chore(main): release 0.69.0 (#1007)

🤖 I have created a release *beep* *boop*
---


##
[0.69.0](https://github.com/agentclientprotocol/claude-agent-acp/compare/v0.68.0...v0.69.0)
(2026-08-16)


### Features

* report changed files to AIR
([#1001](https://github.com/agentclientprotocol/claude-agent-acp/issues/1001))
([450d6b1](450d6b19dc))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: acp-release-bot[bot] <246668977+acp-release-bot[bot]@users.noreply.github.com>

.github/workflows/ci.yml

@@ -21,7 +21,7 @@ jobs:
     timeout-minutes: 5
 
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
 
       - name: Use Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020

.github/workflows/conventional-prs.yml

@@ -0,0 +1,48 @@
+name: Conventional PRs
+
+# Squash merges use the PR title as the commit subject, which is what
+# release-please parses to compute the next version and CHANGELOG entry.
+on:
+  pull_request:
+    branches: [main]
+    # labeled/unlabeled so validation re-runs when `dependencies` is applied.
+    types: [opened, reopened, edited, synchronize, labeled, unlabeled]
+
+permissions: {}
+
+concurrency:
+  group: "conventional-prs-${{ github.event.pull_request.number }}"
+  cancel-in-progress: true
+
+jobs:
+  validate:
+    name: Validate PR title
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      pull-requests: read
+
+    steps:
+      # Config reference: https://github.com/amannn/action-semantic-pull-request#configuration
+      - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          # Exactly the types release-please understands. feat/fix/perf/revert/docs
+          # appear in the changelog; the rest are valid but hidden. Any other type
+          # would be dropped silently, so it is rejected here instead.
+          types: |
+            feat
+            fix
+            perf
+            revert
+            docs
+            style
+            chore
+            refactor
+            test
+            build
+            ci
+          # Dependabot titles itself conventionally already; don't block bot PRs.
+          ignoreLabels: |
+            dependencies

.github/workflows/publish.yml

@@ -3,9 +3,21 @@ on:
   push:
     branches:
       - main
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: Tag or commit to publish
+        required: true
+        type: string
+      publish_npm:
+        description: Publish the package before updating the registry
+        required: true
+        default: true
+        type: boolean
 
 jobs:
   release-please:
+    if: ${{ github.event_name == 'push' }}
     runs-on: ubuntu-latest
     environment: release # Optional: for enhanced security
     permissions:
@@ -27,7 +39,11 @@ jobs:
         id: release
         with:
           token: ${{ steps.generate-token.outputs.token }}
-          release-type: node
+          # Do not add release-type here. The action ignores config-file whenever
+          # release-type is set, which silently disables the pre-1.0 versioning
+          # rules in release-please-config.json and lets a breaking change jump
+          # straight to 1.0.0. The node release type is declared in that config
+          # instead, so nothing is lost by leaving this out.
           config-file: release-please-config.json
           manifest-file: .release-please-manifest.json
     outputs:
@@ -38,13 +54,15 @@ jobs:
     name: Publish to npm
     runs-on: ubuntu-latest
     needs: [release-please]
-    if: ${{ needs.release-please.outputs.release_created }}
+    if: ${{ always() && ((github.event_name == 'workflow_dispatch' && inputs.publish_npm) || needs.release-please.outputs.release_created == 'true') }}
     environment: release # Optional: for enhanced security
     permissions:
       contents: read
       id-token: write
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.ref || github.ref }}
       # Setup .npmrc file to publish to npm
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
         with:
@@ -56,6 +74,7 @@ jobs:
 
   trigger-registry-update:
     needs: publish-npm
+    if: ${{ always() && (needs.publish-npm.result == 'success' || (github.event_name == 'workflow_dispatch' && !inputs.publish_npm)) }}
     runs-on: ubuntu-latest
     environment: release
     permissions: {}

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "0.61.0"
+  ".": "0.69.0"
 }

AGENTS.md

@@ -0,0 +1,42 @@
+# Agent guide
+
+An ACP-compatible coding agent powered by the Claude Agent SDK. Source in `src/`,
+TypeScript, ESM, Node >= 22.
+
+## Commands
+
+```sh
+npm run build         # tsc
+npm run test:run      # vitest, single pass
+npm run check         # eslint + prettier --check
+npm run lint:fix      # eslint --fix
+npm run format        # prettier --write
+```
+
+CI runs `format:check`, `lint`, `build` and `test:run`. Run `npm run check` before
+opening a PR.
+
+## Pull requests
+
+Squash merges use the PR title as the commit subject, and release-please parses it
+to compute the next version. Titles must be conventional commits using one of:
+`feat`, `fix`, `perf`, `revert`, `docs`, `style`, `chore`, `refactor`, `test`,
+`build`, `ci`. `conventional-prs.yml` rejects anything else.
+
+The title also decides the release: `feat:` bumps the minor, `fix:`/`perf:` the
+patch, and `chore:`/`ci:`/`test:` and friends do not release at all.
+
+## Releasing
+
+Releases are fully automated by release-please. There is no manual release
+workflow, and the version is never chosen by hand — it follows from the commit
+history.
+
+```sh
+npm run release:preflight     # verifies it is safe to release, prints the PR and version
+gh pr merge <pr-number> --squash
+```
+
+The preflight is the guard-list as code; if it exits non-zero, follow what it
+prints rather than merging. Full runbook, including how to recover a stalled
+release: [`docs/RELEASES.md`](docs/RELEASES.md).

CHANGELOG.md

@@ -1,5 +1,112 @@
 # Changelog
 
+## [0.69.0](https://github.com/agentclientprotocol/claude-agent-acp/compare/v0.68.0...v0.69.0) (2026-08-16)
+
+
+### Features
+
+* report changed files to AIR ([#1001](https://github.com/agentclientprotocol/claude-agent-acp/issues/1001)) ([450d6b1](https://github.com/agentclientprotocol/claude-agent-acp/commit/450d6b19dc46a041128356a6fa3cfa3ce6a5a382))
+
+## [0.68.0](https://github.com/agentclientprotocol/claude-agent-acp/compare/v0.67.0...v0.68.0) (2026-08-14)
+
+
+### Features
+
+* align typed session failures with AIR protocol ([#992](https://github.com/agentclientprotocol/claude-agent-acp/issues/992)) ([0581b9c](https://github.com/agentclientprotocol/claude-agent-acp/commit/0581b9cf397ffd88f2830db721c2d8e3689045e4))
+
+## [0.67.0](https://github.com/agentclientprotocol/claude-agent-acp/compare/v0.66.0...v0.67.0) (2026-08-14)
+
+
+### Features
+
+* **deps:** Update to @anthropic-ai/claude-agent-sdk v0.3.232 ([#993](https://github.com/agentclientprotocol/claude-agent-acp/issues/993)) ([de0d0e2](https://github.com/agentclientprotocol/claude-agent-acp/commit/de0d0e2b7d185c521c3d1ac7b86e4312c919abfe))
+* expose typed session failures for AIR ([#979](https://github.com/agentclientprotocol/claude-agent-acp/issues/979)) ([8157ee1](https://github.com/agentclientprotocol/claude-agent-acp/commit/8157ee113e705750be4eb6cc787bdd12f1db84ff))
+* publish the model fallback as a warning advisory ([#990](https://github.com/agentclientprotocol/claude-agent-acp/issues/990)) ([35aaddb](https://github.com/agentclientprotocol/claude-agent-acp/commit/35aaddb3d5b14eca316582ab285af8a660150dae))
+* surface resolved model name in default model option description ([#982](https://github.com/agentclientprotocol/claude-agent-acp/issues/982)) ([ec73cd8](https://github.com/agentclientprotocol/claude-agent-acp/commit/ec73cd8560be7d5e8b9741e404d7d45e17336996))
+* surface Skill tool calls with name and kind in _meta ([#986](https://github.com/agentclientprotocol/claude-agent-acp/issues/986)) ([1f09e9a](https://github.com/agentclientprotocol/claude-agent-acp/commit/1f09e9a3cae787b0effdfae0e7205ef7fe22b9dc))
+
+
+### Bug Fixes
+
+* preserve task plans across prompts ([#974](https://github.com/agentclientprotocol/claude-agent-acp/issues/974)) ([1afa940](https://github.com/agentclientprotocol/claude-agent-acp/commit/1afa940a2c8c0f4c610f4f64d30c0961642907b0))
+* show a pending title while Claude prepares a file ([#978](https://github.com/agentclientprotocol/claude-agent-acp/issues/978)) ([3df1ede](https://github.com/agentclientprotocol/claude-agent-acp/commit/3df1ede89f217312bc237124dc1eccc10c860f99))
+
+## [0.66.0](https://github.com/agentclientprotocol/claude-agent-acp/compare/v0.65.0...v0.66.0) (2026-08-07)
+
+
+### Features
+
+* **deps-dev:** Bump globals from 17.8.0 to 17.9.0 in the minor group ([#960](https://github.com/agentclientprotocol/claude-agent-acp/issues/960)) ([7f27c47](https://github.com/agentclientprotocol/claude-agent-acp/commit/7f27c47c5c7c49e65014e9f7dc55cba17352d33b))
+* expose provider-neutral ACP goal extension ([#964](https://github.com/agentclientprotocol/claude-agent-acp/issues/964)) ([8b31dea](https://github.com/agentclientprotocol/claude-agent-acp/commit/8b31dea11bed54f86c41217759159c415611346c))
+
+
+### Bug Fixes
+
+* publish and replace Claude goals reliably ([#967](https://github.com/agentclientprotocol/claude-agent-acp/issues/967)) ([f8fd3ab](https://github.com/agentclientprotocol/claude-agent-acp/commit/f8fd3ab8224420f8ced570e974cde09612939d6b))
+
+## [0.65.0](https://github.com/agentclientprotocol/claude-agent-acp/compare/v0.64.2...v0.65.0) (2026-08-05)
+
+
+### Features
+
+* **deps-dev:** Bump nanoid from 3.3.16 to 3.3.17 ([#951](https://github.com/agentclientprotocol/claude-agent-acp/issues/951)) ([b965dd2](https://github.com/agentclientprotocol/claude-agent-acp/commit/b965dd21917e822b56f5012c3572902f26c065c9))
+* **deps-dev:** Bump tinyexec from 1.2.4 to 1.3.0 in the minor group ([#959](https://github.com/agentclientprotocol/claude-agent-acp/issues/959)) ([15b4eb4](https://github.com/agentclientprotocol/claude-agent-acp/commit/15b4eb46f329566837eae58f2ee4b05e3e81bf64))
+* **deps:** Bump @hono/node-server from 1.19.17 to 2.1.0 ([#956](https://github.com/agentclientprotocol/claude-agent-acp/issues/956)) ([f9123f3](https://github.com/agentclientprotocol/claude-agent-acp/commit/f9123f3e18560b580398aabf49e2190f69746976))
+* **deps:** Bump fast-uri from 3.1.4 to 3.1.5 ([#952](https://github.com/agentclientprotocol/claude-agent-acp/issues/952)) ([0988438](https://github.com/agentclientprotocol/claude-agent-acp/commit/098843842895dcb450746bd064dbb1509e3049d1))
+* **steering:** settle a steered turn at idle, not at the interrupt ([#958](https://github.com/agentclientprotocol/claude-agent-acp/issues/958)) ([a84b810](https://github.com/agentclientprotocol/claude-agent-acp/commit/a84b81080a4127edf40bc448fc8bf2b15503304d))
+
+## [0.64.2](https://github.com/agentclientprotocol/claude-agent-acp/compare/v0.64.1...v0.64.2) (2026-08-02)
+
+
+### Bug Fixes
+
+* restore the single-tool representation for ExitPlanMode ([#942](https://github.com/agentclientprotocol/claude-agent-acp/issues/942)) ([4302a4b](https://github.com/agentclientprotocol/claude-agent-acp/commit/4302a4b0b6df821b164cbe4857f26cf5b44b532c))
+
+## [0.64.1](https://github.com/agentclientprotocol/claude-agent-acp/compare/v0.64.0...v0.64.1) (2026-08-02)
+
+
+### Bug Fixes
+
+* release 0.65.0 ([#939](https://github.com/agentclientprotocol/claude-agent-acp/issues/939)) ([0936ec2](https://github.com/agentclientprotocol/claude-agent-acp/commit/0936ec281ec730714c605e3da732069ff47d8969))
+
+## [0.64.0](https://github.com/agentclientprotocol/claude-agent-acp/compare/v0.63.0...v0.64.0) (2026-07-30)
+
+
+### Features
+
+* **deps:** Bump actions/checkout from 7.0.0 to 7.0.1 ([#925](https://github.com/agentclientprotocol/claude-agent-acp/issues/925)) ([8e099e8](https://github.com/agentclientprotocol/claude-agent-acp/commit/8e099e844254c3e91508c79a02e3e7dc2239fcbb))
+* **deps:** Bump the minor group with 7 updates ([#928](https://github.com/agentclientprotocol/claude-agent-acp/issues/928)) ([3f60921](https://github.com/agentclientprotocol/claude-agent-acp/commit/3f609219592e63b947539f79c696b3cedb421060))
+
+
+### Bug Fixes
+
+* **steering:** add opt-in host-owned fallback ([#919](https://github.com/agentclientprotocol/claude-agent-acp/issues/919)) ([43af4ec](https://github.com/agentclientprotocol/claude-agent-acp/commit/43af4ec29ea5396c2614813af05967bfb0b1bac8)), closes [#903](https://github.com/agentclientprotocol/claude-agent-acp/issues/903)
+
+## [0.63.0](https://github.com/agentclientprotocol/claude-agent-acp/compare/v0.62.0...v0.63.0) (2026-07-27)
+
+
+### Features
+
+* Update to claude agent sdk v0.3.220 ([#921](https://github.com/agentclientprotocol/claude-agent-acp/issues/921)) ([4c7b897](https://github.com/agentclientprotocol/claude-agent-acp/commit/4c7b89718306229254879e5045a183233b5ed073))
+
+
+### Bug Fixes
+
+* Only resolve a denied tool call the client was told about ([#923](https://github.com/agentclientprotocol/claude-agent-acp/issues/923)) ([8f67b6a](https://github.com/agentclientprotocol/claude-agent-acp/commit/8f67b6a92bec24ae43b3dfbd087fe35df0531857)), closes [#918](https://github.com/agentclientprotocol/claude-agent-acp/issues/918)
+* Report tool_progress heartbeats against the tool call they describe ([#916](https://github.com/agentclientprotocol/claude-agent-acp/issues/916)) ([5559ba8](https://github.com/agentclientprotocol/claude-agent-acp/commit/5559ba890ca614cdaa189500aba65d81cc4cd51a))
+* **tools:** key Bash terminal metas off the announced tool_use id ([#917](https://github.com/agentclientprotocol/claude-agent-acp/issues/917)) ([d060414](https://github.com/agentclientprotocol/claude-agent-acp/commit/d0604140f907adbf9747f26a070690926e1de82d))
+
+## [0.62.0](https://github.com/agentclientprotocol/claude-agent-acp/compare/v0.61.0...v0.62.0) (2026-07-24)
+
+
+### Features
+
+* **deps:** Bump @hono/node-server from 1.19.14 to 1.19.15 ([#908](https://github.com/agentclientprotocol/claude-agent-acp/issues/908)) ([5193604](https://github.com/agentclientprotocol/claude-agent-acp/commit/51936049e175274de8e0fd90bc1be2af988c3ca6))
+* **deps:** Bump media-typer from 1.1.0 to 1.1.1 ([#909](https://github.com/agentclientprotocol/claude-agent-acp/issues/909)) ([5d35001](https://github.com/agentclientprotocol/claude-agent-acp/commit/5d35001563ffd702a29c3bac3b7ca134e40c77f8))
+* **deps:** Bump the minor group with 2 updates ([#900](https://github.com/agentclientprotocol/claude-agent-acp/issues/900)) ([809d41c](https://github.com/agentclientprotocol/claude-agent-acp/commit/809d41c6b7c9e7ba3cb5b206d00793a70edba64a))
+* **deps:** Bump the minor group with 2 updates ([#907](https://github.com/agentclientprotocol/claude-agent-acp/issues/907)) ([14d0627](https://github.com/agentclientprotocol/claude-agent-acp/commit/14d06273c01ad4ae944912e36700f6b5599c4c4d))
+* Update to claude-agent-sdk 0.3.218 ([#904](https://github.com/agentclientprotocol/claude-agent-acp/issues/904)) ([8cbaf97](https://github.com/agentclientprotocol/claude-agent-acp/commit/8cbaf97254576089a3b5ee6ae222fb763003c01d))
+
 ## [0.61.0](https://github.com/agentclientprotocol/claude-agent-acp/compare/v0.60.0...v0.61.0) (2026-07-22)
 
 

CLAUDE.md

@@ -0,0 +1 @@
+AGENTS.md

README.md

@@ -12,12 +12,26 @@ This tool implements an ACP agent by using the official [Claude Agent SDK](https
 - Following
 - Edit review
 - TODO lists
+- Nested subagent transcripts
 - Interactive (and background) terminals
 - Custom [Slash commands](https://docs.anthropic.com/en/docs/claude-code/slash-commands)
 - Client MCP servers
+- Session-scoped long-running goals through the provider-neutral [goal extension](docs/goal-extension.md)
+- Structured errors, recovery, and warnings through the opt-in [session failure extension](docs/session-failure-extension.md)
 
 Learn more about the [Agent Client Protocol](https://agentclientprotocol.com/).
 
+### Nested subagent transcripts
+
+ACP 1.2 has no standard subagent tool kind or nested-message relationship. Clients that can render
+nested transcripts can opt in with `clientCapabilities._meta["subagent-transcript"] = true`.
+The agent then forwards subagent text, thinking, and tool calls, relating nested updates to the
+launching Agent/Task call through `_meta.claudeCode.parentToolUseId`. Agent/Task calls are marked
+with `_meta.claudeCode.subagent = true`.
+
+Clients that do not advertise the capability retain the legacy flattened behavior. In both modes,
+the normal Agent/Task tool result is preserved as the protocol-compatible fallback.
+
 ## Contribution Policy
 
 This project does not require a Contributor License Agreement (CLA). Instead, contributions are accepted under the following terms:

docs/RELEASES.md

@@ -1,24 +1,119 @@
-## How to publish a new release
+# Releases
 
-1. Create a new branch prep-vX.X.X
+Releases are automated by [release-please](https://github.com/googleapis/release-please)
+in [`.github/workflows/publish.yml`](../.github/workflows/publish.yml). Every push
+to `main` re-computes the next version from the conventional commit messages and
+keeps a single release PR open, titled `chore(main): release X.Y.Z` and labelled
+`autorelease: pending`.
+
+Merging that PR is what releases. It tags `vX.Y.Z`, creates the GitHub release,
+publishes to npm, and dispatches a version update to the agent registry.
+
+There is no manual release button, and versions are never typed in by hand: the
+version is an output of the commit history, not an input.
+
+## Releasing
 
 ```sh
-git checkout -b prep-vX.X.X
+npm run release:preflight
 ```
 
-2. Bump the version in package.json
+This reports the open release PR, the version it will ship, and checks that the
+repository is in a state where merging is safe. Nothing has to be remembered —
+if it exits non-zero, follow what it prints instead of merging.
+
+Then merge it, using the PR number the preflight printed:
 
 ```sh
-npm version vX.X.X
+gh pr merge <pr-number> --squash
+gh run watch "$(gh run list --workflow=publish.yml --limit 1 --json databaseId --jq '.[0].databaseId')"
 ```
 
-3. Add a new entry in CHANGELOG.md
-4. Create a PR for `prev-vX.X.X` & merge it
-5. Create tag and push it
+The run is looked up rather than picked interactively, so this is safe to script.
+If the workflow has already finished, `gh run list --workflow=publish.yml` shows
+the outcome instead.
+
+Merging main requires no review, so a green preflight and `Build` are the only
+gates. Once the workflow finishes, confirm both outputs landed:
 
 ```sh
-git tag vX.X.X
-git push origin vX.X.X
+gh release view "v<version>"
+npm view "@agentclientprotocol/claude-agent-acp@<version>"
 ```
 
-6. Paste CHANGELOG into release notes and publish the version on GitHub
+## How the version is chosen
+
+Squash merges use the PR title as the commit subject, so the PR title decides the
+next version. [`conventional-prs.yml`](../.github/workflows/conventional-prs.yml)
+rejects titles release-please would not understand.
+
+| PR title prefix                                           | Effect                      |
+| --------------------------------------------------------- | --------------------------- |
+| `fix:`, `perf:`, `revert:`, `docs:`                       | patch, e.g. 0.66.0 → 0.66.1 |
+| `feat:`                                                   | minor, e.g. 0.66.0 → 0.67.0 |
+| any of the above with `!`, or BREAKING CHANGE             | minor while below 1.0.0     |
+| `chore:`, `ci:`, `build:`, `test:`, `refactor:`, `style:` | no release on their own     |
+
+Breaking changes bump the minor rather than the major because
+`bump-minor-pre-major` is set in
+[`release-please-config.json`](../release-please-config.json) and the package is
+still below 1.0.0. That is deliberate: it keeps a single `!` in a PR title from
+shipping 1.0.0 by accident.
+
+Note that `config-file` only takes effect while the workflow does **not** pass a
+`release-type` input to the action — with `release-type` set, the action ignores
+the config entirely. The release type is declared inside the config instead.
+
+Because the config is what is read, it also has to say
+`"include-component-in-tag": false`. Left at its default, release-please derives a
+component from the package name and tags `claude-agent-acp-vX.Y.Z` instead of
+`vX.Y.Z`. That renames the tag every step here looks up, and because no tag under
+the new scheme exists, it also walks the entire commit history into the changelog
+rather than just what landed since the last release. The preflight checks the tag
+release-please is going to use, so this cannot reach a published release.
+
+Releasing 1.0.0 is therefore an explicit act: add `"release-as": "1.0.0"` to
+`release-please-config.json` in its own PR, release, then remove it again.
+
+## Recovering a stalled release
+
+### The release PR merged but nothing was tagged
+
+The preflight fails with `release-please is jammed`. While a merged release PR
+still carries `autorelease: pending`, release-please refuses to open any new
+release PR at all, so every later release stalls silently until this is cleared.
+
+Take the release notes release-please already wrote into the changelog, create
+the missing release, then move the label the way release-please would have:
+
+```sh
+awk '/^## \[<version>\]/{f=1;print;next} /^## \[/{f=0} f' CHANGELOG.md > notes.md
+gh release create "v<version>" --target <merge-commit-sha> --notes-file notes.md
+gh pr edit <pr-number> --remove-label "autorelease: pending" \
+  --add-label "autorelease: tagged"
+```
+
+Then publish the tag as described below.
+
+### The tag exists but npm or the registry is missing
+
+npm publishes through OIDC from inside the workflow, so this cannot be done from
+a laptop. Re-run the publish workflow against the existing tag:
+
+```sh
+gh workflow run publish.yml -f ref="v<version>" -f publish_npm=true
+```
+
+npm versions are immutable. If the package already published and only the
+registry update failed, pass `-f publish_npm=false` so the run skips publishing
+and only re-dispatches the registry update.
+
+## Credentials
+
+| Secret                                                        | Used for                                                          |
+| ------------------------------------------------------------- | ----------------------------------------------------------------- |
+| `RELEASE_PLZ_APP_ID`, `RELEASE_PLZ_APP_PRIVATE_KEY`           | App token for release PRs and tags, so they can trigger workflows |
+| `REGISTRY_UPDATER_APP_ID`, `REGISTRY_UPDATER_APP_PRIVATE_KEY` | App token scoped to the `registry` repository                     |
+
+Publishing to npm uses OIDC trusted publishing, so there is no npm token. All
+release jobs run in the `release` environment.

docs/goal-extension.md

@@ -0,0 +1,57 @@
+# Goal extension
+
+This document defines a provider-neutral experimental ACP extension implemented by `claude-agent-acp`. It is intentionally shaped like a possible future first-class ACP API: implementations publish `_meta.goal`, not provider-specific metadata such as `_meta.claudeCode.goal`.
+
+## Capability negotiation
+
+An agent advertises support in its `initialize` response:
+
+```json
+{
+  "_meta": {
+    "goal": {
+      "version": 1,
+      "controlMethod": "_session/goal",
+      "actions": ["clear"]
+    }
+  }
+}
+```
+
+`actions` is the implementation-supported subset of `set`, `pause`, `resume`, and `clear`. Clients must not infer support for an action that is not advertised. The control request contains `sessionId` and `action`; a future version may add action-specific fields such as an objective for `set`.
+
+## Session state
+
+The current snapshot is published in `session_info_update._meta.goal`. Clearing a goal publishes `goal: null`.
+
+```json
+{
+  "objective": "Ship the change",
+  "status": "active",
+  "iterations": 3,
+  "lastReason": "Tests still need work",
+  "createdAt": 1710000000123,
+  "controlMethod": "_session/goal"
+}
+```
+
+Common statuses are `active`, `paused`, `blocked`, `limited`, and `complete`. Optional fields allow implementations to report budgets, usage, iteration count, and the last continuation reason. Timestamps are Unix milliseconds.
+
+## Lifecycle architecture
+
+A goal belongs to the ACP session, not to an individual `session/prompt` request. Goal activity and prompt activity are independent:
+
+- `status: active` means the persistent objective can drive more work; it does not mean an ACP prompt is currently executing.
+- A prompt completes when its current backend turn reaches a quiescent boundary, even when the goal remains active.
+- A later autonomous cycle may publish more session updates outside that completed prompt.
+- While a turn is running, clients use steering or prompt queueing when advertised. While the session is quiescent, clients may send an ordinary `session/prompt`.
+
+This separation prevents a persistent goal from monopolizing the session's prompt slot and lets clients model “working now” independently from “objective remains active.”
+
+## Claude mapping
+
+Claude's session-scoped `/goal` command installs a Stop hook. The runtime emits internal `active_goal` messages when that hook updates or clears its state; the adapter maps them into the neutral snapshot before the exhaustive SDK message switch. `condition`, `iterations`, `set_at`, and `last_reason` become `objective`, `iterations`, `createdAt`, and `lastReason`. Provider-only bookkeeping such as `tokens_at_start` is not exposed.
+
+Some Claude runtime versions persist the goal and begin the Stop-hook workflow without emitting the initial `active_goal` message on the SDK stream. To avoid leaving clients without visible state for the whole long-running prompt, the adapter publishes a minimal active snapshot as soon as it submits `/goal <condition>`, and publishes `goal: null` for `/goal clear`. While that command is pending, late updates for the previous goal are ignored. A matching runtime `active_goal` remains authoritative and enriches the optimistic snapshot with iteration, reason, and timestamp fields; a failed command restores the previously published state.
+
+`set` and `clear` are advertised for out-of-band control; pause and resume are not. When a goal turn is running, the adapter injects the corresponding `/goal` command at steering priority `now` so it cannot remain queued behind the Stop-hook workflow; on an idle session it uses the ordinary prompt lifecycle. Cancelling a turn does not clear the session-scoped goal: clients use the goal control method when they intend to replace or remove it.

docs/session-failure-extension.md

@@ -0,0 +1,208 @@
+# Session failure extension
+
+This document defines the provider-neutral experimental `sessionFailure` extension implemented by
+`claude-agent-acp`. Warnings and errors are durable transcript entries shown in order beside user,
+agent, and tool messages. They are not assistant-authored text and not ephemeral chat banners.
+
+## Capability negotiation
+
+The extension is opt-in. A client advertises it in `initialize`:
+
+```json
+{
+  "clientCapabilities": {
+    "_meta": {
+      "jetbrains": {
+        "air": {
+          "version": 1,
+          "capabilities": ["sessionFailure"]
+        }
+      }
+    }
+  }
+}
+```
+
+The adapter enables the extension only when `version` is a finite integer greater than or equal to
+`1` and `capabilities` contains `sessionFailure`. Otherwise it preserves the legacy ACP behavior.
+
+## Wire record
+
+The record is placed under `_meta.jetbrains.air.sessionFailure`:
+
+```json
+{
+  "_meta": {
+    "jetbrains": {
+      "air": {
+        "version": 1,
+        "sessionFailure": {
+          "id": "prompt-uuid:error",
+          "revision": 1,
+          "category": "limit",
+          "severity": "error",
+          "title": "You've hit your individual spend limit · run /usage-credits to ask your admin for a higher limit",
+          "actions": []
+        }
+      }
+    }
+  }
+}
+```
+
+| Field      | Required | Type                 | Meaning                                                                 |
+| ---------- | -------: | -------------------- | ----------------------------------------------------------------------- |
+| `id`       |      yes | non-empty string     | Stable identity of one logical incident.                                |
+| `revision` |      yes | positive integer     | Monotonically increasing version of that incident.                      |
+| `category` |      yes | category enum        | Broad machine-readable visual group.                                    |
+| `severity` |      yes | `warning` or `error` | Inline warning or error presentation.                                   |
+| `title`    |      yes | string               | Complete normal user-facing presentation.                               |
+| `details`  |       no | string               | Long explanation used only when required text is too large for `title`. |
+| `actions`  |      yes | ordered string array | Recovery actions recommended by the adapter.                            |
+
+There are no `phase`, `source`, `safeMessage`, `retryable`, `retryAfterMs`, `turnId`, retry-counter,
+or provider-code fields. Retry progress belongs in `title` when Claude supplies it. Transcript order
+and persistence time come from the receiving ACP event.
+
+## Identity, revisions, and history
+
+`id` identifies one occurrence, not an error type.
+
+- The first record for an incident creates one transcript entry at the current stream position.
+- The same `id` with a higher `revision` updates that entry in place without moving it.
+- The same or a lower revision is idempotently ignored by the client.
+- A later independent occurrence uses a new `id`, even when its category and text are identical.
+- Consecutive updates for the same notice may reuse one id and increment its revision.
+- Different ids are never deduplicated by comparing title or category.
+
+Live turn failures use `<turnId>:error`. Session-scoped incidents use an adapter-session epoch plus an
+incident sequence. Notices have their own `:notice:` namespace. Replayed usage-limit failures recover
+the persisted user-message UUID used as the live turn id, so the same occurrence keeps the same id.
+Malformed history without a preceding user message falls back to
+`<sessionId>:history-error:<messageUuid>`.
+
+Resolved records remain in transcript history. Recovery removes only the adapter's internal active
+state; it does not publish a clear tombstone and does not delete or rewrite the historical entry. A
+producer may publish a higher revision only when it has a real new user-facing status to show.
+
+## Delivery surfaces
+
+A turn-terminal failure is attached to the successful ACP `PromptResponse` in `_meta`; the response
+uses `stopReason: end_turn`. Session-scoped, replay-restored, warning, and background incidents use a
+`session_info_update`. The schema is identical on both carriers.
+
+A warning does not end a turn. An error record does not independently invent ACP lifecycle state;
+the prompt response or transport lifecycle remains authoritative. If no capable client negotiated
+the extension, existing JSON-RPC errors and transcript text remain unchanged.
+
+## Categories
+
+Categories are deliberately broad and drive only iconography and generic accessibility labels.
+
+| Category     | Covers                                                                |
+| ------------ | --------------------------------------------------------------------- |
+| `connection` | Lost transport, stopped or shutting-down worker, unavailable runtime. |
+| `access`     | Authentication required, rejected credentials, denied access.         |
+| `limit`      | Rate, quota, token, context, turn, or configured budget limit.        |
+| `request`    | Invalid input, unsupported model or operation, rejected request.      |
+| `service`    | Provider overload, provider failure, adapter/internal failure.        |
+| `unknown`    | A warning or failure that does not fit another group.                 |
+
+Claude SDK conditions map to these groups:
+
+| Claude condition                                                                         | Category                           |
+| ---------------------------------------------------------------------------------------- | ---------------------------------- |
+| `authentication_failed`, `oauth_org_not_allowed`, synthetic login message                | `access`                           |
+| `billing_error`, `rate_limit`, `max_output_tokens`, usage/spend limit, budget/turn limit | `limit`                            |
+| `invalid_request`, `model_not_found`                                                     | `request`                          |
+| `overloaded`, `server_error`, unknown provider error, adapter internal error             | `service`                          |
+| API retry without an HTTP response, query transport loss, worker shutdown                | `connection`                       |
+| model fallback notice                                                                    | `unknown` with `severity: warning` |
+
+Unknown SDK error kinds degrade to `service`; they never become success. Category does not determine
+message text or client behavior beyond presentation.
+
+## Severity
+
+- `warning` means the operation may still succeed and normally has no actions while recovery is in
+  progress. It does not terminate the turn. SDK `api_retry` progress reuses the active turn failure id;
+  a later terminal failure updates that record with a higher revision.
+- `error` means the operation cannot continue without user action or another request.
+
+Severity is always explicit.
+
+## Title and details
+
+`title` is the complete normal presentation: what happened, retry progress when present, and a short
+next step. The adapter must not replace a real Claude message with category-specific canned wording.
+
+For Claude SDK failures the title is copied from the user-facing text Claude already emitted:
+
+- top-level assistant error text, including synthetic usage-limit and login messages;
+- otherwise the terminal SDK result or error text;
+- the exact model-fallback notice for warning records.
+
+Adapter-authored fallback text is allowed only when no Claude user-facing message exists, such as a
+query iterator throwing, worker-shutdown EOF, or an internal missing-result invariant. Raw thrown
+exceptions, stack traces, transport URLs, tokens, headers, environment values, and private paths are
+never used as titles.
+
+`details` is reserved exclusively for required explanations too large to fit reasonably in `title`.
+If the complete message fits in `title`, `details` must be omitted. It is not a place for status text,
+retry counters, provider payloads, or diagnostics.
+
+## Actions
+
+Version 1 defines only:
+
+| Action        | Meaning                                            |
+| ------------- | -------------------------------------------------- |
+| `retry`       | Retry the operation associated with this incident. |
+| `login`       | Start authentication.                              |
+| `new_session` | Start a fresh agent session/runtime.               |
+
+The adapter supplies action ordering. The client filters actions it cannot safely execute and ignores
+unknown or duplicate values. The client must not infer actions from category.
+
+Current Claude policies are:
+
+- authentication: `login`;
+- provider overload/error and recoverable internal error: `retry`;
+- transport loss or worker shutdown: `new_session`;
+- context or configured session-budget exhaustion: `new_session`;
+- account quota and invalid request: no action.
+
+## Internal recovery
+
+Recovery policy is internal adapter state and is not serialized:
+
+- restored quota remains active until a real model answer;
+- authentication remains active until successful `auth_status`;
+- transport loss and worker shutdown remain active until runtime replacement;
+- other turn-scoped failures stop being active at a later confirmed attempt boundary;
+- notices are not cleared merely by generic success.
+
+Recovery never removes the transcript record. Publishing another incident is not evidence that an
+older one recovered.
+
+## History replay
+
+`session/load` scans top-level assistant history for SDK synthetic usage-limit messages. It recognizes
+only `<synthetic>` messages beginning with SDK-owned stable prefixes, not arbitrary model prose. Every
+recognized occurrence is replayed as a typed record at its original transcript position. The latest
+matching message stays active until a later real-model answer proves recovery; older and recovered
+records remain historical typed entries.
+
+For a capable client, replay suppresses duplicate assistant prose and restores typed errors using the
+exact stored Claude text as `title`. Legacy clients receive the original transcript and no typed record.
+
+## Verification
+
+The executable contract lives primarily in `src/tests/acp-agent.test.ts`, under `usage-limit failure
+replay`, `stop reason propagation`, and `model refusal fallback handling`.
+
+```sh
+npm run build
+npm run check
+npm run test:run
+```

examples/simple-client.ts

@@ -0,0 +1,706 @@
+/**
+ * Example: a dead-simple interactive ACP client for this agent.
+ *
+ * This is the "no editor required" way to exercise the agent: it launches
+ * `dist/index.js` as a subprocess, speaks ACP over its stdio using the SDK, and
+ * prints every JSON-RPC message that crosses the wire in both directions. Each
+ * line you type becomes a `session/prompt`; the agent's answer streams back as
+ * `session/update` notifications.
+ *
+ * Every message is preceded by a header line naming its direction:
+ *
+ *   [agent] ◂   inbound  — everything the agent sends us
+ *   [user]  ▸   outbound — everything we send the agent, including our own
+ *                          permission answers and `session/cancel`
+ *
+ * The label and the arrow carry the direction, so it survives NO_COLOR and
+ * redirection to a file (`2> wire.log`). The JSON itself is printed in full,
+ * flush left and undecorated — select it and you have valid JSON on the
+ * clipboard. This exists to show you the protocol, not to summarize it.
+ *
+ * There are four ways for a client to get a message to this agent, and all four
+ * are reachable from the prompt so you can watch what each one looks like on
+ * the wire. Plain text is the first; the rest are `!`-prefixed commands, chosen
+ * so they cannot be confused with the agent's own slash commands (`/compact`
+ * and friends are ordinary prompt text here). `!!` escapes a literal `!`.
+ *
+ *   <text>          `session/prompt`. Typed mid-turn it is *buffered* by this
+ *                   client and sent once the running turn responds.
+ *   !steer <text>   `_session/steering` — injected into the turn that is
+ *                   already running, so it can change course between tool
+ *                   calls. Answers "injected", or "startedNewTurn" if the turn
+ *                   beat us to the finish. An injected reply streams as
+ *                   `session/update` notifications inside that turn, whose
+ *                   `stopReason` waits for it. "startedNewTurn" output belongs
+ *                   to a detached turn no `session/prompt` of ours tracks.
+ *                   See ./steering.ts.
+ *   !queue <text>   `session/prompt` sent mid-turn anyway. The agent advertises
+ *                   `promptQueueing`, so it takes the backlog instead of us —
+ *                   same ordering, different owner.
+ *   !cancel         `session/cancel` for the running turn, as Ctrl-C does.
+ *
+ * Run (build the agent first so `dist/index.js` exists):
+ *
+ *   npm run build
+ *   node examples/simple-client.ts
+ *
+ * or, equivalently, `npm run example:simple-client`.
+ *
+ * To debug the agent itself, pass a port. The agent is then rebuilt with source
+ * maps and started under `--inspect-brk=<port>`, i.e. paused before its first
+ * line, so you can attach (IntelliJ: Run → Attach to Node.js/Chrome; VS Code:
+ * "Attach to Node Process"), set breakpoints in `src/*.ts`, and resume:
+ *
+ *   node examples/simple-client.ts --debug-port=9229
+ *
+ * The client will sit waiting for `initialize` until you attach and resume —
+ * that is expected, ACP has no request timeout.
+ *
+ * (Node < 22.18 needs `node --experimental-strip-types examples/simple-client.ts`.)
+ *
+ * Keys: Enter sends (or buffers), Ctrl-C cancels the running turn (again to
+ * quit), Ctrl-D drains anything buffered and exits. `!help` lists the commands.
+ *
+ * Flags: --debug-port=<port>, --no-build, --help.
+ * Env:   AGENT_ENTRY (default dist/index.js), CWD (default process.cwd()).
+ *
+ * Requires the agent to be authenticated, since it talks to the real model.
+ *
+ * Note: this client does not advertise the `elicitation` capability, so the
+ * agent disables its AskUserQuestion tool instead of asking us to render a
+ * form. That is the one intentional behaviour difference from a full client.
+ */
+import { spawn } from "node:child_process";
+import { once } from "node:events";
+import { existsSync } from "node:fs";
+import path from "node:path";
+import readline from "node:readline";
+import { Readable, Writable } from "node:stream";
+import { fileURLToPath } from "node:url";
+import {
+  PROTOCOL_VERSION,
+  client as acpClient,
+  methods,
+  ndJsonStream,
+} from "@agentclientprotocol/sdk";
+// Type-only: Node's type stripping does not elide value imports, and these two
+// exist only in the .d.ts — importing them normally is a runtime SyntaxError.
+import type { AnyMessage, Stream } from "@agentclientprotocol/sdk";
+
+// ---------------------------------------------------------------- steering
+
+/**
+ * The steering extension (../steering_protocol.md, and ./steering.ts for a
+ * scripted walkthrough). It is not part of ACP proper, so it has no entry in
+ * `methods` and is sent as a raw method name with hand-written types.
+ */
+const STEERING_METHOD = "_session/steering";
+
+type SteeringRequest = {
+  sessionId: string;
+  prompt: Array<{ type: "text"; text: string }>;
+};
+
+/** Both outcomes are successes; they say where the message landed, not whether
+ *  it worked. "startedNewTurn" means the turn finished before we got there. */
+type SteeringResponse = {
+  outcome: "injected" | "startedNewTurn";
+};
+
+// ---------------------------------------------------------------- arguments
+
+const ARGV = process.argv.slice(2);
+
+/** Reads `--name=value` or `--name value`; returns "" for a valueless flag. */
+function flag(name: string): string | undefined {
+  const index = ARGV.findIndex((arg) => arg === `--${name}` || arg.startsWith(`--${name}=`));
+  if (index === -1) return undefined;
+  const [, ...rest] = ARGV[index].split("=");
+  return rest.length > 0 ? rest.join("=") : (ARGV[index + 1] ?? "");
+}
+
+if (ARGV.includes("--help") || ARGV.includes("-h")) {
+  process.stdout.write(
+    [
+      "Usage: node examples/simple-client.ts [--debug-port=<port>] [--no-build]",
+      "",
+      "  --debug-port=<port>  rebuild with source maps and start the agent under",
+      "                       --inspect-brk=<port>, paused until a debugger attaches",
+      "  --no-build           skip the tsc rebuild and use dist/ as-is",
+      "",
+      "Env: AGENT_ENTRY (default dist/index.js), CWD (default process.cwd()).",
+      "",
+    ].join("\n"),
+  );
+  process.exit(0);
+}
+
+// The built agent entry. Rebuilt below unless --no-build is passed.
+const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const AGENT_ENTRY = process.env.AGENT_ENTRY ?? path.join(repoRoot, "dist", "index.js");
+const CWD = process.env.CWD ?? process.cwd();
+const BUILD = !ARGV.includes("--no-build");
+
+const debugPortArg = flag("debug-port");
+const DEBUG_PORT = debugPortArg === undefined ? undefined : Number(debugPortArg);
+if (
+  DEBUG_PORT !== undefined &&
+  (!Number.isInteger(DEBUG_PORT) || DEBUG_PORT < 1 || DEBUG_PORT > 65535)
+) {
+  process.stderr.write(`--debug-port expects a port between 1 and 65535, got "${debugPortArg}"\n`);
+  process.exit(1);
+}
+
+/** Shown by `!help`, and once at startup. */
+const HELP = [
+  "<text>          send it — as a new turn, or buffered until this turn ends",
+  "!steer <text>   inject into the running turn (_session/steering)",
+  "!queue <text>   send session/prompt now and let the agent queue it",
+  "!cancel         session/cancel the running turn (same as Ctrl-C)",
+  "!help           this list; !! sends a line that really starts with '!'",
+];
+
+// How long to wait for a cancelled turn to settle, and for the agent to exit
+// after we close its stdin, before escalating during shutdown.
+const CANCEL_TIMEOUT_MS = 5_000;
+const EXIT_TIMEOUT_MS = 5_000;
+
+// ---------------------------------------------------------------- output
+
+const COLOR = process.stderr.isTTY === true && !process.env.NO_COLOR;
+const paint = (code: string, text: string) => (COLOR ? `\x1b[${code}m${text}\x1b[0m` : text);
+const dim = (text: string) => paint("2", text);
+
+const TTY = process.stdin.isTTY === true && process.stderr.isTTY === true;
+const startedAt = Date.now();
+
+let rl: readline.Interface | null = null;
+let shuttingDown = false;
+let queue: string[] = [];
+// How many `session/prompt` requests are awaiting a response. Usually 0 or 1;
+// `!queue` deliberately drives it higher to exercise the agent's own queueing.
+let inFlight = 0;
+const turnRunning = () => inFlight > 0;
+let cancelRequested = false;
+let lastUpdateKind = "";
+// False until `initialize` returns — an agent still paused under --inspect-brk
+// will never act on stdin EOF, so shutdown skips straight to signalling it.
+let agentReady = false;
+
+/**
+ * The single writer for everything this process prints. It wipes the half-typed
+ * input line, writes the block, then asks readline to redraw its prompt with the
+ * buffer intact — without this, streamed output and typing shred each other.
+ * (One caveat: a soft-wrapped input line leaves a stale fragment behind, since
+ * clearLine only clears the row the cursor is on.)
+ */
+function writeBlock(text: string) {
+  if (TTY) {
+    readline.cursorTo(process.stderr, 0);
+    readline.clearLine(process.stderr, 0);
+  }
+  process.stderr.write(text.endsWith("\n") ? text : `${text}\n`);
+  if (TTY) rl?.prompt(true);
+}
+
+function log(message: string) {
+  writeBlock(`${dim("[client]")} ${message}`);
+}
+
+function refreshPrompt() {
+  if (!rl) return;
+  const queued = queue.length > 0 ? `[${queue.length} queued] ` : "";
+  const running = inFlight > 1 ? `[${inFlight} turns] ` : "";
+  const busy = turnRunning() ? dim(`⋯ ${lastUpdateKind} `) : "";
+  rl.setPrompt(`${busy}${running}${queued}› `);
+  if (TTY) rl.prompt(true);
+}
+
+const delay = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms));
+
+// ---------------------------------------------------------------- wire log
+
+/** A permissive view of the JSON-RPC union, purely for the summary line. */
+type WireMessage = {
+  id?: string | number | null;
+  method?: string;
+  params?: { update?: { sessionUpdate?: string } };
+  result?: { stopReason?: string };
+  error?: { code: number; message: string };
+};
+
+/** One-line summary: method (plus session update kind), or which reply this is. */
+function describe(message: AnyMessage): string {
+  const wire = message as WireMessage;
+  const id = wire.id === undefined || wire.id === null ? "" : ` #${wire.id}`;
+  if (wire.method !== undefined) {
+    const kind = wire.params?.update?.sessionUpdate;
+    return `${wire.method}${kind ? ` · ${kind}` : ""}${id}`;
+  }
+  if (wire.error !== undefined) {
+    return `error${id} · ${wire.error.code} ${wire.error.message}`;
+  }
+  const stopReason = wire.result?.stopReason;
+  return `result${id}${stopReason ? ` · ${stopReason}` : ""}`;
+}
+
+/**
+ * Prints one JSON-RPC message. The SDK exposes no logging hook, so this is
+ * called from a stream tap (see `tapStream`) that sits between the SDK and the
+ * transport — what you see is exactly what is written to / read from the pipe.
+ */
+function logMessage(direction: "agent" | "user", message: AnyMessage) {
+  const inbound = direction === "agent";
+  const color = inbound ? "36" : "35";
+  const elapsed = ((Date.now() - startedAt) / 1000).toFixed(3);
+  const header = [
+    dim(`+${elapsed}s`),
+    paint(`1;${color}`, inbound ? "[agent]" : "[user] "),
+    paint(color, inbound ? "◂" : "▸"),
+    dim(describe(message)),
+  ].join(" ");
+  // The body is printed flush left and unadorned so that selecting it in the
+  // terminal yields valid JSON you can paste straight into a tool.
+  writeBlock(`${header}\n${JSON.stringify(message, null, 2)}`);
+}
+
+/**
+ * Wraps a transport stream so every message is logged post-parse/pre-stringify.
+ * A TransformStream per direction is the only complete interposition point: the
+ * SDK reads inbound with a single reader and takes a fresh writer per outbound
+ * message, and both survive being handed a transform.
+ */
+function tapStream(inner: Stream): Stream {
+  const inbound = new TransformStream<AnyMessage, AnyMessage>({
+    transform(message, controller) {
+      logMessage("agent", message);
+      controller.enqueue(message);
+    },
+  });
+  const outbound = new TransformStream<AnyMessage, AnyMessage>({
+    transform(message, controller) {
+      logMessage("user", message);
+      controller.enqueue(message);
+    },
+  });
+  // The SDK never closes its writable, so this pipe only settles on failure —
+  // typically the agent died and its stdin is gone. Teardown handles the rest;
+  // without the catch this would be an unhandled rejection.
+  outbound.readable.pipeTo(inner.writable).catch((err) => {
+    if (!shuttingDown) log(`transport write failed: ${err}`);
+  });
+  return { readable: inner.readable.pipeThrough(inbound), writable: outbound.writable };
+}
+
+// ---------------------------------------------------------------- build
+
+/** Runs the repo's tsc, sending its diagnostics to our stderr. */
+async function build(sourceMaps: boolean) {
+  const localTsc = path.join(repoRoot, "node_modules", "typescript", "bin", "tsc");
+  const useLocal = existsSync(localTsc);
+  const args = sourceMaps ? ["--sourceMap"] : [];
+  log(`building agent (tsc${sourceMaps ? " --sourceMap" : ""}) …`);
+
+  const child = useLocal
+    ? spawn(process.execPath, [localTsc, ...args], { cwd: repoRoot, stdio: ["ignore", 2, 2] })
+    : spawn(process.platform === "win32" ? "npx.cmd" : "npx", ["tsc", ...args], {
+        cwd: repoRoot,
+        stdio: ["ignore", 2, 2],
+      });
+
+  const [code] = (await once(child, "exit")) as [number | null];
+  if (code !== 0) {
+    log(`build failed (tsc exit ${code}) — fix the errors above, or pass --no-build`);
+    process.exit(1);
+  }
+}
+
+// ---------------------------------------------------------------- main
+
+async function main() {
+  if (BUILD) {
+    await build(DEBUG_PORT !== undefined);
+  } else if (!existsSync(AGENT_ENTRY)) {
+    log(`${AGENT_ENTRY} not found — run \`npm run build\` first, or unset --no-build`);
+    process.exit(1);
+  }
+
+  // An ACP client launches the agent as a subprocess and speaks JSON-RPC over
+  // its stdin/stdout. Its stderr is piped rather than inherited so that agent
+  // logs go through writeBlock() and don't corrupt the readline input line.
+  const nodeArgs =
+    DEBUG_PORT === undefined ? [AGENT_ENTRY] : [`--inspect-brk=${DEBUG_PORT}`, AGENT_ENTRY];
+  const child = spawn(process.execPath, nodeArgs, {
+    cwd: repoRoot,
+    stdio: ["pipe", "pipe", "pipe"],
+    env: process.env,
+  });
+  child.on("error", (err) => {
+    log(`failed to spawn agent (${AGENT_ENTRY}): ${err}`);
+    process.exit(1);
+  });
+  // A write racing the agent's exit surfaces as an unhandled 'error' event that
+  // would take this client down with it.
+  child.stdin?.on("error", (err: NodeJS.ErrnoException) => {
+    if (err.code !== "EPIPE") log(`agent stdin error: ${err}`);
+  });
+  child.stdout?.on("error", () => {});
+  process.stderr.on("error", () => {});
+
+  pumpAgentStderr(child);
+
+  child.on("exit", (code, signal) => {
+    if (!shuttingDown) log(`agent exited (code ${code}, signal ${signal})`);
+  });
+
+  const stream = tapStream(
+    ndJsonStream(
+      Writable.toWeb(child.stdin!) as WritableStream<Uint8Array>,
+      Readable.toWeb(child.stdout!) as unknown as ReadableStream<Uint8Array>,
+    ),
+  );
+
+  const connection = acpClient({ name: "simple-client" })
+    // The tap already prints every update; this handler exists so the prompt line
+    // can show what the agent is currently doing.
+    .onNotification(methods.client.session.update, (ctx) => {
+      lastUpdateKind = ctx.params.update.sessionUpdate;
+    })
+    // Auto-approve, chosen by `kind` and never by a hard-coded optionId: for
+    // ExitPlanMode this agent uses permission-*mode* names as option ids
+    // (auto / acceptEdits / default / plan / bypassPermissions).
+    .onRequest(methods.client.session.requestPermission, (ctx) => {
+      const options = ctx.params.options;
+      const option = options.find((o) => o.kind === "allow_once") ?? options[0];
+      if (!option) return { outcome: { outcome: "cancelled" } };
+      log(`auto-approving permission: ${option.name} (${option.kind}/${option.optionId})`);
+      return { outcome: { outcome: "selected", optionId: option.optionId } };
+    })
+    // Minimal file-system stubs. This agent performs its own file I/O inside the
+    // Claude Agent SDK subprocess and never calls these today.
+    .onRequest(methods.client.fs.readTextFile, () => ({ content: "" }))
+    .onRequest(methods.client.fs.writeTextFile, () => ({}))
+    .connect(stream);
+
+  const agent = connection.agent;
+
+  // Signals are wired up *before* the first request. Under --inspect-brk the
+  // wait below is unbounded, and a client that dies without running shutdown()
+  // orphans a paused agent still holding the debug port.
+  const onInterrupt = () => {
+    if (turnRunning() && !cancelRequested) {
+      cancelRequested = true;
+      const dropped = queue.length;
+      queue = [];
+      // A notification, not a request: every turn in flight settles through its
+      // own session/prompt response, normally with stopReason "cancelled".
+      void agent.notify(methods.agent.session.cancel, { sessionId });
+      log(`sent session/cancel${dropped > 0 ? `, dropped ${dropped} queued line(s)` : ""}`);
+      refreshPrompt();
+      return;
+    }
+    void shutdown(turnRunning() ? "^C while cancelling" : "^C");
+  };
+  // In terminal mode readline puts stdin in raw mode and owns ^C, so this only
+  // ever fires for an explicit `kill -INT`; with piped stdin it is the ^C path.
+  process.on("SIGINT", onInterrupt);
+  process.on("SIGTERM", () => void shutdown("SIGTERM"));
+
+  // 1. Initialize. Under --inspect-brk the agent is paused before it reads a
+  //    single byte, so this request stays unanswered until a debugger attaches
+  //    and resumes it. ACP has no request timeout, so waiting is safe; the
+  //    interval below just keeps the terminal from looking dead.
+  let nudge: NodeJS.Timeout | undefined;
+  if (DEBUG_PORT !== undefined) {
+    log(`agent is PAUSED before its first line (--inspect-brk=${DEBUG_PORT})`);
+    log(`attach a debugger to port ${DEBUG_PORT} and resume it — breakpoints go in src/*.ts`);
+    nudge = setInterval(
+      () => log(`still waiting for a debugger on port ${DEBUG_PORT} … (Ctrl-C to give up)`),
+      10_000,
+    );
+  }
+  let init;
+  try {
+    init = await agent.request(methods.agent.initialize, {
+      protocolVersion: PROTOCOL_VERSION,
+      clientCapabilities: {
+        fs: { readTextFile: true, writeTextFile: true },
+        terminal: false,
+      },
+    });
+  } finally {
+    if (nudge) clearInterval(nudge);
+  }
+  agentReady = true;
+  log(`connected to ${init.agentInfo?.name ?? "agent"} ${init.agentInfo?.version ?? ""}`.trim());
+
+  // Steering is advertised at the TOP-LEVEL `_meta` of the initialize result —
+  // a sibling of `agentCapabilities`, not nested inside it. Prompt queueing is
+  // a Claude-specific capability flag and does live inside.
+  const initMeta = init._meta as { steering?: { supported?: boolean } } | null | undefined;
+  const steeringSupported = initMeta?.steering?.supported === true;
+  const queueMeta = init.agentCapabilities?._meta as
+    { claudeCode?: { promptQueueing?: boolean } } | null | undefined;
+  log(
+    `agent supports: steering=${steeringSupported} ` +
+      `promptQueueing=${queueMeta?.claudeCode?.promptQueueing === true}`,
+  );
+
+  // 2. Open a session.
+  let sessionId: string;
+  try {
+    const session = await agent.request(methods.agent.session.new, { cwd: CWD, mcpServers: [] });
+    sessionId = session.sessionId;
+  } catch (err) {
+    log(`session/new failed: ${err}`);
+    log("if this is an auth error, log in first: node dist/index.js --cli auth login");
+    await shutdown("session/new failed", 1);
+    return;
+  }
+  log(`session ${sessionId} in ${CWD}`);
+
+  // 3. Turns. There are four ways to get a message to the agent, and the client
+  //    can drive all of them (see `handleCommand`); plain text uses the first.
+  //
+  //      session/prompt      a new turn, or — for text typed mid-turn — one
+  //                          buffered here and sent when the turn responds
+  //      session/prompt      sent mid-turn anyway, so the *agent* queues it
+  //        (!queue)          (it advertises `_meta.claudeCode.promptQueueing`)
+  //      _session/steering   injected into the turn that is already running
+  //        (!steer)
+  //      session/cancel      abandon the running turn
+  //        (!cancel, ^C)
+  let draining = false;
+
+  /** One `session/prompt` round-trip. Several may be in flight at once when
+   *  `!queue` is used; the agent runs them in order. */
+  async function sendPrompt(text: string) {
+    inFlight += 1;
+    cancelRequested = false;
+    refreshPrompt();
+    try {
+      const result = await agent.request(methods.agent.session.prompt, {
+        sessionId,
+        prompt: [{ type: "text", text }],
+      });
+      log(`turn ended: ${result.stopReason}`);
+    } catch (err) {
+      // The error response itself was already printed by the tap; this is
+      // the human-readable "your prompt did not run".
+      log(`prompt failed: ${err}`);
+      if (connection.signal.aborted) queue = [];
+    } finally {
+      inFlight -= 1;
+      refreshPrompt();
+      exitWhenIdle();
+    }
+  }
+
+  /** Sends the buffered lines one turn at a time, oldest first. */
+  async function drain() {
+    if (draining) return;
+    draining = true;
+    try {
+      while (queue.length > 0 && !shuttingDown) {
+        await sendPrompt(queue.shift()!);
+        if (connection.signal.aborted) break;
+      }
+    } finally {
+      draining = false;
+      refreshPrompt();
+      exitWhenIdle();
+    }
+  }
+
+  /** A piped stdin ends; exiting has to wait for the work already handed out. */
+  function exitWhenIdle() {
+    if (inputClosed && !draining && queue.length === 0 && inFlight === 0) {
+      void shutdown("input closed, queue drained");
+    }
+  }
+
+  /**
+   * Client-side commands, prefixed with `!` so they cannot collide with the
+   * agent's own slash commands (`/compact` and friends, which are just prompt
+   * text as far as this client is concerned). `!!` escapes a literal `!`.
+   */
+  function handleCommand(line: string) {
+    const word = line.split(/\s+/)[0];
+    const text = line.slice(word.length).trim();
+    switch (word) {
+      case "!steer":
+        if (text.length === 0) {
+          log("usage: !steer <message> — injects into the turn that is running");
+          break;
+        }
+        if (!steeringSupported) log("agent did not advertise steering; trying anyway");
+        void steer(text);
+        break;
+      case "!queue":
+        if (text.length === 0) {
+          log("usage: !queue <message> — sends session/prompt now, agent queues it");
+          break;
+        }
+        void sendPrompt(text);
+        break;
+      case "!cancel":
+        if (!turnRunning()) {
+          log("nothing to cancel");
+          break;
+        }
+        onInterrupt();
+        break;
+      case "!help":
+        for (const entry of HELP) log(entry);
+        break;
+      default:
+        log(`unknown command ${word} — try !help`);
+        break;
+    }
+    refreshPrompt();
+  }
+
+  /** `_session/steering`: deliver a message to the turn already in progress. */
+  async function steer(text: string) {
+    const params: SteeringRequest = { sessionId, prompt: [{ type: "text", text }] };
+    try {
+      const result = await agent.request<SteeringResponse>(STEERING_METHOD, params);
+      // Either way the steered message's own output arrives as `session/update`
+      // notifications, not in this response. When injected, it lands inside the
+      // turn we steered, whose `stopReason` waits for it.
+      log(
+        result.outcome === "injected"
+          ? "steer outcome: injected into the running turn"
+          : "steer outcome: startedNewTurn — the turn had already finished, so the " +
+              "agent began a new one that no session/prompt of ours is tracking",
+      );
+    } catch (err) {
+      log(`steer rejected: ${err}`);
+    }
+  }
+
+  let inputClosed = false;
+  let steerHinted = false;
+
+  rl = readline.createInterface({
+    input: process.stdin,
+    output: process.stderr,
+    terminal: TTY,
+    crlfDelay: Infinity,
+    historySize: 200,
+  });
+
+  rl.on("line", (raw) => {
+    const line = raw.trim();
+    if (line.length === 0 || shuttingDown) {
+      refreshPrompt();
+      return;
+    }
+    if (line.startsWith("!") && !line.startsWith("!!")) {
+      handleCommand(line);
+      return;
+    }
+    // "!!steer …" is how you send text that begins with the command prefix.
+    queue.push(line.startsWith("!!") ? line.slice(1) : line);
+    if (turnRunning()) {
+      log(`buffered — will send when this turn ends (${queue.length} queued)`);
+      if (!steerHinted) {
+        steerHinted = true;
+        log("…or use !steer <text> to inject into the running turn instead");
+      }
+    }
+    refreshPrompt();
+    void drain();
+  });
+
+  rl.on("SIGINT", onInterrupt);
+
+  rl.on("close", () => {
+    inputClosed = true;
+    exitWhenIdle();
+  });
+
+  void connection.closed.then(() => {
+    if (!shuttingDown) void shutdown("connection closed");
+  });
+
+  for (const entry of HELP) log(entry);
+  log("Enter sends, Ctrl-C cancels a turn, Ctrl-D exits");
+  refreshPrompt();
+
+  /**
+   * Order matters here. The agent exits cleanly on stdin EOF (src/index.ts wires
+   * `connection.closed` to `agent.dispose()`), whereas killing it skips disposal
+   * and can orphan the Claude Agent SDK subprocess. Closing our connection first
+   * would cancel the reader on the agent's stdout and make it die of EPIPE
+   * mid-write, so that comes last.
+   */
+  async function shutdown(reason: string, exitCode = 0) {
+    if (shuttingDown) return;
+    shuttingDown = true;
+    log(`shutting down (${reason})`);
+    queue = [];
+    rl?.removeAllListeners("close");
+    rl?.close();
+
+    if (turnRunning()) {
+      if (!cancelRequested) {
+        try {
+          await agent.notify(methods.agent.session.cancel, { sessionId });
+        } catch {
+          // The connection may already be gone; teardown continues regardless.
+        }
+      }
+      const deadline = Date.now() + CANCEL_TIMEOUT_MS;
+      while (turnRunning() && Date.now() < deadline) await delay(50);
+    }
+
+    child.stdin?.end();
+    const exited = await Promise.race([
+      once(child, "exit").then(() => true),
+      delay(agentReady ? EXIT_TIMEOUT_MS : 250).then(() => false),
+    ]);
+    if (!exited) {
+      log("agent did not exit on stdin EOF; sending SIGTERM");
+      child.kill("SIGTERM");
+      const stopped = await Promise.race([
+        once(child, "exit").then(() => true),
+        delay(2_000).then(() => false),
+      ]);
+      if (!stopped) child.kill("SIGKILL");
+    }
+
+    connection.close();
+    process.exit(exitCode);
+  }
+}
+
+/** Streams the agent's stderr through writeBlock, flagging inspector messages. */
+function pumpAgentStderr(child: ReturnType<typeof spawn>) {
+  let buffered = "";
+  child.stderr?.setEncoding("utf8");
+  child.stderr?.on("data", (chunk: string) => {
+    buffered += chunk;
+    const lines = buffered.split("\n");
+    buffered = lines.pop() ?? "";
+    for (const line of lines) {
+      if (line.length === 0) continue;
+      if (line.includes("Debugger listening on")) {
+        writeBlock(paint("1;33", `[agent] ${line.trim()}`));
+      } else if (line.includes("address already in use")) {
+        writeBlock(paint("1;31", `[agent] ${line.trim()}`));
+        log("that inspector port is taken — pass a different --debug-port");
+      } else {
+        writeBlock(dim(`[agent:stderr] ${line}`));
+      }
+    }
+  });
+}
+
+main().catch((err) => {
+  // Tearing down rejects whatever request main() is awaiting; that is the
+  // teardown finishing its job, not a failure, and shutdown() owns the exit.
+  if (shuttingDown) return;
+  log(`fatal: ${err?.stack ?? err}`);
+  process.exit(1);
+});

examples/steering.ts

@@ -8,18 +8,18 @@
  * agent can adapt immediately (it shines in multi-step / tool-using turns,
  * where the message slots in between tool calls).
  *
- * The wire protocol (see ../steering_protocol.md) has three moving parts:
+ * The wire protocol has three moving parts:
  *
  *   1. The agent advertises support in its `initialize` response, at the
- *      top-level `_meta.steering.supported` (a sibling of `agentCapabilities`).
+ *      top-level `_meta.steering` (a sibling of `agentCapabilities`).
  *   2. The client calls the `_session/steering` request with `{ sessionId,
  *      prompt }` while a turn is running.
  *   3. The agent replies with an `outcome`:
  *        - "injected"       the message joined the running turn;
- *        - "startedNewTurn" the turn had already finished (an unavoidable race),
- *                           so the message began a fresh turn instead.
- *      Both are success outcomes — the message is never dropped and the race is
- *      never surfaced as an error.
+ *        - "startedNewTurn" the turn had already finished and the legacy
+ *                           detached fallback was used;
+ *        - "promptRequired" the turn had already finished, but this request
+ *                           explicitly opted into Host-owned prompt delivery.
  *
  * This example launches the agent as a subprocess, starts a deliberately
  * long-running prompt, and — as soon as the agent begins streaming — injects a
@@ -40,7 +40,13 @@ import { spawn } from "node:child_process";
 import { Readable, Writable } from "node:stream";
 import { fileURLToPath } from "node:url";
 import path from "node:path";
-import { client as acpClient, methods, ndJsonStream } from "@agentclientprotocol/sdk";
+import {
+  client as acpClient,
+  methods,
+  ndJsonStream,
+  type PromptRequest,
+  type PromptResponse,
+} from "@agentclientprotocol/sdk";
 
 /** The steering extension method, per the ACP steering wire protocol. */
 const STEERING_METHOD = "_session/steering";
@@ -50,12 +56,22 @@ const STEERING_METHOD = "_session/steering";
 type SteeringRequest = {
   sessionId: string;
   prompt: Array<{ type: "text"; text: string }>;
+  _meta?: { steering?: { idleBehavior?: "promptRequired" } };
 };
 
-/** Result of a `_session/steering` request. Both values are successes: they
- *  tell the client where the message landed, not whether it succeeded. */
-type SteeringResponse = {
-  outcome: "injected" | "startedNewTurn";
+/** Result of a `_session/steering` request. `injected` means the message joined
+ *  the running turn; `promptRequired` means the turn had already settled, so the
+ *  message was NOT consumed and must be (re)sent through a normal
+ *  `session/prompt`. Both are successes. */
+type SteeringResponse =
+  | { outcome: "injected" }
+  | { outcome: "startedNewTurn" }
+  | { outcome: "promptRequired"; reason: "noRunningTurn" };
+
+/** The existing steering capability advertised at the top-level `_meta.steering`
+ *  of the `initialize` result. The idle behavior is selected per request. */
+type SteeringCapability = {
+  supported?: boolean;
 };
 
 // The built agent entry. Run `npm run build` first so this exists.
@@ -87,105 +103,119 @@ async function main() {
   });
   child.on("error", (err) => {
     log(`failed to spawn agent (${AGENT_ENTRY}): ${err}`);
-    process.exit(1);
   });
 
-  const stream = ndJsonStream(
-    Writable.toWeb(child.stdin!) as WritableStream<Uint8Array>,
-    Readable.toWeb(child.stdout!) as unknown as ReadableStream<Uint8Array>,
-  );
-
-  // Resolves the first time the agent streams assistant text — our signal that
-  // the turn is genuinely underway and therefore steerable.
-  let signalFirstOutput = () => {};
-  const firstOutput = new Promise<void>((resolve) => (signalFirstOutput = resolve));
-
-  const connection = acpClient({ name: "steering-example" })
-    .onNotification(methods.client.session.update, (ctx) => {
-      const update = ctx.params.update;
-      if (update.sessionUpdate === "agent_message_chunk" && update.content.type === "text") {
-        process.stdout.write(update.content.text);
-        signalFirstOutput();
-      }
-    })
-    // Auto-approve permission prompts so the turn is never blocked on us.
-    .onRequest(methods.client.session.requestPermission, (ctx) => {
-      const options = ctx.params.options;
-      const option = options.find((o) => o.kind === "allow_once") ?? options[0];
-      return { outcome: { outcome: "selected", optionId: option.optionId } };
-    })
-    // Minimal file-system stubs; the example prompts don't touch files.
-    .onRequest(methods.client.fs.readTextFile, () => ({ content: "" }))
-    .onRequest(methods.client.fs.writeTextFile, () => ({}))
-    .connect(stream);
-
-  const agent = connection.agent;
-
-  // 1. Initialize and confirm the agent advertises steering. Per the wire
-  //    protocol the capability lives at the TOP-LEVEL `_meta` of the initialize
-  //    result — a sibling of `agentCapabilities`, not nested inside it.
-  const init = await agent.request(methods.agent.initialize, {
-    protocolVersion: 1,
-    clientCapabilities: { fs: { readTextFile: true, writeTextFile: true } },
-  });
-  const meta = init._meta as { steering?: { supported?: boolean } } | null | undefined;
-  const steeringSupported = meta?.steering?.supported === true;
-  log(`agent advertises steering: ${steeringSupported}`);
-  if (!steeringSupported) {
-    log("agent does not advertise steering; the steering request may be rejected.");
-  }
-
-  // 2. Open a session.
-  const { sessionId } = await agent.request(methods.agent.session.new, {
-    cwd: CWD,
-    mcpServers: [],
-  });
-  log(`session: ${sessionId}`);
-
-  // 3. Start a long turn, but DON'T await it yet — we need it in flight so we
-  //    can steer it. Its output streams through the notification handler above.
-  log(`prompt: ${PROMPT}`);
-  process.stdout.write("\n----- agent output -----\n");
-  const turn = agent.request(methods.agent.session.prompt, {
-    sessionId,
-    prompt: [{ type: "text", text: PROMPT }],
-  });
-
-  // 4. Once the turn is producing output, inject the follow-up. Wait for the
-  //    first streamed chunk (with a fallback) plus a beat, so the steer clearly
-  //    lands mid-turn.
-  await Promise.race([firstOutput, delay(5000)]);
-  await delay(1000);
-
-  process.stdout.write("\n");
-  log(`steer: ${STEER}`);
-  const steerRequest: SteeringRequest = {
-    sessionId,
-    prompt: [{ type: "text", text: STEER }],
-  };
   try {
-    const result = await agent.request<SteeringResponse>(STEERING_METHOD, steerRequest);
-    log(`steer outcome: ${result.outcome}`);
-  } catch (err) {
-    log(`steer rejected: ${err}`);
+    const stream = ndJsonStream(
+      Writable.toWeb(child.stdin!) as WritableStream<Uint8Array>,
+      Readable.toWeb(child.stdout!) as unknown as ReadableStream<Uint8Array>,
+    );
+
+    // Resolves the first time the agent streams assistant text — our signal that
+    // the turn is genuinely underway and therefore steerable.
+    let signalFirstOutput = () => {};
+    const firstOutput = new Promise<void>((resolve) => (signalFirstOutput = resolve));
+
+    const connection = acpClient({ name: "steering-example" })
+      .onNotification(methods.client.session.update, (ctx) => {
+        const update = ctx.params.update;
+        if (update.sessionUpdate === "agent_message_chunk" && update.content.type === "text") {
+          process.stdout.write(update.content.text);
+          signalFirstOutput();
+        }
+      })
+      // Auto-approve permission prompts so the turn is never blocked on us.
+      .onRequest(methods.client.session.requestPermission, (ctx) => {
+        const options = ctx.params.options;
+        const option = options.find((o) => o.kind === "allow_once") ?? options[0];
+        return { outcome: { outcome: "selected", optionId: option.optionId } };
+      })
+      // Minimal file-system stubs; the example prompts don't touch files.
+      .onRequest(methods.client.fs.readTextFile, () => ({ content: "" }))
+      .onRequest(methods.client.fs.writeTextFile, () => ({}))
+      .connect(stream);
+
+    try {
+      const agent = connection.agent;
+
+      // 1. Initialize and confirm the agent advertises steering. Per the wire
+      //    protocol the capability lives at the TOP-LEVEL `_meta` of the initialize
+      //    result — a sibling of `agentCapabilities`, not nested inside it.
+      const init = await agent.request(methods.agent.initialize, {
+        protocolVersion: 1,
+        clientCapabilities: { fs: { readTextFile: true, writeTextFile: true } },
+      });
+      const steering = (init._meta as { steering?: SteeringCapability } | null | undefined)
+        ?.steering;
+      if (steering?.supported !== true) {
+        throw new Error("agent does not advertise steering support");
+      }
+      log("agent advertises steering support");
+
+      // 2. Open a session.
+      const { sessionId } = await agent.request(methods.agent.session.new, {
+        cwd: CWD,
+        mcpServers: [],
+      });
+      log(`session: ${sessionId}`);
+
+      // 3. Start a long turn, but DON'T await it yet — we need it in flight so we
+      //    can steer it. Its output streams through the notification handler above.
+      log(`prompt: ${PROMPT}`);
+      process.stdout.write("\n----- agent output -----\n");
+      const turn = agent.request(methods.agent.session.prompt, {
+        sessionId,
+        prompt: [{ type: "text", text: PROMPT }],
+      });
+
+      // 4. Once the turn is producing output, inject the follow-up. Wait for the
+      //    first streamed chunk (with a fallback) plus a beat, so the steer clearly
+      //    lands mid-turn.
+      await Promise.race([firstOutput, delay(5000)]);
+      await delay(1000);
+
+      process.stdout.write("\n");
+      log(`steer: ${STEER}`);
+      const steerRequest: SteeringRequest = {
+        sessionId,
+        prompt: [{ type: "text", text: STEER }],
+        // Opt into the host-owned idle fallback. Without this request metadata,
+        // the Adapter preserves its legacy `startedNewTurn` behavior.
+        _meta: { steering: { idleBehavior: "promptRequired" } },
+      };
+      const result = await agent.request<SteeringResponse>(STEERING_METHOD, steerRequest);
+      log(`steer outcome: ${result.outcome}`);
+
+      if (result.outcome === "promptRequired") {
+        // The target turn already settled, so steering did not consume the message.
+        // Start a normal session/prompt on the same session to deliver it — that
+        // request owns the continuation's updates and terminal response.
+        log(`steer fallback: ${result.reason}; starting a normal session/prompt`);
+        const continuationRequest: PromptRequest = {
+          sessionId: steerRequest.sessionId,
+          prompt: steerRequest.prompt,
+        };
+        const continuation = await agent.request<PromptResponse, PromptRequest>(
+          methods.agent.session.prompt,
+          continuationRequest,
+        );
+        log(`continuation stopReason: ${continuation.stopReason}`);
+      }
+
+      // 5. Await the original turn. With outcome "injected" the steer already
+      //    reshaped the output above; the promptRequired branch owns its own turn.
+      const response = await turn;
+      log(`original turn stopReason: ${response.stopReason}`);
+      process.stdout.write("\n----- end of agent output -----\n");
+    } finally {
+      connection.close();
+    }
+  } finally {
+    child.kill();
   }
-
-  // 5. Await the turn. With outcome "injected" the steer already reshaped the
-  //    output above; with "startedNewTurn" the follow-up runs as a fresh turn
-  //    that may still be streaming, so linger briefly to capture it.
-  const response = await turn.catch((err: unknown) => {
-    log(`turn error: ${err}`);
-    return undefined;
-  });
-  if (response) log(`turn stopReason: ${response.stopReason}`);
-  await delay(3000);
-  process.stdout.write("\n----- end of agent output -----\n");
-
-  connection.close();
-  child.kill();
 }
 
 main().catch((err) => {
   log(`fatal: ${err?.stack ?? err}`);
-  process.exit(1);
+  process.exitCode = 1;
 });

package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.61.0",
+  "version": "0.69.0",
   "description": "An ACP-compatible coding agent powered by the Claude Agent SDK (TypeScript)",
   "main": "dist/lib.js",
   "types": "dist/lib.d.ts",
@@ -29,11 +29,13 @@
     "build": "tsc",
     "start": "node dist/index.js",
     "dev": "npm run build && npm run start",
+    "example:simple-client": "node --experimental-strip-types --disable-warning=ExperimentalWarning examples/simple-client.ts",
     "lint": "eslint src --ext .ts",
     "lint:fix": "eslint src --ext .ts --fix",
     "format": "prettier --write .",
     "format:check": "prettier --check .",
     "check": "npm run lint && npm run format:check",
+    "release:preflight": "bash scripts/release-preflight.sh",
     "test": "vitest",
     "test:integration": "RUN_INTEGRATION_TESTS=true vitest run",
     "test:run": "vitest run",
@@ -64,19 +66,19 @@
   },
   "dependencies": {
     "@agentclientprotocol/sdk": "1.3.0",
-    "@anthropic-ai/claude-agent-sdk": "0.3.217",
+    "@anthropic-ai/claude-agent-sdk": "0.3.232",
     "zod": "^3.25.0 || ^4.0.0"
   },
   "devDependencies": {
-    "@anthropic-ai/sdk": "0.112.5",
+    "@anthropic-ai/sdk": "0.117.1",
     "@eslint/js": "10.0.1",
     "@tsconfig/node22": "22.0.5",
-    "@types/node": "26.1.1",
-    "@typescript-eslint/eslint-plugin": "8.65.0",
-    "@typescript-eslint/parser": "8.65.0",
-    "eslint": "10.7.0",
+    "@types/node": "26.2.0",
+    "@typescript-eslint/eslint-plugin": "8.67.0",
+    "@typescript-eslint/parser": "8.67.0",
+    "eslint": "10.8.1",
     "eslint-config-prettier": "10.1.8",
-    "globals": "17.7.0",
+    "globals": "17.11.0",
     "prettier": "3.9.6",
     "ts-node": "10.9.2",
     "typescript": "6.0.3",

release-please-config.json

@@ -1,12 +1,12 @@
 {
   "bump-minor-pre-major": true,
-  "bump-patch-for-minor-pre-major": true,
+  "include-component-in-tag": false,
   "packages": {
     ".": {
       "changelog-path": "CHANGELOG.md",
       "release-type": "node",
       "bump-minor-pre-major": true,
-      "bump-patch-for-minor-pre-major": true
+      "include-component-in-tag": false
     }
   },
   "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json"

scripts/release-preflight.sh

@@ -0,0 +1,124 @@
+#!/usr/bin/env bash
+#
+# Preflight checks for a release.
+#
+# release-please decides what the next version is; this script only verifies the
+# repository is in a state where merging the open release PR produces a correct
+# release. Merging main needs no review, so these checks are the only thing
+# standing between a mistake and a published package — keep them as code rather
+# than as a list someone has to remember. See docs/RELEASES.md.
+#
+# Requires an authenticated GitHub CLI. Nothing else: gh has a jq engine builtin.
+
+set -euo pipefail
+
+PENDING_LABEL="autorelease: pending"
+
+fail() {
+  printf 'FAIL  %s\n' "$1" >&2
+  exit 1
+}
+
+pass() {
+  printf 'ok    %s\n' "$1"
+}
+
+command -v gh >/dev/null 2>&1 ||
+  fail "GitHub CLI (gh) is not installed."
+gh auth status >/dev/null 2>&1 ||
+  fail "GitHub CLI is not authenticated. Run 'gh auth login'."
+
+repo=$(gh repo view --json nameWithOwner --jq .nameWithOwner 2>/dev/null) ||
+  fail "cannot work out which GitHub repository this is. Run from a checkout."
+
+# A merged release PR that still carries the pending label means release-please
+# never tagged it. In that state it refuses to open any new release PR at all,
+# so every later release stalls silently until it is recovered by hand.
+stuck=$(gh pr list --repo "$repo" --state merged --label "$PENDING_LABEL" \
+  --json number --jq 'map("#\(.number)") | join(", ")')
+[ -z "$stuck" ] ||
+  fail "merged release PR still labelled '$PENDING_LABEL': $stuck.
+      release-please is jammed and will not open new release PRs.
+      See docs/RELEASES.md, 'Recovering a stalled release'."
+pass "no untagged merged release PR"
+
+rows=$(gh pr list --repo "$repo" --state open --label "$PENDING_LABEL" \
+  --json number,title,headRefName --jq '.[] | [.number, .headRefName, .title] | @tsv')
+count=$(printf '%s\n' "$rows" | grep -c . || true)
+
+if [ "$count" -eq 0 ]; then
+  fail "no open release PR.
+      Nothing has landed since the last tag that release-please puts in a
+      changelog, so there is nothing to release. Land a feat/fix/perf/revert/docs
+      change first, or check that the Publish and Release workflow is running."
+fi
+if [ "$count" -gt 1 ]; then
+  fail "$count open release PRs, expected exactly one:
+$rows"
+fi
+IFS=$(printf '\t') read -r pr_number head_ref pr_title <<EOF
+$rows
+EOF
+pass "one open release PR: #$pr_number ($pr_title)"
+
+# release-please reads the version to tag from the PR title, while npm publishes
+# whatever package.json says. If those disagree the tag and the published package
+# describe different releases, so check all three sources against each other.
+# The version is the last field, not everything after 'release': release-please
+# writes the component into the title as 'release <component> X.Y.Z' whenever it
+# is configured to tag with one.
+title_version=${pr_title##* }
+case $title_version in
+[0-9]*.[0-9]*.[0-9]*) ;;
+*) fail "cannot read a version from PR title '$pr_title'." ;;
+esac
+pkg_version=$(gh api "repos/$repo/contents/package.json?ref=$head_ref" \
+  -H "Accept: application/vnd.github.raw" --jq .version)
+manifest_version=$(gh api "repos/$repo/contents/.release-please-manifest.json?ref=$head_ref" \
+  -H "Accept: application/vnd.github.raw" --jq '."."')
+
+if [ "$title_version" != "$pkg_version" ] || [ "$title_version" != "$manifest_version" ]; then
+  fail "version mismatch on #$pr_number:
+      PR title                      $title_version
+      package.json                  $pkg_version
+      .release-please-manifest.json $manifest_version"
+fi
+pass "version agrees across PR title, package.json and manifest: $title_version"
+
+# The tag comes from the config, not from the PR title. With
+# include-component-in-tag left on, release-please tags <component>-vX.Y.Z, which
+# breaks the vX.Y.Z scheme the rest of this script and docs/RELEASES.md rely on,
+# and makes it rewrite the whole history into the changelog because no tag under
+# that scheme exists yet. The compare link it writes into the PR body names the
+# tags it is going to use, so check those rather than trusting the config.
+compare_tag=$(gh pr view "$pr_number" --repo "$repo" --json body --jq '
+  .body | capture("/compare/[^)]*[.][.][.](?<to>[^)\\s]+)").to // ""' 2>/dev/null || true)
+case $compare_tag in
+"" | "v$title_version") ;;
+*) fail "release-please is going to tag '$compare_tag', not 'v$title_version'.
+      Every previous release is tagged vX.Y.Z, and the changelog for #$pr_number
+      covers the whole history rather than just this release, because no tag
+      under that scheme exists. Set 'include-component-in-tag': false in
+      release-please-config.json, then let it rewrite the release PR." ;;
+esac
+
+if gh release view "v$title_version" --repo "$repo" >/dev/null 2>&1; then
+  fail "tag v$title_version already exists. Merging would try to release it twice."
+fi
+pass "tag v$title_version does not exist yet"
+
+build=$(gh pr view "$pr_number" --repo "$repo" --json statusCheckRollup --jq '
+  [.statusCheckRollup[]? | select(.name == "Build")]
+  | if length == 0 then "MISSING" else (.[0].conclusion // .[0].status // "PENDING") end')
+[ "$build" = "SUCCESS" ] ||
+  fail "required check 'Build' is $build on #$pr_number, expected SUCCESS."
+pass "required check 'Build' passed"
+
+cat <<EOF
+
+Ready to release $title_version.
+
+  gh pr merge $pr_number --squash
+
+Merging tags v$title_version, publishes to npm and updates the agent registry.
+EOF

src/elicitation.ts

@@ -148,6 +148,14 @@ function questionCustomFieldKey(index: number): string {
  */
 const OPTION_META_KEY = "_claude/askUserQuestionOption";
 
+/**
+ * Shared `_meta` key for marking a per-question free-text field as the custom
+ * answer companion for a select question. This intentionally has no
+ * agent-specific namespace so ACP clients can recognize the same marker across
+ * Codex, Claude, and other AskUserQuestion bridges.
+ */
+const CUSTOM_ANSWER_META_KEY = "_askUserQuestionCustomAnswer";
+
 /**
  * Render the AskUserQuestion tool's questions as an ACP form elicitation.
  *
@@ -204,6 +212,12 @@ export function askUserQuestionsToCreateRequest(
       type: "string",
       title: "Other",
       description: "Type your own answer instead of choosing an option above (optional).",
+      _meta: {
+        [CUSTOM_ANSWER_META_KEY]: {
+          questionId: questionFieldKey(index),
+          isCustomAnswer: true,
+        },
+      },
     };
   });
 

src/file-change-audit.ts

@@ -0,0 +1,482 @@
+import {
+  createSdkMcpServer,
+  type HookCallback,
+  type McpSdkServerConfigWithInstance,
+  type SdkMcpToolDefinition,
+} from "@anthropic-ai/claude-agent-sdk";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { z } from "zod";
+
+export const AGENT_FILE_CHANGE_REPORT_CAPABILITY = "agentFileChangeReport";
+export const FILE_CHANGE_AUDIT_SERVER_NAME = "claude_agent_acp";
+export const FILE_CHANGE_AUDIT_TOOL_NAME = "report_changed_files";
+export const FILE_CHANGE_AUDIT_WIRE_TOOL_NAME = `mcp__${FILE_CHANGE_AUDIT_SERVER_NAME}__${FILE_CHANGE_AUDIT_TOOL_NAME}`;
+
+const FILE_CHANGE_AUDIT_MARKER = "claude-agent-acp-file-change-audit";
+const MAX_REPORTED_PATHS = 1024;
+const MAX_REPORTED_PATH_LENGTH = 4096;
+export const AGENT_FILE_CHANGE_REPORT_MAX_BYTES = 256 * 1024;
+const REQUEST_ID_PATTERN = /^[A-Za-z0-9._:-]{1,128}$/;
+
+export type FileChangeAuditTurnState = {
+  requestId: string;
+  phase: "requested" | "collecting" | "finished";
+};
+
+export type FileChangeAuditWorkspace = {
+  cwd: string;
+  additionalDirectories: string[];
+};
+
+export type AgentFileChangeReport = {
+  paths: string[];
+  complete: boolean;
+  uncertainty?: string;
+};
+
+export type AgentFileChangeReportResult = {
+  version: 1;
+  requestId: string;
+} & (
+  | {
+      status: "reported";
+      paths: string[];
+      declaredComplete: boolean;
+      truncated: boolean;
+      uncertainty?: string;
+    }
+  | {
+      status: "unavailable";
+      reason: FileChangeReportUnavailableReason;
+    }
+);
+
+export type FileChangeReportUnavailableReason =
+  "cancelled" | "timeout" | "invalidOutput" | "notReported" | "providerError";
+
+const JETBRAINS_META_KEY = "jetbrains";
+const AIR_META_KEY = "air";
+const AIR_EXTENSION_VERSION = 1;
+const AIR_EXTENSION_CAPABILITIES_KEY = "capabilities";
+const AIR_AGENT_FILE_CHANGE_REPORT_KEY = "agentFileChangeReport";
+
+type FileChangeAuditSupportOptions = {
+  cwd: string;
+  additionalDirectories: string[];
+  getActiveState: () => FileChangeAuditTurnState | undefined;
+  publish: (result: AgentFileChangeReportResult) => Promise<void>;
+  logError: (message: string) => void;
+};
+
+export type FileChangeAuditSupport = {
+  mcpServer: McpSdkServerConfigWithInstance;
+  preToolUseHook: HookCallback;
+  stopHook: HookCallback;
+  finishUnavailable: (
+    state: FileChangeAuditTurnState,
+    reason: FileChangeReportUnavailableReason,
+  ) => Promise<void>;
+};
+
+const reportInputSchema = {
+  paths: z
+    .array(z.string())
+    .describe(
+      "Workspace file paths changed during this turn. Use absolute paths or paths relative to cwd.",
+    ),
+  complete: z
+    .boolean()
+    .describe("True only when paths contains every workspace file changed during this turn."),
+  uncertainty: z
+    .string()
+    .trim()
+    .min(1)
+    .max(2000)
+    .optional()
+    .describe("Why the report may be incomplete or uncertain."),
+};
+
+export function agentFileChangeReportRequestId(meta: unknown): string | undefined {
+  const air = airExtension(meta);
+  const request = air?.agentFileChangeReportRequest;
+  if (!request || typeof request !== "object" || Array.isArray(request)) return undefined;
+  const requestRecord = request as Record<string, unknown>;
+  const requestKeys = Object.keys(requestRecord);
+  if (
+    requestKeys.length !== 2 ||
+    !requestKeys.includes("version") ||
+    !requestKeys.includes("requestId") ||
+    requestRecord.version !== 1
+  )
+    return undefined;
+  const requestId = requestRecord.requestId;
+  return typeof requestId === "string" && REQUEST_ID_PATTERN.test(requestId)
+    ? requestId
+    : undefined;
+}
+
+export function supportsAgentFileChangeReport(capabilities: unknown): boolean {
+  if (!capabilities || typeof capabilities !== "object" || Array.isArray(capabilities)) {
+    return false;
+  }
+  const air = airExtension((capabilities as Record<string, unknown>)._meta);
+  const advertised = air?.[AIR_EXTENSION_CAPABILITIES_KEY];
+  return (
+    air?.version === AIR_EXTENSION_VERSION &&
+    Array.isArray(advertised) &&
+    advertised.includes(AGENT_FILE_CHANGE_REPORT_CAPABILITY)
+  );
+}
+
+export function agentFileChangeReportMeta(
+  result: AgentFileChangeReportResult,
+): Record<string, unknown> {
+  return {
+    [JETBRAINS_META_KEY]: {
+      [AIR_META_KEY]: {
+        version: AIR_EXTENSION_VERSION,
+        [AIR_AGENT_FILE_CHANGE_REPORT_KEY]: result,
+      },
+    },
+  };
+}
+
+function airExtension(meta: unknown): Record<string, unknown> | undefined {
+  if (!meta || typeof meta !== "object" || Array.isArray(meta)) return undefined;
+  const jetbrains = (meta as Record<string, unknown>)[JETBRAINS_META_KEY];
+  if (!jetbrains || typeof jetbrains !== "object" || Array.isArray(jetbrains)) return undefined;
+  const air = (jetbrains as Record<string, unknown>)[AIR_META_KEY];
+  return air && typeof air === "object" && !Array.isArray(air)
+    ? (air as Record<string, unknown>)
+    : undefined;
+}
+
+export function createFileChangeAuditTurnState(requestId: string): FileChangeAuditTurnState {
+  return {
+    requestId,
+    phase: "requested",
+  };
+}
+
+export function isFileChangeAuditReportPhase(state: FileChangeAuditTurnState | undefined): boolean {
+  return state?.phase === "collecting" || state?.phase === "finished";
+}
+
+export function isFileChangeAuditTool(toolName: string): boolean {
+  return toolName === FILE_CHANGE_AUDIT_WIRE_TOOL_NAME;
+}
+
+export function containsFileChangeAuditMarker(text: string): boolean {
+  return text.includes(`<${FILE_CHANGE_AUDIT_MARKER}>`);
+}
+
+export function createFileChangeAuditSupport(
+  options: FileChangeAuditSupportOptions,
+): FileChangeAuditSupport {
+  const workspace = normalizeWorkspace(options.cwd, options.additionalDirectories);
+
+  const finishUnavailable = async (
+    state: FileChangeAuditTurnState,
+    reason: FileChangeReportUnavailableReason,
+  ) => {
+    // Claim the terminal outcome before the first await. The report tool, a
+    // Stop hook, cancellation, and stream teardown can race, but only the
+    // winner may publish for this request id. Publication remains fail-open:
+    // an audit transport failure must never hold the user prompt open.
+    if (state.phase === "finished") return;
+    state.phase = "finished";
+    try {
+      await options.publish({
+        version: 1,
+        requestId: state.requestId,
+        status: "unavailable",
+        reason,
+      });
+    } catch (error) {
+      options.logError(`Failed to publish unavailable report ${state.requestId}: ${error}`);
+    }
+  };
+
+  const tool: SdkMcpToolDefinition<typeof reportInputSchema> = {
+    name: FILE_CHANGE_AUDIT_TOOL_NAME,
+    description:
+      "Internal audit tool. Call it only when a stop-hook message explicitly requests the file-change audit.",
+    inputSchema: reportInputSchema,
+    _meta: {
+      "anthropic/alwaysLoad": true,
+      "claude/endTurn": true,
+    },
+    handler: async (report) => {
+      const state = options.getActiveState();
+      if (!state || state.phase !== "collecting") {
+        return {
+          isError: true,
+          content: [
+            {
+              type: "text",
+              text: `<${FILE_CHANGE_AUDIT_MARKER}>No file-change audit is active.</${FILE_CHANGE_AUDIT_MARKER}>`,
+            },
+          ],
+        };
+      }
+
+      // Flip before publishing: a client transport failure must not make the
+      // model retry the report and produce duplicates. Delivery is audit-only
+      // and fail-open; the normal turn must still finish.
+      state.phase = "finished";
+      const normalized = normalizeReportedPaths(report.paths, workspace);
+      const result = fitReportedAgentFileChangeReport({
+        version: 1,
+        requestId: state.requestId,
+        status: "reported",
+        paths: normalized.paths,
+        declaredComplete: report.complete && !normalized.truncated,
+        truncated: normalized.truncated,
+        ...(report.uncertainty ? { uncertainty: report.uncertainty } : {}),
+      });
+      try {
+        await options.publish(result);
+      } catch (error) {
+        options.logError(`Failed to publish file-change report ${state.requestId}: ${error}`);
+      }
+
+      return {
+        content: [
+          {
+            type: "text",
+            text: `<${FILE_CHANGE_AUDIT_MARKER}>File-change audit recorded.</${FILE_CHANGE_AUDIT_MARKER}>`,
+          },
+        ],
+        structuredContent: result,
+      };
+    },
+  };
+
+  // canUseTool is not guaranteed to run for tools that the current permission
+  // mode auto-allows (notably bypassPermissions). A PreToolUse hook is the
+  // enforcement boundary that keeps the hidden continuation read-only in every
+  // mode: it can submit the report, but cannot inspect or mutate more files.
+  const preToolUseHook: HookCallback = async (input) => {
+    if (input.hook_event_name !== "PreToolUse") return {};
+    const state = options.getActiveState();
+    const isReportTool = isFileChangeAuditTool(input.tool_name);
+    if (!isReportTool && !isFileChangeAuditReportPhase(state)) return {};
+
+    const allowReport = state?.phase === "collecting" && isReportTool;
+    return {
+      hookSpecificOutput: {
+        hookEventName: "PreToolUse",
+        permissionDecision: allowReport ? "allow" : "deny",
+        ...(!allowReport
+          ? {
+              permissionDecisionReason:
+                "Only the internal file-change report is allowed during the audit.",
+            }
+          : {}),
+      },
+    };
+  };
+
+  const stopHook: HookCallback = async (input) => {
+    if (input.hook_event_name !== "Stop") return {};
+    const state = options.getActiveState();
+    if (!state || state.phase === "finished") return {};
+    // A Stop can be only a pause while a background generator is still
+    // running. Keep the request pending so a later final Stop can include its
+    // writes instead of declaring a prematurely complete path set.
+    if (state.phase === "requested" && (input.background_tasks?.length ?? 0) > 0) return {};
+    if (state.phase === "collecting" || input.stop_hook_active) {
+      await finishUnavailable(state, "notReported");
+      return {};
+    }
+
+    // Set the phase before returning the continuation so every following SDK
+    // message is hidden even if the next stream starts immediately.
+    state.phase = "collecting";
+    return {
+      hookSpecificOutput: {
+        hookEventName: "Stop",
+        additionalContext:
+          `<${FILE_CHANGE_AUDIT_MARKER}>` +
+          `Before stopping, call ${FILE_CHANGE_AUDIT_WIRE_TOOL_NAME} exactly once. ` +
+          "Report every workspace file changed during this user turn, including files changed " +
+          "by commands, generators, version-control operations, and child processes. " +
+          "Do not call any other tool and do not emit user-facing prose. " +
+          "Set complete to false and explain uncertainty when you are not sure the list is complete." +
+          `</${FILE_CHANGE_AUDIT_MARKER}>`,
+      },
+    };
+  };
+
+  return {
+    mcpServer: createSdkMcpServer({
+      name: FILE_CHANGE_AUDIT_SERVER_NAME,
+      version: "1.0.0",
+      tools: [tool],
+      alwaysLoad: true,
+    }),
+    preToolUseHook,
+    stopHook,
+    finishUnavailable,
+  };
+}
+
+function normalizeWorkspace(
+  cwd: string,
+  additionalDirectories: string[],
+): FileChangeAuditWorkspace {
+  const normalizedCwd = canonicalizeWorkspaceRoot(path.resolve(cwd));
+  const seen = new Set([pathKey(normalizedCwd)]);
+  const normalizedAdditionalDirectories: string[] = [];
+  for (const directory of additionalDirectories) {
+    const normalized = canonicalizeWorkspaceRoot(path.resolve(normalizedCwd, directory));
+    const key = pathKey(normalized);
+    if (seen.has(key)) continue;
+    seen.add(key);
+    normalizedAdditionalDirectories.push(normalized);
+  }
+  return {
+    cwd: normalizedCwd,
+    additionalDirectories: normalizedAdditionalDirectories,
+  };
+}
+
+function normalizeReportedPaths(
+  reportedPaths: string[],
+  workspace: FileChangeAuditWorkspace,
+): { paths: string[]; truncated: boolean } {
+  const roots = [workspace.cwd, ...workspace.additionalDirectories];
+  const seen = new Set<string>();
+  const result: string[] = [];
+  let totalBytes = 0;
+  let truncated = false;
+  for (const reportedPath of reportedPaths) {
+    if (
+      reportedPath.trim().length === 0 ||
+      reportedPath.length > MAX_REPORTED_PATH_LENGTH ||
+      hasControlCharacter(reportedPath)
+    ) {
+      truncated = true;
+      continue;
+    }
+    let normalized: string;
+    try {
+      normalized = canonicalizeReportedPath(path.resolve(workspace.cwd, reportedPath));
+    } catch {
+      truncated = true;
+      continue;
+    }
+    if (normalized.length > MAX_REPORTED_PATH_LENGTH || hasControlCharacter(normalized)) {
+      truncated = true;
+      continue;
+    }
+    if (!roots.some((root) => isWithinRoot(normalized, root))) {
+      truncated = true;
+      continue;
+    }
+    const key = pathKey(normalized);
+    if (roots.some((root) => pathKey(root) === key)) {
+      truncated = true;
+      continue;
+    }
+    if (seen.has(key)) {
+      continue;
+    }
+    const pathBytes = Buffer.byteLength(normalized, "utf8");
+    if (
+      result.length >= MAX_REPORTED_PATHS ||
+      totalBytes + pathBytes > AGENT_FILE_CHANGE_REPORT_MAX_BYTES
+    ) {
+      truncated = true;
+      continue;
+    }
+    seen.add(key);
+    result.push(normalized);
+    totalBytes += pathBytes;
+  }
+  return { paths: result, truncated };
+}
+
+/** Keep the complete serialized report within AIR's wire limit. */
+function fitReportedAgentFileChangeReport(
+  report: Extract<AgentFileChangeReportResult, { status: "reported" }>,
+): Extract<AgentFileChangeReportResult, { status: "reported" }> {
+  const paths = [...report.paths];
+  let fitted = report;
+  while (Buffer.byteLength(JSON.stringify(fitted), "utf8") > AGENT_FILE_CHANGE_REPORT_MAX_BYTES) {
+    if (paths.length === 0) {
+      // The fixed fields and bounded uncertainty are far below the cap. Keep
+      // this loud if the wire contract changes without updating this helper.
+      throw new Error("Agent file-change report exceeds the wire limit without paths");
+    }
+    paths.pop();
+    fitted = {
+      ...report,
+      paths: [...paths],
+      declaredComplete: false,
+      truncated: true,
+    };
+  }
+  return fitted;
+}
+
+function isWithinRoot(candidate: string, root: string): boolean {
+  const relative = path.relative(root, candidate);
+  return !path.isAbsolute(relative) && !relative.startsWith(`..${path.sep}`) && relative !== "..";
+}
+
+/**
+ * Resolve filesystem aliases in a workspace root, including macOS' /tmp ->
+ * /private/tmp alias. For a root that does not exist yet, resolve its nearest
+ * existing ancestor and retain the missing suffix.
+ */
+function canonicalizeWorkspaceRoot(value: string): string {
+  return canonicalizeFromExistingAncestor(value);
+}
+
+/**
+ * Canonicalize the parent but not the leaf itself. A changed path may be
+ * deleted, or it may be a symlink whose node (rather than target) changed.
+ */
+function canonicalizeReportedPath(value: string): string {
+  const parent = canonicalizeFromExistingAncestor(path.dirname(value));
+  return path.resolve(parent, path.basename(value));
+}
+
+function canonicalizeFromExistingAncestor(value: string): string {
+  const original = path.resolve(value);
+  let current = original;
+  const missingSegments: string[] = [];
+
+  while (true) {
+    try {
+      const canonical = fs.realpathSync.native(current);
+      return path.resolve(canonical, ...missingSegments.reverse());
+    } catch (error) {
+      if (!isMissingPathError(error)) return original;
+    }
+
+    const parent = path.dirname(current);
+    if (parent === current) return original;
+    missingSegments.push(path.basename(current));
+    current = parent;
+  }
+}
+
+function isMissingPathError(error: unknown): boolean {
+  if (typeof error !== "object" || error === null || !("code" in error)) return false;
+  return error.code === "ENOENT" || error.code === "ENOTDIR";
+}
+
+function pathKey(value: string): string {
+  return process.platform === "win32" ? value.toLowerCase() : value;
+}
+
+function hasControlCharacter(value: string): boolean {
+  for (let index = 0; index < value.length; index++) {
+    const code = value.charCodeAt(index);
+    if (code <= 0x1f || (code >= 0x7f && code <= 0x9f)) return true;
+  }
+  return false;
+}

src/goal-extension.ts

@@ -0,0 +1,83 @@
+import { RequestError } from "@agentclientprotocol/sdk";
+import type { SDKActiveGoalMessage } from "@anthropic-ai/claude-agent-sdk";
+
+export const GOAL_EXTENSION_VERSION = 1 as const;
+export const GOAL_CONTROL_METHOD = "_session/goal";
+
+export const GOAL_ACTIONS = ["set", "clear"] as const;
+export type GoalAction = (typeof GOAL_ACTIONS)[number];
+
+export type GoalCapability = {
+  version: typeof GOAL_EXTENSION_VERSION;
+  controlMethod: typeof GOAL_CONTROL_METHOD;
+  actions: GoalAction[];
+};
+
+export type GoalStatus = "active" | "paused" | "blocked" | "limited" | "complete";
+
+export type GoalSnapshot = {
+  objective: string;
+  status: GoalStatus;
+  iterations?: number;
+  lastReason?: string | null;
+  createdAt?: number;
+  updatedAt?: number;
+  tokenBudget?: number | null;
+  tokensUsed?: number;
+  timeUsedSeconds?: number;
+  controlMethod: typeof GOAL_CONTROL_METHOD;
+};
+
+export type GoalRequest =
+  { sessionId: string; action: "clear" } | { sessionId: string; action: "set"; objective: string };
+
+export type GoalControlResponse = Record<string, never>;
+
+export function goalUpdateFromPrompt(prompt: string): GoalSnapshot | null | undefined {
+  const match = /^\/goal(?:\s+([\s\S]*))?$/.exec(prompt);
+  const argument = match?.[1]?.trim();
+  if (!argument) {
+    return undefined;
+  }
+  if (argument === "clear") {
+    return null;
+  }
+  return {
+    objective: argument,
+    status: "active",
+    controlMethod: GOAL_CONTROL_METHOD,
+  };
+}
+
+export function parseGoalRequest(params: unknown): GoalRequest {
+  if (!params || typeof params !== "object") {
+    throw RequestError.invalidParams(undefined, "goal params must be an object");
+  }
+  const { sessionId, action, objective } = params as Record<string, unknown>;
+  if (typeof sessionId !== "string" || sessionId.length === 0) {
+    throw RequestError.invalidParams(undefined, "goal params require a non-empty sessionId");
+  }
+  if (!GOAL_ACTIONS.includes(action as GoalAction)) {
+    throw RequestError.invalidParams(undefined, 'goal action must be "set" or "clear"');
+  }
+  if (action === "set" && (typeof objective !== "string" || objective.trim().length === 0)) {
+    throw RequestError.invalidParams(undefined, 'goal action "set" requires a non-empty objective');
+  }
+  return action === "set"
+    ? { sessionId, action, objective: (objective as string).trim() }
+    : { sessionId, action: "clear" };
+}
+
+export function toGoalSnapshot(message: SDKActiveGoalMessage): GoalSnapshot | null {
+  if (message.value === null) {
+    return null;
+  }
+  return {
+    objective: message.value.condition.trim(),
+    status: "active",
+    iterations: message.value.iterations,
+    lastReason: message.value.last_reason ?? null,
+    createdAt: message.value.set_at,
+    controlMethod: GOAL_CONTROL_METHOD,
+  };
+}

src/session-failure-extension.ts

@@ -0,0 +1,463 @@
+import type { ClientCapabilities, SessionNotification } from "@agentclientprotocol/sdk";
+import {
+  getSessionMessages,
+  type SDKAssistantMessageError,
+  USAGE_LIMIT_ERROR_PREFIXES,
+} from "@anthropic-ai/claude-agent-sdk";
+import { randomUUID } from "node:crypto";
+
+const JETBRAINS_META_KEY = "jetbrains";
+const AIR_META_KEY = "air";
+const AIR_EXTENSION_VERSION_KEY = "version";
+const AIR_EXTENSION_CAPABILITIES_KEY = "capabilities";
+const AIR_SESSION_FAILURE_KEY = "sessionFailure";
+const AIR_EXTENSION_VERSION = 1;
+
+export function airSessionFailureCapabilityMeta(...additionalCapabilities: string[]) {
+  return {
+    [JETBRAINS_META_KEY]: {
+      [AIR_META_KEY]: {
+        [AIR_EXTENSION_VERSION_KEY]: AIR_EXTENSION_VERSION,
+        [AIR_EXTENSION_CAPABILITIES_KEY]: [AIR_SESSION_FAILURE_KEY, ...additionalCapabilities],
+      },
+    },
+  };
+}
+
+export type ClaudeFailureKind =
+  | "advisory"
+  | "auth_required"
+  | "bad_request"
+  | "budget_exhausted"
+  | "context_exhausted"
+  | "internal_error"
+  | "overloaded"
+  | "provider_error"
+  | "quota_exhausted"
+  | "rate_limited"
+  | "transport_lost"
+  | "worker_shutdown";
+
+type AirSessionFailureCategory =
+  "connection" | "access" | "limit" | "request" | "service" | "unknown";
+
+type AirSessionFailureSeverity = "warning" | "error";
+type AirSessionFailureAction = "retry" | "login" | "new_session";
+
+type SessionFailureRecoveryPolicy =
+  "never" | "next_attempt" | "real_model_success" | "auth_status" | "runtime_rebind";
+
+export type PublishedSessionFailure = {
+  id: string;
+  revision: number;
+  kind: ClaudeFailureKind;
+  category: AirSessionFailureCategory;
+  turnId?: string;
+  severity: AirSessionFailureSeverity;
+  title: string;
+  details?: string;
+  actions: AirSessionFailureAction[];
+  recoveryPolicy: SessionFailureRecoveryPolicy;
+};
+
+type SessionFailureOptions = {
+  turnId?: string;
+  sessionScoped?: boolean;
+  title?: string;
+  details?: string;
+  severity?: AirSessionFailureSeverity;
+};
+
+export type SessionFailureState = {
+  epoch: string;
+  revisions: Map<string, number>;
+  active: Map<string, PublishedSessionFailure>;
+  nextIncident?: number;
+  lastNotice?: { title: string; id: string };
+};
+
+type Logger = {
+  error: (...args: unknown[]) => void;
+};
+
+export function createSessionFailureState(): SessionFailureState {
+  return {
+    epoch: randomUUID(),
+    revisions: new Map(),
+    active: new Map(),
+  };
+}
+
+const AIR_FAILURE_POLICY: Record<
+  ClaudeFailureKind,
+  {
+    category: AirSessionFailureCategory;
+    actions: AirSessionFailureAction[];
+    fallbackTitle: string;
+  }
+> = {
+  advisory: {
+    category: "unknown",
+    actions: [],
+    fallbackTitle: "Claude reported a notice.",
+  },
+  auth_required: {
+    category: "access",
+    actions: ["login"],
+    fallbackTitle: "Sign in to continue using Claude.",
+  },
+  bad_request: {
+    category: "request",
+    actions: [],
+    fallbackTitle: "Claude could not process this request.",
+  },
+  budget_exhausted: {
+    category: "limit",
+    actions: ["new_session"],
+    fallbackTitle: "This Claude session reached its configured budget.",
+  },
+  context_exhausted: {
+    category: "limit",
+    actions: ["new_session"],
+    fallbackTitle: "This Claude turn reached its configured limit.",
+  },
+  internal_error: {
+    category: "service",
+    actions: ["retry", "new_session"],
+    fallbackTitle: "Claude Agent encountered an internal error.",
+  },
+  overloaded: {
+    category: "service",
+    actions: ["retry"],
+    fallbackTitle: "Claude is temporarily overloaded.",
+  },
+  provider_error: {
+    category: "service",
+    actions: ["retry"],
+    fallbackTitle: "The model provider reported an error.",
+  },
+  quota_exhausted: {
+    category: "limit",
+    actions: [],
+    fallbackTitle: "The Claude account has no available quota.",
+  },
+  rate_limited: {
+    category: "limit",
+    actions: ["retry"],
+    fallbackTitle: "Claude is temporarily rate limited.",
+  },
+  transport_lost: {
+    category: "connection",
+    actions: ["new_session"],
+    fallbackTitle: "The connection to Claude was lost.",
+  },
+  worker_shutdown: {
+    category: "connection",
+    actions: ["new_session"],
+    fallbackTitle: "The Claude worker is shutting down.",
+  },
+};
+
+export function sessionFailureMeta(failure: PublishedSessionFailure) {
+  return {
+    [JETBRAINS_META_KEY]: {
+      [AIR_META_KEY]: {
+        [AIR_EXTENSION_VERSION_KEY]: AIR_EXTENSION_VERSION,
+        [AIR_SESSION_FAILURE_KEY]: {
+          id: failure.id,
+          revision: failure.revision,
+          category: failure.category,
+          severity: failure.severity,
+          title: failure.title,
+          ...(failure.details ? { details: failure.details } : {}),
+          actions: failure.actions,
+        },
+      },
+    },
+  };
+}
+
+/** `getSessionMessages` deliberately exposes only the API message and strips
+ *  transcript-level `error` / `isApiErrorMessage` fields. The SDK exports the
+ *  exact stable prefixes used by its synthetic usage-limit errors, so replay
+ *  can recover this one typed failure without matching arbitrary model prose. */
+export function assistantMessageText(apiMessage: unknown): string | undefined {
+  if (!apiMessage || typeof apiMessage !== "object") return undefined;
+  const { content } = apiMessage as { content?: unknown };
+  if (typeof content === "string") return content || undefined;
+  if (!Array.isArray(content)) return undefined;
+  const text = content
+    .map((block) =>
+      block &&
+      typeof block === "object" &&
+      "type" in block &&
+      block.type === "text" &&
+      "text" in block &&
+      typeof block.text === "string"
+        ? block.text
+        : "",
+    )
+    .join("");
+  return text || undefined;
+}
+
+export function isSyntheticUsageLimitMessage(apiMessage: unknown): boolean {
+  if (!apiMessage || typeof apiMessage !== "object") return false;
+  const { model } = apiMessage as { model?: unknown };
+  if (model !== "<synthetic>") return false;
+  const text = assistantMessageText(apiMessage);
+  if (!text) return false;
+  return USAGE_LIMIT_ERROR_PREFIXES.some((prefix) => text.startsWith(prefix));
+}
+
+export function activeUsageLimitMessage(
+  messages: Awaited<ReturnType<typeof getSessionMessages>>,
+): { uuid: string; title: string } | undefined {
+  let active: { uuid: string; title: string } | undefined;
+  for (const message of messages) {
+    if (message.type !== "assistant" || message.parent_tool_use_id !== null) continue;
+    if (isSyntheticUsageLimitMessage(message.message)) {
+      const title = assistantMessageText(message.message);
+      if (title) active = { uuid: message.uuid, title };
+      continue;
+    }
+    const model =
+      message.message && typeof message.message === "object" && "model" in message.message
+        ? message.message.model
+        : undefined;
+    // A later real model answer proves the account recovered. Synthetic
+    // local-command/interruption messages do not: they can be appended while
+    // the provider remains unavailable.
+    if (model !== undefined && model !== "<synthetic>") active = undefined;
+  }
+  return active;
+}
+
+export function supportsAirSessionFailures(capabilities?: ClientCapabilities): boolean {
+  const jetbrains = capabilities?._meta?.[JETBRAINS_META_KEY] as
+    Record<string, unknown> | undefined;
+  const air = jetbrains?.[AIR_META_KEY] as Record<string, unknown> | undefined;
+  const version = air?.[AIR_EXTENSION_VERSION_KEY];
+  const advertised = air?.[AIR_EXTENSION_CAPABILITIES_KEY];
+  return (
+    typeof version === "number" &&
+    Number.isFinite(version) &&
+    Number.isInteger(version) &&
+    version >= AIR_EXTENSION_VERSION &&
+    Array.isArray(advertised) &&
+    advertised.some((capability) => capability === AIR_SESSION_FAILURE_KEY)
+  );
+}
+
+function sessionFailureRecoveryPolicy(
+  kind: ClaudeFailureKind,
+  turnId?: string,
+): SessionFailureRecoveryPolicy {
+  switch (kind) {
+    case "advisory":
+      return "never";
+    case "auth_required":
+      return "auth_status";
+    case "transport_lost":
+    case "worker_shutdown":
+      return "runtime_rebind";
+    case "quota_exhausted":
+      return "real_model_success";
+    default:
+      return turnId ? "next_attempt" : "real_model_success";
+  }
+}
+
+/** Owns the AIR failure lifecycle for both the live consumer and history replay.
+ *  Published revisions become active only after delivery succeeds; recovery only
+ *  removes internal active state because transcript records are historical. */
+export class SessionFailureController {
+  private readonly sessionId: string;
+  private readonly state: SessionFailureState;
+  private readonly capabilities?: ClientCapabilities;
+  private readonly isCurrent: () => boolean;
+  private readonly sendUpdate: (notification: SessionNotification) => Promise<void>;
+  private readonly logger: Logger;
+
+  constructor(options: {
+    sessionId: string;
+    state: SessionFailureState;
+    capabilities?: ClientCapabilities;
+    isCurrent: () => boolean;
+    sendUpdate: (notification: SessionNotification) => Promise<void>;
+    logger: Logger;
+  }) {
+    this.sessionId = options.sessionId;
+    this.state = options.state;
+    this.capabilities = options.capabilities;
+    this.isCurrent = options.isCurrent;
+    this.sendUpdate = options.sendUpdate;
+    this.logger = options.logger;
+  }
+
+  private isSupported(): boolean {
+    return supportsAirSessionFailures(this.capabilities);
+  }
+
+  private async emit(failure: PublishedSessionFailure): Promise<boolean> {
+    if (!this.isCurrent()) {
+      this.logger.error(
+        `Session ${this.sessionId}: ignored AIR session failure from a stale consumer`,
+      );
+      return false;
+    }
+    try {
+      await this.sendUpdate({
+        sessionId: this.sessionId,
+        update: {
+          sessionUpdate: "session_info_update",
+          _meta: sessionFailureMeta(failure),
+        },
+      });
+      return true;
+    } catch (error) {
+      this.logger.error(
+        `Session ${this.sessionId}: failed to publish AIR session failure: ${error}`,
+      );
+      return false;
+    }
+  }
+
+  recordActive(failure: PublishedSessionFailure): void {
+    this.state.revisions.set(failure.id, failure.revision);
+    this.state.active.set(failure.id, failure);
+    this.state.lastNotice =
+      failure.kind === "advisory" ? { title: failure.title, id: failure.id } : undefined;
+  }
+
+  async clear(
+    shouldClear: (failure: PublishedSessionFailure) => boolean = () => true,
+  ): Promise<boolean> {
+    if (!this.isSupported()) return true;
+    this.state.lastNotice = undefined;
+    for (const failure of [...this.state.active.values()]) {
+      if (!shouldClear(failure)) continue;
+      this.state.active.delete(failure.id);
+    }
+    return true;
+  }
+
+  async prepare(
+    kind: ClaudeFailureKind,
+    failureOptions: SessionFailureOptions = {},
+  ): Promise<PublishedSessionFailure | undefined> {
+    if (!this.isSupported() || !this.isCurrent()) return undefined;
+    const policy = AIR_FAILURE_POLICY[kind];
+    const title = failureOptions.title || policy.fallbackTitle;
+    if (kind === "advisory") {
+      const id =
+        this.state.lastNotice?.title === title
+          ? this.state.lastNotice.id
+          : `${this.sessionId}:notice:${this.state.epoch}:${this.state.nextIncident ?? 1}`;
+      if (this.state.lastNotice?.title !== title) {
+        this.state.nextIncident = (this.state.nextIncident ?? 1) + 1;
+      }
+      return {
+        id,
+        revision: (this.state.revisions.get(id) ?? 0) + 1,
+        kind,
+        category: policy.category,
+        severity: "warning",
+        title,
+        ...(failureOptions.details ? { details: failureOptions.details } : {}),
+        actions: policy.actions,
+        recoveryPolicy: sessionFailureRecoveryPolicy(kind),
+      };
+    }
+    const id =
+      failureOptions.turnId && !failureOptions.sessionScoped
+        ? `${failureOptions.turnId}:error`
+        : `${this.sessionId}:session-error:${this.state.epoch}:${this.state.nextIncident ?? 1}`;
+    if (!failureOptions.turnId || failureOptions.sessionScoped) {
+      this.state.nextIncident = (this.state.nextIncident ?? 1) + 1;
+    }
+    return {
+      id,
+      revision: (this.state.revisions.get(id) ?? 0) + 1,
+      kind,
+      category: policy.category,
+      severity: failureOptions.severity ?? "error",
+      title,
+      ...(failureOptions.details ? { details: failureOptions.details } : {}),
+      actions: failureOptions.severity === "warning" ? [] : policy.actions,
+      recoveryPolicy: sessionFailureRecoveryPolicy(
+        kind,
+        failureOptions.turnId && !failureOptions.sessionScoped ? failureOptions.turnId : undefined,
+      ),
+      ...(failureOptions.turnId && !failureOptions.sessionScoped
+        ? { turnId: failureOptions.turnId }
+        : {}),
+    };
+  }
+
+  async publish(
+    kind: ClaudeFailureKind,
+    failureOptions: SessionFailureOptions = {},
+  ): Promise<void> {
+    const failure = await this.prepare(kind, failureOptions);
+    if (!failure) return;
+    if (await this.emit(failure)) this.recordActive(failure);
+  }
+
+  async restore(
+    id: string,
+    kind: ClaudeFailureKind,
+    title: string,
+    active = true,
+  ): Promise<boolean> {
+    if (!this.isSupported() || !this.isCurrent()) return false;
+    const policy = AIR_FAILURE_POLICY[kind];
+    const failure: PublishedSessionFailure = {
+      id,
+      revision: (this.state.revisions.get(id) ?? 0) + 1,
+      kind,
+      category: policy.category,
+      severity: "error",
+      title,
+      actions: policy.actions,
+      recoveryPolicy: sessionFailureRecoveryPolicy(kind),
+    };
+    if (!(await this.emit(failure))) return false;
+    this.state.revisions.set(failure.id, failure.revision);
+    if (active) {
+      this.state.active.set(failure.id, failure);
+    } else {
+      this.state.active.delete(failure.id);
+    }
+    return true;
+  }
+}
+
+export function providerFailureCategory(
+  errorKind?: SDKAssistantMessageError,
+  isUsageLimit = false,
+): ClaudeFailureKind {
+  if (isUsageLimit) return "quota_exhausted";
+  switch (errorKind) {
+    case "authentication_failed":
+    case "oauth_org_not_allowed":
+      return "auth_required";
+    case "billing_error":
+      return "quota_exhausted";
+    case "rate_limit":
+      return "rate_limited";
+    case "overloaded":
+      return "overloaded";
+    case "invalid_request":
+    case "model_not_found":
+      return "bad_request";
+    case "max_output_tokens":
+      return "context_exhausted";
+    case "server_error":
+    case "unknown":
+    case undefined:
+      return "provider_error";
+    default:
+      return "provider_error";
+  }
+}

src/tests/create-session-options.test.ts

@@ -263,6 +263,38 @@ describe("createSession options merging", () => {
     expect(capturedOptions!.tools).toEqual([]);
   });
 
+  describe("subagent transcript forwarding", () => {
+    it("keeps the legacy default when neither the client nor caller opts in", async () => {
+      await agent.newSession({ cwd: process.cwd(), mcpServers: [] });
+
+      expect(capturedOptions!.forwardSubagentText).toBe(false);
+    });
+
+    it("preserves the pre-existing caller-provided SDK option", async () => {
+      await agent.newSession({
+        cwd: process.cwd(),
+        mcpServers: [],
+        _meta: { claudeCode: { options: { forwardSubagentText: true } } },
+      });
+
+      expect(capturedOptions!.forwardSubagentText).toBe(true);
+    });
+
+    it("enables SDK forwarding when the ACP client advertises support", async () => {
+      await agent.initialize({
+        protocolVersion: 1,
+        clientCapabilities: { _meta: { "subagent-transcript": true } },
+      });
+      await agent.newSession({
+        cwd: process.cwd(),
+        mcpServers: [],
+        _meta: { claudeCode: { options: { forwardSubagentText: false } } },
+      });
+
+      expect(capturedOptions!.forwardSubagentText).toBe(true);
+    });
+  });
+
   describe("systemPrompt via _meta", () => {
     it("defaults to the claude_code preset when not provided", async () => {
       await agent.newSession({ cwd: process.cwd(), mcpServers: [] });
@@ -763,7 +795,7 @@ describe("createSession options merging", () => {
       return { onUserDialog: capturedOptions!.onUserDialog!, createElicitation };
     }
 
-    const signal = () => ({ signal: new AbortController().signal });
+    const signal = () => ({ signal: new AbortController().signal, requestId: "1" });
 
     it("renders the prompt as a form elicitation and maps the retry choice", async () => {
       const { onUserDialog, createElicitation } = await setupDialog();

src/tests/elicitation.test.ts

@@ -264,10 +264,22 @@ describe("askUserQuestionsToCreateRequest", () => {
     expect(schema.properties?.["question_0_custom"]).toMatchObject({
       type: "string",
       title: "Other",
+      _meta: {
+        _askUserQuestionCustomAnswer: {
+          questionId: "question_0",
+          isCustomAnswer: true,
+        },
+      },
     });
     expect(schema.properties?.["question_1_custom"]).toMatchObject({
       type: "string",
       title: "Other",
+      _meta: {
+        _askUserQuestionCustomAnswer: {
+          questionId: "question_1",
+          isCustomAnswer: true,
+        },
+      },
     });
   });
 

src/tests/fast-mode-config.test.ts

@@ -1,11 +1,12 @@
 import { describe, it, expect, vi } from "vitest";
 import type { ClientCapabilities, SessionNotification } from "@agentclientprotocol/sdk";
-import type { ModelInfo } from "@anthropic-ai/claude-agent-sdk";
+import type { FastModeDisabledReason, ModelInfo } from "@anthropic-ai/claude-agent-sdk";
 import {
   buildConfigOptions,
   clientSupportsBooleanConfigOptions,
   createFastModeConfigOption,
   fastModeStateEnabled,
+  normalizeFastModeDisabledReason,
   resolveFastModeEnabled,
   FAST_MODE_CONFIG_ID,
   FAST_MODE_ON,
@@ -42,6 +43,28 @@ describe("createFastModeConfigOption", () => {
     });
   });
 
+  it("explains a blocking disabled reason while the toggle reads off", () => {
+    const option = createFastModeConfigOption(false, true, "free");
+    expect(option.description).toBe(
+      "Faster responses on supported models — not available on the free plan",
+    );
+  });
+
+  it("ignores routine and on-state reasons", () => {
+    // Every SDK session starts at `sdk_opt_in_required` — the toggle IS the
+    // opt-in, so it must not read as a blocker.
+    expect(createFastModeConfigOption(false, true, "sdk_opt_in_required").description).toBe(
+      "Faster responses on supported models",
+    );
+    expect(createFastModeConfigOption(false, true, "preference").description).toBe(
+      "Faster responses on supported models",
+    );
+    // A reason riding an `on` state isn't blocking anything right now.
+    expect(createFastModeConfigOption(true, true, "free").description).toBe(
+      "Faster responses on supported models",
+    );
+  });
+
   it("falls back to an on/off select when the client did not opt in", () => {
     const option = createFastModeConfigOption(false, false);
     expect(option).toMatchObject({
@@ -104,6 +127,28 @@ describe("fastModeStateEnabled", () => {
   });
 });
 
+describe("normalizeFastModeDisabledReason", () => {
+  it("retains only reasons we have an explanation for", () => {
+    expect(normalizeFastModeDisabledReason("free")).toBe("free");
+    expect(normalizeFastModeDisabledReason("extra_usage_disabled")).toBe("extra_usage_disabled");
+    expect(normalizeFastModeDisabledReason("model_not_allowed")).toBe("model_not_allowed");
+    expect(normalizeFastModeDisabledReason("not_first_party")).toBe("not_first_party");
+    expect(normalizeFastModeDisabledReason("disabled_by_env")).toBe("disabled_by_env");
+    expect(normalizeFastModeDisabledReason("network_error")).toBe("network_error");
+  });
+
+  it("drops routine states and unknown values", () => {
+    expect(normalizeFastModeDisabledReason("sdk_opt_in_required")).toBeUndefined();
+    expect(normalizeFastModeDisabledReason("preference")).toBeUndefined();
+    expect(normalizeFastModeDisabledReason("pending")).toBeUndefined();
+    expect(normalizeFastModeDisabledReason("unknown")).toBeUndefined();
+    expect(normalizeFastModeDisabledReason(undefined)).toBeUndefined();
+    expect(
+      normalizeFastModeDisabledReason("some_future_reason" as FastModeDisabledReason),
+    ).toBeUndefined();
+  });
+});
+
 describe("buildConfigOptions Fast mode", () => {
   it("omits the Fast mode option when the model does not support it", () => {
     const options = buildConfigOptions(MODES, MODELS, MODEL_INFOS, undefined, [], "default", {
@@ -249,6 +294,7 @@ describe("syncFastModeState (SDK-driven state changes)", () => {
     const session = {
       query: {},
       fastModeEnabled: opts.fastModeEnabled,
+      fastModeDisabledReason: undefined as FastModeDisabledReason | undefined,
       configOptions: opts.withOption
         ? [createFastModeConfigOption(opts.fastModeEnabled, true)]
         : [],
@@ -261,6 +307,7 @@ describe("syncFastModeState (SDK-driven state changes)", () => {
           sessionId: string,
           session: unknown,
           state: string | undefined,
+          reason?: FastModeDisabledReason,
         ) => Promise<void>;
       }
     ).syncFastModeState.bind(agent);
@@ -319,10 +366,65 @@ describe("syncFastModeState (SDK-driven state changes)", () => {
 
     await sync(SESSION_ID, session, undefined);
     await sync(SESSION_ID, session, "off");
+    // A routine reason normalizes away, so it's still "unchanged" — an
+    // `sdk_opt_in_required` on every turn's result must not churn the option.
+    await sync(SESSION_ID, session, "off", "sdk_opt_in_required");
 
     expect(sessionUpdates).toHaveLength(0);
   });
 
+  it("explains a blocking reason once when the SDK refuses a toggle the user turned on", async () => {
+    const { sync, session, sessionUpdates } = setup({ fastModeEnabled: true, withOption: true });
+
+    await sync(SESSION_ID, session, "off", "extra_usage_disabled");
+
+    expect(session.fastModeEnabled).toBe(false);
+    expect(session.fastModeDisabledReason).toBe("extra_usage_disabled");
+    expect(sessionUpdates).toHaveLength(2);
+    expect(sessionUpdates[0].update).toEqual({
+      sessionUpdate: "agent_message_chunk",
+      content: {
+        type: "text",
+        text: "**Fast mode turned off:** requires extra usage to be enabled for this account.",
+      },
+    });
+    expect(sessionUpdates[1].update).toMatchObject({ sessionUpdate: "config_option_update" });
+    expect(session.configOptions).toContainEqual(
+      createFastModeConfigOption(false, true, "extra_usage_disabled"),
+    );
+
+    // The same report again changes nothing the user can see: no repeat notice.
+    await sync(SESSION_ID, session, "off", "extra_usage_disabled");
+    expect(sessionUpdates).toHaveLength(2);
+  });
+
+  it("updates the description when only the reason changes", async () => {
+    const { sync, session, sessionUpdates } = setup({ fastModeEnabled: false, withOption: true });
+
+    await sync(SESSION_ID, session, "off", "not_first_party");
+
+    expect(session.fastModeEnabled).toBe(false);
+    // The toggle was already off, so the flip-time notice doesn't fire — only
+    // the description carries the explanation.
+    expect(sessionUpdates).toHaveLength(1);
+    expect(sessionUpdates[0].update).toMatchObject({ sessionUpdate: "config_option_update" });
+    expect(session.configOptions).toContainEqual(
+      createFastModeConfigOption(false, true, "not_first_party"),
+    );
+  });
+
+  it("drops a retained reason once fast mode comes back on", async () => {
+    const { sync, session } = setup({ fastModeEnabled: false, withOption: true });
+
+    await sync(SESSION_ID, session, "off", "network_error");
+    expect(session.fastModeDisabledReason).toBe("network_error");
+
+    await sync(SESSION_ID, session, "on");
+    expect(session.fastModeEnabled).toBe(true);
+    expect(session.fastModeDisabledReason).toBeUndefined();
+    expect(session.configOptions).toContainEqual(createFastModeConfigOption(true, true));
+  });
+
   it("preserves the retained setting (no clobber) when the model has no Fast mode option", async () => {
     // Model without fast support: the SDK reports a capability-driven state, not
     // the user's intent. We must leave session.fastModeEnabled untouched so it's

src/tests/file-change-audit-integration.test.ts

@@ -0,0 +1,604 @@
+import type {
+  HookCallback,
+  Options,
+  PermissionResult,
+  SDKUserMessage,
+} from "@anthropic-ai/claude-agent-sdk";
+import type { SessionNotification } from "@agentclientprotocol/sdk";
+import * as path from "node:path";
+import { randomUUID } from "node:crypto";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import type { AcpClient, ClaudeAcpAgent as ClaudeAcpAgentType } from "../acp-agent.js";
+import {
+  AGENT_FILE_CHANGE_REPORT_CAPABILITY,
+  FILE_CHANGE_AUDIT_SERVER_NAME,
+  FILE_CHANGE_AUDIT_TOOL_NAME,
+  FILE_CHANGE_AUDIT_WIRE_TOOL_NAME,
+  type AgentFileChangeReport,
+  type AgentFileChangeReportResult,
+} from "../file-change-audit.js";
+import type { Pushable } from "../utils.js";
+
+let observedStopOutputs: unknown[] = [];
+let observedPreToolDecision: unknown;
+let observedCanUseToolDecision: PermissionResult | null | undefined;
+let replayMessages: unknown[] = [];
+type AuditScenario =
+  "reported" | "successWithoutReport" | "providerError" | "localOnly" | "waitForCancel";
+let auditScenario: AuditScenario = "reported";
+let auditTurnActivated = Promise.resolve();
+let resolveAuditTurnActivated = () => {};
+
+vi.mock("@anthropic-ai/claude-agent-sdk", async () => {
+  const actual = await vi.importActual<typeof import("@anthropic-ai/claude-agent-sdk")>(
+    "@anthropic-ai/claude-agent-sdk",
+  );
+  return {
+    ...actual,
+    getSessionMessages: vi.fn(async () => replayMessages),
+    query: ({ prompt, options }: { prompt: Pushable<SDKUserMessage>; options: Options }) => {
+      let resolveInterrupt = () => {};
+      const interrupted = new Promise<void>((resolve) => {
+        resolveInterrupt = resolve;
+      });
+      return Object.assign(runAuditedTurn(prompt, options, interrupted), {
+        initializationResult: async () => ({
+          models: [
+            {
+              value: "claude-sonnet-4-6",
+              displayName: "Claude Sonnet",
+              description: "Fast",
+              supportsAutoMode: true,
+            },
+          ],
+        }),
+        setModel: vi.fn(async () => {}),
+        setPermissionMode: vi.fn(async () => {}),
+        supportedAgents: vi.fn(async () => []),
+        supportedCommands: vi.fn(async () => []),
+        getContextUsage: vi.fn(async () => ({ totalTokens: 0, rawMaxTokens: 200000 })),
+        interrupt: vi.fn(async () => {
+          resolveInterrupt();
+          return undefined;
+        }),
+        close: vi.fn(),
+      });
+    },
+  };
+});
+
+vi.mock("../tools.js", async () => ({
+  ...(await vi.importActual<typeof import("../tools.js")>("../tools.js")),
+  registerHookCallback: vi.fn(),
+}));
+
+type RegisteredAuditTool = {
+  handler: (
+    report: AgentFileChangeReport,
+  ) => Promise<{ content: unknown; structuredContent?: AgentFileChangeReportResult }>;
+};
+
+function hookFrom(options: Options, event: "PreToolUse" | "Stop"): HookCallback {
+  const matcher = options.hooks?.[event]?.at(-1);
+  const hook = matcher?.hooks.at(-1);
+  if (!hook) throw new Error(`Missing ${event} audit hook`);
+  return hook;
+}
+
+function auditToolFrom(options: Options): RegisteredAuditTool {
+  const server = options.mcpServers?.[FILE_CHANGE_AUDIT_SERVER_NAME] as unknown as {
+    instance: { _registeredTools: Record<string, RegisteredAuditTool> };
+  };
+  const tool = server.instance._registeredTools[FILE_CHANGE_AUDIT_TOOL_NAME];
+  if (!tool) throw new Error("Missing internal audit tool");
+  return tool;
+}
+
+function assistantMessage(content: unknown[]) {
+  return {
+    type: "assistant" as const,
+    parent_tool_use_id: null,
+    uuid: randomUUID(),
+    session_id: "sdk-session",
+    message: {
+      role: "assistant" as const,
+      model: "claude-sonnet-4-6",
+      stop_reason: "end_turn",
+      usage: {
+        input_tokens: 1,
+        output_tokens: 1,
+        cache_read_input_tokens: 0,
+        cache_creation_input_tokens: 0,
+      },
+      content,
+    },
+  };
+}
+
+function successResult() {
+  return {
+    type: "result" as const,
+    subtype: "success" as const,
+    stop_reason: "end_turn",
+    is_error: false,
+    result: "",
+    errors: [],
+    duration_ms: 0,
+    duration_api_ms: 0,
+    num_turns: 2,
+    total_cost_usd: 0,
+    usage: {
+      input_tokens: 2,
+      output_tokens: 2,
+      cache_read_input_tokens: 0,
+      cache_creation_input_tokens: 0,
+    },
+    modelUsage: {},
+    permission_denials: [],
+    uuid: randomUUID(),
+    session_id: "sdk-session",
+  };
+}
+
+async function* runAuditedTurn(
+  input: Pushable<SDKUserMessage>,
+  options: Options,
+  interrupted: Promise<void>,
+) {
+  const iterator = input[Symbol.asyncIterator]();
+  const { value: userMessage } = await iterator.next();
+  if (!userMessage) return;
+
+  if (auditScenario === "localOnly") {
+    yield { ...successResult(), result: "Local command output" };
+    return;
+  }
+
+  yield {
+    type: "user" as const,
+    message: userMessage.message,
+    parent_tool_use_id: null,
+    uuid: userMessage.uuid,
+    session_id: "sdk-session",
+    isReplay: true,
+  };
+  resolveAuditTurnActivated();
+
+  if (auditScenario === "successWithoutReport") {
+    yield assistantMessage([{ type: "text", text: "Visible answer" }]);
+    yield successResult();
+    return;
+  }
+  if (auditScenario === "providerError") {
+    yield {
+      ...successResult(),
+      is_error: true,
+      result: "Provider failed",
+      errors: ["Provider failed"],
+    };
+    return;
+  }
+  if (auditScenario === "waitForCancel") {
+    await interrupted;
+    yield {
+      type: "system" as const,
+      subtype: "session_state_changed" as const,
+      state: "idle" as const,
+      uuid: randomUUID(),
+      session_id: "sdk-session",
+    };
+    return;
+  }
+
+  yield assistantMessage([{ type: "text", text: "Visible answer" }]);
+
+  const hookOptions = { signal: new AbortController().signal };
+  const stopHook = hookFrom(options, "Stop");
+  observedStopOutputs.push(
+    await stopHook(
+      { hook_event_name: "Stop", stop_hook_active: false } as Parameters<HookCallback>[0],
+      undefined,
+      hookOptions,
+    ),
+  );
+
+  const preToolUseHook = hookFrom(options, "PreToolUse");
+  observedPreToolDecision = await preToolUseHook(
+    {
+      hook_event_name: "PreToolUse",
+      tool_name: "Bash",
+      tool_input: { command: "git status" },
+      tool_use_id: "blocked-tool",
+    } as Parameters<HookCallback>[0],
+    "blocked-tool",
+    hookOptions,
+  );
+  observedCanUseToolDecision = await options.canUseTool?.(
+    "Bash",
+    { command: "git status" },
+    {
+      signal: hookOptions.signal,
+      toolUseID: "blocked-tool",
+      requestId: "permission-request",
+    },
+  );
+
+  const toolUseId = "audit-tool-use";
+  yield assistantMessage([
+    { type: "text", text: "Audit prose must stay hidden" },
+    {
+      type: "tool_use",
+      id: toolUseId,
+      name: FILE_CHANGE_AUDIT_WIRE_TOOL_NAME,
+      input: { paths: ["src/changed.ts"], complete: true },
+    },
+  ]);
+
+  const toolResult = await auditToolFrom(options).handler({
+    paths: ["src/changed.ts"],
+    complete: true,
+  });
+  yield {
+    type: "user" as const,
+    message: {
+      role: "user" as const,
+      content: [
+        {
+          type: "tool_result",
+          tool_use_id: toolUseId,
+          content: toolResult.content,
+        },
+      ],
+    },
+    parent_tool_use_id: null,
+    uuid: randomUUID(),
+    session_id: "sdk-session",
+  };
+
+  observedStopOutputs.push(
+    await stopHook(
+      { hook_event_name: "Stop", stop_hook_active: true } as Parameters<HookCallback>[0],
+      undefined,
+      hookOptions,
+    ),
+  );
+  yield successResult();
+}
+
+describe("agent file-change audit integration", () => {
+  beforeEach(() => {
+    observedStopOutputs = [];
+    observedPreToolDecision = undefined;
+    observedCanUseToolDecision = undefined;
+    replayMessages = [];
+    auditScenario = "reported";
+    auditTurnActivated = new Promise<void>((resolve) => {
+      resolveAuditTurnActivated = resolve;
+    });
+  });
+
+  const negotiatedCapabilities = {
+    _meta: {
+      jetbrains: {
+        air: {
+          version: 1,
+          capabilities: [AGENT_FILE_CHANGE_REPORT_CAPABILITY, "sessionFailure"],
+        },
+      },
+    },
+  };
+
+  async function createAuditAgent(updates: SessionNotification[]) {
+    const client = {
+      sessionUpdate: async (notification: SessionNotification) => void updates.push(notification),
+      requestPermission: async () => ({ outcome: { outcome: "cancelled" } }),
+      readTextFile: async () => ({ content: "" }),
+      writeTextFile: async () => ({}),
+    } as unknown as AcpClient;
+    const { ClaudeAcpAgent } = await import("../acp-agent.js");
+    const agent: ClaudeAcpAgentType = new ClaudeAcpAgent(client, {
+      log: () => {},
+      error: () => {},
+    });
+    await agent.initialize({
+      protocolVersion: 1,
+      clientCapabilities: negotiatedCapabilities,
+    });
+    const { sessionId } = await agent.newSession({ cwd: process.cwd(), mcpServers: [] });
+    return { agent, sessionId };
+  }
+
+  function fileChangeTerminals(updates: SessionNotification[]): AgentFileChangeReportResult[] {
+    return updates.flatMap((notification) => {
+      if (notification.update.sessionUpdate !== "session_info_update") return [];
+      const meta = notification.update._meta as
+        | {
+            jetbrains?: {
+              air?: { agentFileChangeReport?: AgentFileChangeReportResult };
+            };
+          }
+        | undefined;
+      const report = meta?.jetbrains?.air?.agentFileChangeReport;
+      return report ? [report] : [];
+    });
+  }
+
+  function auditedPrompt(sessionId: string, requestId: string, text: string) {
+    return {
+      sessionId,
+      prompt: [{ type: "text" as const, text }],
+      _meta: {
+        jetbrains: {
+          air: {
+            agentFileChangeReportRequest: { version: 1, requestId },
+          },
+        },
+      },
+    };
+  }
+
+  it.each([
+    {
+      name: "normal success without a Stop report",
+      scenario: "successWithoutReport" as const,
+      prompt: "Finish normally",
+      reason: "notReported" as const,
+      rejects: false,
+    },
+    {
+      name: "a local-only command",
+      scenario: "localOnly" as const,
+      prompt: "/context",
+      reason: "notReported" as const,
+      rejects: false,
+    },
+    {
+      name: "a provider error",
+      scenario: "providerError" as const,
+      prompt: "Call the provider",
+      reason: "providerError" as const,
+      rejects: false,
+    },
+  ])("publishes one terminal for $name", async ({ scenario, prompt, reason, rejects }) => {
+    auditScenario = scenario;
+    const updates: SessionNotification[] = [];
+    const { agent, sessionId } = await createAuditAgent(updates);
+    const requestId = `request-${scenario}`;
+    const result = agent.prompt(auditedPrompt(sessionId, requestId, prompt));
+
+    if (rejects) {
+      await expect(result).rejects.toBeDefined();
+    } else {
+      await expect(result).resolves.toBeDefined();
+    }
+    expect(fileChangeTerminals(updates)).toEqual([
+      {
+        version: 1,
+        requestId,
+        status: "unavailable",
+        reason,
+      },
+    ]);
+
+    await agent.dispose();
+    expect(fileChangeTerminals(updates)).toHaveLength(1);
+  });
+
+  it.each([
+    { name: "cancel", close: false },
+    { name: "session close", close: true },
+  ])("publishes one cancelled terminal and settles the prompt on $name", async ({ close }) => {
+    auditScenario = "waitForCancel";
+    const updates: SessionNotification[] = [];
+    const { agent, sessionId } = await createAuditAgent(updates);
+    const requestId = close ? "request-close" : "request-cancel";
+    const result = agent.prompt(auditedPrompt(sessionId, requestId, "Wait"));
+    await auditTurnActivated;
+
+    if (close) {
+      await agent.closeSession({ sessionId });
+    } else {
+      await agent.cancel({ sessionId });
+    }
+    await expect(result).resolves.toMatchObject({ stopReason: "cancelled" });
+    expect(fileChangeTerminals(updates)).toEqual([
+      {
+        version: 1,
+        requestId,
+        status: "unavailable",
+        reason: "cancelled",
+      },
+    ]);
+
+    await agent.dispose();
+    expect(fileChangeTerminals(updates)).toHaveLength(1);
+  });
+
+  it("negotiates an opt-in turn, publishes one report, and hides the audit continuation", async () => {
+    const updates: SessionNotification[] = [];
+    const client = {
+      sessionUpdate: async (notification: SessionNotification) => void updates.push(notification),
+      requestPermission: async () => ({ outcome: { outcome: "cancelled" } }),
+      readTextFile: async () => ({ content: "" }),
+      writeTextFile: async () => ({}),
+    } as unknown as AcpClient;
+    const { ClaudeAcpAgent } = await import("../acp-agent.js");
+    const agent: ClaudeAcpAgentType = new ClaudeAcpAgent(client, {
+      log: () => {},
+      error: () => {},
+    });
+
+    const capabilities = {
+      _meta: {
+        jetbrains: {
+          air: {
+            version: 1,
+            capabilities: [AGENT_FILE_CHANGE_REPORT_CAPABILITY],
+          },
+        },
+      },
+    };
+    const initialize = await agent.initialize({
+      protocolVersion: 1,
+      clientCapabilities: capabilities,
+    });
+    expect(initialize._meta).toMatchObject({
+      jetbrains: {
+        air: {
+          version: 1,
+          capabilities: expect.arrayContaining([AGENT_FILE_CHANGE_REPORT_CAPABILITY]),
+        },
+      },
+    });
+
+    const cwd = process.cwd();
+    const { sessionId } = await agent.newSession({ cwd, mcpServers: [] });
+    const response = await agent.prompt({
+      sessionId,
+      prompt: [{ type: "text", text: "Change the file" }],
+      _meta: {
+        jetbrains: {
+          air: {
+            agentFileChangeReportRequest: { version: 1, requestId: "request-integration" },
+          },
+        },
+      },
+    });
+
+    expect(response.stopReason).toBe("end_turn");
+    expect(observedStopOutputs).toHaveLength(2);
+    expect(observedStopOutputs[0]).toMatchObject({
+      hookSpecificOutput: {
+        hookEventName: "Stop",
+        additionalContext: expect.stringContaining(FILE_CHANGE_AUDIT_WIRE_TOOL_NAME),
+      },
+    });
+    expect(observedStopOutputs[1]).toEqual({});
+    expect(observedPreToolDecision).toMatchObject({
+      hookSpecificOutput: { permissionDecision: "deny" },
+    });
+    expect(observedCanUseToolDecision).toMatchObject({ behavior: "deny" });
+
+    const reportUpdates = updates.filter((notification) => {
+      if (notification.update.sessionUpdate !== "session_info_update") return false;
+      const meta = notification.update._meta as
+        { jetbrains?: { air?: { agentFileChangeReport?: unknown } } } | undefined;
+      return meta?.jetbrains?.air?.agentFileChangeReport !== undefined;
+    });
+    expect(reportUpdates).toEqual([
+      {
+        sessionId,
+        update: {
+          sessionUpdate: "session_info_update",
+          _meta: {
+            jetbrains: {
+              air: {
+                version: 1,
+                agentFileChangeReport: {
+                  version: 1,
+                  requestId: "request-integration",
+                  status: "reported",
+                  paths: [path.join(cwd, "src/changed.ts")],
+                  declaredComplete: true,
+                  truncated: false,
+                },
+              },
+            },
+          },
+        },
+      },
+    ]);
+
+    const serializedUpdates = JSON.stringify(updates);
+    expect(serializedUpdates).toContain("Visible answer");
+    expect(serializedUpdates).not.toContain("Audit prose must stay hidden");
+    expect(serializedUpdates).not.toContain(FILE_CHANGE_AUDIT_WIRE_TOOL_NAME);
+
+    await agent.dispose();
+
+    const firstStop = observedStopOutputs[0] as {
+      hookSpecificOutput?: { additionalContext?: string };
+    };
+    const auditContext = firstStop.hookSpecificOutput?.additionalContext;
+    if (!auditContext) throw new Error("Missing audit continuation context");
+    const replayToolUseId = "replay-audit-tool";
+    const deniedReplayToolUseId = "replay-denied-tool";
+    const replayUserMessage = (content: unknown) => ({
+      type: "user" as const,
+      message: { role: "user" as const, content },
+      parent_tool_use_id: null,
+      uuid: randomUUID(),
+      session_id: "replay-session",
+    });
+    replayMessages = [
+      replayUserMessage("Original prompt"),
+      assistantMessage([{ type: "text", text: "Visible persisted answer" }]),
+      replayUserMessage(auditContext),
+      assistantMessage([{ type: "text", text: "Separate audit prose must stay hidden" }]),
+      assistantMessage([
+        {
+          type: "tool_use",
+          id: deniedReplayToolUseId,
+          name: "Bash",
+          input: { command: "git status" },
+        },
+      ]),
+      replayUserMessage([
+        {
+          type: "tool_result",
+          tool_use_id: deniedReplayToolUseId,
+          content: "denied",
+          is_error: true,
+        },
+      ]),
+      assistantMessage([{ type: "text", text: "Prose after denial must stay hidden" }]),
+      assistantMessage([
+        {
+          type: "tool_use",
+          id: replayToolUseId,
+          name: FILE_CHANGE_AUDIT_WIRE_TOOL_NAME,
+          input: { paths: ["src/changed.ts"], complete: true },
+        },
+      ]),
+      replayUserMessage([
+        {
+          type: "tool_result",
+          tool_use_id: replayToolUseId,
+          content: "recorded",
+        },
+      ]),
+      replayUserMessage("Follow-up prompt"),
+      assistantMessage([{ type: "text", text: "Follow-up answer" }]),
+    ];
+
+    const replayUpdates: SessionNotification[] = [];
+    const replayAgent = new ClaudeAcpAgent(
+      {
+        ...client,
+        sessionUpdate: async (notification: SessionNotification) =>
+          void replayUpdates.push(notification),
+      } as AcpClient,
+      { log: () => {}, error: () => {} },
+    );
+    await replayAgent.initialize({
+      protocolVersion: 1,
+      clientCapabilities: capabilities,
+    });
+    await replayAgent.loadSession({
+      sessionId: "replay-session",
+      cwd,
+      mcpServers: [],
+    });
+
+    const serializedReplay = JSON.stringify(replayUpdates);
+    expect(serializedReplay).toContain("Original prompt");
+    expect(serializedReplay).toContain("Visible persisted answer");
+    expect(serializedReplay).toContain("Follow-up prompt");
+    expect(serializedReplay).toContain("Follow-up answer");
+    expect(serializedReplay).not.toContain("Separate audit prose must stay hidden");
+    expect(serializedReplay).not.toContain("Prose after denial must stay hidden");
+    expect(serializedReplay).not.toContain(FILE_CHANGE_AUDIT_WIRE_TOOL_NAME);
+    expect(serializedReplay).not.toContain("claude-agent-acp-file-change-audit");
+    await replayAgent.dispose();
+  });
+});

src/tests/file-change-audit.test.ts

@@ -0,0 +1,367 @@
+import type { HookCallback } from "@anthropic-ai/claude-agent-sdk";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { describe, expect, it, vi } from "vitest";
+import {
+  AGENT_FILE_CHANGE_REPORT_MAX_BYTES,
+  agentFileChangeReportRequestId,
+  createFileChangeAuditSupport,
+  createFileChangeAuditTurnState,
+  FILE_CHANGE_AUDIT_TOOL_NAME,
+  FILE_CHANGE_AUDIT_WIRE_TOOL_NAME,
+  type AgentFileChangeReport,
+  type AgentFileChangeReportResult,
+  type FileChangeAuditTurnState,
+} from "../file-change-audit.js";
+
+type RegisteredAuditTool = {
+  _meta?: Record<string, unknown>;
+  handler: (report: AgentFileChangeReport) => Promise<{
+    isError?: boolean;
+    structuredContent?: AgentFileChangeReportResult;
+  }>;
+};
+
+function auditToolHandler(
+  support: ReturnType<typeof createFileChangeAuditSupport>,
+): RegisteredAuditTool {
+  const server = support.mcpServer as unknown as {
+    instance: { _registeredTools: Record<string, RegisteredAuditTool> };
+  };
+  return server.instance._registeredTools[FILE_CHANGE_AUDIT_TOOL_NAME];
+}
+
+function stopInput(stopHookActive = false): Parameters<HookCallback>[0] {
+  return {
+    hook_event_name: "Stop",
+    stop_hook_active: stopHookActive,
+  } as Parameters<HookCallback>[0];
+}
+
+function createSupport(options: {
+  state: FileChangeAuditTurnState;
+  cwd?: string;
+  additionalDirectories?: string[];
+  publish?: (result: AgentFileChangeReportResult) => Promise<void>;
+  logError?: (message: string) => void;
+}) {
+  return createFileChangeAuditSupport({
+    cwd: options.cwd ?? process.cwd(),
+    additionalDirectories: options.additionalDirectories ?? [],
+    getActiveState: () => options.state,
+    publish: options.publish ?? (async () => {}),
+    logError: options.logError ?? (() => {}),
+  });
+}
+
+describe("agent file-change audit", () => {
+  it("accepts only the versioned prompt request shape", () => {
+    expect(
+      agentFileChangeReportRequestId({
+        jetbrains: {
+          air: {
+            agentFileChangeReportRequest: { version: 1, requestId: "turn:42_a-b.c" },
+          },
+        },
+      }),
+    ).toBe("turn:42_a-b.c");
+
+    for (const request of [
+      { version: 2, requestId: "turn-42" },
+      { version: 1, requestId: "contains spaces" },
+      { version: 1, requestId: "x".repeat(129) },
+      { version: 1 },
+      { version: 1, requestId: "turn-42", extra: true },
+      null,
+    ]) {
+      expect(
+        agentFileChangeReportRequestId({
+          jetbrains: { air: { agentFileChangeReportRequest: request } },
+        }),
+      ).toBeUndefined();
+    }
+  });
+
+  it("continues Stop at most once and reports a missing tool call once", async () => {
+    const state = createFileChangeAuditTurnState("request-1");
+    const publish = vi.fn(async (_result: AgentFileChangeReportResult) => {});
+    const support = createSupport({ state, publish });
+    const hookOptions = { signal: new AbortController().signal };
+    const preToolInput = (toolName: string) =>
+      ({
+        hook_event_name: "PreToolUse",
+        tool_name: toolName,
+        tool_input: {},
+        tool_use_id: "tool-1",
+      }) as Parameters<HookCallback>[0];
+
+    await expect(
+      support.preToolUseHook(preToolInput(FILE_CHANGE_AUDIT_WIRE_TOOL_NAME), "tool-1", hookOptions),
+    ).resolves.toMatchObject({
+      hookSpecificOutput: { permissionDecision: "deny" },
+    });
+
+    const pausedStop = {
+      ...stopInput(),
+      background_tasks: [{ id: "generator", type: "shell", status: "running", description: "" }],
+    } as Parameters<HookCallback>[0];
+    expect(await support.stopHook(pausedStop, undefined, hookOptions)).toEqual({});
+    expect(state.phase).toBe("requested");
+
+    const first = await support.stopHook(stopInput(), undefined, hookOptions);
+    expect(state.phase).toBe("collecting");
+    expect(first).toMatchObject({
+      hookSpecificOutput: {
+        hookEventName: "Stop",
+        additionalContext: expect.stringContaining(FILE_CHANGE_AUDIT_WIRE_TOOL_NAME),
+      },
+    });
+
+    await expect(
+      support.preToolUseHook(preToolInput("Bash"), "tool-1", hookOptions),
+    ).resolves.toMatchObject({
+      hookSpecificOutput: { permissionDecision: "deny" },
+    });
+    await expect(
+      support.preToolUseHook(preToolInput(FILE_CHANGE_AUDIT_WIRE_TOOL_NAME), "tool-1", hookOptions),
+    ).resolves.toMatchObject({
+      hookSpecificOutput: { permissionDecision: "allow" },
+    });
+
+    expect(await support.stopHook(stopInput(true), undefined, hookOptions)).toEqual({});
+    expect(state.phase).toBe("finished");
+    expect(publish).toHaveBeenCalledWith({
+      version: 1,
+      requestId: "request-1",
+      status: "unavailable",
+      reason: "notReported",
+    });
+
+    await support.stopHook(stopInput(true), undefined, hookOptions);
+    expect(publish).toHaveBeenCalledTimes(1);
+  });
+
+  it("publishes only the first unavailable terminal and rejects a late report", async () => {
+    const state = createFileChangeAuditTurnState("request-terminal-race");
+    state.phase = "collecting";
+    const publish = vi.fn(async (_result: AgentFileChangeReportResult) => {});
+    const support = createSupport({ state, publish });
+
+    await Promise.all([
+      support.finishUnavailable(state, "cancelled"),
+      support.finishUnavailable(state, "providerError"),
+    ]);
+
+    expect(publish).toHaveBeenCalledTimes(1);
+    expect(publish).toHaveBeenCalledWith({
+      version: 1,
+      requestId: "request-terminal-race",
+      status: "unavailable",
+      reason: "cancelled",
+    });
+    await expect(
+      auditToolHandler(support).handler({ paths: ["src/late.ts"], complete: true }),
+    ).resolves.toMatchObject({ isError: true });
+    expect(publish).toHaveBeenCalledTimes(1);
+  });
+
+  it("normalizes roots, drops invalid paths, and deduplicates without truncation", async () => {
+    const cwd = path.join(os.tmpdir(), "file-audit-project");
+    const additionalRoot = path.join(os.tmpdir(), "file-audit-shared");
+    const canonicalTempRoot = fs.realpathSync.native(os.tmpdir());
+    const canonicalCwd = path.join(canonicalTempRoot, "file-audit-project");
+    const canonicalAdditionalRoot = path.join(canonicalTempRoot, "file-audit-shared");
+    const outside = path.join(os.tmpdir(), "file-audit-outside", "outside.txt");
+    const state = createFileChangeAuditTurnState("request-2");
+    state.phase = "collecting";
+    const published: AgentFileChangeReportResult[] = [];
+    const support = createSupport({
+      state,
+      cwd,
+      additionalDirectories: [additionalRoot],
+      publish: async (result) => void published.push(result),
+    });
+    const tool = auditToolHandler(support);
+
+    expect(tool._meta).toMatchObject({
+      "anthropic/alwaysLoad": true,
+      "claude/endTurn": true,
+    });
+    const result = await tool.handler({
+      paths: [
+        "src/a.ts",
+        "src/a.ts",
+        cwd,
+        additionalRoot,
+        path.join(additionalRoot, "generated.ts"),
+        outside,
+        "bad\u0000path",
+        "bad\u0085path",
+        "x".repeat(4090),
+      ],
+      complete: true,
+      uncertainty: "Generated files may be missing",
+    });
+
+    expect(result.isError).not.toBe(true);
+    expect(published).toEqual([
+      {
+        version: 1,
+        requestId: "request-2",
+        status: "reported",
+        paths: [
+          path.join(canonicalCwd, "src/a.ts"),
+          path.join(canonicalAdditionalRoot, "generated.ts"),
+        ],
+        declaredComplete: false,
+        truncated: true,
+        uncertainty: "Generated files may be missing",
+      },
+    ]);
+
+    expect(await tool.handler({ paths: ["src/late.ts"], complete: true })).toMatchObject({
+      isError: true,
+    });
+    expect(published).toHaveLength(1);
+
+    const duplicateOnlyState = createFileChangeAuditTurnState("request-3");
+    duplicateOnlyState.phase = "collecting";
+    const duplicateOnlyReports: AgentFileChangeReportResult[] = [];
+    const duplicateOnlyTool = auditToolHandler(
+      createSupport({
+        state: duplicateOnlyState,
+        cwd,
+        publish: async (report) => void duplicateOnlyReports.push(report),
+      }),
+    );
+    await duplicateOnlyTool.handler({ paths: ["src/a.ts", "src/a.ts"], complete: true });
+    expect(duplicateOnlyReports[0]).toMatchObject({
+      declaredComplete: true,
+      truncated: false,
+      paths: [path.join(canonicalCwd, "src/a.ts")],
+    });
+  });
+
+  it("accepts canonical paths under a symlinked workspace root", async () => {
+    if (process.platform === "win32") return;
+
+    const realRoot = fs.mkdtempSync(path.join(os.tmpdir(), "file-audit-real-"));
+    const linkedRoot = `${realRoot}-link`;
+    fs.symlinkSync(realRoot, linkedRoot, "dir");
+    try {
+      const state = createFileChangeAuditTurnState("request-symlink-root");
+      state.phase = "collecting";
+      const reports: AgentFileChangeReportResult[] = [];
+      const tool = auditToolHandler(
+        createSupport({
+          state,
+          cwd: linkedRoot,
+          publish: async (report) => void reports.push(report),
+        }),
+      );
+      const canonicalPath = path.join(fs.realpathSync.native(realRoot), "generated.ts");
+
+      await tool.handler({
+        paths: [canonicalPath, path.join(linkedRoot, "generated.ts")],
+        complete: true,
+      });
+
+      expect(reports[0]).toMatchObject({
+        paths: [canonicalPath],
+        declaredComplete: true,
+        truncated: false,
+      });
+    } finally {
+      fs.unlinkSync(linkedRoot);
+      fs.rmSync(realRoot, { recursive: true, force: true });
+    }
+  });
+
+  it("caps path count and total UTF-8 bytes", async () => {
+    const cwd = path.join(os.tmpdir(), "file-audit-caps");
+
+    const countState = createFileChangeAuditTurnState("request-count");
+    countState.phase = "collecting";
+    const countReports: AgentFileChangeReportResult[] = [];
+    await auditToolHandler(
+      createSupport({
+        state: countState,
+        cwd,
+        publish: async (report) => void countReports.push(report),
+      }),
+    ).handler({
+      paths: Array.from({ length: 1030 }, (_, index) => `src/file-${index}.ts`),
+      complete: true,
+    });
+    expect(countReports[0]).toMatchObject({
+      declaredComplete: false,
+      truncated: true,
+    });
+    expect(countReports[0].status).toBe("reported");
+    if (countReports[0].status !== "reported") throw new Error("Expected a reported result");
+    expect(countReports[0].paths).toHaveLength(1024);
+
+    const byteState = createFileChangeAuditTurnState("request-bytes");
+    byteState.phase = "collecting";
+    const byteReports: AgentFileChangeReportResult[] = [];
+    await auditToolHandler(
+      createSupport({
+        state: byteState,
+        cwd,
+        publish: async (report) => void byteReports.push(report),
+      }),
+    ).handler({
+      paths: Array.from(
+        { length: 1000 },
+        (_, index) => `generated/${index}-${"x".repeat(280)}.txt`,
+      ),
+      complete: true,
+    });
+    expect(byteReports[0]).toMatchObject({
+      declaredComplete: false,
+      truncated: true,
+    });
+    expect(byteReports[0].status).toBe("reported");
+    if (byteReports[0].status !== "reported") throw new Error("Expected a reported result");
+    expect(byteReports[0].paths.length).toBeLessThan(1000);
+    expect(Buffer.byteLength(JSON.stringify(byteReports[0]), "utf8")).toBeLessThanOrEqual(
+      AGENT_FILE_CHANGE_REPORT_MAX_BYTES,
+    );
+  });
+
+  it("fails open when report publication fails", async () => {
+    const state = createFileChangeAuditTurnState("request-4");
+    state.phase = "collecting";
+    const logError = vi.fn();
+    const tool = auditToolHandler(
+      createSupport({
+        state,
+        publish: async () => {
+          throw new Error("transport closed");
+        },
+        logError,
+      }),
+    );
+
+    await expect(tool.handler({ paths: ["src/a.ts"], complete: true })).resolves.toMatchObject({
+      structuredContent: { requestId: "request-4", status: "reported" },
+    });
+    expect(state.phase).toBe("finished");
+    expect(logError).toHaveBeenCalledWith(expect.stringContaining("transport closed"));
+
+    const unavailableState = createFileChangeAuditTurnState("request-unavailable-failure");
+    const unavailableSupport = createSupport({
+      state: unavailableState,
+      publish: async () => {
+        throw new Error("transport closed");
+      },
+      logError,
+    });
+    await expect(
+      unavailableSupport.finishUnavailable(unavailableState, "providerError"),
+    ).resolves.toBeUndefined();
+    expect(unavailableState.phase).toBe("finished");
+    expect(logError).toHaveBeenCalledWith(expect.stringContaining("request-unavailable-failure"));
+  });
+});

src/tests/fixtures/usage-limit-session.jsonl

@@ -0,0 +1,3 @@
+{"type":"user","uuid":"11111111-1111-4111-8111-111111111111","parentUuid":null,"sessionId":"aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa","timestamp":"2026-01-01T00:00:00.000Z","message":{"role":"user","content":[{"type":"text","text":"Create a short HTML page"}]}}
+{"type":"assistant","uuid":"22222222-2222-4222-8222-222222222222","parentUuid":"11111111-1111-4111-8111-111111111111","sessionId":"aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa","timestamp":"2026-01-01T00:00:01.000Z","error":"rate_limit","isApiErrorMessage":true,"message":{"id":"msg_usage_limit","type":"message","role":"assistant","model":"<synthetic>","content":[{"type":"text","text":"You've hit your individual spend limit · run /usage-credits to ask your admin for a higher limit"}],"stop_reason":"stop_sequence","stop_sequence":null,"usage":{"input_tokens":0,"output_tokens":0,"cache_read_input_tokens":0,"cache_creation_input_tokens":0}}}
+{"type":"assistant","uuid":"33333333-3333-4333-8333-333333333333","parentUuid":"22222222-2222-4222-8222-222222222222","sessionId":"aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa","timestamp":"2026-01-01T00:00:02.000Z","message":{"id":"msg_local_command","type":"message","role":"assistant","model":"<synthetic>","content":[{"type":"text","text":"No response requested."}],"stop_reason":"stop_sequence","stop_sequence":null,"usage":{"input_tokens":0,"output_tokens":0,"cache_read_input_tokens":0,"cache_creation_input_tokens":0}}}

src/tests/providers.test.ts

@@ -59,7 +59,7 @@ describe("providers", () => {
     expect(response.agentCapabilities?.providers).toEqual({});
   });
 
-  it("lists a single optional 'main' provider, unconfigured by default", async () => {
+  it("lists one mutually exclusive provider slot with native routing", async () => {
     const [agent] = await createAgentMock();
     const response = await agent.unstable_listProviders({});
     expect(response.providers).toEqual([
@@ -67,7 +67,7 @@ describe("providers", () => {
         providerId: "main",
         supported: ["anthropic", "bedrock", "vertex"],
         required: false,
-        current: null,
+        current: { apiType: "anthropic", baseUrl: "https://api.anthropic.com" },
       },
     ]);
   });
@@ -126,7 +126,7 @@ describe("providers", () => {
     ).rejects.toMatchObject({ code: -32602 });
   });
 
-  it("disables the 'main' provider by clearing config and reporting current: null", async () => {
+  it("restores native routing after the last override is disabled", async () => {
     const [agent] = await createAgentMock();
     await agent.unstable_setProvider({
       providerId: "main",
@@ -137,7 +137,36 @@ describe("providers", () => {
 
     await expect(agent.unstable_disableProvider({ providerId: "main" })).resolves.toEqual({});
 
-    expect((await agent.unstable_listProviders({})).providers[0].current).toBeNull();
+    expect((await agent.unstable_listProviders({})).providers[0].current).toEqual({
+      apiType: "anthropic",
+      baseUrl: "https://api.anthropic.com",
+    });
+  });
+
+  it("replaces the active api type when the single slot is set again", async () => {
+    const [agent] = await createAgentMock();
+    await agent.unstable_setProvider({
+      providerId: "main",
+      apiType: "anthropic",
+      baseUrl: "https://anthropic.example",
+    });
+    await agent.unstable_setProvider({
+      providerId: "main",
+      apiType: "bedrock",
+      baseUrl: "https://bedrock.example",
+    });
+
+    const overridden = await agent.unstable_listProviders({});
+    expect(overridden.providers[0].current).toEqual({
+      apiType: "bedrock",
+      baseUrl: "https://bedrock.example",
+    });
+
+    await agent.unstable_disableProvider({ providerId: "main" });
+    expect((await agent.unstable_listProviders({})).providers[0].current).toEqual({
+      apiType: "anthropic",
+      baseUrl: "https://api.anthropic.com",
+    });
   });
 
   it("treats disabling an unknown provider as an idempotent no-op", async () => {
@@ -298,6 +327,9 @@ describe("providers", () => {
 
     await agent.logout({});
 
-    expect((await agent.unstable_listProviders({})).providers[0].current).toBeNull();
+    expect((await agent.unstable_listProviders({})).providers[0].current).toEqual({
+      apiType: "anthropic",
+      baseUrl: "https://api.anthropic.com",
+    });
   });
 });

src/tests/tools.test.ts

@@ -1,4 +1,7 @@
-import { describe, it, expect, beforeEach, vi } from "vitest";
+import { describe, it, expect, afterEach, beforeEach, vi } from "vitest";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import * as path from "node:path";
 import { ClientCapabilities } from "@agentclientprotocol/sdk";
 import { ImageBlockParam, ToolResultBlockParam } from "@anthropic-ai/sdk/resources";
 import {
@@ -18,8 +21,10 @@ import {
   toolInfoFromToolUse,
   planEntries,
   applyTaskCreate,
+  applyTaskList,
   applyTaskUpdate,
   parseTaskCreateOutput,
+  parseTaskListOutput,
   taskStateToPlanEntries,
   TaskState,
 } from "../tools.js";
@@ -491,6 +496,94 @@ describe("Bash terminal output", () => {
       });
     });
 
+    it("keys the terminal metas off the tool_use id, which is what was announced", () => {
+      // `toolInfoFromToolUse` announces the terminal as `toolUse.id`, so the
+      // result's metas have to use the same value for the client to match them
+      // up. A result block that disagrees (or omits `tool_use_id`) must not be
+      // allowed to retarget them.
+      const toolResult = {
+        ...makeBashResult("out", "", 0),
+        tool_use_id: "toolu_something_else",
+      };
+      const update = toolUpdateFromToolResult(toolResult, bashToolUse, true);
+
+      expect(update.content).toEqual([{ type: "terminal", terminalId: "toolu_bash" }]);
+      expect(update._meta).toEqual({
+        terminal_info: { terminal_id: "toolu_bash" },
+        terminal_output: { terminal_id: "toolu_bash", data: "out" },
+        terminal_exit: { terminal_id: "toolu_bash", exit_code: 0, signal: null },
+      });
+    });
+
+    it("falls back to the result's tool_use_id when the tool_use is unavailable", () => {
+      const toolResult = makeBashResult("out", "", 0);
+      const update = toolUpdateFromToolResult(toolResult, { name: "Bash" }, true);
+
+      expect(update.content).toEqual([{ type: "terminal", terminalId: "toolu_bash" }]);
+      expect(update._meta).toEqual({
+        terminal_info: { terminal_id: "toolu_bash" },
+        terminal_output: { terminal_id: "toolu_bash", data: "out" },
+        terminal_exit: { terminal_id: "toolu_bash", exit_code: 0, signal: null },
+      });
+    });
+
+    it("renders a code block instead of a dangling terminal when no id is available", () => {
+      // Previously this emitted `terminal_id: ""` for all three metas. Nothing
+      // on the client has a terminal under that id, so the output was stranded
+      // (Zed buffers output/exit for unknown terminals indefinitely) and the
+      // user saw an empty terminal. Degrade to the non-terminal rendering.
+      // `tool_use_id` is required on every result-block type, so a block without
+      // it can only arrive at runtime (an older or non-conforming emitter). The
+      // source guards for it with `"tool_use_id" in toolResult`, so exercise that
+      // path with a cast rather than pretending the type allows it.
+      const { content, type } = makeBashResult("out", "", 0);
+      const update = toolUpdateFromToolResult(
+        { content, type } as unknown as Parameters<typeof toolUpdateFromToolResult>[0],
+        { name: "Bash" },
+        true,
+      );
+
+      expect(update._meta).toBeUndefined();
+      expect(update.content).toEqual([
+        {
+          type: "content",
+          content: { type: "text", text: "```console\nout\n```" },
+        },
+      ]);
+    });
+
+    it("treats an empty tool_use id as no id and falls back to the result block", () => {
+      const toolResult = makeBashResult("out", "", 0);
+      const update = toolUpdateFromToolResult(toolResult, { id: "", name: "Bash" }, true);
+
+      expect(update.content).toEqual([{ type: "terminal", terminalId: "toolu_bash" }]);
+      expect(update._meta).toEqual({
+        terminal_info: { terminal_id: "toolu_bash" },
+        terminal_output: { terminal_id: "toolu_bash", data: "out" },
+        terminal_exit: { terminal_id: "toolu_bash", exit_code: 0, signal: null },
+      });
+    });
+
+    it("renders a code block when neither id is a usable string", () => {
+      // A present-but-undefined `tool_use_id` still satisfies an `in` check, and
+      // stringifying it would key all three metas on the literal "undefined" — an
+      // id no client ever created a terminal for, so the output strands exactly as
+      // it did under the old empty-string id.
+      const toolResult = {
+        ...makeBashResult("out", "", 0),
+        tool_use_id: undefined,
+      } as unknown as Parameters<typeof toolUpdateFromToolResult>[0];
+      const update = toolUpdateFromToolResult(toolResult, { id: "", name: "Bash" }, true);
+
+      expect(update._meta).toBeUndefined();
+      expect(update.content).toEqual([
+        {
+          type: "content",
+          content: { type: "text", text: "```console\nout\n```" },
+        },
+      ]);
+    });
+
     it("should include exit_code from return_code in terminal_exit", () => {
       const toolResult = makeBashResult("", "command not found", 127);
       const update = toolUpdateFromToolResult(toolResult, bashToolUse, true);
@@ -1729,6 +1822,14 @@ describe("planEntries - undefined input regression", () => {
       { content: "Task 2", status: "completed", priority: "medium" },
     ]);
   });
+
+  it("uses activeForm while a todo is in progress", () => {
+    expect(
+      planEntries({
+        todos: [{ content: "Run tests", status: "in_progress", activeForm: "Running tests" }],
+      }),
+    ).toEqual([{ content: "Running tests", status: "in_progress", priority: "medium" }]);
+  });
 });
 
 describe("toAcpNotifications - TodoWrite with undefined input regression", () => {
@@ -1796,6 +1897,20 @@ describe("parseTaskCreateOutput", () => {
     expect(parsed).toEqual({ task: { id: "2", subject: "Y" } });
   });
 
+  it("continues past unrelated JSON blocks", () => {
+    const parsed = parseTaskCreateOutput([
+      { type: "text", text: JSON.stringify({ metadata: "unrelated" }) },
+      { type: "text", text: JSON.stringify({ task: { id: "2", subject: "Y" } }) },
+    ]);
+    expect(parsed).toEqual({ task: { id: "2", subject: "Y" } });
+  });
+
+  it("parses the human-readable TaskCreate format used in session history", () => {
+    expect(parseTaskCreateOutput("Task #42 created successfully: Run tests")).toEqual({
+      task: { id: "42", subject: "Run tests" },
+    });
+  });
+
   it("returns undefined for non-JSON content", () => {
     expect(parseTaskCreateOutput("not json")).toBeUndefined();
     expect(parseTaskCreateOutput([{ type: "text", text: "not json" }])).toBeUndefined();
@@ -1830,11 +1945,15 @@ describe("applyTaskCreate / applyTaskUpdate", () => {
 
   it("updates fields by task ID and keeps insertion order in plan entries", () => {
     const state: TaskState = new Map();
-    applyTaskCreate(state, { subject: "A", description: "" }, { task: { id: "1", subject: "A" } });
+    applyTaskCreate(
+      state,
+      { subject: "A", description: "", activeForm: "Working on A" },
+      { task: { id: "1", subject: "A" } },
+    );
     applyTaskCreate(state, { subject: "B", description: "" }, { task: { id: "2", subject: "B" } });
     applyTaskUpdate(state, { taskId: "1", status: "in_progress" });
     expect(taskStateToPlanEntries(state)).toEqual([
-      { content: "A", status: "in_progress", priority: "medium" },
+      { content: "Working on A", status: "in_progress", priority: "medium" },
       { content: "B", status: "pending", priority: "medium" },
     ]);
   });
@@ -1864,6 +1983,84 @@ describe("applyTaskCreate / applyTaskUpdate", () => {
     // update is dropped instead of synthesizing a blank placeholder.
     expect(state.has("5")).toBe(false);
   });
+
+  it("rebuilds task state from TaskList while preserving richer local fields", () => {
+    const state: TaskState = new Map([
+      [
+        "1",
+        {
+          subject: "Old subject",
+          status: "pending",
+          activeForm: "Running the task",
+          description: "Details",
+        },
+      ],
+      ["deleted", { subject: "Stale", status: "pending" }],
+    ]);
+    const output = parseTaskListOutput(
+      JSON.stringify({
+        tasks: [
+          { id: "1", subject: "Current subject", status: "in_progress", blockedBy: [] },
+          { id: "2", subject: "New task", status: "pending", blockedBy: [] },
+        ],
+      }),
+    );
+
+    expect(output).toBeDefined();
+    applyTaskList(state, output!);
+
+    expect([...state.entries()]).toEqual([
+      [
+        "1",
+        {
+          subject: "Current subject",
+          status: "in_progress",
+          activeForm: "Running the task",
+          description: "Details",
+        },
+      ],
+      [
+        "2",
+        {
+          subject: "New task",
+          status: "pending",
+          activeForm: undefined,
+          description: undefined,
+        },
+      ],
+    ]);
+  });
+
+  it("finds a TaskList snapshot after an unrelated JSON block", () => {
+    expect(
+      parseTaskListOutput([
+        { type: "text", text: JSON.stringify({ metadata: "unrelated" }) },
+        {
+          type: "text",
+          text: JSON.stringify({
+            tasks: [{ id: "1", subject: "Recovered", status: "pending", blockedBy: [] }],
+          }),
+        },
+      ]),
+    ).toEqual({
+      tasks: [{ id: "1", subject: "Recovered", status: "pending", blockedBy: [] }],
+    });
+  });
+
+  it("parses the human-readable TaskList format used in session history", () => {
+    expect(
+      parseTaskListOutput(
+        "#1 [in_progress] Run tests\n#2 [pending] Write release notes [blocked by #1]",
+      ),
+    ).toEqual({
+      tasks: [
+        { id: "1", subject: "Run tests", status: "in_progress", blockedBy: [] },
+        { id: "2", subject: "Write release notes", status: "pending", blockedBy: ["1"] },
+      ],
+    });
+
+    expect(parseTaskListOutput("No tasks found")).toEqual({ tasks: [] });
+  });
 });
 
 describe("toAcpNotifications - Task* tools", () => {
@@ -2024,10 +2221,9 @@ describe("toAcpNotifications - Task* tools", () => {
     });
   });
 
-  it("suppresses TaskList and TaskGet tool_result without touching task state", () => {
+  it("uses the structured TaskList result as an authoritative plan snapshot", () => {
     const toolUseCache: ToolUseCache = {
       "list-1": { type: "tool_use", id: "list-1", name: "TaskList", input: {} },
-      "get-1": { type: "tool_use", id: "get-1", name: "TaskGet", input: { taskId: "1" } },
     };
     const taskState: TaskState = new Map([
       ["1", { subject: "Existing", status: "in_progress" as const }],
@@ -2035,8 +2231,93 @@ describe("toAcpNotifications - Task* tools", () => {
 
     const notifications = toAcpNotifications(
       [
-        { type: "tool_result", tool_use_id: "list-1", content: "...", is_error: false },
-        { type: "tool_result", tool_use_id: "get-1", content: "...", is_error: false },
+        {
+          type: "tool_result",
+          tool_use_id: "list-1",
+          content: "#2 [pending] Recovered",
+          is_error: false,
+        },
+      ] as any,
+      "user",
+      "test-session",
+      toolUseCache,
+      mockClient,
+      mockLogger,
+      {
+        taskState,
+        toolUseResult: {
+          tasks: [{ id: "2", subject: "Recovered", status: "pending", blockedBy: [] }],
+        },
+      },
+    );
+
+    expect(notifications).toHaveLength(1);
+    expect(notifications[0].update).toMatchObject({
+      sessionUpdate: "plan",
+      entries: [{ content: "Recovered", status: "pending", priority: "medium" }],
+    });
+    expect([...taskState.keys()]).toEqual(["2"]);
+  });
+
+  it("does not apply a logically failed TaskUpdate", () => {
+    const toolUseCache: ToolUseCache = {
+      "update-1": {
+        type: "tool_use",
+        id: "update-1",
+        name: "TaskUpdate",
+        input: { taskId: "1", status: "completed" },
+      },
+    };
+    const taskState: TaskState = new Map([["1", { subject: "Existing", status: "pending" }]]);
+
+    const notifications = toAcpNotifications(
+      [
+        {
+          type: "tool_result",
+          tool_use_id: "update-1",
+          content: "Task #1 not found",
+          is_error: false,
+        },
+      ] as any,
+      "user",
+      "test-session",
+      toolUseCache,
+      mockClient,
+      mockLogger,
+      {
+        taskState,
+        toolUseResult: {
+          success: false,
+          taskId: "1",
+          updatedFields: [],
+          error: "Task not found",
+        },
+      },
+    );
+
+    expect(notifications).toHaveLength(0);
+    expect(taskState.get("1")).toEqual({ subject: "Existing", status: "pending" });
+  });
+
+  it("does not apply a replayed TaskUpdate failure without structured output", () => {
+    const toolUseCache: ToolUseCache = {
+      "update-1": {
+        type: "tool_use",
+        id: "update-1",
+        name: "TaskUpdate",
+        input: { taskId: "1", status: "completed" },
+      },
+    };
+    const taskState: TaskState = new Map([["1", { subject: "Existing", status: "pending" }]]);
+
+    const notifications = toAcpNotifications(
+      [
+        {
+          type: "tool_result",
+          tool_use_id: "update-1",
+          content: "Task #1 not found",
+          is_error: false,
+        },
       ] as any,
       "user",
       "test-session",
@@ -2047,7 +2328,7 @@ describe("toAcpNotifications - Task* tools", () => {
     );
 
     expect(notifications).toHaveLength(0);
-    expect(taskState.get("1")).toEqual({ subject: "Existing", status: "in_progress" });
+    expect(taskState.get("1")).toEqual({ subject: "Existing", status: "pending" });
   });
 
   it("does not apply TaskCreate/TaskUpdate when the tool_result reports an error", () => {
@@ -2896,3 +3177,147 @@ describe("structured tool_use_result rendering (Read/Bash/WebSearch)", () => {
     });
   });
 });
+
+describe("Skill tool rendering", () => {
+  const mockLogger: Logger = { log: () => {}, error: () => {} };
+
+  describe("toolInfoFromToolUse", () => {
+    it("sets title to 'Load skill: <name>' and returns empty content", () => {
+      const info = toolInfoFromToolUse(
+        { name: "Skill", id: "toolu_1", input: { skill: "commits" } },
+        false,
+      );
+      expect(info.title).toBe("Load skill: commits");
+      expect(info.kind).toBe("other");
+      expect(info.content).toEqual([]);
+    });
+
+    it("falls back to 'Load skill' when skill name is absent", () => {
+      const info = toolInfoFromToolUse({ name: "Skill", id: "toolu_2", input: {} }, false);
+      expect(info.title).toBe("Load skill");
+      expect(info.content).toEqual([]);
+    });
+
+    it("does not throw when input is undefined", () => {
+      const info = toolInfoFromToolUse({ name: "Skill", id: "toolu_3", input: undefined }, false);
+      expect(info.title).toBe("Load skill");
+      expect(info.content).toEqual([]);
+    });
+  });
+
+  describe("toolUpdateFromToolResult", () => {
+    it("suppresses the raw 'Launching skill' result text", () => {
+      const toolUse = {
+        type: "tool_use",
+        id: "toolu_4",
+        name: "Skill",
+        input: { skill: "commits" },
+      };
+      const toolResult = {
+        type: "tool_result" as const,
+        tool_use_id: "toolu_4",
+        content: "Launching skill: commits",
+        is_error: false,
+      };
+      const update = toolUpdateFromToolResult(toolResult, toolUse, false);
+      expect(update).toEqual({});
+    });
+  });
+
+  describe("_meta.claudeCode.skill in tool_call notification", () => {
+    it("includes skill name in _meta.claudeCode when Skill tool is invoked", () => {
+      const notifications = toAcpNotifications(
+        [
+          { type: "tool_use", id: "toolu_5", name: "Skill", input: { skill: "commits", args: "" } },
+        ] as any,
+        "assistant",
+        "test-session",
+        {},
+        {} as AcpClient,
+        mockLogger,
+      );
+      expect(notifications[0]?.update).toMatchObject({
+        sessionUpdate: "tool_call",
+        _meta: { claudeCode: { toolName: "Skill", skill: "commits" } },
+      });
+    });
+
+    it("omits skill from _meta.claudeCode when skill name is missing", () => {
+      const notifications = toAcpNotifications(
+        [{ type: "tool_use", id: "toolu_6", name: "Skill", input: {} }] as any,
+        "assistant",
+        "test-session",
+        {},
+        {} as AcpClient,
+        mockLogger,
+      );
+      const meta = (notifications[0]?.update as any)?._meta?.claudeCode;
+      expect(meta).toBeDefined();
+      expect(meta.skill).toBeUndefined();
+    });
+  });
+
+  describe("_meta.claudeCode.skillPath", () => {
+    const skillMeta = (skill: string, cwd?: string) =>
+      (
+        toAcpNotifications(
+          [{ type: "tool_use", id: "toolu_skill_path", name: "Skill", input: { skill } }] as any,
+          "assistant",
+          "test-session",
+          {},
+          {} as AcpClient,
+          mockLogger,
+          cwd ? { cwd } : undefined,
+        )[0]?.update as any
+      )?._meta?.claudeCode;
+
+    let root: string;
+
+    beforeEach(() => {
+      root = mkdtempSync(path.join(tmpdir(), "acp-skill-path-"));
+    });
+
+    afterEach(() => {
+      rmSync(root, { recursive: true, force: true });
+    });
+
+    const writeSkill = (relativeDir: string) => {
+      const dir = path.join(root, relativeDir);
+      mkdirSync(dir, { recursive: true });
+      const file = path.join(dir, "SKILL.md");
+      writeFileSync(file, "# skill\n");
+      return file;
+    };
+
+    it("resolves a project-level .claude/skills skill", () => {
+      const file = writeSkill(".claude/skills/commits");
+      expect(skillMeta("commits", root).skillPath).toBe(file);
+    });
+
+    it("resolves a project-level .agents/skills skill", () => {
+      const file = writeSkill(".agents/skills/commits");
+      expect(skillMeta("commits", root).skillPath).toBe(file);
+    });
+
+    it("resolves a directory-scoped skill spelled prefix:name", () => {
+      const file = writeSkill("apps/web/.claude/skills/deploy");
+      expect(skillMeta("apps/web:deploy", root).skillPath).toBe(file);
+    });
+
+    it("resolves a plugin skill spelled plugin:name", () => {
+      const file = writeSkill(".claude/plugins/reviewer/skills/audit");
+      expect(skillMeta("reviewer:audit", root).skillPath).toBe(file);
+    });
+
+    it("omits skillPath when no known layout holds the skill", () => {
+      const meta = skillMeta("nonexistent", root);
+      expect(meta.skill).toBe("nonexistent");
+      expect(meta.skillPath).toBeUndefined();
+    });
+
+    it("omits skillPath when the session has no cwd", () => {
+      writeSkill(".claude/skills/commits");
+      expect(skillMeta("commits").skillPath).toBeUndefined();
+    });
+  });
+});

src/tools.ts

@@ -21,7 +21,9 @@ import {
   ReportFindingsInput,
   TaskCreateInput,
   TaskCreateOutput,
+  TaskListOutput,
   TaskUpdateInput,
+  TaskUpdateOutput,
   TodoWriteInput,
   WebFetchInput,
   WebSearchInput,
@@ -216,7 +218,7 @@ export function toolInfoFromToolUse(
       }
       const displayPath = input?.file_path ? toDisplayPath(input.file_path, cwd) : undefined;
       return {
-        title: displayPath ? `Write ${displayPath}` : "Write",
+        title: displayPath ? `Write ${displayPath}` : "Preparing file…",
         kind: "edit",
         content,
         locations: input?.file_path ? [{ path: input.file_path }] : [],
@@ -439,6 +441,16 @@ export function toolInfoFromToolUse(
       };
     }
 
+    case "Skill": {
+      const input = toolUse.input as { skill?: string; args?: string } | undefined;
+      const skillName = input?.skill;
+      return {
+        title: skillName ? `Load skill: ${skillName}` : "Load skill",
+        kind: "other",
+        content: [],
+      };
+    }
+
     case "AskUserQuestion": {
       const input = toolUse.input as Partial<AskUserQuestionInput> | undefined;
       const questions = Array.isArray(input?.questions) ? input.questions : [];
@@ -686,7 +698,19 @@ export function toolUpdateFromToolResult(
 
     case "Bash": {
       const result = toolResult.content;
-      const terminalId = "tool_use_id" in toolResult ? String(toolResult.tool_use_id) : "";
+      // The terminal was announced under the tool_use's own id (see
+      // `toolInfoFromToolUse`), so key the output/exit metas off that: it is the
+      // id the client actually created a terminal for. `toolResult.tool_use_id`
+      // is the same value whenever present — the caller looks the tool_use up by
+      // it — so preferring `toolUse.id` only adds a source for the case where the
+      // result block carries no id at all. Anything that isn't a non-empty
+      // string is no id at all: `""` matches no terminal, and stringifying a
+      // present-but-undefined field would invent the literal `"undefined"`.
+      const terminalIdOf = (id: unknown): string | undefined =>
+        typeof id === "string" && id.length > 0 ? id : undefined;
+      const terminalId: string | undefined =
+        terminalIdOf(toolUse?.id) ??
+        terminalIdOf("tool_use_id" in toolResult ? toolResult.tool_use_id : undefined);
       const isError = "is_error" in toolResult && toolResult.is_error;
 
       // Extract output and exit code from either format:
@@ -767,7 +791,14 @@ export function toolUpdateFromToolResult(
         }
       }
 
-      if (supportsTerminalOutput) {
+      // Without a terminal id there is nothing the client can reconcile these
+      // metas against, and emitting them anyway strands the output: a client that
+      // buffers output/exit for terminals it has not been told about (Zed keeps
+      // them in `pending_terminal_output`/`pending_terminal_exit`, drained only on
+      // a matching create) would hold them forever behind an id that never
+      // arrives, showing an empty terminal. Fall through to the code-block
+      // rendering below instead.
+      if (supportsTerminalOutput && terminalId !== undefined) {
         return {
           content: [{ type: "terminal" as const, terminalId }],
           _meta: {
@@ -842,6 +873,10 @@ export function toolUpdateFromToolResult(
       );
     }
 
+    case "Skill": {
+      return {};
+    }
+
     case "Edit": // Edit is handled in hooks
     case "Write": {
       return {};
@@ -1011,7 +1046,7 @@ export type ClaudePlanEntry = {
 
 export function planEntries(input: { todos: ClaudePlanEntry[] } | undefined): PlanEntry[] {
   return (input?.todos ?? []).map((todo) => ({
-    content: todo.content,
+    content: todo.status === "in_progress" && todo.activeForm ? todo.activeForm : todo.content,
     status: todo.status,
     priority: "medium",
   }));
@@ -1033,31 +1068,29 @@ export type TaskEntry = {
 export type TaskState = Map<string, TaskEntry>;
 
 /**
- * Best-effort parse of a TaskCreate tool_result content into the structured
- * TaskCreateOutput. The SDK delivers tool outputs either as a string or as
- * an array of TextBlockParam-like blocks containing JSON text; try both.
+ * Best-effort parse of a structured Task* tool_result. The SDK delivers tool
+ * outputs either as a string or as an array of TextBlockParam-like blocks
+ * containing JSON text; try both.
  */
-export function parseTaskCreateOutput(content: unknown): TaskCreateOutput | undefined {
-  const tryParse = (text: string): TaskCreateOutput | undefined => {
+function parseJsonToolOutput<T>(
+  content: unknown,
+  isExpectedOutput: (value: unknown) => value is T,
+): T | undefined {
+  const tryParse = (text: string): T | undefined => {
     try {
-      const parsed = JSON.parse(text);
-      if (
-        parsed &&
-        typeof parsed === "object" &&
-        parsed.task &&
-        typeof parsed.task.id === "string"
-      ) {
-        return parsed as TaskCreateOutput;
-      }
+      const parsed: unknown = JSON.parse(text);
+      return isExpectedOutput(parsed) ? parsed : undefined;
     } catch {
-      // ignore
+      return undefined;
     }
-    return undefined;
   };
 
   if (typeof content === "string") {
     return tryParse(content);
   }
+  if (content && typeof content === "object" && !Array.isArray(content)) {
+    return isExpectedOutput(content) ? content : undefined;
+  }
   if (Array.isArray(content)) {
     for (const block of content) {
       if (block && typeof block === "object" && "type" in block && block.type === "text") {
@@ -1072,6 +1105,119 @@ export function parseTaskCreateOutput(content: unknown): TaskCreateOutput | unde
   return undefined;
 }
 
+function toolOutputTexts(content: unknown): string[] {
+  if (typeof content === "string") return [content];
+  if (!Array.isArray(content)) return [];
+  return content.flatMap((block) =>
+    block &&
+    typeof block === "object" &&
+    "type" in block &&
+    block.type === "text" &&
+    "text" in block &&
+    typeof block.text === "string"
+      ? [block.text]
+      : [],
+  );
+}
+
+export function parseTaskCreateOutput(content: unknown): TaskCreateOutput | undefined {
+  const structured = parseJsonToolOutput(content, (parsed): parsed is TaskCreateOutput =>
+    Boolean(
+      parsed &&
+      typeof parsed === "object" &&
+      "task" in parsed &&
+      parsed.task &&
+      typeof parsed.task === "object" &&
+      "id" in parsed.task &&
+      typeof parsed.task.id === "string",
+    ),
+  );
+  if (structured) return structured;
+
+  for (const text of toolOutputTexts(content)) {
+    const match = /^Task #(\S+) created successfully: (.+)$/.exec(text.trim());
+    if (match) return { task: { id: match[1], subject: match[2] } };
+  }
+  return undefined;
+}
+
+export function parseTaskListOutput(content: unknown): TaskListOutput | undefined {
+  const validStatuses = new Set(["pending", "in_progress", "completed"]);
+  const structured = parseJsonToolOutput(content, (parsed): parsed is TaskListOutput =>
+    Boolean(
+      parsed &&
+      typeof parsed === "object" &&
+      "tasks" in parsed &&
+      Array.isArray(parsed.tasks) &&
+      parsed.tasks.every(
+        (task) =>
+          task &&
+          typeof task === "object" &&
+          typeof task.id === "string" &&
+          typeof task.subject === "string" &&
+          typeof task.status === "string" &&
+          validStatuses.has(task.status),
+      ),
+    ),
+  );
+  if (structured) return structured;
+
+  for (const text of toolOutputTexts(content)) {
+    if (text.trim() === "No tasks found") return { tasks: [] };
+
+    const tasks: TaskListOutput["tasks"] = [];
+    const lines = text.trim().split("\n");
+    for (const line of lines) {
+      const match =
+        /^#(\S+) \[(pending|in_progress|completed)\] (.+?)(?: \(([^()]*)\))?(?: \[blocked by ((?:#[^,\]]+(?:, )?)+)\])?$/.exec(
+          line,
+        );
+      if (!match) {
+        tasks.length = 0;
+        break;
+      }
+      tasks.push({
+        id: match[1],
+        subject: match[3],
+        status: match[2] as TaskListOutput["tasks"][number]["status"],
+        ...(match[4] ? { owner: match[4] } : {}),
+        blockedBy: match[5] ? match[5].split(", ").map((id) => id.slice(1)) : [],
+      });
+    }
+    if (tasks.length > 0) return { tasks };
+  }
+  return undefined;
+}
+
+export function parseTaskUpdateOutput(
+  content: unknown,
+  expectedTaskId?: string,
+): TaskUpdateOutput | undefined {
+  const structured = parseJsonToolOutput(content, (parsed): parsed is TaskUpdateOutput =>
+    Boolean(
+      parsed &&
+      typeof parsed === "object" &&
+      "success" in parsed &&
+      typeof parsed.success === "boolean" &&
+      "taskId" in parsed &&
+      typeof parsed.taskId === "string" &&
+      "updatedFields" in parsed &&
+      Array.isArray(parsed.updatedFields) &&
+      parsed.updatedFields.every((field) => typeof field === "string"),
+    ),
+  );
+  if (structured) return structured;
+
+  for (const text of toolOutputTexts(content)) {
+    const notFound = /^Task #(\S+) not found$/.exec(text.trim());
+    const taskId = notFound?.[1] ?? expectedTaskId;
+    if (taskId && (notFound || text.trim() === "Failed to delete task")) {
+      return { success: false, taskId, updatedFields: [], error: text.trim() };
+    }
+  }
+  return undefined;
+}
+
 export function applyTaskCreate(
   state: TaskState,
   input: TaskCreateInput | undefined,
@@ -1106,9 +1252,23 @@ export function applyTaskUpdate(state: TaskState, input: TaskUpdateInput | undef
   });
 }
 
+export function applyTaskList(state: TaskState, output: TaskListOutput): void {
+  const previous = new Map(state);
+  state.clear();
+  for (const task of output.tasks) {
+    const existing = previous.get(task.id);
+    state.set(task.id, {
+      subject: task.subject,
+      status: task.status,
+      activeForm: existing?.activeForm,
+      description: existing?.description,
+    });
+  }
+}
+
 export function taskStateToPlanEntries(state: TaskState): PlanEntry[] {
   return Array.from(state.values()).map((task) => ({
-    content: task.subject,
+    content: task.status === "in_progress" && task.activeForm ? task.activeForm : task.subject,
     status: task.status,
     priority: "medium",
   }));