@vellumai/assistant 0.12.1 → 0.12.2-staging.2

package/src/acp/__tests__/acp-claude-oauth.test.ts

@@ -22,11 +22,38 @@ import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
 // ---------------------------------------------------------------------------
 
 let storeReturn = true;
+let deleteReturn: "deleted" | "not-found" | "error" = "not-found";
 let getReturn: string | undefined = undefined;
-const setSecureKeyAsync = mock(
-  async (_account: string, _value: string) => storeReturn,
-);
-const getSecureKeyAsync = mock(async (_account: string) => getReturn);
+const vault = new Map<string, string>();
+const ACCESS_KEY = "credential/acp/claude_oauth_token";
+const REFRESH_KEY = "credential/acp/claude_oauth_refresh_token";
+const EXPIRES_KEY = "credential/acp/claude_oauth_expires_at";
+const DIGEST_KEY = "credential/acp/claude_oauth_access_digest";
+
+const setSecureKeyAsync = mock(async (account: string, value: string) => {
+  if (!storeReturn) {
+    return false;
+  }
+  vault.set(account, value);
+  return true;
+});
+const getSecureKeyAsync = mock(async (account: string) => {
+  if (vault.has(account)) {
+    return vault.get(account);
+  }
+  // Existing cases that only seed the access token keep using getReturn.
+  if (account === ACCESS_KEY) {
+    return getReturn;
+  }
+  return undefined;
+});
+const deleteSecureKeyAsync = mock(async (account: string) => {
+  if (deleteReturn === "error") {
+    return "error";
+  }
+  const existed = vault.delete(account);
+  return existed ? "deleted" : "not-found";
+});
 
 // Spread the real module rather than listing two exports. These cases reach
 // the marker tables, which pulls persistence into the graph, and anything in
@@ -37,6 +64,7 @@ mock.module("../../security/secure-keys.js", () => ({
   ...realSecureKeys,
   setSecureKeyAsync,
   getSecureKeyAsync,
+  deleteSecureKeyAsync,
 }));
 
 const { _setMetadataPath, getCredentialMetadata, upsertCredentialMetadata } =
@@ -69,6 +97,10 @@ const {
   parseManualClaudeCode,
   storeAcpClaudeToken,
   hasAcpClaudeToken,
+  persistRefreshedAcpClaudeTokens,
+  forgetAcpClaudeRenewalStateIfUnbound,
+  clearAcpClaudeRefreshToken,
+  isAcpClaudeTokenExpiring,
 } = await import("../acp-claude-oauth.js");
 
 /**
@@ -95,9 +127,12 @@ beforeEach(() => {
   mkdirSync(TEST_DIR, { recursive: true });
   _setMetadataPath(join(TEST_DIR, "metadata.json"));
   storeReturn = true;
+  deleteReturn = "not-found";
   getReturn = undefined;
+  vault.clear();
   setSecureKeyAsync.mockClear();
   getSecureKeyAsync.mockClear();
+  deleteSecureKeyAsync.mockClear();
 });
 
 afterEach(() => {
@@ -204,11 +239,43 @@ describe("storeAcpClaudeToken", () => {
   test("writes the token to the acp/claude_oauth_token vault field", async () => {
     await storeAcpClaudeToken("sk-ant-oat-token");
 
-    expect(setSecureKeyAsync).toHaveBeenCalledTimes(1);
     expect(setSecureKeyAsync).toHaveBeenCalledWith(
-      "credential/acp/claude_oauth_token",
+      ACCESS_KEY,
       "sk-ant-oat-token",
     );
+    expect(vault.get(ACCESS_KEY)).toBe("sk-ant-oat-token");
+  });
+
+  test("persists refresh token and expiry from a Connect exchange", async () => {
+    const before = Date.now();
+    await storeAcpClaudeToken({
+      accessToken: "sk-ant-oat-connected",
+      refreshToken: "refresh-from-exchange",
+      expiresIn: 28800,
+    });
+    const after = Date.now();
+
+    expect(vault.get(ACCESS_KEY)).toBe("sk-ant-oat-connected");
+    expect(vault.get(REFRESH_KEY)).toBe("refresh-from-exchange");
+    expect(vault.get(DIGEST_KEY)).toBe(
+      claudeTokenDigest("sk-ant-oat-connected"),
+    );
+    const expiresAt = Number(vault.get(EXPIRES_KEY));
+    expect(expiresAt).toBeGreaterThanOrEqual(before + 28800 * 1000);
+    expect(expiresAt).toBeLessThanOrEqual(after + 28800 * 1000);
+  });
+
+  test("clears companion fields when the exchange returns only an access token", async () => {
+    vault.set(REFRESH_KEY, "stale-refresh");
+    vault.set(EXPIRES_KEY, "1");
+    vault.set(DIGEST_KEY, "stale-digest");
+
+    await storeAcpClaudeToken({ accessToken: "sk-ant-oat-access-only" });
+
+    expect(vault.get(ACCESS_KEY)).toBe("sk-ant-oat-access-only");
+    expect(vault.has(REFRESH_KEY)).toBe(false);
+    expect(vault.has(EXPIRES_KEY)).toBe(false);
+    expect(vault.has(DIGEST_KEY)).toBe(false);
   });
 
   test("takes a domain-restricted credential from not-connected to connected", async () => {
@@ -309,6 +376,190 @@ describe("hasAcpClaudeToken", () => {
 
     expect(oauthMetadata()).toBeUndefined();
   });
+
+  test("reports true for an expired token that still has a refresh token", async () => {
+    vault.set(ACCESS_KEY, "sk-ant-oat-expired-renewable");
+    vault.set(REFRESH_KEY, "refresh-still-good");
+    vault.set(EXPIRES_KEY, String(Date.now() - 1000));
+
+    expect(await hasAcpClaudeToken()).toBe(true);
+  });
+
+  test("reports false for an expired token with no refresh token", async () => {
+    vault.set(ACCESS_KEY, "sk-ant-oat-expired-dead");
+    vault.set(EXPIRES_KEY, String(Date.now() - 1000));
+
+    expect(await hasAcpClaudeToken()).toBe(false);
+  });
+
+  test("reports true for a token with no recorded expiry (legacy access-token-only)", async () => {
+    vault.set(ACCESS_KEY, "sk-ant-oat-legacy");
+
+    expect(await hasAcpClaudeToken()).toBe(true);
+    expect(await isAcpClaudeTokenExpiring()).toBe(false);
+  });
+
+  test("reports false when only leftover refresh material remains", async () => {
+    vault.set(REFRESH_KEY, "refresh-leftover");
+    vault.set(EXPIRES_KEY, String(Date.now() - 1000));
+
+    expect(await hasAcpClaudeToken()).toBe(false);
+  });
+
+  test("reports true for a pasted token whose leftover expiry describes a previous token", async () => {
+    vault.set(ACCESS_KEY, "sk-ant-oat-pasted");
+    vault.set(REFRESH_KEY, "refresh-previous");
+    vault.set(EXPIRES_KEY, String(Date.now() - 1000));
+    vault.set(DIGEST_KEY, claudeTokenDigest("sk-ant-oat-previous"));
+
+    expect(await hasAcpClaudeToken()).toBe(true);
+  });
+});
+
+describe("persistRefreshedAcpClaudeTokens", () => {
+  test("writes a rotated refresh token and new expiry without touching policy", async () => {
+    upsertCredentialMetadata(ACP_SERVICE, OAUTH_FIELD, {
+      allowedTools: ["some_other_tool"],
+    });
+    vault.set(ACCESS_KEY, "sk-ant-oat-current");
+    vault.set(REFRESH_KEY, "refresh-expected");
+    vault.set(DIGEST_KEY, claudeTokenDigest("sk-ant-oat-current"));
+    const before = Date.now();
+
+    await persistRefreshedAcpClaudeTokens(
+      {
+        accessToken: "sk-ant-oat-refreshed",
+        refreshToken: "refresh-rotated",
+        expiresIn: 3600,
+      },
+      "refresh-expected",
+    );
+
+    expect(vault.get(ACCESS_KEY)).toBe("sk-ant-oat-refreshed");
+    expect(vault.get(REFRESH_KEY)).toBe("refresh-rotated");
+    expect(vault.get(DIGEST_KEY)).toBe(
+      claudeTokenDigest("sk-ant-oat-refreshed"),
+    );
+    const expiresAt = Number(vault.get(EXPIRES_KEY));
+    expect(expiresAt).toBeGreaterThanOrEqual(before + 3600 * 1000);
+    expect(oauthMetadata()?.allowedTools).toEqual(["some_other_tool"]);
+  });
+
+  test("keeps the stored refresh token when the response omits a new one", async () => {
+    vault.set(ACCESS_KEY, "sk-ant-oat-current");
+    vault.set(REFRESH_KEY, "refresh-kept");
+    vault.set(DIGEST_KEY, claudeTokenDigest("sk-ant-oat-current"));
+
+    await persistRefreshedAcpClaudeTokens(
+      {
+        accessToken: "sk-ant-oat-refreshed",
+        expiresIn: 3600,
+      },
+      "refresh-kept",
+    );
+
+    expect(vault.get(ACCESS_KEY)).toBe("sk-ant-oat-refreshed");
+    expect(vault.get(REFRESH_KEY)).toBe("refresh-kept");
+  });
+
+  test("refuses to persist when the stored refresh token no longer matches", async () => {
+    vault.set(ACCESS_KEY, "sk-ant-oat-current");
+    vault.set(REFRESH_KEY, "refresh-current");
+    vault.set(EXPIRES_KEY, "999");
+
+    const persisted = await persistRefreshedAcpClaudeTokens(
+      {
+        accessToken: "sk-ant-oat-stale",
+        refreshToken: "refresh-stale-rotated",
+        expiresIn: 3600,
+      },
+      "refresh-old",
+    );
+
+    expect(persisted).toBe(false);
+    expect(vault.get(ACCESS_KEY)).toBe("sk-ant-oat-current");
+    expect(vault.get(REFRESH_KEY)).toBe("refresh-current");
+    expect(vault.get(EXPIRES_KEY)).toBe("999");
+  });
+
+  test("refuses to persist when the access token is no longer stored", async () => {
+    vault.set(REFRESH_KEY, "refresh-leftover");
+    vault.set(EXPIRES_KEY, "111");
+
+    const persisted = await persistRefreshedAcpClaudeTokens(
+      {
+        accessToken: "sk-ant-oat-resurrected",
+        refreshToken: "refresh-rotated",
+        expiresIn: 3600,
+      },
+      "refresh-leftover",
+    );
+
+    expect(persisted).toBe(false);
+    expect(vault.has(ACCESS_KEY)).toBe(false);
+    expect(vault.get(REFRESH_KEY)).toBe("refresh-leftover");
+    expect(vault.get(EXPIRES_KEY)).toBe("111");
+  });
+
+  test("refuses to persist when the access token is not the one the refresh material was written with", async () => {
+    vault.set(ACCESS_KEY, "sk-ant-oat-pasted");
+    vault.set(REFRESH_KEY, "refresh-previous");
+    vault.set(EXPIRES_KEY, "111");
+    vault.set(DIGEST_KEY, claudeTokenDigest("sk-ant-oat-previous"));
+
+    const persisted = await persistRefreshedAcpClaudeTokens(
+      {
+        accessToken: "sk-ant-oat-overwritten",
+        refreshToken: "refresh-rotated",
+        expiresIn: 3600,
+      },
+      "refresh-previous",
+    );
+
+    expect(persisted).toBe(false);
+    expect(vault.get(ACCESS_KEY)).toBe("sk-ant-oat-pasted");
+    expect(vault.get(REFRESH_KEY)).toBe("refresh-previous");
+    expect(vault.get(EXPIRES_KEY)).toBe("111");
+  });
+});
+
+describe("clearAcpClaudeRefreshToken", () => {
+  test("leaves the stored refresh token when it no longer matches the rejected one", async () => {
+    vault.set(REFRESH_KEY, "refresh-current");
+
+    await clearAcpClaudeRefreshToken("refresh-old");
+
+    expect(vault.get(REFRESH_KEY)).toBe("refresh-current");
+  });
+});
+
+describe("forgetAcpClaudeRenewalStateIfUnbound", () => {
+  test("clears leftover renewal fields after the access token was replaced", async () => {
+    vault.set(ACCESS_KEY, "sk-ant-oat-pasted");
+    vault.set(REFRESH_KEY, "stale-refresh");
+    vault.set(EXPIRES_KEY, "111");
+    vault.set(DIGEST_KEY, claudeTokenDigest("sk-ant-oat-previous"));
+
+    await forgetAcpClaudeRenewalStateIfUnbound();
+
+    expect(vault.get(ACCESS_KEY)).toBe("sk-ant-oat-pasted");
+    expect(vault.has(REFRESH_KEY)).toBe(false);
+    expect(vault.has(EXPIRES_KEY)).toBe(false);
+    expect(vault.has(DIGEST_KEY)).toBe(false);
+  });
+
+  test("keeps renewal fields when they still describe the stored access token", async () => {
+    vault.set(ACCESS_KEY, "sk-ant-oat-current");
+    vault.set(REFRESH_KEY, "keep-refresh");
+    vault.set(EXPIRES_KEY, "222");
+    vault.set(DIGEST_KEY, claudeTokenDigest("sk-ant-oat-current"));
+
+    await forgetAcpClaudeRenewalStateIfUnbound();
+
+    expect(vault.get(REFRESH_KEY)).toBe("keep-refresh");
+    expect(vault.get(EXPIRES_KEY)).toBe("222");
+    expect(vault.get(DIGEST_KEY)).toBe(claudeTokenDigest("sk-ant-oat-current"));
+  });
 });
 
 describe("storeAcpClaudeToken: retiring the card registry", () => {

package/src/acp/__tests__/acp-credentials.test.ts

@@ -5,6 +5,9 @@
 import { describe, expect, test } from "bun:test";
 
 import {
+  ACP_OAUTH_ACCESS_DIGEST_FIELD,
+  ACP_OAUTH_EXPIRES_AT_FIELD,
+  ACP_OAUTH_REFRESH_TOKEN_FIELD,
   ACP_OAUTH_TOKEN_FIELD,
   ACP_SERVICE,
   AcpCredentialFormatError,
@@ -70,6 +73,9 @@ describe("constants", () => {
   test("expose the ACP service and OAuth field names", () => {
     expect(ACP_SERVICE).toBe("acp");
     expect(ACP_OAUTH_TOKEN_FIELD).toBe("claude_oauth_token");
+    expect(ACP_OAUTH_REFRESH_TOKEN_FIELD).toBe("claude_oauth_refresh_token");
+    expect(ACP_OAUTH_EXPIRES_AT_FIELD).toBe("claude_oauth_expires_at");
+    expect(ACP_OAUTH_ACCESS_DIGEST_FIELD).toBe("claude_oauth_access_digest");
   });
 });
 
@@ -81,6 +87,13 @@ describe("isAcpClaudeOauthField", () => {
   test("rejects other services and fields", () => {
     expect(isAcpClaudeOauthField("acp", "openai_api_key")).toBe(false);
     expect(isAcpClaudeOauthField("acp", "codex_api_key")).toBe(false);
+    expect(isAcpClaudeOauthField("acp", "claude_oauth_refresh_token")).toBe(
+      false,
+    );
+    expect(isAcpClaudeOauthField("acp", "claude_oauth_expires_at")).toBe(false);
+    expect(isAcpClaudeOauthField("acp", "claude_oauth_access_digest")).toBe(
+      false,
+    );
     expect(isAcpClaudeOauthField("sentry", "claude_oauth_token")).toBe(false);
     expect(isAcpClaudeOauthField("openai", "api_key")).toBe(false);
   });

package/src/acp/__tests__/agent-process.test.ts

@@ -8,9 +8,16 @@
 
 import { describe, expect, mock, test } from "bun:test";
 
-import type { AuthMethod, InitializeResponse } from "@agentclientprotocol/sdk";
+import type {
+  AuthMethod,
+  InitializeResponse,
+  SessionConfigOption,
+} from "@agentclientprotocol/sdk";
+import * as acp from "@agentclientprotocol/sdk";
 
 import { AcpAgentProcess } from "../agent-process.js";
+import { AcpConfigOptionRefusedError } from "../types.js";
+import { modelOption } from "./helpers/acp-model-option.js";
 
 function makeProcess(): AcpAgentProcess {
   return new AcpAgentProcess(
@@ -160,6 +167,139 @@ describe("AcpAgentProcess loadSession/resumeSession", () => {
   });
 });
 
+describe("AcpAgentProcess config options", () => {
+  /** Injects a connection whose session calls report `configOptions`. */
+  function stubSessionResponses(
+    proc: AcpAgentProcess,
+    configOptions: SessionConfigOption[] | null | undefined,
+  ): void {
+    (proc as unknown as { connection: unknown }).connection = {
+      newSession: () =>
+        Promise.resolve({ sessionId: "session-1", configOptions }),
+      loadSession: () => Promise.resolve({ configOptions }),
+      resumeSession: () => Promise.resolve({ configOptions }),
+    };
+  }
+
+  test("createSession returns the reported options", async () => {
+    const proc = makeProcess();
+    const options = [modelOption("sonnet")];
+    stubSessionResponses(proc, options);
+
+    await expect(proc.createSession("/tmp/project")).resolves.toEqual({
+      sessionId: "session-1",
+      configOptions: options,
+    });
+  });
+
+  test("loadSession returns the reported options", async () => {
+    const proc = makeProcess();
+    const options = [modelOption("sonnet")];
+    stubSessionResponses(proc, options);
+
+    await expect(
+      proc.loadSession("session-1", "/tmp/project"),
+    ).resolves.toEqual({ configOptions: options });
+  });
+
+  test("resumeSession returns the reported options", async () => {
+    const proc = makeProcess();
+    const options = [modelOption("opus")];
+    stubSessionResponses(proc, options);
+
+    await expect(
+      proc.resumeSession("session-1", "/tmp/project"),
+    ).resolves.toEqual({ configOptions: options });
+  });
+
+  test("a null or absent configOptions normalizes to an empty array", async () => {
+    const created = makeProcess();
+    stubSessionResponses(created, null);
+    await expect(created.createSession("/tmp/project")).resolves.toEqual({
+      sessionId: "session-1",
+      configOptions: [],
+    });
+
+    const loaded = makeProcess();
+    stubSessionResponses(loaded, null);
+    await expect(
+      loaded.loadSession("session-1", "/tmp/project"),
+    ).resolves.toEqual({ configOptions: [] });
+
+    const resumed = makeProcess();
+    stubSessionResponses(resumed, undefined);
+    await expect(
+      resumed.resumeSession("session-1", "/tmp/project"),
+    ).resolves.toEqual({ configOptions: [] });
+  });
+
+  test("setConfigOption forwards the value and returns the refreshed set", async () => {
+    const proc = makeProcess();
+    const calls: unknown[] = [];
+    const refreshed = [modelOption("opus")];
+    (proc as unknown as { connection: unknown }).connection = {
+      setSessionConfigOption: (params: unknown) => {
+        calls.push(params);
+        return Promise.resolve({ configOptions: refreshed });
+      },
+    };
+
+    await expect(
+      proc.setConfigOption("session-1", "model", "opus"),
+    ).resolves.toEqual(refreshed);
+
+    expect(calls).toEqual([
+      { sessionId: "session-1", configId: "model", value: "opus" },
+    ]);
+  });
+
+  test("setConfigOption sends the boolean request variant", async () => {
+    const proc = makeProcess();
+    const calls: unknown[] = [];
+    const refreshed = [modelOption("opus")];
+    (proc as unknown as { connection: unknown }).connection = {
+      setSessionConfigOption: (params: unknown) => {
+        calls.push(params);
+        return Promise.resolve({ configOptions: refreshed });
+      },
+    };
+
+    await proc.setConfigOption("session-1", "thinking", true);
+
+    expect(calls).toEqual([
+      {
+        sessionId: "session-1",
+        configId: "thinking",
+        type: "boolean",
+        value: true,
+      },
+    ]);
+  });
+
+  test("setConfigOption omits the discriminator for string values", async () => {
+    const proc = makeProcess();
+    const calls: unknown[] = [];
+    (proc as unknown as { connection: unknown }).connection = {
+      setSessionConfigOption: (params: unknown) => {
+        calls.push(params);
+        return Promise.resolve({ configOptions: [modelOption("opus")] });
+      },
+    };
+
+    await proc.setConfigOption("session-1", "model", "opus");
+
+    expect(calls[0]).not.toHaveProperty("type");
+  });
+
+  test("setConfigOption throws when the process is not spawned", async () => {
+    const proc = makeProcess();
+
+    await expect(
+      proc.setConfigOption("session-1", "model", "opus"),
+    ).rejects.toThrow('ACP agent "test-agent" is not spawned');
+  });
+});
+
 describe("AcpAgentProcess auth_required retry", () => {
   // spawnedEnv is injected the way spawn() builds it ({ ...process.env,
   // ...config.env }), so the advertised var names use a VELLUM_TEST_ prefix
@@ -196,17 +336,19 @@ describe("AcpAgentProcess auth_required retry", () => {
    * initialize() so the advertised authMethods are captured.
    */
   async function setupAuthProcess(options: {
+    command?: string;
     env?: Record<string, string>;
     authMethods?: AuthMethod[];
     /** Rejections to throw from successive newSession calls before succeeding. */
     newSessionRejections?: unknown[];
     loadSessionRejections?: unknown[];
     resumeSessionRejections?: unknown[];
+    setConfigOptionRejections?: unknown[];
     promptRejections?: unknown[];
   }) {
     const proc = new AcpAgentProcess(
       "codex",
-      { command: "echo", args: [], env: options.env },
+      { command: options.command ?? "echo", args: [], env: options.env },
       () => {
         throw new Error("client factory should not be called in this test");
       },
@@ -234,6 +376,10 @@ describe("AcpAgentProcess auth_required retry", () => {
       options.resumeSessionRejections ?? [],
       {},
     );
+    const setSessionConfigOption = failThenSucceed(
+      options.setConfigOptionRejections ?? [],
+      { configOptions: [] },
+    );
     const prompt = failThenSucceed(options.promptRejections ?? [], {
       stopReason: "end_turn",
     });
@@ -252,6 +398,7 @@ describe("AcpAgentProcess auth_required retry", () => {
       newSession,
       loadSession,
       resumeSession,
+      setSessionConfigOption,
       prompt,
       authenticate,
     };
@@ -264,18 +411,112 @@ describe("AcpAgentProcess auth_required retry", () => {
       newSession,
       loadSession,
       resumeSession,
+      setSessionConfigOption,
       prompt,
       authenticate,
       internals,
     };
   }
 
+  // An adapter that throws a plain Error reaches the client as a generic
+  // "Internal error" carrying the real sentence in `data.details`, which is
+  // the shape these fixtures reproduce.
+  test("setConfigOption surfaces the adapter's error answer as a refusal", async () => {
+    const { proc } = await setupAuthProcess({
+      setConfigOptionRejections: [
+        new acp.RequestError(-32603, "Internal error", {
+          details: "Invalid value for config option model: nope",
+        }),
+      ],
+    });
+
+    const refusal = await proc
+      .setConfigOption("session-1", "model", "nope")
+      .catch((err: unknown) => err);
+
+    expect(refusal).toBeInstanceOf(AcpConfigOptionRefusedError);
+    // The adapter's sentence, not the message the SDK framed it in.
+    expect((refusal as Error).message).toBe(
+      "Invalid value for config option model: nope",
+    );
+  });
+
+  test("setConfigOption serializes a payload that names no reason", async () => {
+    const { proc } = await setupAuthProcess({
+      setConfigOptionRejections: [
+        new acp.RequestError(-32603, "Internal error", { code: 7 }),
+      ],
+    });
+
+    await expect(
+      proc.setConfigOption("session-1", "model", "nope"),
+    ).rejects.toThrow('{"code":7}');
+  });
+
+  test("setConfigOption falls back to the message when there is no payload", async () => {
+    const { proc } = await setupAuthProcess({
+      setConfigOptionRejections: [
+        new acp.RequestError(-32603, "Session not found"),
+      ],
+    });
+
+    await expect(
+      proc.setConfigOption("session-1", "model", "nope"),
+    ).rejects.toThrow("Session not found");
+  });
+
+  test.each(["claude-agent-acp", "/usr/local/bin/claude-agent-acp"])(
+    "setConfigOption leaves Claude's message-shaped auth failure untyped (%s)",
+    async (command) => {
+      const expired = new acp.RequestError(-32603, "Internal error", {
+        details: "Not logged in",
+      });
+      const { proc } = await setupAuthProcess({
+        command,
+        setConfigOptionRejections: [expired],
+      });
+
+      await expect(
+        proc.setConfigOption("session-1", "model", "opus"),
+      ).rejects.toBe(expired);
+    },
+  );
+
+  test("setConfigOption reads Claude's login wording from another adapter as a refusal", async () => {
+    const { proc } = await setupAuthProcess({
+      command: "codex-acp",
+      setConfigOptionRejections: [
+        new acp.RequestError(-32603, "Internal error", {
+          details: "Not logged in",
+        }),
+      ],
+    });
+
+    const refusal = await proc
+      .setConfigOption("session-1", "model", "gpt-5")
+      .catch((err: unknown) => err);
+
+    expect(refusal).toBeInstanceOf(AcpConfigOptionRefusedError);
+    expect((refusal as Error).message).toBe("Not logged in");
+  });
+
+  test("setConfigOption leaves a transport failure untyped", async () => {
+    const closed = new Error("ACP connection closed");
+    const { proc } = await setupAuthProcess({
+      setConfigOptionRejections: [closed],
+    });
+
+    await expect(
+      proc.setConfigOption("session-1", "model", "opus"),
+    ).rejects.toBe(closed);
+  });
+
   test("createSession does not authenticate when newSession succeeds", async () => {
     const { proc, newSession, authenticate } = await setupAuthProcess({
       env: { [OPENAI_VAR]: "sk-test" },
     });
 
-    const sessionId = await proc.createSession("/tmp/project");
+    const { sessionId } = await proc.createSession("/tmp/project");
 
     expect(sessionId).toBe("session-1");
     expect(newSession).toHaveBeenCalledTimes(1);
@@ -288,7 +529,7 @@ describe("AcpAgentProcess auth_required retry", () => {
       newSessionRejections: [authRequiredError],
     });
 
-    const sessionId = await proc.createSession("/tmp/project");
+    const { sessionId } = await proc.createSession("/tmp/project");
 
     expect(sessionId).toBe("session-1");
     expect(authenticate).toHaveBeenCalledTimes(1);
@@ -387,6 +628,19 @@ describe("AcpAgentProcess auth_required retry", () => {
     expect(resumeSession).toHaveBeenCalledTimes(2);
   });
 
+  test("setConfigOption authenticates and retries on auth_required", async () => {
+    const { proc, setSessionConfigOption, authenticate } =
+      await setupAuthProcess({
+        env: { [OPENAI_VAR]: "sk-test" },
+        setConfigOptionRejections: [authRequiredError],
+      });
+
+    await proc.setConfigOption("session-1", "model", "opus");
+
+    expect(authenticate).toHaveBeenCalledWith({ methodId: "openai-api-key" });
+    expect(setSessionConfigOption).toHaveBeenCalledTimes(2);
+  });
+
   test("prompt authenticates and retries on auth_required, returning the response", async () => {
     const { proc, prompt, authenticate } = await setupAuthProcess({
       env: { [OPENAI_VAR]: "sk-test" },