diff --git a/.story_kit/work/1_upcoming/146_bug_permission_approval_still_returns_wrong_format_needs_updatedinput_not_behavior_allow.md b/.story_kit/work/1_upcoming/146_bug_permission_approval_still_returns_wrong_format_needs_updatedinput_not_behavior_allow.md
new file mode 100644
index 0000000..732ebe9
--- /dev/null
+++ b/.story_kit/work/1_upcoming/146_bug_permission_approval_still_returns_wrong_format_needs_updatedinput_not_behavior_allow.md
@@ -0,0 +1,29 @@
+---
+name: "Permission approval still returns wrong format - needs updatedInput not behavior allow"
+---
+
+# Bug 146: Permission approval still returns wrong format - needs updatedInput not behavior allow
+
+## Description
+
+Bug 130 changed prompt_permission from plain text to JSON, but used the wrong format. Claude Code permission-prompt-tool expects a union type: Approve = {updatedInput: {original tool input}}, Deny = {behavior: deny, message: string}. Current code at server/src/http/mcp.rs line 1642 returns {behavior: allow} which matches neither variant. Fix: change json!({behavior: allow}) to json!({updatedInput: tool_input}) where tool_input is already captured at line 1613. Also update the test at line 3076.
+
+## How to Reproduce
+
+1. Start server and open web UI
+2. Chat with claude-code-pty agent
+3. Ask it to do something requiring permission
+4. Approve the permission dialog
+5. Tool fails with Zod validation error about invalid_union
+
+## Actual Result
+
+prompt_permission returns behavior:allow on approval. Claude Code expects updatedInput with original input to approve.
+
+## Expected Result
+
+On approval, prompt_permission should return updatedInput containing the original tool input object.
+
+## Acceptance Criteria
+
+- [ ] Bug is fixed and verified