableModes for the new model and clamp the current
+      // mode if the SDK no longer offers it (today: "auto" on Haiku).
+      // `ModelInfo.supportsAutoMode` is the canonical SDK signal.
+      const newModelInfo = session.modelInfos.find((m) => m.value === value);
+      const newAvailableModes = buildAvailableModes(newModelInfo);
+      // Capture BEFORE mutating session.modes so the log message reflects
+      // the invalidated mode rather than "default".
+      const previousModeId = session.modes.currentModeId;
+      let modeDowngraded = false;
+      if (!newAvailableModes.some((m) => m.id === previousModeId)) {
+        session.modes = {
+          availableModes: newAvailableModes,
+          currentModeId: "default",
+        };
+        try {
+          await session.query.setPermissionMode("default");
+        } catch (err) {
+          // Failing the entire model switch over a bookkeeping sync error is
+          // worse UX than logging and continuing; the user explicitly asked
+          // to change models. The next setPermissionMode from the user will
+          // either succeed or surface a fresh error.
+          this.logger.error(
+            `Failed to sync permissionMode to "default" after model switch invalidated "${previousModeId}":`,
+            err,
+          );
+        }
+        modeDowngraded = true;
+      } else {
+        session.modes = { ...session.modes, availableModes: newAvailableModes };
+      }
+
      // Rebuild config options since effort levels depend on the selected model
      const effortOpt = session.configOptions.find((o) => o.id === "effort");
      const currentEffort =
@@ -1602,6 +1745,22 @@ export class ClaudeAcpAgent implements Agent {
          effortLevel: newEffort as Settings["effortLevel"],
        });
      }
+
+      // Emit current_mode_update only after session.modes AND
+      // session.configOptions have been fully reconciled. This way, a failure
+      // in the configOptions/effort rebuild above can't leave the client with
+      // a clamped currentModeId but stale configOptions, and the notification
+      // still precedes the caller's config_option_update so order-sensitive
+      // clients update currentModeId before re-rendering the option list.
+      if (modeDowngraded) {
+        await this.client.sessionUpdate({
+          sessionId,
+          update: {
+            sessionUpdate: "current_mode_update",
+            currentModeId: "default",
+          },
+        });
+      }
    } else {
      session.configOptions = session.configOptions.map((o) =>
        o.id === configId && typeof o.currentValue === "string" ? { ...o, currentValue: value } : o,
@@ -1618,6 +1777,7 @@ export class ClaudeAcpAgent implements Agent {
    sessionId: string;
    cwd: string;
    mcpServers?: NewSessionRequest["mcpServers"];
+    additionalDirectories?: NewSessionRequest["additionalDirectories"];
    _meta?: NewSessionRequest["_meta"];
  }): Promise<NewSessionResponse> {
    const existingSession = this.sessions[params.sessionId];
@@ -1642,6 +1802,7 @@ export class ClaudeAcpAgent implements Agent {
      {
        cwd: params.cwd,
        mcpServers: params.mcpServers ?? [],
+        additionalDirectories: params.additionalDirectories,
        _meta: params._meta,
      },
      {
@@ -1691,7 +1852,7 @@ export class ClaudeAcpAgent implements Agent {
              ? Object.fromEntries(server.headers.map((e) => [e.name, e.value]))
              : undefined,
          };
-        } else {
+        } else if (!("type" in server)) {
          // Stdio type MCP server (with or without explicit type field)
          mcpServers[server.name] = {
            type: "stdio",
@@ -1755,6 +1916,11 @@ export class ClaudeAcpAgent implements Agent {

    const abortController = userProvidedOptions?.abortController || new AbortController();

+    // Per-session task state. Created here (rather than in the session record
+    // below) so the TaskCreated/TaskCompleted hook callbacks can close over
+    // the same Map that the streaming message handler will read from.
+    const taskState: TaskState = new Map();
+
    const options: Options = {
      systemPrompt,
      settingSources: ["user", "project", "local"],
@@ -1774,7 +1940,7 @@ export class ClaudeAcpAgent implements Agent {
      env: {
        ...process.env,
        ...userProvidedOptions?.env,
-        ...createEnvForGateway(this.gatewayAuthMeta),
+        ...createEnvForGateway(this.gatewayAuthRequest),
        // Opt-in to session state events like when the agent is idle
        CLAUDE_CODE_EMIT_SESSION_STATE_EVENTS: "1",
      },
@@ -1815,14 +1981,58 @@ export class ClaudeAcpAgent implements Agent {
            ],
          },
        ],
+        TaskCreated: [
+          ...(userProvidedOptions?.hooks?.TaskCreated || []),
+          {
+            hooks: [
+              createTaskHook({
+                taskState,
+                onChange: async () => {
+                  await this.client.sessionUpdate({
+                    sessionId,
+                    update: {
+                      sessionUpdate: "plan",
+                      entries: taskStateToPlanEntries(taskState),
+                    },
+                  });
+                },
+              }),
+            ],
+          },
+        ],
+        TaskCompleted: [
+          ...(userProvidedOptions?.hooks?.TaskCompleted || []),
+          {
+            hooks: [
+              createTaskHook({
+                taskState,
+                onChange: async () => {
+                  await this.client.sessionUpdate({
+                    sessionId,
+                    update: {
+                      sessionUpdate: "plan",
+                      entries: taskStateToPlanEntries(taskState),
+                    },
+                  });
+                },
+              }),
+            ],
+          },
+        ],
      },
      ...creationOpts,
      abortController,
    };

+    // Prefer the official ACP `additionalDirectories` field. Fall back to the
+    // legacy `_meta.additionalRoots` extension for clients that haven't been
+    // updated yet. Either source is merged with directories supplied via
+    // `_meta.claudeCode.options.additionalDirectories` (SDK pass-through).
+    const acpAdditionalDirectories =
+      params.additionalDirectories ?? sessionMeta?.additionalRoots ?? [];
    options.additionalDirectories = [
      ...(userProvidedOptions?.additionalDirectories ?? []),
-      ...(sessionMeta?.additionalRoots ?? []),
+      ...acpAdditionalDirectories,
    ];

    if (creationOpts?.resume === undefined || creationOpts?.forkSession) {
@@ -1858,7 +2068,7 @@ export class ClaudeAcpAgent implements Agent {
    if (
      shouldHideClaudeAuth() &&
      initializationResult.account.subscriptionType &&
-      !this.gatewayAuthMeta
+      !this.gatewayAuthRequest
    ) {
      throw RequestError.authRequired(
        undefined,
@@ -1866,58 +2076,62 @@ export class ClaudeAcpAgent implements Agent {
      );
    }

-    const models = await getAvailableModels(
-      q,
-      initializationResult.models,
-      settingsManager,
-      this.logger,
-    );
+    // Apply user's `availableModels` allowlist from settings.json before any
+    // downstream model handling. The SDK only enforces this allowlist in its
+    // own UI, not in `initializationResult.models`, so we filter here to keep
+    // configOptions, the current-model resolver, and the stored modelInfos
+    // consistent with what the user configured.
+    const settingsAvailableModels = settingsManager.getSettings().availableModels;
+    const allowedModels = Array.isArray(settingsAvailableModels)
+      ? applyAvailableModelsAllowlist(initializationResult.models, settingsAvailableModels)
+      : initializationResult.models;

-    const availableModes = [
-      {
-        id: "auto",
-        name: "Auto",
-        description: "Use a model classifier to approve/deny permission prompts",
-      },
-      {
-        id: "default",
-        name: "Default",
-        description: "Standard behavior, prompts for dangerous operations",
-      },
-      {
-        id: "acceptEdits",
-        name: "Accept Edits",
-        description: "Auto-accept file edit operations",
-      },
-      {
-        id: "plan",
-        name: "Plan Mode",
-        description: "Planning mode, no actual tool execution",
-      },
-      {
-        id: "dontAsk",
-        name: "Don't Ask",
-        description: "Don't prompt for permissions, deny if not pre-approved",
-      },
-    ];
-    // Only works in non-root mode
-    if (ALLOW_BYPASS) {
-      availableModes.push({
-        id: "bypassPermissions",
-        name: "Bypass Permissions",
-        description: "Bypass all permission checks",
-      });
+    const models = await getAvailableModels(q, allowedModels, settingsManager, this.logger);
+
+    // Gate `auto` (and future model-specific modes) on the resolved model's
+    // `ModelInfo`. See `buildAvailableModes` for the canonical SDK signal.
+    const currentModelInfo = allowedModels.find((m) => m.value === models.currentModelId);
+    const availableModes = buildAvailableModes(currentModelInfo);
+
+    // Clamp `permissionMode` if the resolved session does not offer it. The
+    // common case is `permissions.defaultMode: "auto"` resolving to a model
+    // that does not support auto mode (e.g. Haiku); without this clamp the
+    // SDK would later throw `"auto mode unavailable for this model"` from
+    // `setPermissionMode`. Keep `permissionMode` as the resolved user intent
+    // (matches what was passed into `options.permissionMode` above) and use
+    // `effectiveMode` for the post-clamp value the session actually runs in.
+    let effectiveMode: PermissionMode = permissionMode;
+    if (!availableModes.some((m) => m.id === effectiveMode)) {
+      if (effectiveMode === "auto") {
+        this.logger.error(
+          `permissions.defaultMode "auto" is not available for model ` +
+            `"${models.currentModelId}"; falling back to "default".`,
+        );
+      } else {
+        this.logger.error(
+          `permissions.defaultMode "${effectiveMode}" is not available in ` +
+            `this session; falling back to "default".`,
+        );
+      }
+      effectiveMode = "default";
+      // Sync the SDK so it doesn't keep "auto" cached internally. Wrapped in
+      // try/catch since failing here would abort session creation entirely.
+      try {
+        await q.setPermissionMode("default");
+      } catch (err) {
+        this.logger.error("Failed to sync clamped permissionMode to SDK:", err);
+      }
    }

    const modes = {
-      currentModeId: permissionMode,
+      currentModeId: effectiveMode,
      availableModes,
    };

    const configOptions = buildConfigOptions(
      modes,
      models,
-      initializationResult.models,
+      allowedModels,
      settingsManager.getSettings().effortLevel,
    );

@@ -1944,7 +2158,7 @@ export class ClaudeAcpAgent implements Agent {
      },
      modes,
      models,
-      modelInfos: initializationResult.models,
+      modelInfos: allowedModels,
      configOptions,
      promptRunning: false,
      pendingMessages: new Map(),
@@ -1953,6 +2167,7 @@ export class ClaudeAcpAgent implements Agent {
      emitRawSDKMessages: sessionMeta?.claudeCode?.emitRawSDKMessages ?? false,
      contextWindowSize:
        inferContextWindowFromModel(models.currentModelId) ?? DEFAULT_CONTEXT_WINDOW,
+      taskState,
    };

    return {
@@ -1966,12 +2181,15 @@ export class ClaudeAcpAgent implements Agent {

 function shouldEmitRawMessage(
  config: boolean | SDKMessageFilter[],
-  message: { type: string; subtype?: string },
+  message: { type: string; subtype?: string; origin?: SDKMessageOrigin },
 ): boolean {
  if (config === true) return true;
  if (config === false) return false;
  return config.some(
-    (f) => f.type === message.type && (f.subtype === undefined || f.subtype === message.subtype),
+    (f) =>
+      f.type === message.type &&
+      (f.subtype === undefined || f.subtype === message.subtype) &&
+      (f.origin === undefined || f.origin === message.origin?.kind),
  );
 }

@@ -2040,19 +2258,81 @@ function snapshotFromUsage(usage: {
  };
 }

-function createEnvForGateway(gatewayMeta?: GatewayAuthMeta) {
-  if (!gatewayMeta) {
+function createEnvForGateway(request?: GatewayAuthRequest) {
+  if (!request?._meta) {
    return {};
  }
+  const customHeaders = Object.entries(request._meta.gateway.headers)
+    .map(([key, value]) => `${key}: ${value}`)
+    .join("\n");
+
+  if (request.methodId === "gateway-bedrock") {
+    return {
+      CLAUDE_CODE_USE_BEDROCK: "1",
+      AWS_BEARER_TOKEN_BEDROCK: " ", // Must be non-empty to bypass pass configuration check
+      ANTHROPIC_BEDROCK_BASE_URL: request._meta.gateway.baseUrl,
+      ANTHROPIC_CUSTOM_HEADERS: customHeaders,
+    };
+  }
  return {
-    ANTHROPIC_BASE_URL: gatewayMeta.gateway.baseUrl,
-    ANTHROPIC_CUSTOM_HEADERS: Object.entries(gatewayMeta.gateway.headers)
-      .map(([key, value]) => `${key}: ${value}`)
-      .join("\n"),
+    ANTHROPIC_BASE_URL: request._meta.gateway.baseUrl,
+    ANTHROPIC_CUSTOM_HEADERS: customHeaders,
    ANTHROPIC_AUTH_TOKEN: "", // Must be specified to bypass claude login requirement
  };
 }

+/**
+ * Build the list of permission modes the agent will advertise for the given
+ * model. `auto` is gated by `ModelInfo.supportsAutoMode === true`, which is
+ * the SDK's model-level availability signal. `undefined`/`false` both exclude
+ * `auto`. `bypassPermissions` is still gated by `ALLOW_BYPASS`.
+ */
+function buildAvailableModes(modelInfo: ModelInfo | undefined): SessionModeState["availableModes"] {
+  const modes: SessionModeState["availableModes"] = [];
+
+  // Only advertise "auto" when the SDK reports the model supports it.
+  if (modelInfo?.supportsAutoMode === true) {
+    modes.push({
+      id: "auto",
+      name: "Auto",
+      description: "Use a model classifier to approve/deny permission prompts",
+    });
+  }
+
+  modes.push(
+    {
+      id: "default",
+      name: "Default",
+      description: "Standard behavior, prompts for dangerous operations",
+    },
+    {
+      id: "acceptEdits",
+      name: "Accept Edits",
+      description: "Auto-accept file edit operations",
+    },
+    {
+      id: "plan",
+      name: "Plan Mode",
+      description: "Planning mode, no actual tool execution",
+    },
+    {
+      id: "dontAsk",
+      name: "Don't Ask",
+      description: "Don't prompt for permissions, deny if not pre-approved",
+    },
+  );
+
+  if (ALLOW_BYPASS) {
+    modes.push({
+      id: "bypassPermissions",
+      name: "Bypass Permissions",
+      description: "Bypass all permission checks",
+    });
+  }
+
+  return modes;
+}
+
 function buildConfigOptions(
  modes: SessionModeState,
  models: SessionModelState,
@@ -2218,6 +2498,52 @@ function resolveSettingsModel(
  return resolveModelPreference(models, settingsModel);
 }

+/**
+ * Restrict the SDK's model list to the user's `availableModels` allowlist
+ * (already merged-and-deduped across settings sources by `SettingsManager`).
+ * The user's exact entries become the model IDs surfaced via configOptions
+ * and passed to `setModel`, which prevents Claude Code from silently
+ * substituting a date-pinned variant (e.g. `haiku` →
+ * `claude-haiku-4-5-20251001`) that the user may not have access to.
+ *
+ * Display info and capability flags are copied from the closest SDK match so
+ * the UI still renders sensible names and effort levels.
+ *
+ * Semantics from https://code.claude.com/docs/en/model-config#restrict-model-selection:
+ * - `undefined` is handled by the caller (no allowlist applied).
+ * - The Default option is unaffected by `availableModels` — it always remains
+ *   available, even when the allowlist is `[]`.
+ */
+function applyAvailableModelsAllowlist(sdkModels: ModelInfo[], allowlist: string[]): ModelInfo[] {
+  // Default is always preserved per the docs. Synthesize one if the SDK
+  // didn't surface it so downstream code (e.g. `getAvailableModels` picking
+  // `models[0]` as a fallback) still has something to work with.
+  const defaultModel = sdkModels.find((m) => m.value === "default") ?? {
+    value: "default",
+    displayName: "Default",
+    description: "",
+  };
+  const result: ModelInfo[] = [defaultModel];
+  const seen = new Set<string>([defaultModel.value]);
+
+  const sdkModelsWithoutDefault = sdkModels.filter((m) => m.value !== "default");
+
+  for (const entry of allowlist) {
+    const trimmed = entry.trim();
+    if (!trimmed || seen.has(trimmed)) continue;
+
+    const sdkMatch = resolveModelPreference(sdkModelsWithoutDefault, trimmed);
+    if (sdkMatch) {
+      result.push({ ...sdkMatch, value: trimmed });
+    } else {
+      result.push({ value: trimmed, displayName: trimmed, description: "" });
+    }
+    seen.add(trimmed);
+  }
+
+  return result;
+}
+
 async function getAvailableModels(
  query: Query,
  models: ModelInfo[],
@@ -2401,8 +2727,10 @@ export function toAcpNotifications(
    clientCapabilities?: ClientCapabilities;
    parentToolUseId?: string | null;
    cwd?: string;
+    taskState?: TaskState;
  },
 ): SessionNotification[] {
+  const taskState = options?.taskState ?? new Map();
  const registerHooks = options?.registerHooks !== false;
  const supportsTerminalOutput = options?.clientCapabilities?._meta?.["terminal_output"] === true;
  if (typeof content === "string") {
@@ -2476,6 +2804,15 @@ export function toAcpNotifications(
              entries: planEntries(chunk.input as { todos: ClaudePlanEntry[] }),
            };
          }
+        } else if (
+          chunk.name === "TaskCreate" ||
+          chunk.name === "TaskUpdate" ||
+          chunk.name === "TaskList" ||
+          chunk.name === "TaskGet"
+        ) {
+          // Task* tool_use is suppressed; the plan update is emitted at
+          // tool_result time once we have the task ID (for TaskCreate) and
+          // confirmation that the change took effect.
        } else {
          // Only register hooks on first encounter to avoid double-firing
          if (registerHooks && !alreadyCached) {
@@ -2483,8 +2820,18 @@ export function toAcpNotifications(
              onPostToolUseHook: async (toolUseId, toolInput, toolResponse) => {
                const toolUse = toolUseCache[toolUseId];
                if (toolUse) {
+                  // Both `Edit` and `Write` produce a structuredPatch in their
+                  // PostToolUse tool_response. For Edit the diff replaces the
+                  // optimistic content built at tool_use time. For Write the
+                  // optimistic content (built from `input.content` alone with
+                  // `oldText: null`) shows "creation" semantics regardless of
+                  // whether the file existed; the structuredPatch from the
+                  // hook lets us emit the real diff for `type: "update"`. The
+                  // helper returns `{}` if the response shape isn't usable.
                  const editDiff =
-                    toolUse.name === "Edit" ? toolUpdateFromEditToolResponse(toolResponse) : {};
+                    toolUse.name === "Edit" || toolUse.name === "Write"
+                      ? toolUpdateFromDiffToolResponse(toolResponse)
+                      : {};
                  const update: SessionNotification["update"] = {
                    _meta: {
                      claudeCode: {
@@ -2570,7 +2917,36 @@ export function toAcpNotifications(
          break;
        }

-        if (toolUse.name !== "TodoWrite") {
+        if (
+          toolUse.name === "TaskCreate" ||
+          toolUse.name === "TaskUpdate" ||
+          toolUse.name === "TaskList" ||
+          toolUse.name === "TaskGet"
+        ) {
+          // Headless/SDK sessions emit Task* tools instead of TodoWrite.
+          // TaskCreate / TaskUpdate mutate the accumulated task list; TaskList
+          // and TaskGet are read-only so we just suppress their tool_call /
+          // tool_result events. The plan update is emitted as a snapshot of
+          // the accumulated state, mirroring the legacy TodoWrite behavior.
+          const isError = "is_error" in chunk && chunk.is_error;
+          if (!isError) {
+            if (toolUse.name === "TaskCreate") {
+              applyTaskCreate(
+                taskState,
+                toolUse.input as Parameters<typeof applyTaskCreate>[1],
+                parseTaskCreateOutput(chunk.content),
+              );
+            } else if (toolUse.name === "TaskUpdate") {
+              applyTaskUpdate(taskState, toolUse.input as Parameters<typeof applyTaskUpdate>[1]);
+            }
+          }
+          if (!isError && (toolUse.name === "TaskCreate" || toolUse.name === "TaskUpdate")) {
+            update = {
+              sessionUpdate: "plan",
+              entries: taskStateToPlanEntries(taskState),
+            };
+          }
+        } else if (toolUse.name !== "TodoWrite") {
          const { _meta: toolMeta, ...toolUpdate } = toolUpdateFromToolResult(
            chunk,
            toolUseCache[chunk.tool_use_id],
@@ -2657,6 +3033,7 @@ export function streamEventToAcpNotifications(
  options?: {
    clientCapabilities?: ClientCapabilities;
    cwd?: string;
+    taskState?: TaskState;
  },
 ): SessionNotification[] {
  const event = message.event;
@@ -2673,6 +3050,7 @@ export function streamEventToAcpNotifications(
          clientCapabilities: options?.clientCapabilities,
          parentToolUseId: message.parent_tool_use_id,
          cwd: options?.cwd,
+          taskState: options?.taskState,
        },
      );
    case "content_block_delta":
@@ -2687,6 +3065,7 @@ export function streamEventToAcpNotifications(
          clientCapabilities: options?.clientCapabilities,
          parentToolUseId: message.parent_tool_use_id,
          cwd: options?.cwd,
+          taskState: options?.taskState,
        },
      );
    // No content
--- a/src/index.ts
+++ b/src/index.ts
@@ -1,7 +1,6 @@
 #!/usr/bin/env node

-// Load managed settings and apply environment variables
-import { loadManagedSettings, applyEnvironmentSettings } from "./utils.js";
+import { resolveSettings } from "@anthropic-ai/claude-agent-sdk";
 import { claudeCliPath, runAcp } from "./acp-agent.js";

 if (process.argv.includes("--cli")) {
@@ -35,9 +34,13 @@ if (process.argv.includes("--cli")) {
    process.exit(1);
  });
 } else {
-  const managedSettings = loadManagedSettings();
-  if (managedSettings) {
-    applyEnvironmentSettings(managedSettings);
+  // Apply env vars from the managed-policy tier before any SDK call so the
+  // SDK subprocess inherits them. Going through resolveSettings (vs. a raw
+  // read of managed-settings.json) also picks up MDM sources on macOS and
+  // HKLM/HKCU on Windows.
+  const policy = await resolveSettings({ settingSources: [] });
+  for (const [key, value] of Object.entries(policy.effective.env ?? {})) {
+    process.env[key] = value;
  }

  // stdout is used to send messages to the client
--- a/src/lib.ts
+++ b/src/lib.ts
@@ -10,25 +10,14 @@ export {
  type NewSessionMeta,
  type SDKMessageFilter,
 } from "./acp-agent.js";
-export {
-  loadManagedSettings,
-  applyEnvironmentSettings,
-  nodeToWebReadable,
-  nodeToWebWritable,
-  Pushable,
-  unreachable,
-} from "./utils.js";
+export { nodeToWebReadable, nodeToWebWritable, Pushable, unreachable } from "./utils.js";
 export {
  toolInfoFromToolUse,
  toDisplayPath,
  planEntries,
  toolUpdateFromToolResult,
 } from "./tools.js";
-export {
-  SettingsManager,
-  type ClaudeCodeSettings,
-  type SettingsManagerOptions,
-} from "./settings.js";
+export { SettingsManager, type SettingsManagerOptions } from "./settings.js";

 // Export types
 export type { ClaudePlanEntry } from "./tools.js";
--- a/src/settings.ts
+++ b/src/settings.ts
@@ -1,5 +1,12 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
+// resolveSettings and filterEscalatingDefaultMode are marked @alpha in the
+// SDK; API may shift in a future release.
+import {
+  filterEscalatingDefaultMode,
+  resolveSettings,
+  type Settings,
+} from "@anthropic-ai/claude-agent-sdk";
 import { CLAUDE_CONFIG_DIR } from "./acp-agent.js";

 /**
@@ -14,51 +21,10 @@ import { CLAUDE_CONFIG_DIR } from "./acp-agent.js";
 * Docs: https://code.claude.com/docs/en/iam#tool-specific-permission-rules
 */

-export interface PermissionSettings {
-  defaultMode?: string;
-}
-
-export interface ClaudeCodeSettings {
-  permissions?: PermissionSettings;
-  env?: Record<string, string>;
-  model?: string;
-  effortLevel?: string;
-}
-
-/**
- * Reads and parses a JSON settings file, returning an empty object if not found or invalid.
- * Silently ignores missing files (ENOENT) but logs warnings for other errors
- * (malformed JSON, permission errors, etc.) to aid debugging.
- */
-async function loadSettingsFile(
-  filePath: string | null,
-  logger?: { error: (...args: any[]) => void },
-): Promise<ClaudeCodeSettings> {
-  if (!filePath) {
-    return {};
-  }
-
-  try {
-    const content = await fs.promises.readFile(filePath, "utf-8");
-    return JSON.parse(content) as ClaudeCodeSettings;
-  } catch (error) {
-    if (error instanceof Error && "code" in error && error.code === "ENOENT") {
-      return {};
-    }
-    logger?.error(`Failed to load settings from ${filePath}:`, error);
-    return {};
-  }
-}
-
-/**
- * Gets the enterprise settings path based on the current platform
- */
-export function getManagedSettingsPath(): string {
+function getManagedSettingsPath(): string {
  switch (process.platform) {
    case "darwin":
      return "/Library/Application Support/ClaudeCode/managed-settings.json";
-    case "linux":
-      return "/etc/claude-code/managed-settings.json";
    case "win32":
      return "C:\\Program Files\\ClaudeCode\\managed-settings.json";
    default:
@@ -72,23 +38,17 @@ export interface SettingsManagerOptions {
 }

 /**
- * Manages Claude Code settings from multiple sources with proper precedence.
+ * Manages Claude Code settings using the SDK's `resolveSettings` merge engine
+ * so the values we see match what `query()` would observe.
 *
- * Settings are loaded from (in order of increasing precedence):
- * 1. User settings (~/.claude/settings.json)
- * 2. Project settings (<cwd>/.claude/settings.json)
- * 3. Local project settings (<cwd>/.claude/settings.local.json)
- * 4. Enterprise managed settings (platform-specific path)
- *
- * The manager watches all settings files for changes and automatically reloads.
+ * Watches the user/project/local/managed settings files for changes and
+ * re-resolves through the SDK on update. Escalating `permissions.defaultMode`
+ * values from repo-committed sources are filtered out via
+ * `filterEscalatingDefaultMode`, matching the CLI's trust policy.
 */
 export class SettingsManager {
  private cwd: string;
-  private userSettings: ClaudeCodeSettings = {};
-  private projectSettings: ClaudeCodeSettings = {};
-  private localSettings: ClaudeCodeSettings = {};
-  private enterpriseSettings: ClaudeCodeSettings = {};
-  private mergedSettings: ClaudeCodeSettings = {};
+  private effective: Settings = {};
  private watchers: fs.FSWatcher[] = [];
  private onChange?: () => void;
  private logger: { log: (...args: any[]) => void; error: (...args: any[]) => void };
@@ -126,98 +86,37 @@ export class SettingsManager {
  }

  /**
-   * Returns the path to the user settings file
+   * Paths the SDK reads when resolving settings for this cwd. Watching the
+   * containing directories means we pick up file creation as well as edits.
   */
-  private getUserSettingsPath(): string {
-    return path.join(CLAUDE_CONFIG_DIR, "settings.json");
+  private getWatchedPaths(): string[] {
+    return [
+      path.join(CLAUDE_CONFIG_DIR, "settings.json"),
+      path.join(this.cwd, ".claude", "settings.json"),
+      path.join(this.cwd, ".claude", "settings.local.json"),
+      getManagedSettingsPath(),
+    ];
  }

  /**
-   * Returns the path to the project settings file
-   */
-  private getProjectSettingsPath(): string {
-    return path.join(this.cwd, ".claude", "settings.json");
-  }
-
-  /**
-   * Returns the path to the local project settings file
-   */
-  private getLocalSettingsPath(): string {
-    return path.join(this.cwd, ".claude", "settings.local.json");
-  }
-
-  /**
-   * Loads settings from all sources
+   * Resolves the effective settings via the SDK and applies the CLI's trust
+   * filter for escalating `permissions.defaultMode` values.
   */
  private async loadAllSettings(): Promise<void> {
-    const [userSettings, projectSettings, localSettings, enterpriseSettings] = await Promise.all([
-      loadSettingsFile(this.getUserSettingsPath(), this.logger),
-      loadSettingsFile(this.getProjectSettingsPath(), this.logger),
-      loadSettingsFile(this.getLocalSettingsPath(), this.logger),
-      loadSettingsFile(getManagedSettingsPath(), this.logger),
-    ]);
-
-    this.userSettings = userSettings;
-    this.projectSettings = projectSettings;
-    this.localSettings = localSettings;
-    this.enterpriseSettings = enterpriseSettings;
-
-    this.mergeSettings();
-  }
-
-  /**
-   * Merges all settings sources with proper precedence.
-   * For permissions, rules from all sources are combined.
-   * Deny rules always take precedence during permission checks.
-   */
-  private mergeSettings(): void {
-    const allSettings = [
-      this.userSettings,
-      this.projectSettings,
-      this.localSettings,
-      this.enterpriseSettings,
-    ];
-
-    const merged: ClaudeCodeSettings = {};
-
-    for (const settings of allSettings) {
-      if (settings.env) {
-        merged.env = { ...merged.env, ...settings.env };
-      }
-
-      if (settings.model) {
-        merged.model = settings.model;
-      }
-
-      if (settings.effortLevel !== undefined) {
-        merged.effortLevel = settings.effortLevel;
-      }
-
-      if (settings.permissions?.defaultMode !== undefined) {
-        merged.permissions = {
-          ...merged.permissions,
-          defaultMode: settings.permissions.defaultMode,
-        };
-      }
+    try {
+      const resolved = await resolveSettings({ cwd: this.cwd });
+      this.effective = filterEscalatingDefaultMode(resolved);
+    } catch (error) {
+      this.logger.error("Failed to resolve settings:", error);
+      this.effective = {};
    }
-
-    this.mergedSettings = merged;
  }

  /**
   * Sets up file watchers for all settings files
   */
  private setupWatchers(): void {
-    const paths = [
-      this.getUserSettingsPath(),
-      this.getProjectSettingsPath(),
-      this.getLocalSettingsPath(),
-      getManagedSettingsPath(),
-    ];
-
-    for (const filePath of paths) {
-      if (!filePath) continue;
-
+    for (const filePath of this.getWatchedPaths()) {
      try {
        const dir = path.dirname(filePath);
        const filename = path.basename(filePath);
@@ -268,8 +167,8 @@ export class SettingsManager {
  /**
   * Returns the current merged settings
   */
-  getSettings(): ClaudeCodeSettings {
-    return this.mergedSettings;
+  getSettings(): Settings {
+    return this.effective;
  }

  /**
--- a/src/tests/acp-agent-settings.test.ts
+++ b/src/tests/acp-agent-settings.test.ts
@@ -39,7 +39,7 @@ describe("ClaudeAcpAgent settings", () => {
        initializationResult: async () => ({
          models: [
            {
-              value: "claude-sonnet-4-5",
+              value: "claude-sonnet-4-6",
              displayName: "Claude Sonnet 4.5",
              description: "Default",
            },
@@ -126,6 +126,31 @@ describe("ClaudeAcpAgent settings", () => {
    expect(response.modes.currentModeId).toBe("acceptEdits");
  });

+  it("drops escalating defaultMode when it comes from project-tier settings", async () => {
+    // bypassPermissions in .claude/settings.json (a repo-committed tier) is
+    // filtered by the SDK's trust policy and clamps to 'default'.
+    const projectDir = path.join(tempDir, "project");
+    await fs.promises.mkdir(path.join(projectDir, ".claude"), { recursive: true });
+    await fs.promises.writeFile(
+      path.join(projectDir, ".claude", "settings.json"),
+      JSON.stringify({ permissions: { defaultMode: "bypassPermissions" } }),
+    );
+
+    const { getCapturedOptions } = mockQuery();
+
+    const { ClaudeAcpAgent } = await import("../acp-agent.js");
+    const agent: ClaudeAcpAgentType = new ClaudeAcpAgent(createMockClient());
+
+    const response = await (agent as any).createSession({
+      cwd: projectDir,
+      mcpServers: [],
+      _meta: { disableBuiltInTools: true },
+    });
+
+    expect(getCapturedOptions().permissionMode).toBe("default");
+    expect(response.modes.currentModeId).toBe("default");
+  });
+
  it("defaults to 'default' when no permissions.defaultMode is set", async () => {
    const projectDir = path.join(tempDir, "project");
    await fs.promises.mkdir(projectDir, { recursive: true });
@@ -197,8 +222,362 @@ describe("ClaudeAcpAgent settings", () => {
    });

    // Bad model is ignored at the usage site; falls back to the first SDK model.
-    expect(setModelSpy).toHaveBeenCalledWith("claude-sonnet-4-5");
-    expect(response.models.currentModelId).toBe("claude-sonnet-4-5");
+    expect(setModelSpy).toHaveBeenCalledWith("claude-sonnet-4-6");
+    expect(response.models.currentModelId).toBe("claude-sonnet-4-6");
+  });
+
+  describe("auto mode availability per model", () => {
+    function mockQueryWithModels(models: any[]): {
+      getCapturedOptions: () => any;
+      setModelSpy: ReturnType<typeof vi.fn>;
+      setPermissionModeSpy: ReturnType<typeof vi.fn>;
+    } {
+      let capturedOptions: any;
+      const setModelSpy = vi.fn();
+      const setPermissionModeSpy = vi.fn();
+      querySpy.mockImplementation(({ options }: any) => {
+        capturedOptions = options;
+        return {
+          initializationResult: async () => ({ models }),
+          setModel: setModelSpy,
+          setPermissionMode: setPermissionModeSpy,
+          supportedCommands: async () => [],
+        } as any;
+      });
+      return {
+        getCapturedOptions: () => capturedOptions,
+        setModelSpy,
+        setPermissionModeSpy,
+      };
+    }
+
+    it("omits `auto` from availableModes when the resolved model lacks supportsAutoMode", async () => {
+      const projectDir = path.join(tempDir, "project");
+      await fs.promises.mkdir(projectDir, { recursive: true });
+
+      mockQueryWithModels([
+        {
+          value: "claude-haiku-4-5",
+          displayName: "Claude Haiku",
+          description: "Fast",
+          // supportsAutoMode intentionally omitted
+        },
+      ]);
+
+      const { ClaudeAcpAgent } = await import("../acp-agent.js");
+      const agent: ClaudeAcpAgentType = new ClaudeAcpAgent(createMockClient());
+
+      const response = await (agent as any).createSession({
+        cwd: projectDir,
+        mcpServers: [],
+        _meta: { disableBuiltInTools: true },
+      });
+
+      const modeIds: string[] = response.modes.availableModes.map((m: any) => m.id);
+      expect(modeIds).not.toContain("auto");
+      expect(modeIds).toEqual(
+        expect.arrayContaining(["default", "acceptEdits", "plan", "dontAsk"]),
+      );
+    });
+
+    it("includes `auto` when the resolved model has supportsAutoMode: true", async () => {
+      const projectDir = path.join(tempDir, "project");
+      await fs.promises.mkdir(projectDir, { recursive: true });
+
+      mockQueryWithModels([
+        {
+          value: "claude-opus-4-5",
+          displayName: "Claude Opus",
+          description: "Most capable",
+          supportsAutoMode: true,
+        },
+      ]);
+
+      const { ClaudeAcpAgent } = await import("../acp-agent.js");
+      const agent: ClaudeAcpAgentType = new ClaudeAcpAgent(createMockClient());
+
+      const response = await (agent as any).createSession({
+        cwd: projectDir,
+        mcpServers: [],
+        _meta: { disableBuiltInTools: true },
+      });
+
+      const modeIds: string[] = response.modes.availableModes.map((m: any) => m.id);
+      expect(modeIds).toContain("auto");
+    });
+
+    it("clamps permissions.defaultMode='auto' to 'default' on a model that lacks supportsAutoMode", async () => {
+      await fs.promises.writeFile(
+        path.join(tempDir, "settings.json"),
+        JSON.stringify({ permissions: { defaultMode: "auto" } }),
+      );
+
+      const projectDir = path.join(tempDir, "project");
+      await fs.promises.mkdir(projectDir, { recursive: true });
+
+      const { getCapturedOptions, setPermissionModeSpy } = mockQueryWithModels([
+        {
+          value: "claude-haiku-4-5",
+          displayName: "Claude Haiku",
+          description: "Fast",
+          // supportsAutoMode intentionally omitted
+        },
+      ]);
+
+      const errorSpy = vi.spyOn(console, "error").mockImplementation(() => {});
+
+      try {
+        const { ClaudeAcpAgent } = await import("../acp-agent.js");
+        const agent: ClaudeAcpAgentType = new ClaudeAcpAgent(createMockClient());
+
+        const response = await (agent as any).createSession({
+          cwd: projectDir,
+          mcpServers: [],
+          _meta: { disableBuiltInTools: true },
+        });
+
+        // Options.permissionMode is built before init resolves, so it still
+        // carries the user-typed value; the SDK was synced via
+        // setPermissionMode after we discovered the model can't honor it.
+        expect(getCapturedOptions().permissionMode).toBe("auto");
+        expect(setPermissionModeSpy).toHaveBeenCalledWith("default");
+        expect(response.modes.currentModeId).toBe("default");
+        expect(response.modes.availableModes.map((m: any) => m.id)).not.toContain("auto");
+
+        // A descriptive warning was logged so operators see the clamp.
+        const messages = errorSpy.mock.calls.map((c) => c.join(" "));
+        expect(messages.some((m) => m.includes("auto") && m.includes("claude-haiku-4-5"))).toBe(
+          true,
+        );
+      } finally {
+        errorSpy.mockRestore();
+      }
+    });
+
+    it("does not clamp permissions.defaultMode='auto' on a model that supports auto", async () => {
+      await fs.promises.writeFile(
+        path.join(tempDir, "settings.json"),
+        JSON.stringify({ permissions: { defaultMode: "auto" } }),
+      );
+
+      const projectDir = path.join(tempDir, "project");
+      await fs.promises.mkdir(projectDir, { recursive: true });
+
+      const { getCapturedOptions, setPermissionModeSpy } = mockQueryWithModels([
+        {
+          value: "claude-opus-4-5",
+          displayName: "Claude Opus",
+          description: "Most capable",
+          supportsAutoMode: true,
+        },
+      ]);
+
+      const { ClaudeAcpAgent } = await import("../acp-agent.js");
+      const agent: ClaudeAcpAgentType = new ClaudeAcpAgent(createMockClient());
+
+      const response = await (agent as any).createSession({
+        cwd: projectDir,
+        mcpServers: [],
+        _meta: { disableBuiltInTools: true },
+      });
+
+      expect(getCapturedOptions().permissionMode).toBe("auto");
+      expect(setPermissionModeSpy).not.toHaveBeenCalled();
+      expect(response.modes.currentModeId).toBe("auto");
+    });
+  });
+
+  describe("availableModels allowlist from settings", () => {
+    function mockQueryWithModels(models: any[]): {
+      setModelSpy: ReturnType<typeof vi.fn>;
+    } {
+      const setModelSpy = vi.fn();
+      querySpy.mockImplementation(() => {
+        return {
+          initializationResult: async () => ({ models }),
+          setModel: setModelSpy,
+          supportedCommands: async () => [],
+        } as any;
+      });
+      return { setModelSpy };
+    }
+
+    it("restricts configOptions to the user's allowlist using their exact IDs", async () => {
+      // Reproduces the scenario from
+      // https://github.com/agentclientprotocol/claude-agent-acp/issues/620:
+      // user lists `claude-haiku-4-5` (no date pin) in availableModels, but
+      // the SDK still surfaces its `haiku` alias which resolves to a
+      // date-pinned variant the user doesn't have access to.
+      await fs.promises.writeFile(
+        path.join(tempDir, "settings.json"),
+        JSON.stringify({
+          availableModels: [
+            "claude-sonnet-4-6[1m]",
+            "claude-opus-4-6[1m]",
+            "claude-haiku-4-5",
+            "claude-opus-4-7[1m]",
+          ],
+        }),
+      );
+
+      const projectDir = path.join(tempDir, "project");
+      await fs.promises.mkdir(projectDir, { recursive: true });
+
+      mockQueryWithModels([
+        { value: "default", displayName: "Default", description: "Default model" },
+        {
+          value: "sonnet[1m]",
+          displayName: "Sonnet (1M context)",
+          description: "Sonnet 4.6 long context",
+        },
+        {
+          value: "opus[1m]",
+          displayName: "Opus (1M context)",
+          description: "Opus 1M context",
+        },
+        { value: "haiku", displayName: "Haiku", description: "Fast" },
+      ]);
+
+      const { ClaudeAcpAgent } = await import("../acp-agent.js");
+      const agent: ClaudeAcpAgentType = new ClaudeAcpAgent(createMockClient());
+
+      const response = await (agent as any).createSession({
+        cwd: projectDir,
+        mcpServers: [],
+        _meta: { disableBuiltInTools: true },
+      });
+
+      const modelOption = response.configOptions.find((o: any) => o.id === "model");
+      expect(modelOption.options.map((o: any) => o.value)).toEqual([
+        "default",
+        "claude-sonnet-4-6[1m]",
+        "claude-opus-4-6[1m]",
+        "claude-haiku-4-5",
+        "claude-opus-4-7[1m]",
+      ]);
+    });
+
+    it("unions availableModels across user and project settings", async () => {
+      // https://code.claude.com/docs/en/model-config#merge-behavior
+      await fs.promises.writeFile(
+        path.join(tempDir, "settings.json"),
+        JSON.stringify({ availableModels: ["claude-haiku-4-5"] }),
+      );
+
+      const projectDir = path.join(tempDir, "project");
+      await fs.promises.mkdir(path.join(projectDir, ".claude"), { recursive: true });
+      await fs.promises.writeFile(
+        path.join(projectDir, ".claude", "settings.json"),
+        JSON.stringify({
+          availableModels: ["claude-haiku-4-5", "claude-opus-4-7[1m]"],
+        }),
+      );
+
+      mockQueryWithModels([
+        { value: "default", displayName: "Default", description: "Default model" },
+        { value: "haiku", displayName: "Haiku", description: "Fast" },
+      ]);
+
+      const { ClaudeAcpAgent } = await import("../acp-agent.js");
+      const agent: ClaudeAcpAgentType = new ClaudeAcpAgent(createMockClient());
+
+      const response = await (agent as any).createSession({
+        cwd: projectDir,
+        mcpServers: [],
+        _meta: { disableBuiltInTools: true },
+      });
+
+      const modelOption = response.configOptions.find((o: any) => o.id === "model");
+      // User and project entries are unioned and deduplicated.
+      expect(modelOption.options.map((o: any) => o.value)).toEqual([
+        "default",
+        "claude-haiku-4-5",
+        "claude-opus-4-7[1m]",
+      ]);
+    });
+
+    it("returns only the default entry when availableModels is an empty array", async () => {
+      await fs.promises.writeFile(
+        path.join(tempDir, "settings.json"),
+        JSON.stringify({ availableModels: [] }),
+      );
+
+      const projectDir = path.join(tempDir, "project");
+      await fs.promises.mkdir(projectDir, { recursive: true });
+
+      mockQueryWithModels([
+        { value: "default", displayName: "Default", description: "Default model" },
+        { value: "haiku", displayName: "Haiku", description: "Fast" },
+      ]);
+
+      const { ClaudeAcpAgent } = await import("../acp-agent.js");
+      const agent: ClaudeAcpAgentType = new ClaudeAcpAgent(createMockClient());
+
+      const response = await (agent as any).createSession({
+        cwd: projectDir,
+        mcpServers: [],
+        _meta: { disableBuiltInTools: true },
+      });
+
+      const modelOption = response.configOptions.find((o: any) => o.id === "model");
+      expect(modelOption.options.map((o: any) => o.value)).toEqual(["default"]);
+    });
+
+    it("does not filter when availableModels is absent from settings", async () => {
+      const projectDir = path.join(tempDir, "project");
+      await fs.promises.mkdir(projectDir, { recursive: true });
+
+      mockQueryWithModels([
+        { value: "default", displayName: "Default", description: "Default model" },
+        { value: "haiku", displayName: "Haiku", description: "Fast" },
+      ]);
+
+      const { ClaudeAcpAgent } = await import("../acp-agent.js");
+      const agent: ClaudeAcpAgentType = new ClaudeAcpAgent(createMockClient());
+
+      const response = await (agent as any).createSession({
+        cwd: projectDir,
+        mcpServers: [],
+        _meta: { disableBuiltInTools: true },
+      });
+
+      const modelOption = response.configOptions.find((o: any) => o.id === "model");
+      expect(modelOption.options.map((o: any) => o.value)).toEqual(["default", "haiku"]);
+    });
+
+    it("passes the user's exact ID to setModel when it matches an SDK alias", async () => {
+      // Without the allowlist, the SDK would resolve `haiku` to a
+      // date-pinned variant. Forcing setModel to receive `claude-haiku-4-5`
+      // is exactly what the issue's workaround
+      // (`ANTHROPIC_DEFAULT_HAIKU_MODEL`) achieves manually.
+      await fs.promises.writeFile(
+        path.join(tempDir, "settings.json"),
+        JSON.stringify({
+          availableModels: ["claude-haiku-4-5"],
+          model: "claude-haiku-4-5",
+        }),
+      );
+
+      const projectDir = path.join(tempDir, "project");
+      await fs.promises.mkdir(projectDir, { recursive: true });
+
+      const { setModelSpy } = mockQueryWithModels([
+        { value: "default", displayName: "Default", description: "Default model" },
+        { value: "haiku", displayName: "Haiku", description: "Fast" },
+      ]);
+
+      const { ClaudeAcpAgent } = await import("../acp-agent.js");
+      const agent: ClaudeAcpAgentType = new ClaudeAcpAgent(createMockClient());
+
+      const response = await (agent as any).createSession({
+        cwd: projectDir,
+        mcpServers: [],
+        _meta: { disableBuiltInTools: true },
+      });
+
+      expect(setModelSpy).toHaveBeenCalledWith("claude-haiku-4-5");
+      expect(response.models.currentModelId).toBe("claude-haiku-4-5");
+    });
  });

  it("resolves model aliases like opus[1m] to the correct model", async () => {
--- a/src/tests/acp-agent.test.ts
+++ b/src/tests/acp-agent.test.ts
@@ -1,4 +1,4 @@
-import { describe, it, expect, beforeAll, afterAll, vi } from "vitest";
+import { describe, it, expect, beforeAll, beforeEach, afterAll, vi } from "vitest";
 import { spawn, spawnSync } from "child_process";
 import {
  Agent,
@@ -22,7 +22,7 @@ import {
  toolInfoFromToolUse,
  toDisplayPath,
  toolUpdateFromToolResult,
-  toolUpdateFromEditToolResponse,
+  toolUpdateFromDiffToolResponse,
 } from "../tools.js";
 import {
  toAcpNotifications,
@@ -32,10 +32,19 @@ import {
  ClaudeAcpAgent,
  claudeCliPath,
  describeAlwaysAllow,
+  type SDKMessageFilter,
 } from "../acp-agent.js";
 import { Pushable } from "../utils.js";
-import { query, SDKAssistantMessage } from "@anthropic-ai/claude-agent-sdk";
+import { deleteSession, query, SDKAssistantMessage } from "@anthropic-ai/claude-agent-sdk";
 import { randomUUID } from "crypto";
+
+vi.mock("@anthropic-ai/claude-agent-sdk", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("@anthropic-ai/claude-agent-sdk")>();
+  return {
+    ...actual,
+    deleteSession: vi.fn(),
+  };
+});
 import type {
  BetaToolResultBlockParam,
  BetaToolSearchToolResultBlockParam,
@@ -638,6 +647,8 @@ describe("tool conversions", () => {
        ],
        stop_reason: null,
        stop_sequence: null,
+        stop_details: null,
+        diagnostics: null,
        usage: {
          input_tokens: 6,
          cache_creation_input_tokens: 326,
@@ -998,17 +1009,17 @@ describe("toDisplayPath", () => {
  });
 });

-describe("toolUpdateFromEditToolResponse", () => {
+describe("toolUpdateFromDiffToolResponse", () => {
  it("should return empty for non-object input", () => {
-    expect(toolUpdateFromEditToolResponse(null)).toEqual({});
-    expect(toolUpdateFromEditToolResponse(undefined)).toEqual({});
-    expect(toolUpdateFromEditToolResponse("string")).toEqual({});
+    expect(toolUpdateFromDiffToolResponse(null)).toEqual({});
+    expect(toolUpdateFromDiffToolResponse(undefined)).toEqual({});
+    expect(toolUpdateFromDiffToolResponse("string")).toEqual({});
  });

  it("should return empty when filePath or structuredPatch is missing", () => {
-    expect(toolUpdateFromEditToolResponse({})).toEqual({});
-    expect(toolUpdateFromEditToolResponse({ filePath: "/foo.ts" })).toEqual({});
-    expect(toolUpdateFromEditToolResponse({ structuredPatch: [] })).toEqual({});
+    expect(toolUpdateFromDiffToolResponse({})).toEqual({});
+    expect(toolUpdateFromDiffToolResponse({ filePath: "/foo.ts" })).toEqual({});
+    expect(toolUpdateFromDiffToolResponse({ structuredPatch: [] })).toEqual({});
  });

  it("should build diff content from a single-hunk structuredPatch", () => {
@@ -1025,7 +1036,7 @@ describe("toolUpdateFromEditToolResponse", () => {
      ],
    };

-    expect(toolUpdateFromEditToolResponse(toolResponse)).toEqual({
+    expect(toolUpdateFromDiffToolResponse(toolResponse)).toEqual({
      content: [
        {
          type: "diff",
@@ -1059,7 +1070,7 @@ describe("toolUpdateFromEditToolResponse", () => {
      ],
    };

-    expect(toolUpdateFromEditToolResponse(toolResponse)).toEqual({
+    expect(toolUpdateFromDiffToolResponse(toolResponse)).toEqual({
      content: [
        {
          type: "diff",
@@ -1095,7 +1106,7 @@ describe("toolUpdateFromEditToolResponse", () => {
      ],
    };

-    expect(toolUpdateFromEditToolResponse(toolResponse)).toEqual({
+    expect(toolUpdateFromDiffToolResponse(toolResponse)).toEqual({
      content: [
        {
          type: "diff",
@@ -1114,7 +1125,7 @@ describe("toolUpdateFromEditToolResponse", () => {
      structuredPatch: [],
    };

-    expect(toolUpdateFromEditToolResponse(toolResponse)).toEqual({});
+    expect(toolUpdateFromDiffToolResponse(toolResponse)).toEqual({});
  });
 });

@@ -1532,6 +1543,7 @@ describe("stop reason propagation", () => {
      abortController: new AbortController(),
      emitRawSDKMessages: false,
      contextWindowSize: 200000,
+      taskState: new Map(),
    };
  }

@@ -1675,6 +1687,7 @@ describe("stop reason propagation", () => {
      nextPendingOrder: 0,
      emitRawSDKMessages: false,
      contextWindowSize: 200000,
+      taskState: new Map(),
    };

    const response = await agent.prompt({
@@ -1833,6 +1846,7 @@ describe("session/close", () => {
      abortController: new AbortController(),
      emitRawSDKMessages: false,
      contextWindowSize: 200000,
+      taskState: new Map(),
    };
    return agent.sessions[sessionId]!;
  }
@@ -1882,6 +1896,94 @@ describe("session/close", () => {
  });
 });

+describe("session/delete", () => {
+  function createMockAgent() {
+    const mockClient = {
+      sessionUpdate: async () => {},
+    } as unknown as AgentSideConnection;
+    return new ClaudeAcpAgent(mockClient, { log: () => {}, error: () => {} });
+  }
+
+  function injectSession(agent: ClaudeAcpAgent, sessionId: string) {
+    function* empty() {}
+    const gen = Object.assign(empty(), { interrupt: vi.fn(), close: vi.fn() });
+    agent.sessions[sessionId] = {
+      query: gen as any,
+      input: new Pushable(),
+      cancelled: false,
+      cwd: "/test",
+      sessionFingerprint: JSON.stringify({ cwd: "/test", mcpServers: [] }),
+      modes: { currentModeId: "default", availableModes: [] },
+      models: { currentModelId: "default", availableModels: [] },
+      modelInfos: [],
+      settingsManager: { dispose: vi.fn() } as any,
+      accumulatedUsage: {
+        inputTokens: 0,
+        outputTokens: 0,
+        cachedReadTokens: 0,
+        cachedWriteTokens: 0,
+      },
+      configOptions: [],
+      promptRunning: false,
+      pendingMessages: new Map(),
+      nextPendingOrder: 0,
+      abortController: new AbortController(),
+      emitRawSDKMessages: false,
+      contextWindowSize: 200000,
+      taskState: new Map(),
+    };
+    return agent.sessions[sessionId]!;
+  }
+
+  beforeEach(() => {
+    vi.mocked(deleteSession).mockReset();
+    vi.mocked(deleteSession).mockResolvedValue(undefined);
+  });
+
+  it("tears down the active session and deletes it from disk", async () => {
+    const agent = createMockAgent();
+    const session = injectSession(agent, "session-1");
+
+    const result = await agent.unstable_deleteSession({ sessionId: "session-1" });
+
+    expect(result).toEqual({});
+    expect(agent.sessions["session-1"]).toBeUndefined();
+    expect(session.query.interrupt).toHaveBeenCalled();
+    expect(session.settingsManager.dispose).toHaveBeenCalled();
+    expect(session.abortController.signal.aborted).toBe(true);
+    expect(deleteSession).toHaveBeenCalledWith("session-1");
+  });
+
+  it("deletes a session from disk that is not currently active", async () => {
+    const agent = createMockAgent();
+
+    const result = await agent.unstable_deleteSession({ sessionId: "not-active" });
+
+    expect(result).toEqual({});
+    expect(deleteSession).toHaveBeenCalledWith("not-active");
+  });
+
+  it("propagates errors from the SDK delete call", async () => {
+    const agent = createMockAgent();
+    vi.mocked(deleteSession).mockRejectedValueOnce(new Error("Session not found on disk"));
+
+    await expect(agent.unstable_deleteSession({ sessionId: "missing" })).rejects.toThrow(
+      "Session not found on disk",
+    );
+  });
+
+  it("does not affect other sessions when deleting one", async () => {
+    const agent = createMockAgent();
+    injectSession(agent, "session-a");
+    injectSession(agent, "session-b");
+
+    await agent.unstable_deleteSession({ sessionId: "session-a" });
+
+    expect(agent.sessions["session-a"]).toBeUndefined();
+    expect(agent.sessions["session-b"]).toBeDefined();
+  });
+});
+
 describe("getOrCreateSession param change detection", () => {
  function createMockAgent() {
    const mockClient = {
@@ -1929,6 +2031,7 @@ describe("getOrCreateSession param change detection", () => {
      abortController: new AbortController(),
      emitRawSDKMessages: false,
      contextWindowSize: 200000,
+      taskState: new Map(),
    };
    return agent.sessions[sessionId]!;
  }
@@ -2163,6 +2266,7 @@ describe("usage_update computation", () => {
      abortController: new AbortController(),
      emitRawSDKMessages: false,
      contextWindowSize: 200000,
+      taskState: new Map(),
    };
  }

@@ -2502,7 +2606,12 @@ describe("usage_update computation", () => {
    const session = agent.sessions["test-session"];
    expect(session.contextWindowSize).toBe(200000);

-    await (agent as any).applyConfigOptionValue(session, "model", "claude-opus-4-6-1m");
+    await (agent as any).applyConfigOptionValue(
+      "test-session",
+      session,
+      "model",
+      "claude-opus-4-6-1m",
+    );
    expect(session.contextWindowSize).toBe(1000000);

    await agent.prompt({ sessionId: "test-session", prompt: [{ type: "text", text: "test" }] });
@@ -2587,7 +2696,12 @@ describe("usage_update computation", () => {
    session.models = { ...session.models, currentModelId: "claude-opus-4-6-1m" };

    // User flips the selector to a 200k model.
-    await (agent as any).applyConfigOptionValue(session, "model", "claude-sonnet-4-6");
+    await (agent as any).applyConfigOptionValue(
+      "test-session",
+      session,
+      "model",
+      "claude-sonnet-4-6",
+    );

    await agent.prompt({ sessionId: "test-session", prompt: [{ type: "text", text: "test" }] });

@@ -3011,7 +3125,7 @@ describe("emitRawSDKMessages", () => {
  function injectSession(
    agent: ClaudeAcpAgent,
    messages: any[],
-    emitRawSDKMessages: boolean | { type: string; subtype?: string }[],
+    emitRawSDKMessages: boolean | SDKMessageFilter[],
  ) {
    const input = new Pushable<any>();
    async function* messageGenerator() {
@@ -3052,6 +3166,7 @@ describe("emitRawSDKMessages", () => {
      abortController: new AbortController(),
      emitRawSDKMessages,
      contextWindowSize: 200000,
+      taskState: new Map(),
    };
  }

@@ -3188,4 +3303,216 @@ describe("emitRawSDKMessages", () => {
    expect(sdkMessages[0].params.message.subtype).toBe("compact_boundary");
    expect(sdkMessages[1].params.message.type).toBe("result");
  });
+
+  it("filter by origin kind only emits matching results", async () => {
+    const { agent, extNotifications } = createMockAgentWithExtNotification();
+    injectSession(
+      agent,
+      [
+        { ...createResultMessage(), origin: { kind: "channel", server: "acp" } },
+        { ...createResultMessage(), origin: { kind: "task-notification" } },
+        { type: "system", subtype: "session_state_changed", state: "idle" },
+      ],
+      [{ type: "result", origin: "task-notification" }],
+    );
+
+    await agent.prompt({ sessionId: "test-session", prompt: [{ type: "text", text: "test" }] });
+
+    const sdkMessages = extNotifications.filter((n) => n.method === "_claude/sdkMessage");
+    expect(sdkMessages).toHaveLength(1);
+    expect(sdkMessages[0].params.message.origin.kind).toBe("task-notification");
+  });
+
+  it("filter without origin matches results regardless of origin", async () => {
+    const { agent, extNotifications } = createMockAgentWithExtNotification();
+    injectSession(
+      agent,
+      [
+        { ...createResultMessage(), origin: { kind: "channel", server: "acp" } },
+        { ...createResultMessage(), origin: { kind: "task-notification" } },
+        { type: "system", subtype: "session_state_changed", state: "idle" },
+      ],
+      [{ type: "result" }],
+    );
+
+    await agent.prompt({ sessionId: "test-session", prompt: [{ type: "text", text: "test" }] });
+
+    const sdkMessages = extNotifications.filter((n) => n.method === "_claude/sdkMessage");
+    expect(sdkMessages).toHaveLength(2);
+  });
+});
+
+describe("result origin handling", () => {
+  function createMockAgentWithCapture() {
+    const updates: any[] = [];
+    const mockClient = {
+      sessionUpdate: async (notification: any) => {
+        updates.push(notification);
+      },
+    } as unknown as AgentSideConnection;
+    const agent = new ClaudeAcpAgent(mockClient, { log: () => {}, error: () => {} });
+    return { agent, updates };
+  }
+
+  function injectSession(agent: ClaudeAcpAgent, messages: any[]) {
+    const input = new Pushable<any>();
+    async function* messageGenerator() {
+      const iter = input[Symbol.asyncIterator]();
+      const { value: userMessage, done } = await iter.next();
+      if (!done && userMessage) {
+        yield {
+          type: "user",
+          message: userMessage.message,
+          parent_tool_use_id: null,
+          uuid: userMessage.uuid,
+          session_id: "test-session",
+          isReplay: true,
+        };
+      }
+      yield* messages;
+    }
+    agent.sessions["test-session"] = {
+      query: messageGenerator() as any,
+      input,
+      cancelled: false,
+      cwd: "/test",
+      sessionFingerprint: JSON.stringify({ cwd: "/test", mcpServers: [] }),
+      modes: { currentModeId: "default", availableModes: [] },
+      models: { currentModelId: "default", availableModels: [] },
+      modelInfos: [],
+      settingsManager: { dispose: vi.fn() } as any,
+      accumulatedUsage: {
+        inputTokens: 0,
+        outputTokens: 0,
+        cachedReadTokens: 0,
+        cachedWriteTokens: 0,
+      },
+      configOptions: [],
+      promptRunning: false,
+      pendingMessages: new Map(),
+      nextPendingOrder: 0,
+      abortController: new AbortController(),
+      emitRawSDKMessages: false,
+      contextWindowSize: 200000,
+      taskState: new Map(),
+    };
+  }
+
+  function createAssistantMessage() {
+    return {
+      type: "assistant" as const,
+      parent_tool_use_id: null,
+      uuid: randomUUID(),
+      session_id: "test-session",
+      message: {
+        model: "claude-sonnet-4-6",
+        content: [{ type: "text", text: "hello" }],
+        usage: {
+          input_tokens: 10,
+          output_tokens: 5,
+          cache_read_input_tokens: 0,
+          cache_creation_input_tokens: 0,
+        },
+      },
+    };
+  }
+
+  function createResult(overrides: Record<string, unknown> = {}) {
+    return {
+      type: "result" as const,
+      subtype: "success" as const,
+      stop_reason: "end_turn",
+      is_error: false,
+      result: "",
+      errors: [],
+      duration_ms: 0,
+      duration_api_ms: 0,
+      num_turns: 1,
+      total_cost_usd: 0.01,
+      usage: {
+        input_tokens: 10,
+        output_tokens: 5,
+        cache_read_input_tokens: 0,
+        cache_creation_input_tokens: 0,
+      },
+      modelUsage: {},
+      permission_denials: [],
+      uuid: randomUUID(),
+      session_id: "test-session",
+      ...overrides,
+    };
+  }
+
+  it("forwards origin in usage_update _meta", async () => {
+    const { agent, updates } = createMockAgentWithCapture();
+    injectSession(agent, [
+      createAssistantMessage(),
+      createResult({ origin: { kind: "channel", server: "acp" } }),
+      { type: "system", subtype: "session_state_changed", state: "idle" },
+    ]);
+
+    await agent.prompt({ sessionId: "test-session", prompt: [{ type: "text", text: "test" }] });
+
+    const usageUpdate = updates.find((u: any) => u.update?.sessionUpdate === "usage_update");
+    expect(usageUpdate).toBeDefined();
+    expect(usageUpdate.update._meta).toEqual({
+      "_claude/origin": { kind: "channel", server: "acp" },
+    });
+  });
+
+  it("omits _meta when origin is absent", async () => {
+    const { agent, updates } = createMockAgentWithCapture();
+    injectSession(agent, [
+      createAssistantMessage(),
+      createResult(),
+      { type: "system", subtype: "session_state_changed", state: "idle" },
+    ]);
+
+    await agent.prompt({ sessionId: "test-session", prompt: [{ type: "text", text: "test" }] });
+
+    const usageUpdate = updates.find((u: any) => u.update?.sessionUpdate === "usage_update");
+    expect(usageUpdate).toBeDefined();
+    expect(usageUpdate.update._meta).toBeUndefined();
+  });
+
+  it("task-notification result with max_tokens does not override the user-turn stopReason", async () => {
+    const { agent } = createMockAgentWithCapture();
+    injectSession(agent, [
+      createAssistantMessage(),
+      // User-turn result completes normally
+      createResult({ origin: { kind: "channel", server: "acp" } }),
+      // Task-notification followup hits max_tokens — must not bleed into the user's stopReason
+      createResult({
+        stop_reason: "max_tokens",
+        origin: { kind: "task-notification" },
+      }),
+      { type: "system", subtype: "session_state_changed", state: "idle" },
+    ]);
+
+    const response = await agent.prompt({
+      sessionId: "test-session",
+      prompt: [{ type: "text", text: "test" }],
+    });
+
+    expect(response.stopReason).toBe("end_turn");
+  });
+
+  it("user-prompted result with max_tokens still sets stopReason", async () => {
+    const { agent } = createMockAgentWithCapture();
+    injectSession(agent, [
+      createAssistantMessage(),
+      createResult({
+        stop_reason: "max_tokens",
+        origin: { kind: "channel", server: "acp" },
+      }),
+      { type: "system", subtype: "session_state_changed", state: "idle" },
+    ]);
+
+    const response = await agent.prompt({
+      sessionId: "test-session",
+      prompt: [{ type: "text", text: "test" }],
+    });
+
+    expect(response.stopReason).toBe("max_tokens");
+  });
 });
--- a/src/tests/additional-roots.test.ts
+++ b/src/tests/additional-roots.test.ts
@@ -15,9 +15,17 @@ vi.mock("@anthropic-ai/claude-agent-sdk", async () => ({
    capturedOptions = options;
    return {
      initializationResult: async () => ({
-        models: [{ value: "claude-sonnet-4-5", displayName: "Claude Sonnet", description: "Fast" }],
+        models: [
+          {
+            value: "claude-sonnet-4-6",
+            displayName: "Claude Sonnet",
+            description: "Fast",
+            supportsAutoMode: true,
+          },
+        ],
      }),
      setModel: async () => {},
+      setPermissionMode: async () => {},
      supportedCommands: async () => [],
      [Symbol.asyncIterator]: async function* () {},
    };
@@ -68,4 +76,33 @@ describe("additionalRoots", () => {
    });
    expect(capturedOptions!.additionalDirectories).toEqual(["/workspace/shared", "", root]);
  });
+
+  it("prefers the official ACP additionalDirectories field over _meta.additionalRoots", async () => {
+    await agent.newSession({
+      cwd: "/test",
+      mcpServers: [],
+      additionalDirectories: ["/from/official"],
+      _meta: { additionalRoots: ["/from/meta"] },
+    });
+    expect(capturedOptions!.additionalDirectories).toEqual(["/from/official"]);
+  });
+
+  it("merges official ACP additionalDirectories with claudeCode SDK additionalDirectories", async () => {
+    await agent.newSession({
+      cwd: "/test",
+      mcpServers: [],
+      additionalDirectories: ["/from/official"],
+      _meta: { claudeCode: { options: { additionalDirectories: ["/from/sdk"] } } },
+    });
+    expect(capturedOptions!.additionalDirectories).toEqual(["/from/sdk", "/from/official"]);
+  });
+
+  it("falls back to _meta.additionalRoots when the official field is omitted", async () => {
+    await agent.newSession({
+      cwd: "/test",
+      mcpServers: [],
+      _meta: { additionalRoots: ["/from/meta"] },
+    });
+    expect(capturedOptions!.additionalDirectories).toEqual(["/from/meta"]);
+  });
 });
--- a/src/tests/authorization.test.ts
+++ b/src/tests/authorization.test.ts
@@ -5,9 +5,12 @@ import { AgentSideConnection } from "@agentclientprotocol/sdk";
 const mockQuery = vi.hoisted(() =>
  vi.fn(() => ({
    initializationResult: vi.fn().mockResolvedValue({
-      models: [{ value: "id", displayName: "name", description: "description" }],
+      models: [
+        { value: "id", displayName: "name", description: "description", supportsAutoMode: true },
+      ],
    }),
    setModel: vi.fn(),
+    setPermissionMode: vi.fn(),
    supportedCommands: vi.fn().mockResolvedValue([]),
  })),
 );
@@ -50,6 +53,9 @@ describe("authorization", () => {
    expect(initializeResponse.authMethods).not.toContainEqual(
      expect.objectContaining({ id: "gateway" }),
    );
+    expect(initializeResponse.authMethods).not.toContainEqual(
+      expect.objectContaining({ id: "gateway-bedrock" }),
+    );
  });

  it("gateway auth offered when client advertises auth._meta.gateway capability", async () => {
@@ -62,11 +68,20 @@ describe("authorization", () => {
      } as any,
    });
    expect(initializeResponse.authMethods).toContainEqual(
-      expect.objectContaining({ id: "gateway" }),
+      expect.objectContaining({
+        id: "gateway",
+        _meta: { gateway: { protocol: "anthropic" } },
+      }),
+    );
+    expect(initializeResponse.authMethods).toContainEqual(
+      expect.objectContaining({
+        id: "gateway-bedrock",
+        _meta: { gateway: { protocol: "bedrock" } },
+      }),
    );
  });

-  it("uses gateway env after gateway auth", async () => {
+  it("uses gateway env after anthropic gateway auth", async () => {
    const [agent, mockQuery] = await createAgentMock();

    const initializeResponse = await agent.initialize({
@@ -112,6 +127,42 @@ describe("authorization", () => {
    );
  });

+  it("uses gateway env after gateway auth", async () => {
+    const [agent, mockQuery] = await createAgentMock();
+
+    await agent.initialize({
+      protocolVersion: 1,
+      clientCapabilities: {
+        auth: { terminal: true, _meta: { gateway: true } },
+      } as any,
+    });
+
+    await agent.authenticate({
+      methodId: "gateway-bedrock",
+      _meta: {
+        gateway: { baseUrl: "https://gateway.example", headers: { "custom-header": "test" } },
+      },
+    });
+
+    await agent.newSession({
+      cwd: "testRoot",
+      mcpServers: [],
+    });
+
+    expect(mockQuery).toHaveBeenCalledWith(
+      expect.objectContaining({
+        options: expect.objectContaining({
+          env: expect.objectContaining({
+            CLAUDE_CODE_USE_BEDROCK: "1",
+            AWS_BEARER_TOKEN_BEDROCK: " ",
+            ANTHROPIC_BEDROCK_BASE_URL: "https://gateway.example",
+            ANTHROPIC_CUSTOM_HEADERS: "custom-header: test",
+          }),
+        }),
+      }),
+    );
+  });
+
  it("hide claude authentication without terminal-auth", async () => {
    const [agent] = await createAgentMock();
    vi.stubGlobal("process", { ...process, argv: ["--hide-claude-auth"] });
--- a/src/tests/create-session-options.test.ts
+++ b/src/tests/create-session-options.test.ts
@@ -15,10 +15,16 @@ vi.mock("@anthropic-ai/claude-agent-sdk", async () => {
      return {
        initializationResult: async () => ({
          models: [
-            { value: "claude-sonnet-4-5", displayName: "Claude Sonnet", description: "Fast" },
+            {
+              value: "claude-sonnet-4-6",
+              displayName: "Claude Sonnet",
+              description: "Fast",
+              supportsAutoMode: true,
+            },
          ],
        }),
        setModel: async () => {},
+        setPermissionMode: async () => {},
        supportedCommands: async () => [],
        [Symbol.asyncIterator]: async function* () {},
      };
@@ -414,7 +420,7 @@ describe("createSession options merging", () => {
          claudeCode: {
            options: {
              settings: {
-                model: "claude-sonnet-4-5",
+                model: "claude-sonnet-4-6",
                modelOverrides: { "claude-opus-4-6": "meta-value" },
              },
            },
@@ -424,7 +430,7 @@ describe("createSession options merging", () => {

      // _meta settings take precedence; env var is ignored entirely
      expect(capturedOptions!.settings).toEqual({
-        model: "claude-sonnet-4-5",
+        model: "claude-sonnet-4-6",
        modelOverrides: { "claude-opus-4-6": "meta-value" },
      });
    });
--- a/src/tests/session-config-options.test.ts
+++ b/src/tests/session-config-options.test.ts
@@ -30,7 +30,7 @@ const MOCK_MODELS = {
  currentModelId: "claude-opus-4-5",
  availableModels: [
    { modelId: "claude-opus-4-5", name: "Claude Opus", description: "Most capable" },
-    { modelId: "claude-sonnet-4-5", name: "Claude Sonnet", description: "Balanced" },
+    { modelId: "claude-sonnet-4-6", name: "Claude Sonnet", description: "Balanced" },
  ],
 };

@@ -242,10 +242,10 @@ describe("session config options", () => {
      await agent.setSessionConfigOption({
        sessionId: SESSION_ID,
        configId: "model",
-        value: "claude-sonnet-4-5",
+        value: "claude-sonnet-4-6",
      });

-      expect(setModelSpy).toHaveBeenCalledWith("claude-sonnet-4-5");
+      expect(setModelSpy).toHaveBeenCalledWith("claude-sonnet-4-6");

      const configUpdate = sessionUpdates.find(
        (n) => n.update.sessionUpdate === "config_option_update",
@@ -273,7 +273,7 @@ describe("session config options", () => {
        value: "sonnet",
      });

-      expect(setModelSpy).toHaveBeenCalledWith("claude-sonnet-4-5");
+      expect(setModelSpy).toHaveBeenCalledWith("claude-sonnet-4-6");
    });

    it("resolves display name to model ID", async () => {
@@ -283,19 +283,19 @@ describe("session config options", () => {
        value: "Claude Sonnet",
      });

-      expect(setModelSpy).toHaveBeenCalledWith("claude-sonnet-4-5");
+      expect(setModelSpy).toHaveBeenCalledWith("claude-sonnet-4-6");
    });

    it("still works with exact model ID", async () => {
      const response = await agent.setSessionConfigOption({
        sessionId: SESSION_ID,
        configId: "model",
-        value: "claude-sonnet-4-5",
+        value: "claude-sonnet-4-6",
      });

-      expect(setModelSpy).toHaveBeenCalledWith("claude-sonnet-4-5");
+      expect(setModelSpy).toHaveBeenCalledWith("claude-sonnet-4-6");
      const modelOption = response.configOptions.find((o) => o.id === "model");
-      expect(modelOption?.currentValue).toBe("claude-sonnet-4-5");
+      expect(modelOption?.currentValue).toBe("claude-sonnet-4-6");
    });

    it("throws for completely invalid model value", async () => {
@@ -384,7 +384,7 @@ describe("session config options", () => {
    it("sends config_option_update when model is changed via setSessionModel", async () => {
      await agent.unstable_setSessionModel({
        sessionId: SESSION_ID,
-        modelId: "claude-sonnet-4-5",
+        modelId: "claude-sonnet-4-6",
      });

      const configUpdate = sessionUpdates.find(
@@ -394,7 +394,7 @@ describe("session config options", () => {
      expect(configUpdate?.update).toMatchObject({
        sessionUpdate: "config_option_update",
        configOptions: expect.arrayContaining([
-          expect.objectContaining({ id: "model", currentValue: "claude-sonnet-4-5" }),
+          expect.objectContaining({ id: "model", currentValue: "claude-sonnet-4-6" }),
        ]),
      });
    });
@@ -402,7 +402,7 @@ describe("session config options", () => {
    it("updates stored configOptions currentValue when model changes", async () => {
      await agent.unstable_setSessionModel({
        sessionId: SESSION_ID,
-        modelId: "claude-sonnet-4-5",
+        modelId: "claude-sonnet-4-6",
      });

      const session = (
@@ -411,7 +411,7 @@ describe("session config options", () => {
        }
      ).sessions[SESSION_ID];
      const modelOption = session.configOptions.find((o) => o.id === "model");
-      expect(modelOption?.currentValue).toBe("claude-sonnet-4-5");
+      expect(modelOption?.currentValue).toBe("claude-sonnet-4-6");
    });

    it("includes updated effort in config_option_update when model drops effort support", async () => {
@@ -425,7 +425,7 @@ describe("session config options", () => {
          supportedEffortLevels: ["low", "medium", "high"],
        },
        {
-          value: "claude-sonnet-4-5",
+          value: "claude-sonnet-4-6",
          displayName: "Claude Sonnet",
          description: "Balanced",
          supportsEffort: false,
@@ -434,7 +434,7 @@ describe("session config options", () => {

      await agent.unstable_setSessionModel({
        sessionId: SESSION_ID,
-        modelId: "claude-sonnet-4-5",
+        modelId: "claude-sonnet-4-6",
      });

      const configUpdate = sessionUpdates.find(
@@ -463,7 +463,7 @@ describe("session config options", () => {
          supportedEffortLevels: ["low", "medium", "high", "max"],
        },
        {
-          value: "claude-sonnet-4-5",
+          value: "claude-sonnet-4-6",
          displayName: "Claude Sonnet",
          description: "Balanced",
          supportsEffort: true,
@@ -473,7 +473,7 @@ describe("session config options", () => {

      await agent.unstable_setSessionModel({
        sessionId: SESSION_ID,
-        modelId: "claude-sonnet-4-5",
+        modelId: "claude-sonnet-4-6",
      });

      const configUpdate = sessionUpdates.find(
@@ -495,7 +495,7 @@ describe("session config options", () => {

      await agent.unstable_setSessionModel({
        sessionId: SESSION_ID,
-        modelId: "claude-sonnet-4-5",
+        modelId: "claude-sonnet-4-6",
      });

      const configUpdate = sessionUpdates.find(
@@ -532,7 +532,7 @@ describe("session config options", () => {
      await agent.setSessionConfigOption({
        sessionId: SESSION_ID,
        configId: "model",
-        value: "claude-sonnet-4-5",
+        value: "claude-sonnet-4-6",
      });

      const configUpdates = sessionUpdates.filter(
@@ -622,7 +622,7 @@ describe("session config options", () => {
          supportedEffortLevels: ["low", "medium", "high"],
        },
        {
-          value: "claude-sonnet-4-5",
+          value: "claude-sonnet-4-6",
          displayName: "Claude Sonnet",
          description: "Balanced",
          supportsEffort: false,
@@ -632,7 +632,7 @@ describe("session config options", () => {
      const response = await agent.setSessionConfigOption({
        sessionId: SESSION_ID,
        configId: "model",
-        value: "claude-sonnet-4-5",
+        value: "claude-sonnet-4-6",
      });

      const effortOption = response.configOptions.find((o) => o.id === "effort");
@@ -650,7 +650,7 @@ describe("session config options", () => {
          supportedEffortLevels: ["low", "medium", "high"],
        },
        {
-          value: "claude-sonnet-4-5",
+          value: "claude-sonnet-4-6",
          displayName: "Claude Sonnet",
          description: "Balanced",
          supportsEffort: false,
@@ -660,7 +660,7 @@ describe("session config options", () => {
      await agent.setSessionConfigOption({
        sessionId: SESSION_ID,
        configId: "model",
-        value: "claude-sonnet-4-5",
+        value: "claude-sonnet-4-6",
      });

      expect(applyFlagSettingsSpy).toHaveBeenCalledWith({ effortLevel: undefined });
@@ -669,7 +669,7 @@ describe("session config options", () => {
    it("adds effort option when switching to a model that supports effort", async () => {
      const session = (agent as unknown as { sessions: Record<string, any> }).sessions[SESSION_ID];
      // Start with sonnet (no effort) as current
-      session.models = { ...session.models, currentModelId: "claude-sonnet-4-5" };
+      session.models = { ...session.models, currentModelId: "claude-sonnet-4-6" };
      session.modelInfos = [
        {
          value: "claude-opus-4-5",
@@ -679,7 +679,7 @@ describe("session config options", () => {
          supportedEffortLevels: ["low", "medium", "high"],
        },
        {
-          value: "claude-sonnet-4-5",
+          value: "claude-sonnet-4-6",
          displayName: "Claude Sonnet",
          description: "Balanced",
          supportsEffort: false,
@@ -715,7 +715,7 @@ describe("session config options", () => {
          supportedEffortLevels: ["low", "medium", "high", "max"],
        },
        {
-          value: "claude-sonnet-4-5",
+          value: "claude-sonnet-4-6",
          displayName: "Claude Sonnet",
          description: "Balanced",
          supportsEffort: true,
@@ -726,7 +726,7 @@ describe("session config options", () => {
      const response = await agent.setSessionConfigOption({
        sessionId: SESSION_ID,
        configId: "model",
-        value: "claude-sonnet-4-5",
+        value: "claude-sonnet-4-6",
      });

      const effortOption = response.configOptions.find((o) => o.id === "effort");
@@ -749,7 +749,7 @@ describe("session config options", () => {
      const response = await agent.setSessionConfigOption({
        sessionId: SESSION_ID,
        configId: "model",
-        value: "claude-sonnet-4-5",
+        value: "claude-sonnet-4-6",
      });

      const effortOption = response.configOptions.find((o) => o.id === "effort");
@@ -778,10 +778,10 @@ describe("session config options", () => {
      await agent.setSessionConfigOption({
        sessionId: SESSION_ID,
        configId: "model",
-        value: "claude-sonnet-4-5",
+        value: "claude-sonnet-4-6",
      });

-      expect(setModelSpy).toHaveBeenCalledWith("claude-sonnet-4-5");
+      expect(setModelSpy).toHaveBeenCalledWith("claude-sonnet-4-6");
    });

    it("setSessionMode also syncs configOptions", async () => {
@@ -798,7 +798,7 @@ describe("session config options", () => {
    it("setSessionModel also syncs configOptions", async () => {
      await agent.unstable_setSessionModel({
        sessionId: SESSION_ID,
-        modelId: "claude-sonnet-4-5",
+        modelId: "claude-sonnet-4-6",
      });

      const session = (
@@ -807,8 +807,395 @@ describe("session config options", () => {
        }
      ).sessions[SESSION_ID];
      expect(session.configOptions.find((o) => o.id === "model")?.currentValue).toBe(
-        "claude-sonnet-4-5",
+        "claude-sonnet-4-6",
      );
    });
  });
+
+  describe("auto mode availability per model", () => {
+    /**
+     * Augment the session populated by `populateSession()` with a Haiku entry
+     * (no `supportsAutoMode`), Opus + Sonnet entries with `supportsAutoMode:
+     * true`, and seed `availableModes` so it currently includes `auto`. This
+     * exercises the per-model recomputation done by `applyConfigOptionValue`
+     * on a model switch.
+     */
+    function setupHaikuOpusSession(currentModeId: string = "default") {
+      const session = (agent as unknown as { sessions: Record<string, any> }).sessions[SESSION_ID];
+      session.modelInfos = [
+        {
+          value: "claude-opus-4-5",
+          displayName: "Claude Opus",
+          description: "Most capable",
+          supportsEffort: true,
+          supportedEffortLevels: ["low", "medium", "high"],
+          supportsAutoMode: true,
+        },
+        {
+          value: "claude-sonnet-4-6",
+          displayName: "Claude Sonnet",
+          description: "Balanced",
+          supportsEffort: true,
+          supportedEffortLevels: ["low", "medium", "high"],
+          supportsAutoMode: true,
+        },
+        {
+          value: "claude-haiku-4-5",
+          displayName: "Claude Haiku",
+          description: "Fast",
+          supportsEffort: true,
+          supportedEffortLevels: ["low", "medium", "high"],
+          // supportsAutoMode intentionally omitted
+        },
+      ];
+      session.models = {
+        currentModelId: "claude-opus-4-5",
+        availableModels: [
+          { modelId: "claude-opus-4-5", name: "Claude Opus", description: "Most capable" },
+          { modelId: "claude-sonnet-4-6", name: "Claude Sonnet", description: "Balanced" },
+          { modelId: "claude-haiku-4-5", name: "Claude Haiku", description: "Fast" },
+        ],
+      };
+      session.modes = {
+        currentModeId,
+        availableModes: [
+          {
+            id: "auto",
+            name: "Auto",
+            description: "Use a model classifier to approve/deny permission prompts",
+          },
+          {
+            id: "default",
+            name: "Default",
+            description: "Standard behavior, prompts for dangerous operations",
+          },
+          {
+            id: "acceptEdits",
+            name: "Accept Edits",
+            description: "Auto-accept file edit operations",
+          },
+          { id: "plan", name: "Plan Mode", description: "Planning mode" },
+          {
+            id: "dontAsk",
+            name: "Don't Ask",
+            description: "Don't prompt for permissions, deny if not pre-approved",
+          },
+        ],
+      };
+      // Reflect the seeded availableModes/availableModels in configOptions so
+      // the pre-state matches what `createSession` would have produced for
+      // Opus, and `setSessionConfigOption` validation can accept the seeded
+      // model ids (notably the new Haiku entry).
+      session.configOptions = session.configOptions.map((o: any) => {
+        if (o.id === "mode") {
+          return {
+            ...o,
+            currentValue: currentModeId,
+            options: session.modes.availableModes.map((m: any) => ({
+              value: m.id,
+              name: m.name,
+              description: m.description,
+            })),
+          };
+        }
+        if (o.id === "model") {
+          return {
+            ...o,
+            currentValue: session.models.currentModelId,
+            options: session.models.availableModels.map((m: any) => ({
+              value: m.modelId,
+              name: m.name,
+              description: m.description,
+            })),
+          };
+        }
+        return o;
+      });
+      return session;
+    }
+
+    beforeEach(() => {
+      populateSession();
+    });
+
+    it("drops `auto` from available modes when switching to Haiku", async () => {
+      setupHaikuOpusSession("default");
+
+      await agent.unstable_setSessionModel({
+        sessionId: SESSION_ID,
+        modelId: "claude-haiku-4-5",
+      });
+
+      const configUpdate = sessionUpdates.find(
+        (n) => n.update.sessionUpdate === "config_option_update",
+      );
+      expect(configUpdate).toBeDefined();
+      const modeOption = (configUpdate?.update as any).configOptions.find(
+        (o: any) => o.id === "mode",
+      );
+      expect(modeOption).toBeDefined();
+      const modeValues = modeOption.options.map((o: any) => o.value);
+      expect(modeValues).not.toContain("auto");
+      expect(modeValues).toEqual(
+        expect.arrayContaining(["default", "acceptEdits", "plan", "dontAsk"]),
+      );
+    });
+
+    it("clamps to `default` and emits current_mode_update when Opus(auto) → Haiku", async () => {
+      setupHaikuOpusSession("auto");
+
+      await agent.unstable_setSessionModel({
+        sessionId: SESSION_ID,
+        modelId: "claude-haiku-4-5",
+      });
+
+      // SDK was synced to "default".
+      expect(setPermissionModeSpy).toHaveBeenCalledWith("default");
+
+      // current_mode_update was emitted before config_option_update so a
+      // client applying notifications in order observes the mode change
+      // before re-rendering the config-option list.
+      const modeUpdateIdx = sessionUpdates.findIndex(
+        (n) => n.update.sessionUpdate === "current_mode_update",
+      );
+      const configUpdateIdx = sessionUpdates.findIndex(
+        (n) => n.update.sessionUpdate === "config_option_update",
+      );
+      expect(modeUpdateIdx).toBeGreaterThanOrEqual(0);
+      expect(configUpdateIdx).toBeGreaterThanOrEqual(0);
+      expect(modeUpdateIdx).toBeLessThan(configUpdateIdx);
+      expect((sessionUpdates[modeUpdateIdx].update as any).currentModeId).toBe("default");
+
+      // configOptions reflect the clamped mode.
+      const modeOption = (sessionUpdates[configUpdateIdx].update as any).configOptions.find(
+        (o: any) => o.id === "mode",
+      );
+      expect(modeOption.currentValue).toBe("default");
+    });
+
+    it("re-adds `auto` when switching from Haiku back to Opus", async () => {
+      const session = setupHaikuOpusSession("default");
+      // Pretend Haiku is the current model with no `auto`.
+      session.models.currentModelId = "claude-haiku-4-5";
+      session.modes.availableModes = session.modes.availableModes.filter(
+        (m: any) => m.id !== "auto",
+      );
+      const modeOpt = session.configOptions.find((o: any) => o.id === "mode");
+      modeOpt.options = session.modes.availableModes.map((m: any) => ({
+        value: m.id,
+        name: m.name,
+        description: m.description,
+      }));
+
+      await agent.unstable_setSessionModel({
+        sessionId: SESSION_ID,
+        modelId: "claude-opus-4-5",
+      });
+
+      const configUpdate = sessionUpdates.find(
+        (n) => n.update.sessionUpdate === "config_option_update",
+      );
+      expect(configUpdate).toBeDefined();
+      const modeOption = (configUpdate?.update as any).configOptions.find(
+        (o: any) => o.id === "mode",
+      );
+      const modeValues = modeOption.options.map((o: any) => o.value);
+      expect(modeValues).toContain("auto");
+
+      // The current mode ("default") is still valid on Opus, so no
+      // current_mode_update should have been emitted by the model switch.
+      const modeUpdates = sessionUpdates.filter(
+        (n) => n.update.sessionUpdate === "current_mode_update",
+      );
+      expect(modeUpdates).toHaveLength(0);
+    });
+
+    it("preserves the current mode when it remains valid after a model switch", async () => {
+      setupHaikuOpusSession("plan");
+
+      await agent.unstable_setSessionModel({
+        sessionId: SESSION_ID,
+        modelId: "claude-haiku-4-5",
+      });
+
+      // `plan` is in availableModes for both Opus and Haiku, so no clamp.
+      expect(setPermissionModeSpy).not.toHaveBeenCalledWith("default");
+
+      const modeUpdates = sessionUpdates.filter(
+        (n) => n.update.sessionUpdate === "current_mode_update",
+      );
+      expect(modeUpdates).toHaveLength(0);
+
+      const configUpdate = sessionUpdates.find(
+        (n) => n.update.sessionUpdate === "config_option_update",
+      );
+      const modeOption = (configUpdate?.update as any).configOptions.find(
+        (o: any) => o.id === "mode",
+      );
+      expect(modeOption.currentValue).toBe("plan");
+    });
+
+    it("clamps mode and emits current_mode_update via setSessionConfigOption(model)", async () => {
+      // Mirrors the unstable_setSessionModel(auto → Haiku) test, but goes
+      // through the request/response API. The `current_mode_update` side
+      // effect must still fire so clients learn about the clamp regardless of
+      // which entry point triggered the model switch.
+      setupHaikuOpusSession("auto");
+
+      const response = await agent.setSessionConfigOption({
+        sessionId: SESSION_ID,
+        configId: "model",
+        value: "claude-haiku-4-5",
+      });
+
+      expect(setPermissionModeSpy).toHaveBeenCalledWith("default");
+
+      const modeUpdates = sessionUpdates.filter(
+        (n) => n.update.sessionUpdate === "current_mode_update",
+      );
+      expect(modeUpdates).toHaveLength(1);
+      expect((modeUpdates[0].update as any).currentModeId).toBe("default");
+
+      // setSessionConfigOption is a request/response API: it returns the new
+      // configOptions in the response rather than emitting a
+      // config_option_update notification.
+      const configUpdates = sessionUpdates.filter(
+        (n) => n.update.sessionUpdate === "config_option_update",
+      );
+      expect(configUpdates).toHaveLength(0);
+
+      const modeOption = response.configOptions.find((o: any) => o.id === "mode");
+      expect(modeOption).toBeDefined();
+      expect((modeOption as any).currentValue).toBe("default");
+      expect((modeOption as any).options.map((o: any) => o.value)).not.toContain("auto");
+    });
+
+    it("rejects direct setSessionMode to `auto` when the active model does not offer it", async () => {
+      const session = setupHaikuOpusSession("default");
+      session.models.currentModelId = "claude-haiku-4-5";
+      session.modes.availableModes = session.modes.availableModes.filter(
+        (mode: any) => mode.id !== "auto",
+      );
+
+      await expect(agent.setSessionMode({ sessionId: SESSION_ID, modeId: "auto" })).rejects.toThrow(
+        "Mode auto is not available in this session",
+      );
+
+      expect(setPermissionModeSpy).not.toHaveBeenCalledWith("auto");
+      expect(sessionUpdates).toHaveLength(0);
+    });
+  });
+
+  describe("ExitPlanMode permission options filtered by availableModes", () => {
+    let capturedPermissionRequest: any;
+    let permissionResponse: any;
+
+    beforeEach(() => {
+      capturedPermissionRequest = null;
+      permissionResponse = { outcome: { outcome: "cancelled" } };
+      // Replace the default mock client with one that captures the
+      // requestPermission call so we can assert on the offered options.
+      (agent as any).client = {
+        sessionUpdate: async (notification: SessionNotification) => {
+          sessionUpdates.push(notification);
+        },
+        requestPermission: async (params: any) => {
+          capturedPermissionRequest = params;
+          return permissionResponse;
+        },
+        readTextFile: async () => ({ content: "" }),
+        writeTextFile: async () => ({}),
+      };
+      populateSession();
+    });
+
+    it("omits the `auto` option on a model without supportsAutoMode", async () => {
+      const session = (agent as unknown as { sessions: Record<string, any> }).sessions[SESSION_ID];
+      // Haiku-shaped session: availableModes does NOT include `auto`.
+      session.modes = {
+        currentModeId: "plan",
+        availableModes: [
+          { id: "default", name: "Default", description: "Standard" },
+          { id: "acceptEdits", name: "Accept Edits", description: "Auto-accept edits" },
+          { id: "plan", name: "Plan Mode", description: "Planning mode" },
+          { id: "dontAsk", name: "Don't Ask", description: "Deny if not pre-approved" },
+        ],
+      };
+
+      const canUseTool = (agent as any).canUseTool(SESSION_ID);
+      const signal = new AbortController().signal;
+      try {
+        await canUseTool(
+          "ExitPlanMode",
+          { plan: "do stuff" },
+          { signal, suggestions: undefined, toolUseID: "toolu_1" },
+        );
+      } catch {
+        // The mock client returns `cancelled`, which makes canUseTool throw.
+        // We only care about the captured requestPermission options.
+      }
+
+      expect(capturedPermissionRequest).not.toBeNull();
+      const optionIds = capturedPermissionRequest.options.map((o: any) => o.optionId);
+      expect(optionIds).not.toContain("auto");
+      expect(optionIds).toEqual(expect.arrayContaining(["default", "acceptEdits", "plan"]));
+    });
+
+    it("denies a selected `auto` option if the client did not receive that option", async () => {
+      const session = (agent as unknown as { sessions: Record<string, any> }).sessions[SESSION_ID];
+      session.modes = {
+        currentModeId: "plan",
+        availableModes: [
+          { id: "default", name: "Default", description: "Standard" },
+          { id: "acceptEdits", name: "Accept Edits", description: "Auto-accept edits" },
+          { id: "plan", name: "Plan Mode", description: "Planning mode" },
+          { id: "dontAsk", name: "Don't Ask", description: "Deny if not pre-approved" },
+        ],
+      };
+      permissionResponse = { outcome: { outcome: "selected", optionId: "auto" } };
+
+      const canUseTool = (agent as any).canUseTool(SESSION_ID);
+      const result = await canUseTool(
+        "ExitPlanMode",
+        { plan: "do stuff" },
+        { signal: new AbortController().signal, suggestions: undefined, toolUseID: "toolu_2" },
+      );
+
+      expect(capturedPermissionRequest).not.toBeNull();
+      const optionIds = capturedPermissionRequest.options.map((o: any) => o.optionId);
+      expect(optionIds).not.toContain("auto");
+      expect(result.behavior).toBe("deny");
+      expect(sessionUpdates).toHaveLength(0);
+    });
+
+    it("includes the `auto` option on a model with supportsAutoMode", async () => {
+      const session = (agent as unknown as { sessions: Record<string, any> }).sessions[SESSION_ID];
+      session.modes = {
+        currentModeId: "plan",
+        availableModes: [
+          { id: "auto", name: "Auto", description: "Use a model classifier" },
+          { id: "default", name: "Default", description: "Standard" },
+          { id: "acceptEdits", name: "Accept Edits", description: "Auto-accept edits" },
+          { id: "plan", name: "Plan Mode", description: "Planning mode" },
+          { id: "dontAsk", name: "Don't Ask", description: "Deny if not pre-approved" },
+        ],
+      };
+
+      const canUseTool = (agent as any).canUseTool(SESSION_ID);
+      const signal = new AbortController().signal;
+      try {
+        await canUseTool(
+          "ExitPlanMode",
+          { plan: "do stuff" },
+          { signal, suggestions: undefined, toolUseID: "toolu_3" },
+        );
+      } catch {
+        // mock returns cancelled
+      }
+
+      expect(capturedPermissionRequest).not.toBeNull();
+      const optionIds = capturedPermissionRequest.options.map((o: any) => o.optionId);
+      expect(optionIds).toContain("auto");
+    });
+  });
 });
--- a/src/tests/settings.test.ts
+++ b/src/tests/settings.test.ts
@@ -53,6 +53,57 @@ describe("SettingsManager", () => {
      expect(settings.model).toBe("claude-3-5-haiku");
    });

+    it("should expose availableModels from settings", async () => {
+      const claudeDir = path.join(tempDir, ".claude");
+      await fs.promises.mkdir(claudeDir, { recursive: true });
+
+      await fs.promises.writeFile(
+        path.join(claudeDir, "settings.json"),
+        JSON.stringify({
+          availableModels: ["claude-haiku-4-5", "claude-opus-4-7[1m]"],
+        }),
+      );
+
+      settingsManager = new SettingsManager(tempDir);
+      await settingsManager.initialize();
+
+      const settings = settingsManager.getSettings();
+      expect(settings.availableModels).toEqual(["claude-haiku-4-5", "claude-opus-4-7[1m]"]);
+    });
+
+    it("should union and dedupe availableModels across sources", async () => {
+      // Per Claude Code docs: "When `availableModels` is set at multiple
+      // levels, such as user settings and project settings, arrays are
+      // merged and deduplicated."
+      // https://code.claude.com/docs/en/model-config#merge-behavior
+      const claudeDir = path.join(tempDir, ".claude");
+      await fs.promises.mkdir(claudeDir, { recursive: true });
+
+      await fs.promises.writeFile(
+        path.join(claudeDir, "settings.json"),
+        JSON.stringify({
+          availableModels: ["claude-haiku-4-5", "claude-opus-4-7[1m]"],
+        }),
+      );
+      await fs.promises.writeFile(
+        path.join(claudeDir, "settings.local.json"),
+        JSON.stringify({
+          // claude-opus-4-7[1m] overlaps with project; should be deduped.
+          availableModels: ["claude-opus-4-7[1m]", "claude-sonnet-4-6[1m]"],
+        }),
+      );
+
+      settingsManager = new SettingsManager(tempDir);
+      await settingsManager.initialize();
+
+      const settings = settingsManager.getSettings();
+      expect(settings.availableModels).toEqual([
+        "claude-haiku-4-5",
+        "claude-opus-4-7[1m]",
+        "claude-sonnet-4-6[1m]",
+      ]);
+    });
+
    it("should merge permissions.defaultMode with later sources taking precedence", async () => {
      const claudeDir = path.join(tempDir, ".claude");
      await fs.promises.mkdir(claudeDir, { recursive: true });
@@ -90,4 +141,66 @@ describe("SettingsManager", () => {
      expect(settings.permissions?.defaultMode).toBe("plan");
    });
  });
+
+  describe("escalating defaultMode trust filter", () => {
+    // The SDK's filterEscalatingDefaultMode drops escalating values
+    // (bypassPermissions / auto / acceptEdits) that came from a repo-committed
+    // tier (.claude/settings.json), preventing a checked-in file from
+    // silently escalating permissions. Local (.claude/settings.local.json)
+    // and user-tier sources are not committed by convention, so escalating
+    // values from those tiers are preserved.
+
+    it.each(["bypassPermissions", "auto", "acceptEdits"] as const)(
+      "drops %s when set in project-tier settings",
+      async (mode) => {
+        const claudeDir = path.join(tempDir, ".claude");
+        await fs.promises.mkdir(claudeDir, { recursive: true });
+
+        await fs.promises.writeFile(
+          path.join(claudeDir, "settings.json"),
+          JSON.stringify({ permissions: { defaultMode: mode } }),
+        );
+
+        settingsManager = new SettingsManager(tempDir);
+        await settingsManager.initialize();
+
+        expect(settingsManager.getSettings().permissions?.defaultMode).toBeUndefined();
+      },
+    );
+
+    it.each(["plan", "dontAsk"] as const)(
+      "preserves non-escalating %s from project-tier settings",
+      async (mode) => {
+        const claudeDir = path.join(tempDir, ".claude");
+        await fs.promises.mkdir(claudeDir, { recursive: true });
+
+        await fs.promises.writeFile(
+          path.join(claudeDir, "settings.json"),
+          JSON.stringify({ permissions: { defaultMode: mode } }),
+        );
+
+        settingsManager = new SettingsManager(tempDir);
+        await settingsManager.initialize();
+
+        expect(settingsManager.getSettings().permissions?.defaultMode).toBe(mode);
+      },
+    );
+
+    it("preserves escalating defaultMode when it comes from local-tier settings", async () => {
+      // settings.local.json is git-ignored by convention, so the trust
+      // filter does not apply.
+      const claudeDir = path.join(tempDir, ".claude");
+      await fs.promises.mkdir(claudeDir, { recursive: true });
+
+      await fs.promises.writeFile(
+        path.join(claudeDir, "settings.local.json"),
+        JSON.stringify({ permissions: { defaultMode: "acceptEdits" } }),
+      );
+
+      settingsManager = new SettingsManager(tempDir);
+      await settingsManager.initialize();
+
+      expect(settingsManager.getSettings().permissions?.defaultMode).toBe("acceptEdits");
+    });
+  });
 });
--- a/src/tests/tools.test.ts
+++ b/src/tests/tools.test.ts
@@ -14,8 +14,14 @@ import { toAcpNotifications, ToolUseCache, Logger } from "../acp-agent.js";
 import {
  toolUpdateFromToolResult,
  createPostToolUseHook,
+  createTaskHook,
  toolInfoFromToolUse,
  planEntries,
+  applyTaskCreate,
+  applyTaskUpdate,
+  parseTaskCreateOutput,
+  taskStateToPlanEntries,
+  TaskState,
 } from "../tools.js";

 describe("rawOutput in tool call updates", () => {
@@ -1056,6 +1062,162 @@ describe("Bash terminal output", () => {
    });
  });

+  describe("post-tool-use hook sends diff content for Write tool", () => {
+    // Regression: previously the dispatch only invoked
+    // toolUpdateFromDiffToolResponse for `Edit`, so a Write that
+    // overwrote an existing file (FileWriteOutput.type === "update")
+    // showed a "creation" diff (oldText: null, full new content) at
+    // tool_use time and was never corrected after the tool ran.
+    it("should emit a real diff for Write of an existing file (type: update)", async () => {
+      const toolUseCache: ToolUseCache = {};
+      const hookUpdates: any[] = [];
+      const mockClientWithUpdate = {
+        sessionUpdate: async (notification: any) => {
+          hookUpdates.push(notification);
+        },
+      } as unknown as AgentSideConnection;
+
+      toAcpNotifications(
+        [
+          {
+            type: "tool_use" as const,
+            id: "toolu_write_update",
+            name: "Write",
+            input: {
+              file_path: "/Users/test/project/file.ts",
+              content: "line1\nNEW line2\nline3",
+            },
+          },
+        ],
+        "assistant",
+        "test-session",
+        toolUseCache,
+        mockClientWithUpdate,
+        mockLogger,
+      );
+
+      const hook = createPostToolUseHook(mockLogger);
+      await hook(
+        {
+          hook_event_name: "PostToolUse",
+          tool_name: "Write",
+          tool_input: {
+            file_path: "/Users/test/project/file.ts",
+            content: "line1\nNEW line2\nline3",
+          },
+          tool_response: {
+            type: "update",
+            filePath: "/Users/test/project/file.ts",
+            content: "line1\nNEW line2\nline3",
+            originalFile: "line1\nold line2\nline3",
+            structuredPatch: [
+              {
+                oldStart: 1,
+                oldLines: 3,
+                newStart: 1,
+                newLines: 3,
+                lines: [" line1", "-old line2", "+NEW line2", " line3"],
+              },
+            ],
+            userModified: false,
+          },
+          tool_use_id: "toolu_write_update",
+          session_id: "test-session",
+          transcript_path: "/tmp/test",
+          cwd: "/tmp",
+        },
+        "toolu_write_update",
+        { signal: AbortSignal.abort() },
+      );
+
+      expect(hookUpdates).toHaveLength(1);
+      const hookUpdate = hookUpdates[0].update;
+      expect(hookUpdate._meta.claudeCode.toolName).toBe("Write");
+      expect(hookUpdate.content).toEqual([
+        {
+          type: "diff",
+          path: "/Users/test/project/file.ts",
+          oldText: "line1\nold line2\nline3",
+          newText: "line1\nNEW line2\nline3",
+        },
+      ]);
+      expect(hookUpdate.locations).toEqual([{ path: "/Users/test/project/file.ts", line: 1 }]);
+    });
+
+    it("should still emit a sensible diff for Write of a brand-new file (type: create)", async () => {
+      const toolUseCache: ToolUseCache = {};
+      const hookUpdates: any[] = [];
+      const mockClientWithUpdate = {
+        sessionUpdate: async (notification: any) => {
+          hookUpdates.push(notification);
+        },
+      } as unknown as AgentSideConnection;
+
+      toAcpNotifications(
+        [
+          {
+            type: "tool_use" as const,
+            id: "toolu_write_create",
+            name: "Write",
+            input: {
+              file_path: "/Users/test/project/new.ts",
+              content: "first\nsecond",
+            },
+          },
+        ],
+        "assistant",
+        "test-session",
+        toolUseCache,
+        mockClientWithUpdate,
+        mockLogger,
+      );
+
+      const hook = createPostToolUseHook(mockLogger);
+      await hook(
+        {
+          hook_event_name: "PostToolUse",
+          tool_name: "Write",
+          tool_input: {
+            file_path: "/Users/test/project/new.ts",
+            content: "first\nsecond",
+          },
+          tool_response: {
+            type: "create",
+            filePath: "/Users/test/project/new.ts",
+            content: "first\nsecond",
+            originalFile: null,
+            structuredPatch: [
+              {
+                oldStart: 0,
+                oldLines: 0,
+                newStart: 1,
+                newLines: 2,
+                lines: ["+first", "+second"],
+              },
+            ],
+          },
+          tool_use_id: "toolu_write_create",
+          session_id: "test-session",
+          transcript_path: "/tmp/test",
+          cwd: "/tmp",
+        },
+        "toolu_write_create",
+        { signal: AbortSignal.abort() },
+      );
+
+      expect(hookUpdates).toHaveLength(1);
+      const hookUpdate = hookUpdates[0].update;
+      expect(hookUpdate.content).toEqual([
+        {
+          type: "diff",
+          path: "/Users/test/project/new.ts",
+          oldText: null,
+          newText: "first\nsecond",
+        },
+      ]);
+    });
+  });
+
  describe("post-tool-use hook preserves terminal _meta", () => {
    it("should send terminal_output and terminal_exit as separate notifications, and hook should only have claudeCode", async () => {
      const clientCapabilities: ClientCapabilities = {
@@ -1385,3 +1547,404 @@ describe("toAcpNotifications - TodoWrite with undefined input regression", () =>
    expect(planUpdates).toHaveLength(1);
  });
 });
+
+describe("parseTaskCreateOutput", () => {
+  it("parses JSON-string content", () => {
+    const parsed = parseTaskCreateOutput(JSON.stringify({ task: { id: "1", subject: "X" } }));
+    expect(parsed).toEqual({ task: { id: "1", subject: "X" } });
+  });
+
+  it("parses array-of-text-block content", () => {
+    const parsed = parseTaskCreateOutput([
+      { type: "text", text: JSON.stringify({ task: { id: "2", subject: "Y" } }) },
+    ]);
+    expect(parsed).toEqual({ task: { id: "2", subject: "Y" } });
+  });
+
+  it("returns undefined for non-JSON content", () => {
+    expect(parseTaskCreateOutput("not json")).toBeUndefined();
+    expect(parseTaskCreateOutput([{ type: "text", text: "not json" }])).toBeUndefined();
+  });
+
+  it("returns undefined when task.id is missing", () => {
+    expect(parseTaskCreateOutput(JSON.stringify({ task: { subject: "X" } }))).toBeUndefined();
+  });
+});
+
+describe("applyTaskCreate / applyTaskUpdate", () => {
+  it("creates an entry on TaskCreate when both input and output are present", () => {
+    const state: TaskState = new Map();
+    applyTaskCreate(
+      state,
+      { subject: "Write tests", description: "Cover Task* flow", activeForm: "Writing tests" },
+      { task: { id: "1", subject: "Write tests" } },
+    );
+    expect(state.get("1")).toEqual({
+      subject: "Write tests",
+      status: "pending",
+      activeForm: "Writing tests",
+      description: "Cover Task* flow",
+    });
+  });
+
+  it("is a no-op when the output has no task ID", () => {
+    const state: TaskState = new Map();
+    applyTaskCreate(state, { subject: "X", description: "Y" }, undefined);
+    expect(state.size).toBe(0);
+  });
+
+  it("updates fields by task ID and keeps insertion order in plan entries", () => {
+    const state: TaskState = new Map();
+    applyTaskCreate(state, { subject: "A", description: "" }, { task: { id: "1", subject: "A" } });
+    applyTaskCreate(state, { subject: "B", description: "" }, { task: { id: "2", subject: "B" } });
+    applyTaskUpdate(state, { taskId: "1", status: "in_progress" });
+    expect(taskStateToPlanEntries(state)).toEqual([
+      { content: "A", status: "in_progress", priority: "medium" },
+      { content: "B", status: "pending", priority: "medium" },
+    ]);
+  });
+
+  it("removes entries when status is 'deleted'", () => {
+    const state: TaskState = new Map();
+    applyTaskCreate(state, { subject: "A", description: "" }, { task: { id: "1", subject: "A" } });
+    applyTaskUpdate(state, { taskId: "1", status: "deleted" });
+    expect(state.size).toBe(0);
+  });
+
+  it("creates a placeholder entry when TaskUpdate carries a subject for an unseen task", () => {
+    const state: TaskState = new Map();
+    applyTaskUpdate(state, { taskId: "5", subject: "Late arrival", status: "in_progress" });
+    expect(state.get("5")).toEqual({
+      subject: "Late arrival",
+      status: "in_progress",
+      activeForm: undefined,
+      description: undefined,
+    });
+  });
+
+  it("skips TaskUpdate for an unseen task when no subject is available", () => {
+    const state: TaskState = new Map();
+    applyTaskUpdate(state, { taskId: "5", status: "in_progress" });
+    // Without a subject we'd render an empty-content plan entry, so the
+    // update is dropped instead of synthesizing a blank placeholder.
+    expect(state.has("5")).toBe(false);
+  });
+});
+
+describe("toAcpNotifications - Task* tools", () => {
+  const mockClient = {} as AgentSideConnection;
+  const mockLogger: Logger = { log: () => {}, error: () => {} };
+
+  it("suppresses tool_call for TaskCreate/TaskUpdate/TaskList/TaskGet on tool_use", () => {
+    const toolUseCache: ToolUseCache = {};
+    const taskState: TaskState = new Map();
+
+    const notifications = toAcpNotifications(
+      [
+        { type: "tool_use", id: "1", name: "TaskCreate", input: { subject: "A", description: "" } },
+        {
+          type: "tool_use",
+          id: "2",
+          name: "TaskUpdate",
+          input: { taskId: "1", status: "in_progress" },
+        },
+        { type: "tool_use", id: "3", name: "TaskList", input: {} },
+        { type: "tool_use", id: "4", name: "TaskGet", input: { taskId: "1" } },
+      ] as any,
+      "assistant",
+      "test-session",
+      toolUseCache,
+      mockClient,
+      mockLogger,
+      { taskState },
+    );
+
+    expect(notifications).toHaveLength(0);
+    expect(taskState.size).toBe(0);
+  });
+
+  it("emits a plan snapshot after a TaskCreate tool_result and accumulates state", () => {
+    const toolUseCache: ToolUseCache = {};
+    const taskState: TaskState = new Map();
+
+    toAcpNotifications(
+      [
+        {
+          type: "tool_use",
+          id: "1",
+          name: "TaskCreate",
+          input: { subject: "First", description: "" },
+        },
+      ] as any,
+      "assistant",
+      "test-session",
+      toolUseCache,
+      mockClient,
+      mockLogger,
+      { taskState },
+    );
+
+    const created = toAcpNotifications(
+      [
+        {
+          type: "tool_result",
+          tool_use_id: "1",
+          content: JSON.stringify({ task: { id: "1", subject: "First" } }),
+          is_error: false,
+        },
+      ] as any,
+      "user",
+      "test-session",
+      toolUseCache,
+      mockClient,
+      mockLogger,
+      { taskState },
+    );
+
+    expect(created).toHaveLength(1);
+    expect(created[0].update).toMatchObject({
+      sessionUpdate: "plan",
+      entries: [{ content: "First", status: "pending", priority: "medium" }],
+    });
+
+    // A second TaskCreate accumulates rather than replacing.
+    toAcpNotifications(
+      [
+        {
+          type: "tool_use",
+          id: "2",
+          name: "TaskCreate",
+          input: { subject: "Second", description: "" },
+        },
+      ] as any,
+      "assistant",
+      "test-session",
+      toolUseCache,
+      mockClient,
+      mockLogger,
+      { taskState },
+    );
+
+    const second = toAcpNotifications(
+      [
+        {
+          type: "tool_result",
+          tool_use_id: "2",
+          content: JSON.stringify({ task: { id: "2", subject: "Second" } }),
+          is_error: false,
+        },
+      ] as any,
+      "user",
+      "test-session",
+      toolUseCache,
+      mockClient,
+      mockLogger,
+      { taskState },
+    );
+
+    expect(second[0].update).toMatchObject({
+      sessionUpdate: "plan",
+      entries: [
+        { content: "First", status: "pending", priority: "medium" },
+        { content: "Second", status: "pending", priority: "medium" },
+      ],
+    });
+  });
+
+  it("emits a plan snapshot reflecting status changes after a TaskUpdate tool_result", () => {
+    const toolUseCache: ToolUseCache = {};
+    const taskState: TaskState = new Map([["1", { subject: "First", status: "pending" as const }]]);
+    toolUseCache["update-1"] = {
+      type: "tool_use",
+      id: "update-1",
+      name: "TaskUpdate",
+      input: { taskId: "1", status: "completed" },
+    };
+
+    const notifications = toAcpNotifications(
+      [
+        {
+          type: "tool_result",
+          tool_use_id: "update-1",
+          content: JSON.stringify({
+            success: true,
+            taskId: "1",
+            updatedFields: ["status"],
+          }),
+          is_error: false,
+        },
+      ] as any,
+      "user",
+      "test-session",
+      toolUseCache,
+      mockClient,
+      mockLogger,
+      { taskState },
+    );
+
+    expect(notifications).toHaveLength(1);
+    expect(notifications[0].update).toMatchObject({
+      sessionUpdate: "plan",
+      entries: [{ content: "First", status: "completed", priority: "medium" }],
+    });
+  });
+
+  it("suppresses TaskList and TaskGet tool_result without touching task state", () => {
+    const toolUseCache: ToolUseCache = {
+      "list-1": { type: "tool_use", id: "list-1", name: "TaskList", input: {} },
+      "get-1": { type: "tool_use", id: "get-1", name: "TaskGet", input: { taskId: "1" } },
+    };
+    const taskState: TaskState = new Map([
+      ["1", { subject: "Existing", status: "in_progress" as const }],
+    ]);
+
+    const notifications = toAcpNotifications(
+      [
+        { type: "tool_result", tool_use_id: "list-1", content: "...", is_error: false },
+        { type: "tool_result", tool_use_id: "get-1", content: "...", is_error: false },
+      ] as any,
+      "user",
+      "test-session",
+      toolUseCache,
+      mockClient,
+      mockLogger,
+      { taskState },
+    );
+
+    expect(notifications).toHaveLength(0);
+    expect(taskState.get("1")).toEqual({ subject: "Existing", status: "in_progress" });
+  });
+
+  it("does not apply TaskCreate/TaskUpdate when the tool_result reports an error", () => {
+    const toolUseCache: ToolUseCache = {
+      "create-1": {
+        type: "tool_use",
+        id: "create-1",
+        name: "TaskCreate",
+        input: { subject: "A", description: "" },
+      },
+    };
+    const taskState: TaskState = new Map();
+
+    const notifications = toAcpNotifications(
+      [
+        {
+          type: "tool_result",
+          tool_use_id: "create-1",
+          content: "task creation failed",
+          is_error: true,
+        },
+      ] as any,
+      "user",
+      "test-session",
+      toolUseCache,
+      mockClient,
+      mockLogger,
+      { taskState },
+    );
+
+    expect(notifications).toHaveLength(0);
+    expect(taskState.size).toBe(0);
+  });
+});
+
+describe("createTaskHook", () => {
+  it("registers a task on TaskCreated and fires onChange", async () => {
+    const taskState: TaskState = new Map();
+    let changes = 0;
+    const hook = createTaskHook({
+      taskState,
+      onChange: async () => {
+        changes++;
+      },
+    });
+
+    await hook(
+      {
+        hook_event_name: "TaskCreated",
+        task_id: "t-1",
+        task_subject: "Investigate flaky test",
+        task_description: "Repro and fix",
+      } as any,
+      undefined,
+      { signal: new AbortController().signal },
+    );
+
+    expect(taskState.get("t-1")).toEqual({
+      subject: "Investigate flaky test",
+      status: "pending",
+      description: "Repro and fix",
+    });
+    expect(changes).toBe(1);
+  });
+
+  it("does not clobber an existing entry on TaskCreated", async () => {
+    const taskState: TaskState = new Map([
+      ["t-1", { subject: "Investigate flaky test", status: "in_progress" as const }],
+    ]);
+    let changes = 0;
+    const hook = createTaskHook({
+      taskState,
+      onChange: async () => {
+        changes++;
+      },
+    });
+
+    await hook(
+      {
+        hook_event_name: "TaskCreated",
+        task_id: "t-1",
+        task_subject: "Investigate flaky test",
+      } as any,
+      undefined,
+      { signal: new AbortController().signal },
+    );
+
+    expect(taskState.get("t-1")?.status).toBe("in_progress");
+    expect(changes).toBe(0);
+  });
+
+  it("marks a task completed on TaskCompleted", async () => {
+    const taskState: TaskState = new Map([
+      ["t-1", { subject: "Investigate flaky test", status: "in_progress" as const }],
+    ]);
+    let changes = 0;
+    const hook = createTaskHook({
+      taskState,
+      onChange: async () => {
+        changes++;
+      },
+    });
+
+    await hook(
+      {
+        hook_event_name: "TaskCompleted",
+        task_id: "t-1",
+        task_subject: "Investigate flaky test",
+      } as any,
+      undefined,
+      { signal: new AbortController().signal },
+    );
+
+    expect(taskState.get("t-1")?.status).toBe("completed");
+    expect(changes).toBe(1);
+  });
+
+  it("is a no-op for unrelated hook events", async () => {
+    const taskState: TaskState = new Map();
+    let changes = 0;
+    const hook = createTaskHook({
+      taskState,
+      onChange: async () => {
+        changes++;
+      },
+    });
+
+    await hook({ hook_event_name: "PostToolUse", tool_name: "Read" } as any, undefined, {
+      signal: new AbortController().signal,
+    });
+
+    expect(taskState.size).toBe(0);
+    expect(changes).toBe(0);
+  });
+});
--- a/src/tools.ts
+++ b/src/tools.ts
@@ -14,6 +14,9 @@ import {
  FileWriteInput,
  GlobInput,
  GrepInput,
+  TaskCreateInput,
+  TaskCreateOutput,
+  TaskUpdateInput,
  TodoWriteInput,
  WebFetchInput,
  WebSearchInput,
@@ -367,6 +370,40 @@ export function toolInfoFromToolUse(
      };
    }

+    case "TaskCreate": {
+      const input = toolUse.input as TaskCreateInput | undefined;
+      return {
+        title: input?.subject ? `Create task: ${input.subject}` : "Create task",
+        kind: "think",
+        content: [],
+      };
+    }
+
+    case "TaskUpdate": {
+      const input = toolUse.input as TaskUpdateInput | undefined;
+      return {
+        title: input?.subject ? `Update task: ${input.subject}` : "Update task",
+        kind: "think",
+        content: [],
+      };
+    }
+
+    case "TaskList": {
+      return {
+        title: "List tasks",
+        kind: "think",
+        content: [],
+      };
+    }
+
+    case "TaskGet": {
+      return {
+        title: "Get task",
+        kind: "think",
+        content: [],
+      };
+    }
+
    case "ExitPlanMode": {
      const planInput = toolUse.input as { plan?: string } | undefined;
      return {
@@ -669,6 +706,103 @@ export function planEntries(input: { todos: ClaudePlanEntry[] } | undefined): Pl
  }));
 }

+/**
+ * Per-session task list accumulated from Task* tool calls (TaskCreate /
+ * TaskUpdate). The headless/SDK session emits these as incremental tool
+ * calls keyed by task ID, replacing the snapshot-style TodoWrite tool.
+ * Iteration order is insertion order (Map semantics), matching the order
+ * tasks are created.
+ */
+export type TaskEntry = {
+  subject: string;
+  status: "pending" | "in_progress" | "completed";
+  activeForm?: string;
+  description?: string;
+};
+export type TaskState = Map<string, TaskEntry>;
+
+/**
+ * Best-effort parse of a TaskCreate tool_result content into the structured
+ * TaskCreateOutput. The SDK delivers tool outputs either as a string or as
+ * an array of TextBlockParam-like blocks containing JSON text; try both.
+ */
+export function parseTaskCreateOutput(content: unknown): TaskCreateOutput | undefined {
+  const tryParse = (text: string): TaskCreateOutput | undefined => {
+    try {
+      const parsed = JSON.parse(text);
+      if (
+        parsed &&
+        typeof parsed === "object" &&
+        parsed.task &&
+        typeof parsed.task.id === "string"
+      ) {
+        return parsed as TaskCreateOutput;
+      }
+    } catch {
+      // ignore
+    }
+    return undefined;
+  };
+
+  if (typeof content === "string") {
+    return tryParse(content);
+  }
+  if (Array.isArray(content)) {
+    for (const block of content) {
+      if (block && typeof block === "object" && "type" in block && block.type === "text") {
+        const text = (block as { text?: unknown }).text;
+        if (typeof text === "string") {
+          const parsed = tryParse(text);
+          if (parsed) return parsed;
+        }
+      }
+    }
+  }
+  return undefined;
+}
+
+export function applyTaskCreate(
+  state: TaskState,
+  input: TaskCreateInput | undefined,
+  output: TaskCreateOutput | undefined,
+): void {
+  const taskId = output?.task?.id;
+  if (!taskId || !input) return;
+  state.set(taskId, {
+    subject: input.subject,
+    status: "pending",
+    activeForm: input.activeForm,
+    description: input.description,
+  });
+}
+
+export function applyTaskUpdate(state: TaskState, input: TaskUpdateInput | undefined): void {
+  if (!input?.taskId) return;
+  if (input.status === "deleted") {
+    state.delete(input.taskId);
+    return;
+  }
+  const existing = state.get(input.taskId);
+  // Without a subject from either the existing entry or the update payload,
+  // we'd produce a plan entry with empty `content` — drop the update.
+  const subject = input.subject ?? existing?.subject;
+  if (!subject) return;
+  state.set(input.taskId, {
+    subject,
+    status: input.status ?? existing?.status ?? "pending",
+    activeForm: input.activeForm ?? existing?.activeForm,
+    description: input.description ?? existing?.description,
+  });
+}
+
+export function taskStateToPlanEntries(state: TaskState): PlanEntry[] {
+  return Array.from(state.values()).map((task) => ({
+    content: task.subject,
+    status: task.status,
+    priority: "medium",
+  }));
+}
+
 export function markdownEscape(text: string): string {
  let escape = "```";
  for (const [m] of text.matchAll(/^```+/gm)) {
@@ -679,7 +813,7 @@ export function markdownEscape(text: string): string {
  return escape + "\n" + text + (text.endsWith("\n") ? "" : "\n") + escape;
 }

-interface EditToolResponseHunk {
+interface DiffToolResponseHunk {
  oldStart: number;
  oldLines: number;
  newStart: number;
@@ -687,23 +821,24 @@ interface EditToolResponseHunk {
  lines: string[];
 }

-interface EditToolResponse {
+interface DiffToolResponse {
  filePath?: string;
-  structuredPatch?: EditToolResponseHunk[];
+  structuredPatch?: DiffToolResponseHunk[];
 }

 /**
- * Builds diff ToolUpdate content from the structured Edit toolResponse provided
- * by the PostToolUse hook. Unlike parsing the plain unified diff string, this uses
- * the pre-parsed structuredPatch which supports multiple replacement sites (replaceAll)
- * and always includes context lines for better readability.
+ * Builds diff ToolUpdate content from the structured toolResponse provided by
+ * the PostToolUse hook for diff-producing tools (Edit, Write). Unlike parsing
+ * the plain unified diff string, this uses the pre-parsed structuredPatch
+ * which supports multiple replacement sites (replaceAll) and always includes
+ * context lines for better readability.
 */
-export function toolUpdateFromEditToolResponse(toolResponse: unknown): {
+export function toolUpdateFromDiffToolResponse(toolResponse: unknown): {
  content?: ToolCallContent[];
  locations?: ToolCallLocation[];
 } {
  if (!toolResponse || typeof toolResponse !== "object") return {};
-  const response = toolResponse as EditToolResponse;
+  const response = toolResponse as DiffToolResponse;
  if (!response.filePath || !Array.isArray(response.structuredPatch)) return {};

  const content: ToolCallContent[] = [];
@@ -796,3 +931,38 @@ export const createPostToolUseHook =
    }
    return { continue: true };
  };
+
+/**
+ * Hook callback for `TaskCreated` / `TaskCompleted` events. The SDK fires
+ * these for both user-facing TaskCreate tool calls and subagent task
+ * creation, giving us `task_id` + `task_subject` without having to parse
+ * tool_result payloads.
+ *
+ * Populating `taskState` from the hook means a later `TaskUpdate` (which
+ * typically only carries `taskId` + `status`) finds an existing entry with
+ * a real subject, instead of synthesizing a placeholder with empty content.
+ */
+export const createTaskHook =
+  (options: { taskState: TaskState; onChange?: () => Promise<void> }): HookCallback =>
+  async (input): Promise<{ continue: boolean }> => {
+    const taskId =
+      "task_id" in input && typeof input.task_id === "string" ? input.task_id : undefined;
+    if (!taskId) return { continue: true };
+
+    if (input.hook_event_name === "TaskCreated") {
+      if (!input.task_subject) return { continue: true };
+      if (options.taskState.has(taskId)) return { continue: true };
+      options.taskState.set(taskId, {
+        subject: input.task_subject,
+        status: "pending",
+        description: input.task_description,
+      });
+      if (options.onChange) await options.onChange();
+    } else if (input.hook_event_name === "TaskCompleted") {
+      const existing = options.taskState.get(taskId);
+      if (!existing || existing.status === "completed") return { continue: true };
+      options.taskState.set(taskId, { ...existing, status: "completed" });
+      if (options.onChange) await options.onChange();
+    }
+    return { continue: true };
+  };
--- a/src/utils.ts
+++ b/src/utils.ts
@@ -2,9 +2,7 @@

 import { Readable, Writable } from "node:stream";
 import { WritableStream, ReadableStream } from "node:stream/web";
-import { readFileSync } from "node:fs";
 import { Logger } from "./acp-agent.js";
-import { ClaudeCodeSettings, getManagedSettingsPath } from "./settings.js";

 // Useful for bridging push-based and async-iterator-based code.
 export class Pushable<T> implements AsyncIterable<T> {
@@ -89,19 +87,3 @@ export function unreachable(value: never, logger: Logger = console) {
 export function sleep(time: number): Promise<void> {
  return new Promise((resolve) => setTimeout(resolve, time));
 }
-
-export function loadManagedSettings(): ClaudeCodeSettings | null {
-  try {
-    return JSON.parse(readFileSync(getManagedSettingsPath(), "utf8")) as ClaudeCodeSettings;
-  } catch {
-    return null;
-  }
-}
-
-export function applyEnvironmentSettings(settings: ClaudeCodeSettings): void {
-  if (settings.env) {
-    for (const [key, value] of Object.entries(settings.env)) {
-      process.env[key] = value;
-    }
-  }
-}