@vellumai/assistant 0.11.7 → 0.11.8-staging.1

package/src/acp/acp-claude-oauth.ts

@@ -18,6 +18,7 @@ import {
   setSecureKeyAsync,
 } from "../security/secure-keys.js";
 import { getLogger } from "../util/logger.js";
+import { claudeTokenDigest } from "./acp-auth-marker-store.js";
 import {
   ACP_OAUTH_TOKEN_FIELD,
   ACP_SERVICE,
@@ -111,6 +112,31 @@ export function parseManualClaudeCode(input: string): {
   };
 }
 
+/**
+ * Digest of the Claude OAuth token secure storage holds right now, or
+ * `undefined` when it holds none.
+ *
+ * The credential a marker is judged against. A configured
+ * `CLAUDE_CODE_OAUTH_TOKEN` that Claude has already refused stands down at the
+ * next spawn, so once a token carries a marker the vault value is what a spawn
+ * goes on to resolve, and comparing against it answers whether the marker
+ * still describes the credential in use.
+ *
+ * Read on demand rather than cached. The vault is the authority on what it
+ * holds, and a copy of that answer in this process is a second one that has to
+ * be kept in step with every write, including writes this process did not
+ * make.
+ *
+ * Lives here rather than beside the comparison it feeds because this module is
+ * already the one authorised to read this vault field (see the importer
+ * allowlist in `credential-security-invariants`). The digest is all that
+ * leaves; the token itself never does.
+ */
+export async function storedClaudeTokenDigest(): Promise<string | undefined> {
+  const token = await usableStoredClaudeToken();
+  return token ? claudeTokenDigest(token) : undefined;
+}
+
 /**
  * Store a captured Claude OAuth token in the `acp/claude_oauth_token` vault
  * field and provision the policy the broker applies at spawn time: grant the
@@ -133,6 +159,66 @@ export async function storeAcpClaudeToken(token: string): Promise<void> {
     ACP_OAUTH_TOKEN_FIELD,
     ACP_CLAUDE_OAUTH_USAGE_DESCRIPTION,
   );
+  // Again, because the write above already ran this and the policy it repairs
+  // is what decides the answer. A token whose `acp_spawn` read was denied is
+  // not usable at the moment `setSecureKeyAsync` asks, so that pass declines
+  // to retire anything, and the repair on the line above is what makes it
+  // usable. Running it a second time is safe: taking the registry is
+  // idempotent, and the invalidation is a refetch trigger.
+  //
+  // Never allowed to fail or delay the store. The token is written either way,
+  // and these are notifications: losing one costs a client a stale card until
+  // its next snapshot, while waiting on one holds the user at "signing in"
+  // while a scan finishes.
+  void notifyAcpConnectRetired().catch((err: unknown) => {
+    log.warn(
+      { err },
+      "ACP Connect card notification failed after a token store",
+    );
+  });
+}
+
+/**
+ * Tell the rest of the system that a usable Claude token now exists.
+ *
+ * Two things only clients and the credential prompt can act on. The card
+ * registry is in-memory and about a card on screen rather than about the
+ * credential, so no marker answers for it, and left standing the prompt keeps
+ * redirecting at a card the new token just made stale. The invalidation tells
+ * other clients to re-read the snapshot, which they otherwise would not until
+ * navigation or reconnect.
+ *
+ * Neither retires anything by itself. A card is retired by its marker no
+ * longer matching the credential a spawn would resolve, which is decided when
+ * the marker is read, so a failure here costs freshness rather than
+ * correctness.
+ *
+ * Does nothing for a value a spawn could not use. A bulk restore can land an
+ * api-key-shaped token, or one the policy blocks, and the marker comparison
+ * keeps the card up for exactly that reason.
+ */
+export async function notifyAcpConnectRetired(): Promise<void> {
+  if (!(await hasAcpClaudeToken())) {
+    return;
+  }
+  // Dropped per conversation, and only where the failure it stands for has
+  // actually stopped being shown. A writer can store the very token Claude
+  // rejected, which passes the usability check above and changes nothing about
+  // the failure: the snapshot goes on serving that marker, so forgetting the
+  // entry would leave the credential prompt opening a second prompt beside a
+  // card that is still there. Asking the markers is the same question the
+  // snapshot answers, rather than a proxy for it.
+  const { conversationsWithRaisedAcpConnectCard, dropAcpConnectCardRaised } =
+    await import("./acp-connect-card-state.js");
+  for (const conversationId of conversationsWithRaisedAcpConnectCard()) {
+    if (!(await acpConnectCardStillWarranted(conversationId))) {
+      dropAcpConnectCardRaised(conversationId);
+    }
+  }
+  const { publishSyncInvalidation } =
+    await import("../runtime/sync/sync-publisher.js");
+  const { SYNC_TAGS } = await import("../daemon/message-types/sync.js");
+  await publishSyncInvalidation([SYNC_TAGS.acpAuthRecovery]);
 }
 
 /**
@@ -157,14 +243,28 @@ export async function storeAcpClaudeToken(token: string): Promise<void> {
  * knows nothing about Anthropic token formats.
  */
 export async function hasAcpClaudeToken(): Promise<boolean> {
+  return (await usableStoredClaudeToken()) !== undefined;
+}
+
+/**
+ * The stored Claude token, but only when a spawn would actually get it.
+ *
+ * One definition of usable for both callers. "Is the account connected" and
+ * "which credential would a spawn resolve" are the same question asked for
+ * different reasons, and answering them separately is how they drift: a value
+ * this rejects still has a digest, so a marker judged against that digest is
+ * withheld while the next spawn cannot authenticate, leaving the user with no
+ * card and no working token.
+ */
+async function usableStoredClaudeToken(): Promise<string | undefined> {
   const token = await getSecureKeyAsync(
     credentialKey(ACP_SERVICE, ACP_OAUTH_TOKEN_FIELD),
   );
   if (token == null || token.length === 0) {
-    return false;
+    return undefined;
   }
   if (classifyAnthropicToken(token) === "api_key") {
-    return false;
+    return undefined;
   }
   const denialReason = acpSpawnCredentialDenialReason(ACP_OAUTH_TOKEN_FIELD);
   if (denialReason !== undefined) {
@@ -172,7 +272,57 @@ export async function hasAcpClaudeToken(): Promise<boolean> {
       { field: ACP_OAUTH_TOKEN_FIELD, reason: denialReason },
       "Connect Claude status: token present but spawn read would be denied",
     );
-    return false;
+    return undefined;
+  }
+  return token;
+}
+
+/**
+ * Whether a conversation's raised Connect card is still something to point at.
+ *
+ * Two ways a card earns its place, matching the two ways one is raised. A
+ * mid-run rejection leaves a marker, and the card stands while that marker
+ * still names the credential a spawn would resolve. A pre-spawn failure leaves
+ * no marker at all, because there was no session to record one, and its card
+ * stands while there is still no usable token to spawn with.
+ *
+ * Asked rather than remembered, so it does not matter what made the situation
+ * change. A vault write, a `config.json` edit to
+ * `acp.agents.<id>.env.CLAUDE_CODE_OAUTH_TOKEN`, or a policy repair all move
+ * the answer, and only one of those runs through a credential write. Hanging
+ * this off the write would leave the other two stale.
+ */
+export async function acpConnectCardStillWarranted(
+  conversationId: string,
+): Promise<boolean> {
+  const { conversationHasCurrentAcpMarker } =
+    await import("./acp-auth-marker-store.js");
+  if (await conversationHasCurrentAcpMarker(conversationId)) {
+    return true;
+  }
+  // No marker, so this is the pre-spawn card: the failure was that a spawn
+  // found nothing to authenticate with, and it stands while that is still
+  // true. Asked through the spawn's own resolution rather than of the vault,
+  // because a user can repair it by setting the agent's configured token, and
+  // a vault-only answer would call that card warranted forever.
+  const { raisedAcpConnectCardAgent } =
+    await import("./acp-connect-card-state.js");
+  const agentId = raisedAcpConnectCardAgent(conversationId);
+  if (agentId === undefined) {
+    return !(await hasAcpClaudeToken());
+  }
+  const { resolvedClaudeCredentialDigest } =
+    await import("./prepare-agent-env.js");
+  const resolved = await resolvedClaudeCredentialDigest(agentId);
+  if (resolved === undefined) {
+    return true;
   }
-  return true;
+  // Resolving something is not the same as having a repair. A configured
+  // token Claude already refused stands down only once the vault offers an
+  // alternative, so with no replacement stored the resolver still reports it
+  // and the next spawn rejects it exactly as this one did. Treating that as
+  // fixed drops the card and lets a second prompt open beside it.
+  const { claudeCredentialRefused } =
+    await import("./acp-auth-marker-store.js");
+  return claudeCredentialRefused(resolved);
 }

package/src/acp/acp-connect-card-state.ts

@@ -11,23 +11,40 @@
  * leaving auth unset.
  *
  * In-memory and ephemeral by design: a daemon restart clears it, which fails
- * safe — the redirect simply doesn't fire and the secure prompt is shown. The
- * client re-derives the card itself from persisted history, so nothing UI-facing
- * depends on this surviving a restart. Entries are never cleared during a run:
- * once a card has been raised the redirect stays the right dedup, and a stale
- * entry after connect is harmless (the caller is already connected).
+ * safe. The redirect simply doesn't fire and the secure prompt is shown.
+ *
+ * Cleared for real on a successful token write (`storeAcpClaudeToken`), which
+ * is the moment the cards these entries stand for stop being the right place
+ * to send anyone. Left standing, the redirect keeps pointing the model at a
+ * card for auth that already works, and the persisted history markers the
+ * entries name keep re-raising it on every reload.
  */
-const conversationsWithAcpConnectCard = new Set<string>();
+const conversationsWithAcpConnectCard = new Map<string, string | undefined>();
 
-/** Record that a Connect Claude card was raised for this conversation. */
+/**
+ * Record that a Connect Claude card was raised for this conversation.
+ *
+ * The agent is kept alongside it because deciding later whether the card still
+ * stands means asking what a spawn of that agent would resolve, and precedence
+ * is per agent: a configured `CLAUDE_CODE_OAUTH_TOKEN` on one alias is not the
+ * vault and is not another alias.
+ */
 export function markAcpConnectCardRaised(
   conversationId: string | undefined,
+  agentId?: string,
 ): void {
   if (conversationId) {
-    conversationsWithAcpConnectCard.add(conversationId);
+    conversationsWithAcpConnectCard.set(conversationId, agentId);
   }
 }
 
+/** The agent whose spawn raised this conversation's card, when it was known. */
+export function raisedAcpConnectCardAgent(
+  conversationId: string,
+): string | undefined {
+  return conversationsWithAcpConnectCard.get(conversationId);
+}
+
 /** Whether a Connect Claude card has been raised for this conversation. */
 export function hasAcpConnectCardRaised(
   conversationId: string | undefined,
@@ -37,3 +54,27 @@ export function hasAcpConnectCardRaised(
     conversationsWithAcpConnectCard.has(conversationId)
   );
 }
+
+/**
+ * Hand back every conversation that raised a card and forget them all.
+ *
+ * Take-and-clear rather than a read plus a separate reset: the caller is
+ * retiring these conversations' persisted markers, and an entry left behind
+ * after that would redirect the secure-prompt fallback at a card nothing can
+ * re-raise.
+ */
+export function takeConversationsWithAcpConnectCard(): string[] {
+  const conversationIds = [...conversationsWithAcpConnectCard.keys()];
+  conversationsWithAcpConnectCard.clear();
+  return conversationIds;
+}
+
+/** Forget one conversation's raised card. */
+export function dropAcpConnectCardRaised(conversationId: string): void {
+  conversationsWithAcpConnectCard.delete(conversationId);
+}
+
+/** Every conversation currently believed to have a card up. */
+export function conversationsWithRaisedAcpConnectCard(): string[] {
+  return [...conversationsWithAcpConnectCard.keys()];
+}

package/src/acp/agent-process.ts

@@ -92,6 +92,7 @@ export class AcpAgentProcess {
       cwd,
       stdio: ["pipe", "pipe", "pipe"],
       env: this.spawnedEnv,
+      windowsHide: true,
     });
 
     const stream = acp.ndJsonStream(

package/src/acp/auto-install.ts

@@ -86,6 +86,7 @@ function execFileWithTimeout(
         encoding: "utf8",
         cwd: options?.cwd,
         env: options?.env,
+        windowsHide: true,
       },
       (err, stdout) => {
         clearTimeout(timer);

package/src/acp/client-handler.ts

@@ -380,6 +380,7 @@ export class VellumAcpClientHandler implements Client {
       cwd: params.cwd ?? undefined,
       stdio: ["ignore", "pipe", "pipe"],
       env,
+      windowsHide: true,
     });
 
     const state: TerminalState = {

package/src/acp/prepare-agent-env.ts

@@ -31,11 +31,16 @@ import {
 } from "../tools/credentials/metadata-store.js";
 import { serverUseDenialReason } from "../tools/credentials/tool-policy.js";
 import { getLogger } from "../util/logger.js";
+import {
+  claudeTokenDigest,
+  claudeTokenRefusedByClaude,
+} from "./acp-auth-marker-store.js";
 import {
   ACP_OAUTH_TOKEN_FIELD,
   ACP_SERVICE,
   classifyAnthropicToken,
 } from "./acp-credentials.js";
+import { lookupAcpAgentConfig } from "./resolve-agent.js";
 import type { AcpAgentConfig } from "./types.js";
 
 const log = getLogger("acp:prepare-agent-env");
@@ -240,6 +245,61 @@ async function injectOptionalCredential(
   }
 }
 
+/**
+ * Whether a configured `CLAUDE_CODE_OAUTH_TOKEN` should stand down.
+ *
+ * True once Claude has refused that exact value and the vault offers a
+ * different one. Only then: with nothing to fall back to, dropping it would
+ * trade a token that fails for no token at all, and the missing-token branch
+ * would report the wrong reason.
+ *
+ * `acp-claude-oauth` is imported at call time because it reaches back into
+ * this module for the spawn policy helpers, and it is the module authorised to
+ * read this vault field, so the dependency runs one way at load and the other
+ * here.
+ */
+async function configuredClaudeTokenStandsDown(
+  configured: string | undefined,
+): Promise<boolean> {
+  if (!configured || !claudeTokenRefusedByClaude(configured)) {
+    return false;
+  }
+  const { storedClaudeTokenDigest } = await import("./acp-claude-oauth.js");
+  const stored = await storedClaudeTokenDigest();
+  return stored !== undefined && stored !== claudeTokenDigest(configured);
+}
+
+/**
+ * Digest of the Claude token a spawn of `agentId` would resolve now, or
+ * `undefined` when it would find none.
+ *
+ * The credential a marker is judged against, and the same precedence
+ * `prepareAgentEnv` applies rather than a second derivation of it. A
+ * vault-only answer is wrong in both directions: a user who repairs auth by
+ * setting `acp.agents.<id>.env.CLAUDE_CODE_OAUTH_TOKEN` would keep seeing a
+ * card for a failure the next spawn will not repeat, and one whose configured
+ * token is the broken one would see none.
+ *
+ * Deliberately does not check that the agent's binary exists. A marker
+ * outlives the run that wrote it, and an uninstalled adapter says nothing
+ * about whether its credential was replaced.
+ */
+export async function resolvedClaudeCredentialDigest(
+  agentId: string,
+): Promise<string | undefined> {
+  const configured =
+    lookupAcpAgentConfig(agentId)?.env?.CLAUDE_CODE_OAUTH_TOKEN;
+  const usable =
+    configured && classifyAnthropicToken(configured) !== "api_key"
+      ? configured
+      : undefined;
+  if (usable && !(await configuredClaudeTokenStandsDown(usable))) {
+    return claudeTokenDigest(usable);
+  }
+  const { storedClaudeTokenDigest } = await import("./acp-claude-oauth.js");
+  return storedClaudeTokenDigest();
+}
+
 /**
  * Returns a NEW config with any required credentials merged into `env`.
  * Does NOT mutate the input. Throws `FailedDependencyError` if a required
@@ -281,6 +341,7 @@ export async function prepareAgentEnv(
   // limitations on the optional `AcpAgentConfig.env` field.
   const env: Record<string, string> = { ...(agentConfig.env ?? {}) };
   const adapterCommand = basename(agentConfig.command);
+  let credentialDigest: string | undefined;
 
   if (adapterCommand === "claude-agent-acp") {
     // A config `env` override or a legacy vault entry can hold an Anthropic API
@@ -302,6 +363,12 @@ export async function prepareAgentEnv(
     };
 
     dropApiKeyOauthToken();
+    // A configured token Claude has already refused stands down in favour of
+    // the vault. Config otherwise wins, so honouring it here would resolve the
+    // same revoked value and raise the card again on every retry.
+    if (await configuredClaudeTokenStandsDown(env.CLAUDE_CODE_OAUTH_TOKEN)) {
+      delete env.CLAUDE_CODE_OAUTH_TOKEN;
+    }
     let missReason: string | undefined;
     if (!env.CLAUDE_CODE_OAUTH_TOKEN) {
       missReason = await injectCredential(
@@ -318,6 +385,13 @@ export async function prepareAgentEnv(
       env.CLAUDE_CODE_OAUTH_TOKEN !== undefined &&
       classifyAnthropicToken(env.CLAUDE_CODE_OAUTH_TOKEN) === "api_key";
     dropApiKeyOauthToken();
+    // Identity of the token this spawn will actually run with, whichever
+    // source survived the resolution above. Recorded on the history row if
+    // Claude refuses it, which is what lets the marker be compared against the
+    // credential a later spawn would resolve instead of relying on a sweep.
+    credentialDigest = env.CLAUDE_CODE_OAUTH_TOKEN
+      ? claudeTokenDigest(env.CLAUDE_CODE_OAUTH_TOKEN)
+      : undefined;
     if (!env.CLAUDE_CODE_OAUTH_TOKEN) {
       // The operator's record of WHY the spawn has no token. `missReason` is
       // the broker's own reason string and the rest are policy verdicts, so no
@@ -388,5 +462,9 @@ export async function prepareAgentEnv(
     ]);
   }
 
-  return { ...agentConfig, env };
+  return {
+    ...agentConfig,
+    env,
+    credentialDigest,
+  };
 }

package/src/acp/resolve-agent.ts

@@ -153,6 +153,18 @@ function normalizeAgentId(id: string): string {
  * id. The alias is consulted ONLY after both direct lookups miss, so a user
  * config entry literally keyed "claude code" always wins over the alias.
  */
+/**
+ * The configured agent for an id, without checking that its binary exists.
+ *
+ * `resolveAcpAgent` answers "can this be run", which a caller that only wants
+ * to know which credential the agent would use does not need and cannot always
+ * get: a marker outlives the run that wrote it, and the binary may since have
+ * gone.
+ */
+export function lookupAcpAgentConfig(id: string): AcpAgentConfig | undefined {
+  return lookupAgent(getConfig().acp.agents, id)?.agent;
+}
+
 function lookupAgent(
   userAgents: Record<string, AcpAgentConfig>,
   id: string,

package/src/acp/session-manager.test.ts

@@ -5,7 +5,39 @@ import {
   deleteConversation,
   setConversation,
 } from "../daemon/conversation-registry.js";
+import { claudeTokenDigest } from "./acp-auth-marker-store.js";
 import { hasAcpConnectCardRaised } from "./acp-connect-card-state.js";
+
+// The credential a spawn of this agent would resolve now. The failure path
+// asks the same question the read path does before emitting a live event, so
+// a card is not raised into connected clients for auth that was already
+// repaired. Spreading the real module keeps every other export intact.
+// Spy on the refusal record. Spread the real module so every other export
+// still resolves for the graph session-manager pulls in.
+const refusedDigests: Array<string | undefined> = [];
+const realMarkerStoreModule = await import("./acp-auth-marker-store.js");
+mock.module("./acp-auth-marker-store.js", () => ({
+  ...realMarkerStoreModule,
+  noteClaudeTokenRefused: (digest: string | undefined) => {
+    refusedDigests.push(digest);
+  },
+}));
+
+let fakeResolvedCredential: string | undefined;
+// Held open by a test that needs to land a teardown inside the window this
+// read suspends the failure handler for.
+let resolveGate: Promise<void> | undefined;
+const realPrepareAgentEnv = await import("./prepare-agent-env.js");
+mock.module("./prepare-agent-env.js", () => ({
+  ...realPrepareAgentEnv,
+  resolvedClaudeCredentialDigest: async () => {
+    if (resolveGate) {
+      await resolveGate;
+    }
+    return fakeResolvedCredential;
+  },
+}));
+
 import { VellumAcpClientHandler } from "./client-handler.js";
 import { AcpSessionManager } from "./session-manager.js";
 
@@ -331,6 +363,7 @@ describe("AcpSessionManager auth-required recovery surface", () => {
     command: string;
     parentToolUseId?: string;
     cancelled?: boolean;
+    credentialDigest?: string;
   }) {
     const manager = new AcpSessionManager(1);
     const parentId = `parent-${opts.id}`;
@@ -350,6 +383,10 @@ describe("AcpSessionManager auth-required recovery surface", () => {
     if (opts.cancelled) {
       entry.state.status = "cancelled";
     }
+    if (opts.credentialDigest !== undefined) {
+      (entry as { credentialDigest?: string }).credentialDigest =
+        opts.credentialDigest;
+    }
 
     await fire(manager, opts.id, entry).catch(() => {});
     if (!opts.cancelled) {
@@ -366,9 +403,65 @@ describe("AcpSessionManager auth-required recovery surface", () => {
       parentId,
       authEvent: events.find((e) => e.type === "acp_auth_required"),
       persistedContent: firstPersist?.[0].content,
+      persistedAuthErrorCredential: (
+        entry.state as { authErrorCredential?: string }
+      ).authErrorCredential,
     };
   }
 
+  test("no live event when the credential was already replaced", async () => {
+    // A replacement token and its invalidation can both land before an older
+    // run reports its rejection. The card the live event raises deliberately
+    // skips connected-state self-healing, so nothing would retire it until the
+    // next snapshot, which may be a navigation away.
+    fakeResolvedCredential = claudeTokenDigest("sk-ant-oat-replacement");
+    const r = await driveAuthFailure({
+      id: "sess-auth-replaced",
+      command: "claude-agent-acp",
+      parentToolUseId: "tool-anchor-replaced",
+      credentialDigest: claudeTokenDigest("sk-ant-oat-refused"),
+    });
+    fakeResolvedCredential = undefined;
+
+    expect(r.authEvent).toBeUndefined();
+    expect(hasAcpConnectCardRaised(r.parentId)).toBe(false);
+    // The guidance follows the same predicate: pointing the model at a card
+    // that was never raised sends it to an affordance that does not exist.
+    expect(r.persistedContent).not.toContain("Connect Claude Code");
+  });
+
+  test("still raises when the run holds the credential a spawn would resolve", async () => {
+    const digest = claudeTokenDigest("sk-ant-oat-still-current");
+    fakeResolvedCredential = digest;
+    const r = await driveAuthFailure({
+      id: "sess-auth-current",
+      command: "claude-agent-acp",
+      parentToolUseId: "tool-anchor-current",
+      credentialDigest: digest,
+    });
+    fakeResolvedCredential = undefined;
+
+    expect(r.authEvent).toBeDefined();
+  });
+
+  test("the marker names the credential the run was refused on", async () => {
+    // The failure path does not judge whether the rejection still matters. It
+    // records what was refused, and the read path compares that against the
+    // credential a spawn would resolve. Deciding here would mean guessing
+    // about writes that have not finished, and guessing toward suppression
+    // spends the rejection that would have raised the card.
+    const digest = claudeTokenDigest("sk-ant-oat-refused");
+    const r = await driveAuthFailure({
+      id: "sess-auth-credential",
+      command: "claude-agent-acp",
+      parentToolUseId: "tool-anchor-credential",
+      credentialDigest: digest,
+    });
+
+    expect(r.authEvent).toBeDefined();
+    expect(r.persistedAuthErrorCredential).toBe(digest);
+  });
+
   test("claude failure with an anchor raises the full surface: event, registry mark, guidance", async () => {
     const r = await driveAuthFailure({
       id: "sess-auth-anchor",
@@ -429,3 +522,93 @@ describe("AcpSessionManager auth-required recovery surface", () => {
     expect(hasAcpConnectCardRaised(r.parentId)).toBe(false);
   });
 });
+
+describe("AcpSessionManager: teardown during the credential read", () => {
+  test("a session torn down mid-read is left alone", async () => {
+    // The credential read suspends the failure handler. A cancel landing in
+    // that window runs to completion first: it persists the cancelled row,
+    // drops the event buffer and removes the session. Carrying on would emit a
+    // card for a run the user stopped, and persist a second time over a buffer
+    // that is already gone, replacing the stored event log with an empty one.
+    const revoked = () =>
+      Promise.reject(
+        new Error(
+          "Internal error: Failed to authenticate. API Error: 401 OAuth access token has been revoked.",
+        ),
+      );
+    const manager = new AcpSessionManager(1);
+    const parentId = "parent-torn-down";
+    const { conversation } = mockConversation();
+    setConversation(parentId, conversation);
+    registered.push(parentId);
+
+    const entry = injectSession(
+      manager,
+      "sess-torn-down",
+      parentId,
+      fakeProcess(revoked),
+    );
+    entry.command = "claude-agent-acp";
+    (entry as { parentToolUseId?: string }).parentToolUseId = "tool-torn";
+
+    let openGate = () => {};
+    resolveGate = new Promise<void>((resolve) => {
+      openGate = resolve;
+    });
+
+    const running = fire(manager, "sess-torn-down", entry).catch(() => {});
+    // Let the handler reach the suspended read, then take the session out from
+    // under it exactly as a cancel would.
+    await new Promise((r) => setTimeout(r, 5));
+    (manager as unknown as { sessions: Map<string, unknown> }).sessions.delete(
+      "sess-torn-down",
+    );
+    openGate();
+    await running;
+    resolveGate = undefined;
+
+    const events = (
+      entry.sendToVellum as ReturnType<typeof mock>
+    ).mock.calls.map((c) => c[0] as { type: string });
+    expect(events.find((e) => e.type === "acp_auth_required")).toBeUndefined();
+  });
+});
+
+describe("AcpSessionManager.spawn: a credential Claude refused at startup", () => {
+  test("records the refusal, so the HTTP route gets it too", async () => {
+    // The record lives here rather than at the tool boundary because
+    // `POST /v1/acp/spawn` reaches this method directly. Without it a
+    // configured CLAUDE_CODE_OAUTH_TOKEN that Claude refused keeps winning
+    // over whatever Connect stores, and every later spawn repeats the failure.
+    const { AcpAgentProcess: Process } = await import("./agent-process.js");
+    const { AcpAuthRequiredError: AuthError } =
+      await import("./auth-required.js");
+    const originalInitialize = Process.prototype.initialize;
+    Process.prototype.initialize = async () => {
+      throw new AuthError("claude", "Authentication required");
+    };
+    refusedDigests.length = 0;
+
+    try {
+      const manager = new AcpSessionManager(5);
+      await manager
+        .spawn(
+          "claude",
+          {
+            command: "echo",
+            args: ["hi"],
+            credentialDigest: "digest-refused-at-startup",
+          },
+          "do something",
+          "/tmp",
+          "conv-startup-auth",
+          () => {},
+        )
+        .catch(() => {});
+    } finally {
+      Process.prototype.initialize = originalInitialize;
+    }
+
+    expect(refusedDigests).toContain("digest-refused-at-startup");
+  });
+});