From c96273993b1b0cb84a13e226c94b4dbe2dc9a5f8 Mon Sep 17 00:00:00 2001
From: dimakis <dimitri.saridakis@gmail.com>
Date: Tue, 15 Sep 2026 08:53:03 +0100
Subject: [PATCH 1/6] fix(approvals): harden question response handling

---
 frontend/src/styles/global.css                |  6 +++++
 .../harness/__tests__/user-questions.test.ts  | 19 ++++++++++++++
 packages/harness/src/permission-handler.ts    | 19 ++++++++++----
 .../protocol/__tests__/ws-schemas-v2.test.ts  | 11 ++++++++
 .../protocol/__tests__/ws-schemas.test.ts     | 10 ++++++++
 packages/protocol/src/ws-schemas-v2.ts        |  5 +++-
 packages/protocol/src/ws-schemas.ts           |  5 +++-
 server/__tests__/ws-handler-v2.test.ts        | 25 ++++++++++++++++++-
 server/index.ts                               | 17 ++++++++++++-
 server/ws-handler-v2.ts                       | 25 +++++++++++++++++--
 10 files changed, 131 insertions(+), 11 deletions(-)

diff --git a/frontend/src/styles/global.css b/frontend/src/styles/global.css
index a098e2a12..107cd01e9 100644
--- a/frontend/src/styles/global.css
+++ b/frontend/src/styles/global.css
@@ -3312,6 +3312,12 @@ textarea:focus {
   max-height: 72dvh;
   overflow: hidden;
 }
+.perm-banner--elevated {
+  border-top-color: var(--warning);
+}
+.perm-banner--unknown {
+  border-top-color: var(--text-dim);
+}
 .perm-banner-heading {
   display: flex;
   justify-content: space-between;
diff --git a/packages/harness/__tests__/user-questions.test.ts b/packages/harness/__tests__/user-questions.test.ts
index f1c7d5741..95d203986 100644
--- a/packages/harness/__tests__/user-questions.test.ts
+++ b/packages/harness/__tests__/user-questions.test.ts
@@ -146,6 +146,25 @@ it('shows complete approval arguments rather than the notification summary', asy
   }
 });
 
+it('caps approval display input without truncating the SDK resolution input', async () => {
+  const { applyTierOverrides } = await import('../src/tool-tiers.js');
+  applyTierOverrides({ Bash: 'unknown' });
+  try {
+    const { handler, sent, abort } = setup();
+    const command = 'x'.repeat(20_000);
+    const result = handler('Bash', { command }, { signal: abort.signal, toolUseID: 'b-large' });
+    await vi.waitFor(() => expect(sent[0]).toBeDefined());
+    expect(sent[0].toolInput).toBe(`${command.slice(0, 10_000)}\n[… truncated]`);
+    resolvePending(sent[0].permId as string, 'once');
+    await expect(result).resolves.toMatchObject({
+      behavior: 'allow',
+      updatedInput: { command },
+    });
+  } finally {
+    applyTierOverrides({});
+  }
+});
+
 it('keeps an unresolved question replayable when a transport closes during send', async () => {
   const { getPendingRequestsBySession } = await import('../src/permissions.js');
   const { handler, registry, abort } = setup();
diff --git a/packages/harness/src/permission-handler.ts b/packages/harness/src/permission-handler.ts
index 7e501d87a..44fade393 100644
--- a/packages/harness/src/permission-handler.ts
+++ b/packages/harness/src/permission-handler.ts
@@ -36,6 +36,19 @@ export const UserQuestionsSchema = z
   .max(4)
   .refine((questions) => new Set(questions.map((q) => q.question)).size === questions.length);
 
+const PERMISSION_INPUT_MAX_CHARS = 10_000;
+const PERMISSION_INPUT_TRUNCATED = '\n[… truncated]';
+
+function permissionDisplayInput(toolName: string, input: Record<string, unknown>): string {
+  const full =
+    toolName === 'Bash' && typeof input.command === 'string'
+      ? input.command
+      : JSON.stringify(input, null, 2);
+  return full.length > PERMISSION_INPUT_MAX_CHARS
+    ? full.slice(0, PERMISSION_INPUT_MAX_CHARS) + PERMISSION_INPUT_TRUNCATED
+    : full;
+}
+
 function transportSend(transport: SessionTransport, data: Record<string, unknown>): void {
   try {
     if (transport.isOpen()) transport.send(data);
@@ -207,11 +220,7 @@ export function buildPermissionHandler(
       const request: PermissionRequest = {
         permId,
         toolName,
-        toolInput: questions
-          ? ''
-          : toolName === 'Bash' && typeof _toolInput.command === 'string'
-            ? _toolInput.command
-            : JSON.stringify(_toolInput, null, 2),
+        toolInput: questions ? '' : permissionDisplayInput(toolName, _toolInput),
         title: opts.title,
         description: opts.description,
         displayName: opts.displayName,
diff --git a/packages/protocol/__tests__/ws-schemas-v2.test.ts b/packages/protocol/__tests__/ws-schemas-v2.test.ts
index d88dd8c07..60ec1dac4 100644
--- a/packages/protocol/__tests__/ws-schemas-v2.test.ts
+++ b/packages/protocol/__tests__/ws-schemas-v2.test.ts
@@ -194,6 +194,17 @@ describe('v2 interrupt / stop / permission_response / set_mode', () => {
     expect(r.success).toBe(true);
   });
 
+  it('rejects whitespace-only question answers', () => {
+    const r = V2PermissionResponseMessage.safeParse({
+      type: 'permission_response',
+      sessionId: 'sess-1',
+      permId: 'p1',
+      decision: 'once',
+      answers: { question: ['   '] },
+    });
+    expect(r.success).toBe(false);
+  });
+
   it('accepts set_mode with sessionId', () => {
     const r = V2SetModeMessage.safeParse({
       type: 'set_mode',
diff --git a/packages/protocol/__tests__/ws-schemas.test.ts b/packages/protocol/__tests__/ws-schemas.test.ts
index 4ca9fa0bb..36755db99 100644
--- a/packages/protocol/__tests__/ws-schemas.test.ts
+++ b/packages/protocol/__tests__/ws-schemas.test.ts
@@ -67,6 +67,16 @@ describe('WS message schemas', () => {
     expect(result.success).toBe(true);
   });
 
+  it('rejects whitespace-only permission answers', () => {
+    const result = IncomingWsMessage.safeParse({
+      type: 'permission_response',
+      permId: 'p1',
+      decision: 'once',
+      answers: { question: ['   '] },
+    });
+    expect(result.success).toBe(false);
+  });
+
   it('accepts set_mode', () => {
     const result = IncomingWsMessage.safeParse({ type: 'set_mode', mode: 'auto' });
     expect(result.success).toBe(true);
diff --git a/packages/protocol/src/ws-schemas-v2.ts b/packages/protocol/src/ws-schemas-v2.ts
index 4af25ed4a..b2674da68 100644
--- a/packages/protocol/src/ws-schemas-v2.ts
+++ b/packages/protocol/src/ws-schemas-v2.ts
@@ -119,7 +119,10 @@ export const V2PermissionResponseMessage = z.object({
   permId: z.string(),
   decision: z.enum(['once', 'always', 'deny']).optional(),
   answers: z
-    .record(z.string().min(1).max(4000), z.array(z.string().min(1).max(4000)).min(1).max(9))
+    .record(
+      z.string().trim().min(1).max(4000),
+      z.array(z.string().trim().min(1).max(4000)).min(1).max(9),
+    )
     .optional(),
 });
 
diff --git a/packages/protocol/src/ws-schemas.ts b/packages/protocol/src/ws-schemas.ts
index cce4face5..1f3d8040b 100644
--- a/packages/protocol/src/ws-schemas.ts
+++ b/packages/protocol/src/ws-schemas.ts
@@ -53,7 +53,10 @@ export const PermissionResponseMessage = z.object({
   permId: z.string(),
   decision: z.enum(['once', 'always', 'deny']).optional(),
   answers: z
-    .record(z.string().min(1).max(4000), z.array(z.string().min(1).max(4000)).min(1).max(9))
+    .record(
+      z.string().trim().min(1).max(4000),
+      z.array(z.string().trim().min(1).max(4000)).min(1).max(9),
+    )
     .optional(),
   traceparent,
 });
diff --git a/server/__tests__/ws-handler-v2.test.ts b/server/__tests__/ws-handler-v2.test.ts
index 991c516a1..ccc821a95 100644
--- a/server/__tests__/ws-handler-v2.test.ts
+++ b/server/__tests__/ws-handler-v2.test.ts
@@ -50,7 +50,11 @@ import {
 } from '../chat.js';
 import { setSkillPolicy, clearSkillPolicy } from '../skill-policy.js';
 import { resolveSlashCommand } from '../slash-commands.js';
-import { denyPendingBySession, getPendingRequestsBySession } from '../permissions.js';
+import {
+  denyPendingBySession,
+  getPendingRequestsBySession,
+  resolvePending,
+} from '../permissions.js';
 
 import {
   handleHello,
@@ -1531,6 +1535,25 @@ describe('handlePermissionResponseV2', () => {
       ),
     ).not.toThrow();
   });
+
+  it('keeps an invalid response retryable and reports the rejection', () => {
+    vi.mocked(resolvePending).mockReturnValueOnce(false);
+    const ctx = createContext();
+    const transport = mockTransport();
+    ctx.connRegistry.register('c1', transport);
+
+    handlePermissionResponseV2(
+      'c1',
+      { type: 'permission_response', sessionId: 'sess-1', permId: 'p1', decision: 'once' },
+      ctx,
+    );
+
+    expect(transport.sent).toContainEqual({
+      type: 'error',
+      sessionId: 'sess-1',
+      error: 'Permission response was invalid or expired. Review the prompt and try again.',
+    });
+  });
 });
 
 // ─── handleReconnect — no running field in summary ──────────────────────────
diff --git a/server/index.ts b/server/index.ts
index 023b61b7b..42f446ee8 100644
--- a/server/index.ts
+++ b/server/index.ts
@@ -1121,12 +1121,27 @@ function handleChatWs(
             'ws.decision': msg.decision || 'deny',
           },
           () => {
-            resolvePending(
+            const resolved = resolvePending(
               msg.permId,
               msg.decision || 'deny',
               msg.answers,
               registry.get(clientId)?.sessionId,
             );
+            if (!resolved) {
+              try {
+                transport.send({
+                  type: 'error',
+                  error:
+                    'Permission response was invalid or expired. Review the prompt and try again.',
+                });
+              } catch (error) {
+                log.warn('permission response error delivery failed', {
+                  clientId,
+                  permId: msg.permId,
+                  error,
+                });
+              }
+            }
           },
           contextFromTraceparent(traceparent),
         );
diff --git a/server/ws-handler-v2.ts b/server/ws-handler-v2.ts
index d3143830b..7a3d57b7d 100644
--- a/server/ws-handler-v2.ts
+++ b/server/ws-handler-v2.ts
@@ -914,7 +914,7 @@ export function handleInterruptV2(
 export function handlePermissionResponseV2(
   connectionId: string,
   msg: PermissionMsg,
-  _ctx: V2HandlerContext,
+  ctx: V2HandlerContext,
 ): void {
   withSpan(
     'ws.permission_response',
@@ -924,7 +924,28 @@ export function handlePermissionResponseV2(
       'ws.permId': msg.permId,
     },
     () => {
-      resolvePending(msg.permId, msg.decision ?? 'deny', msg.answers, msg.sessionId);
+      const resolved = resolvePending(
+        msg.permId,
+        msg.decision ?? 'deny',
+        msg.answers,
+        msg.sessionId,
+      );
+      if (!resolved) {
+        try {
+          ctx.connRegistry.get(connectionId)?.transport.send({
+            type: 'error',
+            sessionId: msg.sessionId,
+            error: 'Permission response was invalid or expired. Review the prompt and try again.',
+          });
+        } catch (error) {
+          log.warn('permission response error delivery failed', {
+            connectionId,
+            sessionId: msg.sessionId,
+            permId: msg.permId,
+            error,
+          });
+        }
+      }
       log.info('permission_response', {
         connectionId,
         sessionId: msg.sessionId,

From 9ccb1b58e5cfd715ee259b6ab4dc3fb0c5f3c6ba Mon Sep 17 00:00:00 2001
From: dimakis <dimitri.saridakis@gmail.com>
Date: Tue, 15 Sep 2026 09:25:09 +0100
Subject: [PATCH 2/6] fix(approvals): make rejected responses safely retryable

---
 frontend/src/components/ChatArea.tsx           |  1 +
 frontend/src/components/PermissionBanner.tsx   |  7 +++++++
 .../__tests__/PermissionBanner.test.tsx        |  6 ++++++
 frontend/src/styles/global.css                 |  7 +++++++
 frontend/src/types/ws-messages.ts              |  8 ++++++++
 .../client/__tests__/messages-slice.test.ts    | 16 ++++++++++++++++
 .../client/__tests__/protocol-parser.test.ts   | 11 +++++++++++
 packages/client/src/protocol-parser.ts         |  8 ++++++++
 packages/client/src/slices/messages.ts         | 13 +++++++++++++
 .../harness/__tests__/user-questions.test.ts   | 10 ++++------
 packages/harness/src/permission-handler.ts     | 18 ++++++++++++------
 .../protocol/__tests__/ws-schemas-v2.test.ts   | 13 +++++++++++++
 packages/protocol/__tests__/ws-schemas.test.ts | 13 +++++++++++++
 packages/protocol/src/types.ts                 |  1 +
 packages/protocol/src/ws-schemas-v2.ts         | 11 +++++++----
 packages/protocol/src/ws-schemas.ts            | 11 +++++++----
 server/__tests__/ws-handler-v2.test.ts         |  3 ++-
 server/index.ts                                |  3 ++-
 server/ws-handler-v2.ts                        |  3 ++-
 19 files changed, 140 insertions(+), 23 deletions(-)

diff --git a/frontend/src/components/ChatArea.tsx b/frontend/src/components/ChatArea.tsx
index f86d58f29..0ce7bfb53 100644
--- a/frontend/src/components/ChatArea.tsx
+++ b/frontend/src/components/ChatArea.tsx
@@ -255,6 +255,7 @@ export function ChatArea({
           displayName={permission.displayName}
           tier={permission.tier}
           approvalScope={permission.approvalScope}
+          responseError={permission.responseError}
           onRespond={onPermissionRespond}
         />
       )}
diff --git a/frontend/src/components/PermissionBanner.tsx b/frontend/src/components/PermissionBanner.tsx
index d911f31a8..d7c3e3bfe 100644
--- a/frontend/src/components/PermissionBanner.tsx
+++ b/frontend/src/components/PermissionBanner.tsx
@@ -11,6 +11,7 @@ interface Props {
   displayName?: string;
   tier?: ToolTier;
   approvalScope?: 'session' | 'conversation';
+  responseError?: string;
   expiresAt?: number;
   questions?: UserQuestion[];
   onRespond: (
@@ -36,6 +37,7 @@ export function PermissionBanner({
   displayName,
   tier,
   approvalScope,
+  responseError,
   questions,
   expiresAt,
   onRespond,
@@ -184,6 +186,11 @@ export function PermissionBanner({
         )}
       </div>
       <div className="perm-banner-actions">
+        {responseError && (
+          <p className="perm-banner-response-error" role="alert">
+            {responseError}
+          </p>
+        )}
         {questions ? (
           <button
             className="perm-banner-btn perm-banner-btn--once"
diff --git a/frontend/src/components/__tests__/PermissionBanner.test.tsx b/frontend/src/components/__tests__/PermissionBanner.test.tsx
index 1e131ea13..b138b1fa1 100644
--- a/frontend/src/components/__tests__/PermissionBanner.test.tsx
+++ b/frontend/src/components/__tests__/PermissionBanner.test.tsx
@@ -74,6 +74,12 @@ describe('PermissionBanner', () => {
     expect(container.querySelector('.perm-banner-btn--deny')).toBeTruthy();
   });
 
+  it('shows a retryable permission response error without dismissing the prompt', () => {
+    render(<PermissionBanner {...defaultProps} responseError="Review the prompt and try again." />);
+    expect(screen.getByRole('alert').textContent).toContain('Review the prompt and try again.');
+    expect(screen.getByText('Allow Once')).toBeTruthy();
+  });
+
   it('adds perm-banner--visible class after mount', () => {
     const rafSpy = vi.spyOn(globalThis, 'requestAnimationFrame').mockImplementation((cb) => {
       cb(0);
diff --git a/frontend/src/styles/global.css b/frontend/src/styles/global.css
index 107cd01e9..10f2ee3ea 100644
--- a/frontend/src/styles/global.css
+++ b/frontend/src/styles/global.css
@@ -3378,6 +3378,13 @@ textarea:focus {
   border-top: 1px solid var(--border);
   padding-top: 14px;
 }
+
+.perm-banner-response-error {
+  flex-basis: 100%;
+  margin: 0;
+  color: var(--error, #f87171);
+  font-size: 0.8rem;
+}
 .perm-banner-btn {
   flex: 1;
   min-height: 44px;
diff --git a/frontend/src/types/ws-messages.ts b/frontend/src/types/ws-messages.ts
index d966d2884..a813274f4 100644
--- a/frontend/src/types/ws-messages.ts
+++ b/frontend/src/types/ws-messages.ts
@@ -136,6 +136,13 @@ interface PermissionResolvedMsg {
   sessionId?: string;
 }
 
+interface PermissionResponseRejectedMsg {
+  type: 'permission_response_rejected';
+  permId: string;
+  sessionId?: string;
+  error: string;
+}
+
 interface ErrorMsg {
   type: 'error';
   error: string;
@@ -246,6 +253,7 @@ export type ServerMessage =
   | PermissionRequestMsg
   | PermissionTimeoutMsg
   | PermissionResolvedMsg
+  | PermissionResponseRejectedMsg
   | ErrorMsg
   | SessionTakeoverMsg
   | ModeChangedMsg
diff --git a/packages/client/__tests__/messages-slice.test.ts b/packages/client/__tests__/messages-slice.test.ts
index 40bf2eab6..335a38460 100644
--- a/packages/client/__tests__/messages-slice.test.ts
+++ b/packages/client/__tests__/messages-slice.test.ts
@@ -1703,3 +1703,19 @@ it('queues concurrent prompts and deduplicates reconnect replay', () => {
   state = messagesReducer(state, { type: 'PERMISSION_TIMEOUT', permId: 'p2' });
   expect(state.permission).toBeNull();
 });
+
+it('keeps streaming state and the prompt when a permission response is rejected', () => {
+  const permission = { permId: 'p1', toolName: 'Bash', toolInput: 'pwd' };
+  const state = messagesReducer(
+    {
+      ...INITIAL_MESSAGES_STATE,
+      running: true,
+      current: { messageId: 'm1', blocks: new Map(), blockOrder: [] },
+      permission,
+    },
+    { type: 'PERMISSION_REJECTED', permId: 'p1', error: 'Try again' },
+  );
+  expect(state.running).toBe(true);
+  expect(state.current?.messageId).toBe('m1');
+  expect(state.permission).toEqual({ ...permission, responseError: 'Try again' });
+});
diff --git a/packages/client/__tests__/protocol-parser.test.ts b/packages/client/__tests__/protocol-parser.test.ts
index 4b26d8ff4..ecf87a15a 100644
--- a/packages/client/__tests__/protocol-parser.test.ts
+++ b/packages/client/__tests__/protocol-parser.test.ts
@@ -353,6 +353,17 @@ describe('permission events', () => {
     );
     expect(r.messagesActions).toEqual([{ type: 'PERMISSION_TIMEOUT', permId: 'p1' }]);
   });
+  it('permission_response_rejected dispatches a nonterminal permission rejection', () => {
+    const r = parseServerMessage(
+      { type: 'permission_response_rejected', permId: 'p1', error: 'Try again' },
+      makeState(),
+      makeCallbacks(),
+      POOL_KEY,
+    );
+    expect(r.messagesActions).toEqual([
+      { type: 'PERMISSION_REJECTED', permId: 'p1', error: 'Try again' },
+    ]);
+  });
 });
 
 // ─── Error handling ──────────────────────────────────────────────────────────
diff --git a/packages/client/src/protocol-parser.ts b/packages/client/src/protocol-parser.ts
index 8f5f49e67..fb15c2229 100644
--- a/packages/client/src/protocol-parser.ts
+++ b/packages/client/src/protocol-parser.ts
@@ -397,6 +397,14 @@ export function parseServerMessage(
       });
       break;
 
+    case 'permission_response_rejected':
+      result.messagesActions.push({
+        type: 'PERMISSION_REJECTED',
+        permId: msg.permId as string,
+        error: msg.error as string,
+      });
+      break;
+
     case 'native_command_result':
       result.messagesActions.push({
         type: 'NATIVE_COMMAND_RESULT',
diff --git a/packages/client/src/slices/messages.ts b/packages/client/src/slices/messages.ts
index acf0a62ee..009b14f44 100644
--- a/packages/client/src/slices/messages.ts
+++ b/packages/client/src/slices/messages.ts
@@ -161,6 +161,7 @@ export type MessagesAction =
   | { type: 'SESSION_STATE_CHANGED'; state: ClientSessionState }
   | { type: 'CONNECTION_LOST' }
   | { type: 'PERMISSION_REQUEST'; payload: PermissionRequest }
+  | { type: 'PERMISSION_REJECTED'; permId: string; error: string }
   | { type: 'PERMISSION_TIMEOUT'; permId: string }
   | { type: 'RESTORE'; messages: FinishedMessage[]; interrupted?: boolean }
   | {
@@ -404,6 +405,18 @@ export function messagesReducer(state: MessagesState, action: MessagesAction): M
         : { ...state, permission: action.payload };
     }
 
+    case 'PERMISSION_REJECTED': {
+      const update = (permission: PermissionRequest) =>
+        permission.permId === action.permId
+          ? { ...permission, responseError: action.error }
+          : permission;
+      return {
+        ...state,
+        permission: state.permission ? update(state.permission) : null,
+        permissionQueue: state.permissionQueue?.map(update),
+      };
+    }
+
     case 'PERMISSION_TIMEOUT': {
       const queue = (state.permissionQueue ?? []).filter((p) => p.permId !== action.permId);
       if (state.permission?.permId !== action.permId) return { ...state, permissionQueue: queue };
diff --git a/packages/harness/__tests__/user-questions.test.ts b/packages/harness/__tests__/user-questions.test.ts
index 95d203986..75cebb762 100644
--- a/packages/harness/__tests__/user-questions.test.ts
+++ b/packages/harness/__tests__/user-questions.test.ts
@@ -146,20 +146,18 @@ it('shows complete approval arguments rather than the notification summary', asy
   }
 });
 
-it('caps approval display input without truncating the SDK resolution input', async () => {
+it('rejects approval input that cannot be displayed in full', async () => {
   const { applyTierOverrides } = await import('../src/tool-tiers.js');
   applyTierOverrides({ Bash: 'unknown' });
   try {
     const { handler, sent, abort } = setup();
     const command = 'x'.repeat(20_000);
     const result = handler('Bash', { command }, { signal: abort.signal, toolUseID: 'b-large' });
-    await vi.waitFor(() => expect(sent[0]).toBeDefined());
-    expect(sent[0].toolInput).toBe(`${command.slice(0, 10_000)}\n[… truncated]`);
-    resolvePending(sent[0].permId as string, 'once');
     await expect(result).resolves.toMatchObject({
-      behavior: 'allow',
-      updatedInput: { command },
+      behavior: 'deny',
+      message: expect.stringContaining('too large to review safely'),
     });
+    expect(sent).toEqual([]);
   } finally {
     applyTierOverrides({});
   }
diff --git a/packages/harness/src/permission-handler.ts b/packages/harness/src/permission-handler.ts
index 44fade393..0e7f5b629 100644
--- a/packages/harness/src/permission-handler.ts
+++ b/packages/harness/src/permission-handler.ts
@@ -37,16 +37,16 @@ export const UserQuestionsSchema = z
   .refine((questions) => new Set(questions.map((q) => q.question)).size === questions.length);
 
 const PERMISSION_INPUT_MAX_CHARS = 10_000;
-const PERMISSION_INPUT_TRUNCATED = '\n[… truncated]';
 
-function permissionDisplayInput(toolName: string, input: Record<string, unknown>): string {
+function permissionDisplayInput(
+  toolName: string,
+  input: Record<string, unknown>,
+): string | undefined {
   const full =
     toolName === 'Bash' && typeof input.command === 'string'
       ? input.command
       : JSON.stringify(input, null, 2);
-  return full.length > PERMISSION_INPUT_MAX_CHARS
-    ? full.slice(0, PERMISSION_INPUT_MAX_CHARS) + PERMISSION_INPUT_TRUNCATED
-    : full;
+  return full.length <= PERMISSION_INPUT_MAX_CHARS ? full : undefined;
 }
 
 function transportSend(transport: SessionTransport, data: Record<string, unknown>): void {
@@ -177,6 +177,12 @@ export function buildPermissionHandler(
 
     const inputSummary = summarizeToolInput(toolName, _toolInput);
     const tier = getToolTier(toolName);
+    const displayInput = questions ? '' : permissionDisplayInput(toolName, _toolInput);
+    if (displayInput === undefined)
+      return {
+        behavior: 'deny',
+        message: 'Tool input is too large to review safely. Split it into smaller operations.',
+      };
 
     return new Promise<PermissionResult>((resolve) => {
       if (opts.signal.aborted) {
@@ -220,7 +226,7 @@ export function buildPermissionHandler(
       const request: PermissionRequest = {
         permId,
         toolName,
-        toolInput: questions ? '' : permissionDisplayInput(toolName, _toolInput),
+        toolInput: displayInput,
         title: opts.title,
         description: opts.description,
         displayName: opts.displayName,
diff --git a/packages/protocol/__tests__/ws-schemas-v2.test.ts b/packages/protocol/__tests__/ws-schemas-v2.test.ts
index 60ec1dac4..0aad25c6f 100644
--- a/packages/protocol/__tests__/ws-schemas-v2.test.ts
+++ b/packages/protocol/__tests__/ws-schemas-v2.test.ts
@@ -205,6 +205,19 @@ describe('v2 interrupt / stop / permission_response / set_mode', () => {
     expect(r.success).toBe(false);
   });
 
+  it('validates nonblank answers without changing provider keys or values', () => {
+    const answers = { ' question ': [' option '] };
+    const r = V2PermissionResponseMessage.safeParse({
+      type: 'permission_response',
+      sessionId: 'sess-1',
+      permId: 'p1',
+      decision: 'once',
+      answers,
+    });
+    expect(r.success).toBe(true);
+    if (r.success) expect(r.data.answers).toEqual(answers);
+  });
+
   it('accepts set_mode with sessionId', () => {
     const r = V2SetModeMessage.safeParse({
       type: 'set_mode',
diff --git a/packages/protocol/__tests__/ws-schemas.test.ts b/packages/protocol/__tests__/ws-schemas.test.ts
index 36755db99..5e904ef1f 100644
--- a/packages/protocol/__tests__/ws-schemas.test.ts
+++ b/packages/protocol/__tests__/ws-schemas.test.ts
@@ -77,6 +77,19 @@ describe('WS message schemas', () => {
     expect(result.success).toBe(false);
   });
 
+  it('validates nonblank answers without changing provider keys or values', () => {
+    const answers = { ' question ': [' option '] };
+    const result = IncomingWsMessage.safeParse({
+      type: 'permission_response',
+      permId: 'p1',
+      decision: 'once',
+      answers,
+    });
+    expect(result.success).toBe(true);
+    if (result.success && result.data.type === 'permission_response')
+      expect(result.data.answers).toEqual(answers);
+  });
+
   it('accepts set_mode', () => {
     const result = IncomingWsMessage.safeParse({ type: 'set_mode', mode: 'auto' });
     expect(result.success).toBe(true);
diff --git a/packages/protocol/src/types.ts b/packages/protocol/src/types.ts
index 3e12c61c2..9201ecd0d 100644
--- a/packages/protocol/src/types.ts
+++ b/packages/protocol/src/types.ts
@@ -190,6 +190,7 @@ export interface PermissionRequest {
   displayName?: string;
   tier?: ToolTier;
   approvalScope?: 'session' | 'conversation';
+  responseError?: string;
 }
 
 // --- Image attachment ---
diff --git a/packages/protocol/src/ws-schemas-v2.ts b/packages/protocol/src/ws-schemas-v2.ts
index b2674da68..fef89abfd 100644
--- a/packages/protocol/src/ws-schemas-v2.ts
+++ b/packages/protocol/src/ws-schemas-v2.ts
@@ -113,16 +113,19 @@ export const V2StopMessage = z.object({
   sessionId: z.string().min(1),
 });
 
+const NonBlankPermissionText = z
+  .string()
+  .min(1)
+  .max(4000)
+  .refine((value) => value.trim().length > 0, 'Must not be blank');
+
 export const V2PermissionResponseMessage = z.object({
   type: z.literal('permission_response'),
   sessionId: z.string().min(1).optional(),
   permId: z.string(),
   decision: z.enum(['once', 'always', 'deny']).optional(),
   answers: z
-    .record(
-      z.string().trim().min(1).max(4000),
-      z.array(z.string().trim().min(1).max(4000)).min(1).max(9),
-    )
+    .record(NonBlankPermissionText, z.array(NonBlankPermissionText).min(1).max(9))
     .optional(),
 });
 
diff --git a/packages/protocol/src/ws-schemas.ts b/packages/protocol/src/ws-schemas.ts
index 1f3d8040b..7dd58bc34 100644
--- a/packages/protocol/src/ws-schemas.ts
+++ b/packages/protocol/src/ws-schemas.ts
@@ -48,15 +48,18 @@ export const StopMessage = z.object({
   traceparent,
 });
 
+const NonBlankPermissionText = z
+  .string()
+  .min(1)
+  .max(4000)
+  .refine((value) => value.trim().length > 0, 'Must not be blank');
+
 export const PermissionResponseMessage = z.object({
   type: z.literal('permission_response'),
   permId: z.string(),
   decision: z.enum(['once', 'always', 'deny']).optional(),
   answers: z
-    .record(
-      z.string().trim().min(1).max(4000),
-      z.array(z.string().trim().min(1).max(4000)).min(1).max(9),
-    )
+    .record(NonBlankPermissionText, z.array(NonBlankPermissionText).min(1).max(9))
     .optional(),
   traceparent,
 });
diff --git a/server/__tests__/ws-handler-v2.test.ts b/server/__tests__/ws-handler-v2.test.ts
index ccc821a95..6ad0c7191 100644
--- a/server/__tests__/ws-handler-v2.test.ts
+++ b/server/__tests__/ws-handler-v2.test.ts
@@ -1549,8 +1549,9 @@ describe('handlePermissionResponseV2', () => {
     );
 
     expect(transport.sent).toContainEqual({
-      type: 'error',
+      type: 'permission_response_rejected',
       sessionId: 'sess-1',
+      permId: 'p1',
       error: 'Permission response was invalid or expired. Review the prompt and try again.',
     });
   });
diff --git a/server/index.ts b/server/index.ts
index 42f446ee8..cd302cbca 100644
--- a/server/index.ts
+++ b/server/index.ts
@@ -1130,7 +1130,8 @@ function handleChatWs(
             if (!resolved) {
               try {
                 transport.send({
-                  type: 'error',
+                  type: 'permission_response_rejected',
+                  permId: msg.permId,
                   error:
                     'Permission response was invalid or expired. Review the prompt and try again.',
                 });
diff --git a/server/ws-handler-v2.ts b/server/ws-handler-v2.ts
index 7a3d57b7d..34471fb90 100644
--- a/server/ws-handler-v2.ts
+++ b/server/ws-handler-v2.ts
@@ -933,8 +933,9 @@ export function handlePermissionResponseV2(
       if (!resolved) {
         try {
           ctx.connRegistry.get(connectionId)?.transport.send({
-            type: 'error',
+            type: 'permission_response_rejected',
             sessionId: msg.sessionId,
+            permId: msg.permId,
             error: 'Permission response was invalid or expired. Review the prompt and try again.',
           });
         } catch (error) {

From fe28881eae0d827bdd494822fa8dded6991a566d Mon Sep 17 00:00:00 2001
From: dimakis <dimitri.saridakis@gmail.com>
Date: Tue, 15 Sep 2026 09:36:33 +0100
Subject: [PATCH 3/6] fix(approvals): preserve opaque question identifiers

---
 frontend/src/styles/global.css                |  1 +
 .../protocol/__tests__/ws-schemas-v2.test.ts  |  3 +-
 .../protocol/__tests__/ws-schemas.test.ts     |  3 +-
 packages/protocol/src/ws-schemas-v2.ts        |  4 +-
 packages/protocol/src/ws-schemas.ts           |  4 +-
 server/__tests__/ws-handler-v2.test.ts        | 26 ++++++++
 server/index.ts                               | 15 +++++
 server/ws-handler-v2.ts                       | 66 +++++++++++++------
 8 files changed, 93 insertions(+), 29 deletions(-)

diff --git a/frontend/src/styles/global.css b/frontend/src/styles/global.css
index 10f2ee3ea..af7811ed0 100644
--- a/frontend/src/styles/global.css
+++ b/frontend/src/styles/global.css
@@ -3373,6 +3373,7 @@ textarea:focus {
 }
 .perm-banner-actions {
   display: flex;
+  flex-wrap: wrap;
   gap: 8px;
   flex-shrink: 0;
   border-top: 1px solid var(--border);
diff --git a/packages/protocol/__tests__/ws-schemas-v2.test.ts b/packages/protocol/__tests__/ws-schemas-v2.test.ts
index 0aad25c6f..b038e7f93 100644
--- a/packages/protocol/__tests__/ws-schemas-v2.test.ts
+++ b/packages/protocol/__tests__/ws-schemas-v2.test.ts
@@ -206,7 +206,8 @@ describe('v2 interrupt / stop / permission_response / set_mode', () => {
   });
 
   it('validates nonblank answers without changing provider keys or values', () => {
-    const answers = { ' question ': [' option '] };
+    const opaqueId = 'x'.repeat(4001);
+    const answers = { '   ': [' option '], [opaqueId]: ['value'] };
     const r = V2PermissionResponseMessage.safeParse({
       type: 'permission_response',
       sessionId: 'sess-1',
diff --git a/packages/protocol/__tests__/ws-schemas.test.ts b/packages/protocol/__tests__/ws-schemas.test.ts
index 5e904ef1f..854755557 100644
--- a/packages/protocol/__tests__/ws-schemas.test.ts
+++ b/packages/protocol/__tests__/ws-schemas.test.ts
@@ -78,7 +78,8 @@ describe('WS message schemas', () => {
   });
 
   it('validates nonblank answers without changing provider keys or values', () => {
-    const answers = { ' question ': [' option '] };
+    const opaqueId = 'x'.repeat(4001);
+    const answers = { '   ': [' option '], [opaqueId]: ['value'] };
     const result = IncomingWsMessage.safeParse({
       type: 'permission_response',
       permId: 'p1',
diff --git a/packages/protocol/src/ws-schemas-v2.ts b/packages/protocol/src/ws-schemas-v2.ts
index fef89abfd..20dcb557f 100644
--- a/packages/protocol/src/ws-schemas-v2.ts
+++ b/packages/protocol/src/ws-schemas-v2.ts
@@ -124,9 +124,7 @@ export const V2PermissionResponseMessage = z.object({
   sessionId: z.string().min(1).optional(),
   permId: z.string(),
   decision: z.enum(['once', 'always', 'deny']).optional(),
-  answers: z
-    .record(NonBlankPermissionText, z.array(NonBlankPermissionText).min(1).max(9))
-    .optional(),
+  answers: z.record(z.string(), z.array(NonBlankPermissionText).min(1).max(9)).optional(),
 });
 
 export const V2SetModeMessage = z.object({
diff --git a/packages/protocol/src/ws-schemas.ts b/packages/protocol/src/ws-schemas.ts
index 7dd58bc34..0322bb208 100644
--- a/packages/protocol/src/ws-schemas.ts
+++ b/packages/protocol/src/ws-schemas.ts
@@ -58,9 +58,7 @@ export const PermissionResponseMessage = z.object({
   type: z.literal('permission_response'),
   permId: z.string(),
   decision: z.enum(['once', 'always', 'deny']).optional(),
-  answers: z
-    .record(NonBlankPermissionText, z.array(NonBlankPermissionText).min(1).max(9))
-    .optional(),
+  answers: z.record(z.string(), z.array(NonBlankPermissionText).min(1).max(9)).optional(),
   traceparent,
 });
 
diff --git a/server/__tests__/ws-handler-v2.test.ts b/server/__tests__/ws-handler-v2.test.ts
index 6ad0c7191..2fc7b6cb8 100644
--- a/server/__tests__/ws-handler-v2.test.ts
+++ b/server/__tests__/ws-handler-v2.test.ts
@@ -2048,6 +2048,32 @@ describe('dispatchV2Message', () => {
     expect(transport.sent).toHaveLength(0);
   });
 
+  it('reports a malformed permission response as a retryable rejection', async () => {
+    const ctx = createContext();
+    const transport = mockTransport();
+    ctx.connRegistry.register('c1', transport);
+
+    await dispatchV2Message(
+      'c1',
+      transport,
+      JSON.stringify({
+        type: 'permission_response',
+        sessionId: 'sess-1',
+        permId: 'p1',
+        decision: 'once',
+        answers: { question: ['   '] },
+      }),
+      ctx,
+    );
+
+    expect(transport.sent).toContainEqual({
+      type: 'permission_response_rejected',
+      sessionId: 'sess-1',
+      permId: 'p1',
+      error: 'Permission response was invalid or expired. Review the prompt and try again.',
+    });
+  });
+
   it('ignores duplicate hello messages', async () => {
     const ctx = createContext();
     const transport = mockTransport();
diff --git a/server/index.ts b/server/index.ts
index cd302cbca..9da383631 100644
--- a/server/index.ts
+++ b/server/index.ts
@@ -897,6 +897,21 @@ function handleChatWs(
       const result = IncomingWsMessage.safeParse(parsed);
 
       if (!result.success) {
+        if (parsed?.type === 'permission_response' && typeof parsed.permId === 'string') {
+          try {
+            transport.send({
+              type: 'permission_response_rejected',
+              permId: parsed.permId,
+              error: 'Permission response was invalid or expired. Review the prompt and try again.',
+            });
+          } catch (error) {
+            log.warn('permission response error delivery failed', {
+              clientId,
+              permId: parsed.permId,
+              error,
+            });
+          }
+        }
         log.debug('unrecognized WS message', { clientId, type: parsed?.type });
         return;
       }
diff --git a/server/ws-handler-v2.ts b/server/ws-handler-v2.ts
index 34471fb90..7ac450072 100644
--- a/server/ws-handler-v2.ts
+++ b/server/ws-handler-v2.ts
@@ -911,6 +911,32 @@ export function handleInterruptV2(
   );
 }
 
+const PERMISSION_RESPONSE_REJECTED_MESSAGE =
+  'Permission response was invalid or expired. Review the prompt and try again.';
+
+function sendPermissionResponseRejected(
+  transport: SessionTransport | undefined,
+  connectionId: string,
+  permId: string,
+  sessionId?: string,
+) {
+  try {
+    transport?.send({
+      type: 'permission_response_rejected',
+      sessionId,
+      permId,
+      error: PERMISSION_RESPONSE_REJECTED_MESSAGE,
+    });
+  } catch (error) {
+    log.warn('permission response error delivery failed', {
+      connectionId,
+      sessionId,
+      permId,
+      error,
+    });
+  }
+}
+
 export function handlePermissionResponseV2(
   connectionId: string,
   msg: PermissionMsg,
@@ -931,21 +957,12 @@ export function handlePermissionResponseV2(
         msg.sessionId,
       );
       if (!resolved) {
-        try {
-          ctx.connRegistry.get(connectionId)?.transport.send({
-            type: 'permission_response_rejected',
-            sessionId: msg.sessionId,
-            permId: msg.permId,
-            error: 'Permission response was invalid or expired. Review the prompt and try again.',
-          });
-        } catch (error) {
-          log.warn('permission response error delivery failed', {
-            connectionId,
-            sessionId: msg.sessionId,
-            permId: msg.permId,
-            error,
-          });
-        }
+        sendPermissionResponseRejected(
+          ctx.connRegistry.get(connectionId)?.transport,
+          connectionId,
+          msg.permId,
+          msg.sessionId,
+        );
       }
       log.info('permission_response', {
         connectionId,
@@ -1288,9 +1305,17 @@ export async function dispatchV2Message(
 
   const result = IncomingWsMessageV2.safeParse(parsed);
   if (!result.success) {
+    const candidate = parsed as Record<string, unknown>;
+    if (candidate?.type === 'permission_response' && typeof candidate.permId === 'string')
+      sendPermissionResponseRejected(
+        transport,
+        connectionId,
+        candidate.permId,
+        typeof candidate.sessionId === 'string' ? candidate.sessionId : undefined,
+      );
     log.debug('unrecognized v2 message', {
       connectionId,
-      type: (parsed as Record<string, unknown>)?.type,
+      type: candidate?.type,
     });
     return;
   }
@@ -1351,12 +1376,11 @@ export function scheduleV2Message(
 ): Promise<void> {
   let isControl = false;
   try {
-    const parsed = IncomingWsMessageV2.safeParse(JSON.parse(raw));
+    const rawMessage = JSON.parse(raw) as Record<string, unknown>;
+    const parsed = IncomingWsMessageV2.safeParse(rawMessage);
     isControl =
-      parsed.success &&
-      (parsed.data.type === 'stop' ||
-        parsed.data.type === 'interrupt' ||
-        parsed.data.type === 'permission_response');
+      rawMessage.type === 'permission_response' ||
+      (parsed.success && (parsed.data.type === 'stop' || parsed.data.type === 'interrupt'));
   } catch {
     // Malformed messages stay on the ordinary FIFO and are ignored by dispatch.
   }

From 4bbc7131d101aaf2e4d630d900fbfed302433c31 Mon Sep 17 00:00:00 2001
From: dimakis <dimitri.saridakis@gmail.com>
Date: Tue, 15 Sep 2026 09:45:33 +0100
Subject: [PATCH 4/6] fix(approvals): handle unserializable review input

---
 .../harness/__tests__/user-questions.test.ts  | 20 +++++++++++++++++++
 packages/harness/src/permission-handler.ts    |  5 +++--
 2 files changed, 23 insertions(+), 2 deletions(-)

diff --git a/packages/harness/__tests__/user-questions.test.ts b/packages/harness/__tests__/user-questions.test.ts
index 75cebb762..5752f5fbe 100644
--- a/packages/harness/__tests__/user-questions.test.ts
+++ b/packages/harness/__tests__/user-questions.test.ts
@@ -163,6 +163,26 @@ it('rejects approval input that cannot be displayed in full', async () => {
   }
 });
 
+it('rejects approval input that cannot be serialized for review', async () => {
+  const { applyTierOverrides } = await import('../src/tool-tiers.js');
+  applyTierOverrides({ CustomWrite: 'unknown' });
+  try {
+    const { handler, sent, abort } = setup();
+    const result = handler(
+      'CustomWrite',
+      { toJSON: () => undefined },
+      { signal: abort.signal, toolUseID: 'custom-large' },
+    );
+    await expect(result).resolves.toMatchObject({
+      behavior: 'deny',
+      message: expect.stringContaining('too large to review safely'),
+    });
+    expect(sent).toEqual([]);
+  } finally {
+    applyTierOverrides({});
+  }
+});
+
 it('keeps an unresolved question replayable when a transport closes during send', async () => {
   const { getPendingRequestsBySession } = await import('../src/permissions.js');
   const { handler, registry, abort } = setup();
diff --git a/packages/harness/src/permission-handler.ts b/packages/harness/src/permission-handler.ts
index 0e7f5b629..01aaae3cf 100644
--- a/packages/harness/src/permission-handler.ts
+++ b/packages/harness/src/permission-handler.ts
@@ -46,6 +46,7 @@ function permissionDisplayInput(
     toolName === 'Bash' && typeof input.command === 'string'
       ? input.command
       : JSON.stringify(input, null, 2);
+  if (full === undefined) return undefined;
   return full.length <= PERMISSION_INPUT_MAX_CHARS ? full : undefined;
 }
 
@@ -175,14 +176,14 @@ export function buildPermissionHandler(
       };
     }
 
-    const inputSummary = summarizeToolInput(toolName, _toolInput);
-    const tier = getToolTier(toolName);
     const displayInput = questions ? '' : permissionDisplayInput(toolName, _toolInput);
     if (displayInput === undefined)
       return {
         behavior: 'deny',
         message: 'Tool input is too large to review safely. Split it into smaller operations.',
       };
+    const inputSummary = summarizeToolInput(toolName, _toolInput);
+    const tier = getToolTier(toolName);
 
     return new Promise<PermissionResult>((resolve) => {
       if (opts.signal.aborted) {

From d96f99f7fa823c267d8595f3cc3c40479a42b091 Mon Sep 17 00:00:00 2001
From: dimakis <dimitri.saridakis@gmail.com>
Date: Tue, 15 Sep 2026 10:05:21 +0100
Subject: [PATCH 5/6] fix(approvals): keep REST rejections nonterminal

---
 .../src/__tests__/sse-connection.test.ts      | 28 +++++++++++++++++++
 packages/client/src/sse-connection.ts         | 22 +++++++++++++--
 .../harness/__tests__/user-questions.test.ts  | 11 ++++----
 packages/harness/src/permission-handler.ts    | 13 ++++++---
 server/__tests__/chat-rest-handler.test.ts    | 22 +++++++++++++++
 server/chat-rest-handler.ts                   | 13 +++++++--
 6 files changed, 96 insertions(+), 13 deletions(-)

diff --git a/packages/client/src/__tests__/sse-connection.test.ts b/packages/client/src/__tests__/sse-connection.test.ts
index ae7221e1e..a6af954a5 100644
--- a/packages/client/src/__tests__/sse-connection.test.ts
+++ b/packages/client/src/__tests__/sse-connection.test.ts
@@ -485,6 +485,34 @@ describe('SseConnection', () => {
     }
   });
 
+  it('reports permission POST failures as nonterminal permission rejections', async () => {
+    const fetch = vi.fn().mockResolvedValue({ ok: false, status: 400 });
+    const conn = new SseConnection(createConfig({ fetch }));
+    const listener = vi.fn();
+    conn.onMessage(listener);
+    conn.connect();
+    lastES()._emit('welcome', { type: 'welcome', protocolVersion: 2, connectionId: 'conn-abc' });
+    listener.mockClear();
+
+    conn.send({
+      type: 'permission_response',
+      sessionId: 'sess-1',
+      permId: 'perm-1',
+      decision: 'once',
+      answers: { question: ['   '] },
+    });
+
+    await vi.waitFor(() =>
+      expect(listener).toHaveBeenCalledWith({
+        type: 'permission_response_rejected',
+        sessionId: 'sess-1',
+        permId: 'perm-1',
+        error: 'Could not submit the permission response (400). Review the prompt and try again.',
+      }),
+    );
+    expect(listener).not.toHaveBeenCalledWith(expect.objectContaining({ type: 'error' }));
+  });
+
   it.each([
     ['switch_session', 'selected'],
     ['switch_session', null],
diff --git a/packages/client/src/sse-connection.ts b/packages/client/src/sse-connection.ts
index 40017f06c..4347289be 100644
--- a/packages/client/src/sse-connection.ts
+++ b/packages/client/src/sse-connection.ts
@@ -485,14 +485,32 @@ export class SseConnection implements ChatConnection {
         headers: { 'Content-Type': 'application/json', 'X-Connection-ID': this._connectionId },
         body: JSON.stringify(body),
       });
-      if (!res.ok)
+      if (!res.ok) {
+        if (endpoint === 'permission' && typeof body.permId === 'string') {
+          this.listener?.({
+            type: 'permission_response_rejected',
+            ...scope,
+            permId: body.permId,
+            error: `Could not submit the permission response (${res.status}). Review the prompt and try again.`,
+          });
+          return;
+        }
         this.listener?.({
           type: 'error',
           ...scope,
           error: `Could not ${endpoint} (${res.status}). Please retry.`,
         });
+      }
     } catch {
-      this.listener?.({ type: 'error', ...scope, error: `Could not ${endpoint}. Please retry.` });
+      if (endpoint === 'permission' && typeof body.permId === 'string')
+        this.listener?.({
+          type: 'permission_response_rejected',
+          ...scope,
+          permId: body.permId,
+          error: 'Could not submit the permission response. Review the prompt and try again.',
+        });
+      else
+        this.listener?.({ type: 'error', ...scope, error: `Could not ${endpoint}. Please retry.` });
     }
   }
 
diff --git a/packages/harness/__tests__/user-questions.test.ts b/packages/harness/__tests__/user-questions.test.ts
index 5752f5fbe..1a2243a21 100644
--- a/packages/harness/__tests__/user-questions.test.ts
+++ b/packages/harness/__tests__/user-questions.test.ts
@@ -168,11 +168,12 @@ it('rejects approval input that cannot be serialized for review', async () => {
   applyTierOverrides({ CustomWrite: 'unknown' });
   try {
     const { handler, sent, abort } = setup();
-    const result = handler(
-      'CustomWrite',
-      { toJSON: () => undefined },
-      { signal: abort.signal, toolUseID: 'custom-large' },
-    );
+    const circular: Record<string, unknown> = {};
+    circular.self = circular;
+    const result = handler('CustomWrite', circular, {
+      signal: abort.signal,
+      toolUseID: 'custom-large',
+    });
     await expect(result).resolves.toMatchObject({
       behavior: 'deny',
       message: expect.stringContaining('too large to review safely'),
diff --git a/packages/harness/src/permission-handler.ts b/packages/harness/src/permission-handler.ts
index 01aaae3cf..49325017d 100644
--- a/packages/harness/src/permission-handler.ts
+++ b/packages/harness/src/permission-handler.ts
@@ -42,10 +42,15 @@ function permissionDisplayInput(
   toolName: string,
   input: Record<string, unknown>,
 ): string | undefined {
-  const full =
-    toolName === 'Bash' && typeof input.command === 'string'
-      ? input.command
-      : JSON.stringify(input, null, 2);
+  let full: string | undefined;
+  try {
+    full =
+      toolName === 'Bash' && typeof input.command === 'string'
+        ? input.command
+        : JSON.stringify(input, null, 2);
+  } catch {
+    return undefined;
+  }
   if (full === undefined) return undefined;
   return full.length <= PERMISSION_INPUT_MAX_CHARS ? full : undefined;
 }
diff --git a/server/__tests__/chat-rest-handler.test.ts b/server/__tests__/chat-rest-handler.test.ts
index ef20d8f28..c1e73dc8c 100644
--- a/server/__tests__/chat-rest-handler.test.ts
+++ b/server/__tests__/chat-rest-handler.test.ts
@@ -302,6 +302,28 @@ describe('chat-rest-handler', () => {
     expect(handlePermissionResponseV2).toHaveBeenCalledOnce();
   });
 
+  it('POST /permission returns a retryable rejection for schema-invalid answers', async () => {
+    const res = await request(testApp)
+      .post('/api/chat/permission')
+      .set('X-Connection-ID', CONNECTION_ID)
+      .send({
+        type: 'permission_response',
+        sessionId: 'sess-1',
+        permId: 'perm-1',
+        decision: 'once',
+        answers: { question: ['   '] },
+      });
+
+    expect(res.status).toBe(400);
+    expect(res.body).toEqual({
+      ok: false,
+      type: 'permission_response_rejected',
+      permId: 'perm-1',
+      error: 'Permission response was invalid or expired. Review the prompt and try again.',
+    });
+    expect(handlePermissionResponseV2).not.toHaveBeenCalled();
+  });
+
   // ─── POST /api/chat/mode ───────────────────────────────────────────────
 
   it('POST /mode calls handleSetModeV2', async () => {
diff --git a/server/chat-rest-handler.ts b/server/chat-rest-handler.ts
index a9f952077..957fec3c9 100644
--- a/server/chat-rest-handler.ts
+++ b/server/chat-rest-handler.ts
@@ -231,8 +231,17 @@ export function createChatRestRouter(
     const connectionId = getConnectionId(req, res);
     if (!connectionId) return;
     if (!requireConnection(connectionId, ctx.connRegistry, res)) return;
-    const msg = validateBody(V2PermissionResponseMessage, req.body, res);
-    if (!msg) return;
+    const parsed = V2PermissionResponseMessage.safeParse(req.body);
+    if (!parsed.success) {
+      res.status(400).json({
+        ok: false,
+        type: 'permission_response_rejected',
+        permId: typeof req.body?.permId === 'string' ? req.body.permId : '',
+        error: 'Permission response was invalid or expired. Review the prompt and try again.',
+      });
+      return;
+    }
+    const msg = parsed.data;
     try {
       handlePermissionResponseV2(connectionId, msg, ctx);
       res.json({ ok: true });

From 26d289a66a21333d894bbba2a2abe8d8e71145cf Mon Sep 17 00:00:00 2001
From: dimakis <dimitri.saridakis@gmail.com>
Date: Tue, 15 Sep 2026 10:13:23 +0100
Subject: [PATCH 6/6] fix(approvals): propagate expired REST responses

---
 server/__tests__/chat-rest-handler.test.ts | 23 +++++++++++++++++++++-
 server/__tests__/ws-handler-v2.test.ts     |  3 ++-
 server/chat-rest-handler.ts                | 10 +++++++++-
 server/ws-handler-v2.ts                    |  5 +++--
 4 files changed, 36 insertions(+), 5 deletions(-)

diff --git a/server/__tests__/chat-rest-handler.test.ts b/server/__tests__/chat-rest-handler.test.ts
index c1e73dc8c..f73c123d3 100644
--- a/server/__tests__/chat-rest-handler.test.ts
+++ b/server/__tests__/chat-rest-handler.test.ts
@@ -17,7 +17,7 @@ vi.mock('../ws-handler-v2.js', async (importOriginal) => {
     handleSendV2: vi.fn(),
     handleStopV2: vi.fn(),
     handleInterruptV2: vi.fn(),
-    handlePermissionResponseV2: vi.fn(),
+    handlePermissionResponseV2: vi.fn().mockReturnValue(true),
     handleSetModeV2: vi
       .fn()
       .mockResolvedValue({ ok: true, applied: true, persisted: true, mode: 'agent' }),
@@ -324,6 +324,27 @@ describe('chat-rest-handler', () => {
     expect(handlePermissionResponseV2).not.toHaveBeenCalled();
   });
 
+  it('POST /permission returns a retryable rejection when the request expired', async () => {
+    vi.mocked(handlePermissionResponseV2).mockReturnValueOnce(false);
+    const res = await request(testApp)
+      .post('/api/chat/permission')
+      .set('X-Connection-ID', CONNECTION_ID)
+      .send({
+        type: 'permission_response',
+        sessionId: 'sess-1',
+        permId: 'expired-perm',
+        decision: 'once',
+      });
+
+    expect(res.status).toBe(409);
+    expect(res.body).toEqual({
+      ok: false,
+      type: 'permission_response_rejected',
+      permId: 'expired-perm',
+      error: 'Permission response was invalid or expired. Review the prompt and try again.',
+    });
+  });
+
   // ─── POST /api/chat/mode ───────────────────────────────────────────────
 
   it('POST /mode calls handleSetModeV2', async () => {
diff --git a/server/__tests__/ws-handler-v2.test.ts b/server/__tests__/ws-handler-v2.test.ts
index 2fc7b6cb8..433278eba 100644
--- a/server/__tests__/ws-handler-v2.test.ts
+++ b/server/__tests__/ws-handler-v2.test.ts
@@ -1542,7 +1542,7 @@ describe('handlePermissionResponseV2', () => {
     const transport = mockTransport();
     ctx.connRegistry.register('c1', transport);
 
-    handlePermissionResponseV2(
+    const resolved = handlePermissionResponseV2(
       'c1',
       { type: 'permission_response', sessionId: 'sess-1', permId: 'p1', decision: 'once' },
       ctx,
@@ -1554,6 +1554,7 @@ describe('handlePermissionResponseV2', () => {
       permId: 'p1',
       error: 'Permission response was invalid or expired. Review the prompt and try again.',
     });
+    expect(resolved).toBe(false);
   });
 });
 
diff --git a/server/chat-rest-handler.ts b/server/chat-rest-handler.ts
index 957fec3c9..5582e330e 100644
--- a/server/chat-rest-handler.ts
+++ b/server/chat-rest-handler.ts
@@ -243,7 +243,15 @@ export function createChatRestRouter(
     }
     const msg = parsed.data;
     try {
-      handlePermissionResponseV2(connectionId, msg, ctx);
+      if (!handlePermissionResponseV2(connectionId, msg, ctx)) {
+        res.status(409).json({
+          ok: false,
+          type: 'permission_response_rejected',
+          permId: msg.permId,
+          error: 'Permission response was invalid or expired. Review the prompt and try again.',
+        });
+        return;
+      }
       res.json({ ok: true });
     } catch (err) {
       log.error('POST /chat/permission failed', { connectionId, error: String(err) });
diff --git a/server/ws-handler-v2.ts b/server/ws-handler-v2.ts
index 7ac450072..745175cce 100644
--- a/server/ws-handler-v2.ts
+++ b/server/ws-handler-v2.ts
@@ -941,8 +941,8 @@ export function handlePermissionResponseV2(
   connectionId: string,
   msg: PermissionMsg,
   ctx: V2HandlerContext,
-): void {
-  withSpan(
+): boolean {
+  return withSpan(
     'ws.permission_response',
     {
       'ws.connectionId': connectionId,
@@ -969,6 +969,7 @@ export function handlePermissionResponseV2(
         sessionId: msg.sessionId,
         permId: msg.permId,
       });
+      return resolved;
     },
   );
 }