diff --git a/.story_kit/work/1_upcoming/91_bug_permissions_dialog_never_triggers_in_web_ui.md b/.story_kit/work/1_upcoming/91_bug_permissions_dialog_never_triggers_in_web_ui.md
new file mode 100644
index 0000000..6675c54
--- /dev/null
+++ b/.story_kit/work/1_upcoming/91_bug_permissions_dialog_never_triggers_in_web_ui.md
@@ -0,0 +1,33 @@
+---
+name: "Permissions dialog never triggers in web UI"
+test_plan: pending
+---
+
+# Bug 91: Permissions dialog never triggers in web UI
+
+## Description
+
+The web UI permissions dialog has never successfully triggered. Claude Code in `-p` (pipe) mode is missing two critical CLI flags: `--input-format stream-json` (so it reads permission responses from stdin) and `--permission-mode default` (so it actually emits permission_request events instead of auto-approving). Without these, the full permission channel wiring (PTY → WebSocket → React dialog → WebSocket → PTY) is never exercised.
+
+## How to Reproduce
+
+1. Start the story-kit server
+2. Open the web UI and select claude-code-pty as the model
+3. Send a message that triggers a tool requiring permission (e.g. "run `ls` in the terminal")
+4. Observe that no permission dialog appears — the tool executes automatically
+
+## Actual Result
+
+Claude Code auto-approves all tool use. No `permission_request` NDJSON event is emitted, so the frontend dialog never renders.
+
+## Expected Result
+
+A permission dialog should appear in the web UI showing the tool name and input, with Approve/Deny buttons. The user's response should be sent back to Claude Code via stdin.
+
+## Acceptance Criteria
+
+- [ ] Add --input-format stream-json to the claude CLI invocation in run_pty_session so Claude Code reads permission responses from stdin
+- [ ] Add --permission-mode default to the claude CLI invocation so Claude Code emits permission_request events instead of auto-approving
+- [ ] Trigger a tool use via the web UI and confirm the permission dialog appears
+- [ ] Approve a permission request and confirm Claude Code proceeds with the tool
+- [ ] Deny a permission request and confirm Claude Code skips the tool