@@ -100,6 +100,15 @@ export class ConnectionRefreshError extends Data.TaggedError(
 )<{
   readonly connectionId: ConnectionId;
   readonly message: string;
+  /**
+   * Set by providers when the refresh failed in a way that the stored
+   * refresh token cannot recover from (RFC 6749 §5.2 `invalid_grant`
+   * — the AS has revoked the grant, the user changed their password,
+   * the refresh token rotated out from under us, ...). The SDK
+   * translates this into a `ConnectionReauthRequiredError` so callers
+   * can prompt the user to sign in again instead of silently retrying.
+   */
+  readonly reauthRequired?: boolean;
   readonly cause?: unknown;
 }> {}
 
 
@@ -111,6 +111,24 @@ export class ConnectionRefreshNotSupportedError extends Schema.TaggedError<Conne
   },
 ) {}
 
+/**
+ * Raised by `connections.accessToken(id)` when the provider's refresh
+ * handler reported that the stored refresh token is permanently
+ * invalid (RFC 6749 §5.2 `invalid_grant` and friends). The caller —
+ * typically a tool invocation — surfaces this so the UI can prompt the
+ * user to sign in again. Distinct from `ConnectionRefreshError` so
+ * "the network flaked, retry later" and "the grant is dead, re-auth"
+ * don't collapse into one error tag at the plugin boundary.
+ */
+export class ConnectionReauthRequiredError extends Schema.TaggedError<ConnectionReauthRequiredError>()(
+  "ConnectionReauthRequiredError",
+  {
+    connectionId: ConnectionId,
+    provider: Schema.String,
+    message: Schema.String,
+  },
+) {}
+
 // ---------------------------------------------------------------------------
 // Union type for convenience in signatures.
 // ---------------------------------------------------------------------------
@@ -127,4 +145,5 @@ export type ExecutorError =
   | SecretOwnedByConnectionError
   | ConnectionNotFoundError
   | ConnectionProviderNotRegisteredError
-  | ConnectionRefreshNotSupportedError;
+  | ConnectionRefreshNotSupportedError
+  | ConnectionReauthRequiredError;
@@ -1,4 +1,4 @@
-import { Effect, FiberRef, Option, Schema } from "effect";
+import { Deferred, Effect, FiberRef, Option, Schema } from "effect";
 import {
   StorageError,
   typedAdapter,
@@ -41,6 +41,7 @@ import {
 import {
   ConnectionNotFoundError,
   ConnectionProviderNotRegisteredError,
+  ConnectionReauthRequiredError,
   ConnectionRefreshNotSupportedError,
   NoHandlerError,
   PluginNotLoadedError,
@@ -219,6 +220,7 @@ export type Executor<TPlugins extends readonly AnyPlugin[] = []> = {
       | ConnectionNotFoundError
       | ConnectionProviderNotRegisteredError
       | ConnectionRefreshNotSupportedError
+      | ConnectionReauthRequiredError
       | ConnectionRefreshError
       | StorageFailure
     >;
@@ -603,6 +605,25 @@ export const createExecutor = <
     // Connection providers keyed by `provider.key` — drive the refresh
     // lifecycle for connection-owned tokens.
     const connectionProviders = new Map<string, ConnectionProvider>();
+    // In-flight refresh dedup. `connectionsAccessToken` stamps a
+    // `Deferred` here before calling the provider's `refresh`; parallel
+    // callers that walk in while a refresh is still running observe
+    // the same Deferred and await its resolution instead of hitting
+    // the AS a second time. The map is mutated under a semaphore so
+    // check-or-register is atomic under fiber interleavings.
+    const refreshInFlight = new Map<
+      string,
+      Deferred.Deferred<
+        string,
+        | ConnectionNotFoundError
+        | ConnectionProviderNotRegisteredError
+        | ConnectionRefreshNotSupportedError
+        | ConnectionReauthRequiredError
+        | ConnectionRefreshError
+        | StorageFailure
+      >
+    >();
+    const refreshInFlightLock = Effect.unsafeMakeSemaphore(1);
     const extensions: Record<string, object> = {};
 
     // ------------------------------------------------------------------
@@ -1389,46 +1410,26 @@ export const createExecutor = <
         );
       });
 
-    // accessToken(id) — the single surface plugins use at invoke time.
-    // Resolves the backing secret, checks expiry, calls the provider's
-    // refresh handler if we're inside the skew window. New tokens are
-    // written back through the same provider and the connection row is
-    // patched with the new expiry.
-    const connectionsAccessToken = (
-      id: string,
-    ): Effect.Effect<
-      string,
+    // Typed error union that `connectionsAccessToken` and every helper
+    // that participates in a refresh returns. Pulled out into a type
+    // alias because it has to match the Deferred's channel exactly —
+    // otherwise concurrent waiters and the leader diverge on the error
+    // type.
+    type AccessTokenError =
       | ConnectionNotFoundError
       | ConnectionProviderNotRegisteredError
       | ConnectionRefreshNotSupportedError
+      | ConnectionReauthRequiredError
       | ConnectionRefreshError
-      | StorageFailure
-    > =>
+      | StorageFailure;
+
+    // The actual work of a single refresh cycle, factored out so the
+    // concurrency gate (`connectionsAccessToken`) stays readable. Runs
+    // for the fiber that wins the `refreshInFlight` race.
+    const performRefresh = (
+      ref: ConnectionRef,
+    ): Effect.Effect<string, AccessTokenError> =>
       Effect.gen(function* () {
-        const row = yield* findInnermostConnectionRow(id);
-        if (!row) {
-          return yield* Effect.fail(
-            new ConnectionNotFoundError({
-              connectionId: ConnectionId.make(id),
-            }),
-          );
-        }
-        const ref = rowToConnection(row);
-        const now = Date.now();
-        const needsRefresh =
-          ref.expiresAt !== null &&
-          ref.expiresAt - CONNECTION_REFRESH_SKEW_MS <= now;
-
-        if (!needsRefresh) {
-          const current = yield* secretsGet(
-            ref.accessTokenSecretId as unknown as string,
-          );
-          if (current !== null) return current;
-          // Fall through to refresh if the stored token vanished — a
-          // genuinely-missing secret with no way to refresh is a
-          // hard-failure, same behavior as if `expires_at` had passed.
-        }
-
         const provider = connectionProviders.get(ref.provider);
         if (!provider) {
           return yield* Effect.fail(
@@ -1451,15 +1452,36 @@ export const createExecutor = <
           ? yield* secretsGet(ref.refreshTokenSecretId as unknown as string)
           : null;
 
-        const result = yield* provider.refresh({
-          connectionId: ref.id,
-          scopeId: ref.scopeId,
-          kind: ref.kind,
-          identityLabel: ref.identityLabel,
-          refreshToken: refreshTokenValue,
-          providerState: ref.providerState,
-          oauthScope: ref.oauthScope,
-        });
+        // RFC 6749 §5.2 `invalid_grant` (and anything else the
+        // provider tags with `reauthRequired`) is terminal — the
+        // stored refresh token can't recover. Translate into the
+        // caller-visible "re-authenticate" error so the UI can
+        // prompt sign-in instead of silently retrying.
+        const rawResult = yield* Effect.either(
+          provider.refresh({
+            connectionId: ref.id,
+            scopeId: ref.scopeId,
+            kind: ref.kind,
+            identityLabel: ref.identityLabel,
+            refreshToken: refreshTokenValue,
+            providerState: ref.providerState,
+            oauthScope: ref.oauthScope,
+          }),
+        );
+        if (rawResult._tag === "Left") {
+          const err = rawResult.left;
+          if (err.reauthRequired) {
+            return yield* Effect.fail(
+              new ConnectionReauthRequiredError({
+                connectionId: err.connectionId,
+                provider: ref.provider,
+                message: err.message,
+              }),
+            );
+          }
+          return yield* Effect.fail(err);
+        }
+        const result = rawResult.right;
 
         yield* connectionsUpdateTokens({
           id: ref.id,
@@ -1473,6 +1495,87 @@ export const createExecutor = <
         return result.accessToken;
       });
 
+    // accessToken(id) — the single surface plugins use at invoke time.
+    // Resolves the backing secret, checks expiry, calls the provider's
+    // refresh handler if we're inside the skew window. New tokens are
+    // written back through the same provider and the connection row is
+    // patched with the new expiry.
+    //
+    // Concurrent invokes on an expired token all share one refresh.
+    // The fiber that wins the `refreshInFlightLock` race registers a
+    // Deferred and performs the refresh; every other concurrent caller
+    // observes the Deferred and awaits its completion. The Deferred is
+    // pulled out of the map before the refresh result resolves so
+    // later invokes don't reuse a completed slot.
+    const connectionsAccessToken = (
+      id: string,
+    ): Effect.Effect<string, AccessTokenError> =>
+      Effect.gen(function* () {
+        const row = yield* findInnermostConnectionRow(id);
+        if (!row) {
+          return yield* Effect.fail(
+            new ConnectionNotFoundError({
+              connectionId: ConnectionId.make(id),
+            }),
+          );
+        }
+        const ref = rowToConnection(row);
+        const now = Date.now();
+        const needsRefresh =
+          ref.expiresAt !== null &&
+          ref.expiresAt - CONNECTION_REFRESH_SKEW_MS <= now;
+
+        if (!needsRefresh) {
+          const current = yield* secretsGet(
+            ref.accessTokenSecretId as unknown as string,
+          );
+          if (current !== null) return current;
+          // Fall through to refresh if the stored token vanished — a
+          // genuinely-missing secret with no way to refresh is a
+          // hard-failure, same behavior as if `expires_at` had passed.
+        }
+
+        // Concurrency gate. `action` either returns the fresh access
+        // token (this fiber did the refresh) or the already-running
+        // Deferred that another fiber stamped into the map (this fiber
+        // piggybacks on their refresh).
+        const action = yield* refreshInFlightLock.withPermits(1)(
+          Effect.gen(function* () {
+            const existing = refreshInFlight.get(id);
+            if (existing) {
+              return {
+                kind: "await" as const,
+                deferred: existing,
+              };
+            }
+            const deferred = yield* Deferred.make<string, AccessTokenError>();
+            refreshInFlight.set(id, deferred);
+            return { kind: "lead" as const, deferred };
+          }),
+        );
+
+        if (action.kind === "await") {
+          return yield* action.deferred;
+        }
+
+        // Leader path: run the refresh, pipe the outcome into the
+        // Deferred (so waiters wake up), and then clear the map slot
+        // regardless of success or failure. Keeping clear+complete in
+        // the same `onExit` avoids a window where a late waiter sees
+        // the Deferred after it's been completed but before it's been
+        // evicted.
+        return yield* performRefresh(ref).pipe(
+          Effect.onExit((exit) =>
+            refreshInFlightLock.withPermits(1)(
+              Effect.gen(function* () {
+                refreshInFlight.delete(id);
+                yield* Deferred.done(action.deferred, exit);
+              }),
+            ),
+          ),
+        );
+      });
+
     const connectionsListForCtx = () => connectionsList();
 
     // ------------------------------------------------------------------
 
@@ -42,6 +42,7 @@ export {
   ConnectionNotFoundError,
   ConnectionProviderNotRegisteredError,
   ConnectionRefreshNotSupportedError,
+  ConnectionReauthRequiredError,
   type ExecutorError,
 } from "./errors";
 
 
@@ -30,6 +30,7 @@ import type {
 import type {
   ConnectionNotFoundError,
   ConnectionProviderNotRegisteredError,
+  ConnectionReauthRequiredError,
   ConnectionRefreshNotSupportedError,
   SecretOwnedByConnectionError,
 } from "./errors";
@@ -193,6 +194,7 @@ export interface PluginCtx<TStore = unknown> {
       | ConnectionNotFoundError
       | ConnectionProviderNotRegisteredError
       | ConnectionRefreshNotSupportedError
+      | ConnectionReauthRequiredError
       | ConnectionRefreshError
       | StorageFailure
     >;
 
@@ -22,6 +22,13 @@ import { Data, Effect, ParseResult, Schema } from "effect";
 
 export class OAuth2Error extends Data.TaggedError("OAuth2Error")<{
   readonly message: string;
+  /**
+   * RFC 6749 §5.2 error code, when the token endpoint returned one
+   * (`invalid_grant`, `invalid_client`, `unauthorized_client`, ...).
+   * Callers use this to distinguish terminal failures (a refresh token
+   * the AS no longer honours → re-auth required) from transient ones.
+   */
+  readonly error?: string;
   readonly cause?: unknown;
 }> {}
 
@@ -104,8 +111,11 @@ export const buildAuthorizationUrl = (input: BuildAuthorizationUrlInput): string
 // Token endpoint response parsing
 // ---------------------------------------------------------------------------
 
-const oauth2Error = (message: string, cause?: unknown): OAuth2Error =>
-  new OAuth2Error({ message, cause });
+const oauth2Error = (
+  message: string,
+  cause?: unknown,
+  error?: string,
+): OAuth2Error => new OAuth2Error({ message, cause, error });
 
 // ---------------------------------------------------------------------------
 // Schemas
@@ -213,7 +223,13 @@ export const decodeTokenResponse = (
       );
       const description =
         envelope.error_description ?? envelope.error ?? `status ${response.status}`;
-      return yield* Effect.fail(oauth2Error(`OAuth token exchange failed: ${description}`));
+      return yield* Effect.fail(
+        oauth2Error(
+          `OAuth token exchange failed: ${description}`,
+          undefined,
+          envelope.error,
+        ),
+      );
     }
 
     return yield* decodeSuccessBody(record).pipe(