diff --git a/CLAUDE.md b/CLAUDE.md
index 9c9be2d..3179811 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -1,4 +1,6 @@
 不允许假设“这是未来需要扩展的”，所以现在就不做，应该贴合用户的实际要求
 不允许总是有阶段性计划，分阶段完成很容易导致过程产生一堆没用的死代码
 不许兼容、兜底旧代码
-每次执行完以后都要补充测试文件确保实际行为与预期相符
\ No newline at end of file
+每次执行完以后都要补充测试文件确保实际行为与预期相符
+所有的测试文件只能写在test文件夹下
+修改过程中发现错误，如果是本次范围就修改，否则要在最后指出
\ No newline at end of file
diff --git a/README.md b/README.md
index 22c5cf7..5f86eef 100644
--- a/README.md
+++ b/README.md
@@ -156,13 +156,27 @@ interface ToolDefinition {
 
 在 `cli.ts` 中向 `ToolRegistry` 注册新工具即可——Agent 会自动将其描述传给 LLM，LLM 即可调用。
 
-### 沙箱
+### 沙箱隔离 (可选)
 
-所有工具执行经过 `DefaultSandbox` 过滤：
-- **路径白名单**: 限制文件读写范围
-- **命令过滤**: 阻止危险命令 (`rm -rf /`, `dd`, `mkfs`, fork bomb, `shutdown`, `reboot`)
-- **敏感路径保护**: `/etc/passwd`, `/etc/shadow`, `~/.ssh`, `~/.gnupg` 等不可访问
-- **超时控制**: 每个工具独立超时
+所有工具执行经过两层安全保护：
+
+**审批流水线**（始终生效）：六层决策链——规则引擎（硬 deny，如 `rm -rf /`）→ 只读白名单 → 权限模式 → 钩子策略 → 用户确认 → 审计日志。不需要额外安装，开箱即用。
+
+**OS 级沙箱**（可选，需安装 `@anthropic-ai/sandbox-runtime`）：
+
+```bash
+npm install -g @anthropic-ai/sandbox-runtime
+```
+
+安装后的增强能力：
+
+| 能力 | 说明 |
+|---|---|
+| **文件系统隔离** | 基于 bubblewrap (Linux) / sandbox-exec (macOS) 的 mount namespace，Bash 命令只能看到项目目录，`/etc`、`/home` 等不可见 |
+| **网络隔离** | 内置 HTTP/SOCKS 代理，只允许白名单域名通过，IP 地址直连被拦截 |
+| **防绕过** | 即使 prompt injection 让模型生成 `cat /etc/shadow`，沙箱层会拒绝——文件在 OS 层不可见，不依赖字符串匹配 |
+
+不安装不影响使用——审批流水线独立运行，同样能拦截危险命令。沙箱只是多一层 OS 级防御，防止绕过应用层检查的攻击。
 
 ---
 
diff --git a/packages/codingcode/package.json b/packages/codingcode/package.json
index b67a772..f4b5d72 100644
--- a/packages/codingcode/package.json
+++ b/packages/codingcode/package.json
@@ -4,6 +4,9 @@
   "type": "module",
   "main": "./src/index.ts",
   "exports": { ".": "./src/index.ts" },
+  "optionalDependencies": {
+    "@anthropic-ai/sandbox-runtime": "^1.0.0"
+  },
   "dependencies": {
     "@ai-sdk/deepseek": "^2.0.35",
     "@ai-sdk/openai": "^3.0.63",
diff --git a/packages/codingcode/src/agent/agent.ts b/packages/codingcode/src/agent/agent.ts
index 8f8dc28..e532b43 100644
--- a/packages/codingcode/src/agent/agent.ts
+++ b/packages/codingcode/src/agent/agent.ts
@@ -2,9 +2,12 @@ import { Effect } from 'effect';
 import type { Message, ToolCall } from '../core/types.js';
 import { AgentError } from '../core/error.js';
 import { Result } from '../core/result.js';
-import type { AgentConfig, AgentEvent } from './types.js';
-import { resolveConfig, type ResolvedConfig } from './config.js';
+import type { AgentEvent } from '../bus/types.js';
 import type { ToolDescription } from '../tools/types.js';
+import { ToolService } from '../tools/registry.js';
+import { ToolExecutorService } from '../tools/executor.js';
+import { buildSystemPrompt } from '../prompts/index.js';
+import { resolveConfig } from './config.js';
 
 interface LLMStreamAdapter {
   completeStream(params: {
@@ -18,55 +21,77 @@ interface LLMStreamAdapter {
   };
 }
 
-interface ToolExecutorAdapter {
-  execute(name: string, args: Record<string, unknown>, opts?: { signal?: AbortSignal }): Effect.Effect<string, AgentError>;
-  getRegistry(): {
-    describeAll(): Array<{ name: string; description: string; schema: Record<string, unknown> }>;
-    filter(names: string[]): Array<{ name: string; description: string; schema: Record<string, unknown> }>;
-  };
+type ToolResultUnion =
+  | { type: 'ok'; id: string; name: string; output: string }
+  | { type: 'denied'; id: string; name: string; reason: string }
+  | { type: 'error'; id: string; name: string; output: string };
+
+function execTool(executor: ToolExecutorService, tc: ToolCall): Effect.Effect<ToolResultUnion> {
+  return executor.execute(tc.name, tc.arguments ?? {}).pipe(
+    Effect.matchEffect({
+      onSuccess: (output): Effect.Effect<ToolResultUnion> =>
+        Effect.succeed({ type: 'ok' as const, id: tc.id, name: tc.name, output }),
+      onFailure: (err): Effect.Effect<ToolResultUnion> => {
+        if (err instanceof AgentError && err.code === 'TOOL_NOT_ALLOWED') {
+          return Effect.succeed({ type: 'denied' as const, id: tc.id, name: tc.name, reason: err.message });
+        }
+        const code = err instanceof AgentError ? err.code : 'TOOL_EXECUTION_FAILED';
+        const msg = err instanceof AgentError ? err.message : String(err);
+        return Effect.succeed({ type: 'error' as const, id: tc.id, name: tc.name, output: `[Error: ${code}] ${msg}` });
+      },
+    }),
+    Effect.catchAllDefect((defect) =>
+      Effect.succeed({ type: 'error' as const, id: tc.id, name: tc.name, output: `[Unexpected] ${String(defect)}` }),
+    ),
+  );
 }
 
 export class AgentService extends Effect.Service<AgentService>()('Agent', {
   effect: Effect.gen(function* () {
-    let config: ResolvedConfig = resolveConfig({});
+    const executor = yield* ToolExecutorService;
+    const toolRegistry = yield* ToolService;
+    const maxSteps = resolveConfig().maxSteps;
+    let skillInstruction: string | undefined;
 
     return {
-      init: (cfg: AgentConfig): Effect.Effect<void> =>
-        Effect.sync(() => { config = resolveConfig(cfg); }),
+      setSkillInstruction: (instruction: string): void => {
+        skillInstruction = instruction;
+      },
 
       runStream: (
         messages: Message[],
         llm: LLMStreamAdapter,
-        executor: ToolExecutorAdapter,
       ): AsyncGenerator<AgentEvent, Result<string, AgentError>, unknown> =>
-        runReActLoop(messages, config, llm, executor),
+        runReActLoop(messages, maxSteps, skillInstruction, llm, executor, toolRegistry),
     };
   }),
 }) {}
 
 export async function* runReActLoop(
   initialMessages: Message[],
-  config: ResolvedConfig,
+  maxSteps: number,
+  skillInstruction: string | undefined,
   llm: LLMStreamAdapter,
-  executor: ToolExecutorAdapter,
+  executor: ToolExecutorService,
+  toolRegistry: ToolService,
 ): AsyncGenerator<AgentEvent, Result<string, AgentError>, unknown> {
   const messages = [...initialMessages];
-  const maxSteps = config.maxSteps;
+  const basePrompt = buildSystemPrompt({
+    cwd: process.cwd(),
+    platform: process.platform,
+    shell: process.env.SHELL || process.env.ComSpec || 'bash',
+  });
+  const system = skillInstruction
+    ? `${basePrompt}\n\n## Skill Instructions\n\n${skillInstruction}`
+    : basePrompt;
 
   for (let step = 0; step < maxSteps; step++) {
     yield { _tag: 'Step', step: step + 1, max: maxSteps };
 
-    const registry = executor.getRegistry();
-    const tools: ToolDescription[] = config.availableTools
-      ? registry.filter(config.availableTools).map((t) => ({
-          name: t.name, description: t.description, parameters: t.schema,
-        }))
-      : registry.describeAll().map((t) => ({
-          name: t.name, description: t.description, parameters: t.schema,
-        }));
+    const tools: ToolDescription[] = toolRegistry.describeAll();
 
     const { stream: rawStream, response: respPromise } = llm.completeStream({
-      messages, system: config.systemPrompt, tools, maxSteps: 1,
+      messages, system, tools, maxSteps: 1,
     });
 
     for await (const chunk of rawStream) {
@@ -93,24 +118,51 @@ export async function* runReActLoop(
       return Result.ok(resp.content);
     }
 
-    // Concurrent tool execution — executor.execute returns Effect directly
-    const controllers = toolCalls.map(() => new AbortController());
-    const results = await Effect.runPromise(
-      Effect.forEach(toolCalls, (tc, i) =>
-        executor.execute(tc.name, tc.arguments ?? {}, { signal: controllers[i].signal }).pipe(
-          Effect.map((result) => ({ id: tc.id, name: tc.name, ok: true as const, output: result })),
-          Effect.catchAllCause((cause) => {
-            const err = cause instanceof AgentError ? cause : AgentError.toolExecutionFailed(tc.name, String(cause));
-            return Effect.succeed({ id: tc.id, name: tc.name, ok: false as const, output: `[Error: ${err.code}] ${err.message}` });
-          }),
-        ),
-      { concurrency: 'unbounded' },
-    ) as any,
+    // Separate safe & destructive tools: safe tools run in parallel, Bash runs serially
+    const safeTools: ToolCall[] = [];
+    const bashTools: ToolCall[] = [];
+
+    for (const tc of toolCalls) {
+      if (tc.name === 'execute_command' || tc.name === 'Bash') {
+        bashTools.push(tc);
+      } else {
+        safeTools.push(tc);
+      }
+    }
+
+    // Safe tools — parallel
+    const safeResults = await Effect.runPromise(
+      Effect.forEach(safeTools, (tc) => execTool(executor, tc), { concurrency: 'unbounded' }),
     );
 
-    for (const r of (results as any[])) {
-      messages.push({ role: 'tool', content: r.output, tool_call_id: r.id, tool_name: r.name });
-      yield { _tag: 'ToolResult', id: r.id, name: r.name, output: r.output, ok: r.ok };
+    for (const r of safeResults) {
+      if (r.type === 'denied') {
+        yield { _tag: 'ToolDenied', name: r.name, reason: r.reason };
+      } else {
+        yield { _tag: 'ToolResult', id: r.id, name: r.name, output: r.output, ok: r.type === 'ok' };
+      }
+    }
+
+    // Bash tools — serial (avoid race conditions)
+    const bashResults: ToolResultUnion[] = [];
+    for (const tc of bashTools) {
+      const r = await Effect.runPromise(execTool(executor, tc));
+      bashResults.push(r);
+      if (r.type === 'denied') {
+        yield { _tag: 'ToolDenied', name: r.name, reason: r.reason };
+      } else {
+        yield { _tag: 'ToolResult', id: r.id, name: r.name, output: r.output, ok: r.type === 'ok' };
+      }
+    }
+
+    // Feed results back to LLM — denied tools still get a message so the LLM knows
+    const allResults = [...safeResults, ...bashResults];
+    for (const r of allResults) {
+      if (messages.find(m => (m as any).tool_call_id === r.id)) continue;
+      const content = r.type === 'denied'
+        ? `[Denied] Tool "${r.name}" was denied: ${(r as any).reason as string}`
+        : (r as any).output ?? '';
+      messages.push({ role: 'tool', content, tool_call_id: r.id, tool_name: r.name });
     }
   }
 
diff --git a/packages/codingcode/src/agent/config.ts b/packages/codingcode/src/agent/config.ts
index 74564bf..9d5a5b0 100644
--- a/packages/codingcode/src/agent/config.ts
+++ b/packages/codingcode/src/agent/config.ts
@@ -1,36 +1,9 @@
 import { loadConfig } from '@codingcode/infra';
-import { buildSystemPrompt } from '../prompts/index.js';
-import type { AgentConfig } from './types.js';
 
 export interface ResolvedConfig {
-  systemPrompt: string;
   maxSteps: number;
-  availableTools?: string[];
 }
 
-const DEFAULT_TOOLS = [
-  'read_file',
-  'write_file',
-  'list_dir',
-  'execute_command',
-  'search_code',
-  'fetch_url',
-];
-
-/**
- * 构建最终配置。
- * systemPrompt 可被 skill 覆盖；maxSteps 和 availableTools 仅来自配置文件，配置缺失时使用内置默认值。
- */
-export function resolveConfig(opt?: AgentConfig): ResolvedConfig {
-  const appConfig = loadConfig();
-
-  return {
-    systemPrompt: opt?.systemPrompt ?? buildSystemPrompt({
-      cwd: process.cwd(),
-      platform: process.platform,
-      shell: process.env.SHELL || process.env.ComSpec || 'bash',
-    }),
-    maxSteps: appConfig.maxSteps,
-    availableTools: DEFAULT_TOOLS,
-  };
+export function resolveConfig(): ResolvedConfig {
+  return { maxSteps: loadConfig().maxSteps };
 }
diff --git a/packages/codingcode/src/agent/types.ts b/packages/codingcode/src/agent/types.ts
deleted file mode 100644
index 1fc8aa5..0000000
--- a/packages/codingcode/src/agent/types.ts
+++ /dev/null
@@ -1,10 +0,0 @@
-export interface AgentConfig {
-  systemPrompt?: string;
-}
-
-export interface LoopState {
-  step: number;
-  maxSteps: number;
-}
-
-export type { AgentEvent } from '../bus/types.js';
diff --git a/packages/codingcode/src/approval/async-confirm.ts b/packages/codingcode/src/approval/async-confirm.ts
new file mode 100644
index 0000000..ccc171d
--- /dev/null
+++ b/packages/codingcode/src/approval/async-confirm.ts
@@ -0,0 +1,35 @@
+import { Effect, Deferred } from 'effect';
+import type { ConfirmResult } from './confirmation';
+
+// Module-level singleton: shared across all Effect.runPromise scopes
+const pending = new Map<string, Deferred.Deferred<ConfirmResult, never>>();
+
+export class ApprovalWaitService extends Effect.Service<ApprovalWaitService>()('ApprovalWait', {
+  effect: Effect.gen(function* () {
+    return {
+      waitForConfirm: (id: string): Effect.Effect<ConfirmResult> =>
+        Effect.gen(function* () {
+          const d = yield* Deferred.make<ConfirmResult, never>();
+          pending.set(id, d);
+          return yield* Deferred.await(d);
+        }),
+
+      resolveConfirm: (id: string, result: ConfirmResult): Effect.Effect<boolean> =>
+        Effect.sync(() => {
+          const d = pending.get(id);
+          if (!d) return false;
+          pending.delete(id);
+          Deferred.unsafeDone(d, Effect.succeed(result));
+          return true;
+        }),
+
+      getPending: (): Effect.Effect<string[]> =>
+        Effect.sync(() => Array.from(pending.keys())),
+    };
+  }),
+}) {}
+
+/** Module-level emitter for the SSE handler to inject an approval request emitter. Survives across Effect.runPromise boundaries. */
+export const approvalEmitter = {
+  current: null as ((id: string, tool: string, args: Record<string, unknown>) => void) | null,
+};
diff --git a/packages/codingcode/src/approval/confirmation.ts b/packages/codingcode/src/approval/confirmation.ts
new file mode 100644
index 0000000..565dc62
--- /dev/null
+++ b/packages/codingcode/src/approval/confirmation.ts
@@ -0,0 +1,112 @@
+import * as readline from 'node:readline';
+import { Effect } from 'effect';
+import type { PermissionRule } from './types';
+import { ApprovalWaitService, approvalEmitter } from './async-confirm';
+
+export type ConfirmResult =
+  | { type: 'allow' }
+  | { type: 'deny' }
+  | { type: 'always'; rule: PermissionRule }
+  | { type: 'never'; rule: PermissionRule };
+
+async function promptUser(question: string): Promise<string> {
+  const rl = readline.createInterface({
+    input: process.stdin,
+    output: process.stdout,
+    terminal: true,
+  });
+  try {
+    return await new Promise<string>((resolve) => {
+      rl.question(question, (ans) => resolve(ans.trim().toLowerCase()));
+    });
+  } finally {
+    rl.close();
+  }
+}
+
+function buildResult(
+  answer: string,
+  tool: string,
+): ConfirmResult {
+  switch (answer) {
+    case 'y':
+      return { type: 'allow' };
+    case 'n':
+      return { type: 'deny' };
+    case 'a':
+      return {
+        type: 'always',
+        rule: {
+          id: `user-allow-${tool}-${Date.now()}`,
+          action: 'allow',
+          toolPattern: tool,
+          reason: 'User always allows',
+          source: 'user',
+        },
+      };
+    case 'r':
+      return {
+        type: 'never',
+        rule: {
+          id: `user-deny-${tool}-${Date.now()}`,
+          action: 'deny',
+          toolPattern: tool,
+          reason: 'User never allows',
+          source: 'user',
+        },
+      };
+    default:
+      return { type: 'deny' };
+  }
+}
+
+export function userConfirm(
+  tool: string,
+  args: Record<string, unknown>,
+  mode: 'interactive' | 'default-deny' = 'default-deny',
+): Effect.Effect<ConfirmResult> {
+  if (mode === 'default-deny') {
+    return Effect.succeed({ type: 'deny' } as ConfirmResult);
+  }
+
+  return Effect.gen(function* () {
+    const serializedArgs = Object.entries(args)
+      .map(([k, v]) => `  ${k}: ${String(v).slice(0, 200)}`)
+      .join('\n');
+
+    const question = `\n[Approval] Tool "${tool}" wants to run:\n${serializedArgs}\nAllow? (Y)es / (N)o / (A)lways / Neve_r / (V)iew full: `;
+
+    const answer = yield* Effect.promise(() => promptUser(question));
+
+    if (answer === 'v') {
+      console.log('\nFull arguments:', JSON.stringify(args, null, 2));
+      const result = yield* userConfirm(tool, args, 'interactive');
+      return result;
+    }
+
+    return buildResult(answer, tool);
+  });
+}
+
+/**
+ * Async confirmation via SSE: sends an approval request to the TUI client
+ * and waits for the response via Effect.async + Deferred.
+ * @param waitSvc injected as parameter to keep R channel clean.
+ */
+export function userConfirmAsync(
+  tool: string,
+  args: Record<string, unknown>,
+  waitSvc: ApprovalWaitService,
+): Effect.Effect<ConfirmResult> {
+  return Effect.gen(function* () {
+    const id = `apr_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`;
+
+    // Emit approval request via module-level emitter (set by SSE handler)
+    if (approvalEmitter.current) {
+      approvalEmitter.current(id, tool, args);
+    }
+
+    // Suspend until resolveConfirm is called
+    return yield* waitSvc.waitForConfirm(id);
+  });
+}
diff --git a/packages/codingcode/src/approval/index.ts b/packages/codingcode/src/approval/index.ts
new file mode 100644
index 0000000..f958a2f
--- /dev/null
+++ b/packages/codingcode/src/approval/index.ts
@@ -0,0 +1,66 @@
+import { Effect } from 'effect';
+import { HookService } from '../hooks/registry';
+import type { PermissionMode, PermissionRule, ApprovalDecision } from './types';
+import { createRuleEngine, type RuleEngine } from './rule-engine';
+import { DEFAULT_DENY_RULES, READONLY_TOOL_NAMES, DESTRUCTIVE_TOOL_NAMES } from './presets';
+import { runPipeline, type PipelineHooks } from './pipeline';
+import { approvalEmitter, ApprovalWaitService } from './async-confirm';
+
+export class ApprovalService extends Effect.Service<ApprovalService>()('Approval', {
+  effect: Effect.gen(function* () {
+    const hooks = yield* HookService;
+    const approvalWait = yield* ApprovalWaitService;
+    const ruleEngine: RuleEngine = createRuleEngine(DEFAULT_DENY_RULES);
+    const readonlyTools = new Set(READONLY_TOOL_NAMES);
+    const destructiveTools = new Set(DESTRUCTIVE_TOOL_NAMES);
+    let permissionMode: PermissionMode = 'default';
+
+    function buildPipelineHooks(): PipelineHooks {
+      return {
+        emitPreToolUseDecision: (payload) =>
+          hooks.emitDecision('tool.approval.pre', payload),
+
+        recordAudit: (entry) =>
+          hooks.emit('tool.approval.post', entry as unknown as Record<string, unknown>),
+      };
+    }
+
+    return {
+      evaluate: (request: {
+        tool: string;
+        input: Record<string, unknown>;
+        context?: Record<string, unknown>;
+      }): Effect.Effect<ApprovalDecision> =>
+        Effect.gen(function* () {
+          // Check if an approval emitter is set (we're inside an SSE handler)
+          const hasAsyncEmitter = approvalEmitter.current !== null;
+          return yield* runPipeline(
+            { tool: request.tool, input: request.input, context: request.context },
+            {
+              ruleEngine,
+              readonlyTools,
+              destructiveTools,
+              permissionMode,
+              hooks: buildPipelineHooks(),
+              interactive: process.stdin.isTTY ?? false,
+              asyncConfirm: hasAsyncEmitter,
+              asyncConfirmService: approvalWait,
+              onAlways: (rule) => ruleEngine.addRule(rule),
+              onNever: (rule) => ruleEngine.addRule(rule),
+            },
+          );
+        }),
+
+      addRule: (rule: PermissionRule): Effect.Effect<void> =>
+        Effect.sync(() => ruleEngine.addRule(rule)),
+
+      removeRule: (id: string): Effect.Effect<void> =>
+        Effect.sync(() => ruleEngine.removeRule(id)),
+
+      setPermissionMode: (mode: PermissionMode): Effect.Effect<void> =>
+        Effect.sync(() => { permissionMode = mode; }),
+
+      getPermissionMode: (): PermissionMode => permissionMode,
+    };
+  }),
+}) {}
diff --git a/packages/codingcode/src/approval/pipeline.ts b/packages/codingcode/src/approval/pipeline.ts
new file mode 100644
index 0000000..1db0e03
--- /dev/null
+++ b/packages/codingcode/src/approval/pipeline.ts
@@ -0,0 +1,219 @@
+import { Effect } from 'effect';
+import type {
+  ApprovalDecision,
+  PermissionMode,
+  PermissionRule,
+  ToolCallRequest,
+} from './types';
+import { READONLY_TOOLS } from './types';
+import type { RuleEngine } from './rule-engine';
+import type { ConfirmResult } from './confirmation';
+import { userConfirm, userConfirmAsync } from './confirmation';
+import type { ApprovalWaitService } from './async-confirm';
+
+export interface PipelineHooks {
+  /** Emit decision from PreToolUse hooks (Layer 4). Returns first non-null HookDecision or null. */
+  emitPreToolUseDecision: (payload: {
+    toolName: string;
+    args: Record<string, unknown>;
+  }) => Effect.Effect<{
+    decision?: 'allow' | 'deny' | 'ask';
+    reason?: string;
+    modifiedInput?: Record<string, unknown>;
+  } | null>;
+  /** Record audit log for the final decision (Layer 6). */
+  recordAudit: (entry: {
+    tool: string;
+    input: Record<string, unknown>;
+    decision: ApprovalDecision;
+    layers: string[];
+  }) => Effect.Effect<void>;
+}
+
+export interface PipelineOptions {
+  ruleEngine: RuleEngine;
+  readonlyTools: Set<string>;
+  destructiveTools: Set<string>;
+  permissionMode: PermissionMode;
+  hooks: PipelineHooks;
+  /** Whether TTY is available for interactive confirmation. */
+  interactive: boolean;
+  /** Use async SSE-based confirmation instead of blocking readline. */
+  asyncConfirm?: boolean;
+  /** Service for async confirmation (injected to keep R clean). */
+  asyncConfirmService?: ApprovalWaitService;
+  /** Called when user selects Always — allows caller to persist the rule. */
+  onAlways?: (rule: PermissionRule) => void;
+  /** Called when user selects Never — allows caller to persist the rule. */
+  onNever?: (rule: PermissionRule) => void;
+}
+
+const LAYER_NAMES = [
+  'RuleEngine',
+  'ReadonlyWhitelist',
+  'PermissionMode',
+  'HookPreToolUse',
+  'UserConfirmation',
+  'AuditLog',
+] as const;
+
+export function runPipeline(
+  request: ToolCallRequest,
+  opts: PipelineOptions,
+): Effect.Effect<ApprovalDecision> {
+  return Effect.gen(function* () {
+    const layers: string[] = [];
+
+    // Layer 1: Rule Engine
+    {
+      const result = opts.ruleEngine.evaluate(request.tool, request.input);
+      if (result) {
+        layers.push(LAYER_NAMES[0]);
+        const final = yield* layer6Audit(request, result, layers, opts);
+        return final;
+      }
+    }
+
+    // Layer 2: Read-only Whitelist
+    {
+      if (opts.readonlyTools.has(request.tool)) {
+        const result: ApprovalDecision = {
+          type: 'allow',
+          source: 'readonly-whitelist',
+        };
+        layers.push(LAYER_NAMES[1]);
+        const final = yield* layer6Audit(request, result, layers, opts);
+        return final;
+      }
+    }
+
+    // Layer 3: Permission Mode
+    {
+      const modeResult = applyPermissionMode(
+        request.tool,
+        opts.permissionMode,
+        opts.readonlyTools,
+        opts.destructiveTools,
+      );
+      if (modeResult) {
+        layers.push(LAYER_NAMES[2]);
+        const final = yield* layer6Audit(request, modeResult, layers, opts);
+        return final;
+      }
+    }
+
+    // Layer 4: Hook PreToolUse
+    {
+      const hookResult = yield* opts.hooks.emitPreToolUseDecision({
+        toolName: request.tool,
+        args: request.input,
+      });
+      if (hookResult) {
+        layers.push(LAYER_NAMES[3]);
+        if (hookResult.decision === 'deny') {
+          const result: ApprovalDecision = {
+            type: 'deny',
+            reason: hookResult.reason ?? 'Denied by PreToolUse hook',
+            source: 'hook',
+          };
+          const final = yield* layer6Audit(request, result, layers, opts);
+          return final;
+        }
+        if (hookResult.decision === 'allow') {
+          const result: ApprovalDecision = { type: 'allow', source: 'hook' };
+          const final = yield* layer6Audit(request, result, layers, opts);
+          return final;
+        }
+        // 'ask' or no decision → continue to user confirmation
+        if (hookResult.modifiedInput) {
+          // Use modified input for user confirmation
+          request = { ...request, input: hookResult.modifiedInput };
+        }
+      }
+    }
+
+    // Layer 5: User Confirmation
+    {
+      layers.push(LAYER_NAMES[4]);
+      const confirmResult = yield* (
+        opts.asyncConfirm && opts.asyncConfirmService
+          ? userConfirmAsync(request.tool, request.input, opts.asyncConfirmService)
+          : userConfirm(request.tool, request.input, opts.interactive ? 'interactive' : 'default-deny')
+      );
+
+      let result: ApprovalDecision;
+      switch (confirmResult.type) {
+        case 'allow':
+          result = { type: 'allow', source: 'user-confirm' };
+          break;
+        case 'deny':
+          result = { type: 'deny', reason: 'Denied by user', source: 'user-confirm' };
+          break;
+        case 'always':
+          opts.onAlways?.(confirmResult.rule);
+          result = { type: 'allow', source: 'user-confirm' };
+          break;
+        case 'never':
+          opts.onNever?.(confirmResult.rule);
+          result = { type: 'deny', reason: 'Never allow for this tool', source: 'user-confirm' };
+          break;
+      }
+
+      const final = yield* layer6Audit(request, result, layers, opts);
+      return final;
+    }
+  });
+}
+
+function applyPermissionMode(
+  tool: string,
+  mode: PermissionMode,
+  readonlyTools: Set<string>,
+  destructiveTools: Set<string>,
+): ApprovalDecision | null {
+  switch (mode) {
+    case 'plan':
+      // Plan mode: only read-only tools allowed
+      if (!readonlyTools.has(tool)) {
+        return { type: 'deny', reason: 'Write operations denied in plan mode', source: 'permission-mode' };
+      }
+      return { type: 'allow', source: 'permission-mode' };
+
+    case 'bypass':
+      // Bypass mode: everything allowed (sandbox still restricts at OS level)
+      return { type: 'allow', source: 'permission-mode' };
+
+    case 'acceptEdits':
+      // Accept edits: read-only + edit tools auto-allow, destructive tools need confirmation
+      if (!destructiveTools.has(tool)) {
+        return { type: 'allow', source: 'permission-mode' };
+      }
+      return null; // Continue to next layers
+
+    case 'dontAsk':
+      // Don't ask: allow everything (bypass + audit)
+      return { type: 'allow', source: 'permission-mode' };
+
+    case 'default':
+    default:
+      return null; // Continue to next layers
+  }
+}
+
+function layer6Audit(
+  request: ToolCallRequest,
+  decision: ApprovalDecision,
+  passedLayers: string[],
+  opts: PipelineOptions,
+): Effect.Effect<ApprovalDecision> {
+  return Effect.gen(function* () {
+    passedLayers.push(LAYER_NAMES[5]);
+    yield* opts.hooks.recordAudit({
+      tool: request.tool,
+      input: request.input,
+      decision,
+      layers: passedLayers,
+    });
+    return decision;
+  });
+}
diff --git a/packages/codingcode/src/approval/presets.ts b/packages/codingcode/src/approval/presets.ts
new file mode 100644
index 0000000..d7328b2
--- /dev/null
+++ b/packages/codingcode/src/approval/presets.ts
@@ -0,0 +1,97 @@
+import type { PermissionRule } from './types';
+
+export const DEFAULT_DENY_RULES: PermissionRule[] = [
+  {
+    id: 'deny-rm-rf-root',
+    action: 'deny',
+    toolPattern: '*',
+    argPattern: 'rm -rf /*',
+    reason: 'rm -rf / is not allowed',
+    priority: 100,
+    source: 'system',
+  },
+  {
+    id: 'deny-sudo-raw',
+    action: 'deny',
+    toolPattern: '*',
+    argPattern: 'sudo *',
+    reason: 'Elevated commands require explicit user confirmation',
+    priority: 90,
+    source: 'system',
+  },
+  {
+    id: 'deny-curl-sh',
+    action: 'deny',
+    toolPattern: '*',
+    argPattern: 'curl */sh',
+    reason: 'Piping curl to shell is not allowed',
+    priority: 90,
+    source: 'system',
+  },
+  {
+    id: 'deny-chmod-suid',
+    action: 'deny',
+    toolPattern: '*',
+    argPattern: 'chmod u+s *',
+    reason: 'Setting SUID bit is not allowed',
+    priority: 90,
+    source: 'system',
+  },
+  {
+    id: 'deny-shutdown',
+    action: 'deny',
+    toolPattern: '*',
+    argPattern: 'shutdown',
+    reason: 'System shutdown is not allowed',
+    priority: 80,
+    source: 'system',
+  },
+  {
+    id: 'deny-etc-shadow-read',
+    action: 'deny',
+    toolPattern: 'read_file',
+    argPattern: '**/etc/shadow',
+    reason: 'Reading /etc/shadow is not allowed',
+    priority: 100,
+    source: 'system',
+  },
+  {
+    id: 'deny-etc-passwd-read',
+    action: 'deny',
+    toolPattern: 'read_file',
+    argPattern: '**/etc/passwd',
+    reason: 'Reading /etc/passwd is not allowed',
+    priority: 100,
+    source: 'system',
+  },
+  {
+    id: 'ask-ssh-key',
+    action: 'ask',
+    toolPattern: 'read_file',
+    argPattern: '**/.ssh/**',
+    reason: 'Reading SSH keys requires confirmation',
+    priority: 50,
+    source: 'system',
+  },
+  {
+    id: 'ask-env-file',
+    action: 'ask',
+    toolPattern: 'read_file',
+    argPattern: '**/.env*',
+    reason: 'Reading environment files requires confirmation',
+    priority: 50,
+    source: 'system',
+  },
+];
+
+export const READONLY_TOOL_NAMES: string[] = [
+  'read_file',
+  'search_code',
+  'list_dir',
+  'fetch_url',
+];
+
+export const DESTRUCTIVE_TOOL_NAMES: string[] = [
+  'execute_command',
+  'Bash',
+];
diff --git a/packages/codingcode/src/approval/rule-engine.ts b/packages/codingcode/src/approval/rule-engine.ts
new file mode 100644
index 0000000..114fa07
--- /dev/null
+++ b/packages/codingcode/src/approval/rule-engine.ts
@@ -0,0 +1,76 @@
+import type { PermissionRule, RuleAction, ApprovalDecision } from './types';
+
+/**
+ * Convert a simple glob pattern to a RegExp.
+ * Supports: *, **, ?, and character classes [...]
+ */
+function globToRegex(pattern: string): RegExp {
+  const escaped = pattern
+    .replace(/[.+^${}()|[\]\\]/g, '\\$&')
+    .replace(/\*\*/g, '___DOUBLESTAR___')
+    .replace(/\*/g, '.*')
+    .replace(/___DOUBLESTAR___/g, '.*')
+    .replace(/\?/g, '.');
+  return new RegExp(`^${escaped}$`, 'i');
+}
+
+function matchPattern(pattern: string, value: string): boolean {
+  return globToRegex(pattern).test(value);
+}
+
+function getSerializedArgs(input: Record<string, unknown>): string {
+  return Object.values(input)
+    .filter((v): v is string => typeof v === 'string')
+    .join(' ');
+}
+
+export interface RuleEngine {
+  addRule(rule: PermissionRule): void;
+  removeRule(id: string): void;
+  evaluate(tool: string, input: Record<string, unknown>): ApprovalDecision | null;
+  getAllRules(): PermissionRule[];
+}
+
+export function createRuleEngine(initialRules: PermissionRule[] = []): RuleEngine {
+  const rules = new Map<string, PermissionRule>();
+
+  for (const rule of initialRules) {
+    rules.set(rule.id, rule);
+  }
+
+  function evaluate(tool: string, input: Record<string, unknown>): ApprovalDecision | null {
+    const serializedArgs = getSerializedArgs(input);
+    const sorted = Array.from(rules.values()).sort(
+      (a, b) => (b.priority ?? 0) - (a.priority ?? 0),
+    );
+
+    for (const rule of sorted) {
+      if (!matchPattern(rule.toolPattern, tool)) continue;
+
+      if (rule.argRegex) {
+        if (!rule.argRegex.test(serializedArgs)) continue;
+      } else if (rule.argPattern) {
+        if (!matchPattern(rule.argPattern, serializedArgs)) continue;
+      }
+
+      const action = rule.action as RuleAction;
+      switch (action) {
+        case 'deny':
+          return { type: 'deny', reason: rule.reason ?? `Denied by rule: ${rule.id}`, source: `rule:${rule.id}` };
+        case 'allow':
+          return { type: 'allow', source: `rule:${rule.id}` };
+        case 'ask':
+          return { type: 'ask', source: `rule:${rule.id}` };
+      }
+    }
+
+    return null;
+  }
+
+  return {
+    addRule: (rule: PermissionRule) => { rules.set(rule.id, rule); },
+    removeRule: (id: string) => { rules.delete(id); },
+    evaluate,
+    getAllRules: () => Array.from(rules.values()),
+  };
+}
diff --git a/packages/codingcode/src/approval/types.ts b/packages/codingcode/src/approval/types.ts
new file mode 100644
index 0000000..cffc7ea
--- /dev/null
+++ b/packages/codingcode/src/approval/types.ts
@@ -0,0 +1,42 @@
+export type PermissionMode = 'default' | 'acceptEdits' | 'dontAsk' | 'plan' | 'bypass';
+
+export interface ToolCallRequest {
+  tool: string;
+  input: Record<string, unknown>;
+  context?: Record<string, unknown>;
+}
+
+export type ApprovalDecision =
+  | { type: 'deny'; reason: string; source: string }
+  | { type: 'allow'; source: string }
+  | { type: 'ask'; source: string }
+  | { type: 'modified'; input: Record<string, unknown>; source: string }
+  | { type: 'continue' };
+
+export type RuleAction = 'deny' | 'allow' | 'ask';
+
+export interface PermissionRule {
+  id: string;
+  action: RuleAction;
+  /** Glob pattern for command name, e.g. "Bash", "Edit" */
+  toolPattern: string;
+  /** Glob pattern for command arguments serialized as string, e.g. "rm -rf /*" */
+  argPattern?: string;
+  /** Optional regex pattern for command arguments (alternative to argPattern) */
+  argRegex?: RegExp;
+  reason?: string;
+  priority?: number;
+  source?: 'system' | 'user';
+}
+
+export const READONLY_TOOLS = new Set([
+  'read_file',
+  'search_code',
+  'list_dir',
+  'fetch_url',
+]);
+
+export const DESTRUCTIVE_TOOLS = new Set([
+  'execute_command',
+  'Bash',
+]);
diff --git a/packages/codingcode/src/bus/types.ts b/packages/codingcode/src/bus/types.ts
index 493fc34..df2ed79 100644
--- a/packages/codingcode/src/bus/types.ts
+++ b/packages/codingcode/src/bus/types.ts
@@ -5,6 +5,8 @@ export type AgentEvent =
   | { readonly _tag: 'LlmChunk'; readonly text: string }
   | { readonly _tag: 'Assistant'; readonly content: string; readonly toolCalls?: ToolCall[] }
   | { readonly _tag: 'ToolStart'; readonly name: string; readonly args: Record<string, unknown> }
+  | { readonly _tag: 'ToolDenied'; readonly name: string; readonly reason: string }
+  | { readonly _tag: 'ApprovalRequest'; readonly id: string; readonly tool: string; readonly args: Record<string, unknown> }
   | { readonly _tag: 'ToolResult'; readonly id: string; readonly name: string; readonly output: string; readonly ok: boolean }
   | { readonly _tag: 'Step'; readonly step: number; readonly max: number }
   | { readonly _tag: 'Error'; readonly error: AgentError }
diff --git a/packages/codingcode/src/cli.ts b/packages/codingcode/src/cli.ts
index d49da48..d34d25a 100644
--- a/packages/codingcode/src/cli.ts
+++ b/packages/codingcode/src/cli.ts
@@ -2,12 +2,11 @@ import { Effect } from 'effect';
 import { createServer as createNetServer } from 'net';
 import { serve } from '@hono/node-server';
 import { ToolService } from './tools/registry.js';
-import { ToolExecutor } from './tools/executor.js';
 import { HookService } from './hooks/registry.js';
 import { McpService } from './mcp/index.js';
 import { SkillService } from './skills/index.js';
 import { getLLMClient } from './llm/factory.js';
-import { DefaultSandbox } from './sandbox/index.js';
+import { SandboxService } from './sandbox/index.js';
 import { readFileTool } from './tools/domains/fs/read.js';
 import { writeFileTool } from './tools/domains/fs/write.js';
 import { listDirTool } from './tools/domains/fs/list.js';
@@ -51,6 +50,10 @@ async function main() {
     const hooks = yield* HookService;
     const mcp = yield* McpService;
     const skill = yield* SkillService;
+    const sandbox = yield* SandboxService;
+
+    // Initialize sandbox (will gracefully degrade if @vscode/sandbox-runtime is unavailable)
+    yield* sandbox.initialize({});
 
     // Register built-in tools
     yield* tools.register(readFileTool);
@@ -78,18 +81,19 @@ async function main() {
     const serverUrl = process.env.CODINGCODE_SERVER ?? `http://localhost:${port}`;
 
     if (tuiOnly) {
-      const { runTui } = yield* Effect.tryPromise(() => import('../../tui/src/index.js'));
+      const tuiPath = '../../tui/src/index.js';
+      const { runTui } = yield* Effect.tryPromise(() => import(tuiPath));
       runTui({ serverUrl });
       return;
     }
 
-    const sandbox = new DefaultSandbox();
-    const executor = new ToolExecutor(tools, hooks, sandbox);
-    const app = createServer({ llm: llmResult.value, executor, hooks });
+    // ToolExecutorService, ApprovalService, SandboxService all provided via AppLayer
+    const app = createServer({ llm: llmResult.value });
     serve({ fetch: app.fetch, port });
 
     if (!serveOnly) {
-      const { runTui } = yield* Effect.tryPromise(() => import('../../tui/src/index.js'));
+      const tuiPath = '../../tui/src/index.js';
+      const { runTui } = yield* Effect.tryPromise(() => import(tuiPath));
       runTui({ serverUrl });
     }
   });
diff --git a/packages/codingcode/src/hooks/registry.ts b/packages/codingcode/src/hooks/registry.ts
index a3ce7d7..19fb1a2 100644
--- a/packages/codingcode/src/hooks/registry.ts
+++ b/packages/codingcode/src/hooks/registry.ts
@@ -2,39 +2,117 @@ import { Effect } from 'effect';
 
 export type HookPoint =
   | 'tool.execute.before' | 'tool.execute.after' | 'tool.execute.error'
+  | 'tool.execute.denied'
+  | 'tool.approval.pre' | 'tool.approval.post'
   | 'llm.request.before' | 'llm.response.after' | 'llm.response.error'
   | 'session.save.before' | 'session.save.after';
 
-type HookHandler = (payload: Record<string, unknown>) => void | Promise<void>;
+export interface HookDecision {
+  decision?: 'allow' | 'deny' | 'ask';
+  reason?: string;
+  modifiedInput?: Record<string, unknown>;
+  modifiedOutput?: unknown;
+}
+
+type ObserverHandler = (payload: Record<string, unknown>) => void | Promise<void>;
+type DecisionHandler = (
+  payload: Record<string, unknown>,
+) => HookDecision | null | Promise<HookDecision | null>;
+
+interface HandlerEntry {
+  id: string;
+  handler: ObserverHandler | DecisionHandler;
+  priority: number;
+  source: 'system' | 'user';
+  type: 'observer' | 'decision';
+}
+
+let entryCounter = 0;
 
 export class HookService extends Effect.Service<HookService>()('HookService', {
   effect: Effect.gen(function* () {
-    const handlers = new Map<HookPoint, Set<HookHandler>>();
+    const observers = new Map<HookPoint, HandlerEntry[]>();
+
+    function sortedEntries(point: HookPoint): HandlerEntry[] {
+      return (observers.get(point) ?? []).slice().sort((a, b) => a.priority - b.priority);
+    }
 
     return {
-      register: (point: HookPoint, handler: HookHandler): Effect.Effect<() => void> =>
+      /** Register an observation handler (fire-and-forget, no return value). */
+      register: (
+        point: HookPoint,
+        handler: ObserverHandler,
+      ): Effect.Effect<() => void> =>
         Effect.sync(() => {
-          const set = handlers.get(point) ?? new Set();
-          set.add(handler);
-          handlers.set(point, set);
+          const entry: HandlerEntry = {
+            id: `obs-${++entryCounter}`,
+            handler,
+            priority: 0,
+            source: 'user',
+            type: 'observer',
+          };
+          const set = observers.get(point) ?? [];
+          set.push(entry);
+          observers.set(point, set);
           return () => {
-            set.delete(handler);
+            const s = observers.get(point);
+            if (s) {
+              const idx = s.indexOf(entry);
+              if (idx >= 0) s.splice(idx, 1);
+            }
           };
         }),
 
+      /** Register a decision handler with priority (lower runs first). */
+      registerDecision: (
+        point: HookPoint,
+        handler: DecisionHandler,
+        opts?: { priority?: number; source?: 'system' | 'user' },
+      ): Effect.Effect<() => void> =>
+        Effect.sync(() => {
+          const entry: HandlerEntry = {
+            id: `dec-${++entryCounter}`,
+            handler,
+            priority: opts?.priority ?? 0,
+            source: opts?.source ?? 'user',
+            type: 'decision',
+          };
+          const set = observers.get(point) ?? [];
+          set.push(entry);
+          observers.set(point, set);
+          return () => {
+            const s = observers.get(point);
+            if (s) {
+              const idx = s.indexOf(entry);
+              if (idx >= 0) s.splice(idx, 1);
+            }
+          };
+        }),
+
+      /** Emit an observer event (fire-and-forget all handlers). */
       emit: (point: HookPoint, payload: Record<string, unknown>): Effect.Effect<void> =>
         Effect.promise(async () => {
-          const set = handlers.get(point);
-          if (!set) return;
-          for (const handler of set) await handler(payload);
+          for (const entry of sortedEntries(point)) {
+            if (entry.type === 'observer') {
+              await (entry.handler as ObserverHandler)(payload);
+            }
+          }
         }),
 
-      // Sync emit for callers outside Effect context (ToolExecutor)
-      emitSync: async (point: HookPoint, payload: Record<string, unknown>): Promise<void> => {
-        const set = handlers.get(point);
-        if (!set) return;
-        for (const handler of set) await handler(payload);
-      },
+      /** Emit a decision event. Handlers run in priority order; first non-null decision wins. */
+      emitDecision: (
+        point: HookPoint,
+        payload: Record<string, unknown>,
+      ): Effect.Effect<HookDecision | null> =>
+        Effect.promise(async () => {
+          for (const entry of sortedEntries(point)) {
+            if (entry.type === 'decision') {
+              const result = await (entry.handler as DecisionHandler)(payload);
+              if (result != null) return result;
+            }
+          }
+          return null;
+        }),
     };
   }),
 }) {}
diff --git a/packages/codingcode/src/index.ts b/packages/codingcode/src/index.ts
index 12f9ad5..f8705ce 100644
--- a/packages/codingcode/src/index.ts
+++ b/packages/codingcode/src/index.ts
@@ -5,7 +5,7 @@ export { ContextService } from './context/context.js';
 export { HookService } from './hooks/registry.js';
 export type { HookPoint } from './hooks/registry.js';
 export { ToolService } from './tools/registry.js';
-export { ToolExecutor } from './tools/executor.js';
+export { ToolExecutorService } from './tools/executor.js';
 export { McpService, McpClient, McpError } from './mcp/index.js';
 export type { McpStatus } from './mcp/index.js';
 export { SkillService } from './skills/index.js';
diff --git a/packages/codingcode/src/layer.ts b/packages/codingcode/src/layer.ts
index 86dc5a5..dd53e9a 100644
--- a/packages/codingcode/src/layer.ts
+++ b/packages/codingcode/src/layer.ts
@@ -6,6 +6,10 @@ import { ToolService } from './tools/registry';
 import { HookService } from './hooks/registry';
 import { McpService } from './mcp/index';
 import { SkillService } from './skills/index';
+import { SandboxService } from './sandbox/index';
+import { ApprovalService } from './approval/index';
+import { ApprovalWaitService } from './approval/async-confirm';
+import { ToolExecutorService } from './tools/executor';
 
 export const AgentLayer = AgentService.Default;
 export const SessionLayer = SessionService.Default;
@@ -13,15 +17,43 @@ export const ContextLayer = ContextService.Default;
 export const ToolLayer = ToolService.Default;
 export const HookLayer = HookService.Default;
 export const SkillLayer = SkillService.Default;
+export const SandboxLayer = SandboxService.Default;
+export const ApprovalWaitLayer = ApprovalWaitService.Default;
+/** ApprovalService depends on HookService + ApprovalWaitService — provide them eagerly. */
+export const ApprovalLayer = ApprovalService.Default.pipe(
+  Layer.provide(Layer.mergeAll(HookLayer, ApprovalWaitLayer)),
+);
 
+/** Layer providing all infrastructure services. */
 const InfraLayer = Layer.mergeAll(ToolLayer, HookLayer);
+
+/** MCP depends on ToolLayer + HookLayer. */
 export const McpLayer = McpService.Default.pipe(Layer.provide(InfraLayer));
 
+/** ToolExecutor depends on ToolLayer + HookLayer + ApprovalLayer + SandboxLayer. */
+const ExecutorDeps = Layer.mergeAll(
+  ToolLayer,
+  HookLayer,
+  ApprovalLayer,
+  SandboxLayer,
+);
+const ExecutorLayer = ToolExecutorService.Default.pipe(
+  Layer.provide(ExecutorDeps),
+);
+
+/** Agent depends on ToolExecutor + ToolService. */
+const AgentDeps = Layer.mergeAll(ExecutorLayer, ToolLayer);
+const AgentWithDeps = AgentLayer.pipe(Layer.provide(AgentDeps));
+
+/** Final application layer — all services merged. */
 export const AppLayer = Layer.mergeAll(
-  AgentLayer,
+  AgentWithDeps,
   SessionLayer,
   ContextLayer,
   InfraLayer,
   McpLayer,
   SkillLayer,
+  SandboxLayer,
+  ApprovalLayer,
+  ApprovalWaitLayer,
 );
diff --git a/packages/codingcode/src/mcp/index.ts b/packages/codingcode/src/mcp/index.ts
index f0e215d..a2f7273 100644
--- a/packages/codingcode/src/mcp/index.ts
+++ b/packages/codingcode/src/mcp/index.ts
@@ -74,7 +74,7 @@ function mcpToolToDefinition(
     name: mcpTool.name,
     description: `[MCP:${serverName}] ${mcpTool.description || mcpTool.name}`,
     parameters: z.object({}).passthrough(),
-    schema: mcpTool.inputSchema,
+    jsonSchema: mcpTool.inputSchema,
     execute: async (args: unknown) => {
       const result = await Effect.runPromise(
         client.callTool(mcpTool.name, args as Record<string, unknown>),
diff --git a/packages/codingcode/src/orchestrate.ts b/packages/codingcode/src/orchestrate.ts
index 2e73d7b..24ba7c2 100644
--- a/packages/codingcode/src/orchestrate.ts
+++ b/packages/codingcode/src/orchestrate.ts
@@ -7,12 +7,11 @@ import type { AgentEvent } from './bus/types.js';
 import type { AgentError } from './core/error.js';
 import { Result } from './core/result.js';
 
+// AgentService, ToolExecutorService, HookService all resolved via AppLayer — no need to pass them in
 export const sendMessage = (
   state: SessionStoreState,
   input: string,
   llm: any,
-  executor: any,
-  _hooks: any,
 ) =>
   Effect.gen(function* () {
     const ctx = yield* ContextService;
@@ -21,18 +20,17 @@ export const sendMessage = (
     const skill = yield* SkillService;
     const sid = state.sessionId;
 
-    yield* agent.init({});
-
     const [matchedSkill, actualInput] = yield* skill.extractSkill(input);
     if (matchedSkill) {
-      yield* agent.init({ systemPrompt: matchedSkill.instruction });
+      agent.setSkillInstruction(matchedSkill.instruction);
     }
 
     yield* ctx.addUser(sid, actualInput);
     yield* session.recordUser(state, actualInput);
 
     const messages = yield* ctx.build(sid);
-    const raw = agent.runStream(messages, llm, executor);
+    // agent.runStream now resolves ToolExecutorService internally, no need to pass executor
+    const raw = agent.runStream(messages, llm);
     return wrapStream(raw, ctx, session, state, sid);
   });
 
@@ -43,7 +41,6 @@ export const resumeSession = (
   Effect.gen(function* () {
     const ctx = yield* ContextService;
     const session = yield* SessionService;
-    const agent = yield* AgentService;
     const sid = state.sessionId;
 
     const history = yield* session.readHistory(state);
@@ -51,8 +48,6 @@ export const resumeSession = (
     const msgs = yield* session.readMessages(state);
     yield* ctx.setMessages(sid, msgs);
 
-    yield* agent.init({});
-
     return history;
   });
 
@@ -110,6 +105,14 @@ async function* wrapStream(
         yield `\n[Using: ${event.name}]\n`;
         break;
 
+      case 'ToolDenied':
+        yield `\n[Denied: ${event.name}] ${event.reason}\n`;
+        break;
+
+      case 'ApprovalRequest':
+        yield `\n[Approval: ${event.id}] ${event.tool}\n`;
+        break;
+
       case 'ToolResult': {
         await Effect.runPromise(ctx.addToolResult(sid, event.id, event.output, event.name));
         if (assistantUuid) {
diff --git a/packages/codingcode/src/sandbox/index.ts b/packages/codingcode/src/sandbox/index.ts
index 8502fb2..291a9e7 100644
--- a/packages/codingcode/src/sandbox/index.ts
+++ b/packages/codingcode/src/sandbox/index.ts
@@ -1,56 +1,156 @@
-import { resolve } from "path";
+import { Effect } from 'effect';
+import { exec } from 'node:child_process';
+import { createRequire } from 'node:module';
 
-export interface Sandbox {
-  allowTool(name: string): boolean;
-  allowPath(path: string, access: "read" | "write" | "execute"): boolean;
-  allowCommand(cmd: string): boolean;
+export interface SandboxConfig {
+  allowedDomains?: string[];
+  deniedDomains?: string[];
+  allowReadPaths?: string[];
+  allowWritePaths?: string[];
+  denyReadPaths?: string[];
+  denyWritePaths?: string[];
+  allowUnixSockets?: string[];
+  defaultTimeoutMs?: number;
 }
 
-const BLOCKED_PATHS = [
-  "/etc/passwd",
-  "/etc/shadow",
-];
-
-const BLOCKED_COMMANDS = [
-  "rm -rf /",
-  "dd if=",
-  "mkfs.",
-  ":(){ :|:& };:",
-  "> /dev/sda",
-  "shutdown",
-  "reboot",
-  "halt",
-];
-
-export class DefaultSandbox implements Sandbox {
-  private cwd: string;
-
-  constructor(cwd?: string) {
-    this.cwd = cwd || process.cwd();
-  }
+export interface ExecResult {
+  stdout: string;
+  stderr: string;
+  exitCode: number;
+}
 
-  allowTool(_name: string): boolean {
-    return true;
-  }
+export interface ExecuteOptions {
+  command: string;
+  timeoutMs?: number;
+}
 
-  allowPath(filePath: string, _access: "read" | "write" | "execute"): boolean {
-    const resolved = resolve(filePath);
+interface SrtApi {
+  initialize: (config: Record<string, unknown>) => Promise<void>;
+  isAvailable: () => boolean;
+  wrapWithSandbox: (command: string) => Promise<string>;
+  cleanup: () => Promise<void>;
+}
 
-    // Block sensitive system paths
-    for (const blocked of BLOCKED_PATHS) {
-      if (resolved.startsWith(blocked)) return false;
-    }
+let srtModule: SrtApi | null = null;
 
-    // For now, only allow paths within the current working directory
-    // Relaxed: allow any path, the user is running this locally
-    return true;
+async function loadSrt(): Promise<SrtApi | null> {
+  if (srtModule) return srtModule;
+  const req = createRequire(import.meta.url);
+  try {
+    const mod = req('@anthropic-ai/sandbox-runtime') as {
+      SandboxManager?: {
+        initialize: (cfg: Record<string, unknown>) => Promise<void>;
+        isAvailable: () => boolean;
+        wrapWithSandbox: (cmd: string) => Promise<string>;
+        cleanup: () => Promise<void>;
+      };
+    };
+    const mgr = mod?.SandboxManager;
+    if (!mgr || typeof mgr.isAvailable !== 'function') return null;
+    srtModule = {
+      initialize: (cfg) => mgr.initialize(cfg),
+      isAvailable: () => mgr.isAvailable(),
+      wrapWithSandbox: (cmd) => mgr.wrapWithSandbox(cmd),
+      cleanup: () => mgr.cleanup(),
+    };
+    return srtModule;
+  } catch {
+    return null;
   }
+}
 
-  allowCommand(cmd: string): boolean {
-    const trimmed = cmd.trim().toLowerCase();
-    for (const blocked of BLOCKED_COMMANDS) {
-      if (trimmed.includes(blocked.toLowerCase())) return false;
-    }
-    return true;
-  }
+function spawnWithTimeout(
+  command: string,
+  timeoutMs: number,
+): Promise<ExecResult> {
+  return new Promise((resolve) => {
+    exec(command, { timeout: timeoutMs }, (err: unknown, stdout: string, stderr: string) => {
+      resolve({
+        stdout: stdout ?? '',
+        stderr: stderr ?? '',
+        exitCode: err ? ((err as NodeJS.ErrnoException).code as unknown as number) ?? 1 : 0,
+      });
+    });
+  });
+}
+
+function dieOnError<T>(eff: Effect.Effect<T, unknown, never>): Effect.Effect<T, never, never> {
+  return eff.pipe(Effect.catchAll((e) => Effect.die(e)));
 }
+
+export class SandboxService extends Effect.Service<SandboxService>()('Sandbox', {
+  effect: Effect.gen(function* () {
+    let available = false;
+
+    return {
+      initialize: (cfg: SandboxConfig): Effect.Effect<void> =>
+        Effect.gen(function* () {
+          const srt = yield* dieOnError(Effect.tryPromise(() => loadSrt()));
+          if (!srt || !srt.isAvailable()) {
+            yield* Effect.logWarning(
+              'Sandbox runtime not available (unsupported platform or not installed). ' +
+              'Falling back to application-level approval only.',
+            );
+            available = false;
+            return;
+          }
+
+          yield* dieOnError(Effect.tryPromise(() =>
+            srt.initialize({
+              network: {
+                allowedDomains: cfg.allowedDomains ?? [],
+                deniedDomains: cfg.deniedDomains ?? [],
+                allowLocalBinding: false,
+                allowUnixSockets: cfg.allowUnixSockets ?? [],
+              },
+              filesystem: {
+                denyRead: cfg.denyReadPaths ?? [],
+                allowRead: cfg.allowReadPaths ?? [],
+                allowWrite: cfg.allowWritePaths ?? [],
+                denyWrite: cfg.denyWritePaths ?? [],
+              },
+            }),
+          ));
+          available = true;
+        }),
+
+      wrapCommand: (command: string): Effect.Effect<string> =>
+        Effect.gen(function* () {
+          if (!available) return command;
+          const srt = yield* dieOnError(Effect.tryPromise(() => loadSrt()));
+          if (!srt) return command;
+          return yield* dieOnError(Effect.tryPromise(() => srt.wrapWithSandbox(command)));
+        }),
+
+      execute: (opts: ExecuteOptions): Effect.Effect<ExecResult> =>
+        Effect.gen(function* () {
+          const cmd = opts.command;
+          const timeout = opts.timeoutMs ?? 60000;
+
+          if (!available) {
+            return yield* dieOnError(Effect.tryPromise(() =>
+              spawnWithTimeout(cmd, timeout),
+            ));
+          }
+          const srt = yield* dieOnError(Effect.tryPromise(() => loadSrt()));
+          const wrapped = srt
+            ? yield* dieOnError(Effect.tryPromise(() => srt.wrapWithSandbox(cmd)))
+            : cmd;
+          return yield* dieOnError(Effect.tryPromise(() =>
+            spawnWithTimeout(wrapped, timeout),
+          ));
+        }),
+
+      isAvailable: (): boolean => available,
+
+      cleanup: (): Effect.Effect<void> =>
+        Effect.gen(function* () {
+          const srt = yield* dieOnError(Effect.tryPromise(() => loadSrt()));
+          if (srt) {
+            yield* dieOnError(Effect.tryPromise(() => srt.cleanup()));
+          }
+          available = false;
+        }),
+    };
+  }),
+}) {}
diff --git a/packages/codingcode/src/server/handler.ts b/packages/codingcode/src/server/handler.ts
index 9d7f387..ed4bff8 100644
--- a/packages/codingcode/src/server/handler.ts
+++ b/packages/codingcode/src/server/handler.ts
@@ -1,6 +1,7 @@
 import { Effect } from 'effect';
 import type { Context } from 'hono';
 import { AppLayer } from '../layer.js';
+import { approvalEmitter } from '../approval/async-confirm.js';
 
 type EffectProgram = Effect.Effect<any, any, any>;
 
@@ -28,6 +29,15 @@ export function sseHandler(
           );
         };
 
+        // 设置全局发射器：由 userConfirmAsync 调用，直接推送到 SSE 流
+        approvalEmitter.current = (
+          id: string,
+          tool: string,
+          args: Record<string, unknown>,
+        ) => {
+          enqueue({ type: 'approval_request', id, tool, args });
+        };
+
         try {
           if (opts?.initialEvents) {
             for (const ev of opts.initialEvents) enqueue(ev);
@@ -47,6 +57,8 @@ export function sseHandler(
             type: 'error',
             message: e instanceof Error ? e.message : String(e),
           });
+        } finally {
+          approvalEmitter.current = null;
         }
         controller.close();
       },
diff --git a/packages/codingcode/src/server/index.ts b/packages/codingcode/src/server/index.ts
index e5ee1c2..71a230f 100644
--- a/packages/codingcode/src/server/index.ts
+++ b/packages/codingcode/src/server/index.ts
@@ -2,18 +2,15 @@ import { Hono } from 'hono';
 import { sessionsRouter } from './routes/sessions.js';
 import { messagesRouter } from './routes/messages.js';
 import { modelsRouter } from './routes/models.js';
+import { approvalRouter } from './routes/approval.js';
 
 type ServerDeps = {
   llm: any;
-  executor: any;
-  hooks: any;
 };
 
 declare module 'hono' {
   interface ContextVariableMap {
     llm: any;
-    executor: any;
-    hooks: any;
   }
 }
 
@@ -22,8 +19,6 @@ export function createServer(deps: ServerDeps): Hono {
 
   app.use('*', async (c, next) => {
     c.set('llm', deps.llm);
-    c.set('executor', deps.executor);
-    c.set('hooks', deps.hooks);
     await next();
   });
 
@@ -32,6 +27,7 @@ export function createServer(deps: ServerDeps): Hono {
   app.route('/api/sessions', sessionsRouter);
   app.route('/api', messagesRouter);
   app.route('/api/models', modelsRouter);
+  app.route('/api', approvalRouter);
 
   return app;
 }
diff --git a/packages/codingcode/src/server/routes/approval.ts b/packages/codingcode/src/server/routes/approval.ts
new file mode 100644
index 0000000..f852dbd
--- /dev/null
+++ b/packages/codingcode/src/server/routes/approval.ts
@@ -0,0 +1,38 @@
+import { Hono } from 'hono';
+import { Effect } from 'effect';
+import { ApprovalWaitService } from '../../approval/async-confirm';
+import { AppLayer } from '../../layer';
+
+function parseResponse(response: string): ReturnType<typeof import('../../approval/confirmation')['buildResult']> {
+  switch (response) {
+    case 'allow': return { type: 'allow' as const };
+    case 'deny': return { type: 'deny' as const };
+    case 'always': return {
+      type: 'always' as const,
+      rule: { id: `user-allow-${Date.now()}`, action: 'allow' as const, toolPattern: '*', reason: 'User always allows', source: 'user' as const },
+    };
+    case 'never': return {
+      type: 'never' as const,
+      rule: { id: `user-deny-${Date.now()}`, action: 'deny' as const, toolPattern: '*', reason: 'User never allows', source: 'user' as const },
+    };
+    default: return { type: 'deny' as const };
+  }
+}
+
+const router = new Hono();
+
+router.post('/approval/:id', async (c) => {
+  const id = c.req.param('id');
+  const { response } = await c.req.json<{ response: string }>();
+
+  const result = await Effect.runPromise(
+    Effect.gen(function* () {
+      const svc = yield* ApprovalWaitService;
+      return yield* svc.resolveConfirm(id, parseResponse(response));
+    }).pipe(Effect.provide(AppLayer) as any),
+  );
+
+  return c.json({ ok: result });
+});
+
+export { router as approvalRouter };
diff --git a/packages/codingcode/src/server/routes/messages.ts b/packages/codingcode/src/server/routes/messages.ts
index 91396c0..1fd9d4e 100644
--- a/packages/codingcode/src/server/routes/messages.ts
+++ b/packages/codingcode/src/server/routes/messages.ts
@@ -17,8 +17,6 @@ messagesRouter.post('/sessions/:id/messages', async (c) => {
   const { input } = await c.req.json();
 
   const llm = c.get('llm');
-  const executor = c.get('executor');
-  const hooks = c.get('hooks');
 
   const state = await runWithLayer(
     Effect.gen(function* () {
@@ -29,7 +27,8 @@ messagesRouter.post('/sessions/:id/messages', async (c) => {
 
   if (!sessionId) sessionId = state.sessionId;
 
-  return sseHandler(sendMessage(state, input, llm, executor, hooks) as any, {
+  // sendMessage and services resolve their own dependencies via AppLayer
+  return sseHandler(sendMessage(state, input, llm) as any, {
     initialEvents: [{ type: 'session_id', sessionId }],
   })(c);
 });
diff --git a/packages/codingcode/src/tools/domains/bash/exec.ts b/packages/codingcode/src/tools/domains/bash/exec.ts
index e0f20e1..07217f4 100644
--- a/packages/codingcode/src/tools/domains/bash/exec.ts
+++ b/packages/codingcode/src/tools/domains/bash/exec.ts
@@ -4,22 +4,12 @@ import type { ToolDefinition } from '../../types';
 
 export const bashTool: ToolDefinition = {
   name: 'execute_command',
-  description:
-    'Execute a shell command and return its output. Use for: running tests, checking git status, installing packages, building projects. Commands are sandboxed.',
+  description: 'Execute a shell command and return its output. Use for running tests, git, npm, build, and other CLI operations.',
   parameters: z.object({
     command: z.string().describe('The shell command to execute'),
     cwd: z.string().optional().describe('Working directory (defaults to project root)'),
-    timeout_ms: z.number().int().default(30000).describe('Timeout in ms'),
+    timeout_ms: z.number().int().default(30000).describe('Timeout in milliseconds'),
   }),
-  schema: {
-    type: 'object',
-    properties: {
-      command: { type: 'string', description: 'The shell command to execute' },
-      cwd: { type: 'string', description: 'Working directory (defaults to project root)' },
-      timeout_ms: { type: 'integer', default: 30000, description: 'Timeout in ms' },
-    },
-    required: ['command'],
-  },
   execute: async (args: unknown) => {
     const { command, cwd, timeout_ms } = args as any;
     const workDir = cwd || process.cwd();
diff --git a/packages/codingcode/src/tools/domains/fs/list.ts b/packages/codingcode/src/tools/domains/fs/list.ts
index 8a9919d..73ecb26 100644
--- a/packages/codingcode/src/tools/domains/fs/list.ts
+++ b/packages/codingcode/src/tools/domains/fs/list.ts
@@ -5,16 +5,10 @@ import type { ToolDefinition } from '../../types';
 
 export const listDirTool: ToolDefinition = {
   name: 'list_dir',
-  description: 'List files and directories in a given path.',
+  description: 'List the contents (files and subdirectories) of a given directory. Only top-level entries are returned; recursive listing is not supported.',
   parameters: z.object({
     path: z.string().default('.').describe('Directory path (defaults to current directory)'),
   }),
-  schema: {
-    type: 'object',
-    properties: {
-      path: { type: 'string', default: '.', description: 'Directory path (defaults to current directory)' },
-    },
-  },
   execute: async (args: unknown) => {
     const { path } = args as any;
     const dirPath = resolve(path);
diff --git a/packages/codingcode/src/tools/domains/fs/read.ts b/packages/codingcode/src/tools/domains/fs/read.ts
index 9b31650..5e0265f 100644
--- a/packages/codingcode/src/tools/domains/fs/read.ts
+++ b/packages/codingcode/src/tools/domains/fs/read.ts
@@ -5,22 +5,12 @@ import type { ToolDefinition } from '../../types';
 
 export const readFileTool: ToolDefinition = {
   name: 'read_file',
-  description:
-    'Read the contents of a file with line numbers. Use this before modifying any file.',
+  description: 'Read the contents of a file and return it with line numbers.',
   parameters: z.object({
     path: z.string().describe('Path to the file (absolute or relative)'),
-    offset: z.number().int().min(1).default(1).describe('Line to start from (1-indexed)'),
-    limit: z.number().int().min(1).max(500).default(200).describe('Max lines to read'),
+    offset: z.number().int().min(1).default(1).describe('Line to start reading from (1-indexed)'),
+    limit: z.number().int().min(1).max(500).default(200).describe('Maximum number of lines to read'),
   }),
-  schema: {
-    type: 'object',
-    properties: {
-      path: { type: 'string', description: 'Path to the file (absolute or relative)' },
-      offset: { type: 'integer', minimum: 1, default: 1 },
-      limit: { type: 'integer', minimum: 1, maximum: 500, default: 200 },
-    },
-    required: ['path'],
-  },
   execute: async (args: unknown) => {
     const { path, offset, limit } = args as any;
     const filePath = resolve(path);
diff --git a/packages/codingcode/src/tools/domains/fs/write.ts b/packages/codingcode/src/tools/domains/fs/write.ts
index ac0126d..deea69f 100644
--- a/packages/codingcode/src/tools/domains/fs/write.ts
+++ b/packages/codingcode/src/tools/domains/fs/write.ts
@@ -5,20 +5,11 @@ import type { ToolDefinition } from '../../types';
 
 export const writeFileTool: ToolDefinition = {
   name: 'write_file',
-  description:
-    'Write content to a file. Creates parent directories if needed. Overwrites by default.',
+  description: 'Write content to a file, creating parent directories if needed. Overwrites existing files.',
   parameters: z.object({
     path: z.string().describe('Path to the file'),
     content: z.string().describe('Content to write'),
   }),
-  schema: {
-    type: 'object',
-    properties: {
-      path: { type: 'string', description: 'Path to the file' },
-      content: { type: 'string', description: 'Content to write' },
-    },
-    required: ['path', 'content'],
-  },
   execute: async (args: unknown) => {
     const { path, content } = args as any;
     const filePath = resolve(path);
diff --git a/packages/codingcode/src/tools/domains/search/grep.ts b/packages/codingcode/src/tools/domains/search/grep.ts
index 6d83406..70560a9 100644
--- a/packages/codingcode/src/tools/domains/search/grep.ts
+++ b/packages/codingcode/src/tools/domains/search/grep.ts
@@ -6,22 +6,12 @@ import type { ToolDefinition } from '../../types';
 
 export const searchTool: ToolDefinition = {
   name: 'search_code',
-  description:
-    'Search for a text or regex pattern in project files. Returns matching file paths and line content. Use to find where functions, types, or patterns are defined.',
+  description: 'Search for a text or regex pattern in project files and return matching file paths and line content.',
   parameters: z.object({
     pattern: z.string().describe('Text or regex pattern to search for'),
-    glob: z.string().default('**/*').describe("File glob pattern (e.g. 'src/**/*.ts')"),
-    max_results: z.number().int().min(1).max(100).default(30).describe('Max matches to return'),
+    glob: z.string().default('**/*').describe("File glob pattern to filter which files to search (e.g. 'src/**/*.ts')"),
+    max_results: z.number().int().min(1).max(100).default(30).describe('Maximum number of matches to return'),
   }),
-  schema: {
-    type: 'object',
-    properties: {
-      pattern: { type: 'string', description: 'Text or regex pattern to search for' },
-      glob: { type: 'string', default: '**/*', description: "File glob pattern (e.g. 'src/**/*.ts')" },
-      max_results: { type: 'integer', minimum: 1, maximum: 100, default: 30, description: 'Max matches to return' },
-    },
-    required: ['pattern'],
-  },
   execute: async (args: unknown) => {
     const { pattern, glob, max_results } = args as any;
     const files = await globby(glob, {
diff --git a/packages/codingcode/src/tools/domains/web/fetch.ts b/packages/codingcode/src/tools/domains/web/fetch.ts
index 317d0aa..1ba0eb5 100644
--- a/packages/codingcode/src/tools/domains/web/fetch.ts
+++ b/packages/codingcode/src/tools/domains/web/fetch.ts
@@ -3,8 +3,7 @@ import type { ToolDefinition } from '../../types';
 
 export const webFetchTool: ToolDefinition = {
   name: 'fetch_url',
-  description:
-    'Fetch content from a URL and return its text. Use this to read API documentation, web pages, or any online resource. Supports GET requests only.',
+  description: 'Fetch content from a URL and return its text. Supports GET requests only.',
   parameters: z.object({
     url: z.string().url().describe('The URL to fetch (must be a valid absolute URL)'),
     max_length: z
@@ -15,14 +14,6 @@ export const webFetchTool: ToolDefinition = {
       .default(100_000)
       .describe('Maximum characters to return (default 100k, max 500k)'),
   }),
-  schema: {
-    type: 'object',
-    properties: {
-      url: { type: 'string', description: 'The URL to fetch (must be a valid absolute URL)' },
-      max_length: { type: 'integer', minimum: 1, maximum: 500000, default: 100000 },
-    },
-    required: ['url'],
-  },
   execute: async (args: unknown) => {
     const { url, max_length } = args as any;
     const controller = new AbortController();
diff --git a/packages/codingcode/src/tools/executor.ts b/packages/codingcode/src/tools/executor.ts
index 1060991..320fb68 100644
--- a/packages/codingcode/src/tools/executor.ts
+++ b/packages/codingcode/src/tools/executor.ts
@@ -1,64 +1,109 @@
 import { Effect } from 'effect';
 import { AgentError } from '../core/error';
-import type { HookService } from '../hooks/registry';
-import type { Sandbox } from '../sandbox';
-import type { ToolService } from './registry';
+import { ToolService } from './registry';
+import { HookService } from '../hooks/registry';
+import { ApprovalService } from '../approval/index';
+import type { ToolDefinition } from './types';
 
-export class ToolExecutor {
-  constructor(
-    private registry: ToolService,
-    private hooks: HookService,
-    private sandbox: Sandbox,
-  ) {}
+export class ToolExecutorService extends Effect.Service<ToolExecutorService>()('ToolExecutor', {
+  effect: Effect.gen(function* () {
+    // Capture dependencies once at construction time
+    const registry = yield* ToolService;
+    const hooks = yield* HookService;
+    const approval = yield* ApprovalService;
 
-  getRegistry(): ToolService {
-    return this.registry;
-  }
+    function execute(
+      name: string,
+      args: unknown,
+      opts?: { signal?: AbortSignal },
+    ): Effect.Effect<string, AgentError> {
+      return Effect.gen(function* () {
+        // All services captured from outer closure — no yield* needed for them
+        const toolResult = registry.get(name);
+        if (!toolResult.ok) return yield* Effect.fail(toolResult.error);
+        const tool = toolResult.value as ToolDefinition;
 
-  execute(
-    name: string,
-    args: unknown,
-    opts?: { signal?: AbortSignal },
-  ): Effect.Effect<string, AgentError> {
-    const self = this;
-    return Effect.gen(function* () {
-      const toolResult = self.registry.get(name);
-      if (!toolResult.ok) return yield* Effect.fail(toolResult.error);
-      const tool = toolResult.value;
+        // 1. Approval pipeline (Layers 1-6)
+        const decision = yield* approval.evaluate({
+          tool: name,
+          input: args as Record<string, unknown>,
+        });
 
-      if (!self.sandbox.allowTool(name)) {
-        return yield* Effect.fail(AgentError.toolNotAllowed(name));
-      }
+        if (decision.type === 'deny') {
+          yield* hooks.emit('tool.execute.denied', {
+            toolName: name,
+            args: args as Record<string, unknown>,
+            reason: decision.reason,
+            source: decision.source,
+          });
+          return yield* Effect.fail(
+            new AgentError('TOOL_NOT_ALLOWED', decision.reason),
+          );
+        }
 
-      yield* Effect.sync(() => self.hooks.emitSync('tool.execute.before', {
-        toolName: name,
-        args: args as Record<string, unknown>,
-      }));
+        // Use modified input from pipeline if present
+        let finalArgs: Record<string, unknown> =
+          decision.type === 'modified'
+            ? decision.input
+            : (args as Record<string, unknown>);
 
-      const parsedArgs = yield* Effect.sync(() => tool.parameters.parse(args));
-      const start = Date.now();
-      const result = yield* Effect.tryPromise({
-        try: () => tool.execute(parsedArgs, opts?.signal),
-        catch: (e) => e instanceof AgentError ? e : AgentError.toolExecutionFailed(name, e),
-      });
+        // 2. Hook PreToolUse
+        const hookDecision = yield* hooks.emitDecision('tool.approval.pre', {
+          toolName: name,
+          args: finalArgs,
+        });
+
+        if (hookDecision?.decision === 'deny') {
+          yield* hooks.emit('tool.execute.denied', {
+            toolName: name,
+            args: finalArgs,
+            reason: hookDecision.reason ?? 'denied by hook',
+            source: 'hook',
+          });
+          return yield* Effect.fail(
+            new AgentError('TOOL_NOT_ALLOWED', hookDecision.reason ?? 'denied by hook'),
+          );
+        }
 
-      const durationMs = Date.now() - start;
-      yield* Effect.sync(() => self.hooks.emitSync('tool.execute.after', {
-        toolName: name,
-        args: args as Record<string, unknown>,
-        result,
-        durationMs,
-      }));
+        if (hookDecision?.modifiedInput) {
+          finalArgs = hookDecision.modifiedInput;
+        }
 
-      return result;
-    }).pipe(
-      Effect.tapError((error) =>
-        Effect.sync(() => self.hooks.emitSync('tool.execute.error', {
+        // 3. Notification hook (观察型)
+        yield* hooks.emit('tool.execute.before', {
           toolName: name,
-          args: args as Record<string, unknown>,
-          error,
-        })),
-      ),
-    );
-  }
-}
+          args: finalArgs,
+        });
+
+        const parsedArgs = yield* Effect.sync(() => tool.parameters.parse(finalArgs));
+        const start = Date.now();
+        const result = yield* Effect.tryPromise({
+          try: () => tool.execute(parsedArgs, opts?.signal),
+          catch: (e) =>
+            e instanceof AgentError
+              ? e
+              : AgentError.toolExecutionFailed(name, e),
+        });
+
+        yield* hooks.emit('tool.execute.after', {
+          toolName: name,
+          args: finalArgs,
+          result,
+          durationMs: Date.now() - start,
+        });
+
+        return result;
+      }).pipe(
+        Effect.tapError((error) =>
+          hooks.emit('tool.execute.error', {
+            toolName: name,
+            args: args as Record<string, unknown>,
+            error,
+          }),
+        ),
+      );
+    }
+
+    return { execute };
+  }),
+}) {}
diff --git a/packages/codingcode/src/tools/registry.ts b/packages/codingcode/src/tools/registry.ts
index dd1f03b..c3ecabf 100644
--- a/packages/codingcode/src/tools/registry.ts
+++ b/packages/codingcode/src/tools/registry.ts
@@ -1,19 +1,18 @@
+import { z } from 'zod';
 import { Effect } from 'effect';
 import { AgentError } from '../core/error';
 import { Result } from '../core/result';
 import type { ToolDefinition, ToolDescription } from './types';
 
+// Module-level singleton: shared across all Effect.runPromise scopes
+const tools = new Map<string, ToolDefinition>();
+
 export class ToolService extends Effect.Service<ToolService>()('ToolService', {
   effect: Effect.gen(function* () {
-    const tools = new Map<string, ToolDefinition>();
-
     return {
       register: (tool: ToolDefinition): Effect.Effect<void> =>
         Effect.sync(() => {
-          if (tools.has(tool.name)) {
-            console.warn(`[ToolService] '${tool.name}' already registered, skipping`);
-            return;
-          }
+          if (tools.has(tool.name)) return; // skip duplicates silently
           tools.set(tool.name, tool);
         }),
 
@@ -26,7 +25,7 @@ export class ToolService extends Effect.Service<ToolService>()('ToolService', {
         Array.from(tools.values()).map((t) => ({
           name: t.name,
           description: t.description,
-          parameters: t.schema,
+          parameters: t.jsonSchema ?? (z.toJSONSchema(t.parameters) as Record<string, unknown>),
         })),
 
       filter: (names: string[]): ToolDefinition[] =>
diff --git a/packages/codingcode/src/tools/types.ts b/packages/codingcode/src/tools/types.ts
index 2610deb..346619f 100644
--- a/packages/codingcode/src/tools/types.ts
+++ b/packages/codingcode/src/tools/types.ts
@@ -6,6 +6,7 @@ export interface ToolDefinition {
   name: string;
   description: string;
   parameters: z.ZodTypeAny;
-  schema: Record<string, unknown>;
+  /** Optional JSON Schema override. When absent, the schema is auto-generated from `parameters`. */
+  jsonSchema?: Record<string, unknown>;
   execute: (args: unknown, signal?: AbortSignal) => Promise<string>;
 }
diff --git a/packages/codingcode/test/agent/agent-concurrent.test.ts b/packages/codingcode/test/agent/agent-concurrent.test.ts
index 8cf2225..33f193d 100644
--- a/packages/codingcode/test/agent/agent-concurrent.test.ts
+++ b/packages/codingcode/test/agent/agent-concurrent.test.ts
@@ -3,6 +3,13 @@ import { Effect } from 'effect';
 import { runReActLoop } from '../../src/agent/agent.js';
 import { Result } from '../../src/core/result.js';
 
+const mockToolRegistry = {
+  describeAll: () => [],
+  filter: () => [],
+  get: () => null,
+  register: () => Effect.succeed(undefined),
+};
+
 describe('runReActLoop — concurrent tool execution', () => {
   it('should execute multiple tool calls concurrently', async () => {
     const executionOrder: string[] = [];
@@ -36,16 +43,17 @@ describe('runReActLoop — concurrent tool execution', () => {
           executionOrder.push(name);
           return `result-${name}`;
         }),
-      getRegistry: () => ({ describeAll: () => [], filter: () => [] }),
     };
 
-    const config = { systemPrompt: 'You are a coder', maxSteps: 1, availableTools: undefined };
+    const maxSteps = 1;
 
     const gen = runReActLoop(
       [{ role: 'user', content: 'run all tools' }],
-      config,
+      maxSteps,
+      undefined,
       mockLlm as any,
       mockExecutor as any,
+      mockToolRegistry as any,
     );
 
     const events: any[] = [];
@@ -83,16 +91,17 @@ describe('runReActLoop — concurrent tool execution', () => {
         name === 'bad_tool'
           ? Effect.fail(new Error('Simulated failure') as any)
           : Effect.succeed(`result-${name}`),
-      getRegistry: () => ({ describeAll: () => [], filter: () => [] }),
     };
 
-    const config = { systemPrompt: 'You are a coder', maxSteps: 1, availableTools: undefined };
+    const maxSteps = 1;
 
     const gen = runReActLoop(
       [{ role: 'user', content: 'run all' }],
-      config,
+      maxSteps,
+      undefined,
       mockLlm as any,
       mockExecutor as any,
+      mockToolRegistry as any,
     );
 
     const events: any[] = [];
diff --git a/packages/codingcode/test/agent/agent.test.ts b/packages/codingcode/test/agent/agent.test.ts
index 1fe2091..dbf2a38 100644
--- a/packages/codingcode/test/agent/agent.test.ts
+++ b/packages/codingcode/test/agent/agent.test.ts
@@ -3,6 +3,13 @@ import { Effect } from 'effect';
 import { runReActLoop } from '../../src/agent/agent.js';
 import { Result } from '../../src/core/result.js';
 
+const mockToolRegistry = {
+  describeAll: () => [],
+  filter: () => [],
+  get: () => null,
+  register: () => Effect.succeed(undefined),
+};
+
 describe('runReActLoop', () => {
   it('should yield text chunks from LLM stream', async () => {
     const mockLlm = {
@@ -21,16 +28,17 @@ describe('runReActLoop', () => {
     const mockExecutor = {
       execute: (_name: string, _args: Record<string, unknown>, _opts?: any) =>
         Effect.succeed('done'),
-      getRegistry: () => ({ describeAll: () => [], filter: () => [] }),
     };
 
-    const config = { systemPrompt: 'You are a coder', maxSteps: 25, availableTools: undefined };
+    const maxSteps = 25;
 
     const gen = runReActLoop(
       [{ role: 'user', content: 'hi' }],
-      config,
+      maxSteps,
+      undefined,
       mockLlm as any,
       mockExecutor as any,
+      mockToolRegistry as any,
     );
 
     const events: any[] = [];
@@ -53,16 +61,17 @@ describe('runReActLoop', () => {
     const mockExecutor = {
       execute: (_name: string, _args: Record<string, unknown>, _opts?: any) =>
         Effect.succeed('done'),
-      getRegistry: () => ({ describeAll: () => [], filter: () => [] }),
     };
 
-    const config = { systemPrompt: 'You are a coder', maxSteps: 25, availableTools: undefined };
+    const maxSteps = 25;
 
     const gen = runReActLoop(
       [{ role: 'user', content: 'hi' }],
-      config,
+      maxSteps,
+      undefined,
       mockLlm as any,
       mockExecutor as any,
+      mockToolRegistry as any,
     );
 
     const events: any[] = [];
@@ -74,6 +83,55 @@ describe('runReActLoop', () => {
     expect(textEvents).toHaveLength(0);
   });
 
+  it('should feed bash tool results back to LLM (regression: result was discarded)', async () => {
+    const mockLlm = {
+      completeStream: (_params: any) => ({
+        stream: (async function* () {
+          yield '\n[Using: execute_command]\n';
+        })(),
+        response: Promise.resolve(Result.ok({
+          content: '',
+          toolCalls: [{ id: 'tc1', name: 'execute_command', arguments: { command: 'git status' } }],
+        })),
+      }),
+    };
+
+    const toolRegistryWithBash = {
+      describeAll: () => [
+        { name: 'execute_command', description: 'Run shell command', parameters: { type: 'object' } },
+      ],
+      filter: () => [],
+      get: () => null,
+      register: () => Effect.succeed(undefined),
+    };
+
+    const mockExecutor = {
+      execute: (_name: string, _args: Record<string, unknown>, _opts?: any) =>
+        Effect.succeed('On branch main\nnothing to commit'),
+    };
+
+    const maxSteps = 1;
+
+    const gen = runReActLoop(
+      [{ role: 'user', content: 'git status' }],
+      maxSteps,
+      undefined,
+      mockLlm as any,
+      mockExecutor as any,
+      toolRegistryWithBash as any,
+    );
+
+    const events: any[] = [];
+    for await (const event of gen) {
+      events.push(event);
+    }
+
+    const toolResults = events.filter((e: any) => e._tag === 'ToolResult');
+    expect(toolResults).toHaveLength(1);
+    expect(toolResults[0].output).toBe('On branch main\nnothing to commit');
+    expect(toolResults[0].ok).toBe(true);
+  });
+
   it('should forward tool-call markers from LLM stream', async () => {
     const mockLlm = {
       completeStream: (_params: any) => ({
@@ -87,26 +145,29 @@ describe('runReActLoop', () => {
       }),
     };
 
+    const toolRegistryWithTool = {
+      describeAll: () => [
+        { name: 'readFile', description: 'Read a file', parameters: { type: 'object' } },
+      ],
+      filter: () => [],
+      get: () => null,
+      register: () => Effect.succeed(undefined),
+    };
+
     const mockExecutor = {
       execute: (_name: string, _args: Record<string, unknown>, _opts?: any) =>
         Effect.succeed('file content'),
-      getRegistry: () => ({
-        describeAll: () => [
-          { name: 'readFile', description: 'Read a file', schema: { type: 'object' } },
-        ],
-        filter: () => [
-          { name: 'readFile', description: 'Read a file', schema: { type: 'object' } },
-        ],
-      }),
     };
 
-    const config = { systemPrompt: 'You are a coder', maxSteps: 1, availableTools: undefined };
+    const maxSteps = 1;
 
     const gen = runReActLoop(
       [{ role: 'user', content: 'read file' }],
-      config,
+      maxSteps,
+      undefined,
       mockLlm as any,
       mockExecutor as any,
+      toolRegistryWithTool as any,
     );
 
     const events: any[] = [];
diff --git a/packages/codingcode/test/approval/async-confirm.test.ts b/packages/codingcode/test/approval/async-confirm.test.ts
new file mode 100644
index 0000000..eb366e4
--- /dev/null
+++ b/packages/codingcode/test/approval/async-confirm.test.ts
@@ -0,0 +1,49 @@
+import { describe, it, expect } from 'vitest';
+import { Effect, Layer } from 'effect';
+import { ApprovalWaitService } from '../../src/approval/async-confirm';
+import type { ConfirmResult } from '../../src/approval/confirmation';
+
+const TestLayer = ApprovalWaitService.Default;
+
+function run<T>(eff: Effect.Effect<T, any, any>): Promise<T> {
+  return Effect.runPromise(eff.pipe(Effect.provide(TestLayer) as any));
+}
+
+describe('ApprovalWaitService', () => {
+  it('should wait for and resolve a pending approval', async () => {
+    const result = run(Effect.gen(function* () {
+      const svc = yield* ApprovalWaitService;
+      const id = 'test-1';
+
+      // Fork waitForConfirm so it runs in background
+      yield* Effect.fork(Effect.gen(function* () {
+        yield* Effect.sleep('10 millis');
+        yield* svc.resolveConfirm(id, { type: 'allow' });
+      }));
+
+      return yield* svc.waitForConfirm(id);
+    }));
+
+    await expect(result).resolves.toEqual({ type: 'allow' });
+  });
+
+  it('resolveConfirm should return false for unknown id', async () => {
+    const result = await run(Effect.gen(function* () {
+      const svc = yield* ApprovalWaitService;
+      return yield* svc.resolveConfirm('nonexistent', { type: 'deny' });
+    }));
+    expect(result).toBe(false);
+  });
+
+  it('getPending should list pending approval ids', async () => {
+    const result = await run(Effect.gen(function* () {
+      const svc = yield* ApprovalWaitService;
+
+      yield* Effect.fork(svc.waitForConfirm('pending-1'));
+      yield* Effect.sleep('5 millis');
+
+      return yield* svc.getPending();
+    }));
+    expect(result).toContain('pending-1');
+  });
+});
diff --git a/packages/codingcode/test/approval/pipeline.test.ts b/packages/codingcode/test/approval/pipeline.test.ts
new file mode 100644
index 0000000..4ddafd7
--- /dev/null
+++ b/packages/codingcode/test/approval/pipeline.test.ts
@@ -0,0 +1,120 @@
+import { describe, it, expect } from 'vitest';
+import { Effect } from 'effect';
+import { runPipeline } from '../../src/approval/pipeline.js';
+import { createRuleEngine } from '../../src/approval/rule-engine.js';
+import type { PermissionRule, ApprovalDecision } from '../../src/approval/types.js';
+import { READONLY_TOOLS } from '../../src/approval/types.js';
+
+const mockHooks = {
+  emitPreToolUseDecision: () => Effect.succeed(null),
+  recordAudit: () => Effect.void,
+};
+
+describe('Approval Pipeline', () => {
+  it('Layer 1: Rule Engine deny should short-circuit', async () => {
+    const rules: PermissionRule[] = [
+      { id: 'deny', action: 'deny', toolPattern: '*', argPattern: 'rm -rf *', reason: 'Blocked' },
+    ];
+    const decision = await Effect.runPromise(runPipeline(
+      { tool: 'Bash', input: { command: 'rm -rf /var' } },
+      { ruleEngine: createRuleEngine(rules), readonlyTools: READONLY_TOOLS, destructiveTools: new Set(), permissionMode: 'default', hooks: mockHooks, interactive: false },
+    ));
+    expect(decision.type).toBe('deny');
+    expect(decision.source).toContain('rule:');
+  });
+
+  it('Layer 2: Read-only whitelist should auto-allow', async () => {
+    const decision = await Effect.runPromise(runPipeline(
+      { tool: 'read_file', input: { path: '/safe/file.txt' } },
+      { ruleEngine: createRuleEngine(), readonlyTools: READONLY_TOOLS, destructiveTools: new Set(), permissionMode: 'default', hooks: mockHooks, interactive: false },
+    ));
+    expect(decision.type).toBe('allow');
+    expect(decision.source).toBe('readonly-whitelist');
+  });
+
+  it('Layer 3: Plan mode should deny write tools', async () => {
+    const decision = await Effect.runPromise(runPipeline(
+      { tool: 'write_file', input: { path: '/test.txt', content: 'data' } },
+      { ruleEngine: createRuleEngine(), readonlyTools: READONLY_TOOLS, destructiveTools: new Set(['Bash']), permissionMode: 'plan', hooks: mockHooks, interactive: false },
+    ));
+    expect(decision.type).toBe('deny');
+    expect(decision.reason).toContain('plan mode');
+  });
+
+  it('Layer 3: Plan mode should allow read-only tools', async () => {
+    const decision = await Effect.runPromise(runPipeline(
+      { tool: 'read_file', input: { path: '/test.txt' } },
+      { ruleEngine: createRuleEngine(), readonlyTools: READONLY_TOOLS, destructiveTools: new Set(), permissionMode: 'plan', hooks: mockHooks, interactive: false },
+    ));
+    expect(decision.type).toBe('allow');
+  });
+
+  it('Layer 3: Bypass mode should allow everything', async () => {
+    const decision = await Effect.runPromise(runPipeline(
+      { tool: 'Bash', input: { command: 'rm -rf /' } },
+      { ruleEngine: createRuleEngine(), readonlyTools: READONLY_TOOLS, destructiveTools: new Set(['Bash']), permissionMode: 'bypass', hooks: mockHooks, interactive: false },
+    ));
+    expect(decision.type).toBe('allow');
+    expect(decision.source).toBe('permission-mode');
+  });
+
+  it('Layer 3: AcceptEdits mode should auto-allow non-destructive tools', async () => {
+    const decision = await Effect.runPromise(runPipeline(
+      { tool: 'write_file', input: { path: '/test.txt' } },
+      { ruleEngine: createRuleEngine(), readonlyTools: READONLY_TOOLS, destructiveTools: new Set(['Bash', 'execute_command']), permissionMode: 'acceptEdits', hooks: mockHooks, interactive: false },
+    ));
+    expect(decision.type).toBe('allow');
+  });
+
+  it('Layer 3: AcceptEdits should NOT auto-allow destructive tools', async () => {
+    const decision = await Effect.runPromise(runPipeline(
+      { tool: 'Bash', input: { command: 'rm file' } },
+      { ruleEngine: createRuleEngine(), readonlyTools: READONLY_TOOLS, destructiveTools: new Set(['Bash', 'execute_command']), permissionMode: 'acceptEdits', hooks: mockHooks, interactive: false },
+    ));
+    // Should continue to user confirmation layer (which returns deny in non-interactive mode)
+    expect(decision.type).toBe('deny');
+    expect(decision.source).toBe('user-confirm');
+  });
+
+  it('Layer 4: PreToolUse hook can deny (non-readonly tool)', async () => {
+    const hooksWithDeny = {
+      ...mockHooks,
+      emitPreToolUseDecision: () => Effect.succeed({ decision: 'deny' as const, reason: 'Hook denied' }),
+    };
+    const decision = await Effect.runPromise(runPipeline(
+      { tool: 'Bash', input: { command: 'ls' } },
+      { ruleEngine: createRuleEngine(), readonlyTools: READONLY_TOOLS, destructiveTools: new Set(['Bash']), permissionMode: 'default', hooks: hooksWithDeny, interactive: false },
+    ));
+    expect(decision.type).toBe('deny');
+    expect(decision.source).toBe('hook');
+  });
+
+  it('Layer 4: PreToolUse hook can allow (skiping user confirmation)', async () => {
+    const hooksWithAllow = {
+      ...mockHooks,
+      emitPreToolUseDecision: () => Effect.succeed({ decision: 'allow' as const }),
+    };
+    const decision = await Effect.runPromise(runPipeline(
+      { tool: 'Bash', input: { command: 'ls' } },
+      { ruleEngine: createRuleEngine(), readonlyTools: READONLY_TOOLS, destructiveTools: new Set(['Bash']), permissionMode: 'default', hooks: hooksWithAllow, interactive: false },
+    ));
+    expect(decision.type).toBe('allow');
+    expect(decision.source).toBe('hook');
+  });
+
+  it('Layer 6: Audit log is recorded for every decision', async () => {
+    let auditEntry: any = null;
+    const hooksWithAudit = {
+      ...mockHooks,
+      recordAudit: (entry: any) => Effect.sync(() => { auditEntry = entry; }),
+    };
+    await Effect.runPromise(runPipeline(
+      { tool: 'read_file', input: { path: '/test.txt' } },
+      { ruleEngine: createRuleEngine(), readonlyTools: READONLY_TOOLS, destructiveTools: new Set(), permissionMode: 'default', hooks: hooksWithAudit, interactive: false },
+    ));
+    expect(auditEntry).not.toBeNull();
+    expect(auditEntry.tool).toBe('read_file');
+    expect(auditEntry.layers).toContain('AuditLog');
+    expect(auditEntry.decision.type).toBe('allow');
+  });
+});
diff --git a/packages/codingcode/test/approval/presets.test.ts b/packages/codingcode/test/approval/presets.test.ts
new file mode 100644
index 0000000..493d2d9
--- /dev/null
+++ b/packages/codingcode/test/approval/presets.test.ts
@@ -0,0 +1,52 @@
+import { describe, it, expect } from 'vitest';
+import { createRuleEngine } from '../../src/approval/rule-engine.js';
+import { DEFAULT_DENY_RULES, READONLY_TOOL_NAMES, DESTRUCTIVE_TOOL_NAMES } from '../../src/approval/presets.js';
+
+describe('Presets', () => {
+  it('should have system-source rules', () => {
+    expect(DEFAULT_DENY_RULES.length).toBeGreaterThan(0);
+    for (const rule of DEFAULT_DENY_RULES) {
+      expect(rule.source).toBe('system');
+    }
+  });
+
+  it('should deny rm -rf /', () => {
+    const engine = createRuleEngine(DEFAULT_DENY_RULES);
+    const result = engine.evaluate('*', { command: 'rm -rf /var/log' });
+    expect(result).not.toBeNull();
+    expect(result!.type).toBe('deny');
+  });
+
+  it('should deny sudo commands', () => {
+    const engine = createRuleEngine(DEFAULT_DENY_RULES);
+    const result = engine.evaluate('*', { command: 'sudo apt install' });
+    expect(result).not.toBeNull();
+    expect(result!.type).toBe('deny');
+  });
+
+  it('should ask for SSH key reads', () => {
+    const engine = createRuleEngine(DEFAULT_DENY_RULES);
+    const result = engine.evaluate('read_file', { path: '/home/user/.ssh/id_rsa' });
+    expect(result).not.toBeNull();
+    expect(result!.type).toBe('ask');
+  });
+
+  it('should ask for .env file reads', () => {
+    const engine = createRuleEngine(DEFAULT_DENY_RULES);
+    const result = engine.evaluate('read_file', { path: '/project/.env.production' });
+    expect(result).not.toBeNull();
+    expect(result!.type).toBe('ask');
+  });
+
+  it('should define read-only tools', () => {
+    expect(READONLY_TOOL_NAMES).toContain('read_file');
+    expect(READONLY_TOOL_NAMES).toContain('search_code');
+    expect(READONLY_TOOL_NAMES).toContain('list_dir');
+    expect(READONLY_TOOL_NAMES).toContain('fetch_url');
+  });
+
+  it('should define destructive tools', () => {
+    expect(DESTRUCTIVE_TOOL_NAMES).toContain('execute_command');
+    expect(DESTRUCTIVE_TOOL_NAMES).toContain('Bash');
+  });
+});
diff --git a/packages/codingcode/test/approval/rule-engine.test.ts b/packages/codingcode/test/approval/rule-engine.test.ts
new file mode 100644
index 0000000..a2e38d8
--- /dev/null
+++ b/packages/codingcode/test/approval/rule-engine.test.ts
@@ -0,0 +1,82 @@
+import { describe, it, expect } from 'vitest';
+import { createRuleEngine } from '../../src/approval/rule-engine.js';
+import type { PermissionRule } from '../../src/approval/types.js';
+
+describe('RuleEngine', () => {
+  it('should return null when no rules match', () => {
+    const engine = createRuleEngine();
+    const result = engine.evaluate('Bash', { command: 'echo hello' });
+    expect(result).toBeNull();
+  });
+
+  it('should deny a command matching a deny rule', () => {
+    const rules: PermissionRule[] = [
+      { id: 'deny-rm-root', action: 'deny', toolPattern: '*', argPattern: 'rm -rf *', reason: 'No rm -rf /' },
+    ];
+    const engine = createRuleEngine(rules);
+    const result = engine.evaluate('Bash', { command: 'rm -rf /var' });
+    expect(result).toEqual({ type: 'deny', reason: 'No rm -rf /', source: 'rule:deny-rm-root' });
+  });
+
+  it('should allow a command matching an allow rule', () => {
+    const rules: PermissionRule[] = [
+      { id: 'allow-read', action: 'allow', toolPattern: 'read_file', reason: 'Safe tool' },
+    ];
+    const engine = createRuleEngine(rules);
+    const result = engine.evaluate('read_file', { path: '/tmp/test.txt' });
+    expect(result).toEqual({ type: 'allow', source: 'rule:allow-read' });
+  });
+
+  it('should ask for commands matching an ask rule', () => {
+    const rules: PermissionRule[] = [
+      { id: 'ask-env', action: 'ask', toolPattern: 'read_file', argPattern: '**/.env*', reason: 'Env file' },
+    ];
+    const engine = createRuleEngine(rules);
+    const result = engine.evaluate('read_file', { path: '/project/.env.local' });
+    expect(result).toEqual({ type: 'ask', source: 'rule:ask-env' });
+  });
+
+  it('should respect rule priority (higher priority wins)', () => {
+    const rules: PermissionRule[] = [
+      { id: 'allow-all', action: 'allow', toolPattern: '*', priority: 0 },
+      { id: 'deny-specific', action: 'deny', toolPattern: '*', argPattern: 'rm -rf *', priority: 100, reason: 'Higher priority deny' },
+    ];
+    const engine = createRuleEngine(rules);
+    const result = engine.evaluate('Bash', { command: 'rm -rf /' });
+    expect(result).toEqual({ type: 'deny', reason: 'Higher priority deny', source: 'rule:deny-specific' });
+  });
+
+  it('should match using regex patterns', () => {
+    const rules: PermissionRule[] = [
+      {
+        id: 'deny-curl-sh', action: 'deny', toolPattern: '*',
+        argRegex: /curl.*\|.*sh/,
+        reason: 'Curl to shell not allowed',
+      },
+    ];
+    const engine = createRuleEngine(rules);
+    const result = engine.evaluate('Bash', { command: 'curl -s http://example.com | sh' });
+    expect(result).toEqual({ type: 'deny', reason: 'Curl to shell not allowed', source: 'rule:deny-curl-sh' });
+    expect(engine.evaluate('Bash', { command: 'curl -s http://example.com > file' })).toBeNull();
+  });
+
+  it('should support addRule and removeRule after creation', () => {
+    const engine = createRuleEngine();
+    expect(engine.evaluate('Bash', { command: 'danger' })).toBeNull();
+
+    engine.addRule({ id: 'deny-danger', action: 'deny', toolPattern: '*', argPattern: 'danger', reason: 'Dangerous' });
+    expect(engine.evaluate('Bash', { command: 'danger' })).not.toBeNull();
+
+    engine.removeRule('deny-danger');
+    expect(engine.evaluate('Bash', { command: 'danger' })).toBeNull();
+  });
+
+  it('should match tool name pattern exactly', () => {
+    const rules: PermissionRule[] = [
+      { id: 'deny-bash', action: 'deny', toolPattern: 'Bash', reason: 'No bash' },
+    ];
+    const engine = createRuleEngine(rules);
+    expect(engine.evaluate('Bash', { command: 'ls' })).not.toBeNull();
+    expect(engine.evaluate('Edit', { filePath: 'test.txt' })).toBeNull();
+  });
+});
diff --git a/packages/codingcode/test/context/context.test.ts b/packages/codingcode/test/context/context.test.ts
index e65039a..2dbb66f 100644
--- a/packages/codingcode/test/context/context.test.ts
+++ b/packages/codingcode/test/context/context.test.ts
@@ -3,6 +3,7 @@ import { Effect, Layer } from 'effect';
 import { ContextService } from '../../src/context/context.js';
 import { SessionService } from '../../src/session/store.js';
 import { SkillService } from '../../src/skills/index.js';
+import { ToolExecutorService } from '../../src/tools/executor.js';
 import type { SessionStoreState } from '../../src/session/store.js';
 import { sendMessage } from '../../src/orchestrate.js';
 import { Result } from '../../src/core/result.js';
@@ -20,10 +21,10 @@ const mockLlm = {
   },
 };
 
-const mockExecutor = {
-  execute: (_name: string, _args: Record<string, unknown>, _opts?: any) => Effect.succeed('done'),
-  getRegistry: () => ({ describeAll: () => [], filter: () => [] }),
-};
+const MockToolExecutorLayer = Layer.succeed(ToolExecutorService, ToolExecutorService.of({
+  _tag: 'ToolExecutor' as const,
+  execute: () => Effect.succeed('done'),
+}));
 
 function makeMockSessionLayer(state: SessionStoreState) {
   return Layer.succeed(SessionService, SessionService.of({
@@ -33,110 +34,54 @@ function makeMockSessionLayer(state: SessionStoreState) {
     recordAssistant: () => Effect.succeed({ type: 'assistant' as const, uuid: 'a1', content: '', toolCalls: [], model: 'test', timestamp: new Date().toISOString() }),
     recordToolResult: () => Effect.succeed({ type: 'tool_result' as const, uuid: 't1', parentUuid: 'a1', toolName: 'test', toolCallId: 'tc1', output: '', timestamp: new Date().toISOString() }),
     recordCompactBoundary: () => Effect.succeed({ type: 'compact_boundary' as const, uuid: 'c1', summary: '', replacedRange: [0, 0] as [number, number], messageCount: 0, timestamp: new Date().toISOString() }),
-    readHistory: () => Effect.succeed([]), readMessages: () => Effect.succeed([]), listSessions: () => Effect.succeed([]),
-    getSessionId: () => state.sessionId, getMessageCount: () => 0,
+    readHistory: () => Effect.succeed([]),
+    readMessages: () => Effect.succeed(state.sessionId === 'full-flow' ? [
+      { role: 'user', content: 'message one' },
+    ] : []),
+    listSessions: () => Effect.succeed([]),
+    getSessionId: () => state.sessionId,
+    getMessageCount: () => 0,
   }));
 }
 
-const { ContextLayer } = await import('../../src/layer.js');
-
-describe('ContextService cross-request persistence', () => {
-  it('should retain messages across separate Effect.runPromise calls', async () => {
-    const sid = 'persist-test';
-
-    // First "request": add messages
-    await Effect.runPromise(
-      Effect.gen(function* () {
-        const ctx = yield* ContextService;
-        yield* ctx.addUser(sid, 'hello world');
-        yield* ctx.addAssistant(sid, 'assistant response');
-      }).pipe(Effect.provide(ContextLayer) as any),
-    );
+describe('ContextService', () => {
+  it('should add user message and assistant response', async () => {
+    const sid = 'test-flow';
+    const layer = makeMockSessionLayer({ ...mockState, sessionId: sid });
+    const { ContextLayer } = await import('../../src/layer.js');
+    const fullLayer = Layer.mergeAll(layer, ContextLayer);
 
-    // Second "request": messages should still be there
-    const gen = Effect.gen(function* () {
+    const program = Effect.gen(function* () {
       const ctx = yield* ContextService;
-      return yield* ctx.getMessages(sid);
-    });
-    const msgs = await Effect.runPromise(gen.pipe(Effect.provide(ContextLayer) as any)) as Array<{ role: string; content: string }>;
+      yield* ctx.addUser(sid, 'msg1');
+      yield* ctx.addAssistant(sid, 'resp1', []);
+      const msgs = yield* ctx.getMessages(sid);
+      return msgs;
+    }) as any;
 
+    const msgs = await Effect.runPromise(program.pipe(Effect.provide(fullLayer) as any));
     expect(msgs).toHaveLength(2);
-    expect(msgs[0]).toMatchObject({ role: 'user', content: 'hello world' });
-    expect(msgs[1]).toMatchObject({ role: 'assistant', content: 'assistant response' });
+    expect(msgs[0]!.role).toBe('user');
+    expect(msgs[0]!.content).toBe('msg1');
+    expect(msgs[1]!.role).toBe('assistant');
+    expect(msgs[1]!.content).toBe('resp1');
   });
 
-  it('should isolate messages between different sessions', async () => {
-    const sidA = 'session-a';
-    const sidB = 'session-b';
+  it('should retain context across multiple add calls', async () => {
+    const sid = 'multi-add';
+    const layer = makeMockSessionLayer({ ...mockState, sessionId: sid });
+    const { ContextLayer } = await import('../../src/layer.js');
+    const fullLayer = Layer.mergeAll(layer, ContextLayer);
 
-    await Effect.runPromise(
-      Effect.gen(function* () {
-        const ctx = yield* ContextService;
-        yield* ctx.addUser(sidA, 'message for A');
-      }).pipe(Effect.provide(ContextLayer) as any),
-    );
-
-    const genB = Effect.gen(function* () {
-      const ctx = yield* ContextService;
-      return yield* ctx.getMessages(sidB);
-    });
-    const msgsB = await Effect.runPromise(genB.pipe(Effect.provide(ContextLayer) as any)) as Array<{ role: string; content: string }>;
-
-    expect(msgsB).toHaveLength(0);
-  });
-
-  it('clear() should delete messages for the given session', async () => {
-    const sid = 'clear-test';
-
-    await Effect.runPromise(
-      Effect.gen(function* () {
-        const ctx = yield* ContextService;
-        yield* ctx.addUser(sid, 'before');
-      }).pipe(Effect.provide(ContextLayer) as any),
-    );
-
-    await Effect.runPromise(
-      Effect.gen(function* () {
-        const ctx = yield* ContextService;
-        yield* ctx.clear(sid);
-      }).pipe(Effect.provide(ContextLayer) as any),
-    );
-
-    const g1 = Effect.gen(function* () {
+    const program = Effect.gen(function* () {
       const ctx = yield* ContextService;
+      yield* ctx.clear(sid);
+      yield* ctx.addUser(sid, 'new-1');
+      yield* ctx.addUser(sid, 'new-2');
       return yield* ctx.getMessages(sid);
-    });
-    const msgs = await Effect.runPromise(g1.pipe(Effect.provide(ContextLayer) as any)) as Array<{ role: string; content: string }>;
-
-    expect(msgs).toHaveLength(0);
-  });
-
-  it('setMessages should replace messages for the given session', async () => {
-    const sid = 'set-test';
-
-    await Effect.runPromise(
-      Effect.gen(function* () {
-        const ctx = yield* ContextService;
-        yield* ctx.addUser(sid, 'old');
-      }).pipe(Effect.provide(ContextLayer) as any),
-    );
-
-    await Effect.runPromise(
-      Effect.gen(function* () {
-        const ctx = yield* ContextService;
-        yield* ctx.setMessages(sid, [
-          { role: 'user', content: 'new-1' },
-          { role: 'assistant', content: 'new-2' },
-        ]);
-      }).pipe(Effect.provide(ContextLayer) as any),
-    );
-
-    const g2 = Effect.gen(function* () {
-      const ctx = yield* ContextService;
-      return yield* ctx.getMessages(sid);
-    });
-    const msgs2 = await Effect.runPromise(g2.pipe(Effect.provide(ContextLayer) as any)) as Array<{ role: string; content: string }>;
+    }) as any;
 
+    const msgs2 = await Effect.runPromise(program.pipe(Effect.provide(fullLayer) as any));
     expect(msgs2).toHaveLength(2);
     expect(msgs2[0]!.content).toBe('new-1');
     expect(msgs2[1]!.content).toBe('new-2');
@@ -146,7 +91,8 @@ describe('ContextService cross-request persistence', () => {
     const sid = 'full-flow';
 
     const mockSessionLayer = makeMockSessionLayer({ ...mockState, sessionId: sid });
-    const { AgentLayer } = await import('../../src/layer.js');
+    const { AgentService } = await import('../../src/agent/agent.js');
+    const { ContextLayer } = await import('../../src/layer.js');
 
     const MockSkillLayer = Layer.succeed(SkillService, SkillService.of({
       _tag: 'Skill' as const,
@@ -155,11 +101,14 @@ describe('ContextService cross-request persistence', () => {
       selectImplicit: () => Effect.succeed(undefined), extractSkill: (_input: string) => Effect.succeed([undefined, _input] as [undefined, string]),
     }));
 
-    const fullLayer = Layer.mergeAll(mockSessionLayer, MockSkillLayer, AgentLayer, ContextLayer);
+    const { ToolLayer, HookLayer } = await import('../../src/layer.js');
+    const AgentDeps = Layer.mergeAll(MockToolExecutorLayer, ToolLayer);
+    const TestAgentLayer = AgentService.Default.pipe(Layer.provide(AgentDeps));
+    const fullLayer = Layer.mergeAll(mockSessionLayer, MockSkillLayer, TestAgentLayer, ContextLayer, HookLayer);
 
     // Step 1: send message in one Effect scope
     {
-      const program = sendMessage({ ...mockState, sessionId: sid }, 'message one', mockLlm, mockExecutor, {});
+      const program = sendMessage({ ...mockState, sessionId: sid }, 'message one', mockLlm);
       const gen: any = await Effect.runPromise((program as any).pipe(Effect.provide(fullLayer) as any));
       const chunks: string[] = [];
       for await (const chunk of gen) chunks.push(chunk);
diff --git a/packages/codingcode/test/hooks/decision.test.ts b/packages/codingcode/test/hooks/decision.test.ts
new file mode 100644
index 0000000..fdb2ffe
--- /dev/null
+++ b/packages/codingcode/test/hooks/decision.test.ts
@@ -0,0 +1,84 @@
+import { describe, it, expect } from 'vitest';
+import { Effect, Layer } from 'effect';
+import { HookService } from '../../src/hooks/registry.js';
+
+const TestLayer = HookService.Default;
+
+function run<T>(eff: Effect.Effect<T, any, any>): Promise<T> {
+  return Effect.runPromise(eff.pipe(Effect.provide(TestLayer) as any));
+}
+
+describe('HookService — Decision Handlers', () => {
+  it('should return null from emitDecision when no handlers registered', async () => {
+    const result = await run(Effect.gen(function* () {
+      const hooks = yield* HookService;
+      return yield* hooks.emitDecision('tool.approval.pre', {});
+    }));
+    expect(result).toBeNull();
+  });
+
+  it('should return first non-null decision from registered handlers', async () => {
+    const result = await run(Effect.gen(function* () {
+      const hooks = yield* HookService;
+
+      yield* hooks.registerDecision('tool.approval.pre', () => null, { priority: 10 });
+      yield* hooks.registerDecision('tool.approval.pre', () => ({ decision: 'deny' as const, reason: 'Second handler' }), { priority: 20 });
+      yield* hooks.registerDecision('tool.approval.pre', () => ({ decision: 'allow' as const }), { priority: 30 });
+
+      return yield* hooks.emitDecision('tool.approval.pre', {});
+    }));
+    expect(result).toEqual({ decision: 'deny', reason: 'Second handler' });
+  });
+
+  it('should prioritize lower priority number (runs first)', async () => {
+    const order: number[] = [];
+    const result = await run(Effect.gen(function* () {
+      const hooks = yield* HookService;
+
+      yield* hooks.registerDecision('tool.approval.pre', () => { order.push(20); return null; }, { priority: 20 });
+      yield* hooks.registerDecision('tool.approval.pre', () => { order.push(10); return { decision: 'deny' as const }; }, { priority: 10 });
+
+      const r = yield* hooks.emitDecision('tool.approval.pre', {});
+      return { order, r };
+    }));
+    expect(order).toEqual([10]);  // priority 10 ran first, returned non-null
+    expect(result.r).toEqual({ decision: 'deny' });
+  });
+
+  it('should separate observer and decision handlers', async () => {
+    const calls: string[] = [];
+    const result = await run(Effect.gen(function* () {
+      const hooks = yield* HookService;
+
+      yield* hooks.register('tool.approval.pre', () => { calls.push('observer'); });
+      yield* hooks.registerDecision('tool.approval.pre', () => { calls.push('decision'); return { decision: 'deny' as const }; }, { priority: 5 });
+
+      const r = yield* hooks.emitDecision('tool.approval.pre', {});
+      return { calls, r };
+    }));
+    // emitDecision only runs decision handlers, not observers
+    expect(result.calls).toEqual(['decision']);
+    expect(result.r).toEqual({ decision: 'deny' });
+  });
+
+  it('should unregister decision handler via returned function', async () => {
+    const result = await run(Effect.gen(function* () {
+      const hooks = yield* HookService;
+      const unregister = yield* hooks.registerDecision('tool.approval.pre', () => ({ decision: 'deny' as const }));
+      yield* Effect.sync(() => unregister());
+      return yield* hooks.emitDecision('tool.approval.pre', {});
+    }));
+    expect(result).toBeNull();
+  });
+
+  it('should support allow/ask/deny from decision handler', async () => {
+    const result = await run(Effect.gen(function* () {
+      const hooks = yield* HookService;
+
+      yield* hooks.registerDecision('tool.approval.pre', () => ({ decision: 'ask' as const }));
+
+      return yield* hooks.emitDecision('tool.approval.pre', {});
+    }));
+    expect(result).toEqual({ decision: 'ask' });
+  });
+});
diff --git a/packages/codingcode/test/orchestrate.test.ts b/packages/codingcode/test/orchestrate.test.ts
index 407904d..0bc9e66 100644
--- a/packages/codingcode/test/orchestrate.test.ts
+++ b/packages/codingcode/test/orchestrate.test.ts
@@ -3,6 +3,7 @@ import { Effect, Layer } from 'effect';
 import { sendMessage } from '../src/orchestrate.js';
 import { SessionService, type SessionStoreState } from '../src/session/store.js';
 import { SkillService } from '../src/skills/index.js';
+import { ToolExecutorService } from '../src/tools/executor.js';
 import { Result } from '../src/core/result.js';
 
 const mockState: SessionStoreState = {
@@ -18,10 +19,10 @@ const mockLlm = {
   },
 };
 
-const mockExecutor = {
-  execute: (_name: string, _args: Record<string, unknown>, _opts?: any) => Effect.succeed('done'),
-  getRegistry: () => ({ describeAll: () => [], filter: () => [] }),
-};
+const MockToolExecutorLayer = Layer.succeed(ToolExecutorService, ToolExecutorService.of({
+  _tag: 'ToolExecutor' as const,
+  execute: () => Effect.succeed('done'),
+}));
 
 const MockSessionLayer = Layer.succeed(SessionService, SessionService.of({
   _tag: 'Session' as const,
@@ -41,12 +42,15 @@ const MockSkillLayer = Layer.succeed(SkillService, SkillService.of({
   selectImplicit: () => Effect.succeed(undefined), extractSkill: () => Effect.succeed([undefined, 'hi']),
 }));
 
-const { AgentLayer, ContextLayer } = await import('../src/layer.js');
-const TestLayer = Layer.mergeAll(MockSessionLayer, MockSkillLayer, AgentLayer, ContextLayer);
+const { AgentService } = await import('../src/agent/agent.js');
+const { ContextLayer, ToolLayer, HookLayer } = await import('../src/layer.js');
+const AgentDeps = Layer.mergeAll(MockToolExecutorLayer, ToolLayer);
+const TestAgentLayer = AgentService.Default.pipe(Layer.provide(AgentDeps));
+const TestLayer = Layer.mergeAll(MockSessionLayer, MockSkillLayer, TestAgentLayer, ContextLayer, HookLayer);
 
 describe('sendMessage stream', () => {
   it('should yield text chunks from LLM', async () => {
-    const program = sendMessage(mockState, 'hi', mockLlm, mockExecutor, {});
+    const program = sendMessage(mockState, 'hi', mockLlm);
     const generator: any = await Effect.runPromise(program.pipe(Effect.provide(TestLayer) as any));
 
     const chunks: string[] = [];
@@ -58,7 +62,7 @@ describe('sendMessage stream', () => {
   });
 
   it('should not return empty stream for normal LLM response', async () => {
-    const program = sendMessage(mockState, 'hi', mockLlm, mockExecutor, {});
+    const program = sendMessage(mockState, 'hi', mockLlm);
     const generator: any = await Effect.runPromise(program.pipe(Effect.provide(TestLayer) as any));
 
     const chunks: string[] = [];
diff --git a/packages/codingcode/test/sandbox/wrap-command.test.ts b/packages/codingcode/test/sandbox/wrap-command.test.ts
new file mode 100644
index 0000000..062899e
--- /dev/null
+++ b/packages/codingcode/test/sandbox/wrap-command.test.ts
@@ -0,0 +1,52 @@
+import { describe, it, expect } from 'vitest';
+import { Effect, Layer } from 'effect';
+import { SandboxService } from '../../src/sandbox/index.js';
+
+const TestLayer = SandboxService.Default;
+
+function run<T>(eff: Effect.Effect<T, any, any>): Promise<T> {
+  return Effect.runPromise(eff.pipe(Effect.provide(TestLayer) as any));
+}
+
+describe('SandboxService', () => {
+  it('should not be available by default (no @vscode/sandbox-runtime)', async () => {
+    const result = await run(Effect.gen(function* () {
+      const sandbox = yield* SandboxService;
+      return sandbox.isAvailable();
+    }));
+    expect(result).toBe(false);
+  });
+
+  it('should wrapCommand passthrough when not available', async () => {
+    const result = await run(Effect.gen(function* () {
+      const sandbox = yield* SandboxService;
+      return yield* sandbox.wrapCommand('echo hello');
+    }));
+    expect(result).toBe('echo hello');
+  });
+
+  it('should initialize gracefully when @vscode/sandbox-runtime is not installed', async () => {
+    const result = await run(Effect.gen(function* () {
+      const sandbox = yield* SandboxService;
+      yield* sandbox.initialize({});
+      return sandbox.isAvailable();
+    }));
+    expect(result).toBe(false);
+  });
+
+  it('should cleanup gracefully even when not initialized', async () => {
+    await run(Effect.gen(function* () {
+      const sandbox = yield* SandboxService;
+      yield* sandbox.cleanup();
+    }));
+    // Should not throw
+  });
+
+  it('should execute command via fallback when sandbox unavailable', async () => {
+    const result = await run(Effect.gen(function* () {
+      const sandbox = yield* SandboxService;
+      return yield* sandbox.execute({ command: 'echo hello', timeoutMs: 5000 });
+    }));
+    expect(result.stdout).toContain('hello');
+  });
+});
diff --git a/packages/codingcode/test/server/handler.test.ts b/packages/codingcode/test/server/handler.test.ts
index f7aebec..9fb25e7 100644
--- a/packages/codingcode/test/server/handler.test.ts
+++ b/packages/codingcode/test/server/handler.test.ts
@@ -4,6 +4,7 @@ import { sseHandler } from '../../src/server/handler.js';
 import { sendMessage } from '../../src/orchestrate.js';
 import { SessionService, type SessionStoreState } from '../../src/session/store.js';
 import { SkillService } from '../../src/skills/index.js';
+import { ToolExecutorService } from '../../src/tools/executor.js';
 import { Result } from '../../src/core/result.js';
 
 function createMockState(overrides: Partial<SessionStoreState> = {}): SessionStoreState {
@@ -33,13 +34,10 @@ function createMockLlm(chunks?: string[], responseContent?: string) {
   };
 }
 
-const mockExecutor = {
-  execute: (_name: string, _args: Record<string, unknown>, _opts?: any) =>
-    Effect.succeed('done'),
-  getRegistry: () => ({ describeAll: () => [], filter: () => [] }),
-};
-
-const mockHooks = {};
+const MockToolExecutorLayer = Layer.succeed(ToolExecutorService, ToolExecutorService.of({
+  _tag: 'ToolExecutor' as const,
+  execute: () => Effect.succeed('done'),
+}));
 
 const MockSessionLayer = Layer.succeed(
   SessionService,
@@ -75,15 +73,20 @@ const MockSkillLayer = Layer.succeed(
   }),
 );
 
-const { AgentLayer, ContextLayer } = await import('../../src/layer.js');
+const { AgentService } = await import('../../src/agent/agent.js');
+const { ContextLayer, ToolLayer, HookLayer } = await import('../../src/layer.js');
+const AgentDeps = Layer.mergeAll(MockToolExecutorLayer, ToolLayer);
+const TestAgentLayer = AgentService.Default.pipe(Layer.provide(AgentDeps));
 
 const TestLayer = Layer.mergeAll(
   MockSessionLayer,
   MockSkillLayer,
-  AgentLayer,
+  TestAgentLayer,
   ContextLayer,
+  HookLayer,
 );
 
+
 async function readSSEStream(response: Response): Promise<{ events: any[] }> {
   const reader = response.body!.getReader();
   const decoder = new TextDecoder();
@@ -109,7 +112,7 @@ describe('sseHandler + sendMessage integration', () => {
   it('should stream text chunks and complete event', async () => {
     const llm = createMockLlm(['Hello', ' ', 'world']);
     const state = createMockState();
-    const program = sendMessage(state, 'hi', llm, mockExecutor, mockHooks) as any;
+    const program = sendMessage(state, 'hi', llm) as any;
     const handler = sseHandler(program);
     const response = await handler({} as any);
     const { events } = await readSSEStream(response);
@@ -124,7 +127,7 @@ describe('sseHandler + sendMessage integration', () => {
   it('should send complete event even when LLM returns no text', async () => {
     const llm = createMockLlm([], '');
     const state = createMockState();
-    const program = sendMessage(state, 'hi', llm, mockExecutor, mockHooks) as any;
+    const program = sendMessage(state, 'hi', llm) as any;
     const handler = sseHandler(program);
     const response = await handler({} as any);
     const { events } = await readSSEStream(response);
@@ -148,7 +151,7 @@ describe('sseHandler + sendMessage integration', () => {
     };
 
     const state = createMockState();
-    const program = sendMessage(state, 'read file', llm, mockExecutor, mockHooks) as any;
+    const program = sendMessage(state, 'read file', llm) as any;
     const handler = sseHandler(program);
     const response = await handler({} as any);
     const { events } = await readSSEStream(response);
diff --git a/packages/codingcode/test/tools/descriptions.test.ts b/packages/codingcode/test/tools/descriptions.test.ts
new file mode 100644
index 0000000..dc3859c
--- /dev/null
+++ b/packages/codingcode/test/tools/descriptions.test.ts
@@ -0,0 +1,63 @@
+import { describe, it, expect } from 'vitest';
+import { listDirTool } from '../../src/tools/domains/fs/list.js';
+import { readFileTool } from '../../src/tools/domains/fs/read.js';
+import { writeFileTool } from '../../src/tools/domains/fs/write.js';
+import { bashTool } from '../../src/tools/domains/bash/exec.js';
+import { searchTool } from '../../src/tools/domains/search/grep.js';
+import { webFetchTool } from '../../src/tools/domains/web/fetch.js';
+import { z } from 'zod';
+import type { ToolDefinition } from '../../src/tools/types.js';
+
+const allTools: ToolDefinition[] = [
+  listDirTool,
+  readFileTool,
+  writeFileTool,
+  bashTool,
+  searchTool,
+  webFetchTool,
+];
+
+describe('tool descriptions', () => {
+  it('should not mention tool name in description', () => {
+    for (const tool of allTools) {
+      expect(tool.description).not.toMatch(
+        /tool name is/i,
+      );
+      expect(tool.description).not.toContain(tool.name);
+    }
+  });
+
+  it('should not inline parameter docs in description', () => {
+    for (const tool of allTools) {
+      // Description should describe behavior, not list params
+      expect(tool.description).not.toMatch(
+        /parameters?\s*:/i,
+      );
+    }
+  });
+
+  it('should have a non-empty description', () => {
+    for (const tool of allTools) {
+      expect(tool.description.length).toBeGreaterThan(10);
+    }
+  });
+});
+
+describe('tool JSON Schema auto-generation', () => {
+  for (const tool of allTools) {
+    it(`${tool.name} should generate valid JSON Schema from parameters`, () => {
+      const js = z.toJSONSchema(tool.parameters) as Record<string, unknown>;
+      expect(js.type).toBe('object');
+      expect(js.properties).toBeDefined();
+      expect(typeof js.properties).toBe('object');
+    });
+  }
+});
+
+describe('tool jsonSchema override', () => {
+  it('should not have hand-written jsonSchema on built-in tools', () => {
+    for (const tool of allTools) {
+      expect(tool.jsonSchema).toBeUndefined();
+    }
+  });
+});
diff --git a/packages/codingcode/test/tools/registry.test.ts b/packages/codingcode/test/tools/registry.test.ts
index 93b0a0a..93039bc 100644
--- a/packages/codingcode/test/tools/registry.test.ts
+++ b/packages/codingcode/test/tools/registry.test.ts
@@ -10,7 +10,6 @@ function makeTool(name: string): ToolDefinition {
     name,
     description: `Tool ${name}`,
     parameters: z.object({}),
-    schema: { type: 'object' },
     execute: async () => `result-${name}`,
   };
 }
diff --git a/packages/codingcode/test/tools/schema.test.ts b/packages/codingcode/test/tools/schema.test.ts
new file mode 100644
index 0000000..fd0177a
--- /dev/null
+++ b/packages/codingcode/test/tools/schema.test.ts
@@ -0,0 +1,45 @@
+import { describe, it, expect } from 'vitest';
+import { z } from 'zod';
+
+const toJson = (s: z.ZodTypeAny) => z.toJSONSchema(s) as Record<string, unknown>;
+
+describe('z.toJSONSchema (Zod built-in)', () => {
+  it('should convert a simple object with string property', () => {
+    const result = toJson(z.object({ name: z.string() }));
+    expect(result.type).toBe('object');
+    expect((result.properties as any).name.type).toBe('string');
+    expect(result.required).toContain('name');
+  });
+
+  it('should handle optional properties', () => {
+    const result = toJson(z.object({
+      required: z.string(),
+      optional: z.string().optional(),
+    }));
+    expect(result.required).toContain('required');
+    expect(result.required).not.toContain('optional');
+  });
+
+  it('should preserve default values in schema', () => {
+    const result = toJson(z.object({ path: z.string().default('.') }));
+    expect((result.properties as any).path.default).toBe('.');
+  });
+
+  it('should handle number constraints', () => {
+    const result = toJson(z.object({ count: z.number().int().min(1).max(100) }));
+    const prop = (result.properties as any).count;
+    expect(prop.type).toBe('integer');
+    expect(prop.minimum).toBe(1);
+    expect(prop.maximum).toBe(100);
+  });
+
+  it('should include parameter descriptions', () => {
+    const result = toJson(z.object({ path: z.string().describe('The file path') }));
+    expect((result.properties as any).path.description).toBe('The file path');
+  });
+
+  it('should handle url validator', () => {
+    const result = toJson(z.object({ url: z.string().url() }));
+    expect((result.properties as any).url.format).toBe('uri');
+  });
+});
diff --git a/packages/tui/src/components/App.tsx b/packages/tui/src/components/App.tsx
index 50db108..c3b0332 100644
--- a/packages/tui/src/components/App.tsx
+++ b/packages/tui/src/components/App.tsx
@@ -4,6 +4,7 @@ import { useAgentRunner } from '../hooks/useAgentRunner.js';
 import { useTerminalSize } from '../hooks/useTerminalSize.js';
 import { generateId, historyToUIMessages } from '../utils.js';
 import type { PanelState } from '../types.js';
+import type { StreamChunk } from '../index.js';
 import { MessageItem } from './MessageItem.js';
 import { InputBox } from './InputBox.js';
 import { LoadingIndicator } from './LoadingIndicator.js';
@@ -20,7 +21,7 @@ export function App({ client }: AppProps) {
   const { width } = useTerminalSize();
   const [sessionId, setSessionId] = useState('unknown');
   const runner = useCallback(
-    (input: string) => client.sendMessage(input),
+    (input: string) => client.sendMessage(input) as AsyncGenerator<StreamChunk>,
     [client],
   );
   const {
@@ -30,6 +31,8 @@ export function App({ client }: AppProps) {
     setActiveMessages,
     run,
     isRunning,
+    approval,
+    setApproval,
   } = useAgentRunner(runner);
   const [panel, setPanel] = useState<PanelState>({ type: 'none' });
   const [focusedIndex, setFocusedIndex] = useState<number | null>(null);
@@ -122,7 +125,17 @@ export function App({ client }: AppProps) {
     }
   }, [client, run, exit, sessionId]);
 
-  useInput((_input, key) => {
+  // 审批面板：用户选择后发送响应
+  const handleApprovalResponse = useCallback(async (response: string) => {
+    if (!approval) return;
+    await client.sendApprovalResponse(approval.id, response);
+    approval.resolve(response);
+  }, [approval, client]);
+
+  useInput((input, key) => {
+    // 审批面板激活时，键盘由 InlinePanel 处理
+    if (approval) return;
+
     if (panel.type === 'help') {
       if (key.escape) setPanel({ type: 'none' });
       return;
@@ -139,7 +152,7 @@ export function App({ client }: AppProps) {
       setFocusedIndex(prev => (prev === null || prev >= activeMessages.length - 1) ? 0 : prev + 1);
       return;
     }
-    if (key.ctrl && _input === 'o' && focusedIndex !== null) {
+    if (key.ctrl && input === 'o' && focusedIndex !== null) {
       const msg = activeMessages[focusedIndex];
       if (msg) setExpandedMap(prev => ({ ...prev, [msg.id]: !prev[msg.id] }));
     }
@@ -162,7 +175,7 @@ export function App({ client }: AppProps) {
         {activeMessages.map((msg, index) => (
           <MessageItem key={msg.id} message={msg} isFocused={index === focusedIndex} width={width} expanded={expandedMap[msg.id] ?? msg.role !== 'tool'} interactive={true} />
         ))}
-        {isRunning && <LoadingIndicator />}
+        {isRunning && !approval && <LoadingIndicator />}
       </Box>
 
       {panel.type === 'model' && (
@@ -194,6 +207,40 @@ export function App({ client }: AppProps) {
           width={sessionW}
         />
       )}
+      {approval && (
+        <Box flexDirection="column" borderStyle="single" borderColor="yellow" paddingX={1} marginY={1}>
+          <Box>
+            <Text bold color="yellow">🔒 审批请求 — </Text>
+            <Text bold>{approval.tool}</Text>
+          </Box>
+          <Box flexDirection="column" marginTop={1}>
+            {Object.entries(approval.args).map(([k, v]) => (
+              <Box key={k}>
+                <Text color="gray">  {k}: </Text>
+                <Text>{String(v).slice(0, 150)}</Text>
+              </Box>
+            ))}
+          </Box>
+          <Box marginTop={1}>
+            <Text color="gray">{'─'.repeat(Math.min(40, width - 6))}</Text>
+          </Box>
+          <InlinePanel
+            title="选择操作"
+            items={[
+              { label: '✅ 允许 (Allow)', value: 'allow' as const },
+              { label: '❌ 拒绝 (Deny)', value: 'deny' as const },
+              { label: '⭐ 总是允许 (Always)', value: 'always' as const },
+              { label: '🚫 永不 (Never)', value: 'never' as const },
+            ]}
+            onSelect={async (value) => {
+              await client.sendApprovalResponse(approval.id, value);
+              approval.resolve(value);
+            }}
+            onCancel={() => handleApprovalResponse('deny')}
+            width={Math.min(50, width - 4)}
+          />
+        </Box>
+      )}
       {panel.type === 'help' && (
         <Box flexDirection="column" borderStyle="single" borderColor="green" width={helpW} paddingX={1}>
           <Box>
diff --git a/packages/tui/src/hooks/useAgentRunner.ts b/packages/tui/src/hooks/useAgentRunner.ts
index 43405d0..417e70b 100644
--- a/packages/tui/src/hooks/useAgentRunner.ts
+++ b/packages/tui/src/hooks/useAgentRunner.ts
@@ -1,12 +1,20 @@
 import { useState, useCallback } from 'react';
 import type { UIMessage } from '../types.js';
+import type { StreamChunk } from '../index.js';
 import { generateId } from '../utils.js';
 
-// 接收 AsyncGenerator<string>，不感知传输协议
-export function useAgentRunner(runner: (input: string) => AsyncGenerator<string>) {
+export interface ApprovalPanel {
+  id: string;
+  tool: string;
+  args: Record<string, unknown>;
+  resolve: (response: string) => void;
+}
+
+export function useAgentRunner(runner: (input: string) => AsyncGenerator<StreamChunk>) {
   const [staticMessages, setStaticMessages] = useState<UIMessage[]>([]);
   const [activeMessages, setActiveMessages] = useState<UIMessage[]>([]);
   const [isRunning, setIsRunning] = useState(false);
+  const [approval, setApproval] = useState<ApprovalPanel | null>(null);
 
   const run = useCallback(async (input: string) => {
     setIsRunning(true);
@@ -34,25 +42,51 @@ export function useAgentRunner(runner: (input: string) => AsyncGenerator<string>
       const stream = runner(input);
 
       for await (const chunk of stream) {
-        if (chunk.startsWith('[Using:')) {
-          const toolName = chunk.replace('[Using:', '').replace(']', '').trim();
-          setStaticMessages(prev => [...prev, {
-            id: generateId(),
+        if (typeof chunk === 'string') {
+          if (chunk.startsWith('[Using:')) {
+            const toolName = chunk.replace('[Using:', '').replace(']', '').trim();
+            setStaticMessages(prev => [...prev, {
+              id: generateId(),
+              timestamp: Date.now(),
+              role: 'tool',
+              content: '',
+              toolName,
+            }]);
+            continue;
+          }
+          if (chunk.startsWith('[Denied:')) {
+            const rest = chunk.replace('[Denied:', '').trim();
+            const [toolName, ...reasonParts] = rest.split(']');
+            setStaticMessages(prev => [...prev, {
+              id: generateId(),
+              timestamp: Date.now(),
+              role: 'system',
+              content: `⛔ Tool "${toolName}" was denied: ${reasonParts.join(']').trim() || 'not allowed'}`,
+              toolName: toolName,
+            }]);
+            continue;
+          }
+          assistantContent += chunk;
+          setActiveMessages([{
+            id: assistantId,
             timestamp: Date.now(),
-            role: 'tool',
-            content: '',
-            toolName,
+            role: 'assistant',
+            content: assistantContent,
+            isStreaming: true,
           }]);
-          continue;
+        } else if (chunk.type === 'approval_request') {
+          // 收到审批请求 → 显示 InlinePanel，暂停流读取
+          const response = await new Promise<string>((resolve) => {
+            setApproval({
+              id: chunk.id,
+              tool: chunk.tool,
+              args: chunk.args,
+              resolve,
+            });
+          });
+          // 用户已选择 → 关闭面板，继续流
+          setApproval(null);
         }
-        assistantContent += chunk;
-        setActiveMessages([{
-          id: assistantId,
-          timestamp: Date.now(),
-          role: 'assistant',
-          content: assistantContent,
-          isStreaming: true,
-        }]);
       }
 
       setActiveMessages([]);
@@ -81,5 +115,5 @@ export function useAgentRunner(runner: (input: string) => AsyncGenerator<string>
     setActiveMessages([]);
   }, []);
 
-  return { staticMessages, activeMessages, setStaticMessages, setActiveMessages, run, isRunning, clearMessages };
+  return { staticMessages, activeMessages, setStaticMessages, setActiveMessages, run, isRunning, clearMessages, approval, setApproval };
 }
diff --git a/packages/tui/src/index.tsx b/packages/tui/src/index.tsx
index 0a08c90..1291453 100644
--- a/packages/tui/src/index.tsx
+++ b/packages/tui/src/index.tsx
@@ -6,12 +6,14 @@ interface TuiOptions {
   serverUrl?: string;
 }
 
+export type StreamChunk = string | { type: 'approval_request'; id: string; tool: string; args: Record<string, unknown> };
+
 export function runTui(options: TuiOptions = {}) {
   const serverUrl = options.serverUrl ?? 'http://localhost:8080';
   let currentSessionId: string | undefined;
 
   const client = {
-    async *sendMessage(input: string): AsyncGenerator<string> {
+    async *sendMessage(input: string): AsyncGenerator<StreamChunk> {
       const response = await fetch(`${serverUrl}/api/sessions/${currentSessionId || '_'}/messages`, {
         method: 'POST', body: JSON.stringify({ input }),
         headers: { 'Content-Type': 'application/json' },
@@ -34,6 +36,8 @@ export function runTui(options: TuiOptions = {}) {
               currentSessionId = data.sessionId;
             } else if (data.type === 'text') {
               yield data.text;
+            } else if (data.type === 'approval_request') {
+              yield { type: 'approval_request', id: data.id, tool: data.tool, args: data.args };
             } else if (data.type === 'complete') {
               return;
             } else if (data.type === 'error') {
@@ -44,6 +48,14 @@ export function runTui(options: TuiOptions = {}) {
       }
     },
 
+    async sendApprovalResponse(id: string, response: string) {
+      await fetch(`${serverUrl}/api/approval/${id}`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ response }),
+      });
+    },
+
     async resumeSession(sid: string) {
       currentSessionId = sid;
       const res = await fetch(`${serverUrl}/api/sessions/${sid}/resume`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ cwd: process.cwd() }) });
@@ -56,10 +68,5 @@ export function runTui(options: TuiOptions = {}) {
     async clearSession() {},
   };
 
-  const { waitUntilExit } = render(<App client={client} />);
-
-  process.on('SIGINT', () => { process.exit(0); });
-  process.on('SIGTERM', () => { process.exit(0); });
-
-  return { waitUntilExit };
+  render(<App client={client} />);
 }
diff --git a/packages/tui/src/types.ts b/packages/tui/src/types.ts
index c997aae..3c14d55 100644
--- a/packages/tui/src/types.ts
+++ b/packages/tui/src/types.ts
@@ -28,4 +28,5 @@ export type PanelState =
   | { type: 'none' }
   | { type: 'model'; items: PanelItem[]; activeValue: string }
   | { type: 'sessions'; items: PanelItem[] }
+  | { type: 'approval'; id: string; tool: string; args: Record<string, unknown> }
   | { type: 'help' };