diff --git a/Cargo.toml b/Cargo.toml
index 0e285efc..61762bc6 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -13,7 +13,7 @@ thiserror = "2.0.12"
 tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter"] }
 openssl-sys = { version = "0.9", features = ["vendored"] }
-ts-rs = { git = "https://github.com/xazukx/ts-rs.git", branch = "use-ts-enum", features = ["uuid-impl", "chrono-impl", "no-serde-warnings"] }
+ts-rs = { git = "https://github.com/xazukx/ts-rs.git", branch = "use-ts-enum", features = ["uuid-impl", "chrono-impl", "no-serde-warnings", "serde-json-impl"] }
 schemars = { version = "1.0.4", features = ["derive", "chrono04", "uuid1", "preserve_order"] }
 
 [profile.release]
diff --git a/crates/db/.sqlx/query-87b21a85d12a8d5494464574a460b1b78024a9bb43d6246f161a073629e463ff.json b/crates/db/.sqlx/query-87b21a85d12a8d5494464574a460b1b78024a9bb43d6246f161a073629e463ff.json
new file mode 100644
index 00000000..30c16032
--- /dev/null
+++ b/crates/db/.sqlx/query-87b21a85d12a8d5494464574a460b1b78024a9bb43d6246f161a073629e463ff.json
@@ -0,0 +1,62 @@
+{
+  "db_name": "SQLite",
+  "query": "SELECT\n                id as \"id!: Uuid\",\n                task_attempt_id as \"task_attempt_id!: Uuid\",\n                execution_process_id as \"execution_process_id!: Uuid\",\n                session_id,\n                prompt,\n                summary,\n                created_at as \"created_at!: DateTime<Utc>\",\n                updated_at as \"updated_at!: DateTime<Utc>\"\n               FROM executor_sessions\n               WHERE session_id = ?",
+  "describe": {
+    "columns": [
+      {
+        "name": "id!: Uuid",
+        "ordinal": 0,
+        "type_info": "Blob"
+      },
+      {
+        "name": "task_attempt_id!: Uuid",
+        "ordinal": 1,
+        "type_info": "Blob"
+      },
+      {
+        "name": "execution_process_id!: Uuid",
+        "ordinal": 2,
+        "type_info": "Blob"
+      },
+      {
+        "name": "session_id",
+        "ordinal": 3,
+        "type_info": "Text"
+      },
+      {
+        "name": "prompt",
+        "ordinal": 4,
+        "type_info": "Text"
+      },
+      {
+        "name": "summary",
+        "ordinal": 5,
+        "type_info": "Text"
+      },
+      {
+        "name": "created_at!: DateTime<Utc>",
+        "ordinal": 6,
+        "type_info": "Text"
+      },
+      {
+        "name": "updated_at!: DateTime<Utc>",
+        "ordinal": 7,
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Right": 1
+    },
+    "nullable": [
+      true,
+      false,
+      false,
+      true,
+      true,
+      true,
+      false,
+      false
+    ]
+  },
+  "hash": "87b21a85d12a8d5494464574a460b1b78024a9bb43d6246f161a073629e463ff"
+}
diff --git a/crates/db/src/models/executor_session.rs b/crates/db/src/models/executor_session.rs
index 4dcefc17..0dc75fad 100644
--- a/crates/db/src/models/executor_session.rs
+++ b/crates/db/src/models/executor_session.rs
@@ -104,6 +104,29 @@ impl ExecutorSession {
         .await
     }
 
+    pub async fn find_by_session_id(
+        pool: &SqlitePool,
+        session_id: &str,
+    ) -> Result<Option<Self>, sqlx::Error> {
+        sqlx::query_as!(
+            ExecutorSession,
+            r#"SELECT
+                id as "id!: Uuid",
+                task_attempt_id as "task_attempt_id!: Uuid",
+                execution_process_id as "execution_process_id!: Uuid",
+                session_id,
+                prompt,
+                summary,
+                created_at as "created_at!: DateTime<Utc>",
+                updated_at as "updated_at!: DateTime<Utc>"
+               FROM executor_sessions
+               WHERE session_id = ?"#,
+            session_id
+        )
+        .fetch_optional(pool)
+        .await
+    }
+
     /// Create a new executor session
     pub async fn create(
         pool: &SqlitePool,
diff --git a/crates/deployment/src/lib.rs b/crates/deployment/src/lib.rs
index bfe4c8f7..17c3c8a7 100644
--- a/crates/deployment/src/lib.rs
+++ b/crates/deployment/src/lib.rs
@@ -18,6 +18,7 @@ use git2::Error as Git2Error;
 use serde_json::Value;
 use services::services::{
     analytics::AnalyticsService,
+    approvals::Approvals,
     auth::{AuthError, AuthService},
     config::{Config, ConfigError},
     container::{ContainerError, ContainerService},
@@ -102,6 +103,8 @@ pub trait Deployment: Clone + Send + Sync + 'static {
 
     fn file_search_cache(&self) -> &Arc<FileSearchCache>;
 
+    fn approvals(&self) -> &Approvals;
+
     async fn update_sentry_scope(&self) -> Result<(), DeploymentError> {
         let user_id = self.user_id();
         let config = self.config().read().await;
diff --git a/crates/executors/Cargo.toml b/crates/executors/Cargo.toml
index 06c4bbf0..39d90139 100644
--- a/crates/executors/Cargo.toml
+++ b/crates/executors/Cargo.toml
@@ -4,7 +4,7 @@ version = "0.0.94"
 edition = "2024"
 
 [dependencies]
-utils = { path = "../utils" }
+workspace_utils = { path = "../utils", package = "utils" }
 tokio = { workspace = true }
 tokio-util = { version = "0.7", features = ["io"] }
 bytes = "1.0"
@@ -15,7 +15,7 @@ toml = "0.8"
 tracing-subscriber = { workspace = true }
 chrono = { version = "0.4", features = ["serde"] }
 uuid = { version = "1.0", features = ["v4", "serde"] }
-ts-rs = { workspace = true, features = ["serde-json-impl"]}
+ts-rs = { workspace = true }
 schemars = { workspace = true }
 dirs = "5.0"
 xdg = "3.0"
@@ -41,3 +41,4 @@ strum_macros = "0.27.2"
 convert_case = "0.6"
 sqlx = "0.8.6"
 axum = { workspace = true }
+shlex = "1.3.0"
diff --git a/crates/executors/default_profiles.json b/crates/executors/default_profiles.json
index cbab04af..9d9bbd2d 100644
--- a/crates/executors/default_profiles.json
+++ b/crates/executors/default_profiles.json
@@ -10,6 +10,11 @@
         "CLAUDE_CODE": {
           "plan": true
         }
+      },
+      "APPROVALS": {
+        "CLAUDE_CODE": {
+          "approvals": true
+        }
       }
     },
     "AMP": {
diff --git a/crates/executors/src/actions/script.rs b/crates/executors/src/actions/script.rs
index fe64738d..16271c36 100644
--- a/crates/executors/src/actions/script.rs
+++ b/crates/executors/src/actions/script.rs
@@ -5,7 +5,7 @@ use command_group::{AsyncCommandGroup, AsyncGroupChild};
 use serde::{Deserialize, Serialize};
 use tokio::process::Command;
 use ts_rs::TS;
-use utils::shell::get_shell_command;
+use workspace_utils::shell::get_shell_command;
 
 use crate::{actions::Executable, executors::ExecutorError};
 
diff --git a/crates/executors/src/executors/amp.rs b/crates/executors/src/executors/amp.rs
index 8332bbcb..9c256ee0 100644
--- a/crates/executors/src/executors/amp.rs
+++ b/crates/executors/src/executors/amp.rs
@@ -6,7 +6,7 @@ use schemars::JsonSchema;
 use serde::{Deserialize, Serialize};
 use tokio::{io::AsyncWriteExt, process::Command};
 use ts_rs::TS;
-use utils::{msg_store::MsgStore, shell::get_shell_command};
+use workspace_utils::{msg_store::MsgStore, shell::get_shell_command};
 
 use crate::{
     command::{CmdOverrides, CommandBuilder, apply_overrides},
diff --git a/crates/executors/src/executors/claude.rs b/crates/executors/src/executors/claude.rs
index edd049fc..0aa4f723 100644
--- a/crates/executors/src/executors/claude.rs
+++ b/crates/executors/src/executors/claude.rs
@@ -1,17 +1,19 @@
-use std::{path::Path, process::Stdio, sync::Arc};
+use std::{os::unix::fs::PermissionsExt, path::Path, process::Stdio, sync::Arc};
 
 use async_trait::async_trait;
 use command_group::{AsyncCommandGroup, AsyncGroupChild};
 use futures::StreamExt;
 use schemars::JsonSchema;
 use serde::{Deserialize, Serialize};
-use tokio::{io::AsyncWriteExt, process::Command};
+use tokio::{io::AsyncWriteExt, process::Command, sync::OnceCell};
 use ts_rs::TS;
-use utils::{
+use workspace_utils::{
+    approvals::APPROVAL_TIMEOUT_SECONDS,
     diff::{concatenate_diff_hunks, create_unified_diff, create_unified_diff_hunk},
     log_msg::LogMsg,
     msg_store::MsgStore,
     path::make_path_relative,
+    port_file::read_port_file,
     shell::get_shell_command,
 };
 
@@ -19,12 +21,22 @@ use crate::{
     command::{CmdOverrides, CommandBuilder, apply_overrides},
     executors::{AppendPrompt, ExecutorError, StandardCodingAgentExecutor},
     logs::{
-        ActionType, FileChange, NormalizedEntry, NormalizedEntryType, TodoItem,
+        ActionType, FileChange, NormalizedEntry, NormalizedEntryType, TodoItem, ToolStatus,
         stderr_processor::normalize_stderr_logs,
         utils::{EntryIndexProvider, patch::ConversationPatch},
     },
 };
 
+static BACKEND_PORT: OnceCell<u16> = OnceCell::const_new();
+async fn get_backend_port() -> std::io::Result<u16> {
+    BACKEND_PORT
+        .get_or_try_init(|| async { read_port_file("vibe-kanban").await })
+        .await
+        .copied()
+}
+
+const CONFIRM_HOOK_SCRIPT: &str = include_str!("./hooks/confirm.py");
+
 fn base_command(claude_code_router: bool) -> &'static str {
     if claude_code_router {
         "npx -y @musistudio/claude-code-router code"
@@ -42,6 +54,8 @@ pub struct ClaudeCode {
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub plan: Option<bool>,
     #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub approvals: Option<bool>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
     pub model: Option<String>,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub dangerously_skip_permissions: Option<bool>,
@@ -50,7 +64,7 @@ pub struct ClaudeCode {
 }
 
 impl ClaudeCode {
-    fn build_command_builder(&self) -> CommandBuilder {
+    async fn build_command_builder(&self) -> CommandBuilder {
         // If base_command_override is provided and claude_code_router is also set, log a warning
         if self.cmd.base_command_override.is_some() && self.claude_code_router.is_some() {
             tracing::warn!(
@@ -62,9 +76,35 @@ impl ClaudeCode {
             CommandBuilder::new(base_command(self.claude_code_router.unwrap_or(false)))
                 .params(["-p"]);
 
-        if self.plan.unwrap_or(false) {
+        let plan = self.plan.unwrap_or(false);
+        let approvals = self.approvals.unwrap_or(false);
+        if plan && approvals {
+            tracing::warn!("Both plan and approvals are enabled. Plan will take precedence.");
+        }
+
+        if plan {
             builder = builder.extend_params(["--permission-mode=plan"]);
         }
+
+        if plan || approvals {
+            match settings_json(plan).await {
+                // TODO: Avoid quoting
+                Ok(settings) => match shlex::try_quote(&settings) {
+                    Ok(quoted) => {
+                        builder = builder.extend_params(["--settings", &quoted]);
+                    }
+                    Err(e) => {
+                        tracing::error!("Failed to quote approvals JSON for --settings: {e}");
+                    }
+                },
+                Err(e) => {
+                    tracing::error!(
+                        "Failed to generate approvals JSON. Not running approvals: {e}"
+                    );
+                }
+            }
+        }
+
         if self.dangerously_skip_permissions.unwrap_or(false) {
             builder = builder.extend_params(["--dangerously-skip-permissions"]);
         }
@@ -85,13 +125,16 @@ impl StandardCodingAgentExecutor for ClaudeCode {
         prompt: &str,
     ) -> Result<AsyncGroupChild, ExecutorError> {
         let (shell_cmd, shell_arg) = get_shell_command();
-        let command_builder = self.build_command_builder();
-        let base_command = command_builder.build_initial();
-        let claude_command = if self.plan.unwrap_or(false) {
-            create_watchkill_script(&base_command)
-        } else {
-            base_command
-        };
+        let command_builder = self.build_command_builder().await;
+        let mut base_command = command_builder.build_initial();
+
+        if self.plan.unwrap_or(false) {
+            base_command = create_watchkill_script(&base_command);
+        }
+
+        if self.approvals.unwrap_or(false) || self.plan.unwrap_or(false) {
+            write_python_hook(current_dir).await?
+        }
 
         let combined_prompt = self.append_prompt.combine_prompt(prompt);
 
@@ -103,7 +146,7 @@ impl StandardCodingAgentExecutor for ClaudeCode {
             .stderr(Stdio::piped())
             .current_dir(current_dir)
             .arg(shell_arg)
-            .arg(&claude_command);
+            .arg(&base_command);
 
         let mut child = command.group_spawn()?;
 
@@ -123,15 +166,18 @@ impl StandardCodingAgentExecutor for ClaudeCode {
         session_id: &str,
     ) -> Result<AsyncGroupChild, ExecutorError> {
         let (shell_cmd, shell_arg) = get_shell_command();
-        let command_builder = self.build_command_builder();
+        let command_builder = self.build_command_builder().await;
         // Build follow-up command with --resume {session_id}
-        let base_command =
+        let mut base_command =
             command_builder.build_follow_up(&["--resume".to_string(), session_id.to_string()]);
-        let claude_command = if self.plan.unwrap_or(false) {
-            create_watchkill_script(&base_command)
-        } else {
-            base_command
-        };
+
+        if self.plan.unwrap_or(false) {
+            base_command = create_watchkill_script(&base_command);
+        }
+
+        if self.approvals.unwrap_or(false) || self.plan.unwrap_or(false) {
+            write_python_hook(current_dir).await?
+        }
 
         let combined_prompt = self.append_prompt.combine_prompt(prompt);
 
@@ -143,7 +189,7 @@ impl StandardCodingAgentExecutor for ClaudeCode {
             .stderr(Stdio::piped())
             .current_dir(current_dir)
             .arg(shell_arg)
-            .arg(&claude_command);
+            .arg(&base_command);
 
         let mut child = command.group_spawn()?;
 
@@ -177,14 +223,80 @@ impl StandardCodingAgentExecutor for ClaudeCode {
     }
 }
 
+async fn write_python_hook(current_dir: &Path) -> Result<(), ExecutorError> {
+    let hooks_dir = current_dir.join(".claude").join("hooks");
+    tokio::fs::create_dir_all(&hooks_dir).await?;
+    let hook_path = hooks_dir.join("confirm.py");
+
+    if tokio::fs::try_exists(&hook_path).await? {
+        return Ok(());
+    }
+
+    let mut file = tokio::fs::File::create(&hook_path).await?;
+    file.write_all(CONFIRM_HOOK_SCRIPT.as_bytes()).await?;
+    file.flush().await?;
+
+    // TODO: Handle Windows permissioning
+    #[cfg(unix)]
+    {
+        let perm = std::fs::Permissions::from_mode(0o755);
+        tokio::fs::set_permissions(&hook_path, perm).await?;
+    }
+
+    // ignore the confirm.py script
+    let gitignore_path = hooks_dir.join(".gitignore");
+    if !tokio::fs::try_exists(&gitignore_path).await? {
+        let mut gitignore_file = tokio::fs::File::create(&gitignore_path).await?;
+        gitignore_file
+            .write_all(b"confirm.py\n.gitignore\n")
+            .await?;
+        gitignore_file.flush().await?;
+    }
+
+    Ok(())
+}
+
+// Configure settings json
+async fn settings_json(plan: bool) -> Result<String, std::io::Error> {
+    let backend_port = get_backend_port().await?;
+    let backend_timeout = APPROVAL_TIMEOUT_SECONDS + 5; // add buffer
+
+    let matcher = if plan {
+        "^ExitPlanMode$"
+    } else {
+        "^(?!(Glob|Grep|NotebookRead|Read|Task|TodoWrite)$).*"
+    };
+
+    Ok(serde_json::json!({
+        "hooks": {
+            "PreToolUse": [
+                {
+                    "matcher": matcher,
+                    "hooks": [
+                        {
+                            "type": "command",
+                            "command": format!("$CLAUDE_PROJECT_DIR/.claude/hooks/confirm.py --timeout-seconds {backend_timeout} --poll-interval 5 --backend-port {backend_port}"),
+                            "timeout": backend_timeout + 10
+                       }
+                    ]
+                }
+            ]
+        }
+    })
+    .to_string())
+}
+
 fn create_watchkill_script(command: &str) -> String {
-    let claude_plan_stop_indicator = concat!("Exit ", "plan mode?");
+    // Hack: we concatenate so that Claude doesn't trigger the watchkill when reading this file
+    // during development, since it contains the stop phrase
+    let claude_plan_stop_indicator = concat!("Approval ", "request timed out");
+    let cmd = shlex::try_quote(command).unwrap().to_string();
+
     format!(
         r#"#!/usr/bin/env bash
 set -euo pipefail
 
 word="{claude_plan_stop_indicator}"
-command="{command}"
 
 exit_code=0
 while IFS= read -r line; do
@@ -192,7 +304,7 @@ while IFS= read -r line; do
     if [[ $line == *"$word"* ]]; then
         exit 0
     fi
-done < <($command <&0 2>&1)
+done < <(bash -lc {cmd} <&0 2>&1)
 
 exit_code=${{PIPESTATUS[0]}}
 exit "$exit_code"
@@ -325,6 +437,7 @@ impl ClaudeLogProcessor {
                                                     entry_type: NormalizedEntryType::ToolUse {
                                                         tool_name: tool_name.clone(),
                                                         action_type,
+                                                        status: ToolStatus::Created,
                                                     },
                                                     content: content_text.clone(),
                                                     metadata: Some(
@@ -457,6 +570,12 @@ impl ClaudeLogProcessor {
                                                     })
                                                 };
 
+                                                let status = if is_error.unwrap_or(false) {
+                                                    ToolStatus::Failed
+                                                } else {
+                                                    ToolStatus::Success
+                                                };
+
                                                 let entry = NormalizedEntry {
                                                     timestamp: None,
                                                     entry_type: NormalizedEntryType::ToolUse {
@@ -465,6 +584,7 @@ impl ClaudeLogProcessor {
                                                             command: info.content.clone(),
                                                             result,
                                                         },
+                                                        status,
                                                     },
                                                     content: info.content.clone(),
                                                     metadata: None,
@@ -520,6 +640,12 @@ impl ClaudeLogProcessor {
                                                         tool_name.clone()
                                                     };
 
+                                                    let status = if is_error.unwrap_or(false) {
+                                                        ToolStatus::Failed
+                                                    } else {
+                                                        ToolStatus::Success
+                                                    };
+
                                                     let entry = NormalizedEntry {
                                                         timestamp: None,
                                                         entry_type: NormalizedEntryType::ToolUse {
@@ -534,6 +660,7 @@ impl ClaudeLogProcessor {
                                                                     },
                                                                 ),
                                                             },
+                                                            status,
                                                         },
                                                         content: info.content.clone(),
                                                         metadata: None,
@@ -727,6 +854,7 @@ impl ClaudeLogProcessor {
                     entry_type: NormalizedEntryType::ToolUse {
                         tool_name: tool_name.to_string(),
                         action_type,
+                        status: ToolStatus::Created,
                     },
                     content,
                     metadata: Some(
@@ -834,6 +962,7 @@ impl ClaudeLogProcessor {
                     entry_type: NormalizedEntryType::ToolUse {
                         tool_name: name.to_string(),
                         action_type,
+                        status: ToolStatus::Created,
                     },
                     content,
                     metadata: Some(
@@ -1549,11 +1678,12 @@ mod tests {
     async fn test_streaming_patch_generation() {
         use std::sync::Arc;
 
-        use utils::msg_store::MsgStore;
+        use workspace_utils::msg_store::MsgStore;
 
         let executor = ClaudeCode {
             claude_code_router: Some(false),
             plan: None,
+            approvals: None,
             model: None,
             append_prompt: AppendPrompt::default(),
             dangerously_skip_permissions: None,
@@ -1582,7 +1712,7 @@ mod tests {
         let history = msg_store.get_history();
         let patch_count = history
             .iter()
-            .filter(|msg| matches!(msg, utils::log_msg::LogMsg::JsonPatch(_)))
+            .filter(|msg| matches!(msg, workspace_utils::log_msg::LogMsg::JsonPatch(_)))
             .count();
         assert!(
             patch_count > 0,
diff --git a/crates/executors/src/executors/codex.rs b/crates/executors/src/executors/codex.rs
index a05cd734..a5578428 100644
--- a/crates/executors/src/executors/codex.rs
+++ b/crates/executors/src/executors/codex.rs
@@ -14,7 +14,7 @@ use serde::{Deserialize, Serialize};
 use strum_macros::AsRefStr;
 use tokio::{io::AsyncWriteExt, process::Command};
 use ts_rs::TS;
-use utils::{
+use workspace_utils::{
     diff::{concatenate_diff_hunks, extract_unified_diff_hunks},
     msg_store::MsgStore,
     path::make_path_relative,
@@ -27,7 +27,7 @@ use crate::{
         AppendPrompt, ExecutorError, StandardCodingAgentExecutor, codex::session::SessionHandler,
     },
     logs::{
-        ActionType, FileChange, NormalizedEntry, NormalizedEntryType,
+        ActionType, FileChange, NormalizedEntry, NormalizedEntryType, ToolStatus,
         utils::{EntryIndexProvider, patch::ConversationPatch},
     },
 };
@@ -245,6 +245,7 @@ impl StandardCodingAgentExecutor for Codex {
                                             command: command_str.clone(),
                                             result: None,
                                         },
+                                        status: ToolStatus::Created,
                                     },
                                     content: format!("`{command_str}`"),
                                     metadata: None,
@@ -317,6 +318,24 @@ impl StandardCodingAgentExecutor for Codex {
                                             crate::logs::CommandExitStatus::ExitCode { code: *code }
                                         })
                                     };
+
+                                    let status = if let Some(s) = success {
+                                        if *s {
+                                            ToolStatus::Success
+                                        } else {
+                                            ToolStatus::Failed
+                                        }
+                                    } else if let Some(code) = exit_code {
+                                        if *code == 0 {
+                                            ToolStatus::Success
+                                        } else {
+                                            ToolStatus::Failed
+                                        }
+                                    } else {
+                                        // Default to failed status
+                                        ToolStatus::Failed
+                                    };
+
                                     let entry = NormalizedEntry {
                                         timestamp: None,
                                         entry_type: NormalizedEntryType::ToolUse {
@@ -328,6 +347,7 @@ impl StandardCodingAgentExecutor for Codex {
                                                     output,
                                                 }),
                                             },
+                                            status,
                                         },
                                         content: prev_content,
                                         metadata: None,
@@ -351,6 +371,7 @@ impl StandardCodingAgentExecutor for Codex {
                                             arguments: invocation.arguments.clone(),
                                             result: None,
                                         },
+                                        status: ToolStatus::Created,
                                     },
                                     content: content_str.clone(),
                                     metadata: None,
@@ -386,6 +407,7 @@ impl StandardCodingAgentExecutor for Codex {
                                                     value: result.clone(),
                                                 }),
                                             },
+                                            status: ToolStatus::Success,
                                         },
                                         content: prev_content,
                                         metadata: None,
@@ -710,6 +732,7 @@ impl CodexJson {
                                         path: relative_path.clone(),
                                         changes,
                                     },
+                                    status: ToolStatus::Success,
                                 },
                                 content: relative_path,
                                 metadata: None,
@@ -1109,6 +1132,7 @@ invalid json line here
         if let NormalizedEntryType::ToolUse {
             tool_name,
             action_type,
+            status: _,
         } = &entries[0].entry_type
         {
             assert_eq!(tool_name, "edit");
diff --git a/crates/executors/src/executors/codex/session.rs b/crates/executors/src/executors/codex/session.rs
index 5d48af87..9e48a241 100644
--- a/crates/executors/src/executors/codex/session.rs
+++ b/crates/executors/src/executors/codex/session.rs
@@ -2,7 +2,7 @@ use std::{path::PathBuf, sync::Arc};
 
 use futures::StreamExt;
 use regex::Regex;
-use utils::msg_store::MsgStore;
+use workspace_utils::msg_store::MsgStore;
 
 /// Handles session management for Codex
 pub struct SessionHandler;
diff --git a/crates/executors/src/executors/cursor.rs b/crates/executors/src/executors/cursor.rs
index 5874842a..7779a587 100644
--- a/crates/executors/src/executors/cursor.rs
+++ b/crates/executors/src/executors/cursor.rs
@@ -8,7 +8,7 @@ use schemars::JsonSchema;
 use serde::{Deserialize, Serialize};
 use tokio::{io::AsyncWriteExt, process::Command};
 use ts_rs::TS;
-use utils::{
+use workspace_utils::{
     diff::{
         concatenate_diff_hunks, create_unified_diff, create_unified_diff_hunk,
         extract_unified_diff_hunks,
@@ -22,7 +22,7 @@ use crate::{
     command::{CmdOverrides, CommandBuilder, apply_overrides},
     executors::{AppendPrompt, ExecutorError, StandardCodingAgentExecutor},
     logs::{
-        ActionType, FileChange, NormalizedEntry, NormalizedEntryType, TodoItem,
+        ActionType, FileChange, NormalizedEntry, NormalizedEntryType, TodoItem, ToolStatus,
         plain_text_processor::PlainTextLogProcessor,
         utils::{ConversationPatch, EntryIndexProvider},
     },
@@ -255,6 +255,7 @@ impl StandardCodingAgentExecutor for Cursor {
                                 entry_type: NormalizedEntryType::ToolUse {
                                     tool_name,
                                     action_type,
+                                    status: ToolStatus::Created,
                                 },
                                 content,
                                 metadata: None,
@@ -358,6 +359,7 @@ impl StandardCodingAgentExecutor for Cursor {
                                     }),
                                 };
                             }
+
                             let entry = NormalizedEntry {
                                 timestamp: None,
                                 entry_type: NormalizedEntryType::ToolUse {
@@ -374,6 +376,7 @@ impl StandardCodingAgentExecutor for Cursor {
                                         _ => tool_call.get_name().to_string(),
                                     },
                                     action_type: new_action,
+                                    status: ToolStatus::Success,
                                 },
                                 content: content_str,
                                 metadata: None,
@@ -1063,7 +1066,7 @@ Tests
 mod tests {
     use std::sync::Arc;
 
-    use utils::msg_store::MsgStore;
+    use workspace_utils::msg_store::MsgStore;
 
     use super::*;
 
@@ -1103,7 +1106,7 @@ mod tests {
         let history = msg_store.get_history();
         let patch_count = history
             .iter()
-            .filter(|m| matches!(m, utils::log_msg::LogMsg::JsonPatch(_)))
+            .filter(|m| matches!(m, workspace_utils::log_msg::LogMsg::JsonPatch(_)))
             .count();
         assert!(
             patch_count >= 2,
diff --git a/crates/executors/src/executors/gemini.rs b/crates/executors/src/executors/gemini.rs
index 2250e75a..f0c1a09d 100644
--- a/crates/executors/src/executors/gemini.rs
+++ b/crates/executors/src/executors/gemini.rs
@@ -15,7 +15,7 @@ use tokio::{
     process::Command,
 };
 use ts_rs::TS;
-use utils::{msg_store::MsgStore, shell::get_shell_command};
+use workspace_utils::{msg_store::MsgStore, shell::get_shell_command};
 
 use crate::{
     command::{CmdOverrides, CommandBuilder, apply_overrides},
@@ -381,7 +381,7 @@ You are continuing work on the above task. The execution history shows the previ
 
     fn get_legacy_sessions_base_dir() -> PathBuf {
         // Previous location was under the temp-based vibe-kanban dir
-        utils::path::get_vibe_kanban_temp_dir().join("gemini_sessions")
+        workspace_utils::path::get_vibe_kanban_temp_dir().join("gemini_sessions")
     }
 
     async fn get_session_file_path(current_dir: &Path) -> PathBuf {
diff --git a/crates/executors/src/executors/hooks/confirm.py b/crates/executors/src/executors/hooks/confirm.py
new file mode 100755
index 00000000..1fac2ca2
--- /dev/null
+++ b/crates/executors/src/executors/hooks/confirm.py
@@ -0,0 +1,165 @@
+#!/usr/bin/env python3
+import argparse
+import json
+import sys
+import time
+import urllib.error
+import urllib.request
+from typing import Optional
+
+
+def json_error(reason: Optional[str]) -> None:
+    """Emit a deny PreToolUse JSON to stdout and exit(0)."""
+    payload = {
+        "hookSpecificOutput": {
+            "hookEventName": "PreToolUse",
+            "permissionDecision": "deny",
+            "permissionDecisionReason": reason,
+        }
+    }
+    print(json.dumps(payload, ensure_ascii=False))
+    sys.exit(0)
+
+
+def json_success() -> None:
+    payload = {
+        "hookSpecificOutput": {
+            "hookEventName": "PreToolUse",
+            "permissionDecision": "allow",
+        },
+        "suppressOutput": True,
+    }
+    print(json.dumps(payload, ensure_ascii=False))
+    sys.exit(0)
+
+
+def http_post_json(url: str, body: dict) -> dict:
+    data = json.dumps(body).encode("utf-8")
+    req = urllib.request.Request(
+        url, data=data, headers={"Content-Type": "application/json"}, method="POST"
+    )
+    try:
+        with urllib.request.urlopen(req, timeout=10) as resp:
+            return json.loads(resp.read().decode("utf-8") or "{}")
+    except (
+        urllib.error.HTTPError,
+        urllib.error.URLError,
+        TimeoutError,
+        json.JSONDecodeError,
+    ) as e:
+        json_error(
+            f"Failed to create approval request. Backend may be unavailable. ({e})"
+        )
+        raise  # unreachable
+
+
+def http_get_json(url: str) -> dict:
+    req = urllib.request.Request(url, method="GET")
+    try:
+        with urllib.request.urlopen(req, timeout=10) as resp:
+            return json.loads(resp.read().decode("utf-8") or "{}")
+    except (
+        urllib.error.HTTPError,
+        urllib.error.URLError,
+        TimeoutError,
+        json.JSONDecodeError,
+    ) as e:
+        json_error(f"Lost connection to approval backend: {e}")
+        raise
+
+
+def parse_args() -> argparse.Namespace:
+    parser = argparse.ArgumentParser(
+        description="PreToolUse approval gate. All parameters are passed via CLI."
+    )
+    parser.add_argument(
+        "-t",
+        "--timeout-seconds",
+        type=int,
+        required=True,
+        help="Maximum time to wait for approval before timing out (seconds).",
+    )
+    parser.add_argument(
+        "-p",
+        "--poll-interval",
+        type=int,
+        required=True,
+        help="Seconds between polling the backend for status.",
+    )
+    parser.add_argument(
+        "-b",
+        "--backend-port",
+        type=int,
+        required=True,
+        help="Port of the approval backend running on 127.0.0.1.",
+    )
+    args = parser.parse_args()
+
+    if args.timeout_seconds <= 0:
+        parser.error("--timeout-seconds must be a positive integer")
+    if args.poll_interval <= 0:
+        parser.error("--poll-interval must be a positive integer")
+    if args.poll_interval > args.timeout_seconds:
+        parser.error("--poll-interval cannot be greater than --timeout-seconds")
+
+    return args
+
+
+def main():
+    args = parse_args()
+    port = args.backend_port
+
+    url = f"http://127.0.0.1:{port}"
+    create_endpoint = f"{url}/api/approvals/create"
+
+    try:
+        raw_payload = sys.stdin.read()
+        incoming = json.loads(raw_payload or "{}")
+    except json.JSONDecodeError:
+        json_error("Invalid JSON payload on stdin")
+
+    tool_name = incoming.get("tool_name")
+    tool_input = incoming.get("tool_input")
+    session_id = incoming.get("session_id", "unknown")
+
+    create_payload = {
+        "tool_name": tool_name,
+        "tool_input": tool_input,
+        "session_id": session_id,
+    }
+
+    response = http_post_json(create_endpoint, create_payload)
+    approval_id = response.get("id")
+    if not approval_id:
+        json_error("Invalid response from approval backend")
+
+    print(
+        f"Approval request created: {approval_id}. Waiting for user response...",
+        file=sys.stderr,
+    )
+
+    elapsed = 0
+    while elapsed < args.timeout_seconds:
+        result = http_get_json(f"{url}/api/approvals/{approval_id}/status")
+        status = result.get("status")
+
+        if status == "approved":
+            json_success()
+        elif status == "denied":
+            reason = result.get("reason")
+            json_error(reason)
+        elif status == "timed_out":
+            json_error(
+                f"Approval request timed out after {args.timeout_seconds} seconds"
+            )
+        elif status == "pending":
+            time.sleep(args.poll_interval)
+            elapsed += args.poll_interval
+        else:
+            json_error(f"Unknown approval status: {status}")
+
+    json_error(f"Approval request timed out after {args.timeout_seconds} seconds")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/crates/executors/src/executors/mod.rs b/crates/executors/src/executors/mod.rs
index ef022be2..34e0c502 100644
--- a/crates/executors/src/executors/mod.rs
+++ b/crates/executors/src/executors/mod.rs
@@ -10,7 +10,7 @@ use sqlx::Type;
 use strum_macros::{Display, EnumDiscriminants, EnumString, VariantNames};
 use thiserror::Error;
 use ts_rs::TS;
-use utils::msg_store::MsgStore;
+use workspace_utils::msg_store::MsgStore;
 
 use crate::{
     executors::{
diff --git a/crates/executors/src/executors/opencode.rs b/crates/executors/src/executors/opencode.rs
index 3c4003a4..562eadc3 100644
--- a/crates/executors/src/executors/opencode.rs
+++ b/crates/executors/src/executors/opencode.rs
@@ -16,7 +16,7 @@ use schemars::JsonSchema;
 use serde::{Deserialize, Serialize};
 use tokio::{io::AsyncWriteExt, process::Command};
 use ts_rs::TS;
-use utils::{msg_store::MsgStore, path::make_path_relative, shell::get_shell_command};
+use workspace_utils::{msg_store::MsgStore, path::make_path_relative, shell::get_shell_command};
 
 use crate::{
     command::{CmdOverrides, CommandBuilder, apply_overrides},
@@ -25,7 +25,7 @@ use crate::{
         opencode::share_bridge::Bridge as ShareBridge,
     },
     logs::{
-        ActionType, FileChange, NormalizedEntry, NormalizedEntryType, TodoItem,
+        ActionType, FileChange, NormalizedEntry, NormalizedEntryType, TodoItem, ToolStatus,
         utils::EntryIndexProvider,
     },
     stdout_dup,
@@ -796,6 +796,7 @@ impl Opencode {
                         entry_type: NormalizedEntryType::ToolUse {
                             tool_name: tool.clone(),
                             action_type: resolved_action_type,
+                            status: ToolStatus::Success,
                         },
                         content: content_text,
                         metadata: None,
diff --git a/crates/executors/src/executors/qwen.rs b/crates/executors/src/executors/qwen.rs
index d644af93..cfdbd787 100644
--- a/crates/executors/src/executors/qwen.rs
+++ b/crates/executors/src/executors/qwen.rs
@@ -6,7 +6,7 @@ use schemars::JsonSchema;
 use serde::{Deserialize, Serialize};
 use tokio::{io::AsyncWriteExt, process::Command};
 use ts_rs::TS;
-use utils::{msg_store::MsgStore, shell::get_shell_command};
+use workspace_utils::{msg_store::MsgStore, shell::get_shell_command};
 
 use crate::{
     command::{CmdOverrides, CommandBuilder, apply_overrides},
diff --git a/crates/executors/src/logs/mod.rs b/crates/executors/src/logs/mod.rs
index e9bc7eb0..11f0c6fe 100644
--- a/crates/executors/src/logs/mod.rs
+++ b/crates/executors/src/logs/mod.rs
@@ -1,5 +1,7 @@
+use chrono::{DateTime, Utc};
 use serde::{Deserialize, Serialize};
 use ts_rs::TS;
+use workspace_utils::approvals::ApprovalStatus;
 
 pub mod plain_text_processor;
 pub mod stderr_processor;
@@ -45,6 +47,7 @@ pub struct NormalizedConversation {
     pub summary: Option<String>,
 }
 
+#[allow(clippy::large_enum_variant)]
 #[derive(Debug, Clone, Serialize, Deserialize, TS)]
 #[serde(tag = "type", rename_all = "snake_case")]
 pub enum NormalizedEntryType {
@@ -53,6 +56,7 @@ pub enum NormalizedEntryType {
     ToolUse {
         tool_name: String,
         action_type: ActionType,
+        status: ToolStatus,
     },
     SystemMessage,
     ErrorMessage,
@@ -69,6 +73,59 @@ pub struct NormalizedEntry {
     pub metadata: Option<serde_json::Value>,
 }
 
+impl NormalizedEntry {
+    pub fn with_tool_status(&self, status: ToolStatus) -> Option<Self> {
+        if let NormalizedEntryType::ToolUse {
+            tool_name,
+            action_type,
+            ..
+        } = &self.entry_type
+        {
+            Some(Self {
+                entry_type: NormalizedEntryType::ToolUse {
+                    tool_name: tool_name.clone(),
+                    action_type: action_type.clone(),
+                    status,
+                },
+                ..self.clone()
+            })
+        } else {
+            None
+        }
+    }
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, TS)]
+#[ts(export)]
+#[serde(tag = "status", rename_all = "snake_case")]
+pub enum ToolStatus {
+    Created,
+    Success,
+    Failed,
+    Denied {
+        reason: Option<String>,
+    },
+    PendingApproval {
+        approval_id: String,
+        requested_at: DateTime<Utc>,
+        timeout_at: DateTime<Utc>,
+    },
+    TimedOut,
+}
+
+impl ToolStatus {
+    pub fn from_approval_status(status: &ApprovalStatus) -> Option<Self> {
+        match status {
+            ApprovalStatus::Approved => Some(ToolStatus::Created),
+            ApprovalStatus::Denied { reason } => Some(ToolStatus::Denied {
+                reason: reason.clone(),
+            }),
+            ApprovalStatus::TimedOut => Some(ToolStatus::TimedOut),
+            ApprovalStatus::Pending => None, // this should not happen
+        }
+    }
+}
+
 #[derive(Debug, Clone, Serialize, Deserialize, TS)]
 #[ts(export)]
 pub struct TodoItem {
diff --git a/crates/executors/src/logs/plain_text_processor.rs b/crates/executors/src/logs/plain_text_processor.rs
index 313cf642..3ee999cf 100644
--- a/crates/executors/src/logs/plain_text_processor.rs
+++ b/crates/executors/src/logs/plain_text_processor.rs
@@ -362,7 +362,7 @@ impl PlainTextLogProcessor {
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::logs::NormalizedEntryType;
+    use crate::logs::{NormalizedEntryType, ToolStatus};
 
     #[test]
     fn test_plain_buffer_flush() {
@@ -432,6 +432,7 @@ mod tests {
                         action_type: super::super::ActionType::Other {
                             description: tool_name.to_string(),
                         },
+                        status: ToolStatus::Success,
                     },
                     content,
                     metadata: None,
diff --git a/crates/executors/src/logs/stderr_processor.rs b/crates/executors/src/logs/stderr_processor.rs
index 562a9617..04510cdb 100644
--- a/crates/executors/src/logs/stderr_processor.rs
+++ b/crates/executors/src/logs/stderr_processor.rs
@@ -11,7 +11,7 @@
 use std::{sync::Arc, time::Duration};
 
 use futures::StreamExt;
-use utils::msg_store::MsgStore;
+use workspace_utils::msg_store::MsgStore;
 
 use super::{NormalizedEntry, NormalizedEntryType, plain_text_processor::PlainTextLogProcessor};
 use crate::logs::utils::EntryIndexProvider;
diff --git a/crates/executors/src/logs/utils/entry_index.rs b/crates/executors/src/logs/utils/entry_index.rs
index b0373826..b92aa9e1 100644
--- a/crates/executors/src/logs/utils/entry_index.rs
+++ b/crates/executors/src/logs/utils/entry_index.rs
@@ -6,7 +6,7 @@ use std::sync::{
 };
 
 use json_patch::PatchOperation;
-use utils::{log_msg::LogMsg, msg_store::MsgStore};
+use workspace_utils::{log_msg::LogMsg, msg_store::MsgStore};
 
 /// Thread-safe provider for monotonically increasing entry indexes
 #[derive(Debug, Clone)]
diff --git a/crates/executors/src/logs/utils/patch.rs b/crates/executors/src/logs/utils/patch.rs
index 726110bd..91685263 100644
--- a/crates/executors/src/logs/utils/patch.rs
+++ b/crates/executors/src/logs/utils/patch.rs
@@ -1,8 +1,8 @@
 use json_patch::Patch;
 use serde::{Deserialize, Serialize};
-use serde_json::{from_value, json};
+use serde_json::{from_value, json, to_value};
 use ts_rs::TS;
-use utils::diff::Diff;
+use workspace_utils::diff::Diff;
 
 use crate::logs::NormalizedEntry;
 
@@ -114,3 +114,20 @@ impl ConversationPatch {
         from_value(json!([patch_entry])).unwrap()
     }
 }
+
+/// Extract the entry index and `NormalizedEntry` from a JsonPatch if it contains one
+pub fn extract_normalized_entry_from_patch(patch: &Patch) -> Option<(usize, NormalizedEntry)> {
+    let value = to_value(patch).ok()?;
+    let ops = value.as_array()?;
+    ops.iter().rev().find_map(|op| {
+        let path = op.get("path")?.as_str()?;
+        let entry_index = path.strip_prefix("/entries/")?.parse::<usize>().ok()?;
+
+        let value = op.get("value")?;
+        (value.get("type")?.as_str()? == "NORMALIZED_ENTRY")
+            .then(|| value.get("content"))
+            .flatten()
+            .and_then(|c| from_value::<NormalizedEntry>(c.clone()).ok())
+            .map(|entry| (entry_index, entry))
+    })
+}
diff --git a/crates/executors/src/profile.rs b/crates/executors/src/profile.rs
index 306d9eb2..671c8893 100644
--- a/crates/executors/src/profile.rs
+++ b/crates/executors/src/profile.rs
@@ -204,7 +204,7 @@ impl ExecutorConfigs {
 
     /// Load executor profiles from file or defaults
     pub fn load() -> Self {
-        let profiles_path = utils::assets::profiles_path();
+        let profiles_path = workspace_utils::assets::profiles_path();
 
         // Load defaults first
         let mut defaults = Self::from_defaults();
@@ -238,7 +238,7 @@ impl ExecutorConfigs {
 
     /// Save user profile overrides to file (only saves what differs from defaults)
     pub fn save_overrides(&self) -> Result<(), ProfileError> {
-        let profiles_path = utils::assets::profiles_path();
+        let profiles_path = workspace_utils::assets::profiles_path();
         let mut defaults = Self::from_defaults();
         defaults.canonicalise();
 
@@ -425,3 +425,10 @@ impl ExecutorConfigs {
         Err(ProfileError::NoAvailableExecutorProfile)
     }
 }
+
+pub fn to_default_variant(id: &ExecutorProfileId) -> ExecutorProfileId {
+    ExecutorProfileId {
+        executor: id.executor,
+        variant: None,
+    }
+}
diff --git a/crates/local-deployment/src/container.rs b/crates/local-deployment/src/container.rs
index 7a1f0002..1524376a 100644
--- a/crates/local-deployment/src/container.rs
+++ b/crates/local-deployment/src/container.rs
@@ -33,8 +33,11 @@ use deployment::DeploymentError;
 use executors::{
     actions::{Executable, ExecutorAction},
     logs::{
-        NormalizedEntry, NormalizedEntryType,
-        utils::{ConversationPatch, patch::escape_json_pointer_segment},
+        NormalizedEntryType,
+        utils::{
+            ConversationPatch,
+            patch::{escape_json_pointer_segment, extract_normalized_entry_from_patch},
+        },
     },
 };
 use futures::{StreamExt, TryStreamExt, stream::select};
@@ -1298,7 +1301,7 @@ impl LocalContainerService {
         for msg in history.iter().rev() {
             if let LogMsg::JsonPatch(patch) = msg {
                 // Try to extract a NormalizedEntry from the patch
-                if let Some(entry) = self.extract_normalized_entry_from_patch(patch)
+                if let Some((_, entry)) = extract_normalized_entry_from_patch(patch)
                     && matches!(entry.entry_type, NormalizedEntryType::AssistantMessage)
                 {
                     let content = entry.content.trim();
@@ -1317,32 +1320,6 @@ impl LocalContainerService {
         None
     }
 
-    /// Extract a NormalizedEntry from a JsonPatch if it contains one
-    fn extract_normalized_entry_from_patch(
-        &self,
-        patch: &json_patch::Patch,
-    ) -> Option<NormalizedEntry> {
-        // Convert the patch to JSON to examine its structure
-        if let Ok(patch_json) = serde_json::to_value(patch)
-            && let Some(operations) = patch_json.as_array()
-        {
-            for operation in operations {
-                if let Some(value) = operation.get("value") {
-                    // Try to extract a NormalizedEntry from the value
-                    if let Some(patch_type) = value.get("type").and_then(|t| t.as_str())
-                        && patch_type == "NORMALIZED_ENTRY"
-                        && let Some(content) = value.get("content")
-                        && let Ok(entry) =
-                            serde_json::from_value::<NormalizedEntry>(content.clone())
-                    {
-                        return Some(entry);
-                    }
-                }
-            }
-        }
-        None
-    }
-
     /// Update the executor session summary with the final assistant message
     async fn update_executor_session_summary(&self, exec_id: &Uuid) -> Result<(), anyhow::Error> {
         // Check if there's an executor session for this execution process
diff --git a/crates/local-deployment/src/lib.rs b/crates/local-deployment/src/lib.rs
index d8e09f06..88ff41d2 100644
--- a/crates/local-deployment/src/lib.rs
+++ b/crates/local-deployment/src/lib.rs
@@ -6,6 +6,7 @@ use deployment::{Deployment, DeploymentError};
 use executors::profile::ExecutorConfigs;
 use services::services::{
     analytics::{AnalyticsConfig, AnalyticsContext, AnalyticsService, generate_user_id},
+    approvals::Approvals,
     auth::AuthService,
     config::{Config, load_config_from_file, save_config_to_file},
     container::ContainerService,
@@ -40,6 +41,7 @@ pub struct LocalDeployment {
     filesystem: FilesystemService,
     events: EventService,
     file_search_cache: Arc<FileSearchCache>,
+    approvals: Approvals,
 }
 
 #[async_trait]
@@ -103,6 +105,8 @@ impl Deployment for LocalDeployment {
             });
         }
 
+        let approvals = Approvals::new(db.pool.clone(), msg_stores.clone());
+
         // We need to make analytics accessible to the ContainerService
         // TODO: Handle this more gracefully
         let analytics_ctx = analytics.as_ref().map(|s| AnalyticsContext {
@@ -136,6 +140,7 @@ impl Deployment for LocalDeployment {
             filesystem,
             events,
             file_search_cache,
+            approvals,
         })
     }
 
@@ -193,4 +198,8 @@ impl Deployment for LocalDeployment {
     fn file_search_cache(&self) -> &Arc<FileSearchCache> {
         &self.file_search_cache
     }
+
+    fn approvals(&self) -> &Approvals {
+        &self.approvals
+    }
 }
diff --git a/crates/server/Cargo.toml b/crates/server/Cargo.toml
index 79f3ebc3..ab920c60 100644
--- a/crates/server/Cargo.toml
+++ b/crates/server/Cargo.toml
@@ -25,7 +25,7 @@ tracing-subscriber = { workspace = true }
 sqlx = { version = "0.8.6", features = ["runtime-tokio-rustls", "sqlite", "chrono", "uuid"] }
 chrono = { version = "0.4", features = ["serde"] }
 uuid = { version = "1.0", features = ["v4", "serde"] }
-ts-rs = { workspace = true, features = ["serde-json-impl"]}
+ts-rs = { workspace = true }
 async-trait = "0.1"
 command-group = { version = "5.0", features = ["with-tokio"] }
 nix = { version = "0.29", features = ["signal", "process"] }
diff --git a/crates/server/src/bin/generate_types.rs b/crates/server/src/bin/generate_types.rs
index b616d869..09fc887f 100644
--- a/crates/server/src/bin/generate_types.rs
+++ b/crates/server/src/bin/generate_types.rs
@@ -108,7 +108,11 @@ fn generate_types_content() -> String {
         executors::logs::TodoItem::decl(),
         executors::logs::ToolResult::decl(),
         executors::logs::ToolResultValueType::decl(),
+        executors::logs::ToolStatus::decl(),
         executors::logs::utils::patch::PatchType::decl(),
+        utils::approvals::ApprovalStatus::decl(),
+        utils::approvals::CreateApprovalRequest::decl(),
+        utils::approvals::ApprovalResponse::decl(),
         serde_json::Value::decl(),
     ];
 
diff --git a/crates/server/src/main.rs b/crates/server/src/main.rs
index ac145490..dbd1b9a8 100644
--- a/crates/server/src/main.rs
+++ b/crates/server/src/main.rs
@@ -81,9 +81,7 @@ async fn main() -> Result<(), VibeKanbanError> {
     let actual_port = listener.local_addr()?.port(); // get → 53427 (example)
 
     // Write port file for discovery if prod, warn on fail
-    if !cfg!(debug_assertions)
-        && let Err(e) = write_port_file(actual_port).await
-    {
+    if let Err(e) = write_port_file(actual_port).await {
         tracing::warn!("Failed to write port file: {}", e);
     }
 
diff --git a/crates/server/src/routes/approvals.rs b/crates/server/src/routes/approvals.rs
new file mode 100644
index 00000000..247fe254
--- /dev/null
+++ b/crates/server/src/routes/approvals.rs
@@ -0,0 +1,92 @@
+use axum::{
+    Json, Router,
+    extract::{Path, State},
+    http::StatusCode,
+    routing::{get, post},
+};
+use db::models::execution_process::ExecutionProcess;
+use deployment::Deployment;
+use services::services::container::ContainerService;
+use utils::approvals::{
+    ApprovalPendingInfo, ApprovalRequest, ApprovalResponse, ApprovalStatus, CreateApprovalRequest,
+    EXIT_PLAN_MODE_TOOL_NAME,
+};
+
+use crate::DeploymentImpl;
+
+pub async fn create_approval(
+    State(deployment): State<DeploymentImpl>,
+    Json(request): Json<CreateApprovalRequest>,
+) -> Result<Json<ApprovalRequest>, StatusCode> {
+    let service = deployment.approvals();
+    let approval_request = ApprovalRequest::from_create(request);
+
+    match service.create(approval_request).await {
+        Ok(approval) => Ok(Json(approval)),
+        Err(e) => {
+            tracing::error!("Failed to create approval: {:?}", e);
+            Err(StatusCode::INTERNAL_SERVER_ERROR)
+        }
+    }
+}
+
+pub async fn get_approval_status(
+    State(deployment): State<DeploymentImpl>,
+    Path(id): Path<String>,
+) -> Result<Json<ApprovalStatus>, StatusCode> {
+    let service = deployment.approvals();
+    match service.status(&id).await {
+        Some(status) => Ok(Json(status)),
+        None => Err(StatusCode::NOT_FOUND),
+    }
+}
+
+pub async fn respond_to_approval(
+    State(deployment): State<DeploymentImpl>,
+    Path(id): Path<String>,
+    Json(request): Json<ApprovalResponse>,
+) -> Result<Json<ApprovalStatus>, StatusCode> {
+    let service = deployment.approvals();
+
+    match service.respond(&id, request).await {
+        Ok((status, context)) => {
+            if matches!(status, ApprovalStatus::Approved)
+                && context.tool_name == EXIT_PLAN_MODE_TOOL_NAME
+            {
+                // If exiting plan mode, automatically start a new execution process with different
+                // permissions
+                if let Ok(ctx) = ExecutionProcess::load_context(
+                    &deployment.db().pool,
+                    context.execution_process_id,
+                )
+                .await
+                    && let Err(e) = deployment.container().exit_plan_mode_tool(ctx).await
+                {
+                    tracing::error!("failed to exit plan mode: {:?}", e);
+                    return Err(StatusCode::INTERNAL_SERVER_ERROR);
+                }
+            }
+            Ok(Json(status))
+        }
+        Err(e) => {
+            tracing::error!("Failed to respond to approval: {:?}", e);
+            Err(StatusCode::INTERNAL_SERVER_ERROR)
+        }
+    }
+}
+
+pub async fn get_pending_approvals(
+    State(deployment): State<DeploymentImpl>,
+) -> Json<Vec<ApprovalPendingInfo>> {
+    let service = deployment.approvals();
+    let approvals = service.pending().await;
+    Json(approvals)
+}
+
+pub fn router() -> Router<DeploymentImpl> {
+    Router::new()
+        .route("/approvals/create", post(create_approval))
+        .route("/approvals/{id}/status", get(get_approval_status))
+        .route("/approvals/{id}/respond", post(respond_to_approval))
+        .route("/approvals/pending", get(get_pending_approvals))
+}
diff --git a/crates/server/src/routes/mod.rs b/crates/server/src/routes/mod.rs
index cc23fb50..8c267042 100644
--- a/crates/server/src/routes/mod.rs
+++ b/crates/server/src/routes/mod.rs
@@ -5,6 +5,7 @@ use axum::{
 
 use crate::DeploymentImpl;
 
+pub mod approvals;
 pub mod auth;
 pub mod config;
 pub mod containers;
@@ -34,6 +35,7 @@ pub fn router(deployment: DeploymentImpl) -> IntoMakeService<Router> {
         .merge(auth::router(&deployment))
         .merge(filesystem::router())
         .merge(events::router(&deployment))
+        .merge(approvals::router())
         .nest("/images", images::routes())
         .with_state(deployment);
 
diff --git a/crates/services/src/services/approvals.rs b/crates/services/src/services/approvals.rs
new file mode 100644
index 00000000..832c74c9
--- /dev/null
+++ b/crates/services/src/services/approvals.rs
@@ -0,0 +1,274 @@
+use std::{collections::HashMap, sync::Arc, time::Duration as StdDuration};
+
+use chrono::{DateTime, Utc};
+use dashmap::DashMap;
+use db::models::executor_session::ExecutorSession;
+use executors::logs::{
+    NormalizedEntry, NormalizedEntryType, ToolStatus,
+    utils::patch::{ConversationPatch, extract_normalized_entry_from_patch},
+};
+use sqlx::{Error as SqlxError, SqlitePool};
+use thiserror::Error;
+use tokio::sync::{RwLock, oneshot};
+use utils::{
+    approvals::{ApprovalPendingInfo, ApprovalRequest, ApprovalResponse, ApprovalStatus},
+    log_msg::LogMsg,
+    msg_store::MsgStore,
+};
+use uuid::Uuid;
+
+#[derive(Debug)]
+struct PendingApproval {
+    entry_index: usize,
+    entry: NormalizedEntry,
+    execution_process_id: Uuid,
+    tool_name: String,
+    requested_at: DateTime<Utc>,
+    timeout_at: DateTime<Utc>,
+    response_tx: oneshot::Sender<ApprovalStatus>,
+}
+
+#[derive(Debug)]
+pub struct ToolContext {
+    pub tool_name: String,
+    pub execution_process_id: Uuid,
+}
+
+#[derive(Clone)]
+pub struct Approvals {
+    pending: Arc<DashMap<String, PendingApproval>>,
+    completed: Arc<DashMap<String, ApprovalStatus>>,
+    db_pool: SqlitePool,
+    msg_stores: Arc<RwLock<HashMap<Uuid, Arc<MsgStore>>>>,
+}
+
+#[derive(Debug, Error)]
+pub enum ApprovalError {
+    #[error("approval request not found")]
+    NotFound,
+    #[error("approval request already completed")]
+    AlreadyCompleted,
+    #[error("no executor session found for session_id: {0}")]
+    NoExecutorSession(String),
+    #[error("corresponding tool use entry not found for approval request")]
+    NoToolUseEntry,
+    #[error(transparent)]
+    Custom(#[from] anyhow::Error),
+    #[error(transparent)]
+    Sqlx(#[from] SqlxError),
+}
+
+impl Approvals {
+    pub fn new(db_pool: SqlitePool, msg_stores: Arc<RwLock<HashMap<Uuid, Arc<MsgStore>>>>) -> Self {
+        Self {
+            pending: Arc::new(DashMap::new()),
+            completed: Arc::new(DashMap::new()),
+            db_pool,
+            msg_stores,
+        }
+    }
+
+    pub async fn create(&self, request: ApprovalRequest) -> Result<ApprovalRequest, ApprovalError> {
+        let execution_process_id = if let Some(executor_session) =
+            ExecutorSession::find_by_session_id(&self.db_pool, &request.session_id).await?
+        {
+            executor_session.execution_process_id
+        } else {
+            tracing::warn!(
+                "No executor session found for session_id: {}",
+                request.session_id
+            );
+            return Err(ApprovalError::NoExecutorSession(request.session_id.clone()));
+        };
+
+        let (tx, rx) = oneshot::channel();
+        let req_id = request.id.clone();
+
+        if let Some(store) = self.msg_store_by_id(&execution_process_id).await {
+            let last_tool = get_last_tool_use(store.clone());
+            if let Some((idx, last_tool)) = last_tool {
+                let approval_entry = last_tool
+                    .with_tool_status(ToolStatus::PendingApproval {
+                        approval_id: req_id.clone(),
+                        requested_at: request.created_at,
+                        timeout_at: request.timeout_at,
+                    })
+                    .ok_or(ApprovalError::NoToolUseEntry)?;
+                store.push_patch(ConversationPatch::replace(idx, approval_entry));
+
+                self.pending.insert(
+                    req_id.clone(),
+                    PendingApproval {
+                        entry_index: idx,
+                        entry: last_tool,
+                        execution_process_id,
+                        tool_name: request.tool_name.clone(),
+                        requested_at: request.created_at,
+                        timeout_at: request.timeout_at,
+                        response_tx: tx,
+                    },
+                );
+            }
+        } else {
+            tracing::warn!(
+                "No msg_store found for execution_process_id: {}",
+                execution_process_id
+            );
+        }
+
+        self.spawn_timeout_watcher(req_id.clone(), request.timeout_at, rx);
+        Ok(request)
+    }
+
+    pub async fn respond(
+        &self,
+        id: &str,
+        req: ApprovalResponse,
+    ) -> Result<(ApprovalStatus, ToolContext), ApprovalError> {
+        if let Some((_, p)) = self.pending.remove(id) {
+            self.completed.insert(id.to_string(), req.status.clone());
+            let _ = p.response_tx.send(req.status.clone());
+
+            if let Some(store) = self.msg_store_by_id(&req.execution_process_id).await {
+                let status = ToolStatus::from_approval_status(&req.status).ok_or(
+                    ApprovalError::Custom(anyhow::anyhow!("Invalid approval status")),
+                )?;
+                let updated_entry = p
+                    .entry
+                    .with_tool_status(status)
+                    .ok_or(ApprovalError::NoToolUseEntry)?;
+
+                store.push_patch(ConversationPatch::replace(p.entry_index, updated_entry));
+            } else {
+                tracing::warn!(
+                    "No msg_store found for execution_process_id: {}",
+                    req.execution_process_id
+                );
+            }
+
+            let tool_ctx = ToolContext {
+                tool_name: p.tool_name,
+                execution_process_id: p.execution_process_id,
+            };
+            Ok((req.status, tool_ctx))
+        } else if self.completed.contains_key(id) {
+            Err(ApprovalError::AlreadyCompleted)
+        } else {
+            Err(ApprovalError::NotFound)
+        }
+    }
+
+    pub async fn status(&self, id: &str) -> Option<ApprovalStatus> {
+        if let Some(f) = self.completed.get(id) {
+            return Some(f.clone());
+        }
+        if let Some(p) = self.pending.get(id) {
+            if chrono::Utc::now() >= p.timeout_at {
+                return Some(ApprovalStatus::TimedOut);
+            }
+            return Some(ApprovalStatus::Pending);
+        }
+        None
+    }
+
+    pub async fn pending(&self) -> Vec<ApprovalPendingInfo> {
+        self.pending
+            .iter()
+            .filter_map(|entry| {
+                let (id, pending) = entry.pair();
+
+                match &pending.entry.entry_type {
+                    NormalizedEntryType::ToolUse { tool_name, .. } => Some(ApprovalPendingInfo {
+                        approval_id: id.clone(),
+                        execution_process_id: pending.execution_process_id,
+                        tool_name: tool_name.clone(),
+                        requested_at: pending.requested_at,
+                        timeout_at: pending.timeout_at,
+                    }),
+                    _ => None,
+                }
+            })
+            .collect()
+    }
+
+    fn spawn_timeout_watcher(
+        &self,
+        id: String,
+        timeout_at: chrono::DateTime<chrono::Utc>,
+        mut rx: oneshot::Receiver<ApprovalStatus>,
+    ) {
+        let pending = self.pending.clone();
+        let completed = self.completed.clone();
+        let msg_stores = self.msg_stores.clone();
+
+        let now = chrono::Utc::now();
+        let to_wait = (timeout_at - now)
+            .to_std()
+            .unwrap_or_else(|_| StdDuration::from_secs(0));
+        let deadline = tokio::time::Instant::now() + to_wait;
+
+        tokio::spawn(async move {
+            let status = tokio::select! {
+                biased;
+
+                r = &mut rx => match r {
+                    Ok(status) => status,
+                    Err(_canceled) => ApprovalStatus::TimedOut,
+                },
+                _ = tokio::time::sleep_until(deadline) => ApprovalStatus::TimedOut,
+            };
+
+            let is_timeout = matches!(&status, ApprovalStatus::TimedOut);
+            completed.insert(id.clone(), status.clone());
+
+            let removed = pending.remove(&id);
+
+            if is_timeout && let Some((_, pending_approval)) = removed {
+                let store = {
+                    let map = msg_stores.read().await;
+                    map.get(&pending_approval.execution_process_id).cloned()
+                };
+
+                if let Some(store) = store {
+                    if let Some(updated_entry) = pending_approval
+                        .entry
+                        .with_tool_status(ToolStatus::TimedOut)
+                    {
+                        store.push_patch(ConversationPatch::replace(
+                            pending_approval.entry_index,
+                            updated_entry,
+                        ));
+                    } else {
+                        tracing::warn!(
+                            "Timed out approval '{}' but couldn't update tool status (no tool-use entry).",
+                            id
+                        );
+                    }
+                } else {
+                    tracing::warn!(
+                        "No msg_store found for execution_process_id: {}",
+                        pending_approval.execution_process_id
+                    );
+                }
+            }
+        });
+    }
+
+    async fn msg_store_by_id(&self, execution_process_id: &Uuid) -> Option<Arc<MsgStore>> {
+        let map = self.msg_stores.read().await;
+        map.get(execution_process_id).cloned()
+    }
+}
+
+fn get_last_tool_use(store: Arc<MsgStore>) -> Option<(usize, NormalizedEntry)> {
+    let history = store.get_history();
+    for msg in history.iter().rev() {
+        if let LogMsg::JsonPatch(patch) = msg
+            && let Some((idx, entry)) = extract_normalized_entry_from_patch(patch)
+            && matches!(entry.entry_type, NormalizedEntryType::ToolUse { .. })
+        {
+            return Some((idx, entry));
+        }
+    }
+    None
+}
diff --git a/crates/services/src/services/container.rs b/crates/services/src/services/container.rs
index 505c95fa..f01bcd91 100644
--- a/crates/services/src/services/container.rs
+++ b/crates/services/src/services/container.rs
@@ -23,11 +23,12 @@ use db::{
 use executors::{
     actions::{
         ExecutorAction, ExecutorActionType,
+        coding_agent_follow_up::CodingAgentFollowUpRequest,
         coding_agent_initial::CodingAgentInitialRequest,
         script::{ScriptContext, ScriptRequest, ScriptRequestLanguage},
     },
     executors::{ExecutorError, StandardCodingAgentExecutor},
-    profile::{ExecutorConfigs, ExecutorProfileId},
+    profile::{ExecutorConfigs, ExecutorProfileId, to_default_variant},
 };
 use futures::{StreamExt, future};
 use sqlx::Error as SqlxError;
@@ -689,4 +690,66 @@ pub trait ContainerService {
         tracing::debug!("Started next action: {:?}", next_action);
         Ok(())
     }
+
+    async fn exit_plan_mode_tool(&self, ctx: ExecutionContext) -> Result<(), ContainerError> {
+        let execution_id = ctx.execution_process.id;
+
+        if let Err(err) = self.stop_execution(&ctx.execution_process).await {
+            tracing::error!("Failed to stop execution process {}: {}", execution_id, err);
+            return Err(err);
+        }
+        let _ = ExecutionProcess::update_completion(
+            &self.db().pool,
+            execution_id,
+            ExecutionProcessStatus::Completed,
+            Some(0),
+        )
+        .await;
+
+        let action = ctx.execution_process.executor_action()?;
+        let executor_profile_id = match action.typ() {
+            ExecutorActionType::CodingAgentInitialRequest(req) => req.executor_profile_id.clone(),
+            ExecutorActionType::CodingAgentFollowUpRequest(req) => req.executor_profile_id.clone(),
+            _ => {
+                return Err(ContainerError::Other(anyhow::anyhow!(
+                    "exit plan mode tool called on non-coding agent action"
+                )));
+            }
+        };
+        let cleanup_chain = action.next_action().cloned();
+
+        let session_id =
+            ExecutorSession::find_by_execution_process_id(&self.db().pool, execution_id)
+                .await?
+                .and_then(|s| s.session_id);
+        if session_id.is_none() {
+            tracing::warn!(
+                "No executor session found for execution process {}",
+                execution_id
+            );
+            return Err(ContainerError::Other(anyhow::anyhow!(
+                "No executor session found"
+            )));
+        }
+
+        let default_profile = to_default_variant(&executor_profile_id);
+        let follow_up = CodingAgentFollowUpRequest {
+            prompt: String::from("The plan has been approved, please execute it."),
+            session_id: session_id.unwrap(),
+            executor_profile_id: default_profile,
+        };
+        let action = ExecutorAction::new(
+            ExecutorActionType::CodingAgentFollowUpRequest(follow_up),
+            cleanup_chain.map(Box::new),
+        );
+
+        let _ = self
+            .start_execution(
+                &ctx.task_attempt,
+                &action,
+                &ExecutionProcessRunReason::CodingAgent,
+            )
+            .await?;
+        Ok(())
+    }
 }
diff --git a/crates/services/src/services/mod.rs b/crates/services/src/services/mod.rs
index 9a4bef65..9c842427 100644
--- a/crates/services/src/services/mod.rs
+++ b/crates/services/src/services/mod.rs
@@ -1,4 +1,5 @@
 pub mod analytics;
+pub mod approvals;
 pub mod auth;
 pub mod config;
 pub mod container;
diff --git a/crates/utils/src/approvals.rs b/crates/utils/src/approvals.rs
new file mode 100644
index 00000000..a827edb6
--- /dev/null
+++ b/crates/utils/src/approvals.rs
@@ -0,0 +1,69 @@
+use chrono::{DateTime, Duration, Utc};
+use serde::{Deserialize, Serialize};
+use ts_rs::TS;
+use uuid::Uuid;
+
+pub const APPROVAL_TIMEOUT_SECONDS: i64 = 3600; // 1 hour
+pub const EXIT_PLAN_MODE_TOOL_NAME: &str = "ExitPlanMode";
+
+#[derive(Debug, Clone, Serialize, Deserialize, TS)]
+pub struct ApprovalRequest {
+    pub id: String,
+    pub tool_name: String,
+    pub tool_input: serde_json::Value,
+    pub session_id: String,
+    pub created_at: DateTime<Utc>,
+    pub timeout_at: DateTime<Utc>,
+}
+
+impl ApprovalRequest {
+    pub fn from_create(request: CreateApprovalRequest) -> Self {
+        let now = Utc::now();
+        Self {
+            id: Uuid::new_v4().to_string(),
+            tool_name: request.tool_name,
+            tool_input: request.tool_input,
+            session_id: request.session_id,
+            created_at: now,
+            timeout_at: now + Duration::seconds(APPROVAL_TIMEOUT_SECONDS),
+        }
+    }
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, TS)]
+#[ts(export)]
+pub struct CreateApprovalRequest {
+    pub tool_name: String,
+    pub tool_input: serde_json::Value,
+    pub session_id: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, TS)]
+#[ts(export)]
+#[serde(tag = "status", rename_all = "snake_case")]
+pub enum ApprovalStatus {
+    Pending,
+    Approved,
+    Denied {
+        #[ts(optional)]
+        reason: Option<String>,
+    },
+    TimedOut,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, TS)]
+#[ts(export)]
+pub struct ApprovalResponse {
+    pub execution_process_id: Uuid,
+    pub status: ApprovalStatus,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, TS)]
+#[ts(export)]
+pub struct ApprovalPendingInfo {
+    pub approval_id: String,
+    pub execution_process_id: Uuid,
+    pub tool_name: String,
+    pub requested_at: DateTime<Utc>,
+    pub timeout_at: DateTime<Utc>,
+}
diff --git a/crates/utils/src/lib.rs b/crates/utils/src/lib.rs
index 4941bad5..523d156c 100644
--- a/crates/utils/src/lib.rs
+++ b/crates/utils/src/lib.rs
@@ -2,6 +2,7 @@ use std::{env, sync::OnceLock};
 
 use directories::ProjectDirs;
 
+pub mod approvals;
 pub mod assets;
 pub mod browser;
 pub mod diff;
diff --git a/crates/utils/src/msg_store.rs b/crates/utils/src/msg_store.rs
index 906f3549..a5536c05 100644
--- a/crates/utils/src/msg_store.rs
+++ b/crates/utils/src/msg_store.rs
@@ -67,6 +67,7 @@ impl MsgStore {
     pub fn push_stdout<S: Into<String>>(&self, s: S) {
         self.push(LogMsg::Stdout(s.into()));
     }
+
     pub fn push_stderr<S: Into<String>>(&self, s: S) {
         self.push(LogMsg::Stderr(s.into()));
     }
@@ -85,6 +86,7 @@ impl MsgStore {
     pub fn get_receiver(&self) -> broadcast::Receiver<LogMsg> {
         self.sender.subscribe()
     }
+
     pub fn get_history(&self) -> Vec<LogMsg> {
         self.inner
             .read()
diff --git a/crates/utils/src/port_file.rs b/crates/utils/src/port_file.rs
index 6ced4ed4..7b22b4b4 100644
--- a/crates/utils/src/port_file.rs
+++ b/crates/utils/src/port_file.rs
@@ -10,3 +10,25 @@ pub async fn write_port_file(port: u16) -> std::io::Result<PathBuf> {
     fs::write(&path, port.to_string()).await?;
     Ok(path)
 }
+
+pub async fn read_port_file(app_name: &str) -> std::io::Result<u16> {
+    let base = if cfg!(target_os = "linux") {
+        match env::var("XDG_RUNTIME_DIR") {
+            Ok(val) if !val.is_empty() => PathBuf::from(val),
+            _ => env::temp_dir(),
+        }
+    } else {
+        env::temp_dir()
+    };
+
+    let path = base.join(app_name).join(format!("{app_name}.port"));
+    tracing::debug!("Reading port from {:?}", path);
+
+    let content = fs::read_to_string(&path).await?;
+    let port: u16 = content
+        .trim()
+        .parse()
+        .map_err(|e| std::io::Error::new(std::io::ErrorKind::InvalidData, e))?;
+
+    Ok(port)
+}
diff --git a/frontend/package.json b/frontend/package.json
index 9d30fc7b..df04b622 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -8,7 +8,7 @@
     "build": "tsc && vite build",
     "check": "tsc --noEmit",
     "preview": "vite preview",
-    "lint": "eslint . --ext ts,tsx --report-unused-disable-directives --max-warnings 100",
+    "lint": "eslint . --ext ts,tsx --report-unused-disable-directives --max-warnings 110",
     "lint:fix": "eslint . --ext ts,tsx --fix",
     "lint:i18n": "LINT_I18N=true eslint . --ext ts,tsx --max-warnings 0",
     "format": "prettier --write \"src/**/*.{ts,tsx,js,jsx,json,css,md}\"",
diff --git a/frontend/src/components/NormalizedConversation/DisplayConversationEntry.tsx b/frontend/src/components/NormalizedConversation/DisplayConversationEntry.tsx
index 59c10112..8aa86215 100644
--- a/frontend/src/components/NormalizedConversation/DisplayConversationEntry.tsx
+++ b/frontend/src/components/NormalizedConversation/DisplayConversationEntry.tsx
@@ -1,8 +1,10 @@
+import { useTranslation } from 'react-i18next';
 import MarkdownRenderer from '@/components/ui/markdown-renderer.tsx';
 import {
   ActionType,
   NormalizedEntry,
   TaskAttempt,
+  ToolStatus,
   type NormalizedEntryType,
 } from 'shared/types.ts';
 import type { ProcessStartPayload } from '@/types/logs';
@@ -27,6 +29,8 @@ import {
 } from 'lucide-react';
 import RawLogText from '../common/RawLogText';
 import UserMessage from './UserMessage';
+import PendingApprovalEntry from './PendingApprovalEntry';
+import { cn } from '@/lib/utils';
 
 type Props = {
   entry: NormalizedEntry | ProcessStartPayload;
@@ -304,38 +308,101 @@ const CollapsibleEntry: React.FC<{
   );
 };
 
+type ToolStatusAppearance = 'default' | 'denied' | 'timed_out';
+
+const PLAN_APPEARANCE: Record<
+  ToolStatusAppearance,
+  {
+    border: string;
+    headerBg: string;
+    headerText: string;
+    contentBg: string;
+    contentText: string;
+  }
+> = {
+  default: {
+    border: 'border-blue-400/40',
+    headerBg: 'bg-blue-50 dark:bg-blue-950/20',
+    headerText: 'text-blue-700 dark:text-blue-300',
+    contentBg: 'bg-blue-50 dark:bg-blue-950/20',
+    contentText: 'text-blue-700 dark:text-blue-300',
+  },
+  denied: {
+    border: 'border-red-400/40',
+    headerBg: 'bg-red-50 dark:bg-red-950/20',
+    headerText: 'text-red-700 dark:text-red-300',
+    contentBg: 'bg-red-50 dark:bg-red-950/10',
+    contentText: 'text-red-700 dark:text-red-300',
+  },
+  timed_out: {
+    border: 'border-amber-400/40',
+    headerBg: 'bg-amber-50 dark:bg-amber-950/20',
+    headerText: 'text-amber-700 dark:text-amber-200',
+    contentBg: 'bg-amber-50 dark:bg-amber-950/10',
+    contentText: 'text-amber-700 dark:text-amber-200',
+  },
+};
+
 const PlanPresentationCard: React.FC<{
   plan: string;
   expansionKey: string;
-}> = ({ plan, expansionKey }) => {
-  const [expanded, toggle] = useExpandable(`plan-entry:${expansionKey}`, true);
+  defaultExpanded?: boolean;
+  statusAppearance?: ToolStatusAppearance;
+}> = ({
+  plan,
+  expansionKey,
+  defaultExpanded = false,
+  statusAppearance = 'default',
+}) => {
+  const { t } = useTranslation('common');
+  const [expanded, toggle] = useExpandable(
+    `plan-entry:${expansionKey}`,
+    defaultExpanded
+  );
+  const tone = PLAN_APPEARANCE[statusAppearance];
 
   return (
     <div className="inline-block w-full">
-      <div className="border w-full overflow-hidden  border-blue-400/40">
+      <div
+        className={cn('border w-full overflow-hidden rounded-sm', tone.border)}
+      >
         <button
           onClick={(e: React.MouseEvent) => {
             e.preventDefault();
             toggle();
           }}
-          title={expanded ? 'Hide plan' : 'Show plan'}
-          className="w-full px-2 py-1.5 flex items-center gap-1.5 text-left bg-blue-50 dark:bg-blue-950/20 text-blue-700 dark:text-blue-300 border-b border-blue-400/40"
+          title={
+            expanded
+              ? t('conversation.planToggle.hide')
+              : t('conversation.planToggle.show')
+          }
+          className={cn(
+            'w-full px-2 py-1.5 flex items-center gap-1.5 text-left border-b',
+            tone.headerBg,
+            tone.headerText,
+            tone.border
+          )}
         >
           <span className=" min-w-0 truncate">
-            <span className="font-semibold">Plan</span>
+            <span className="font-semibold">{t('conversation.plan')}</span>
           </span>
           <div className="ml-auto flex items-center gap-2">
             <ExpandChevron
               expanded={expanded}
               onClick={toggle}
-              variant="system"
+              variant={statusAppearance === 'denied' ? 'error' : 'system'}
             />
           </div>
         </button>
 
         {expanded && (
-          <div className="px-3 py-2 max-h-[65vh] overflow-y-auto overscroll-contain bg-blue-50 dark:bg-blue-950/20">
-            <div className=" text-blue-700 dark:text-blue-300">
+          <div
+            className={cn(
+              'px-3 py-2 max-h-[65vh] overflow-y-auto overscroll-contain',
+              tone.contentBg
+            )}
+          >
+            <div className={cn('text-sm', tone.contentText)}>
               <MarkdownRenderer
                 content={plan}
                 className="whitespace-pre-wrap break-words"
@@ -355,9 +422,26 @@ const ToolCallCard: React.FC<{
   expansionKey: string;
   content?: string;
   entryContent?: string;
-}> = ({ entryType, action, expansionKey, content, entryContent }) => {
+  highlighted?: boolean;
+  defaultExpanded?: boolean;
+  statusAppearance?: ToolStatusAppearance;
+  forceExpanded?: boolean;
+}> = ({
+  entryType,
+  action,
+  expansionKey,
+  content,
+  entryContent,
+  defaultExpanded = false,
+  forceExpanded = false,
+}) => {
+  const { t } = useTranslation('common');
   const at: any = entryType?.action_type || action;
-  const [expanded, toggle] = useExpandable(`tool-entry:${expansionKey}`, false);
+  const [expanded, toggle] = useExpandable(
+    `tool-entry:${expansionKey}`,
+    defaultExpanded
+  );
+  const effectiveExpanded = forceExpanded || expanded;
 
   const label =
     at?.action === 'command_run'
@@ -400,16 +484,18 @@ const ToolCallCard: React.FC<{
           e.preventDefault();
           toggle();
         },
-        title: expanded ? 'Hide details' : 'Show details',
+        title: effectiveExpanded
+          ? t('conversation.toolDetailsToggle.hide')
+          : t('conversation.toolDetailsToggle.show'),
       }
     : {};
 
+  const headerClassName = cn(
+    'w-full flex items-center gap-1.5 text-left text-secondary-foreground'
+  );
   return (
-    <div className="inline-block w-full  flex flex-col gap-4">
-      <HeaderWrapper
-        {...headerProps}
-        className="w-full flex items-center gap-1.5 text-left text-secondary-foreground"
-      >
+    <div className="inline-block w-full flex flex-col gap-4">
+      <HeaderWrapper {...headerProps} className={headerClassName}>
         <span className=" min-w-0 flex items-center gap-1.5">
           {entryType ? (
             <span>
@@ -425,14 +511,14 @@ const ToolCallCard: React.FC<{
         </span>
       </HeaderWrapper>
 
-      {expanded && (
+      {effectiveExpanded && (
         <div className="max-h-[200px] overflow-y-auto border">
           {isCommand ? (
             <>
               {argsText && (
                 <>
                   <div className="font-normal uppercase bg-background border-b border-dashed px-2 py-1">
-                    Args
+                    {t('conversation.args')}
                   </div>
                   <div className="px-2 py-1">{argsText}</div>
                 </>
@@ -441,7 +527,7 @@ const ToolCallCard: React.FC<{
               {output && (
                 <>
                   <div className="font-normal uppercase bg-background border-y border-dashed px-2 py-1">
-                    Output
+                    {t('conversation.output')}
                   </div>
                   <div className="px-2 py-1">
                     <RawLogText content={output} />
@@ -454,13 +540,13 @@ const ToolCallCard: React.FC<{
               {entryType?.action_type.action === 'tool' && (
                 <>
                   <div className="font-normal uppercase bg-background border-b border-dashed px-2 py-1">
-                    Args
+                    {t('conversation.args')}
                   </div>
                   <div className="px-2 py-1">
                     {renderJson(entryType.action_type.arguments)}
                   </div>
                   <div className="font-normal uppercase bg-background border-y border-dashed px-2 py-1">
-                    Result
+                    {t('conversation.result')}
                   </div>
                   <div className="px-2 py-1">
                     {entryType.action_type.result?.type.type === 'markdown' &&
@@ -493,6 +579,17 @@ const LoadingCard = () => {
   );
 };
 
+const isPendingApprovalStatus = (
+  status: ToolStatus
+): status is Extract<ToolStatus, { status: 'pending_approval' }> =>
+  status.status === 'pending_approval';
+
+const getToolStatusAppearance = (status: ToolStatus): ToolStatusAppearance => {
+  if (status.status === 'denied') return 'denied';
+  if (status.status === 'timed_out') return 'timed_out';
+  return 'default';
+};
+
 /*******************
  * Main component  *
  *******************/
@@ -541,10 +638,85 @@ function DisplayConversationEntry({
       />
     );
   }
+  const renderToolUse = () => {
+    if (!isNormalizedEntry(entry)) return null;
 
-  return (
-    <div className="px-4 py-2 text-sm">
-      {isSystem || isError ? (
+    if (entryType.type !== 'tool_use') return null;
+    const toolEntry = entryType;
+
+    const status = toolEntry.status;
+    const statusAppearance = getToolStatusAppearance(status);
+    const isPlanPresentation =
+      toolEntry.action_type.action === 'plan_presentation';
+    const isPendingApproval = status.status === 'pending_approval';
+    const defaultExpanded = isPendingApproval || isPlanPresentation;
+
+    const body = (() => {
+      if (isFileEdit(toolEntry.action_type)) {
+        const fileEditAction = toolEntry.action_type as FileEditAction;
+        return (
+          <div className="space-y-3">
+            {fileEditAction.changes.map((change, idx) => (
+              <FileChangeRenderer
+                key={idx}
+                path={fileEditAction.path}
+                change={change}
+                expansionKey={`edit:${expansionKey}:${idx}`}
+                defaultExpanded={defaultExpanded}
+                statusAppearance={statusAppearance}
+                forceExpanded={isPendingApproval}
+              />
+            ))}
+          </div>
+        );
+      }
+
+      if (toolEntry.action_type.action === 'plan_presentation') {
+        return (
+          <PlanPresentationCard
+            plan={toolEntry.action_type.plan}
+            expansionKey={expansionKey}
+            defaultExpanded={defaultExpanded}
+            statusAppearance={statusAppearance}
+          />
+        );
+      }
+
+      return (
+        <ToolCallCard
+          entryType={toolEntry}
+          expansionKey={expansionKey}
+          entryContent={entry.content}
+          defaultExpanded={defaultExpanded}
+          statusAppearance={statusAppearance}
+          forceExpanded={isPendingApproval}
+        />
+      );
+    })();
+
+    const content = <div className="px-4 py-2 text-sm space-y-3">{body}</div>;
+
+    if (isPendingApprovalStatus(status)) {
+      return (
+        <PendingApprovalEntry
+          pendingStatus={status}
+          executionProcessId={executionProcessId}
+        >
+          {content}
+        </PendingApprovalEntry>
+      );
+    }
+
+    return content;
+  };
+
+  if (isToolUse) {
+    return renderToolUse();
+  }
+
+  if (isSystem || isError) {
+    return (
+      <div className="px-4 py-2 text-sm">
         <CollapsibleEntry
           content={isNormalizedEntry(entry) ? entry.content : ''}
           markdown={shouldRenderMarkdown(entryType)}
@@ -552,47 +724,33 @@ function DisplayConversationEntry({
           variant={isSystem ? 'system' : 'error'}
           contentClassName={getContentClassName(entryType)}
         />
-      ) : isToolUse && isFileEdit(entryType.action_type) ? (
-        // Only FileChangeRenderer for file_edit
-        (() => {
-          const fileEditAction = entryType.action_type as FileEditAction;
-          return fileEditAction.changes.map((change, idx) => (
-            <FileChangeRenderer
-              key={idx}
-              path={fileEditAction.path}
-              change={change}
-              expansionKey={`edit:${expansionKey}:${idx}`}
-            />
-          ));
-        })()
-      ) : isToolUse && entryType.action_type.action === 'plan_presentation' ? (
-        <PlanPresentationCard
-          plan={entryType.action_type.plan}
-          expansionKey={expansionKey}
-        />
-      ) : isToolUse ? (
-        <ToolCallCard
-          entryType={entryType}
-          expansionKey={expansionKey}
-          entryContent={isNormalizedEntry(entry) ? entry.content : ''}
-        />
-      ) : isLoading ? (
+      </div>
+    );
+  }
+
+  if (isLoading) {
+    return (
+      <div className="px-4 py-2 text-sm">
         <LoadingCard />
-      ) : (
-        <div className={getContentClassName(entryType)}>
-          {shouldRenderMarkdown(entryType) ? (
-            <MarkdownRenderer
-              content={isNormalizedEntry(entry) ? entry.content : ''}
-              className="whitespace-pre-wrap break-words flex flex-col gap-1 font-light"
-              enableCopyButton={entryType.type === 'assistant_message'}
-            />
-          ) : isNormalizedEntry(entry) ? (
-            entry.content
-          ) : (
-            ''
-          )}
-        </div>
-      )}
+      </div>
+    );
+  }
+
+  return (
+    <div className="px-4 py-2 text-sm">
+      <div className={getContentClassName(entryType)}>
+        {shouldRenderMarkdown(entryType) ? (
+          <MarkdownRenderer
+            content={isNormalizedEntry(entry) ? entry.content : ''}
+            className="whitespace-pre-wrap break-words flex flex-col gap-1 font-light"
+            enableCopyButton={entryType.type === 'assistant_message'}
+          />
+        ) : isNormalizedEntry(entry) ? (
+          entry.content
+        ) : (
+          ''
+        )}
+      </div>
     </div>
   );
 }
diff --git a/frontend/src/components/NormalizedConversation/EditDiffRenderer.tsx b/frontend/src/components/NormalizedConversation/EditDiffRenderer.tsx
index 5cce45a2..11b3019c 100644
--- a/frontend/src/components/NormalizedConversation/EditDiffRenderer.tsx
+++ b/frontend/src/components/NormalizedConversation/EditDiffRenderer.tsx
@@ -13,12 +13,16 @@ import '@/styles/diff-style-overrides.css';
 import '@/styles/edit-diff-overrides.css';
 import { useDiffViewMode } from '@/stores/useDiffViewStore';
 import DiffViewSwitch from '@/components/diff-view-switch';
+import { cn } from '@/lib/utils';
 
 type Props = {
   path: string;
   unifiedDiff: string;
   hasLineNumbers: boolean;
   expansionKey: string;
+  defaultExpanded?: boolean;
+  statusAppearance?: 'default' | 'denied' | 'timed_out';
+  forceExpanded?: boolean;
 };
 
 /**
@@ -64,9 +68,13 @@ function EditDiffRenderer({
   unifiedDiff,
   hasLineNumbers,
   expansionKey,
+  defaultExpanded = false,
+  statusAppearance = 'default',
+  forceExpanded = false,
 }: Props) {
   const { config } = useUserSystem();
-  const [expanded, setExpanded] = useExpandable(expansionKey, false);
+  const [expanded, setExpanded] = useExpandable(expansionKey, defaultExpanded);
+  const effectiveExpanded = forceExpanded || expanded;
 
   const theme = getActualTheme(config?.theme);
   const globalMode = useDiffViewMode();
@@ -87,9 +95,15 @@ function EditDiffRenderer({
     };
   }, [hunks, path]);
 
+  const headerClass = cn(
+    'flex items-center gap-1.5 text-secondary-foreground',
+    statusAppearance === 'denied' && 'text-red-700 dark:text-red-300',
+    statusAppearance === 'timed_out' && 'text-amber-700 dark:text-amber-200'
+  );
+
   return (
     <div>
-      <div className="flex items-center text-secondary-foreground gap-1.5">
+      <div className={headerClass}>
         <SquarePen className="h-3 w-3" />
         <p
           onClick={() => setExpanded()}
@@ -105,7 +119,7 @@ function EditDiffRenderer({
         </p>
       </div>
 
-      {expanded && (
+      {effectiveExpanded && (
         <div className={'mt-2 border ' + hideLineNumbersClass}>
           <div className="flex items-center justify-end border-b px-2 py-1">
             <DiffViewSwitch />
diff --git a/frontend/src/components/NormalizedConversation/FileChangeRenderer.tsx b/frontend/src/components/NormalizedConversation/FileChangeRenderer.tsx
index 0ff79a56..db3fe1e3 100644
--- a/frontend/src/components/NormalizedConversation/FileChangeRenderer.tsx
+++ b/frontend/src/components/NormalizedConversation/FileChangeRenderer.tsx
@@ -1,17 +1,21 @@
 import { type FileChange } from 'shared/types';
 import { useUserSystem } from '@/components/config-provider';
-import { Trash2, FilePlus2, ArrowRight } from 'lucide-react';
+import { Trash2, FilePlus2, ArrowRight, FileX, FileClock } from 'lucide-react';
 import { getHighLightLanguageFromPath } from '@/utils/extToLanguage';
 import { getActualTheme } from '@/utils/theme';
 import EditDiffRenderer from './EditDiffRenderer';
 import FileContentView from './FileContentView';
 import '@/styles/diff-style-overrides.css';
 import { useExpandable } from '@/stores/useExpandableStore';
+import { cn } from '@/lib/utils';
 
 type Props = {
   path: string;
   change: FileChange;
   expansionKey: string;
+  defaultExpanded?: boolean;
+  statusAppearance?: 'default' | 'denied' | 'timed_out';
+  forceExpanded?: boolean;
 };
 
 function isWrite(
@@ -35,11 +39,38 @@ function isEdit(
   return change?.action === 'edit';
 }
 
-const FileChangeRenderer = ({ path, change, expansionKey }: Props) => {
+const FileChangeRenderer = ({
+  path,
+  change,
+  expansionKey,
+  defaultExpanded = false,
+  statusAppearance = 'default',
+  forceExpanded = false,
+}: Props) => {
   const { config } = useUserSystem();
-  const [expanded, setExpanded] = useExpandable(expansionKey, false);
+  const [expanded, setExpanded] = useExpandable(expansionKey, defaultExpanded);
+  const effectiveExpanded = forceExpanded || expanded;
 
   const theme = getActualTheme(config?.theme);
+  const headerClass = cn('flex items-center gap-1.5 text-secondary-foreground');
+
+  const statusIcon =
+    statusAppearance === 'denied' ? (
+      <FileX className="h-3 w-3" />
+    ) : statusAppearance === 'timed_out' ? (
+      <FileClock className="h-3 w-3" />
+    ) : null;
+
+  if (statusIcon) {
+    return (
+      <div>
+        <div className={headerClass}>
+          {statusIcon}
+          <p className="text-sm font-light overflow-x-auto flex-1">{path}</p>
+        </div>
+      </div>
+    );
+  }
 
   // Edit: delegate to EditDiffRenderer for identical styling and behavior
   if (isEdit(change)) {
@@ -49,6 +80,9 @@ const FileChangeRenderer = ({ path, change, expansionKey }: Props) => {
         unifiedDiff={change.unified_diff}
         hasLineNumbers={change.has_line_numbers}
         expansionKey={expansionKey}
+        defaultExpanded={defaultExpanded}
+        statusAppearance={statusAppearance}
+        forceExpanded={forceExpanded}
       />
     );
   }
@@ -98,7 +132,7 @@ const FileChangeRenderer = ({ path, change, expansionKey }: Props) => {
 
   return (
     <div>
-      <div className="flex items-center text-secondary-foreground gap-1.5">
+      <div className={headerClass}>
         {icon}
         <p
           onClick={() => expandable && setExpanded()}
@@ -109,7 +143,7 @@ const FileChangeRenderer = ({ path, change, expansionKey }: Props) => {
       </div>
 
       {/* Body */}
-      {isWrite(change) && expanded && (
+      {isWrite(change) && effectiveExpanded && (
         <FileContentView
           content={change.content}
           lang={getHighLightLanguageFromPath(path)}
diff --git a/frontend/src/components/NormalizedConversation/PendingApprovalEntry.tsx b/frontend/src/components/NormalizedConversation/PendingApprovalEntry.tsx
new file mode 100644
index 00000000..0798341b
--- /dev/null
+++ b/frontend/src/components/NormalizedConversation/PendingApprovalEntry.tsx
@@ -0,0 +1,269 @@
+import { useEffect, useMemo, useRef, useState } from 'react';
+import type { ReactNode } from 'react';
+import type { ApprovalStatus, ToolStatus } from 'shared/types';
+import { Button } from '@/components/ui/button';
+import {
+  Tooltip,
+  TooltipContent,
+  TooltipProvider,
+  TooltipTrigger,
+} from '@/components/ui/tooltip';
+import { CircularProgress } from '@/components/ui/circular-progress';
+import { approvalsApi } from '@/lib/api';
+import { Check, X } from 'lucide-react';
+import { Textarea } from '@/components/ui/textarea';
+
+const DEFAULT_DENIAL_REASON = 'User denied this tool use request.';
+
+interface PendingApprovalEntryProps {
+  pendingStatus: Extract<ToolStatus, { status: 'pending_approval' }>;
+  executionProcessId?: string;
+  children: ReactNode;
+}
+
+function formatSeconds(s: number) {
+  if (s <= 0) return '0s';
+  const m = Math.floor(s / 60);
+  const rem = s % 60;
+  return m > 0 ? `${m}m ${rem}s` : `${rem}s`;
+}
+
+const PendingApprovalEntry = ({
+  pendingStatus,
+  executionProcessId,
+  children,
+}: PendingApprovalEntryProps) => {
+  const [timeLeft, setTimeLeft] = useState<number>(() => {
+    const remaining = new Date(pendingStatus.timeout_at).getTime() - Date.now();
+    return Math.max(0, Math.floor(remaining / 1000));
+  });
+  const [isResponding, setIsResponding] = useState(false);
+  const [hasResponded, setHasResponded] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [isEnteringReason, setIsEnteringReason] = useState(false);
+  const [denyReason, setDenyReason] = useState('');
+  const abortRef = useRef<AbortController | null>(null);
+  const denyReasonRef = useRef<HTMLTextAreaElement | null>(null);
+
+  const percent = useMemo(() => {
+    const total = Math.max(
+      1,
+      Math.floor(
+        (new Date(pendingStatus.timeout_at).getTime() -
+          new Date(pendingStatus.requested_at).getTime()) /
+          1000
+      )
+    );
+    return Math.max(0, Math.min(100, Math.round((timeLeft / total) * 100)));
+  }, [pendingStatus.requested_at, pendingStatus.timeout_at, timeLeft]);
+
+  useEffect(() => {
+    if (hasResponded) return;
+
+    const id = window.setInterval(() => {
+      const remaining =
+        new Date(pendingStatus.timeout_at).getTime() - Date.now();
+      const next = Math.max(0, Math.floor(remaining / 1000));
+      setTimeLeft(next);
+      if (next <= 0) {
+        window.clearInterval(id);
+      }
+    }, 1000);
+
+    return () => window.clearInterval(id);
+  }, [pendingStatus.timeout_at, hasResponded]);
+
+  useEffect(() => () => abortRef.current?.abort(), []);
+
+  const disabled = isResponding || hasResponded || timeLeft <= 0;
+
+  const respond = async (approved: boolean, reason?: string) => {
+    if (disabled) return;
+    if (!executionProcessId) {
+      setError('Missing executionProcessId');
+      return;
+    }
+
+    setIsResponding(true);
+    setError(null);
+    const controller = new AbortController();
+    abortRef.current = controller;
+
+    const status: ApprovalStatus = approved
+      ? { status: 'approved' }
+      : { status: 'denied', reason };
+
+    try {
+      await approvalsApi.respond(
+        pendingStatus.approval_id,
+        {
+          execution_process_id: executionProcessId,
+          status,
+        },
+        controller.signal
+      );
+
+      setHasResponded(true);
+      setIsEnteringReason(false);
+      setDenyReason('');
+    } catch (e: any) {
+      console.error('Approval respond failed:', e);
+      setError(e?.message || 'Failed to send response');
+    } finally {
+      setIsResponding(false);
+    }
+  };
+
+  const handleApprove = () => respond(true);
+  const handleStartDeny = () => {
+    if (disabled) return;
+    setError(null);
+    setIsEnteringReason(true);
+  };
+
+  const handleCancelDeny = () => {
+    if (isResponding) return;
+    setIsEnteringReason(false);
+    setDenyReason('');
+  };
+
+  const handleSubmitDeny = () => {
+    const trimmed = denyReason.trim();
+    respond(false, trimmed || DEFAULT_DENIAL_REASON);
+  };
+
+  useEffect(() => {
+    if (!hasResponded) return;
+  }, [hasResponded]);
+
+  useEffect(() => {
+    if (!isEnteringReason) return;
+    const id = window.setTimeout(() => denyReasonRef.current?.focus(), 0);
+    return () => window.clearTimeout(id);
+  }, [isEnteringReason]);
+
+  return (
+    <div className="relative mt-3">
+      <div className="absolute -top-3 left-4 rounded-full border bg-background px-2 py-0.5 text-[10px] font-semibold uppercase tracking-wide shadow-sm">
+        Awaiting approval
+      </div>
+      <div className="overflow-hidden border">
+        {children}
+        <div className="border-t bg-background px-2 py-1.5 text-xs sm:text-sm">
+          <TooltipProvider>
+            <div className="flex items-center justify-between gap-1.5">
+              <div className="flex items-center gap-1.5 pl-4">
+                {!isEnteringReason && (
+                  <>
+                    <Tooltip>
+                      <TooltipTrigger asChild>
+                        <Button
+                          onClick={handleApprove}
+                          variant="ghost"
+                          className="h-8 w-8 rounded-full p-0"
+                          disabled={disabled}
+                          aria-label={
+                            isResponding ? 'Submitting approval' : 'Approve'
+                          }
+                        >
+                          <Check className="h-5 w-5" />
+                        </Button>
+                      </TooltipTrigger>
+                      <TooltipContent>
+                        <p>
+                          {isResponding ? 'Submitting…' : 'Approve request'}
+                        </p>
+                      </TooltipContent>
+                    </Tooltip>
+                    <Tooltip>
+                      <TooltipTrigger asChild>
+                        <Button
+                          onClick={handleStartDeny}
+                          variant="ghost"
+                          className="h-8 w-8 rounded-full p-0"
+                          disabled={disabled}
+                          aria-label={
+                            isResponding ? 'Submitting denial' : 'Deny'
+                          }
+                        >
+                          <X className="h-5 w-5" />
+                        </Button>
+                      </TooltipTrigger>
+                      <TooltipContent>
+                        <p>
+                          {isResponding
+                            ? 'Submitting…'
+                            : 'Provide denial reason'}
+                        </p>
+                      </TooltipContent>
+                    </Tooltip>
+                  </>
+                )}
+              </div>
+              {!isEnteringReason && !hasResponded && timeLeft > 0 && (
+                <Tooltip>
+                  <TooltipTrigger asChild>
+                    <div className="flex items-center pr-8">
+                      <CircularProgress percent={percent} />
+                    </div>
+                  </TooltipTrigger>
+                  <TooltipContent>
+                    <p>{formatSeconds(timeLeft)} remaining</p>
+                  </TooltipContent>
+                </Tooltip>
+              )}
+            </div>
+            {error && <div className="mt-1 text-xs text-red-600">{error}</div>}
+            {isEnteringReason && !hasResponded && (
+              <div className="mt-3 bg-background px-3 py-3 text-sm">
+                <Textarea
+                  ref={denyReasonRef}
+                  value={denyReason}
+                  onChange={(e) => {
+                    setDenyReason(e.target.value);
+                  }}
+                  placeholder="Let the agent know why this request was denied..."
+                  disabled={isResponding}
+                  className="text-sm"
+                />
+                <div className="mt-3 flex flex-wrap items-center justify-between gap-2">
+                  <div className="flex items-center gap-2">
+                    <Button
+                      variant="ghost"
+                      size="sm"
+                      onClick={handleCancelDeny}
+                      disabled={isResponding}
+                    >
+                      Cancel
+                    </Button>
+                    <Button
+                      size="sm"
+                      onClick={handleSubmitDeny}
+                      disabled={isResponding}
+                    >
+                      Submit denial
+                    </Button>
+                  </div>
+                  {!hasResponded && timeLeft > 0 && (
+                    <Tooltip>
+                      <TooltipTrigger asChild>
+                        <div className="flex items-center pr-2">
+                          <CircularProgress percent={percent} />
+                        </div>
+                      </TooltipTrigger>
+                      <TooltipContent>
+                        <p>{formatSeconds(timeLeft)} remaining</p>
+                      </TooltipContent>
+                    </Tooltip>
+                  )}
+                </div>
+              </div>
+            )}
+          </TooltipProvider>
+        </div>
+      </div>
+    </div>
+  );
+};
+
+export default PendingApprovalEntry;
diff --git a/frontend/src/components/logs/VirtualizedList.tsx b/frontend/src/components/logs/VirtualizedList.tsx
index 47589ad9..4a180b4f 100644
--- a/frontend/src/components/logs/VirtualizedList.tsx
+++ b/frontend/src/components/logs/VirtualizedList.tsx
@@ -6,7 +6,8 @@ import {
   VirtuosoMessageListMethods,
   VirtuosoMessageListProps,
 } from '@virtuoso.dev/message-list';
-import { useEffect, useRef, useState } from 'react';
+import { useEffect, useMemo, useRef, useState } from 'react';
+
 import DisplayConversationEntry from '../NormalizedConversation/DisplayConversationEntry';
 import { useEntries } from '@/contexts/EntriesContext';
 import {
@@ -14,8 +15,8 @@ import {
   PatchTypeWithKey,
   useConversationHistory,
 } from '@/hooks/useConversationHistory';
-import { TaskAttempt } from 'shared/types';
 import { Loader2 } from 'lucide-react';
+import { TaskAttempt } from 'shared/types';
 
 interface VirtualizedListProps {
   attempt: TaskAttempt;
@@ -25,56 +26,59 @@ interface MessageListContext {
   attempt: TaskAttempt;
 }
 
-type ChannelData = DataWithScrollModifier<PatchTypeWithKey> | null;
+const INITIAL_TOP_ITEM = { index: 'LAST' as const, align: 'end' as const };
 
 const InitialDataScrollModifier: ScrollModifier = {
   type: 'item-location',
-  location: {
-    index: 'LAST',
-    align: 'end',
-  },
+  location: INITIAL_TOP_ITEM,
   purgeItemSizes: true,
 };
 
 const AutoScrollToBottom: ScrollModifier = {
   type: 'auto-scroll-to-bottom',
-  autoScroll: ({ atBottom, scrollInProgress }) => {
-    if (atBottom || scrollInProgress) {
-      return 'smooth';
-    }
-    return false;
-  },
+  autoScroll: 'smooth',
 };
 
 const ItemContent: VirtuosoMessageListProps<
   PatchTypeWithKey,
   MessageListContext
 >['ItemContent'] = ({ data, context }) => {
+  const attempt = context?.attempt;
+
   if (data.type === 'STDOUT') {
     return <p>{data.content}</p>;
-  } else if (data.type === 'STDERR') {
+  }
+  if (data.type === 'STDERR') {
     return <p>{data.content}</p>;
-  } else if (data.type === 'NORMALIZED_ENTRY') {
+  }
+  if (data.type === 'NORMALIZED_ENTRY' && attempt) {
     return (
       <DisplayConversationEntry
-        key={data.patchKey}
         expansionKey={data.patchKey}
         entry={data.content}
         executionProcessId={data.executionProcessId}
-        taskAttempt={context.attempt}
+        taskAttempt={attempt}
       />
     );
   }
+
+  return null;
 };
 
+const computeItemKey: VirtuosoMessageListProps<
+  PatchTypeWithKey,
+  MessageListContext
+>['computeItemKey'] = ({ data }) => `l-${data.patchKey}`;
+
 const VirtualizedList = ({ attempt }: VirtualizedListProps) => {
-  const [channelData, setChannelData] = useState<ChannelData>(null);
+  const [channelData, setChannelData] =
+    useState<DataWithScrollModifier<PatchTypeWithKey> | null>(null);
   const [loading, setLoading] = useState(true);
   const { setEntries, reset } = useEntries();
 
-  // When attempt changes, set loading and reset entries
   useEffect(() => {
     setLoading(true);
+    setChannelData(null);
     reset();
   }, [attempt.id, reset]);
 
@@ -83,7 +87,6 @@ const VirtualizedList = ({ attempt }: VirtualizedListProps) => {
     addType: AddEntryType,
     newLoading: boolean
   ) => {
-    // initial defaults to scrolling to the latest
     let scrollModifier: ScrollModifier = InitialDataScrollModifier;
 
     if (addType === 'running' && !loading) {
@@ -91,14 +94,17 @@ const VirtualizedList = ({ attempt }: VirtualizedListProps) => {
     }
 
     setChannelData({ data: newEntries, scrollModifier });
-    setEntries(newEntries); // Update shared context
+    setEntries(newEntries);
+
     if (loading) {
       setLoading(newLoading);
     }
   };
+
   useConversationHistory({ attempt, onEntriesUpdated });
 
   const messageListRef = useRef<VirtuosoMessageListMethods | null>(null);
+  const messageListContext = useMemo(() => ({ attempt }), [attempt]);
 
   return (
     <>
@@ -109,12 +115,12 @@ const VirtualizedList = ({ attempt }: VirtualizedListProps) => {
           ref={messageListRef}
           className="flex-1"
           data={channelData}
-          context={{ attempt }}
-          itemIdentity={(item) => item.patchKey}
-          computeItemKey={({ data }) => data.patchKey}
+          initialLocation={INITIAL_TOP_ITEM}
+          context={messageListContext}
+          computeItemKey={computeItemKey}
           ItemContent={ItemContent}
-          Header={() => <div className="h-2"></div>} // Padding
-          Footer={() => <div className="h-2"></div>} // Padding
+          Header={() => <div className="h-2"></div>}
+          Footer={() => <div className="h-2"></div>}
         />
       </VirtuosoMessageListLicense>
       {loading && (
diff --git a/frontend/src/components/ui/circular-progress.tsx b/frontend/src/components/ui/circular-progress.tsx
new file mode 100644
index 00000000..316e362a
--- /dev/null
+++ b/frontend/src/components/ui/circular-progress.tsx
@@ -0,0 +1,41 @@
+import * as React from 'react';
+
+interface CircularProgressProps {
+  percent: number;
+}
+
+export const CircularProgress: React.FC<CircularProgressProps> = ({
+  percent,
+}) => {
+  const size = 24;
+  const strokeWidth = 2;
+  const radius = (size - strokeWidth) / 2;
+  const circumference = 2 * Math.PI * radius;
+  const strokeDashoffset = circumference - (percent / 100) * circumference;
+
+  return (
+    <svg width={size} height={size} className="transform -rotate-90">
+      <circle
+        cx={size / 2}
+        cy={size / 2}
+        r={radius}
+        stroke="currentColor"
+        strokeWidth={strokeWidth}
+        fill="none"
+        className="text-muted-foreground/20"
+      />
+      <circle
+        cx={size / 2}
+        cy={size / 2}
+        r={radius}
+        stroke="currentColor"
+        strokeWidth={strokeWidth}
+        fill="none"
+        strokeDasharray={circumference}
+        strokeDashoffset={strokeDashoffset}
+        className="text-muted-foreground transition-all duration-1000 ease-linear"
+        strokeLinecap="round"
+      />
+    </svg>
+  );
+};
diff --git a/frontend/src/components/ui/tooltip.tsx b/frontend/src/components/ui/tooltip.tsx
index 5a57afdd..bbdbf88b 100644
--- a/frontend/src/components/ui/tooltip.tsx
+++ b/frontend/src/components/ui/tooltip.tsx
@@ -13,15 +13,17 @@ const TooltipContent = React.forwardRef<
   React.ElementRef<typeof TooltipPrimitive.Content>,
   React.ComponentPropsWithoutRef<typeof TooltipPrimitive.Content>
 >(({ className, sideOffset = 4, ...props }, ref) => (
-  <TooltipPrimitive.Content
-    ref={ref}
-    sideOffset={sideOffset}
-    className={cn(
-      'z-50 overflow-hidden rounded-md border bg-popover px-3 py-1.5 text-sm text-popover-foreground shadow-md animate-in fade-in-0 zoom-in-95 data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=closed]:zoom-out-95 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2 origin-[--radix-tooltip-content-transform-origin]',
-      className
-    )}
-    {...props}
-  />
+  <TooltipPrimitive.Portal>
+    <TooltipPrimitive.Content
+      ref={ref}
+      sideOffset={sideOffset}
+      className={cn(
+        'z-50 overflow-hidden rounded-md border bg-popover px-3 py-1.5 text-sm text-popover-foreground shadow-md animate-in fade-in-0 zoom-in-95 data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=closed]:zoom-out-95 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2 origin-[--radix-tooltip-content-transform-origin]',
+        className
+      )}
+      {...props}
+    />
+  </TooltipPrimitive.Portal>
 ));
 TooltipContent.displayName = TooltipPrimitive.Content.displayName;
 
diff --git a/frontend/src/hooks/useConversationHistory.ts b/frontend/src/hooks/useConversationHistory.ts
index 3f7a09c4..5662c9de 100644
--- a/frontend/src/hooks/useConversationHistory.ts
+++ b/frontend/src/hooks/useConversationHistory.ts
@@ -6,6 +6,7 @@ import {
   NormalizedEntry,
   PatchType,
   TaskAttempt,
+  ToolStatus,
 } from 'shared/types';
 import { useExecutionProcesses } from './useExecutionProcesses';
 import { useEffect, useMemo, useRef } from 'react';
@@ -273,13 +274,22 @@ export const useConversationHistory = ({
             p.executionProcess.id
           );
 
+          const exitCode = Number(executionProcess?.exit_code) || 0;
           const exit_status: CommandExitStatus | null =
             executionProcess?.status === 'running'
               ? null
               : {
                   type: 'exit_code',
-                  code: Number(executionProcess?.exit_code) || 0,
+                  code: exitCode,
                 };
+
+          const toolStatus: ToolStatus =
+            executionProcess?.status === 'running'
+              ? { status: 'created' }
+              : exitCode === 0
+                ? { status: 'success' }
+                : { status: 'failed' };
+
           const output = p.entries.map((line) => line.content).join('\n');
 
           const toolNormalizedEntry: NormalizedEntry = {
@@ -294,6 +304,7 @@ export const useConversationHistory = ({
                   exit_status,
                 },
               },
+              status: toolStatus,
             },
             content: toolName,
             timestamp: null,
diff --git a/frontend/src/i18n/locales/en/common.json b/frontend/src/i18n/locales/en/common.json
index 4028b006..4c1efd5a 100644
--- a/frontend/src/i18n/locales/en/common.json
+++ b/frontend/src/i18n/locales/en/common.json
@@ -21,5 +21,19 @@
     "en": "English",
     "ja": "日本語",
     "browserDefault": "Browser Default"
+  },
+  "conversation": {
+    "plan": "Plan",
+    "planToggle": {
+      "show": "Show plan",
+      "hide": "Hide plan"
+    },
+    "toolDetailsToggle": {
+      "show": "Show details",
+      "hide": "Hide details"
+    },
+    "args": "Args",
+    "output": "Output",
+    "result": "Result"
   }
 }
diff --git a/frontend/src/i18n/locales/ja/common.json b/frontend/src/i18n/locales/ja/common.json
index e67124a0..06418603 100644
--- a/frontend/src/i18n/locales/ja/common.json
+++ b/frontend/src/i18n/locales/ja/common.json
@@ -21,5 +21,19 @@
     "en": "English",
     "ja": "日本語",
     "browserDefault": "ブラウザ設定"
+  },
+  "conversation": {
+    "plan": "計画",
+    "planToggle": {
+      "show": "計画を表示",
+      "hide": "計画を非表示"
+    },
+    "toolDetailsToggle": {
+      "show": "詳細を表示",
+      "hide": "詳細を非表示"
+    },
+    "args": "引数",
+    "output": "出力",
+    "result": "結果"
   }
 }
diff --git a/frontend/src/lib/api.ts b/frontend/src/lib/api.ts
index 6302a3c3..7cc9fe36 100644
--- a/frontend/src/lib/api.ts
+++ b/frontend/src/lib/api.ts
@@ -1,6 +1,7 @@
 // Import all necessary types from shared types
 
 import {
+  ApprovalStatus,
   ApiResponse,
   BranchStatus,
   CheckTokenResponse,
@@ -41,6 +42,7 @@ import {
   FollowUpDraftResponse,
   UpdateFollowUpDraftRequest,
   GitOperationError,
+  ApprovalResponse,
 } from 'shared/types';
 
 // Re-export types for convenience
@@ -795,3 +797,21 @@ export const imagesApi = {
     return `/api/images/${imageId}/file`;
   },
 };
+
+// Approval API
+export const approvalsApi = {
+  respond: async (
+    approvalId: string,
+    payload: ApprovalResponse,
+    signal?: AbortSignal
+  ): Promise<ApprovalStatus> => {
+    const res = await makeRequest(`/api/approvals/${approvalId}/respond`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify(payload),
+      signal,
+    });
+
+    return handleApiResponse<ApprovalStatus>(res);
+  },
+};
diff --git a/shared/schemas/claude_code.json b/shared/schemas/claude_code.json
index db0e4e01..a28fabf0 100644
--- a/shared/schemas/claude_code.json
+++ b/shared/schemas/claude_code.json
@@ -23,6 +23,12 @@
         "null"
       ]
     },
+    "approvals": {
+      "type": [
+        "boolean",
+        "null"
+      ]
+    },
     "model": {
       "type": [
         "string",
diff --git a/shared/types.ts b/shared/types.ts
index 05092113..6a211b0f 100644
--- a/shared/types.ts
+++ b/shared/types.ts
@@ -148,7 +148,7 @@ export type ExecutorConfig = { [key in string]?: { "CLAUDE_CODE": ClaudeCode } |
 
 export type BaseAgentCapability = "SESSION_FORK";
 
-export type ClaudeCode = { append_prompt: AppendPrompt, claude_code_router?: boolean | null, plan?: boolean | null, model?: string | null, dangerously_skip_permissions?: boolean | null, base_command_override?: string | null, additional_params?: Array<string> | null, };
+export type ClaudeCode = { append_prompt: AppendPrompt, claude_code_router?: boolean | null, plan?: boolean | null, approvals?: boolean | null, model?: string | null, dangerously_skip_permissions?: boolean | null, base_command_override?: string | null, additional_params?: Array<string> | null, };
 
 export type Gemini = { append_prompt: AppendPrompt, model: GeminiModel, yolo?: boolean | null, base_command_override?: string | null, additional_params?: Array<string> | null, };
 
@@ -274,7 +274,7 @@ export type CommandRunResult = { exit_status: CommandExitStatus | null, output:
 
 export type NormalizedEntry = { timestamp: string | null, entry_type: NormalizedEntryType, content: string, };
 
-export type NormalizedEntryType = { "type": "user_message" } | { "type": "assistant_message" } | { "type": "tool_use", tool_name: string, action_type: ActionType, } | { "type": "system_message" } | { "type": "error_message" } | { "type": "thinking" } | { "type": "loading" };
+export type NormalizedEntryType = { "type": "user_message" } | { "type": "assistant_message" } | { "type": "tool_use", tool_name: string, action_type: ActionType, status: ToolStatus, } | { "type": "system_message" } | { "type": "error_message" } | { "type": "thinking" } | { "type": "loading" };
 
 export type FileChange = { "action": "write", content: string, } | { "action": "delete" } | { "action": "rename", new_path: string, } | { "action": "edit", 
 /**
@@ -298,6 +298,14 @@ value: JsonValue, };
 
 export type ToolResultValueType = { "type": "markdown" } | { "type": "json" };
 
+export type ToolStatus = { "status": "created" } | { "status": "success" } | { "status": "failed" } | { "status": "denied", reason: string | null, } | { "status": "pending_approval", approval_id: string, requested_at: string, timeout_at: string, } | { "status": "timed_out" };
+
 export type PatchType = { "type": "NORMALIZED_ENTRY", "content": NormalizedEntry } | { "type": "STDOUT", "content": string } | { "type": "STDERR", "content": string } | { "type": "DIFF", "content": Diff };
 
+export type ApprovalStatus = { "status": "pending" } | { "status": "approved" } | { "status": "denied", reason?: string, } | { "status": "timed_out" };
+
+export type CreateApprovalRequest = { tool_name: string, tool_input: JsonValue, session_id: string, };
+
+export type ApprovalResponse = { execution_process_id: string, status: ApprovalStatus, };
+
 export type JsonValue = number | string | boolean | Array<JsonValue> | { [key in string]?: JsonValue } | null;
\ No newline at end of file