@hienlh/ppm 0.23.15 → 0.23.17

package/src/providers/claude-agent-sdk.ts

@@ -221,6 +221,30 @@ interface StreamingSession {
   lastUserContent: string;
   /** Latest user message images — updated on follow-ups for accurate retry */
   lastUserImages?: Array<{ data: string; mediaType: string }>;
+  /** The sign-in this subprocess was started with — see `SubprocessCredential`. */
+  credential: SubprocessCredential;
+}
+
+/**
+ * The OAuth token a CLI subprocess holds, fixed for its whole life.
+ *
+ * The CLI cannot renew a token handed to it in `CLAUDE_CODE_OAUTH_TOKEN`: it carries no
+ * refresh token, and the CLI's own 401 recovery deliberately keeps a user-supplied token
+ * rather than adopting one from disk. Its only other renewal paths — the SDK's
+ * `getOAuthToken` callback and the rotated-token file — are enabled for Anthropic's own
+ * clients alone (the callback is gated on `CLAUDE_CODE_ENTRYPOINT` being Desktop, Cowork or
+ * VS Code). So when PPM renews an account's token, which revokes the previous one, every
+ * subprocess still holding it fails its next request. Recording the token per subprocess is
+ * what lets the chat layer renew while an account is quiet and restart idle subprocesses
+ * onto the new token between turns (`src/server/ws/chat-token-rotation.ts`).
+ */
+export interface SubprocessCredential {
+  accountId: string | null;
+  oauthToken: string;
+}
+
+function credentialOf(env: Record<string, string | undefined>, accountId: string | undefined): SubprocessCredential {
+  return { accountId: accountId ?? null, oauthToken: env.CLAUDE_CODE_OAUTH_TOKEN ?? "" };
 }
 
 /**
@@ -825,6 +849,11 @@ export class ClaudeAgentSdkProvider implements AIProvider {
     return this.streamingSessions.has(sessionId);
   }
 
+  /** Every session with a live subprocess, with the sign-in that subprocess holds. */
+  liveSubprocessCredentials(): Array<{ sessionId: string; credential: SubprocessCredential }> {
+    return [...this.streamingSessions].map(([sessionId, ss]) => ({ sessionId, credential: ss.credential }));
+  }
+
   /**
    * How long this session's prompt cache is worth holding a subprocess for.
    *
@@ -1390,6 +1419,7 @@ export class ClaudeAgentSdkProvider implements AIProvider {
         if (latest) account = latest;
       }
       const queryEnv = this.buildQueryEnv(meta.projectPath, account);
+      const queryCredential = credentialOf(queryEnv, account?.id);
 
       // Pre-flight: warn if no credentials at all (avoids 2-minute silent timeout)
       if (!account) {
@@ -1503,7 +1533,7 @@ export class ClaudeAgentSdkProvider implements AIProvider {
       // The query's one start line: a warm CLI and the MCP servers belong to it.
       log.info(`query: session=${sessionId} isFirst=${isFirstMessage} fork=${shouldFork} cwd=${effectiveCwd} platform=${process.platform} accountMode=${!!account} permissionMode=${permissionMode} isBypass=${isBypass}`
         + ` cli=${spare ? `warm ageMs=${spare.ageMs}` : "cold"}${crashRetryCount > 0 ? ` crashRetry=${crashRetryCount}` : ""} mcp=${Object.keys(mcpServers).join(",") || "none"}`);
-      this.streamingSessions.set(sessionId, { meta, query: initialQuery, controller: initialCtrl, lastUserContent: initContent, lastUserImages: initImages });
+      this.streamingSessions.set(sessionId, { meta, query: initialQuery, controller: initialCtrl, lastUserContent: initContent, lastUserImages: initImages, credential: queryCredential });
       this.activeQueries.set(sessionId, initialQuery);
       let eventSource: AsyncIterable<any> = initialQuery;
       log.debug(`session=${sessionId} query() created, waiting for first SDK event...`);
@@ -1531,7 +1561,7 @@ export class ClaudeAgentSdkProvider implements AIProvider {
           prompt: generator,
           options: { ...opts, hooks: queryHooks, canUseTool } as any,
         });
-        this.streamingSessions.set(sessionId, { meta, query: rq, controller, lastUserContent: retry.lastUserContent, lastUserImages: retry.lastUserImages });
+        this.streamingSessions.set(sessionId, { meta, query: rq, controller, lastUserContent: retry.lastUserContent, lastUserImages: retry.lastUserImages, credential: credentialOf(env, acc?.id) });
         this.activeQueries.set(sessionId, rq);
         return rq;
       };
@@ -1600,7 +1630,7 @@ export class ClaudeAgentSdkProvider implements AIProvider {
               prompt: retryGen,
               options: { ...retryOpts, hooks: queryHooks, canUseTool } as any,
             });
-            this.streamingSessions.set(sessionId, { meta, query: rq, controller: retryCtrl, lastUserContent: retry1.lastUserContent, lastUserImages: retry1.lastUserImages });
+            this.streamingSessions.set(sessionId, { meta, query: rq, controller: retryCtrl, lastUserContent: retry1.lastUserContent, lastUserImages: retry1.lastUserImages, credential: queryCredential });
             this.activeQueries.set(sessionId, rq);
             eventSource = rq;
             continue retryLoop;
@@ -1686,7 +1716,7 @@ export class ClaudeAgentSdkProvider implements AIProvider {
                 prompt: earlyAuthGen,
                 options: { ...retryOpts, hooks: queryHooks, canUseTool } as any,
               });
-              this.streamingSessions.set(sessionId, { meta, query: rq, controller: earlyAuthCtrl, lastUserContent: retry2.lastUserContent, lastUserImages: retry2.lastUserImages });
+              this.streamingSessions.set(sessionId, { meta, query: rq, controller: earlyAuthCtrl, lastUserContent: retry2.lastUserContent, lastUserImages: retry2.lastUserImages, credential: credentialOf(retryEnv, account?.id) });
               this.activeQueries.set(sessionId, rq);
               eventSource = rq;
               continue retryLoop;
@@ -1913,7 +1943,7 @@ export class ClaudeAgentSdkProvider implements AIProvider {
                   prompt: authRetryGen,
                   options: { ...retryOpts, hooks: queryHooks, canUseTool } as any,
                 });
-                this.streamingSessions.set(sessionId, { meta, query: rq, controller: authRetryCtrl, lastUserContent: retry3.lastUserContent, lastUserImages: retry3.lastUserImages });
+                this.streamingSessions.set(sessionId, { meta, query: rq, controller: authRetryCtrl, lastUserContent: retry3.lastUserContent, lastUserImages: retry3.lastUserImages, credential: credentialOf(retryEnv, account?.id) });
                 this.activeQueries.set(sessionId, rq);
                 eventSource = rq;
                 continue retryLoop;
@@ -1950,7 +1980,7 @@ export class ClaudeAgentSdkProvider implements AIProvider {
                   prompt: ulRetryGen,
                   options: { ...retryOpts, hooks: queryHooks, canUseTool } as any,
                 });
-                this.streamingSessions.set(sessionId, { meta, query: rq, controller: ulRetryCtrl, lastUserContent: retryU.lastUserContent, lastUserImages: retryU.lastUserImages });
+                this.streamingSessions.set(sessionId, { meta, query: rq, controller: ulRetryCtrl, lastUserContent: retryU.lastUserContent, lastUserImages: retryU.lastUserImages, credential: credentialOf(ulRetryEnv, account?.id) });
                 this.activeQueries.set(sessionId, rq);
                 eventSource = rq;
                 continue retryLoop;
@@ -2171,7 +2201,7 @@ export class ClaudeAgentSdkProvider implements AIProvider {
                   prompt: authRetryGen2,
                   options: { ...retryOpts, hooks: queryHooks, canUseTool } as any,
                 });
-                this.streamingSessions.set(sessionId, { meta, query: rq, controller: authRetryCtrl2, lastUserContent: retry6.lastUserContent, lastUserImages: retry6.lastUserImages });
+                this.streamingSessions.set(sessionId, { meta, query: rq, controller: authRetryCtrl2, lastUserContent: retry6.lastUserContent, lastUserImages: retry6.lastUserImages, credential: credentialOf(retryEnv, account?.id) });
                 this.activeQueries.set(sessionId, rq);
                 eventSource = rq;
                 continue retryLoop;

package/src/providers/codex-app-server/codex-event-mapper.ts

@@ -1,6 +1,7 @@
 import type { ChatEvent } from "../provider.interface.ts";
 import type { TurnUsage } from "../../shared/turn-usage.ts";
 import { redactTruncate } from "./codex-redact.ts";
+import { codexAsyncQuestionEvent } from "./codex-user-input.ts";
 import { changeToToolUse, fileUpdateChanges } from "./codex-patch.ts";
 import { parseSubagentActivity, subagentToolResult, subagentToolUse } from "./codex-subagent-thread.ts";
 
@@ -237,6 +238,8 @@ export function mapCodexEvent(notif: Notif, sessionId: string): ChatEvent[] {
 
     case "item/completed": {
       const item = asObj(p.item) as Item;
+      const question = codexAsyncQuestionEvent(item);
+      if (question) return [question];
       if (item.type === "contextCompaction") return [{ type: "system", subtype: "compact_done" }];
       const subagent = parseSubagentActivity(item);
       // Answers the card opened at `started` — keyed on the thread, because the

package/src/providers/codex-app-server/codex-provider.ts

@@ -51,6 +51,7 @@ import { getOrFetchUsage, registerUsageSource } from "../../services/provider-us
 import { codexUsageSource } from "./codex-usage-source.ts";
 import { AMBIENT_ACCOUNT_KEY } from "../../services/provider-usage/usage-source.ts";
 import { redactTruncate } from "./codex-redact.ts";
+import { buildUserInputResponse, normalizeCodexQuestions } from "./codex-user-input.ts";
 import { localizeRollout } from "./codex-rollout-transfer.ts";
 import { getRolloutMessagesAsync } from "./codex-history-async.ts";
 import {
@@ -62,7 +63,6 @@ import type {
   ModelListResponse,
   ServerRequest,
   JsonRpcNotification,
-  ToolRequestUserInputResponse,
   Thread,
   UserInput,
   CodexSkill,
@@ -328,24 +328,6 @@ function approvalToolLabel(method: string, params: unknown): string {
   return String(p.tool ?? "Tool");
 }
 
-function buildUserInputResponse(questions: unknown, data: unknown): ToolRequestUserInputResponse {
-  const answers: ToolRequestUserInputResponse["answers"] = {};
-  if (data && typeof data === "object" && !Array.isArray(data)) {
-    for (const [k, v] of Object.entries(data as Record<string, unknown>)) {
-      answers[k] = { answers: Array.isArray(v) ? v.map(String) : [String(v)] };
-    }
-    return { answers };
-  }
-  const arr = Array.isArray(data) ? data : data != null ? [data] : [];
-  const qs = Array.isArray(questions) ? questions : [];
-  qs.forEach((q, i) => {
-    const qid = (q && typeof q === "object" && ((q as any).id ?? (q as any).questionId)) || String(i);
-    const a = arr[i];
-    answers[qid] = { answers: a != null ? [String(a)] : [] };
-  });
-  return { answers };
-}
-
 /**
  * Codex provider — implements AIProvider directly (mirrors claude-agent-sdk),
  * driving `codex app-server` over JSON-RPC. Per-session live subprocess map;
@@ -1160,7 +1142,7 @@ export class CodexAppServerProvider implements AIProvider {
       const ppmReqId = crypto.randomUUID();
       const questions = (req.params as { questions?: unknown })?.questions;
       live.pendingApprovals.set(ppmReqId, { codexId: req.id, method, questions });
-      live.channel.push({ type: "approval_request", requestId: ppmReqId, tool: "AskUserQuestion", input: redactTruncate(req.params) });
+      live.channel.push({ type: "approval_request", requestId: ppmReqId, tool: "AskUserQuestion", input: { questions: normalizeCodexQuestions(questions) } });
       return;
     }
     // permissions/* response is a granted-profile, not a decision → decline.
@@ -1174,7 +1156,7 @@ export class CodexAppServerProvider implements AIProvider {
       if (!pending) continue;
       live.pendingApprovals.delete(requestId);
       if (pending.method === "item/tool/requestUserInput") {
-        this.respondOnce(live, pending.codexId, buildUserInputResponse(pending.questions, data));
+        this.respondOnce(live, pending.codexId, buildUserInputResponse(pending.questions, approved ? data : undefined));
       } else if (isApprovalMethod(pending.method)) {
         this.respondOnce(live, pending.codexId, decisionFor(pending.method as ApprovalMethod, approved));
       }

package/src/providers/codex-app-server/codex-rollout-items.ts

@@ -1,5 +1,6 @@
 import type { ChatEvent } from "../provider.interface.ts";
 import { redactTruncate } from "./codex-redact.ts";
+import { codexAsyncQuestionEvent } from "./codex-user-input.ts";
 import { parseSubagentActivity, type SubagentActivity } from "./codex-subagent-thread.ts";
 import { changeToToolUse, rolloutFileChanges } from "./codex-patch.ts";
 
@@ -161,6 +162,8 @@ export function mapRolloutItem(item: unknown): RolloutItemMapping {
     return text ? { kind: "user", text } : { kind: "ignore" };
   }
   if (type === "AgentMessage") {
+    const question = codexAsyncQuestionEvent(it);
+    if (question) return { kind: "events", events: [question] };
     const text = textFrom(it.content);
     return text ? { kind: "assistant", text } : { kind: "ignore" };
   }

package/src/providers/codex-app-server/codex-thread-params.ts

@@ -116,6 +116,7 @@ export function dbToolsMcpEnv(access: DbToolsMcpAccess | undefined): Record<stri
 export function buildThreadParams(input: ThreadParamsInput): CodexThreadParams {
   const instructions = input.developerInstructions?.trim();
   const config = {
+    "features.default_mode_request_user_input": true,
     ...(input.configOverrides?.config ?? {}),
     ...designMcpConfig(input.designMcp),
     ...tabToolsMcpConfig(input.tabToolsMcp),

package/src/providers/codex-app-server/codex-user-input.ts

@@ -0,0 +1,41 @@
+import type { ChatEvent } from "../provider.interface.ts";
+import { ASYNC_QUESTION_TOOL, type ChatQuestion } from "../../shared/chat-questions.ts";
+import type { ToolRequestUserInputResponse } from "./codex-protocol.ts";
+
+export function normalizeCodexQuestions(value: unknown): ChatQuestion[] {
+  if (!Array.isArray(value)) return [];
+  return value.flatMap((value, index) => {
+    if (!value || typeof value !== "object") return [];
+    const question = typeof value.question === "string" ? value.question : value.title;
+    if (typeof question !== "string" || !question.trim()) return [];
+    const options = Array.isArray(value.options) ? value.options.flatMap((option: unknown) => {
+      if (typeof option === "string") return [{ label: option }];
+      if (!option || typeof option !== "object" || !("label" in option) || typeof option.label !== "string") return [];
+      return [{ label: option.label, ...("description" in option && typeof option.description === "string" ? { description: option.description } : {}) }];
+    }) : [];
+    return [{ id: typeof value.id === "string" ? value.id : String(index), question,
+      ...(typeof value.header === "string" ? { header: value.header } : {}), options }];
+  });
+}
+
+export function codexAsyncQuestionEvent(item: Record<string, unknown>): ChatEvent | null {
+  if (item.type !== "agentMessage" && item.type !== "AgentMessage") return null;
+  const questions = normalizeCodexQuestions(item.questions);
+  if (typeof item.id !== "string" || !questions.length) return null;
+  return { type: "tool_use", tool: ASYNC_QUESTION_TOOL, toolUseId: item.id, input: { questions } };
+}
+
+export function buildUserInputResponse(questions: unknown, data: unknown): ToolRequestUserInputResponse {
+  const answers: ToolRequestUserInputResponse["answers"] = {};
+  if (!data || typeof data !== "object") return { answers };
+  normalizeCodexQuestions(questions).forEach((question, index) => {
+    const id = question.id!;
+    const value = Array.isArray(data) ? data[index]
+      : Object.hasOwn(data, id) ? (data as Record<string, unknown>)[id]
+      : Object.hasOwn(data, question.question) ? (data as Record<string, unknown>)[question.question] : undefined;
+    if (value != null) Object.defineProperty(answers, id, {
+      value: { answers: Array.isArray(value) ? value.map(String) : [String(value)] }, enumerable: true,
+    });
+  });
+  return { answers };
+}

package/src/server/ws/chat-token-rotation.ts

@@ -0,0 +1,150 @@
+/**
+ * Renews Claude sign-ins while nothing is using them, and moves idle chats onto the new token.
+ *
+ * Every chat subprocess is started with its account's access token in
+ * `CLAUDE_CODE_OAUTH_TOKEN` and cannot renew it (`SubprocessCredential` in
+ * `claude-agent-sdk.ts` says why). Tokens live eight hours, and renewing one revokes the
+ * previous token, so a renewal used to land in the middle of whatever turn happened to be
+ * running: its next request got a 401, the provider rebuilt the subprocess, and every
+ * subagent still working inside it died with it.
+ *
+ * So a token is renewed early — inside `QUIET_REFRESH_WINDOW_S` of expiry — at a moment
+ * when no turn, approval or background work is running on that account. Idle subprocesses
+ * still holding the old token are then dropped, the same way a model switch drops them, and
+ * their next message resumes on the new one. A subprocess that is busy is left alone and
+ * dropped once its turn is over. Only an account kept busy for the whole window still meets
+ * the point-of-use renewal mid-turn, and the provider's 401 recovery covers that, as before.
+ *
+ * Accounts no subprocess is using are not touched: they are renewed where they are next
+ * used, which is the rule `account.service.ts` follows on purpose.
+ */
+import { accountService } from "../../services/account.service.ts";
+import { createLogger } from "../../services/logger.ts";
+import type { SubprocessCredential } from "../../providers/claude-agent-sdk.ts";
+
+const log = createLogger("token-rotation");
+
+/** Renew this close to expiry, as soon as nothing is running on the account. */
+export const QUIET_REFRESH_WINDOW_S = 2 * 3600;
+/** Inside this the point-of-use renewal owns the token (`PREFLIGHT_REFRESH_BUFFER_S`). */
+const POINT_OF_USE_BUFFER_S = 300;
+const SWEEP_INTERVAL_MS = 60_000;
+
+export interface LiveSubprocess {
+  sessionId: string;
+  credential: SubprocessCredential;
+  /** A turn, an approval or background work is running in it — dropping it would lose work. */
+  busy: boolean;
+}
+
+export interface RenewalCandidate {
+  id: string;
+  expiresAt: number | null;
+  /** An OAuth account with a refresh token that the server has not rejected. */
+  renewable: boolean;
+}
+
+/** Accounts to renew now: in use by some subprocess, near expiry, and busy in none. */
+export function accountsToRenewNow(candidates: RenewalCandidate[], live: LiveSubprocess[], nowS: number): string[] {
+  const inUse = new Set<string>();
+  const busy = new Set<string>();
+  for (const p of live) {
+    const id = p.credential.accountId;
+    if (!id || !p.credential.oauthToken) continue;
+    inUse.add(id);
+    if (p.busy) busy.add(id);
+  }
+  return candidates
+    .filter((c) => {
+      if (!c.renewable || c.expiresAt == null || !inUse.has(c.id) || busy.has(c.id)) return false;
+      const left = c.expiresAt - nowS;
+      return left <= QUIET_REFRESH_WINDOW_S && left > POINT_OF_USE_BUFFER_S;
+    })
+    .map((c) => c.id);
+}
+
+/** Idle subprocesses still holding a token their account no longer has. */
+export function staleIdleSessions(live: LiveSubprocess[], currentToken: (accountId: string) => string | null): string[] {
+  return live
+    .filter((p) => {
+      const id = p.credential.accountId;
+      if (p.busy || !id || !p.credential.oauthToken) return false;
+      const current = currentToken(id);
+      return current !== null && current !== p.credential.oauthToken;
+    })
+    .map((p) => p.sessionId);
+}
+
+export interface TokenRotationDeps {
+  /** Every live Claude subprocess and whether work is running in it right now. */
+  liveSubprocesses: () => LiveSubprocess[];
+  /** Restart one idle subprocess; its next message resumes on the account's current token. */
+  dropIdle: (sessionId: string) => void;
+}
+
+function currentOAuthToken(accountId: string): string | null {
+  const token = accountService.getWithTokens(accountId)?.accessToken;
+  return token && token.startsWith("sk-ant-oat") ? token : null;
+}
+
+/** Drop every idle subprocess whose token has been replaced. Safe to call at any time. */
+export function dropStaleIdle(deps: TokenRotationDeps): void {
+  for (const sessionId of staleIdleSessions(deps.liveSubprocesses(), currentOAuthToken)) {
+    log.info(`session=${sessionId} restarting idle subprocess: its account's token was renewed`);
+    deps.dropIdle(sessionId);
+  }
+}
+
+/** One pass: renew what is due and quiet, then move idle subprocesses onto new tokens. */
+export async function sweepTokenRotation(deps: TokenRotationDeps, nowS = Math.floor(Date.now() / 1000)): Promise<void> {
+  const candidates: RenewalCandidate[] = accountService.list().map((a) => {
+    const acc = accountService.getWithTokens(a.id);
+    return {
+      id: a.id,
+      expiresAt: acc?.expiresAt ?? null,
+      renewable: !!acc && acc.accessToken.startsWith("sk-ant-oat") && acc.refreshToken !== "" && !acc.reauthRequired,
+    };
+  });
+  for (const id of accountsToRenewNow(candidates, deps.liveSubprocesses(), nowS)) {
+    const left = (candidates.find((c) => c.id === id)?.expiresAt ?? nowS) - nowS;
+    log.info(`Renewing ${id} early while no turn runs on it (token expires in ${left}s)`);
+    try {
+      await accountService.refreshAccessToken(id, false, false, QUIET_REFRESH_WINDOW_S);
+    } catch (e) {
+      // The point-of-use renewal tries again before the token is needed.
+      log.warn(`Early renewal failed for ${id}: ${(e as Error).message}`);
+    }
+  }
+  dropStaleIdle(deps);
+}
+
+// Survive Bun --hot reloads: one timer and one listener, whichever module copy registered last.
+const HOT_KEY = "__PPM_TOKEN_ROTATION__" as const;
+const hot = ((globalThis as any)[HOT_KEY] ??= { stop: null, deps: null }) as {
+  stop: (() => void) | null;
+  deps: TokenRotationDeps | null;
+};
+
+/** Run a sweep now with the registered chat layer, rather than waiting for the timer. */
+export async function runTokenRotationSweep(): Promise<void> {
+  if (hot.deps) await sweepTokenRotation(hot.deps);
+}
+
+export function registerTokenRotation(deps: TokenRotationDeps): () => void {
+  hot.stop?.();
+  hot.deps = deps;
+  let sweeping = false;
+  const sweep = () => {
+    if (sweeping) return;
+    sweeping = true;
+    sweepTokenRotation(deps)
+      .catch((e) => log.warn(`token rotation sweep failed: ${(e as Error).message}`))
+      .finally(() => { sweeping = false; });
+  };
+  const timer = setInterval(sweep, SWEEP_INTERVAL_MS);
+  (timer as { unref?: () => void }).unref?.();
+  // Any renewal — this sweep's, a turn's pre-flight, the usage poller's — strands idle subprocesses.
+  const unlisten = accountService.onTokenRotated(() => dropStaleIdle(deps));
+  hot.stop = () => { clearInterval(timer); unlisten(); };
+  return hot.stop;
+}

package/src/server/ws/chat.ts

@@ -33,6 +33,8 @@ import { parseTabOpenResult, type TabOpenRequest } from "../../shared/tab-open-p
 import { readLastTurnStop } from "../../services/session-trace/turn-stop-reader.ts";
 import { describeTurnStop, type TurnStop } from "../../shared/turn-stop.ts";
 import { createLogger } from "../../services/logger.ts";
+import { dropStaleIdle, registerTokenRotation, type TokenRotationDeps } from "./chat-token-rotation.ts";
+import type { SubprocessCredential } from "../../providers/claude-agent-sdk.ts";
 
 const log = createLogger("chat");
 const bgShellLog = createLogger("bg-shell");
@@ -436,6 +438,28 @@ registerMcpSignInSync({
   ),
 });
 
+const tokenRotationDeps: TokenRotationDeps = {
+  liveSubprocesses: () => {
+    const provider = providerRegistry.get("claude") as {
+      liveSubprocessCredentials?: () => Array<{ sessionId: string; credential: SubprocessCredential }>;
+    } | undefined;
+    return (provider?.liveSubprocessCredentials?.() ?? []).map(({ sessionId, credential }) => {
+      const entry = activeSessions.get(sessionId);
+      // The consumer loop outlives each turn, so a live subprocess between turns sits at
+      // `idle` with `isStreamingActive` still set. A subprocess with no entry here belongs to
+      // something else (a scheduled run) and is never ours to judge idle.
+      const busy = !entry || entry.phase !== "idle" || !!entry.pendingApprovalEvent || hasBackgroundWork(sessionId);
+      return { sessionId, credential, busy };
+    });
+  },
+  dropIdle: (sessionId) => dropIdleSubprocess(
+    sessionId,
+    "token_rotated",
+    "Subprocess restarted: its account's sign-in token was renewed, the next message resumes on the new one",
+  ),
+};
+registerTokenRotation(tokenRotationDeps);
+
 /**
  * Sessions with a turn in flight, optionally narrowed to one project.
  *
@@ -1253,6 +1277,10 @@ async function startSessionConsumer(sessionId: string, providerId: string, conte
           broadcast(sessionId, { type: "compact_status", status: "done" });
         }
         setPhase(sessionId, "idle");
+        // A renewal that landed while this turn ran left its subprocess holding a revoked
+        // token; restart it now rather than let the next message open with a 401. Deferred so
+        // the drop does not close the query from inside the loop that is reading it.
+        setTimeout(() => dropStaleIdle(tokenRotationDeps), 0);
         // Reset heartbeat tracking for next turn
         firstEventReceived = false;
         startTime = Date.now();

package/src/services/account.service.ts

@@ -166,6 +166,17 @@ class AccountService {
   private pendingStates = new Map<string, { verifier: string; createdAt: number }>();
   /** Per-account mutex: dedup concurrent refresh calls so only one OAuth request fires at a time. */
   private pendingRefreshes = new Map<string, Promise<void>>();
+  private tokenListeners = new Set<(accountId: string) => void>();
+
+  /**
+   * Hear about every replaced access token. Renewing one revokes the previous token, so a
+   * Claude subprocess still holding it fails its next request — see
+   * `src/server/ws/chat-token-rotation.ts`, which moves idle chats onto the new one.
+   */
+  onTokenRotated(listener: (accountId: string) => void): () => void {
+    this.tokenListeners.add(listener);
+    return () => { this.tokenListeners.delete(listener); };
+  }
 
   private toAccount(row: AccountRow): Account {
     let profileData: OAuthProfileData | null = null;
@@ -518,6 +529,9 @@ class AccountService {
       reauth_required: 0,
       ...(parked ? {} : { status: "active" as const }),
     });
+    for (const listener of this.tokenListeners) {
+      try { listener(id); } catch (e) { log.warn(`token rotation listener failed for ${id}: ${(e as Error).message}`); }
+    }
   }
 
   /**

package/src/shared/chat-questions.ts

@@ -0,0 +1,19 @@
+export interface ChatQuestion {
+  id?: string;
+  question: string;
+  header?: string;
+  options: { label: string; description?: string }[];
+  multiSelect?: boolean;
+}
+
+export const ASYNC_QUESTION_TOOL = "RequestUserInput";
+
+export function questionReplyPrefix(itemId: string): string {
+  return `Answers to Codex question ${encodeURIComponent(itemId)}:\n`;
+}
+
+export function formatQuestionReply(itemId: string, questions: ChatQuestion[], answers?: Record<string, string>): string {
+  return questionReplyPrefix(itemId) + (answers
+    ? questions.map((question) => `${question.question}\n${answers[question.id ?? question.question] ?? ""}`).join("\n\n")
+    : "Skipped by the user.");
+}

package/src/web/components/chat/async-question-card.tsx

@@ -0,0 +1,24 @@
+import { createContext, useContext } from "react";
+import type { ChatMessage } from "../../../types/chat";
+import { formatQuestionReply, questionReplyPrefix, type ChatQuestion } from "../../../shared/chat-questions";
+import { QuestionCard } from "./question-card";
+
+export const AsyncQuestionContext = createContext<{
+  messages: ChatMessage[];
+  onSend?: (content: string) => void;
+}>({ messages: [] });
+
+export function AsyncQuestionCard({ itemId, questions }: { itemId: string; questions: ChatQuestion[] }) {
+  const { messages, onSend } = useContext(AsyncQuestionContext);
+  const prefix = questionReplyPrefix(itemId);
+  const reply = messages.find((message) => message.role === "user" && message.content.startsWith(prefix));
+  if (reply || !onSend) return (
+    <div className="rounded-lg border border-border bg-surface p-3 text-sm whitespace-pre-wrap">
+      {reply ? reply.content.slice(prefix.length) : questions.map((question) => question.question).join("\n")}
+      <div className="mt-2 text-xs text-text-secondary">{reply ? "Response sent" : "Connect to answer this question"}</div>
+    </div>
+  );
+  return <QuestionCard questions={questions} autoFocus={false}
+    onSubmit={(answers) => onSend(formatQuestionReply(itemId, questions, answers))}
+    onSkip={() => onSend(formatQuestionReply(itemId, questions))} />;
+}

package/src/web/components/chat/chat-reconnect-banner.tsx

@@ -0,0 +1,54 @@
+import { Loader2, WifiOff } from "@/lib/icons";
+import { useReconnectIndicator } from "@/hooks/use-reconnect-indicator";
+
+interface ChatReconnectBannerProps {
+  isReconnecting: boolean;
+  onRetry: () => void;
+  /** Overrides for tests; production uses the hook's defaults. */
+  showDelayMs?: number;
+  lostAfterMs?: number;
+}
+
+/**
+ * A small pill floating over the top of the chat while the socket reconnects.
+ *
+ * It deliberately covers nothing else: the messages on screen stay readable and
+ * scrollable, and anything sent meanwhile is queued and goes out on reconnect.
+ */
+export function ChatReconnectBanner({ isReconnecting, onRetry, showDelayMs, lostAfterMs }: ChatReconnectBannerProps) {
+  const { stage, restart } = useReconnectIndicator(isReconnecting, showDelayMs, lostAfterMs);
+  if (stage === "hidden") return null;
+
+  return (
+    <div className="pointer-events-none absolute inset-x-0 top-2 z-40 flex justify-center px-4">
+      <div
+        role="status"
+        aria-live="polite"
+        data-reconnect-stage={stage}
+        className="pointer-events-auto flex items-center gap-2 rounded-full border border-border bg-surface/95 px-3 py-1 text-xs text-text-secondary shadow-sm backdrop-blur-sm"
+      >
+        {stage === "reconnecting" ? (
+          <>
+            <Loader2 className="size-3.5 animate-spin" />
+            <span>Reconnecting…</span>
+          </>
+        ) : (
+          <>
+            <WifiOff className="size-3.5 text-error" />
+            <span>Connection lost</span>
+            <button
+              type="button"
+              onClick={() => {
+                restart();
+                onRetry();
+              }}
+              className="-my-1 min-h-11 rounded-full px-2 font-medium text-primary hover:underline active:opacity-70 md:min-h-0 md:py-1"
+            >
+              Retry
+            </button>
+          </>
+        )}
+      </div>
+    </div>
+  );
+}

package/src/web/components/chat/chat-tab.tsx

@@ -1,4 +1,5 @@
 import { useState, useCallback, useRef, useEffect, useMemo } from "react";
+import { AsyncQuestionContext } from "./async-question-card";
 import { Loader2, Upload, X } from "@/lib/icons";
 import { toast } from "sonner";
 import { api, projectUrl } from "@/lib/api-client";
@@ -19,6 +20,7 @@ import { useChatAccountClaim } from "@/hooks/use-chat-account-claim";
 import { startPrepare, getPrepare, isPrepared, forgetPrepare } from "@/lib/new-chat-prepare-client";
 import { MessageList } from "./message-list";
 import { BackgroundCommandBar } from "./background-command-bar";
+import { ChatReconnectBanner } from "./chat-reconnect-banner";
 import { RunningAgentsBar } from "./running-agents-bar";
 import { AgentSessionProvider, normalizeProviderId } from "./agent-session-context";
 import { McpSignInBar } from "@/components/mcp-auth/mcp-sign-in-bar";
@@ -473,6 +475,12 @@ function ChatTabContent({ metadata, tabId, onNewSession, onFork, historyFilter }
     killBackgroundShell,
   } = useChat(sessionId, providerId, projectName, handleSessionMigrated, observeAttempt, replyTransportOptions);
 
+  // Shared by the history bar's reload button and the reconnect pill's Retry.
+  const reloadChat = useCallback(() => {
+    if (!isConnected) reconnect();
+    refetchMessages();
+  }, [isConnected, reconnect, refetchMessages]);
+
   const sessionChanges = useSessionFileChanges({ projectName, sessionId, messages, isStreaming });
   const openReview = useCallback((path?: string) => {
     if (!sessionId) return;
@@ -1283,15 +1291,8 @@ function ChatTabContent({ metadata, tabId, onNewSession, onFork, historyFilter }
         </div>
       )}
 
-      {/* Reconnect overlay */}
-      {isReconnecting && (
-        <div className="absolute inset-0 z-50 flex items-center justify-center bg-background/60 backdrop-blur-sm">
-          <div className="flex items-center gap-2 text-sm text-muted-foreground">
-            <Loader2 className="size-4 animate-spin" />
-            <span>Reconnecting...</span>
-          </div>
-        </div>
-      )}
+      {/* Reconnect status — a pill, not an overlay: the chat stays readable and usable */}
+      <ChatReconnectBanner isReconnecting={isReconnecting} onRetry={reloadChat} />
 
       {/* Edit-fork overlay — covers the chat while the new version forks + connects */}
       {editForking && (
@@ -1315,7 +1316,7 @@ function ChatTabContent({ metadata, tabId, onNewSession, onFork, historyFilter }
             <span>Starting conversation...</span>
           </div>
         </div>
-      ) : <SessionChangesContext.Provider value={sessionChangesValue}><MessageList
+      ) : <AsyncQuestionContext.Provider value={{ messages: renderedMessages, onSend: isConnected ? (content) => sendMessage(content, { permissionMode }) : undefined }}><SessionChangesContext.Provider value={sessionChangesValue}><MessageList
         messages={renderedMessages}
         onExpandCompact={expandCompact}
         isCompactExpanded={isCompactExpanded}
@@ -1346,7 +1347,7 @@ function ChatTabContent({ metadata, tabId, onNewSession, onFork, historyFilter }
         onDismissMessage={dismissMessage}
         onClearErrors={clearErrors}
         bashPartialOutput={bashPartialOutput}
-      /></SessionChangesContext.Provider>}
+      /></SessionChangesContext.Provider></AsyncQuestionContext.Provider>}
 
       {/* Agents still working — pinned here so it is the last thing under the conversation */}
       <RunningAgentsBar
@@ -1399,10 +1400,7 @@ function ChatTabContent({ metadata, tabId, onNewSession, onFork, historyFilter }
           onSelectSession={handleSelectSession}
           historyFilter={historyFilter}
           isConnected={isConnected}
-          onReload={() => {
-            if (!isConnected) reconnect();
-            refetchMessages();
-          }}
+          onReload={reloadChat}
           teamActivity={teamActivity}
           teamMessages={teamMessages}
           onTeamOpen={markTeamRead}