fix(protocol): harden credential response and options handling (#763)