feat(chat): refresh agent credentials during tool calls

src/lib/chatStream.test.ts

@@ -2,6 +2,7 @@ import {
   abortAgentChat,
   forkAgentChat,
   rejectAgentQuestion,
+  replyAgentCredentialRefresh,
   replyAgentPermission,
   replyAgentQuestion,
   type StreamEvent,
@@ -171,6 +172,32 @@ describe("streamAgentChat", () => {
     });
   });
 
+  it("parses credential refresh lifecycle events", async () => {
+    mockNewSessionStream({
+      ok: true,
+      body: makeStream([
+        'event: credential_refresh_required\ndata: {"session_id":"s1","request_id":"credential-1","reason":"access_token_rejected","timeout_ms":30000}\n\n',
+        'event: credential_refreshed\ndata: {"session_id":"s1","request_id":"credential-1"}\n\n',
+      ]),
+    });
+    const events: StreamEvent[] = [];
+    await streamAgentChat({ message: "hi", onEvent: (event) => events.push(event) });
+    expect(events).toEqual([
+      {
+        type: "credential_refresh_required",
+        sessionId: "s1",
+        requestId: "credential-1",
+        reason: "access_token_rejected",
+        timeoutMs: 30000,
+      },
+      {
+        type: "credential_refreshed",
+        sessionId: "s1",
+        requestId: "credential-1",
+      },
+    ]);
+  });
+
   it("parses tool_call arguments when params is empty", async () => {
     mockNewSessionStream({
       ok: true,
@@ -388,6 +415,20 @@ describe("streamAgentChat", () => {
     );
   });
 
+  it("submits refreshed credentials through the authenticated context", async () => {
+    apiFetch.mockResolvedValue({ ok: true, status: 202, text: async () => "" });
+    await replyAgentCredentialRefresh("s1", "credential-1");
+    expect(apiFetch).toHaveBeenCalledWith(
+      expect.stringContaining("/api/v1/agent/sessions/s1/credential-refreshes"),
+      expect.objectContaining({
+        method: "POST",
+        body: JSON.stringify({ request_id: "credential-1" }),
+        projectHeaderMode: "include",
+        skipAuthRedirect: true,
+      }),
+    );
+  });
+
   it("calls question reply and reject endpoints", async () => {
     apiFetch.mockResolvedValue({
       ok: true,