diff --git a/server/src/http/mcp.rs b/server/src/http/mcp.rs
index f679d18..0a25639 100644
--- a/server/src/http/mcp.rs
+++ b/server/src/http/mcp.rs
@@ -1617,6 +1617,7 @@ async fn tool_prompt_permission(args: &Value, ctx: &AppContext) -> Result<String
     let request_id = uuid::Uuid::new_v4().to_string();
     let (response_tx, response_rx) = tokio::sync::oneshot::channel();
 
+    let tool_input_copy = tool_input.clone();
     ctx.perm_tx
         .send(crate::http::context::PermissionForward {
             request_id: request_id.clone(),
@@ -1639,7 +1640,7 @@ async fn tool_prompt_permission(args: &Value, ctx: &AppContext) -> Result<String
     .map_err(|_| "Permission response channel closed unexpectedly".to_string())?;
 
     if approved {
-        Ok(json!({"behavior": "allow"}).to_string())
+        Ok(json!({"updatedInput": tool_input_copy}).to_string())
     } else {
         slog_warn!("[permission] User denied permission for '{tool_name}'");
         Ok(json!({
@@ -3052,7 +3053,7 @@ mod tests {
     }
 
     #[tokio::test]
-    async fn tool_prompt_permission_approved_returns_allow_json() {
+    async fn tool_prompt_permission_approved_returns_updated_input_json() {
         let tmp = tempfile::tempdir().unwrap();
         let ctx = test_ctx(tmp.path());
 
@@ -3073,7 +3074,10 @@ mod tests {
         .expect("should succeed on approval");
 
         let parsed: Value = serde_json::from_str(&result).expect("result should be valid JSON");
-        assert_eq!(parsed["behavior"], "allow", "approved must return behavior:allow");
+        assert_eq!(
+            parsed["updatedInput"]["command"], "echo hello",
+            "approved must return updatedInput with original tool input"
+        );
     }
 
     #[tokio::test]