From 6e114aa5fe0e719fd30cc0d186013cda5d033b86 Mon Sep 17 00:00:00 2001
From: larryro <371767072@qq.com>
Date: Fri, 20 Mar 2026 13:46:16 +0800
Subject: [PATCH 1/9] feat(platform): add human input approvals to workflow
 engine and fix Outlook pagination

Implement end-to-end human input request flow for workflow executions,
allowing LLM agents to pause and request user input via approval cards.
Adds approval queries, mutation handlers, and chat UI components for
reviewing and responding to input requests. Also fixes Outlook connector
cursor-based pagination with position-based skip to handle sub-second
timestamp precision issues.
---
 examples/integrations/outlook/connector.ts    |  41 ++-
 .../workflows/contract-generation/config.json |   4 +-
 .../chat/components/chat-interface.tsx        |  30 ++-
 .../components/workflow-run-approval-card.tsx | 239 +++++++++++++++++-
 .../chat/hooks/use-execution-status.ts        |  10 +
 .../human_input/internal_mutations.ts         |  29 ++-
 .../agent_tools/human_input/mutations.ts      |  39 +++
 .../human_input/request_human_input_tool.ts   |  10 +
 .../convex/approvals/internal_queries.ts      |  70 +++++
 services/platform/convex/approvals/queries.ts |  22 ++
 .../platform/convex/wf_executions/queries.ts  |   1 +
 .../conversation/conversation_action.ts       |   8 +
 .../engine/dynamic_workflow_handler.ts        |  49 +++-
 .../helpers/engine/execute_step_handler.ts    |  51 +++-
 .../nodes/llm/execute_agent_with_tools.ts     |  10 +-
 .../helpers/nodes/llm/execute_llm_node.ts     |  31 +++
 .../workflow_engine/internal_actions.ts       |   2 +
 17 files changed, 626 insertions(+), 20 deletions(-)

diff --git a/examples/integrations/outlook/connector.ts b/examples/integrations/outlook/connector.ts
index 40aa341f7..5fa85c457 100644
--- a/examples/integrations/outlook/connector.ts
+++ b/examples/integrations/outlook/connector.ts
@@ -310,16 +310,28 @@ function listMessages(
   headers: Record<string, string>,
   params: Record<string, unknown>,
 ) {
-  const top = Math.min((params.top as number) || 25, 100);
+  const requestedTop = Math.min((params.top as number) || 25, 100);
   const orderby = (params.orderby as string) || 'receivedDateTime desc';
 
-  // Build filter: prefer explicit cursor param, fall back to raw filter string
-  const cursor = params.cursor as { receivedDateTime?: string } | undefined;
+  // Build filter: prefer explicit cursor param, fall back to raw filter string.
+  // Use `ge` (>=) so that messages at the cursor's exact second are included;
+  // the cursor message itself is excluded by position-based skip below.
+  const cursor = params.cursor as
+    | { receivedDateTime?: string; messageId?: string }
+    | undefined;
   let filter = (params.filter as string) || '';
   if (cursor?.receivedDateTime && !filter) {
-    filter = 'receivedDateTime gt ' + cursor.receivedDateTime;
+    filter = 'receivedDateTime ge ' + cursor.receivedDateTime;
   }
 
+  // Over-fetch when cursor is present: Graph API may truncate receivedDateTime
+  // to seconds while filtering with sub-second precision internally, causing
+  // messages at the cursor's truncated second to re-appear. Extra buffer lets
+  // us filter them out and still return genuinely new messages.
+  const top = cursor?.receivedDateTime
+    ? Math.min(requestedTop + 10, 100)
+    : requestedTop;
+
   // Graph API does not support $orderby combined with $filter on conversationId.
   // When this combination is detected, drop $orderby from the request and sort
   // the results in memory afterwards.
@@ -369,7 +381,26 @@ function listMessages(
 
   const data = response.json() as Record<string, unknown>;
   const accountEmail = getAccountEmail(http, headers);
-  const rawValues = (data.value || []) as GraphMessage[];
+  let rawValues = (data.value || []) as GraphMessage[];
+
+  // Position-based skip: find the cursor message by ID in the asc-ordered
+  // results and take only messages after it. This avoids timestamp precision
+  // issues and correctly handles multiple messages within the same second.
+  // Then trim to the originally requested $top so the caller gets exactly
+  // the number of messages it asked for.
+  if (cursor?.messageId) {
+    const cursorIndex = rawValues.findIndex(function (msg) {
+      return msg.id === cursor.messageId;
+    });
+    if (cursorIndex !== -1) {
+      rawValues = rawValues.slice(
+        cursorIndex + 1,
+        cursorIndex + 1 + requestedTop,
+      );
+    }
+    // If cursor message not found (deleted or outside window), keep all results
+  }
+
   const messages =
     params.format === 'email'
       ? rawValues.map(function (msg) {
diff --git a/examples/workflows/contract-generation/config.json b/examples/workflows/contract-generation/config.json
index 3678fd566..3f0b4602f 100644
--- a/examples/workflows/contract-generation/config.json
+++ b/examples/workflows/contract-generation/config.json
@@ -106,8 +106,8 @@
       "stepType": "llm",
       "config": {
         "name": "Batch Modification Planner",
-        "tools": ["rag_search"],
-        "systemPrompt": "You are a professional contract lawyer.\n\nYour task is to edit legal text conservatively.\n\nEditing principles:\n- Make minimal necessary changes\n- Preserve at least 85% of the original wording\n- Do NOT rewrite the entire clause\n- Do NOT restructure paragraphs or sections\n- Preserve numbering, references, and formatting\n\nEditing discipline:\n- Prefer small, precise modifications over broad rewrites\n- Only change text where clearly necessary\n- If no meaningful improvement is needed, return the original text unchanged\n\nCRITICAL EDITING RULE:\n- You must REPLACE existing text, not append to it\n- Do NOT keep both original and modified versions\n- The result must be a clean, single, final version of the clause\n\nSTRICTLY AVOID:\n- Duplicated sentences\n- Conflicting formulations\n- Partially merged text\n\nIf a sentence is modified, remove or fully integrate the original version.\n\nConsistency:\n- Ensure the revised text remains internally consistent\n- Avoid introducing new legal concepts unless required by the instruction\n\nCROSS-BATCH CONSISTENCY:\nYou may receive PREVIOUS BATCH MODIFICATIONS showing changes from the immediately preceding batch. Use this to maintain consistency — if a term, cap, threshold, or defined term was changed, align your modifications accordingly.\n\nLANGUAGE PRESERVATION: Output text MUST be in the SAME LANGUAGE as the input paragraph. NEVER translate.\n\nRAG DISCOVERY:\n- ONLY search for paragraphs you have already decided need modification based on the user requirements. Do NOT search for paragraphs that do not need changes.\n- Use rag_search with the provided template file IDs to find relevant template language\n- Run 2 or 3 diverse queries per paragraph you plan to modify (clause topic, key legal terms)\n- Templates are the ONLY source of clause language — NEVER invent clause text\n- If rag_search returns no relevant language, do NOT modify that paragraph\n- Always pass topK: 2 in every rag_search call\n\nPARAGRAPH BOUNDARIES: Do NOT merge or split paragraphs. Each modification replaces exactly one paragraph.\nDEFINED TERMS: Preserve defined terms in their original language.\nNO PLACEHOLDERS: Do not use [X], [TBD], or similar.\nEMPTY PARAGRAPHS: Skip entirely.\n\nThe output clause must read like a clean, final legal draft ready for review by a lawyer.\n\nOUTPUT FORMAT:\nFor each paragraph that needs changes:\n--- MODIFICATION ---\nKey: [paragraph key]\nNew text: [complete replacement text]\n--- END ---\n\nOnly include paragraphs that actually need changes. If no paragraphs need changes: \"No modifications needed for this batch.\"",
+        "tools": ["rag_search", "request_human_input"],
+        "systemPrompt": "You are a professional contract lawyer.\n\nYour task is to edit legal text conservatively.\n\nEditing principles:\n- Make minimal necessary changes\n- Preserve at least 85% of the original wording\n- Do NOT rewrite the entire clause\n- Do NOT restructure paragraphs or sections\n- Preserve numbering, references, and formatting\n\nEditing discipline:\n- Prefer small, precise modifications over broad rewrites\n- Only change text where clearly necessary\n- If no meaningful improvement is needed, return the original text unchanged\n\nCRITICAL EDITING RULE:\n- You must REPLACE existing text, not append to it\n- Do NOT keep both original and modified versions\n- The result must be a clean, single, final version of the clause\n\nSTRICTLY AVOID:\n- Duplicated sentences\n- Conflicting formulations\n- Partially merged text\n\nIf a sentence is modified, remove or fully integrate the original version.\n\nConsistency:\n- Ensure the revised text remains internally consistent\n- Avoid introducing new legal concepts unless required by the instruction\n\nCROSS-BATCH CONSISTENCY:\nYou may receive PREVIOUS BATCH MODIFICATIONS showing changes from the immediately preceding batch. Use this to maintain consistency — if a term, cap, threshold, or defined term was changed, align your modifications accordingly.\n\nLANGUAGE PRESERVATION: Output text MUST be in the SAME LANGUAGE as the input paragraph. NEVER translate.\n\nRAG DISCOVERY:\n- ONLY search for paragraphs you have already decided need modification based on the user requirements. Do NOT search for paragraphs that do not need changes.\n- Use rag_search with the provided template file IDs to find relevant template language\n- Run 2 or 3 diverse queries per paragraph you plan to modify (clause topic, key legal terms)\n- Templates are the ONLY source of clause language — NEVER invent clause text\n- If rag_search returns no relevant language, do NOT modify that paragraph\n- Always pass topK: 2 in every rag_search call\n\nPARAGRAPH BOUNDARIES: Do NOT merge or split paragraphs. Each modification replaces exactly one paragraph.\nDEFINED TERMS: Preserve defined terms in their original language.\nPLACEHOLDERS: When you encounter fill-in placeholders ([●], [TBD], [___], [Datum], etc.), use the request_human_input tool to ask the user for the actual values. Do not invent values or leave placeholders unfilled.\nEMPTY PARAGRAPHS: Skip entirely.\n\nUSER CONFIRMATION:\nWhen you encounter ANY of the following, use the request_human_input tool to ask the user before proceeding:\n- Fill-in placeholders: [●], [___], [Datum], [TBD], or similar blank fields that need specific values\n- Missing key information: party names, addresses, dates, registration numbers, or other identifying details\n- Ambiguous business decisions: liability caps, warranty periods, indemnification limits, governing law, jurisdiction, or other terms that require a commercial decision\n- Unclear requirements: if the user's instructions are ambiguous about how to modify a specific clause\nWhen calling request_human_input:\n- Collect ALL uncertain items from the current batch into a SINGLE request (do not make multiple calls)\n- Use text_input format for open-ended questions, single_select for binary choices, yes_no for confirmations\n- Provide clear context about what the placeholder or decision is about\n- If prior user responses are available (via <human_input_context>), use those values directly — do NOT re-ask\n\nThe output clause must read like a clean, final legal draft ready for review by a lawyer.\n\nOUTPUT FORMAT:\nFor each paragraph that needs changes:\n--- MODIFICATION ---\nKey: [paragraph key]\nNew text: [complete replacement text]\n--- END ---\n\nOnly include paragraphs that actually need changes. If no paragraphs need changes: \"No modifications needed for this batch.\"",
         "userPrompt": "PREVIOUS BATCH MODIFICATIONS:\n{{variables.previousBatchMods}}\n\nPARAGRAPHS IN THIS BATCH:\n{{loop.item}}\n\nTEMPLATE FILE IDS (pass these as fileIds to rag_search):\n{{input.templateFileIds}}\n\nUSER REQUIREMENTS:\n{{input.requirements}}",
         "outputFormat": "text"
       },
diff --git a/services/platform/app/features/chat/components/chat-interface.tsx b/services/platform/app/features/chat/components/chat-interface.tsx
index 74d4b8274..38f97a655 100644
--- a/services/platform/app/features/chat/components/chat-interface.tsx
+++ b/services/platform/app/features/chat/components/chat-interface.tsx
@@ -2,7 +2,7 @@
 
 import { m, AnimatePresence } from 'framer-motion';
 import { ArrowDown } from 'lucide-react';
-import { useRef, useEffect, useState, useCallback } from 'react';
+import { useRef, useEffect, useState, useCallback, useMemo } from 'react';
 
 import { PanelFooter } from '@/app/components/layout/panel-footer';
 import { FileUpload } from '@/app/components/ui/forms/file-upload';
@@ -142,6 +142,25 @@ export function ChatInterface({
     threadId,
   );
 
+  // Block input when any pending approval exists
+  const hasPendingApproval = useMemo(
+    () =>
+      (integrationApprovals ?? []).some((a) => a.status === 'pending') ||
+      (workflowCreationApprovals ?? []).some((a) => a.status === 'pending') ||
+      (workflowUpdateApprovals ?? []).some((a) => a.status === 'pending') ||
+      (workflowRunApprovals ?? []).some((a) => a.status === 'pending') ||
+      (humanInputRequests ?? []).some((a) => a.status === 'pending') ||
+      (documentWriteApprovals ?? []).some((a) => a.status === 'pending'),
+    [
+      integrationApprovals,
+      workflowCreationApprovals,
+      workflowUpdateApprovals,
+      workflowRunApprovals,
+      humanInputRequests,
+      documentWriteApprovals,
+    ],
+  );
+
   // Merge messages with approvals and human input requests
   const mergedChatItems = useMergedChatItems({
     messages,
@@ -358,7 +377,14 @@ export function ChatInterface({
             onSendMessage={handleSendMessage}
             onStopGenerating={stopGenerating}
             isLoading={isLoading}
-            disabled={hasNoAgents}
+            disabled={hasNoAgents || hasPendingApproval}
+            disabledReason={
+              hasNoAgents
+                ? 'no-agents'
+                : hasPendingApproval
+                  ? 'pending-approval'
+                  : undefined
+            }
             organizationId={organizationId}
             attachments={attachments}
             uploadingFiles={uploadingFiles}
diff --git a/services/platform/app/features/chat/components/workflow-run-approval-card.tsx b/services/platform/app/features/chat/components/workflow-run-approval-card.tsx
index f714216a2..c2fc9fa80 100644
--- a/services/platform/app/features/chat/components/workflow-run-approval-card.tsx
+++ b/services/platform/app/features/chat/components/workflow-run-approval-card.tsx
@@ -7,16 +7,19 @@ import {
   ChevronRight,
   ExternalLink,
   Loader2,
+  MessageCircleQuestion,
   Play,
+  Send,
   Square,
   XCircle,
 } from 'lucide-react';
-import { memo, useEffect, useState } from 'react';
+import { memo, useCallback, useEffect, useState } from 'react';
 
 import type { Id } from '@/convex/_generated/dataModel';
 import type { WorkflowRunMetadata } from '@/convex/approvals/types';
 
 import { Badge } from '@/app/components/ui/feedback/badge';
+import { Textarea } from '@/app/components/ui/forms/textarea';
 import { ActionRow } from '@/app/components/ui/layout/action-row';
 import { HStack, Stack } from '@/app/components/ui/layout/layout';
 import { Tooltip } from '@/app/components/ui/overlays/tooltip';
@@ -26,9 +29,11 @@ import {
   useExecuteApprovedWorkflowRun,
   useUpdateApprovalStatus,
 } from '@/app/features/chat/hooks/mutations';
+import { useSubmitHumanInputResponse } from '@/app/features/chat/hooks/mutations';
 import {
   useCancelExecution,
   useExecutionStatus,
+  useWorkflowHumanInputApproval,
 } from '@/app/features/chat/hooks/use-execution-status';
 import { useAuth } from '@/app/hooks/use-convex-auth';
 import { useT } from '@/lib/i18n/client';
@@ -100,6 +105,21 @@ function WorkflowRunApprovalCardComponent({
     executionStatus?.status === 'pending' ||
     executionStatus?.status === 'running';
 
+  // Human input request for paused workflow
+  const waitingForApprovalId =
+    executionStatus?.status === 'running' && executionStatus?.waitingFor
+      ? executionStatus.waitingFor
+      : undefined;
+  const { data: humanInputApproval } =
+    useWorkflowHumanInputApproval(waitingForApprovalId);
+  const isWaitingForHumanInput = !!waitingForApprovalId && !!humanInputApproval;
+
+  const { mutate: submitHumanInput, isPending: isSubmittingHumanInput } =
+    useSubmitHumanInputResponse();
+  const [humanInputValue, setHumanInputValue] = useState('');
+  const [humanInputSelected, setHumanInputSelected] = useState<string>('');
+  const [humanInputMulti, setHumanInputMulti] = useState<string[]>([]);
+
   useEffect(() => {
     if (!isRunning || !executionStatus?.startedAt) return;
     setElapsed(formatElapsed(executionStatus.startedAt));
@@ -240,8 +260,40 @@ function WorkflowRunApprovalCardComponent({
         </Stack>
       )}
 
+      {/* Human Input Request (paused workflow waiting for user response) */}
+      {isWaitingForHumanInput && humanInputApproval && (
+        <WorkflowHumanInputSection
+          approval={humanInputApproval}
+          inputValue={humanInputValue}
+          onInputChange={setHumanInputValue}
+          selectedValue={humanInputSelected}
+          onSelectedChange={setHumanInputSelected}
+          multiValues={humanInputMulti}
+          onMultiChange={setHumanInputMulti}
+          isSubmitting={isSubmittingHumanInput}
+          onSubmit={(response) => {
+            submitHumanInput(
+              {
+                // oxlint-disable-next-line typescript/no-unsafe-type-assertion -- _id from query result is a string at runtime but typed as Id<'approvals'> by Convex
+                approvalId: humanInputApproval._id as Id<'approvals'>,
+                response,
+              },
+              {
+                onError: (err) => {
+                  setError(
+                    err instanceof Error
+                      ? err.message
+                      : 'Failed to submit response',
+                  );
+                },
+              },
+            );
+          }}
+        />
+      )}
+
       {/* Live Execution Status */}
-      {status === 'approved' && executionId && (
+      {status === 'approved' && executionId && !isWaitingForHumanInput && (
         <Stack gap={1} className="mb-3" role="status" aria-live="polite">
           {isRunning && (
             <>
@@ -436,6 +488,189 @@ function WorkflowRunApprovalCardComponent({
   );
 }
 
+interface WorkflowHumanInputSectionProps {
+  approval: {
+    _id: string;
+    metadata?: Record<string, unknown> | null;
+  };
+  inputValue: string;
+  onInputChange: (value: string) => void;
+  selectedValue: string;
+  onSelectedChange: (value: string) => void;
+  multiValues: string[];
+  onMultiChange: (values: string[]) => void;
+  isSubmitting: boolean;
+  onSubmit: (response: string | string[]) => void;
+}
+
+function WorkflowHumanInputSection({
+  approval,
+  inputValue,
+  onInputChange,
+  selectedValue,
+  onSelectedChange,
+  multiValues,
+  onMultiChange,
+  isSubmitting,
+  onSubmit,
+}: WorkflowHumanInputSectionProps) {
+  const meta = approval.metadata ?? {};
+  const question = typeof meta.question === 'string' ? meta.question : '';
+  const context = typeof meta.context === 'string' ? meta.context : undefined;
+  const format = typeof meta.format === 'string' ? meta.format : 'text_input';
+  const rawOptions = Array.isArray(meta.options) ? meta.options : [];
+  const options = rawOptions.filter(
+    (opt): opt is { label: string; value?: string; description?: string } =>
+      typeof opt === 'object' &&
+      opt !== null &&
+      'label' in opt &&
+      typeof opt.label === 'string',
+  );
+
+  const getOptionValue = (opt: { label: string; value?: string }) =>
+    opt.value ?? opt.label;
+
+  const handleSubmit = useCallback(() => {
+    switch (format) {
+      case 'text_input':
+        if (inputValue.trim()) onSubmit(inputValue.trim());
+        break;
+      case 'single_select':
+      case 'yes_no':
+        if (selectedValue) onSubmit(selectedValue);
+        break;
+      case 'multi_select':
+        if (multiValues.length > 0) onSubmit(multiValues);
+        break;
+    }
+  }, [format, inputValue, selectedValue, multiValues, onSubmit]);
+
+  return (
+    <Stack gap={3} className="mb-3">
+      <HStack gap={2}>
+        <MessageCircleQuestion className="text-primary size-4 shrink-0" />
+        <Text as="div" variant="label">
+          {question}
+        </Text>
+      </HStack>
+      {context && (
+        <Text variant="caption" className="mt-1">
+          {context}
+        </Text>
+      )}
+
+      {format === 'text_input' && (
+        <Textarea
+          value={inputValue}
+          onChange={(e: React.ChangeEvent<HTMLTextAreaElement>) =>
+            onInputChange(e.target.value)
+          }
+          placeholder="Type your response..."
+          className="min-h-[80px] text-sm"
+          disabled={isSubmitting}
+        />
+      )}
+
+      {(format === 'single_select' || format === 'yes_no') &&
+        options.map((opt) => {
+          const val = getOptionValue(opt);
+          return (
+            <button
+              key={val}
+              type="button"
+              className={cn(
+                'flex items-start gap-3 rounded-lg border p-3 text-left transition-all',
+                selectedValue === val
+                  ? 'border-primary bg-primary/5'
+                  : 'border-border hover:border-primary/50 hover:bg-muted/30',
+              )}
+              onClick={() => onSelectedChange(val)}
+              disabled={isSubmitting}
+            >
+              <div
+                className={cn(
+                  'mt-0.5 size-4 shrink-0 rounded-full border-2',
+                  selectedValue === val
+                    ? 'border-primary bg-primary'
+                    : 'border-muted-foreground',
+                )}
+              />
+              <div className="flex-1">
+                <Text as="span" variant="label" className="text-sm">
+                  {opt.label}
+                </Text>
+                {opt.description && (
+                  <Text as="div" variant="caption" className="mt-0.5 text-xs">
+                    {opt.description}
+                  </Text>
+                )}
+              </div>
+            </button>
+          );
+        })}
+
+      {format === 'multi_select' &&
+        options.map((opt) => {
+          const val = getOptionValue(opt);
+          const isChecked = multiValues.includes(val);
+          return (
+            <button
+              key={val}
+              type="button"
+              className={cn(
+                'flex items-start gap-3 rounded-lg border p-3 text-left transition-all',
+                isChecked
+                  ? 'border-primary bg-primary/5'
+                  : 'border-border hover:border-primary/50 hover:bg-muted/30',
+              )}
+              onClick={() =>
+                onMultiChange(
+                  isChecked
+                    ? multiValues.filter((v) => v !== val)
+                    : [...multiValues, val],
+                )
+              }
+              disabled={isSubmitting}
+            >
+              <div
+                className={cn(
+                  'mt-0.5 size-4 shrink-0 rounded border',
+                  isChecked
+                    ? 'border-primary bg-primary'
+                    : 'border-muted-foreground',
+                )}
+              />
+              <div className="flex-1">
+                <Text as="span" variant="label" className="text-sm">
+                  {opt.label}
+                </Text>
+                {opt.description && (
+                  <Text as="div" variant="caption" className="mt-0.5 text-xs">
+                    {opt.description}
+                  </Text>
+                )}
+              </div>
+            </button>
+          );
+        })}
+
+      <Button
+        onClick={handleSubmit}
+        disabled={isSubmitting}
+        size="sm"
+        className="w-full"
+      >
+        {isSubmitting ? (
+          <Loader2 className="mr-2 size-4 animate-spin" />
+        ) : (
+          <Send className="mr-2 size-4" />
+        )}
+        Submit response
+      </Button>
+    </Stack>
+  );
+}
+
 export const WorkflowRunApprovalCard = memo(
   WorkflowRunApprovalCardComponent,
   (prevProps, nextProps) => {
diff --git a/services/platform/app/features/chat/hooks/use-execution-status.ts b/services/platform/app/features/chat/hooks/use-execution-status.ts
index c8962a8fc..5a06278b6 100644
--- a/services/platform/app/features/chat/hooks/use-execution-status.ts
+++ b/services/platform/app/features/chat/hooks/use-execution-status.ts
@@ -13,6 +13,16 @@ export function useExecutionStatus(
   );
 }
 
+export function useWorkflowHumanInputApproval(approvalId: string | undefined) {
+  return useConvexQuery(
+    api.approvals.queries.getApproval,
+    approvalId
+      ? // oxlint-disable-next-line typescript/no-unsafe-type-assertion -- approval ID string from execution.waitingFor
+        { approvalId: approvalId as Id<'approvals'> }
+      : 'skip',
+  );
+}
+
 export function useCancelExecution() {
   return useConvexMutation(api.wf_executions.mutations.cancelExecution);
 }
diff --git a/services/platform/convex/agent_tools/human_input/internal_mutations.ts b/services/platform/convex/agent_tools/human_input/internal_mutations.ts
index 40294274c..7bdea7a8a 100644
--- a/services/platform/convex/agent_tools/human_input/internal_mutations.ts
+++ b/services/platform/convex/agent_tools/human_input/internal_mutations.ts
@@ -3,7 +3,11 @@ import { v } from 'convex/values';
 import type { HumanInputRequestMetadata } from '../../../lib/shared/schemas/approvals';
 
 import { internalMutation } from '../../_generated/server';
-import { createApproval } from '../../approvals/helpers';
+import {
+  createApproval,
+  listPendingApprovalsForExecution,
+} from '../../approvals/helpers';
+import { toId } from '../../lib/type_cast_helpers';
 
 export const createHumanInputRequest = internalMutation({
   args: {
@@ -28,8 +32,27 @@ export const createHumanInputRequest = internalMutation({
     ),
     placeholder: v.optional(v.string()),
     messageId: v.optional(v.string()),
+    wfExecutionId: v.optional(v.string()),
+    stepSlug: v.optional(v.string()),
   },
   handler: async (ctx, args) => {
+    // Idempotency guard for workflow context: if a pending human_input_request
+    // already exists for this execution+step, return it instead of creating a duplicate
+    if (args.wfExecutionId && args.stepSlug) {
+      const existing = await listPendingApprovalsForExecution(
+        ctx,
+        toId<'wfExecutions'>(args.wfExecutionId),
+      );
+      const duplicate = existing.find(
+        (a) =>
+          a.resourceType === 'human_input_request' &&
+          a.stepSlug === args.stepSlug,
+      );
+      if (duplicate) {
+        return duplicate._id;
+      }
+    }
+
     const options =
       args.options ??
       (args.format === 'yes_no'
@@ -67,6 +90,10 @@ export const createHumanInputRequest = internalMutation({
       description: args.question,
       threadId: args.threadId,
       messageId: args.messageId,
+      wfExecutionId: args.wfExecutionId
+        ? toId<'wfExecutions'>(args.wfExecutionId)
+        : undefined,
+      stepSlug: args.stepSlug,
       metadata,
     });
 
diff --git a/services/platform/convex/agent_tools/human_input/mutations.ts b/services/platform/convex/agent_tools/human_input/mutations.ts
index 242c150a5..fb8522ab3 100644
--- a/services/platform/convex/agent_tools/human_input/mutations.ts
+++ b/services/platform/convex/agent_tools/human_input/mutations.ts
@@ -1,3 +1,5 @@
+import type { WorkflowId } from '@convex-dev/workflow';
+
 import { saveMessage } from '@convex-dev/agent';
 import { createFunctionHandle, makeFunctionReference } from 'convex/server';
 import { v } from 'convex/values';
@@ -10,6 +12,8 @@ import { toSerializableConfig } from '../../custom_agents/config';
 import { getDefaultAgentRuntimeConfig } from '../../lib/agent_runtime_config';
 import { getOrganizationMember } from '../../lib/rls';
 import { persistentStreaming } from '../../streaming/helpers';
+import { workflowManagers } from '../../workflow_engine/engine';
+import { safeShardIndex } from '../../workflow_engine/helpers/engine/shard';
 
 const beforeGenerateHookRef = makeFunctionReference<'action'>(
   'lib/agent_chat/internal_actions:beforeGenerateHook',
@@ -91,6 +95,41 @@ export const submitHumanInputResponse = mutation({
       : mapValueToLabel(args.response);
     const responseMessage = `User responded to question "${existingMetadata.question}": ${responseDisplay}`;
 
+    // Workflow-context fork: resume the paused workflow via sendEvent instead of triggering chat agent
+    if (approval.wfExecutionId) {
+      const execution = await ctx.db.get(approval.wfExecutionId);
+      if (!execution?.componentWorkflowId) {
+        throw new Error(
+          'Workflow execution not found or missing component workflow ID',
+        );
+      }
+
+      const manager = workflowManagers[safeShardIndex(execution.shardIndex)];
+      // oxlint-disable-next-line typescript/no-unsafe-type-assertion -- branded type cast from string stored in DB, same pattern as cancelExecution
+      const workflowId = execution.componentWorkflowId as unknown as WorkflowId;
+
+      await manager.sendEvent(ctx, {
+        workflowId,
+        name: `approval_response:${approval._id}`,
+        value: {
+          response: args.response,
+          respondedBy,
+          question: existingMetadata.question ?? '',
+          timestamp: Date.now(),
+          stepSlug: approval.stepSlug ?? '',
+        },
+      });
+
+      // Post user message for AI context
+      await saveMessage(ctx, components.agent, {
+        threadId,
+        message: { role: 'user', content: responseMessage },
+      });
+
+      return { success: true, threadId };
+    }
+
+    // Chat-context flow: trigger agent generation
     const { messageId: promptMessageId } = await saveMessage(
       ctx,
       components.agent,
diff --git a/services/platform/convex/agent_tools/human_input/request_human_input_tool.ts b/services/platform/convex/agent_tools/human_input/request_human_input_tool.ts
index 27e8916c3..82260a396 100644
--- a/services/platform/convex/agent_tools/human_input/request_human_input_tool.ts
+++ b/services/platform/convex/agent_tools/human_input/request_human_input_tool.ts
@@ -102,6 +102,14 @@ Call this tool with:
       message: string;
     }> => {
       const { organizationId, threadId: currentThreadId } = ctx;
+      // oxlint-disable-next-line typescript/no-unsafe-type-assertion -- workflow context fields spread onto ctx at runtime via execute_agent_with_tools.ts
+      const ctxRecord = ctx as unknown as Record<string, unknown>;
+      const wfExecutionId =
+        typeof ctxRecord.wfExecutionId === 'string'
+          ? ctxRecord.wfExecutionId
+          : undefined;
+      const stepSlug =
+        typeof ctxRecord.stepSlug === 'string' ? ctxRecord.stepSlug : undefined;
 
       // Look up parent thread from thread summary (stable, database-backed)
       // This ensures approvals from sub-agents link to the main chat thread
@@ -166,6 +174,8 @@ Call this tool with:
               value: opt.value,
             })),
             placeholder: args.placeholder,
+            wfExecutionId,
+            stepSlug,
           },
         );
 
diff --git a/services/platform/convex/approvals/internal_queries.ts b/services/platform/convex/approvals/internal_queries.ts
index 575820f48..1fd4e0683 100644
--- a/services/platform/convex/approvals/internal_queries.ts
+++ b/services/platform/convex/approvals/internal_queries.ts
@@ -34,6 +34,76 @@ export const verifyOrganizationMembership = internalQuery({
   },
 });
 
+export const listPendingForExecution = internalQuery({
+  args: {
+    executionId: v.id('wfExecutions'),
+  },
+  returns: v.array(approvalItemValidator),
+  handler: async (ctx, args): Promise<ApprovalItem[]> => {
+    return await ApprovalsHelpers.listPendingApprovalsForExecution(
+      ctx,
+      args.executionId,
+    );
+  },
+});
+
+export const listRespondedForExecution = internalQuery({
+  args: {
+    executionId: v.id('wfExecutions'),
+  },
+  returns: v.array(
+    v.object({
+      question: v.string(),
+      response: v.union(v.string(), v.array(v.string())),
+    }),
+  ),
+  handler: async (ctx, args) => {
+    const approvals = await ApprovalsHelpers.listApprovalsForExecution(
+      ctx,
+      args.executionId,
+    );
+    const responded: Array<{ question: string; response: string | string[] }> =
+      [];
+    for (const approval of approvals) {
+      if (
+        approval.status === 'approved' &&
+        approval.resourceType === 'human_input_request' &&
+        approval.metadata
+      ) {
+        const meta =
+          typeof approval.metadata === 'object' && approval.metadata !== null
+            ? approval.metadata
+            : {};
+        const question =
+          'question' in meta && typeof meta.question === 'string'
+            ? meta.question
+            : '';
+        const responseField = 'response' in meta ? meta.response : undefined;
+        const responseRecord =
+          typeof responseField === 'object' && responseField !== null
+            ? responseField
+            : null;
+        const responseValue =
+          responseRecord && 'value' in responseRecord
+            ? responseRecord.value
+            : undefined;
+        if (question && typeof responseValue === 'string') {
+          responded.push({ question, response: responseValue });
+        } else if (
+          question &&
+          Array.isArray(responseValue) &&
+          responseValue.every(
+            (item): item is string => typeof item === 'string',
+          )
+        ) {
+          responded.push({ question, response: responseValue });
+        }
+      }
+    }
+    return responded;
+  },
+});
+
 export const getApprovalsForThread = internalQuery({
   args: {
     threadId: v.string(),
diff --git a/services/platform/convex/approvals/queries.ts b/services/platform/convex/approvals/queries.ts
index 04d3dd21e..60d8b019f 100644
--- a/services/platform/convex/approvals/queries.ts
+++ b/services/platform/convex/approvals/queries.ts
@@ -12,6 +12,28 @@ import {
   approvalResourceTypeValidator,
 } from './validators';
 
+export const getApproval = query({
+  args: {
+    approvalId: v.id('approvals'),
+  },
+  returns: v.union(approvalItemValidator, v.null()),
+  handler: async (ctx, args) => {
+    const authUser = await getAuthUserIdentity(ctx);
+    if (!authUser) return null;
+
+    const approval = await ApprovalsHelpers.getApproval(ctx, args.approvalId);
+    if (!approval) return null;
+
+    try {
+      await getOrganizationMember(ctx, approval.organizationId, authUser);
+    } catch {
+      return null;
+    }
+
+    return approval;
+  },
+});
+
 export const approxCountApprovalsByStatus = query({
   args: {
     organizationId: v.string(),
diff --git a/services/platform/convex/wf_executions/queries.ts b/services/platform/convex/wf_executions/queries.ts
index dd51d37ba..a66794ee5 100644
--- a/services/platform/convex/wf_executions/queries.ts
+++ b/services/platform/convex/wf_executions/queries.ts
@@ -70,6 +70,7 @@ export const getExecutionStatus = queryWithRLS({
       currentStepSlug: exec.currentStepSlug,
       currentStepName: exec.currentStepName,
       loopProgress: exec.loopProgress,
+      waitingFor: exec.waitingFor,
       error: exec.error,
       startedAt: exec.startedAt,
       completedAt: exec.completedAt,
diff --git a/services/platform/convex/workflow_engine/action_defs/conversation/conversation_action.ts b/services/platform/convex/workflow_engine/action_defs/conversation/conversation_action.ts
index 87b27daae..22a5a6b24 100644
--- a/services/platform/convex/workflow_engine/action_defs/conversation/conversation_action.ts
+++ b/services/platform/convex/workflow_engine/action_defs/conversation/conversation_action.ts
@@ -16,10 +16,13 @@ import type { Id } from '../../../_generated/dataModel';
 import type { ActionDefinition } from '../../helpers/nodes/action/types';
 import type { ConversationStatus, ConversationPriority } from './helpers/types';
 
+import { createDebugLog } from '../../../lib/debug_log';
 import {
   jsonRecordValidator,
   jsonValueValidator,
 } from '../../../lib/shared/schemas/utils/json_value';
+
+const debugLog = createDebugLog('DEBUG_WORKFLOW', '[Conversations]');
 import { createConversation } from './helpers/create_conversation';
 import { createConversationFromEmail } from './helpers/create_conversation_from_email';
 import { createConversationFromSentEmail } from './helpers/create_conversation_from_sent_email';
@@ -313,6 +316,11 @@ See 'product_recommendation_email' predefined workflow for complete example.`,
       }
 
       case 'update_email_sync_cursor': {
+        debugLog('update_email_sync_cursor cursor:', {
+          cursor: params.cursor,
+          cursorType: typeof params.cursor,
+          integrationName: params.integrationName,
+        });
         await updateEmailSyncCursor(ctx, {
           organizationId,
           integrationName: params.integrationName,
diff --git a/services/platform/convex/workflow_engine/helpers/engine/dynamic_workflow_handler.ts b/services/platform/convex/workflow_engine/helpers/engine/dynamic_workflow_handler.ts
index 9ab7b216d..84e548bb3 100644
--- a/services/platform/convex/workflow_engine/helpers/engine/dynamic_workflow_handler.ts
+++ b/services/platform/convex/workflow_engine/helpers/engine/dynamic_workflow_handler.ts
@@ -5,7 +5,7 @@
 import type { WorkflowCtx } from '@convex-dev/workflow';
 import type { RetryBehavior } from '@convex-dev/workpool';
 
-import { Infer } from 'convex/values';
+import { Infer, v } from 'convex/values';
 
 import type { Doc, Id } from '../../../_generated/dataModel';
 
@@ -194,6 +194,53 @@ export async function handleDynamicWorkflow(
       throw new Error(errorMsg);
     }
 
+    // If the step created a human input approval, pause the workflow until the user responds
+    if (stepResult.approvalTaskId) {
+      debugLog('dynamicWorkflow Pausing for human input approval', {
+        stepSlug: stepDef.stepSlug,
+        approvalTaskId: stepResult.approvalTaskId,
+      });
+
+      // Set waitingFor on execution for UI visibility
+      await step.runMutation(
+        internal.wf_executions.internal_mutations.updateExecutionStatus,
+        {
+          executionId,
+          status: 'running',
+          waitingFor: stepResult.approvalTaskId,
+          currentStepSlug: stepDef.stepSlug,
+          currentStepName: stepDef.name,
+        },
+      );
+
+      // Block workflow until user responds via sendEvent
+      await step.awaitEvent({
+        name: `approval_response:${stepResult.approvalTaskId}`,
+        validator: v.object({
+          response: v.union(v.string(), v.array(v.string())),
+          respondedBy: v.string(),
+          question: v.string(),
+          timestamp: v.number(),
+          stepSlug: v.string(),
+        }),
+      });
+
+      // Clear waitingFor after resume
+      await step.runMutation(
+        internal.wf_executions.internal_mutations.updateExecutionStatus,
+        {
+          executionId,
+          status: 'running',
+          waitingFor: undefined,
+        },
+      );
+
+      debugLog('dynamicWorkflow Resumed after human input', {
+        stepSlug: stepDef.stepSlug,
+        approvalTaskId: stepResult.approvalTaskId,
+      });
+    }
+
     currentStepSlug = nextStepSlug;
   }
 
diff --git a/services/platform/convex/workflow_engine/helpers/engine/execute_step_handler.ts b/services/platform/convex/workflow_engine/helpers/engine/execute_step_handler.ts
index 827db1cd6..8346985ba 100644
--- a/services/platform/convex/workflow_engine/helpers/engine/execute_step_handler.ts
+++ b/services/platform/convex/workflow_engine/helpers/engine/execute_step_handler.ts
@@ -36,6 +36,7 @@ export type ExecuteStepArgs = {
 export type ExecuteStepResult = {
   port: string;
   error?: string;
+  approvalTaskId?: string;
 };
 
 /**
@@ -159,6 +160,20 @@ export async function handleExecuteStep(
     });
   }
 
+  // Debug: Log resolved cursor for sync cursor steps
+  if (
+    args.stepType === 'action' &&
+    isRecord(processedConfig) &&
+    isRecord(processedConfig.parameters) &&
+    processedConfig.parameters.operation === 'update_email_sync_cursor'
+  ) {
+    debugLog('update_sync_cursor resolved params:', {
+      stepSlug: args.stepSlug,
+      cursor: processedConfig.parameters.cursor,
+      cursorType: typeof processedConfig.parameters.cursor,
+    });
+  }
+
   const processedStepDef = { ...stepDef, config: processedConfig };
 
   // 6. Execute step by type
@@ -177,13 +192,31 @@ export async function handleExecuteStep(
     args.threadId,
   );
 
-  // 7. Build steps map
+  // 7. Post-LLM approval scan: check if a human_input_request was created
+  // Only scan when the step has the request_human_input tool configured
+  let approvalTaskId: string | undefined;
+  if (args.stepType === 'llm' && stepHasHumanInputTool(stepConfig)) {
+    const pendingApprovals = await ctx.runQuery(
+      internal.approvals.internal_queries.listPendingForExecution,
+      { executionId: toId<'wfExecutions'>(args.executionId) },
+    );
+    const humanInputApproval = pendingApprovals.find(
+      (a: { resourceType: string; stepSlug?: string }) =>
+        a.resourceType === 'human_input_request' &&
+        a.stepSlug === args.stepSlug,
+    );
+    if (humanInputApproval) {
+      approvalTaskId = humanInputApproval._id;
+    }
+  }
+
+  // 8. Build steps map
   const stepsMap = await buildStepsMap(ctx, args.executionId, stepDef, result);
 
-  // 8. Extract essential loop variables
+  // 9. Extract essential loop variables
   const essentialLoop = extractEssentialLoopVariables(result.variables);
 
-  // 9. Persist execution result
+  // 10. Persist execution result
   await persistExecutionResult(
     ctx,
     args.executionId,
@@ -194,9 +227,19 @@ export async function handleExecuteStep(
     essentialLoop,
   );
 
-  // 10. Return essential control information
+  // 11. Return essential control information
   return {
     port: result.port,
     error: result.error,
+    approvalTaskId,
   };
 }
+
+function stepHasHumanInputTool(
+  config: Record<string, unknown> | undefined,
+): boolean {
+  if (!config) return false;
+  const tools = config.tools;
+  if (!Array.isArray(tools)) return false;
+  return tools.includes('request_human_input');
+}
diff --git a/services/platform/convex/workflow_engine/helpers/nodes/llm/execute_agent_with_tools.ts b/services/platform/convex/workflow_engine/helpers/nodes/llm/execute_agent_with_tools.ts
index 1c6c20940..6ccf73d22 100644
--- a/services/platform/convex/workflow_engine/helpers/nodes/llm/execute_agent_with_tools.ts
+++ b/services/platform/convex/workflow_engine/helpers/nodes/llm/execute_agent_with_tools.ts
@@ -92,6 +92,7 @@ export async function executeAgentWithTools(
     executionId: string;
     organizationId?: string;
     threadId?: string;
+    stepSlug?: string;
   },
 ): Promise<LLMExecutionResult> {
   if (config.outputFormat === 'json' && !config.outputSchema) {
@@ -125,9 +126,12 @@ export async function executeAgentWithTools(
   });
 
   const threadId = await getOrCreateThread(ctx, config.name, _args.threadId);
-  const contextWithOrg = _args.organizationId
-    ? { ...ctx, organizationId: _args.organizationId }
-    : ctx;
+  const contextWithOrg = {
+    ...ctx,
+    ...(_args.organizationId ? { organizationId: _args.organizationId } : {}),
+    ...(_args.executionId ? { wfExecutionId: _args.executionId } : {}),
+    ...(_args.stepSlug ? { stepSlug: _args.stepSlug } : {}),
+  };
 
   // Case 1: JSON output WITHOUT tools -> use generateObject directly
   if (needsJsonOutput && !hasTools && zodSchema) {
diff --git a/services/platform/convex/workflow_engine/helpers/nodes/llm/execute_llm_node.ts b/services/platform/convex/workflow_engine/helpers/nodes/llm/execute_llm_node.ts
index 87f5c31ff..c16a63909 100644
--- a/services/platform/convex/workflow_engine/helpers/nodes/llm/execute_llm_node.ts
+++ b/services/platform/convex/workflow_engine/helpers/nodes/llm/execute_llm_node.ts
@@ -9,6 +9,9 @@ import type { Id } from '../../../../_generated/dataModel';
 import type { ActionCtx } from '../../../../_generated/server';
 import type { StepExecutionResult, LLMNodeConfig } from '../../../types';
 
+import { internal } from '../../../../_generated/api';
+import { createDebugLog } from '../../../../lib/debug_log';
+import { toId } from '../../../../lib/type_cast_helpers';
 // Agent execution
 import { executeAgentWithTools } from './execute_agent_with_tools';
 // Result creation
@@ -17,6 +20,8 @@ import { processPrompts } from './utils/process_prompts';
 // Validation
 import { validateAndNormalizeConfig } from './utils/validate_and_normalize_config';
 
+const debugLog = createDebugLog('DEBUG_WORKFLOW', '[LLMNode]');
+
 // =============================================================================
 // HELPER FUNCTION
 // =============================================================================
@@ -31,6 +36,7 @@ export async function executeLLMNode(
   executionId: string | Id<'wfExecutions'>,
   organizationId: string,
   threadId?: string,
+  stepSlug?: string,
 ): Promise<StepExecutionResult> {
   // 1. Validate and normalize configuration
   const normalizedConfig = validateAndNormalizeConfig(config);
@@ -38,6 +44,30 @@ export async function executeLLMNode(
   // 2. Process prompts with variable substitution
   const prompts = processPrompts(normalizedConfig, variables);
 
+  // 2.5. Inject prior human input responses into system prompt (for workflow context)
+  if (executionId) {
+    try {
+      const respondedApprovals = await ctx.runQuery(
+        internal.approvals.internal_queries.listRespondedForExecution,
+        { executionId: toId<'wfExecutions'>(executionId) },
+      );
+      if (respondedApprovals.length > 0) {
+        const context = respondedApprovals
+          .map(
+            (a: { question: string; response: string | string[] }) =>
+              `- Q: "${a.question}" → A: "${Array.isArray(a.response) ? a.response.join(', ') : a.response}"`,
+          )
+          .join('\n');
+        prompts.systemPrompt += `\n\n<human_input_context>\nThe following information was provided by the user during this workflow:\n${context}\n</human_input_context>`;
+        debugLog('Injected human input context into system prompt', {
+          responseCount: respondedApprovals.length,
+        });
+      }
+    } catch {
+      // Non-critical: skip if query fails (e.g., executionId is not a valid wfExecutions ID)
+    }
+  }
+
   // 3. Execute using Convex agent with tools
   const llmResult = await executeAgentWithTools(
     ctx,
@@ -47,6 +77,7 @@ export async function executeLLMNode(
       executionId,
       organizationId,
       threadId, // Pass shared threadId when reusing conversation context across steps
+      stepSlug,
     },
   );
 
diff --git a/services/platform/convex/workflow_engine/internal_actions.ts b/services/platform/convex/workflow_engine/internal_actions.ts
index e8f89e1e4..6cd5fa56b 100644
--- a/services/platform/convex/workflow_engine/internal_actions.ts
+++ b/services/platform/convex/workflow_engine/internal_actions.ts
@@ -64,6 +64,7 @@ export const executeStep = internalAction({
   returns: v.object({
     port: v.string(),
     error: v.optional(v.string()),
+    approvalTaskId: v.optional(v.string()),
   }),
   handler: async (ctx, args) => {
     return await EngineHelpers.handleExecuteStep(ctx, args);
@@ -190,6 +191,7 @@ export const executeLLMNode = internalAction({
       args.executionId,
       args.stepDef.organizationId,
       args.threadId,
+      args.stepDef.stepSlug,
     );
     return result as Infer<typeof stepExecutionResultValidator>;
   },

From 833ac0534f7d2e92a38c121ccac14eed55984b3f Mon Sep 17 00:00:00 2001
From: larryro <371767072@qq.com>
Date: Fri, 20 Mar 2026 16:54:14 +0800
Subject: [PATCH 2/9] feat(platform): split approval into executing/completed
 and fix human input loop
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Replace the single 'approved' status with 'executing' and 'completed' to accurately track approval lifecycle — approvals now transition pending→executing→completed/rejected, with the triggering approval auto-updated on workflow completion.

Key fixes:
- Re-execute the same LLM step after human input resume instead of advancing to next step
- Inject humanInputContext as a template variable (not appended to system prompt) so {{humanInputContext}} placeholders in workflow configs resolve correctly
- Write rejection reason as system message to thread so the AI acknowledges user-initiated rejections
- Clear waitingFor with empty string instead of undefined (Convex strips undefined from serialized args)
- Update all approval card UIs for new status values with executing=blue/processing badge
- Add request_human_input tool and {{humanInputContext}} to contract generation workflow
---
 .../workflows/contract-generation/config.json |   8 +-
 .../executions/executions-table.tsx           |  32 +-
 .../features/chat/components/chat-input.tsx   |   7 +-
 .../chat/components/chat-interface.tsx        |  32 +-
 .../document-write-approval-card.tsx          | 107 ++++---
 .../components/human-input-request-card.tsx   |  16 +-
 .../components/integration-approval-card.tsx  |  40 ++-
 .../workflow-creation-approval-card.tsx       |  67 +++--
 .../components/workflow-run-approval-card.tsx | 279 ++++++++++--------
 .../workflow-update-approval-card.tsx         |  60 ++--
 .../app/features/chat/hooks/queries.ts        |  12 +-
 .../database/helpers/schema_definitions.ts    |   6 +-
 .../agent_tools/documents/internal_actions.ts |   4 +-
 .../documents/internal_mutations.ts           |   1 +
 .../agent_tools/human_input/mutations.ts      |   2 +-
 .../integrations/internal_actions.ts          |   4 +-
 .../integrations/internal_mutations.ts        |   1 +
 .../integrations/verify_approval_tool.ts      |   2 +-
 .../execute_approved_workflow_run.test.ts     |   2 +-
 .../execute_approved_workflow_update.test.ts  |   2 +-
 .../agent_tools/workflows/internal_actions.ts |  12 +-
 .../workflows/internal_mutations.ts           |  18 ++
 services/platform/convex/approvals/helpers.ts |   2 +-
 .../convex/approvals/internal_queries.ts      |   2 +-
 .../list_approvals_paginated.test.ts          |   4 +-
 .../platform/convex/approvals/mutations.ts    |  18 +-
 services/platform/convex/approvals/queries.ts |  23 +-
 services/platform/convex/approvals/schema.ts  |   3 +-
 .../platform/convex/approvals/validators.ts   |   3 +-
 .../send_message_via_integration.ts           |   2 +-
 .../convex/wf_executions/mutations.ts         |  29 +-
 .../action_defs/approval/helpers/types.ts     |   2 +-
 .../workflow_processing_records_action.ts     |   4 +-
 .../engine/dynamic_workflow_handler.ts        |  11 +-
 .../helpers/engine/on_workflow_complete.ts    |  28 ++
 .../helpers/nodes/llm/execute_llm_node.ts     |  60 ++--
 .../helpers/validation/variables/parse.ts     |   1 +
 .../executions/update_execution_status.ts     |   3 +-
 services/platform/messages/en.json            |  23 +-
 39 files changed, 577 insertions(+), 355 deletions(-)

diff --git a/examples/workflows/contract-generation/config.json b/examples/workflows/contract-generation/config.json
index 3f0b4602f..306ca9940 100644
--- a/examples/workflows/contract-generation/config.json
+++ b/examples/workflows/contract-generation/config.json
@@ -107,7 +107,7 @@
       "config": {
         "name": "Batch Modification Planner",
         "tools": ["rag_search", "request_human_input"],
-        "systemPrompt": "You are a professional contract lawyer.\n\nYour task is to edit legal text conservatively.\n\nEditing principles:\n- Make minimal necessary changes\n- Preserve at least 85% of the original wording\n- Do NOT rewrite the entire clause\n- Do NOT restructure paragraphs or sections\n- Preserve numbering, references, and formatting\n\nEditing discipline:\n- Prefer small, precise modifications over broad rewrites\n- Only change text where clearly necessary\n- If no meaningful improvement is needed, return the original text unchanged\n\nCRITICAL EDITING RULE:\n- You must REPLACE existing text, not append to it\n- Do NOT keep both original and modified versions\n- The result must be a clean, single, final version of the clause\n\nSTRICTLY AVOID:\n- Duplicated sentences\n- Conflicting formulations\n- Partially merged text\n\nIf a sentence is modified, remove or fully integrate the original version.\n\nConsistency:\n- Ensure the revised text remains internally consistent\n- Avoid introducing new legal concepts unless required by the instruction\n\nCROSS-BATCH CONSISTENCY:\nYou may receive PREVIOUS BATCH MODIFICATIONS showing changes from the immediately preceding batch. Use this to maintain consistency — if a term, cap, threshold, or defined term was changed, align your modifications accordingly.\n\nLANGUAGE PRESERVATION: Output text MUST be in the SAME LANGUAGE as the input paragraph. NEVER translate.\n\nRAG DISCOVERY:\n- ONLY search for paragraphs you have already decided need modification based on the user requirements. Do NOT search for paragraphs that do not need changes.\n- Use rag_search with the provided template file IDs to find relevant template language\n- Run 2 or 3 diverse queries per paragraph you plan to modify (clause topic, key legal terms)\n- Templates are the ONLY source of clause language — NEVER invent clause text\n- If rag_search returns no relevant language, do NOT modify that paragraph\n- Always pass topK: 2 in every rag_search call\n\nPARAGRAPH BOUNDARIES: Do NOT merge or split paragraphs. Each modification replaces exactly one paragraph.\nDEFINED TERMS: Preserve defined terms in their original language.\nPLACEHOLDERS: When you encounter fill-in placeholders ([●], [TBD], [___], [Datum], etc.), use the request_human_input tool to ask the user for the actual values. Do not invent values or leave placeholders unfilled.\nEMPTY PARAGRAPHS: Skip entirely.\n\nUSER CONFIRMATION:\nWhen you encounter ANY of the following, use the request_human_input tool to ask the user before proceeding:\n- Fill-in placeholders: [●], [___], [Datum], [TBD], or similar blank fields that need specific values\n- Missing key information: party names, addresses, dates, registration numbers, or other identifying details\n- Ambiguous business decisions: liability caps, warranty periods, indemnification limits, governing law, jurisdiction, or other terms that require a commercial decision\n- Unclear requirements: if the user's instructions are ambiguous about how to modify a specific clause\nWhen calling request_human_input:\n- Collect ALL uncertain items from the current batch into a SINGLE request (do not make multiple calls)\n- Use text_input format for open-ended questions, single_select for binary choices, yes_no for confirmations\n- Provide clear context about what the placeholder or decision is about\n- If prior user responses are available (via <human_input_context>), use those values directly — do NOT re-ask\n\nThe output clause must read like a clean, final legal draft ready for review by a lawyer.\n\nOUTPUT FORMAT:\nFor each paragraph that needs changes:\n--- MODIFICATION ---\nKey: [paragraph key]\nNew text: [complete replacement text]\n--- END ---\n\nOnly include paragraphs that actually need changes. If no paragraphs need changes: \"No modifications needed for this batch.\"",
+        "systemPrompt": "You are a professional contract lawyer.\n\nYour task is to edit legal text conservatively.\n\nEditing principles:\n- Make minimal necessary changes\n- Preserve at least 85% of the original wording\n- Do NOT rewrite the entire clause\n- Do NOT restructure paragraphs or sections\n- Preserve numbering, references, and formatting\n\nEditing discipline:\n- Prefer small, precise modifications over broad rewrites\n- Only change text where clearly necessary\n- If no meaningful improvement is needed, return the original text unchanged\n\nCRITICAL EDITING RULE:\n- You must REPLACE existing text, not append to it\n- Do NOT keep both original and modified versions\n- The result must be a clean, single, final version of the clause\n\nSTRICTLY AVOID:\n- Duplicated sentences\n- Conflicting formulations\n- Partially merged text\n\nIf a sentence is modified, remove or fully integrate the original version.\n\nConsistency:\n- Ensure the revised text remains internally consistent\n- Avoid introducing new legal concepts unless required by the instruction\n\nCROSS-BATCH CONSISTENCY:\nYou may receive PREVIOUS BATCH MODIFICATIONS showing changes from the immediately preceding batch. Use this to maintain consistency — if a term, cap, threshold, or defined term was changed, align your modifications accordingly.\n\nLANGUAGE PRESERVATION: Output text MUST be in the SAME LANGUAGE as the input paragraph. NEVER translate.\n\nRAG DISCOVERY:\n- ONLY search for paragraphs you have already decided need modification based on the user requirements. Do NOT search for paragraphs that do not need changes.\n- Use rag_search with the provided template file IDs to find relevant template language\n- Run 2 or 3 diverse queries per paragraph you plan to modify (clause topic, key legal terms)\n- Templates are the ONLY source of clause language — NEVER invent clause text\n- If rag_search returns no relevant language, do NOT modify that paragraph\n- Always pass topK: 2 in every rag_search call\n\nPARAGRAPH BOUNDARIES: Do NOT merge or split paragraphs. Each modification replaces exactly one paragraph.\nDEFINED TERMS: Preserve defined terms in their original language.\nPLACEHOLDERS: When you encounter fill-in placeholders ([●], [TBD], [___], [Datum], etc.), use the request_human_input tool to ask the user for the actual values. Do not invent values or leave placeholders unfilled.\nEMPTY PARAGRAPHS: Skip entirely.\n\nUSER CONFIRMATION:\nWhen you encounter ANY of the following, use the request_human_input tool to ask the user before proceeding:\n- Fill-in placeholders: [●], [___], [Datum], [TBD], or similar blank fields that need specific values\n- Missing key information: party names, addresses, dates, registration numbers, or other identifying details\n- Ambiguous business decisions: liability caps, warranty periods, indemnification limits, governing law, jurisdiction, or other terms that require a commercial decision\n- Unclear requirements: if the user's instructions are ambiguous about how to modify a specific clause\nWhen calling request_human_input:\n- Collect ALL uncertain items from the current batch into a SINGLE request (do not make multiple calls)\n- Use text_input format for open-ended questions, single_select for binary choices, yes_no for confirmations\n- Provide clear context about what the placeholder or decision is about\n- If prior user responses are available (via {{humanInputContext}}), use those values directly — do NOT re-ask\n\n{{humanInputContext}}\n\nThe output clause must read like a clean, final legal draft ready for review by a lawyer.\n\nOUTPUT FORMAT:\nFor each paragraph that needs changes:\n--- MODIFICATION ---\nKey: [paragraph key]\nNew text: [complete replacement text]\n--- END ---\n\nOnly include paragraphs that actually need changes. If no paragraphs need changes: \"No modifications needed for this batch.\"",
         "userPrompt": "PREVIOUS BATCH MODIFICATIONS:\n{{variables.previousBatchMods}}\n\nPARAGRAPHS IN THIS BATCH:\n{{loop.item}}\n\nTEMPLATE FILE IDS (pass these as fileIds to rag_search):\n{{input.templateFileIds}}\n\nUSER REQUIREMENTS:\n{{input.requirements}}",
         "outputFormat": "text"
       },
@@ -119,7 +119,7 @@
       "stepType": "llm",
       "config": {
         "name": "Batch Modification Reviewer",
-        "systemPrompt": "You are a quality-control reviewer for contract modifications.\n\nYou receive the FULL DOCUMENT for reference, ACCUMULATED MODIFICATIONS from previous batches, the CURRENT BATCH paragraphs, and SUGGESTED MODIFICATIONS from a prior editing step. Your job is to check each modification for structural and formatting integrity, then pass it through (with corrections if needed) or reject it.\n\nIMPORTANT: Default to PASSING modifications. You are a formatting/integrity check, NOT a second opinion on legal content. Adding qualifications, conditions, or protective language to existing text is expected and should be allowed. Only reject on clear structural violations.\n\nVALIDATION RULES:\n\n1. NO NEW PLACEHOLDERS: The modified text must not introduce NEW placeholders ([●], [X], [TBD], [___], etc.) that were not already in the original paragraph. Placeholders already present in the original may remain. If a new placeholder is found, restore the corresponding original text or REJECT.\n\n2. PARAGRAPH BOUNDARIES: Each modification must map to exactly one original paragraph key. If a modification consolidates content from multiple paragraphs into one, or splits one paragraph across multiple keys, REJECT it.\n\n3. PRESERVE INFO SLOTS: If the original paragraph contains placeholder fields (e.g., '[●]', '________', '[Datum]'), these fields must not be replaced with dashes ('—'), empty text, or generic filler. They must remain as-is or be replaced with concrete values. If violated, restore the original placeholder or REJECT.\n\n4. LANGUAGE MATCH: The modification must be in the same language as the original paragraph. If it switches languages, REJECT.\n\n5. DEFINED TERMS (cross-reference): Scan the FULL DOCUMENT PARAGRAPHS for defined terms — look for patterns like (die \"...\"), (der \"...\"), (\"...\"), or quoted capitalized terms. Modified text MUST use the exact defined terms found in the document. If a modification introduces a variant not found in the document (e.g., \"Käufer\" when the document defines \"Käuferin\"), correct it to match the document's defined term.\n\n6. CLEAN FINAL TEXT: The output must be a clean, single, final version — no duplicated sentences, no conflicting formulations, no partially merged text from original and modified versions.\n\n7. ORIGINAL MEANING PRESERVED: The original text's core meaning must be retained. Adding qualifications, conditions, or protective language is fine. Deleting substantive content from the original without replacement is not — restore the deleted content or REJECT.\n\n8. NO-CHANGE DETECTION: If the modified text is identical to the original text, omit it from output — it is not a real modification.\n\n9. PURE PLACEHOLDER PARAGRAPHS: If the original paragraph contains only placeholder text (e.g., just '[●]' or '[●]' with whitespace and no substantive legal text), reject any modification to it. These are fill-in fields (names, addresses, dates), not legal clauses.\n\n10. CROSS-BATCH CONSISTENCY: Check ACCUMULATED MODIFICATIONS FROM PREVIOUS BATCHES for terms, thresholds, caps, or defined terms that were changed. Ensure the current batch's modifications are consistent with previous changes.\n\nACTION ON VIOLATIONS:\n- FIXABLE (info slot replaced with dash, defined-term variant mismatch): Correct and output the fixed modification.\n- FUNDAMENTAL (merged paragraphs, language switch, original meaning deleted, pure placeholder modified): REJECT by omitting from output.\n\nOUTPUT FORMAT:\nReproduce validated/corrected modifications using exactly this format:\n--- MODIFICATION ---\nKey: [paragraph key]\nNew text: [complete replacement text]\n--- END ---\n\nOnly include modifications that pass all rules (after any corrections).\nIf all modifications are rejected or none were suggested: \"No modifications needed for this batch.\"",
+        "systemPrompt": "You are a quality-control reviewer for contract modifications.\n\nYou receive the FULL DOCUMENT for reference, ACCUMULATED MODIFICATIONS from previous batches, the CURRENT BATCH paragraphs, and SUGGESTED MODIFICATIONS from a prior editing step. Your job is to check each modification for structural and formatting integrity, then pass it through (with corrections if needed) or reject it.\n\nIMPORTANT: Default to PASSING modifications. You are a formatting/integrity check, NOT a second opinion on legal content. Adding qualifications, conditions, or protective language to existing text is expected and should be allowed. Only reject on clear structural violations.\n\nVALIDATION RULES:\n\n1. NO NEW PLACEHOLDERS: The modified text must not introduce NEW placeholders ([●], [X], [TBD], [___], etc.) that were not already in the original paragraph. Placeholders already present in the original may remain. If a new placeholder is found, restore the corresponding original text or REJECT.\n\n2. PARAGRAPH BOUNDARIES: Each modification must map to exactly one original paragraph key. If a modification consolidates content from multiple paragraphs into one, or splits one paragraph across multiple keys, REJECT it.\n\n3. PRESERVE INFO SLOTS: If the original paragraph contains placeholder fields (e.g., '[●]', '________', '[Datum]'), these fields must not be replaced with dashes ('—'), empty text, or generic filler. They must remain as-is or be replaced with concrete values. If violated, restore the original placeholder or REJECT.\n\n4. LANGUAGE MATCH: The modification must be in the same language as the original paragraph. If it switches languages, REJECT.\n\n5. DEFINED TERMS (cross-reference): Scan the FULL DOCUMENT PARAGRAPHS for defined terms — look for patterns like (die \"...\"), (der \"...\"), (\"...\"), or quoted capitalized terms. Modified text MUST use the exact defined terms found in the document. If a modification introduces a variant not found in the document (e.g., \"Käufer\" when the document defines \"Käuferin\"), correct it to match the document's defined term.\n\n6. CLEAN FINAL TEXT: The output must be a clean, single, final version — no duplicated sentences, no conflicting formulations, no partially merged text from original and modified versions.\n\n7. ORIGINAL MEANING PRESERVED: The original text's core meaning must be retained. Adding qualifications, conditions, or protective language is fine. Deleting substantive content from the original without replacement is not — restore the deleted content or REJECT.\n\n8. NO-CHANGE DETECTION: If the modified text is identical to the original text, omit it from output — it is not a real modification.\n\n9. PURE PLACEHOLDER PARAGRAPHS: If the original paragraph contains only placeholder text (e.g., just '[●]' or '[●]' with whitespace and no substantive legal text), reject any modification to it. These are fill-in fields (names, addresses, dates), not legal clauses.\n\n10. CROSS-BATCH CONSISTENCY: Check ACCUMULATED MODIFICATIONS FROM PREVIOUS BATCHES for terms, thresholds, caps, or defined terms that were changed. Ensure the current batch's modifications are consistent with previous changes.\n\n{{humanInputContext}}\n\nACTION ON VIOLATIONS:\n- FIXABLE (info slot replaced with dash, defined-term variant mismatch): Correct and output the fixed modification.\n- FUNDAMENTAL (merged paragraphs, language switch, original meaning deleted, pure placeholder modified): REJECT by omitting from output.\n\nOUTPUT FORMAT:\nReproduce validated/corrected modifications using exactly this format:\n--- MODIFICATION ---\nKey: [paragraph key]\nNew text: [complete replacement text]\n--- END ---\n\nOnly include modifications that pass all rules (after any corrections).\nIf all modifications are rejected or none were suggested: \"No modifications needed for this batch.\"",
         "userPrompt": "FULL DOCUMENT PARAGRAPHS (reference only — do NOT modify paragraphs outside the current batch):\n{{steps.extract_base_structured.output.data.lightweight}}\n\nACCUMULATED MODIFICATIONS FROM PREVIOUS BATCHES:\n{{variables.allModifications}}\n\nCURRENT BATCH PARAGRAPHS:\n{{loop.item}}\n\nSUGGESTED MODIFICATIONS FROM PRIOR STEP:\n{{steps.process_batch.output.data}}",
         "outputFormat": "text"
       },
@@ -131,8 +131,8 @@
       "stepType": "llm",
       "config": {
         "name": "Batch Modification Structurer",
-        "systemPrompt": "You are a data extraction assistant. Extract modification data from the suggested modifications and apply them to the original paragraphs.\n\nRULES:\n- ONLY modify paragraphs that exist in the ORIGINAL PARAGRAPHS. Never add new paragraphs.\n- The \"key\" field MUST be an exact key from the original paragraphs (e.g., \"p_5\", \"tbl_0_r0_c0_p0\").\n- The \"text\" field must be the complete new text for that paragraph, based on the suggested modifications.\n- If a suggested modification references a paragraph not in the original input, skip it.\n- If no valid modifications exist, return: {\"modifications\": []}",
-        "userPrompt": "ORIGINAL PARAGRAPHS:\n{{loop.item}}\n\nSUGGESTED MODIFICATIONS:\n{{steps.review_batch.output.data}}",
+        "systemPrompt": "You are a data extraction assistant. Extract modification data from the suggested modifications into structured JSON.\n\nRULES:\n- The \"key\" field MUST be an exact paragraph key from the modifications (e.g., \"p_5\", \"tbl_0_r0_c0_p0\").\n- The \"text\" field must be the complete new text for that paragraph, based on the suggested modifications.\n- If no valid modifications exist, return: {\"modifications\": []}",
+        "userPrompt": "SUGGESTED MODIFICATIONS:\n{{steps.review_batch.output.data}}",
         "outputFormat": "json",
         "outputSchema": {
           "type": "object",
diff --git a/services/platform/app/features/automations/executions/executions-table.tsx b/services/platform/app/features/automations/executions/executions-table.tsx
index 3d5e98d53..9e248ec8a 100644
--- a/services/platform/app/features/automations/executions/executions-table.tsx
+++ b/services/platform/app/features/automations/executions/executions-table.tsx
@@ -39,12 +39,13 @@ interface ExecutionsTableProps {
 
 const STATUS_BADGE_VARIANTS: Record<
   string,
-  'green' | 'destructive' | 'blue' | 'outline'
+  'green' | 'destructive' | 'blue' | 'outline' | 'yellow'
 > = {
   completed: 'green',
   failed: 'destructive',
   running: 'blue',
   pending: 'outline',
+  waiting_for_input: 'yellow',
 };
 
 type Execution = Doc<'wfExecutions'>;
@@ -166,16 +167,22 @@ export function ExecutionsTable({
   }, []);
 
   const getStatusBadge = useCallback(
-    (statusVal: string) => (
-      <Badge
-        dot
-        variant={STATUS_BADGE_VARIANTS[statusVal] || 'outline'}
-        className="text-xs capitalize"
-      >
-        {statusVal}
-      </Badge>
-    ),
-    [],
+    (statusVal: string, waitingFor?: string) => {
+      const displayStatus =
+        statusVal === 'running' && waitingFor ? 'waiting_for_input' : statusVal;
+      return (
+        <Badge
+          dot
+          variant={STATUS_BADGE_VARIANTS[displayStatus] || 'outline'}
+          className="text-xs capitalize"
+        >
+          {displayStatus === 'waiting_for_input'
+            ? tCommon('status.waitingForInput')
+            : statusVal}
+        </Badge>
+      );
+    },
+    [tCommon],
   );
 
   const formatTimestampWithMillis = useCallback((timestamp: number) => {
@@ -237,7 +244,8 @@ export function ExecutionsTable({
         accessorKey: 'status',
         header: tTables('headers.status'),
         size: 128,
-        cell: ({ row }) => getStatusBadge(row.original.status),
+        cell: ({ row }) =>
+          getStatusBadge(row.original.status, row.original.waitingFor),
       },
       {
         accessorKey: 'startedAt',
diff --git a/services/platform/app/features/chat/components/chat-input.tsx b/services/platform/app/features/chat/components/chat-input.tsx
index b1ebaf01c..fcadbeed7 100644
--- a/services/platform/app/features/chat/components/chat-input.tsx
+++ b/services/platform/app/features/chat/components/chat-input.tsx
@@ -34,6 +34,7 @@ interface ChatInputProps extends Omit<
   onStopGenerating?: () => void;
   isLoading?: boolean;
   disabled?: boolean;
+  disabledReason?: 'no-agents' | 'pending-approval';
   placeholder?: string;
   value?: string;
   onChange?: (value: string) => void;
@@ -52,6 +53,7 @@ export function ChatInput({
   onStopGenerating,
   isLoading = false,
   disabled = false,
+  disabledReason,
   placeholder,
   organizationId,
   attachments,
@@ -154,6 +156,7 @@ export function ChatInput({
         className="relative flex h-full min-h-0 flex-1 flex-col"
         onFilesSelected={uploadFiles}
         clickable={false}
+        disabled={inputDisabled}
       >
         <FileUpload.Overlay className="mx-2 rounded-t-3xl" />
         <input
@@ -290,7 +293,9 @@ export function ChatInput({
                 variant="muted"
                 className="pointer-events-none absolute top-0 left-0"
               >
-                {tChat('noAgentsAvailable')}
+                {disabledReason === 'pending-approval'
+                  ? tChat('pendingApprovalDisabled')
+                  : tChat('noAgentsAvailable')}
               </Text>
             )}
           </div>
diff --git a/services/platform/app/features/chat/components/chat-interface.tsx b/services/platform/app/features/chat/components/chat-interface.tsx
index 38f97a655..1571256c4 100644
--- a/services/platform/app/features/chat/components/chat-interface.tsx
+++ b/services/platform/app/features/chat/components/chat-interface.tsx
@@ -142,15 +142,27 @@ export function ChatInterface({
     threadId,
   );
 
-  // Block input when any pending approval exists
-  const hasPendingApproval = useMemo(
+  // Block input when any pending or executing approval exists
+  const hasActiveApproval = useMemo(
     () =>
-      (integrationApprovals ?? []).some((a) => a.status === 'pending') ||
-      (workflowCreationApprovals ?? []).some((a) => a.status === 'pending') ||
-      (workflowUpdateApprovals ?? []).some((a) => a.status === 'pending') ||
-      (workflowRunApprovals ?? []).some((a) => a.status === 'pending') ||
-      (humanInputRequests ?? []).some((a) => a.status === 'pending') ||
-      (documentWriteApprovals ?? []).some((a) => a.status === 'pending'),
+      (integrationApprovals ?? []).some(
+        (a) => a.status === 'pending' || a.status === 'executing',
+      ) ||
+      (workflowCreationApprovals ?? []).some(
+        (a) => a.status === 'pending' || a.status === 'executing',
+      ) ||
+      (workflowUpdateApprovals ?? []).some(
+        (a) => a.status === 'pending' || a.status === 'executing',
+      ) ||
+      (workflowRunApprovals ?? []).some(
+        (a) => a.status === 'pending' || a.status === 'executing',
+      ) ||
+      (humanInputRequests ?? []).some(
+        (a) => a.status === 'pending' || a.status === 'executing',
+      ) ||
+      (documentWriteApprovals ?? []).some(
+        (a) => a.status === 'pending' || a.status === 'executing',
+      ),
     [
       integrationApprovals,
       workflowCreationApprovals,
@@ -377,11 +389,11 @@ export function ChatInterface({
             onSendMessage={handleSendMessage}
             onStopGenerating={stopGenerating}
             isLoading={isLoading}
-            disabled={hasNoAgents || hasPendingApproval}
+            disabled={hasNoAgents || hasActiveApproval}
             disabledReason={
               hasNoAgents
                 ? 'no-agents'
-                : hasPendingApproval
+                : hasActiveApproval
                   ? 'pending-approval'
                   : undefined
             }
diff --git a/services/platform/app/features/chat/components/document-write-approval-card.tsx b/services/platform/app/features/chat/components/document-write-approval-card.tsx
index 6d39d5875..50644b3e2 100644
--- a/services/platform/app/features/chat/components/document-write-approval-card.tsx
+++ b/services/platform/app/features/chat/components/document-write-approval-card.tsx
@@ -31,7 +31,7 @@ import { formatBytes } from '@/lib/utils/format/number';
 interface DocumentWriteApprovalCardProps {
   approvalId: Id<'approvals'>;
   organizationId: string;
-  status: 'pending' | 'approved' | 'rejected';
+  status: 'pending' | 'executing' | 'completed' | 'rejected';
   metadata: DocumentWriteMetadata;
   executedAt?: number;
   executionError?: string;
@@ -76,7 +76,7 @@ function DocumentWriteApprovalCardComponent({
     try {
       await updateApprovalStatus({
         approvalId,
-        status: 'approved',
+        status: 'executing',
       });
       await executeDocumentWrite({ approvalId });
     } catch (err) {
@@ -135,15 +135,16 @@ function DocumentWriteApprovalCardComponent({
         {files.map((file) => (
           <div key={file.fileId} className="flex min-w-0 items-start gap-2">
             {/* Per-file status icon (only after execution) */}
-            {status === 'approved' && executedAt && (
-              <span className="mt-0.5 shrink-0">
-                {file.createdDocumentId && !file.executionError ? (
-                  <CheckCircle className="size-3 text-green-600" />
-                ) : file.executionError ? (
-                  <XCircle className="text-destructive size-3" />
-                ) : null}
-              </span>
-            )}
+            {(status === 'executing' || status === 'completed') &&
+              executedAt && (
+                <span className="mt-0.5 shrink-0">
+                  {file.createdDocumentId && !file.executionError ? (
+                    <CheckCircle className="size-3 text-green-600" />
+                  ) : file.executionError ? (
+                    <XCircle className="text-destructive size-3" />
+                  ) : null}
+                </span>
+              )}
             <div className="min-w-0 flex-1">
               <Text as="div" variant="label" className="truncate">
                 {file.title}
@@ -184,23 +185,29 @@ function DocumentWriteApprovalCardComponent({
       )}
 
       {/* Batch success summary */}
-      {status === 'approved' && executedAt && isBatch && !executionError && (
-        <HStack gap={1} className="mb-3 text-xs text-green-600">
-          <CheckCircle className="size-3" />
-          {t('savedSuccessfully')}
-        </HStack>
-      )}
+      {(status === 'executing' || status === 'completed') &&
+        executedAt &&
+        isBatch &&
+        !executionError && (
+          <HStack gap={1} className="mb-3 text-xs text-green-600">
+            <CheckCircle className="size-3" />
+            {t('savedSuccessfully')}
+          </HStack>
+        )}
 
       {/* Single file success */}
-      {status === 'approved' && executedAt && !isBatch && !executionError && (
-        <HStack gap={1} className="mb-3 text-xs text-green-600">
-          <CheckCircle className="size-3" />
-          {t('savedSuccessfully')}
-        </HStack>
-      )}
+      {(status === 'executing' || status === 'completed') &&
+        executedAt &&
+        !isBatch &&
+        !executionError && (
+          <HStack gap={1} className="mb-3 text-xs text-green-600">
+            <CheckCircle className="size-3" />
+            {t('savedSuccessfully')}
+          </HStack>
+        )}
 
       {/* Partial success (batch) */}
-      {status === 'approved' &&
+      {(status === 'executing' || status === 'completed') &&
         executedAt &&
         isBatch &&
         failedCount > 0 &&
@@ -215,21 +222,23 @@ function DocumentWriteApprovalCardComponent({
         )}
 
       {/* Execution error (single file) */}
-      {status === 'approved' && executionError && !isBatch && (
-        <HStack
-          gap={1}
-          align="start"
-          className="text-destructive mb-3 text-xs wrap-break-word"
-        >
-          <XCircle className="size-3 shrink-0" />
-          <Text as="span" className="min-w-0">
-            {executionError}
-          </Text>
-        </HStack>
-      )}
+      {(status === 'executing' || status === 'completed') &&
+        executionError &&
+        !isBatch && (
+          <HStack
+            gap={1}
+            align="start"
+            className="text-destructive mb-3 text-xs wrap-break-word"
+          >
+            <XCircle className="size-3 shrink-0" />
+            <Text as="span" className="min-w-0">
+              {executionError}
+            </Text>
+          </HStack>
+        )}
 
       {/* All failed (batch) */}
-      {status === 'approved' &&
+      {(status === 'executing' || status === 'completed') &&
         executedAt &&
         isBatch &&
         failedCount === files.length && (
@@ -298,16 +307,24 @@ function DocumentWriteApprovalCardComponent({
       {!isPending && (
         <HStack justify="between" align="center" className="mt-2">
           <Text as="div" variant="caption">
-            {status === 'approved' && failedCount > 0 && successCount > 0
-              ? t('statusApprovedPartial')
-              : status === 'approved' && executionError
-                ? t('statusApprovedFailed')
-                : status === 'approved'
-                  ? t('statusApprovedSuccess')
-                  : t('statusRejected')}
+            {status === 'executing'
+              ? t('statusExecuting')
+              : status === 'completed' && failedCount > 0 && successCount > 0
+                ? t('statusCompletedPartial')
+                : status === 'completed' && executionError
+                  ? t('statusCompletedFailed')
+                  : status === 'completed'
+                    ? t('statusCompletedSuccess')
+                    : t('statusRejected')}
           </Text>
           <Badge
-            variant={status === 'approved' ? 'green' : 'destructive'}
+            variant={
+              status === 'completed'
+                ? 'green'
+                : status === 'executing'
+                  ? 'blue'
+                  : 'destructive'
+            }
             className="shrink-0 text-xs capitalize"
           >
             {status}
diff --git a/services/platform/app/features/chat/components/human-input-request-card.tsx b/services/platform/app/features/chat/components/human-input-request-card.tsx
index 5a1593765..9b3c320a2 100644
--- a/services/platform/app/features/chat/components/human-input-request-card.tsx
+++ b/services/platform/app/features/chat/components/human-input-request-card.tsx
@@ -25,7 +25,7 @@ import { useSubmitHumanInputResponse } from '../hooks/mutations';
 
 interface HumanInputRequestCardProps {
   approvalId: Id<'approvals'>;
-  status: 'pending' | 'approved' | 'rejected';
+  status: 'pending' | 'executing' | 'completed' | 'rejected';
   metadata: HumanInputRequestMetadata;
   className?: string;
   onResponseSubmitted?: () => void;
@@ -312,10 +312,20 @@ function HumanInputRequestCardComponent({
       {!isPending && (
         <HStack justify="end" className="mt-2">
           <Badge
-            variant={status === 'approved' ? 'green' : 'destructive'}
+            variant={
+              status === 'completed'
+                ? 'green'
+                : status === 'executing'
+                  ? 'blue'
+                  : 'destructive'
+            }
             className="shrink-0 text-xs capitalize"
           >
-            {status === 'approved' ? 'Responded' : status}
+            {status === 'completed'
+              ? 'Responded'
+              : status === 'executing'
+                ? 'Processing'
+                : status}
           </Badge>
         </HStack>
       )}
diff --git a/services/platform/app/features/chat/components/integration-approval-card.tsx b/services/platform/app/features/chat/components/integration-approval-card.tsx
index 5c35f59a4..2f6f60a5a 100644
--- a/services/platform/app/features/chat/components/integration-approval-card.tsx
+++ b/services/platform/app/features/chat/components/integration-approval-card.tsx
@@ -29,7 +29,7 @@ import { cn } from '@/lib/utils/cn';
 interface IntegrationApprovalCardProps {
   approvalId: Id<'approvals'>;
   organizationId: string;
-  status: 'pending' | 'approved' | 'rejected';
+  status: 'pending' | 'executing' | 'completed' | 'rejected';
   metadata: IntegrationOperationMetadata;
   executedAt?: number;
   executionError?: string;
@@ -70,7 +70,7 @@ function IntegrationApprovalCardComponent({
     try {
       await updateApprovalStatus({
         approvalId,
-        status: 'approved',
+        status: 'executing',
       });
       await executeApprovedOperation({
         approvalId,
@@ -199,15 +199,17 @@ function IntegrationApprovalCardComponent({
       </Stack>
 
       {/* Execution Result (if approved and executed) */}
-      {status === 'approved' && executedAt && !executionError && (
-        <HStack gap={1} className="mb-3 text-xs text-green-600">
-          <CheckCircle className="size-3" />
-          {t('executedSuccessfully')}
-        </HStack>
-      )}
+      {(status === 'executing' || status === 'completed') &&
+        executedAt &&
+        !executionError && (
+          <HStack gap={1} className="mb-3 text-xs text-green-600">
+            <CheckCircle className="size-3" />
+            {t('executedSuccessfully')}
+          </HStack>
+        )}
 
       {/* Execution Error (persisted from backend) */}
-      {status === 'approved' && executionError && (
+      {(status === 'executing' || status === 'completed') && executionError && (
         <HStack
           gap={1}
           align="start"
@@ -269,14 +271,22 @@ function IntegrationApprovalCardComponent({
       {!isPending && (
         <HStack justify="between" align="center" className="mt-2">
           <Text as="div" variant="caption">
-            {status === 'approved' && executionError
-              ? t('statusApprovedFailed')
-              : status === 'approved'
-                ? t('statusApprovedSuccess')
-                : t('statusRejected')}
+            {status === 'executing'
+              ? t('statusExecuting')
+              : status === 'completed' && executionError
+                ? t('statusCompletedFailed')
+                : status === 'completed'
+                  ? t('statusCompletedSuccess')
+                  : t('statusRejected')}
           </Text>
           <Badge
-            variant={status === 'approved' ? 'green' : 'destructive'}
+            variant={
+              status === 'completed'
+                ? 'green'
+                : status === 'executing'
+                  ? 'blue'
+                  : 'destructive'
+            }
             className="shrink-0 text-xs capitalize"
           >
             {status}
diff --git a/services/platform/app/features/chat/components/workflow-creation-approval-card.tsx b/services/platform/app/features/chat/components/workflow-creation-approval-card.tsx
index 7e332252c..4cee3beda 100644
--- a/services/platform/app/features/chat/components/workflow-creation-approval-card.tsx
+++ b/services/platform/app/features/chat/components/workflow-creation-approval-card.tsx
@@ -34,7 +34,7 @@ import { isRecord } from '@/lib/utils/type-guards';
 interface WorkflowCreationApprovalCardProps {
   approvalId: Id<'approvals'>;
   organizationId: string;
-  status: 'pending' | 'approved' | 'rejected';
+  status: 'pending' | 'executing' | 'completed' | 'rejected';
   metadata: WorkflowCreationMetadata;
   executedAt?: number;
   executionError?: string;
@@ -281,7 +281,7 @@ function WorkflowCreationApprovalCardComponent({
     try {
       await updateApprovalStatus({
         approvalId,
-        status: 'approved',
+        status: 'executing',
       });
       await executeApprovedWorkflow({
         approvalId,
@@ -460,27 +460,32 @@ function WorkflowCreationApprovalCardComponent({
       </Stack>
 
       {/* Execution Result (if approved and executed) */}
-      {status === 'approved' && executedAt && !executionError && (
-        <Stack gap={1} className="mb-3">
-          <HStack gap={1} className="text-xs text-green-600">
-            <CheckCircle className="size-3" />
-            Workflow created successfully
-          </HStack>
-          {metadata.createdWorkflowId && (
-            <Link
-              to="/dashboard/$id/automations/$amId"
-              params={{ id: organizationId, amId: metadata.createdWorkflowId }}
-              className="text-primary flex items-center gap-1 text-xs hover:underline"
-            >
-              View workflow
-              <ExternalLink className="size-3" />
-            </Link>
-          )}
-        </Stack>
-      )}
+      {(status === 'executing' || status === 'completed') &&
+        executedAt &&
+        !executionError && (
+          <Stack gap={1} className="mb-3">
+            <HStack gap={1} className="text-xs text-green-600">
+              <CheckCircle className="size-3" />
+              Workflow created successfully
+            </HStack>
+            {metadata.createdWorkflowId && (
+              <Link
+                to="/dashboard/$id/automations/$amId"
+                params={{
+                  id: organizationId,
+                  amId: metadata.createdWorkflowId,
+                }}
+                className="text-primary flex items-center gap-1 text-xs hover:underline"
+              >
+                View workflow
+                <ExternalLink className="size-3" />
+              </Link>
+            )}
+          </Stack>
+        )}
 
       {/* Execution Error (persisted from backend) */}
-      {status === 'approved' && executionError && (
+      {(status === 'executing' || status === 'completed') && executionError && (
         <HStack
           gap={1}
           align="start"
@@ -542,14 +547,22 @@ function WorkflowCreationApprovalCardComponent({
       {!isPending && (
         <HStack justify="between" align="center" className="mt-2">
           <Text as="div" variant="caption">
-            {status === 'approved' && executionError
-              ? 'Workflow creation was approved but failed.'
-              : status === 'approved'
-                ? 'Workflow was created successfully.'
-                : 'Workflow creation was cancelled.'}
+            {status === 'executing'
+              ? 'Workflow creation in progress...'
+              : status === 'completed' && executionError
+                ? 'Workflow creation was approved but failed.'
+                : status === 'completed'
+                  ? 'Workflow was created successfully.'
+                  : 'Workflow creation was cancelled.'}
           </Text>
           <Badge
-            variant={status === 'approved' ? 'green' : 'destructive'}
+            variant={
+              status === 'completed'
+                ? 'green'
+                : status === 'executing'
+                  ? 'blue'
+                  : 'destructive'
+            }
             className="shrink-0 text-xs capitalize"
           >
             {status}
diff --git a/services/platform/app/features/chat/components/workflow-run-approval-card.tsx b/services/platform/app/features/chat/components/workflow-run-approval-card.tsx
index c2fc9fa80..0519abeb8 100644
--- a/services/platform/app/features/chat/components/workflow-run-approval-card.tsx
+++ b/services/platform/app/features/chat/components/workflow-run-approval-card.tsx
@@ -14,6 +14,8 @@ import {
   XCircle,
 } from 'lucide-react';
 import { memo, useCallback, useEffect, useState } from 'react';
+import ReactMarkdown from 'react-markdown';
+import remarkGfm from 'remark-gfm';
 
 import type { Id } from '@/convex/_generated/dataModel';
 import type { WorkflowRunMetadata } from '@/convex/approvals/types';
@@ -42,7 +44,7 @@ import { cn } from '@/lib/utils/cn';
 interface WorkflowRunApprovalCardProps {
   approvalId: Id<'approvals'>;
   organizationId: string;
-  status: 'pending' | 'approved' | 'rejected';
+  status: 'pending' | 'executing' | 'completed' | 'rejected';
   metadata: WorkflowRunMetadata;
   executedAt?: number;
   executionError?: string;
@@ -95,7 +97,7 @@ function WorkflowRunApprovalCardComponent({
   const [isCancelling, setIsCancelling] = useState(false);
 
   const executionId =
-    status === 'approved' && metadata.executionId
+    (status === 'executing' || status === 'completed') && metadata.executionId
       ? // oxlint-disable-next-line typescript/no-unsafe-type-assertion -- metadata.executionId is a string from Convex approval doc; cast to branded Id type required by the query
         (metadata.executionId as Id<'wfExecutions'>)
       : undefined;
@@ -148,7 +150,7 @@ function WorkflowRunApprovalCardComponent({
     try {
       await updateApprovalStatus({
         approvalId,
-        status: 'approved',
+        status: 'executing',
       });
       await executeApprovedRun({
         approvalId,
@@ -279,6 +281,15 @@ function WorkflowRunApprovalCardComponent({
                 response,
               },
               {
+                onSuccess: () => {
+                  // Defer clear so the Convex subscription hides the form first,
+                  // then clear state invisibly for the next human input request
+                  setTimeout(() => {
+                    setHumanInputValue('');
+                    setHumanInputSelected('');
+                    setHumanInputMulti([]);
+                  }, 500);
+                },
                 onError: (err) => {
                   setError(
                     err instanceof Error
@@ -293,126 +304,132 @@ function WorkflowRunApprovalCardComponent({
       )}
 
       {/* Live Execution Status */}
-      {status === 'approved' && executionId && !isWaitingForHumanInput && (
-        <Stack gap={1} className="mb-3" role="status" aria-live="polite">
-          {isRunning && (
-            <>
-              <HStack gap={1} justify="between" className="text-xs">
-                <HStack gap={1} className="text-primary">
-                  <Loader2 className="size-3 animate-spin" />
-                  {executionStatus?.currentStepName
-                    ? executionStatus.loopProgress
-                      ? t('executionRunningStepWithProgress', {
-                          step: executionStatus.currentStepName,
-                          current: executionStatus.loopProgress.current,
-                          total: executionStatus.loopProgress.total,
-                        })
-                      : t('executionRunningStep', {
-                          step: executionStatus.currentStepName,
-                        })
-                    : t('executionRunning')}
+      {(status === 'executing' || status === 'completed') &&
+        executionId &&
+        !isWaitingForHumanInput && (
+          <Stack gap={1} className="mb-3" role="status" aria-live="polite">
+            {isRunning && (
+              <>
+                <HStack gap={1} justify="between" className="text-xs">
+                  <HStack gap={1} className="text-primary">
+                    <Loader2 className="size-3 animate-spin" />
+                    {executionStatus?.currentStepName
+                      ? executionStatus.loopProgress
+                        ? t('executionRunningStepWithProgress', {
+                            step: executionStatus.currentStepName,
+                            current: executionStatus.loopProgress.current,
+                            total: executionStatus.loopProgress.total,
+                          })
+                        : t('executionRunningStep', {
+                            step: executionStatus.currentStepName,
+                          })
+                      : t('executionRunning')}
+                  </HStack>
+                  <Tooltip content={t('stopTooltip')}>
+                    <button
+                      type="button"
+                      onClick={handleCancel}
+                      disabled={isCancelling}
+                      aria-busy={isCancelling}
+                      aria-label={t('stopExecution')}
+                      className="text-muted-foreground hover:text-destructive flex cursor-pointer items-center gap-1 text-xs transition-colors disabled:opacity-50"
+                    >
+                      {isCancelling ? (
+                        <Loader2 className="size-3 animate-spin" />
+                      ) : (
+                        <Square className="size-3 fill-current" />
+                      )}
+                      {t('stopExecution')}
+                    </button>
+                  </Tooltip>
                 </HStack>
-                <Tooltip content={t('stopTooltip')}>
-                  <button
-                    type="button"
-                    onClick={handleCancel}
-                    disabled={isCancelling}
-                    aria-busy={isCancelling}
-                    aria-label={t('stopExecution')}
-                    className="text-muted-foreground hover:text-destructive flex cursor-pointer items-center gap-1 text-xs transition-colors disabled:opacity-50"
-                  >
-                    {isCancelling ? (
-                      <Loader2 className="size-3 animate-spin" />
-                    ) : (
-                      <Square className="size-3 fill-current" />
-                    )}
-                    {t('stopExecution')}
-                  </button>
-                </Tooltip>
-              </HStack>
-              {elapsed && (
-                <Text as="div" variant="caption">
-                  {t('executionElapsed', { duration: elapsed })}
-                </Text>
-              )}
-            </>
-          )}
+                {elapsed && (
+                  <Text as="div" variant="caption">
+                    {t('executionElapsed', { duration: elapsed })}
+                  </Text>
+                )}
+              </>
+            )}
 
-          {executionStatus?.status === 'completed' && (
-            <>
-              <HStack gap={1} className="text-xs text-green-600">
-                <CheckCircle className="size-3" />
-                {t('executionCompleted')}
-              </HStack>
-              {executionStatus.output != null && (
-                <>
-                  <button
-                    type="button"
-                    onClick={() => setShowOutput(!showOutput)}
-                    className="text-muted-foreground hover:text-foreground flex items-center gap-1 text-xs transition-colors"
-                    aria-expanded={showOutput}
-                    aria-label={showOutput ? t('hideOutput') : t('showOutput')}
-                  >
-                    {showOutput ? (
-                      <ChevronDown className="size-3" />
-                    ) : (
-                      <ChevronRight className="size-3" />
+            {executionStatus?.status === 'completed' && (
+              <>
+                <HStack gap={1} className="text-xs text-green-600">
+                  <CheckCircle className="size-3" />
+                  {t('executionCompleted')}
+                </HStack>
+                {executionStatus.output != null && (
+                  <>
+                    <button
+                      type="button"
+                      onClick={() => setShowOutput(!showOutput)}
+                      className="text-muted-foreground hover:text-foreground flex items-center gap-1 text-xs transition-colors"
+                      aria-expanded={showOutput}
+                      aria-label={
+                        showOutput ? t('hideOutput') : t('showOutput')
+                      }
+                    >
+                      {showOutput ? (
+                        <ChevronDown className="size-3" />
+                      ) : (
+                        <ChevronRight className="size-3" />
+                      )}
+                      {showOutput ? t('hideOutput') : t('showOutput')}
+                    </button>
+                    {showOutput && (
+                      <pre className="bg-muted/50 max-h-40 overflow-auto rounded-md p-2 font-mono text-[10px] break-all whitespace-pre-wrap">
+                        {formatOutputPreview(executionStatus.output)}
+                      </pre>
                     )}
-                    {showOutput ? t('hideOutput') : t('showOutput')}
-                  </button>
-                  {showOutput && (
-                    <pre className="bg-muted/50 max-h-40 overflow-auto rounded-md p-2 font-mono text-[10px] break-all whitespace-pre-wrap">
-                      {formatOutputPreview(executionStatus.output)}
-                    </pre>
-                  )}
-                </>
-              )}
-            </>
-          )}
+                  </>
+                )}
+              </>
+            )}
 
-          {executionStatus?.status === 'failed' && (
-            <HStack
-              gap={1}
-              align="start"
-              className="text-destructive text-xs wrap-break-word"
-            >
-              <XCircle className="size-3 shrink-0" />
-              <Text as="span" className="min-w-0">
-                {executionStatus.error || t('executionFailed')}
-              </Text>
-            </HStack>
-          )}
+            {executionStatus?.status === 'failed' && (
+              <HStack
+                gap={1}
+                align="start"
+                className="text-destructive text-xs wrap-break-word"
+              >
+                <XCircle className="size-3 shrink-0" />
+                <Text as="span" className="min-w-0">
+                  {executionStatus.error || t('executionFailed')}
+                </Text>
+              </HStack>
+            )}
 
-          {(executionStatus?.status === 'completed' ||
-            executionStatus?.status === 'failed') && (
-            <Link
-              to="/dashboard/$id/automations/$amId/executions"
-              params={{
-                id: organizationId,
-                amId: metadata.workflowId,
-              }}
-              className="text-primary flex items-center gap-1 text-xs hover:underline"
-            >
-              {t('viewDetails')}
-              <ExternalLink className="size-3" />
-            </Link>
-          )}
-        </Stack>
-      )}
+            {(executionStatus?.status === 'completed' ||
+              executionStatus?.status === 'failed') && (
+              <Link
+                to="/dashboard/$id/automations/$amId/executions"
+                params={{
+                  id: organizationId,
+                  amId: metadata.workflowId,
+                }}
+                className="text-primary flex items-center gap-1 text-xs hover:underline"
+              >
+                {t('viewDetails')}
+                <ExternalLink className="size-3" />
+              </Link>
+            )}
+          </Stack>
+        )}
 
       {/* Execution startup error (no executionId — workflow failed to start) */}
-      {status === 'approved' && !executionId && executionError && (
-        <HStack
-          gap={1}
-          align="start"
-          className="text-destructive mb-3 text-xs wrap-break-word"
-        >
-          <XCircle className="size-3 shrink-0" />
-          <Text as="span" className="min-w-0">
-            {executionError}
-          </Text>
-        </HStack>
-      )}
+      {(status === 'executing' || status === 'completed') &&
+        !executionId &&
+        executionError && (
+          <HStack
+            gap={1}
+            align="start"
+            className="text-destructive mb-3 text-xs wrap-break-word"
+          >
+            <XCircle className="size-3 shrink-0" />
+            <Text as="span" className="min-w-0">
+              {executionError}
+            </Text>
+          </HStack>
+        )}
 
       {/* Error Message (temporary UI error) */}
       {error && (
@@ -477,10 +494,20 @@ function WorkflowRunApprovalCardComponent({
             </Text>
           )}
           <Badge
-            variant={status === 'approved' ? 'green' : 'destructive'}
+            variant={
+              status === 'completed'
+                ? 'green'
+                : status === 'executing'
+                  ? 'blue'
+                  : 'destructive'
+            }
             className="shrink-0 text-xs"
           >
-            {status === 'approved' ? t('statusApproved') : t('statusRejected')}
+            {status === 'executing'
+              ? t('statusExecuting')
+              : status === 'completed'
+                ? t('statusCompleted')
+                : t('statusRejected')}
           </Badge>
         </HStack>
       )}
@@ -547,16 +574,16 @@ function WorkflowHumanInputSection({
 
   return (
     <Stack gap={3} className="mb-3">
-      <HStack gap={2}>
-        <MessageCircleQuestion className="text-primary size-4 shrink-0" />
-        <Text as="div" variant="label">
-          {question}
-        </Text>
+      <HStack gap={2} align="start">
+        <MessageCircleQuestion className="text-primary mt-0.5 size-4 shrink-0" />
+        <div className="prose prose-sm dark:prose-invert prose-p:my-0.5 prose-ul:my-0.5 prose-ol:my-0.5 prose-li:my-0 max-w-none text-sm font-medium">
+          <ReactMarkdown remarkPlugins={[remarkGfm]}>{question}</ReactMarkdown>
+        </div>
       </HStack>
       {context && (
-        <Text variant="caption" className="mt-1">
-          {context}
-        </Text>
+        <div className="prose prose-sm dark:prose-invert prose-p:my-0.5 prose-ul:my-0.5 prose-li:my-0 text-muted-foreground max-w-none text-xs">
+          <ReactMarkdown remarkPlugins={[remarkGfm]}>{context}</ReactMarkdown>
+        </div>
       )}
 
       {format === 'text_input' && (
diff --git a/services/platform/app/features/chat/components/workflow-update-approval-card.tsx b/services/platform/app/features/chat/components/workflow-update-approval-card.tsx
index b8a596f0e..38eae7c9c 100644
--- a/services/platform/app/features/chat/components/workflow-update-approval-card.tsx
+++ b/services/platform/app/features/chat/components/workflow-update-approval-card.tsx
@@ -36,7 +36,7 @@ import { isRecord } from '@/lib/utils/type-guards';
 interface WorkflowUpdateApprovalCardProps {
   approvalId: Id<'approvals'>;
   organizationId: string;
-  status: 'pending' | 'approved' | 'rejected';
+  status: 'pending' | 'executing' | 'completed' | 'rejected';
   metadata: WorkflowUpdateMetadata;
   executedAt?: number;
   executionError?: string;
@@ -118,7 +118,7 @@ function WorkflowUpdateApprovalCardComponent({
     try {
       await updateApprovalStatus({
         approvalId,
-        status: 'approved',
+        status: 'executing',
       });
       await executeApprovedUpdate({
         approvalId,
@@ -283,25 +283,27 @@ function WorkflowUpdateApprovalCardComponent({
       </Stack>
 
       {/* Execution Result */}
-      {status === 'approved' && executedAt && !executionError && (
-        <Stack gap={1} className="mb-3">
-          <HStack gap={1} className="text-xs text-green-600">
-            <CheckCircle className="size-3" />
-            Workflow updated successfully
-          </HStack>
-          <Link
-            to="/dashboard/$id/automations/$amId"
-            params={{ id: organizationId, amId: metadata.workflowId }}
-            className="text-primary flex items-center gap-1 text-xs hover:underline"
-          >
-            View workflow
-            <ExternalLink className="size-3" />
-          </Link>
-        </Stack>
-      )}
+      {(status === 'executing' || status === 'completed') &&
+        executedAt &&
+        !executionError && (
+          <Stack gap={1} className="mb-3">
+            <HStack gap={1} className="text-xs text-green-600">
+              <CheckCircle className="size-3" />
+              Workflow updated successfully
+            </HStack>
+            <Link
+              to="/dashboard/$id/automations/$amId"
+              params={{ id: organizationId, amId: metadata.workflowId }}
+              className="text-primary flex items-center gap-1 text-xs hover:underline"
+            >
+              View workflow
+              <ExternalLink className="size-3" />
+            </Link>
+          </Stack>
+        )}
 
       {/* Execution Error */}
-      {status === 'approved' && executionError && (
+      {(status === 'executing' || status === 'completed') && executionError && (
         <HStack
           gap={1}
           align="start"
@@ -363,14 +365,22 @@ function WorkflowUpdateApprovalCardComponent({
       {!isPending && (
         <HStack justify="between" align="center" className="mt-2">
           <Text as="div" variant="caption">
-            {status === 'approved' && executionError
-              ? 'Update was approved but failed to apply.'
-              : status === 'approved'
-                ? 'Workflow was updated successfully.'
-                : 'Workflow update was cancelled.'}
+            {status === 'executing'
+              ? 'Applying update...'
+              : status === 'completed' && executionError
+                ? 'Update was approved but failed to apply.'
+                : status === 'completed'
+                  ? 'Workflow was updated successfully.'
+                  : 'Workflow update was cancelled.'}
           </Text>
           <Badge
-            variant={status === 'approved' ? 'green' : 'destructive'}
+            variant={
+              status === 'completed'
+                ? 'green'
+                : status === 'executing'
+                  ? 'blue'
+                  : 'destructive'
+            }
             className="shrink-0 text-xs capitalize"
           >
             {status}
diff --git a/services/platform/app/features/chat/hooks/queries.ts b/services/platform/app/features/chat/hooks/queries.ts
index a4027c942..6eee6689c 100644
--- a/services/platform/app/features/chat/hooks/queries.ts
+++ b/services/platform/app/features/chat/hooks/queries.ts
@@ -129,7 +129,7 @@ function useApprovals(organizationId: string) {
 
 export interface HumanInputRequest {
   _id: Id<'approvals'>;
-  status: 'pending' | 'approved' | 'rejected';
+  status: 'pending' | 'executing' | 'completed' | 'rejected';
   metadata: HumanInputRequestMetadata;
   _creationTime: number;
   messageId?: string;
@@ -183,7 +183,7 @@ export interface IntegrationOperationMetadata {
 
 export interface IntegrationApproval {
   _id: Id<'approvals'>;
-  status: 'pending' | 'approved' | 'rejected';
+  status: 'pending' | 'executing' | 'completed' | 'rejected';
   metadata: IntegrationOperationMetadata;
   executedAt?: number;
   executionError?: string;
@@ -226,7 +226,7 @@ export function useIntegrationApprovals(
 
 export interface WorkflowCreationApproval {
   _id: Id<'approvals'>;
-  status: 'pending' | 'approved' | 'rejected';
+  status: 'pending' | 'executing' | 'completed' | 'rejected';
   metadata: WorkflowCreationMetadata;
   executedAt?: number;
   executionError?: string;
@@ -269,7 +269,7 @@ export function useWorkflowCreationApprovals(
 
 export interface WorkflowRunApproval {
   _id: Id<'approvals'>;
-  status: 'pending' | 'approved' | 'rejected';
+  status: 'pending' | 'executing' | 'completed' | 'rejected';
   metadata: WorkflowRunMetadata;
   executedAt?: number;
   executionError?: string;
@@ -312,7 +312,7 @@ export function useWorkflowRunApprovals(
 
 export interface WorkflowUpdateApproval {
   _id: Id<'approvals'>;
-  status: 'pending' | 'approved' | 'rejected';
+  status: 'pending' | 'executing' | 'completed' | 'rejected';
   metadata: WorkflowUpdateMetadata;
   executedAt?: number;
   executionError?: string;
@@ -355,7 +355,7 @@ export function useWorkflowUpdateApprovals(
 
 export interface DocumentWriteApproval {
   _id: Id<'approvals'>;
-  status: 'pending' | 'approved' | 'rejected';
+  status: 'pending' | 'executing' | 'completed' | 'rejected';
   metadata: DocumentWriteMetadata;
   executedAt?: number;
   executionError?: string;
diff --git a/services/platform/convex/agent_tools/database/helpers/schema_definitions.ts b/services/platform/convex/agent_tools/database/helpers/schema_definitions.ts
index 2d83dd6a6..e9b3725d4 100644
--- a/services/platform/convex/agent_tools/database/helpers/schema_definitions.ts
+++ b/services/platform/convex/agent_tools/database/helpers/schema_definitions.ts
@@ -131,7 +131,7 @@ export const TABLE_SCHEMAS: Record<string, TableSchemaDefinition> = {
       {
         field: 'status',
         type: 'enum',
-        values: ['pending', 'approved', 'rejected'],
+        values: ['pending', 'executing', 'completed', 'rejected'],
       },
       {
         field: 'resourceType',
@@ -151,8 +151,8 @@ export const TABLE_SCHEMAS: Record<string, TableSchemaDefinition> = {
     ],
     examples: [
       'status == "pending"',
-      'status == "approved"',
-      'status == "approved" && resourceType == "product_recommendation"',
+      'status == "completed"',
+      'status == "completed" && resourceType == "product_recommendation"',
       'status == "pending" && priority == "urgent"',
       'daysAgo(_creationTime) > 7 && status == "pending"',
     ],
diff --git a/services/platform/convex/agent_tools/documents/internal_actions.ts b/services/platform/convex/agent_tools/documents/internal_actions.ts
index a8af0e3d8..e12f22041 100644
--- a/services/platform/convex/agent_tools/documents/internal_actions.ts
+++ b/services/platform/convex/agent_tools/documents/internal_actions.ts
@@ -36,9 +36,9 @@ export const executeApprovedDocumentWrite = internalAction({
       throw new Error('Approval not found');
     }
 
-    if (approval.status !== 'approved') {
+    if (approval.status !== 'executing') {
       throw new Error(
-        `Cannot execute document write: approval status is "${approval.status}", expected "approved"`,
+        `Cannot execute document write: approval status is "${approval.status}", expected "executing"`,
       );
     }
 
diff --git a/services/platform/convex/agent_tools/documents/internal_mutations.ts b/services/platform/convex/agent_tools/documents/internal_mutations.ts
index 0b4a70bce..bc8ed96cd 100644
--- a/services/platform/convex/agent_tools/documents/internal_mutations.ts
+++ b/services/platform/convex/agent_tools/documents/internal_mutations.ts
@@ -114,6 +114,7 @@ export const updateDocumentWriteApprovalWithResult = internalMutation({
     const now = Date.now();
 
     await ctx.db.patch(args.approvalId, {
+      status: hasErrors ? 'rejected' : 'completed',
       executedAt: now,
       executionError: hasErrors ? 'Some files failed to save' : undefined,
       // oxlint-disable-next-line typescript/no-unsafe-type-assertion -- constructing approval metadata from known DocumentWriteMetadata fields
diff --git a/services/platform/convex/agent_tools/human_input/mutations.ts b/services/platform/convex/agent_tools/human_input/mutations.ts
index fb8522ab3..0af7bc7bd 100644
--- a/services/platform/convex/agent_tools/human_input/mutations.ts
+++ b/services/platform/convex/agent_tools/human_input/mutations.ts
@@ -72,7 +72,7 @@ export const submitHumanInputResponse = mutation({
     };
 
     await ctx.db.patch(args.approvalId, {
-      status: 'approved',
+      status: 'completed',
       approvedBy: identity.subject,
       reviewedAt: Date.now(),
       metadata: updatedMetadata,
diff --git a/services/platform/convex/agent_tools/integrations/internal_actions.ts b/services/platform/convex/agent_tools/integrations/internal_actions.ts
index abc2943b4..9a3c2f643 100644
--- a/services/platform/convex/agent_tools/integrations/internal_actions.ts
+++ b/services/platform/convex/agent_tools/integrations/internal_actions.ts
@@ -133,9 +133,9 @@ export const executeApprovedOperation = internalAction({
       throw new Error('Approval not found');
     }
 
-    if (approval.status !== 'approved') {
+    if (approval.status !== 'executing') {
       throw new Error(
-        `Cannot execute operation: approval status is "${approval.status}", expected "approved"`,
+        `Cannot execute operation: approval status is "${approval.status}", expected "executing"`,
       );
     }
 
diff --git a/services/platform/convex/agent_tools/integrations/internal_mutations.ts b/services/platform/convex/agent_tools/integrations/internal_mutations.ts
index 93855e4c2..a4422af15 100644
--- a/services/platform/convex/agent_tools/integrations/internal_mutations.ts
+++ b/services/platform/convex/agent_tools/integrations/internal_mutations.ts
@@ -43,6 +43,7 @@ export const updateApprovalWithResult = internalMutation({
     const executedAt = Date.now();
 
     await ctx.db.patch(args.approvalId, {
+      status: args.executionError ? 'rejected' : 'completed',
       executedAt,
       executionError: args.executionError || undefined,
       metadata: toConvexJsonRecord({
diff --git a/services/platform/convex/agent_tools/integrations/verify_approval_tool.ts b/services/platform/convex/agent_tools/integrations/verify_approval_tool.ts
index 704d940c1..a32e7a01a 100644
--- a/services/platform/convex/agent_tools/integrations/verify_approval_tool.ts
+++ b/services/platform/convex/agent_tools/integrations/verify_approval_tool.ts
@@ -22,7 +22,7 @@ const verifyApprovalArgs = z.object({
 export interface VerifyApprovalResult {
   exists: boolean;
   approvalId: string;
-  status?: 'pending' | 'approved' | 'rejected';
+  status?: 'pending' | 'executing' | 'completed' | 'rejected';
   operationName?: string;
   operationTitle?: string;
   integrationName?: string;
diff --git a/services/platform/convex/agent_tools/workflows/__tests__/execute_approved_workflow_run.test.ts b/services/platform/convex/agent_tools/workflows/__tests__/execute_approved_workflow_run.test.ts
index 0a000a86c..1334a90fc 100644
--- a/services/platform/convex/agent_tools/workflows/__tests__/execute_approved_workflow_run.test.ts
+++ b/services/platform/convex/agent_tools/workflows/__tests__/execute_approved_workflow_run.test.ts
@@ -31,7 +31,7 @@ vi.mock('../../../_generated/server', () => ({
 function createMockApproval(overrides?: Record<string, unknown>) {
   return {
     _id: 'approval-1',
-    status: 'approved',
+    status: 'executing',
     resourceType: 'workflow_run',
     organizationId: 'org-1',
     threadId: 'thread-1',
diff --git a/services/platform/convex/agent_tools/workflows/__tests__/execute_approved_workflow_update.test.ts b/services/platform/convex/agent_tools/workflows/__tests__/execute_approved_workflow_update.test.ts
index a803e93dc..fdb25ee4b 100644
--- a/services/platform/convex/agent_tools/workflows/__tests__/execute_approved_workflow_update.test.ts
+++ b/services/platform/convex/agent_tools/workflows/__tests__/execute_approved_workflow_update.test.ts
@@ -39,7 +39,7 @@ vi.mock('../../../_generated/server', () => ({
 function createMockApproval(overrides?: Record<string, unknown>) {
   return {
     _id: 'approval-1',
-    status: 'approved',
+    status: 'executing',
     resourceType: 'workflow_update',
     organizationId: 'org-1',
     threadId: 'thread-1',
diff --git a/services/platform/convex/agent_tools/workflows/internal_actions.ts b/services/platform/convex/agent_tools/workflows/internal_actions.ts
index 0b9a81d71..4049d012a 100644
--- a/services/platform/convex/agent_tools/workflows/internal_actions.ts
+++ b/services/platform/convex/agent_tools/workflows/internal_actions.ts
@@ -39,9 +39,9 @@ export const executeApprovedWorkflowCreation = internalAction({
       throw new Error('Approval not found');
     }
 
-    if (approval.status !== 'approved') {
+    if (approval.status !== 'executing') {
       throw new Error(
-        `Cannot execute workflow creation: approval status is "${approval.status}", expected "approved"`,
+        `Cannot execute workflow creation: approval status is "${approval.status}", expected "executing"`,
       );
     }
 
@@ -165,9 +165,9 @@ export const executeApprovedWorkflowRun = internalAction({
       throw new Error('Approval not found');
     }
 
-    if (approval.status !== 'approved') {
+    if (approval.status !== 'executing') {
       throw new Error(
-        `Cannot execute workflow run: approval status is "${approval.status}", expected "approved"`,
+        `Cannot execute workflow run: approval status is "${approval.status}", expected "executing"`,
       );
     }
 
@@ -292,9 +292,9 @@ export const executeApprovedWorkflowUpdate = internalAction({
       throw new Error('Approval not found');
     }
 
-    if (approval.status !== 'approved') {
+    if (approval.status !== 'executing') {
       throw new Error(
-        `Cannot execute workflow update: approval status is "${approval.status}", expected "approved"`,
+        `Cannot execute workflow update: approval status is "${approval.status}", expected "executing"`,
       );
     }
 
diff --git a/services/platform/convex/agent_tools/workflows/internal_mutations.ts b/services/platform/convex/agent_tools/workflows/internal_mutations.ts
index faf9c5256..8af2a956f 100644
--- a/services/platform/convex/agent_tools/workflows/internal_mutations.ts
+++ b/services/platform/convex/agent_tools/workflows/internal_mutations.ts
@@ -41,6 +41,7 @@ export const updateWorkflowApprovalWithResult = internalMutation({
 
     const now = Date.now();
     await ctx.db.patch(args.approvalId, {
+      status: args.executionError ? 'rejected' : 'completed',
       executedAt: now,
       executionError: args.executionError ?? undefined,
       // oxlint-disable-next-line typescript/no-unsafe-type-assertion -- constructing approval metadata from known WorkflowCreationMetadata fields
@@ -116,6 +117,19 @@ export const triggerWorkflowCompletionResponse = internalMutation({
     const agentConfig = toSerializableConfig(chatAgent);
     const { model, provider } = getDefaultAgentRuntimeConfig();
     const streamId = await persistentStreaming.createStream(ctx);
+
+    // Set generationStatus so the frontend shows loading indicator
+    const threadMeta = await ctx.db
+      .query('threadMetadata')
+      .withIndex('by_threadId', (q) => q.eq('threadId', threadId))
+      .first();
+    if (threadMeta) {
+      await ctx.db.patch(threadMeta._id, {
+        generationStatus: 'generating' as const,
+        streamId,
+      });
+    }
+
     const beforeGenerate = await createFunctionHandle(beforeGenerateHookRef);
 
     await ctx.scheduler.runAfter(
@@ -267,6 +281,9 @@ export const updateWorkflowRunApprovalWithResult = internalMutation({
 
     const now = Date.now();
     await ctx.db.patch(args.approvalId, {
+      // On error: reject immediately. On success: keep 'executing' — the workflow
+      // runs asynchronously and onWorkflowComplete will set 'completed' when done.
+      ...(args.executionError ? { status: 'rejected' as const } : {}),
       executedAt: now,
       executionError: args.executionError ?? undefined,
       // oxlint-disable-next-line typescript/no-unsafe-type-assertion -- constructing approval metadata from known WorkflowRunMetadata fields
@@ -410,6 +427,7 @@ export const updateWorkflowUpdateApprovalWithResult = internalMutation({
 
     const now = Date.now();
     await ctx.db.patch(args.approvalId, {
+      status: args.executionError ? 'rejected' : 'completed',
       executedAt: now,
       executionError: args.executionError ?? undefined,
       // oxlint-disable-next-line typescript/no-unsafe-type-assertion -- constructing approval metadata from known WorkflowUpdateMetadata fields
diff --git a/services/platform/convex/approvals/helpers.ts b/services/platform/convex/approvals/helpers.ts
index e24b773af..d7bc0ac2e 100644
--- a/services/platform/convex/approvals/helpers.ts
+++ b/services/platform/convex/approvals/helpers.ts
@@ -199,7 +199,7 @@ export async function listApprovalsByOrganization(
 
   const statuses: ApprovalStatus[] = args.status
     ? [args.status]
-    : ['pending', 'approved', 'rejected'];
+    : ['pending', 'executing', 'completed', 'rejected'];
 
   for (const status of statuses) {
     const query = buildQuery(status);
diff --git a/services/platform/convex/approvals/internal_queries.ts b/services/platform/convex/approvals/internal_queries.ts
index 1fd4e0683..7282a065d 100644
--- a/services/platform/convex/approvals/internal_queries.ts
+++ b/services/platform/convex/approvals/internal_queries.ts
@@ -66,7 +66,7 @@ export const listRespondedForExecution = internalQuery({
       [];
     for (const approval of approvals) {
       if (
-        approval.status === 'approved' &&
+        approval.status === 'completed' &&
         approval.resourceType === 'human_input_request' &&
         approval.metadata
       ) {
diff --git a/services/platform/convex/approvals/list_approvals_paginated.test.ts b/services/platform/convex/approvals/list_approvals_paginated.test.ts
index 7a267149b..780e11715 100644
--- a/services/platform/convex/approvals/list_approvals_paginated.test.ts
+++ b/services/platform/convex/approvals/list_approvals_paginated.test.ts
@@ -122,7 +122,7 @@ describe('listApprovalsPaginated', () => {
     await listApprovalsPaginated(ctx as unknown as QueryCtx, {
       paginationOpts: DEFAULT_PAGINATION_OPTS,
       organizationId: 'org_1',
-      status: 'approved',
+      status: 'completed',
       resourceType: 'product_recommendation',
       excludeStatus: 'pending',
     });
@@ -140,7 +140,7 @@ describe('listApprovalsPaginated', () => {
       { _id: 'a_1', status: 'pending', resourceType: 'product_recommendation' },
       {
         _id: 'a_2',
-        status: 'approved',
+        status: 'completed',
         resourceType: 'product_recommendation',
       },
     ];
diff --git a/services/platform/convex/approvals/mutations.ts b/services/platform/convex/approvals/mutations.ts
index 2874096f5..17018e59b 100644
--- a/services/platform/convex/approvals/mutations.ts
+++ b/services/platform/convex/approvals/mutations.ts
@@ -1,5 +1,7 @@
+import { saveMessage } from '@convex-dev/agent';
 import { v } from 'convex/values';
 
+import { components } from '../_generated/api';
 import { mutation } from '../_generated/server';
 import * as AuditLogHelpers from '../audit_logs/helpers';
 import { authComponent } from '../auth';
@@ -37,7 +39,7 @@ export const updateApprovalStatus = mutation({
     });
 
     const action =
-      args.status === 'approved' ? 'approve_request' : 'reject_request';
+      args.status === 'executing' ? 'approve_request' : 'reject_request';
 
     await AuditLogHelpers.logSuccess(
       ctx,
@@ -58,6 +60,20 @@ export const updateApprovalStatus = mutation({
       { status: args.status, comments: args.comments },
     );
 
+    // Write system message to thread on rejection so the AI knows it was user-initiated
+    if (args.status === 'rejected' && approval.threadId) {
+      const reason = args.comments
+        ? `Reason: ${args.comments}`
+        : 'No reason provided.';
+      await saveMessage(ctx, components.agent, {
+        threadId: approval.threadId,
+        message: {
+          role: 'system',
+          content: `[APPROVAL_REJECTED]\nThe user manually rejected the ${approval.resourceType.replace(/_/g, ' ')} request.\n${reason}\n\nInstructions:\n- Acknowledge that the user rejected this request\n- Do NOT speculate about technical errors or failures\n- Ask if they would like to try a different approach`,
+        },
+      });
+    }
+
     return null;
   },
 });
diff --git a/services/platform/convex/approvals/queries.ts b/services/platform/convex/approvals/queries.ts
index 60d8b019f..3649e30d2 100644
--- a/services/platform/convex/approvals/queries.ts
+++ b/services/platform/convex/approvals/queries.ts
@@ -66,20 +66,15 @@ export const approxCountApprovalsByStatus = query({
     }
 
     let count = 0;
-    for await (const _ of ctx.db
-      .query('approvals')
-      .withIndex('by_org_status', (q) =>
-        q.eq('organizationId', args.organizationId).eq('status', 'approved'),
-      )) {
-      count++;
-      if (count >= DEFAULT_COUNT_CAP) break;
-    }
-    for await (const _ of ctx.db
-      .query('approvals')
-      .withIndex('by_org_status', (q) =>
-        q.eq('organizationId', args.organizationId).eq('status', 'rejected'),
-      )) {
-      count++;
+    for (const status of ['executing', 'completed', 'rejected'] as const) {
+      for await (const _ of ctx.db
+        .query('approvals')
+        .withIndex('by_org_status', (q) =>
+          q.eq('organizationId', args.organizationId).eq('status', status),
+        )) {
+        count++;
+        if (count >= DEFAULT_COUNT_CAP) break;
+      }
       if (count >= DEFAULT_COUNT_CAP) break;
     }
     return count;
diff --git a/services/platform/convex/approvals/schema.ts b/services/platform/convex/approvals/schema.ts
index 0f91671f0..bd038196d 100644
--- a/services/platform/convex/approvals/schema.ts
+++ b/services/platform/convex/approvals/schema.ts
@@ -9,7 +9,8 @@ export const approvalsTable = defineTable({
   stepSlug: v.optional(v.string()),
   status: v.union(
     v.literal('pending'),
-    v.literal('approved'),
+    v.literal('executing'),
+    v.literal('completed'),
     v.literal('rejected'),
   ),
   approvedBy: v.optional(v.string()),
diff --git a/services/platform/convex/approvals/validators.ts b/services/platform/convex/approvals/validators.ts
index 07f16fbd1..5bcf36a1a 100644
--- a/services/platform/convex/approvals/validators.ts
+++ b/services/platform/convex/approvals/validators.ts
@@ -9,7 +9,8 @@ import { v } from 'convex/values';
 
 export const approvalStatusValidator = v.union(
   v.literal('pending'),
-  v.literal('approved'),
+  v.literal('executing'),
+  v.literal('completed'),
   v.literal('rejected'),
 );
 
diff --git a/services/platform/convex/conversations/send_message_via_integration.ts b/services/platform/convex/conversations/send_message_via_integration.ts
index e93c39b39..a9b42d884 100644
--- a/services/platform/convex/conversations/send_message_via_integration.ts
+++ b/services/platform/convex/conversations/send_message_via_integration.ts
@@ -150,7 +150,7 @@ export async function sendMessageViaIntegration(
     const approvalExistingMetadata = pendingApproval.metadata ?? {};
 
     await ctx.db.patch(pendingApproval._id, {
-      status: 'approved',
+      status: 'completed',
       approvedBy,
       reviewedAt: Date.now(),
       metadata: {
diff --git a/services/platform/convex/wf_executions/mutations.ts b/services/platform/convex/wf_executions/mutations.ts
index d02b64a74..bf50a1cfa 100644
--- a/services/platform/convex/wf_executions/mutations.ts
+++ b/services/platform/convex/wf_executions/mutations.ts
@@ -1,11 +1,14 @@
 import type { WorkflowId } from '@convex-dev/workflow';
 
+import { saveMessage } from '@convex-dev/agent';
 import { v } from 'convex/values';
 
-import { internal } from '../_generated/api';
+import { isRecord, getString } from '../../lib/utils/type-guards';
+import { components, internal } from '../_generated/api';
 import { mutation } from '../_generated/server';
 import { authComponent } from '../auth';
 import { getOrganizationMember, mutationWithRLS } from '../lib/rls';
+import { toId } from '../lib/type_cast_helpers';
 import { jsonValueValidator } from '../lib/validators/json';
 import { workflowManagers } from '../workflow_engine/engine';
 import { safeShardIndex } from '../workflow_engine/helpers/engine/shard';
@@ -91,6 +94,30 @@ export const cancelExecution = mutationWithRLS({
       );
     }
 
+    // Write system message to thread so the AI knows this was user-initiated
+    const triggerData = isRecord(execution.triggerData)
+      ? execution.triggerData
+      : null;
+    const approvalIdStr = triggerData
+      ? getString(triggerData, 'approvalId')
+      : undefined;
+    if (approvalIdStr) {
+      try {
+        const approval = await ctx.db.get(toId<'approvals'>(approvalIdStr));
+        if (approval?.threadId) {
+          await saveMessage(ctx, components.agent, {
+            threadId: approval.threadId,
+            message: {
+              role: 'system',
+              content: `[WORKFLOW_CANCELLED]\nThe user manually stopped the running workflow "${execution.workflowSlug ?? 'unknown'}".\n\nInstructions:\n- Acknowledge that the user cancelled the workflow execution\n- Do NOT speculate about technical errors\n- Ask if they would like to try again or take a different approach`,
+            },
+          });
+        }
+      } catch {
+        // Non-critical: system message failure should not block cancellation
+      }
+    }
+
     return null;
   },
 });
diff --git a/services/platform/convex/workflow_engine/action_defs/approval/helpers/types.ts b/services/platform/convex/workflow_engine/action_defs/approval/helpers/types.ts
index e7af4ead6..04cce5b17 100644
--- a/services/platform/convex/workflow_engine/action_defs/approval/helpers/types.ts
+++ b/services/platform/convex/workflow_engine/action_defs/approval/helpers/types.ts
@@ -2,7 +2,7 @@ import type { Id } from '../../../../_generated/dataModel';
 import type { ApprovalResourceType } from '../../../../approvals/types';
 import type { ConvexJsonRecord } from '../../../../lib/validators/json';
 
-export type ApprovalStatus = 'pending' | 'approved' | 'rejected';
+export type ApprovalStatus = 'pending' | 'executing' | 'completed' | 'rejected';
 export type ApprovalPriority = 'low' | 'medium' | 'high' | 'urgent';
 
 export type ApprovalData = {
diff --git a/services/platform/convex/workflow_engine/action_defs/workflow_processing_records/workflow_processing_records_action.ts b/services/platform/convex/workflow_engine/action_defs/workflow_processing_records/workflow_processing_records_action.ts
index 794b8f6d2..adfddc313 100644
--- a/services/platform/convex/workflow_engine/action_defs/workflow_processing_records/workflow_processing_records_action.ts
+++ b/services/platform/convex/workflow_engine/action_defs/workflow_processing_records/workflow_processing_records_action.ts
@@ -50,7 +50,7 @@ type WorkflowProcessingRecordsActionParams =
        * @example 'status == "closed"'
        * @example 'status == "open" && priority == "high"'
        * @example 'status == "closed" && daysAgo(metadata.resolved_at) > 30'
-       * @example 'status == "approved" && resourceType == "product_recommendation"'
+       * @example 'status == "completed" && resourceType == "product_recommendation"'
        */
       filterExpression?: string;
     }
@@ -80,7 +80,7 @@ Examples:
 - Find any conversation: { operation: 'find_unprocessed', tableName: 'conversations' }
 - Find open conversations: { filterExpression: 'status == "open"' }
 - Find stale closed conversations: { filterExpression: 'status == "closed" && daysAgo(metadata.resolved_at) > 30' }
-- Find approved product recommendations: { tableName: 'approvals', filterExpression: 'status == "approved" && resourceType == "product_recommendation"' }
+- Find approved product recommendations: { tableName: 'approvals', filterExpression: 'status == "completed" && resourceType == "product_recommendation"' }
 
 organizationId and rootWfDefinitionId are automatically read from workflow context variables.`,
     parametersValidator: v.union(
diff --git a/services/platform/convex/workflow_engine/helpers/engine/dynamic_workflow_handler.ts b/services/platform/convex/workflow_engine/helpers/engine/dynamic_workflow_handler.ts
index 84e548bb3..138f15179 100644
--- a/services/platform/convex/workflow_engine/helpers/engine/dynamic_workflow_handler.ts
+++ b/services/platform/convex/workflow_engine/helpers/engine/dynamic_workflow_handler.ts
@@ -225,20 +225,25 @@ export async function handleDynamicWorkflow(
         }),
       });
 
-      // Clear waitingFor after resume
+      // Clear waitingFor after resume (empty string signals "clear" since
+      // Convex strips undefined values from serialized args)
       await step.runMutation(
         internal.wf_executions.internal_mutations.updateExecutionStatus,
         {
           executionId,
           status: 'running',
-          waitingFor: undefined,
+          waitingFor: '',
         },
       );
 
-      debugLog('dynamicWorkflow Resumed after human input', {
+      debugLog('dynamicWorkflow Resumed after human input, re-executing step', {
         stepSlug: stepDef.stepSlug,
         approvalTaskId: stepResult.approvalTaskId,
       });
+
+      // Re-execute the same step — the LLM now has the user's response
+      // available via <human_input_context> prompt injection
+      continue;
     }
 
     currentStepSlug = nextStepSlug;
diff --git a/services/platform/convex/workflow_engine/helpers/engine/on_workflow_complete.ts b/services/platform/convex/workflow_engine/helpers/engine/on_workflow_complete.ts
index eaf5e4051..f4d181ad7 100644
--- a/services/platform/convex/workflow_engine/helpers/engine/on_workflow_complete.ts
+++ b/services/platform/convex/workflow_engine/helpers/engine/on_workflow_complete.ts
@@ -94,10 +94,38 @@ export async function handleWorkflowComplete(
   }
 
   if (!wasTerminal) {
+    // Mark the triggering approval as completed/rejected now that the workflow is done
+    await updateTriggeringApprovalStatus(ctx, exec, kind);
     await postCompletionMessageToThread(ctx, exec, kind, result);
   }
 }
 
+async function updateTriggeringApprovalStatus(
+  ctx: MutationCtx,
+  exec: Doc<'wfExecutions'>,
+  kind: string | undefined,
+): Promise<void> {
+  const triggerData = isRecord(exec.triggerData) ? exec.triggerData : null;
+  const approvalIdStr = triggerData
+    ? getString(triggerData, 'approvalId')
+    : undefined;
+  if (!approvalIdStr) return;
+
+  try {
+    const approval = await ctx.db.get(toId<'approvals'>(approvalIdStr));
+    if (!approval || approval.status !== 'executing') return;
+
+    await ctx.db.patch(approval._id, {
+      status: kind === 'success' ? 'completed' : 'rejected',
+      ...(kind !== 'success'
+        ? { executionError: exec.error ?? 'Workflow failed' }
+        : {}),
+    });
+  } catch {
+    // Non-critical: approval status update failure should not block completion
+  }
+}
+
 async function postCompletionMessageToThread(
   ctx: MutationCtx,
   exec: Doc<'wfExecutions'>,
diff --git a/services/platform/convex/workflow_engine/helpers/nodes/llm/execute_llm_node.ts b/services/platform/convex/workflow_engine/helpers/nodes/llm/execute_llm_node.ts
index c16a63909..e0ea2adc7 100644
--- a/services/platform/convex/workflow_engine/helpers/nodes/llm/execute_llm_node.ts
+++ b/services/platform/convex/workflow_engine/helpers/nodes/llm/execute_llm_node.ts
@@ -41,34 +41,44 @@ export async function executeLLMNode(
   // 1. Validate and normalize configuration
   const normalizedConfig = validateAndNormalizeConfig(config);
 
-  // 2. Process prompts with variable substitution
-  const prompts = processPrompts(normalizedConfig, variables);
-
-  // 2.5. Inject prior human input responses into system prompt (for workflow context)
+  // 2. Build prompt-scoped variables with {{humanInputContext}} support.
+  // We create a shallow copy instead of mutating `variables` because:
+  // - The original `variables` object is persisted to execution state by
+  //   persistExecutionResult() in execute_step_handler.ts after this function returns.
+  // - humanInputContext is an ephemeral, prompt-only value that must be freshly
+  //   computed from the DB on each step execution, not stored in execution state.
+  // - Storing it would cause stale context after human input replay: the persisted
+  //   value from run N would shadow the fresh query result in run N+1.
+  let promptVariables = variables;
   if (executionId) {
-    try {
-      const respondedApprovals = await ctx.runQuery(
-        internal.approvals.internal_queries.listRespondedForExecution,
-        { executionId: toId<'wfExecutions'>(executionId) },
-      );
-      if (respondedApprovals.length > 0) {
-        const context = respondedApprovals
-          .map(
-            (a: { question: string; response: string | string[] }) =>
-              `- Q: "${a.question}" → A: "${Array.isArray(a.response) ? a.response.join(', ') : a.response}"`,
-          )
-          .join('\n');
-        prompts.systemPrompt += `\n\n<human_input_context>\nThe following information was provided by the user during this workflow:\n${context}\n</human_input_context>`;
-        debugLog('Injected human input context into system prompt', {
-          responseCount: respondedApprovals.length,
-        });
-      }
-    } catch {
-      // Non-critical: skip if query fails (e.g., executionId is not a valid wfExecutions ID)
+    const respondedApprovals = await ctx.runQuery(
+      internal.approvals.internal_queries.listRespondedForExecution,
+      { executionId: toId<'wfExecutions'>(executionId) },
+    );
+    const humanInputContext =
+      respondedApprovals.length > 0
+        ? [
+            '<human_input_context>',
+            'The following information was provided by the user during this workflow. Use these values directly — do not re-ask for information already provided.',
+            ...respondedApprovals.map(
+              (a: { question: string; response: string | string[] }) =>
+                `- Q: "${a.question}" → A: "${Array.isArray(a.response) ? a.response.join(', ') : a.response}"`,
+            ),
+            '</human_input_context>',
+          ].join('\n')
+        : '';
+    promptVariables = { ...variables, humanInputContext };
+    if (respondedApprovals.length > 0) {
+      debugLog('Built humanInputContext for prompt variables', {
+        responseCount: respondedApprovals.length,
+      });
     }
   }
 
-  // 3. Execute using Convex agent with tools
+  // 3. Process prompts with variable substitution
+  const prompts = processPrompts(normalizedConfig, promptVariables);
+
+  // 4. Execute using Convex agent with tools
   const llmResult = await executeAgentWithTools(
     ctx,
     normalizedConfig,
@@ -81,7 +91,7 @@ export async function executeLLMNode(
     },
   );
 
-  // 4. Create and return result
+  // 5. Create and return result
   return createLLMResult(llmResult, normalizedConfig, {
     threadId: llmResult.threadId, // Return the threadId used
   });
diff --git a/services/platform/convex/workflow_engine/helpers/validation/variables/parse.ts b/services/platform/convex/workflow_engine/helpers/validation/variables/parse.ts
index 3f9df4e5b..11eb40158 100644
--- a/services/platform/convex/workflow_engine/helpers/validation/variables/parse.ts
+++ b/services/platform/convex/workflow_engine/helpers/validation/variables/parse.ts
@@ -148,6 +148,7 @@ function parseExpression(
     'executionId',
     'now',
     'nowMs',
+    'humanInputContext',
   ];
   if (systemVars.includes(firstPart)) {
     return {
diff --git a/services/platform/convex/workflows/executions/update_execution_status.ts b/services/platform/convex/workflows/executions/update_execution_status.ts
index e55775b4b..e27b360a2 100644
--- a/services/platform/convex/workflows/executions/update_execution_status.ts
+++ b/services/platform/convex/workflows/executions/update_execution_status.ts
@@ -38,7 +38,8 @@ export async function updateExecutionStatus(
   }
 
   if (args.waitingFor !== undefined) {
-    updates.waitingFor = args.waitingFor;
+    // Empty string signals "clear the field"
+    updates.waitingFor = args.waitingFor || undefined;
   }
 
   if (args.error !== undefined) {
diff --git a/services/platform/messages/en.json b/services/platform/messages/en.json
index a33f7ded9..82e9cd32a 100644
--- a/services/platform/messages/en.json
+++ b/services/platform/messages/en.json
@@ -101,6 +101,7 @@
       "running": "Running",
       "completed": "Completed",
       "failed": "Failed",
+      "waitingForInput": "Waiting for input",
       "published": "Published",
       "draft": "Draft",
       "enabled": "Enabled",
@@ -2104,8 +2105,10 @@
     "reject": "Cancel",
     "approveTooltip": "Approve and run this workflow",
     "rejectTooltip": "Cancel workflow execution",
-    "statusApprovedSuccess": "Workflow execution started successfully.",
-    "statusApprovedFailed": "Workflow execution was approved but failed to start.",
+    "statusExecuting": "Executing...",
+    "statusCompleted": "Completed",
+    "statusCompletedSuccess": "Workflow execution started successfully.",
+    "statusCompletedFailed": "Workflow execution was approved but failed to start.",
     "statusRejected": "Rejected",
     "showParameters": "Show parameters",
     "hideParameters": "Hide parameters",
@@ -2120,8 +2123,7 @@
     "hideOutput": "Hide output",
     "stopExecution": "Stop",
     "stopTooltip": "Stop workflow execution",
-    "statusPending": "Pending",
-    "statusApproved": "Approved"
+    "statusPending": "Pending"
   },
   "documentWriteApproval": {
     "cardTitle": "Save to documents",
@@ -2135,9 +2137,10 @@
     "savedSuccessfully": "Saved to your documents",
     "savedPartially": "{success} of {total} files saved successfully",
     "fileFailed": "Failed to save",
-    "statusApprovedFailed": "This document was approved but failed to save.",
-    "statusApprovedSuccess": "This document was saved to your documents.",
-    "statusApprovedPartial": "Some documents failed to save.",
+    "statusExecuting": "Saving documents...",
+    "statusCompletedFailed": "This document was approved but failed to save.",
+    "statusCompletedSuccess": "This document was saved to your documents.",
+    "statusCompletedPartial": "Some documents failed to save.",
     "statusRejected": "This document save was rejected.",
     "allFilesFailed": "All {count} files failed to save",
     "errorNotAuthenticated": "User not authenticated",
@@ -2150,8 +2153,9 @@
     "executedSuccessfully": "Executed successfully",
     "approveTooltip": "Approve and execute this operation",
     "rejectTooltip": "Reject this operation",
-    "statusApprovedFailed": "This operation was approved but failed during execution.",
-    "statusApprovedSuccess": "This operation was approved and executed successfully.",
+    "statusExecuting": "Executing operation...",
+    "statusCompletedFailed": "This operation was approved but failed during execution.",
+    "statusCompletedSuccess": "This operation was approved and executed successfully.",
     "statusRejected": "This operation was rejected.",
     "moreParameters": "+{count} more",
     "showLess": "Show less"
@@ -2281,6 +2285,7 @@
     "showMore": "Show more",
     "showLess": "Show less",
     "noAgentsAvailable": "No agents available. Please publish an agent first.",
+    "pendingApprovalDisabled": "Respond to the pending request above to continue",
     "searchConversations": "Search conversations",
     "invalidFiles": "Invalid files",
     "filesNotSupported": "Some files are too large (>10MB) or not supported. Supported: images, PDF, Word docs, text files.",

From 00f75937b71e8290f25cbc91e8b5c43c119e9220 Mon Sep 17 00:00:00 2001
From: larryro <371767072@qq.com>
Date: Fri, 20 Mar 2026 18:20:51 +0800
Subject: [PATCH 3/9] feat(platform): batch workflow step updates, approval
 card refactor, and LLM input sanitization

Adds batch update support to the workflow step tool with JSON sanitization
for malformed LLM output. Extracts ApprovalCardRenderer component and
refactors chat to show a single active approval at the bottom. Adds human
input context builder for LLM nodes and new approval helper queries.
---
 .../message-list.test.tsx                     |  78 ++-
 .../automation-assistant/message-list.tsx     | 284 ++++----
 .../components/approval-card-renderer.tsx     |  87 +++
 .../chat/components/chat-interface.tsx        |  41 +-
 .../chat/components/chat-messages.tsx         | 189 ++----
 .../workflow-update-approval-card.tsx         |  38 +-
 .../__tests__/use-merged-chat-items.test.ts   | 190 ++++++
 .../app/features/chat/hooks/queries.ts        |  16 +-
 .../chat/hooks/use-merged-chat-items.ts       | 194 +++---
 .../components/test-chat-panel.tsx            |   2 +
 .../test-chat-panel/test-message-list.tsx     | 122 +---
 .../custom-agents/hooks/use-test-chat.ts      |   9 +-
 services/platform/convex/_generated/api.d.ts  |   2 +
 .../agent_tools/workflows/internal_actions.ts |  30 +-
 .../workflows/internal_mutations.ts           |  46 ++
 .../workflows/update_workflow_step_tool.ts    | 604 +++++++++++-------
 services/platform/convex/approvals/helpers.ts |  37 ++
 services/platform/convex/approvals/queries.ts |  22 +
 services/platform/convex/approvals/types.ts   |  14 +-
 .../convex/lib/create_agent_config.ts         |   9 +-
 .../variables/replace_variables_in_string.ts  |   5 +-
 .../convex/wf_executions/mutations.ts         |   2 +-
 .../convex/wf_step_defs/internal_mutations.ts |  17 +
 .../helpers/engine/execute_step_handler.ts    |  15 +-
 .../engine/on_workflow_complete.test.ts       |  34 +
 .../helpers/engine/on_workflow_complete.ts    |   6 +-
 .../helpers/nodes/llm/execute_llm_node.ts     |  55 +-
 .../llm/utils/build_human_input_context.ts    |  38 ++
 28 files changed, 1308 insertions(+), 878 deletions(-)
 create mode 100644 services/platform/app/features/chat/components/approval-card-renderer.tsx
 create mode 100644 services/platform/app/features/chat/hooks/__tests__/use-merged-chat-items.test.ts
 create mode 100644 services/platform/convex/workflow_engine/helpers/nodes/llm/utils/build_human_input_context.ts

diff --git a/services/platform/app/features/automations/components/automation-assistant/message-list.test.tsx b/services/platform/app/features/automations/components/automation-assistant/message-list.test.tsx
index 49b59f447..31d44ca21 100644
--- a/services/platform/app/features/automations/components/automation-assistant/message-list.test.tsx
+++ b/services/platform/app/features/automations/components/automation-assistant/message-list.test.tsx
@@ -98,11 +98,12 @@ describe('MessageList', () => {
   afterEach(cleanup);
 
   describe('approval rendering', () => {
-    it('renders approval inline after its linked message', () => {
+    it('renders a pending approval at the bottom', () => {
       const message = createMessage({ id: 'msg-1', content: 'AI response' });
       const approval = createUpdateApproval({
         _id: 'approval-1' as Id<'approvals'>,
         messageId: 'msg-1',
+        status: 'pending',
       });
 
       render(
@@ -119,102 +120,109 @@ describe('MessageList', () => {
       ).toBeInTheDocument();
     });
 
-    it('does not render approval whose messageId does not match any loaded message', () => {
+    it('does not render completed approvals', () => {
       const message = createMessage({ id: 'msg-2', content: 'Recent message' });
-      const orphanedApproval = createUpdateApproval({
-        _id: 'orphaned-approval' as Id<'approvals'>,
-        messageId: 'msg-evicted',
+      const completedApproval = createUpdateApproval({
+        _id: 'completed-ap' as Id<'approvals'>,
+        messageId: 'msg-2',
+        status: 'completed',
       });
 
       render(
         <MessageList
           {...defaultProps}
           displayMessages={[message]}
-          workflowUpdateApprovals={[orphanedApproval]}
+          workflowUpdateApprovals={[completedApproval]}
           workflowCreationApprovals={[]}
         />,
       );
 
       expect(
-        screen.queryByTestId('update-approval-orphaned-approval'),
+        screen.queryByTestId('update-approval-completed-ap'),
       ).not.toBeInTheDocument();
     });
 
-    it('does not render approval without a messageId', () => {
+    it('does not render rejected approvals', () => {
       const message = createMessage({ id: 'msg-3' });
-      const noMessageIdApproval = createUpdateApproval({
-        _id: 'no-mid-approval' as Id<'approvals'>,
-        messageId: undefined,
+      const rejectedApproval = createUpdateApproval({
+        _id: 'rejected-ap' as Id<'approvals'>,
+        messageId: 'msg-3',
+        status: 'rejected',
       });
 
       render(
         <MessageList
           {...defaultProps}
           displayMessages={[message]}
-          workflowUpdateApprovals={[noMessageIdApproval]}
+          workflowUpdateApprovals={[rejectedApproval]}
           workflowCreationApprovals={[]}
         />,
       );
 
       expect(
-        screen.queryByTestId('update-approval-no-mid-approval'),
+        screen.queryByTestId('update-approval-rejected-ap'),
       ).not.toBeInTheDocument();
     });
 
-    it('renders multiple approvals on the same message', () => {
+    it('shows only the latest pending approval when multiple exist', () => {
       const message = createMessage({ id: 'msg-4' });
-      const approval1 = createUpdateApproval({
+      const olderApproval = createUpdateApproval({
         _id: 'ap-1' as Id<'approvals'>,
         messageId: 'msg-4',
+        status: 'pending',
+        _creationTime: 1000,
       });
-      const approval2 = createCreationApproval({
+      const newerApproval = createCreationApproval({
         _id: 'ap-2' as Id<'approvals'>,
         messageId: 'msg-4',
+        status: 'pending',
+        _creationTime: 2000,
       });
 
       render(
         <MessageList
           {...defaultProps}
           displayMessages={[message]}
-          workflowUpdateApprovals={[approval1]}
-          workflowCreationApprovals={[approval2]}
+          workflowUpdateApprovals={[olderApproval]}
+          workflowCreationApprovals={[newerApproval]}
         />,
       );
 
-      expect(screen.getByTestId('update-approval-ap-1')).toBeInTheDocument();
+      // Only the latest (ap-2) should be shown
       expect(screen.getByTestId('creation-approval-ap-2')).toBeInTheDocument();
+      expect(
+        screen.queryByTestId('update-approval-ap-1'),
+      ).not.toBeInTheDocument();
     });
 
-    it('does not render orphaned approvals at the bottom when messages are evicted from pagination', () => {
-      const loadedMessage = createMessage({
-        id: 'msg-recent',
-        content: 'Recent',
-      });
-      const evictedApproval = createUpdateApproval({
-        _id: 'evicted-ap' as Id<'approvals'>,
-        messageId: 'msg-old-evicted',
-        status: 'rejected',
+    it('shows only the latest active approval when multiple pending exist across types', () => {
+      const message = createMessage({ id: 'msg-5' });
+      const olderPending = createUpdateApproval({
+        _id: 'older-ap' as Id<'approvals'>,
+        status: 'pending',
+        _creationTime: 1000,
       });
-      const linkedApproval = createUpdateApproval({
-        _id: 'linked-ap' as Id<'approvals'>,
-        messageId: 'msg-recent',
+      const newerPending = createUpdateApproval({
+        _id: 'newer-ap' as Id<'approvals'>,
         status: 'pending',
+        _creationTime: 2000,
       });
 
       render(
         <MessageList
           {...defaultProps}
-          displayMessages={[loadedMessage]}
-          workflowUpdateApprovals={[evictedApproval, linkedApproval]}
+          displayMessages={[message]}
+          workflowUpdateApprovals={[olderPending, newerPending]}
           workflowCreationApprovals={[]}
         />,
       );
 
+      // Only the latest (newer-ap) should render
       expect(
-        screen.getByTestId('update-approval-linked-ap'),
+        screen.getByTestId('update-approval-newer-ap'),
       ).toBeInTheDocument();
       expect(
-        screen.queryByTestId('update-approval-evicted-ap'),
+        screen.queryByTestId('update-approval-older-ap'),
       ).not.toBeInTheDocument();
     });
   });
diff --git a/services/platform/app/features/automations/components/automation-assistant/message-list.tsx b/services/platform/app/features/automations/components/automation-assistant/message-list.tsx
index 4f8d81cde..a62207c99 100644
--- a/services/platform/app/features/automations/components/automation-assistant/message-list.tsx
+++ b/services/platform/app/features/automations/components/automation-assistant/message-list.tsx
@@ -2,7 +2,7 @@
 
 import { AnimatePresence } from 'framer-motion';
 import { Bot, LoaderCircle } from 'lucide-react';
-import { Fragment, useMemo } from 'react';
+import { useMemo } from 'react';
 import ReactMarkdown from 'react-markdown';
 import remarkGfm from 'remark-gfm';
 
@@ -25,7 +25,7 @@ import type { Message } from './types';
 import { AutomationDetailsCollapse } from './automation-details-collapse';
 import { ThinkingAnimation } from './thinking-animation';
 
-type ApprovalItem =
+type ActiveApprovalItem =
   | { type: 'workflow_update'; data: WorkflowUpdateApproval }
   | { type: 'workflow_creation'; data: WorkflowCreationApproval };
 
@@ -52,34 +52,26 @@ export function MessageList({
 }: MessageListProps) {
   const { t } = useT('automations');
 
-  const messageIds = useMemo(
-    () => new Set(displayMessages.map((m) => m.id)),
-    [displayMessages],
-  );
-
-  const approvalsByMessageId = useMemo(() => {
-    const byMessageId = new Map<string, ApprovalItem[]>();
-
-    const allApprovals: ApprovalItem[] = [
-      ...workflowUpdateApprovals.map(
-        (a): ApprovalItem => ({ type: 'workflow_update', data: a }),
-      ),
-      ...workflowCreationApprovals.map(
-        (a): ApprovalItem => ({ type: 'workflow_creation', data: a }),
-      ),
-    ];
+  // Find the latest active (pending/executing) approval
+  const activeApproval = useMemo((): ActiveApprovalItem | null => {
+    const candidates: ActiveApprovalItem[] = [];
 
-    for (const item of allApprovals) {
-      const mid = item.data.messageId;
-      if (mid && messageIds.has(mid)) {
-        const list = byMessageId.get(mid) ?? [];
-        list.push(item);
-        byMessageId.set(mid, list);
+    for (const a of workflowUpdateApprovals) {
+      if (a.status === 'pending' || a.status === 'executing') {
+        candidates.push({ type: 'workflow_update', data: a });
+      }
+    }
+    for (const a of workflowCreationApprovals) {
+      if (a.status === 'pending' || a.status === 'executing') {
+        candidates.push({ type: 'workflow_creation', data: a });
       }
     }
 
-    return byMessageId;
-  }, [workflowUpdateApprovals, workflowCreationApprovals, messageIds]);
+    if (candidates.length === 0) return null;
+
+    candidates.sort((a, b) => b.data._creationTime - a.data._creationTime);
+    return candidates[0];
+  }, [workflowUpdateApprovals, workflowCreationApprovals]);
 
   if (displayMessages.length === 0) {
     return (
@@ -112,134 +104,105 @@ export function MessageList({
   return (
     <>
       {displayMessages.map((message) => (
-        <Fragment key={message.id}>
-          <div
-            className={cn(
-              'flex gap-1',
-              message.role === 'user' ? 'justify-end' : 'justify-start',
+        <div
+          key={message.id}
+          className={cn(
+            'flex gap-1',
+            message.role === 'user' ? 'justify-end' : 'justify-start',
+          )}
+        >
+          <div className="flex max-w-[92.5%] flex-col gap-2">
+            {message.automationContext && (
+              <AutomationDetailsCollapse
+                context={message.automationContext}
+                title={t('assistant.automationDetails')}
+              />
             )}
-          >
-            <div className="flex max-w-[92.5%] flex-col gap-2">
-              {message.automationContext && (
-                <AutomationDetailsCollapse
-                  context={message.automationContext}
-                  title={t('assistant.automationDetails')}
-                />
+            <div
+              className={cn(
+                'rounded-2xl px-4 py-3',
+                message.role === 'user'
+                  ? 'bg-muted text-foreground'
+                  : 'bg-background text-foreground',
               )}
-              <div
-                className={cn(
-                  'rounded-2xl px-4 py-3',
-                  message.role === 'user'
-                    ? 'bg-muted text-foreground'
-                    : 'bg-background text-foreground',
-                )}
-              >
-                {message.fileParts && message.fileParts.length > 0 && (
-                  <div className="mb-2 flex flex-wrap gap-1">
-                    {message.fileParts.map((part, partIndex) =>
-                      part.mediaType.startsWith('image/') ? (
-                        <button
-                          key={partIndex}
-                          type="button"
-                          aria-label={t('assistant.previewImage', {
-                            filename:
-                              part.filename || t('assistant.fallbackImage'),
-                          })}
-                          onClick={() =>
-                            onImagePreview(
-                              part.url,
-                              part.filename || t('assistant.fallbackImage'),
-                            )
-                          }
-                          className="bg-muted focus:ring-ring size-11 cursor-pointer overflow-hidden rounded-lg bg-cover bg-center bg-no-repeat transition-opacity hover:opacity-90 focus:ring-2 focus:ring-offset-2 focus:outline-none"
-                        >
-                          <Image
-                            src={part.url}
-                            alt={part.filename || t('assistant.fallbackImage')}
-                            className="size-full object-cover"
-                            width={44}
-                            height={44}
-                          />
-                        </button>
-                      ) : (
-                        <a
-                          key={partIndex}
-                          href={part.url}
-                          target="_blank"
-                          rel="noopener noreferrer"
-                          className="bg-muted hover:bg-muted/80 flex max-w-[13.5rem] items-center gap-2 rounded-lg px-2 py-1.5 transition-colors"
-                        >
-                          <DocumentIcon fileName={part.filename || 'file'} />
-                          <div className="flex min-w-0 flex-1 flex-col">
-                            <Text as="div" variant="label" truncate>
-                              {part.filename || t('assistant.fallbackFile')}
-                            </Text>
-                          </div>
-                        </a>
-                      ),
-                    )}
-                  </div>
-                )}
-                {message.attachments && message.attachments.length > 0 && (
-                  <div className="mb-2 flex flex-wrap gap-1">
-                    {message.attachments.map((attachment) => (
-                      <FileAttachmentDisplay
-                        key={attachment.fileId}
-                        attachment={attachment}
-                      />
-                    ))}
-                  </div>
-                )}
-                {message.content && (
-                  <div className="text-sm leading-5">
-                    {message.role === 'assistant' ? (
-                      <div className="prose prose-sm dark:prose-invert prose-p:my-0.5 prose-pre:my-1 prose-pre:bg-muted/50 prose-pre:border prose-pre:border-border prose-pre:rounded-md prose-pre:p-2 prose-pre:overflow-x-auto prose-headings:my-1 max-w-none wrap-break-word">
-                        <ReactMarkdown remarkPlugins={[remarkGfm]}>
-                          {message.content}
-                        </ReactMarkdown>
-                      </div>
+            >
+              {message.fileParts && message.fileParts.length > 0 && (
+                <div className="mb-2 flex flex-wrap gap-1">
+                  {message.fileParts.map((part, partIndex) =>
+                    part.mediaType.startsWith('image/') ? (
+                      <button
+                        key={partIndex}
+                        type="button"
+                        aria-label={t('assistant.previewImage', {
+                          filename:
+                            part.filename || t('assistant.fallbackImage'),
+                        })}
+                        onClick={() =>
+                          onImagePreview(
+                            part.url,
+                            part.filename || t('assistant.fallbackImage'),
+                          )
+                        }
+                        className="bg-muted focus:ring-ring size-11 cursor-pointer overflow-hidden rounded-lg bg-cover bg-center bg-no-repeat transition-opacity hover:opacity-90 focus:ring-2 focus:ring-offset-2 focus:outline-none"
+                      >
+                        <Image
+                          src={part.url}
+                          alt={part.filename || t('assistant.fallbackImage')}
+                          className="size-full object-cover"
+                          width={44}
+                          height={44}
+                        />
+                      </button>
                     ) : (
-                      <Text
-                        variant="body-sm"
-                        className="leading-relaxed wrap-break-word whitespace-pre-wrap"
+                      <a
+                        key={partIndex}
+                        href={part.url}
+                        target="_blank"
+                        rel="noopener noreferrer"
+                        className="bg-muted hover:bg-muted/80 flex max-w-[13.5rem] items-center gap-2 rounded-lg px-2 py-1.5 transition-colors"
                       >
+                        <DocumentIcon fileName={part.filename || 'file'} />
+                        <div className="flex min-w-0 flex-1 flex-col">
+                          <Text as="div" variant="label" truncate>
+                            {part.filename || t('assistant.fallbackFile')}
+                          </Text>
+                        </div>
+                      </a>
+                    ),
+                  )}
+                </div>
+              )}
+              {message.attachments && message.attachments.length > 0 && (
+                <div className="mb-2 flex flex-wrap gap-1">
+                  {message.attachments.map((attachment) => (
+                    <FileAttachmentDisplay
+                      key={attachment.fileId}
+                      attachment={attachment}
+                    />
+                  ))}
+                </div>
+              )}
+              {message.content && (
+                <div className="text-sm leading-5">
+                  {message.role === 'assistant' ? (
+                    <div className="prose prose-sm dark:prose-invert prose-p:my-0.5 prose-pre:my-1 prose-pre:bg-muted/50 prose-pre:border prose-pre:border-border prose-pre:rounded-md prose-pre:p-2 prose-pre:overflow-x-auto prose-headings:my-1 max-w-none wrap-break-word">
+                      <ReactMarkdown remarkPlugins={[remarkGfm]}>
                         {message.content}
-                      </Text>
-                    )}
-                  </div>
-                )}
-              </div>
-            </div>
-          </div>
-          {approvalsByMessageId.get(message.id)?.map((item) => (
-            <div
-              key={`approval-${item.data._id}`}
-              className="flex justify-start"
-            >
-              {item.type === 'workflow_update' ? (
-                <WorkflowUpdateApprovalCard
-                  approvalId={item.data._id}
-                  organizationId={organizationId}
-                  status={item.data.status}
-                  metadata={item.data.metadata}
-                  executedAt={item.data.executedAt}
-                  executionError={item.data.executionError}
-                  className="max-w-full"
-                />
-              ) : (
-                <WorkflowCreationApprovalCard
-                  approvalId={item.data._id}
-                  organizationId={organizationId}
-                  status={item.data.status}
-                  metadata={item.data.metadata}
-                  executedAt={item.data.executedAt}
-                  executionError={item.data.executionError}
-                  className="max-w-full"
-                />
+                      </ReactMarkdown>
+                    </div>
+                  ) : (
+                    <Text
+                      variant="body-sm"
+                      className="leading-relaxed wrap-break-word whitespace-pre-wrap"
+                    >
+                      {message.content}
+                    </Text>
+                  )}
+                </div>
               )}
             </div>
-          ))}
-        </Fragment>
+          </div>
+        </div>
       ))}
       <AnimatePresence>
         {(isLoading || isWaitingForResponse) && (
@@ -252,6 +215,33 @@ export function MessageList({
           />
         )}
       </AnimatePresence>
+
+      {/* Single active approval always at the bottom */}
+      {activeApproval && (
+        <div className="flex justify-start">
+          {activeApproval.type === 'workflow_update' ? (
+            <WorkflowUpdateApprovalCard
+              approvalId={activeApproval.data._id}
+              organizationId={organizationId}
+              status={activeApproval.data.status}
+              metadata={activeApproval.data.metadata}
+              executedAt={activeApproval.data.executedAt}
+              executionError={activeApproval.data.executionError}
+              className="max-w-full"
+            />
+          ) : (
+            <WorkflowCreationApprovalCard
+              approvalId={activeApproval.data._id}
+              organizationId={organizationId}
+              status={activeApproval.data.status}
+              metadata={activeApproval.data.metadata}
+              executedAt={activeApproval.data.executedAt}
+              executionError={activeApproval.data.executionError}
+              className="max-w-full"
+            />
+          )}
+        </div>
+      )}
     </>
   );
 }
diff --git a/services/platform/app/features/chat/components/approval-card-renderer.tsx b/services/platform/app/features/chat/components/approval-card-renderer.tsx
new file mode 100644
index 000000000..7c7dee9c1
--- /dev/null
+++ b/services/platform/app/features/chat/components/approval-card-renderer.tsx
@@ -0,0 +1,87 @@
+'use client';
+
+import type { ChatItem } from '../hooks/use-merged-chat-items';
+
+import { DocumentWriteApprovalCard } from './document-write-approval-card';
+import { HumanInputRequestCard } from './human-input-request-card';
+import { IntegrationApprovalCard } from './integration-approval-card';
+import { WorkflowCreationApprovalCard } from './workflow-creation-approval-card';
+import { WorkflowRunApprovalCard } from './workflow-run-approval-card';
+import { WorkflowUpdateApprovalCard } from './workflow-update-approval-card';
+
+interface ApprovalCardRendererProps {
+  item: ChatItem;
+  organizationId: string;
+  onHumanInputResponseSubmitted?: () => void;
+}
+
+export function ApprovalCardRenderer({
+  item,
+  organizationId,
+  onHumanInputResponseSubmitted,
+}: ApprovalCardRendererProps) {
+  if (item.type === 'message') return null;
+
+  return (
+    <div className="flex justify-start">
+      {item.type === 'approval' && (
+        <IntegrationApprovalCard
+          approvalId={item.data._id}
+          organizationId={organizationId}
+          status={item.data.status}
+          metadata={item.data.metadata}
+          executedAt={item.data.executedAt}
+          executionError={item.data.executionError}
+        />
+      )}
+      {item.type === 'workflow_approval' && (
+        <WorkflowCreationApprovalCard
+          approvalId={item.data._id}
+          organizationId={organizationId}
+          status={item.data.status}
+          metadata={item.data.metadata}
+          executedAt={item.data.executedAt}
+          executionError={item.data.executionError}
+        />
+      )}
+      {item.type === 'workflow_update_approval' && (
+        <WorkflowUpdateApprovalCard
+          approvalId={item.data._id}
+          organizationId={organizationId}
+          status={item.data.status}
+          metadata={item.data.metadata}
+          executedAt={item.data.executedAt}
+          executionError={item.data.executionError}
+        />
+      )}
+      {item.type === 'workflow_run_approval' && (
+        <WorkflowRunApprovalCard
+          approvalId={item.data._id}
+          organizationId={organizationId}
+          status={item.data.status}
+          metadata={item.data.metadata}
+          executedAt={item.data.executedAt}
+          executionError={item.data.executionError}
+        />
+      )}
+      {item.type === 'human_input_request' && (
+        <HumanInputRequestCard
+          approvalId={item.data._id}
+          status={item.data.status}
+          metadata={item.data.metadata}
+          onResponseSubmitted={onHumanInputResponseSubmitted}
+        />
+      )}
+      {item.type === 'document_write_approval' && (
+        <DocumentWriteApprovalCard
+          approvalId={item.data._id}
+          organizationId={organizationId}
+          status={item.data.status}
+          metadata={item.data.metadata}
+          executedAt={item.data.executedAt}
+          executionError={item.data.executionError}
+        />
+      )}
+    </div>
+  );
+}
diff --git a/services/platform/app/features/chat/components/chat-interface.tsx b/services/platform/app/features/chat/components/chat-interface.tsx
index 1571256c4..0f5c09520 100644
--- a/services/platform/app/features/chat/components/chat-interface.tsx
+++ b/services/platform/app/features/chat/components/chat-interface.tsx
@@ -2,7 +2,7 @@
 
 import { m, AnimatePresence } from 'framer-motion';
 import { ArrowDown } from 'lucide-react';
-import { useRef, useEffect, useState, useCallback, useMemo } from 'react';
+import { useRef, useEffect, useState, useCallback } from 'react';
 
 import { PanelFooter } from '@/app/components/layout/panel-footer';
 import { FileUpload } from '@/app/components/ui/forms/file-upload';
@@ -142,39 +142,8 @@ export function ChatInterface({
     threadId,
   );
 
-  // Block input when any pending or executing approval exists
-  const hasActiveApproval = useMemo(
-    () =>
-      (integrationApprovals ?? []).some(
-        (a) => a.status === 'pending' || a.status === 'executing',
-      ) ||
-      (workflowCreationApprovals ?? []).some(
-        (a) => a.status === 'pending' || a.status === 'executing',
-      ) ||
-      (workflowUpdateApprovals ?? []).some(
-        (a) => a.status === 'pending' || a.status === 'executing',
-      ) ||
-      (workflowRunApprovals ?? []).some(
-        (a) => a.status === 'pending' || a.status === 'executing',
-      ) ||
-      (humanInputRequests ?? []).some(
-        (a) => a.status === 'pending' || a.status === 'executing',
-      ) ||
-      (documentWriteApprovals ?? []).some(
-        (a) => a.status === 'pending' || a.status === 'executing',
-      ),
-    [
-      integrationApprovals,
-      workflowCreationApprovals,
-      workflowUpdateApprovals,
-      workflowRunApprovals,
-      humanInputRequests,
-      documentWriteApprovals,
-    ],
-  );
-
   // Merge messages with approvals and human input requests
-  const mergedChatItems = useMergedChatItems({
+  const { messages: mergedMessages, activeApproval } = useMergedChatItems({
     messages,
     integrationApprovals,
     workflowCreationApprovals,
@@ -184,6 +153,9 @@ export function ChatInterface({
     documentWriteApprovals,
   });
 
+  // Block input when any pending or executing approval exists
+  const hasActiveApproval = activeApproval !== null;
+
   // Server-derived generation status (reactive Convex subscription)
   const { data: isGenerating } = useConvexQuery(
     api.threads.queries.isThreadGenerating,
@@ -342,7 +314,7 @@ export function ChatInterface({
 
         {showMessages && (
           <ChatMessages
-            items={mergedChatItems}
+            items={mergedMessages}
             threadId={threadId}
             organizationId={organizationId}
             canLoadMore={canLoadMore}
@@ -351,6 +323,7 @@ export function ChatInterface({
             activeMessage={activeMessage}
             isLoading={isLoading}
             aiResponseAreaRef={aiResponseAreaRef}
+            activeApproval={activeApproval}
             onHumanInputResponseSubmitted={handleHumanInputResponseSubmitted}
             onSendFollowUp={handleSendFollowUp}
           />
diff --git a/services/platform/app/features/chat/components/chat-messages.tsx b/services/platform/app/features/chat/components/chat-messages.tsx
index 7d0547320..8a962b9ff 100644
--- a/services/platform/app/features/chat/components/chat-messages.tsx
+++ b/services/platform/app/features/chat/components/chat-messages.tsx
@@ -10,14 +10,9 @@ import { useT } from '@/lib/i18n/client';
 
 import type { ChatItem } from '../hooks/use-merged-chat-items';
 
-import { DocumentWriteApprovalCard } from './document-write-approval-card';
-import { HumanInputRequestCard } from './human-input-request-card';
-import { IntegrationApprovalCard } from './integration-approval-card';
+import { ApprovalCardRenderer } from './approval-card-renderer';
 import { MessageBubble } from './message-bubble';
 import { ThinkingAnimation } from './thinking-animation';
-import { WorkflowCreationApprovalCard } from './workflow-creation-approval-card';
-import { WorkflowRunApprovalCard } from './workflow-run-approval-card';
-import { WorkflowUpdateApprovalCard } from './workflow-update-approval-card';
 
 interface ChatMessagesProps {
   items: ChatItem[];
@@ -29,12 +24,13 @@ interface ChatMessagesProps {
   activeMessage: UIMessage | undefined;
   isLoading: boolean;
   aiResponseAreaRef: RefObject<HTMLDivElement | null>;
+  activeApproval: ChatItem | null;
   onHumanInputResponseSubmitted?: () => void;
   onSendFollowUp?: (message: string) => void;
 }
 
 /**
- * Renders the chat message list with approvals and thinking animation.
+ * Renders the chat message list with a single active approval at the bottom.
  */
 export function ChatMessages({
   items,
@@ -46,6 +42,7 @@ export function ChatMessages({
   activeMessage,
   isLoading,
   aiResponseAreaRef,
+  activeApproval,
   onHumanInputResponseSubmitted,
   onSendFollowUp,
 }: ChatMessagesProps) {
@@ -80,153 +77,59 @@ export function ChatMessages({
         </div>
       )}
 
-      {/* Render merged messages and approvals */}
+      {/* Render messages only (approvals are rendered separately at bottom) */}
       {items.map((item) => {
-        if (item.type === 'message') {
-          const message = item.data;
-
-          // Render human input response as a special system message
-          if (message.isHumanInputResponse && message.role === 'system') {
-            // Parse the response from the message content
-            // Format: "User responded to question \"<question>\": <response>"
-            const match = message.content.match(
-              /^User responded to question "(.*?)": ([\s\S]+)$/,
-            );
-            const response = match?.[2] ?? message.content;
-
-            return (
-              <div key={message.key} className="flex justify-end">
-                <div className="bg-primary/10 text-primary flex items-center gap-2 rounded-full px-4 py-2 text-sm">
-                  <CheckCircle2 className="size-4" />
-                  <span>{response}</span>
-                </div>
-              </div>
-            );
-          }
-
-          const shouldShow =
-            message.role === 'user' ||
-            message.content !== '' ||
-            message.isAborted;
-
-          return shouldShow ? (
-            <MessageBubble
-              key={message.key}
-              message={{
-                ...message,
-                role: message.role === 'user' ? 'user' : 'assistant',
-                threadId: threadId,
-              }}
-              onSendFollowUp={onSendFollowUp}
-            />
-          ) : null;
-        } else if (item.type === 'approval') {
-          const approval = item.data;
-          return (
-            <div
-              key={`approval-${approval._id}`}
-              className="flex justify-start"
-            >
-              <IntegrationApprovalCard
-                approvalId={approval._id}
-                organizationId={organizationId}
-                status={approval.status}
-                metadata={approval.metadata}
-                executedAt={approval.executedAt}
-                executionError={approval.executionError}
-              />
-            </div>
-          );
-        } else if (item.type === 'workflow_approval') {
-          const approval = item.data;
-          return (
-            <div
-              key={`workflow-approval-${approval._id}`}
-              className="flex justify-start"
-            >
-              <WorkflowCreationApprovalCard
-                approvalId={approval._id}
-                organizationId={organizationId}
-                status={approval.status}
-                metadata={approval.metadata}
-                executedAt={approval.executedAt}
-                executionError={approval.executionError}
-              />
-            </div>
-          );
-        } else if (item.type === 'workflow_run_approval') {
-          const approval = item.data;
-          return (
-            <div
-              key={`workflow-run-approval-${approval._id}`}
-              className="flex justify-start"
-            >
-              <WorkflowRunApprovalCard
-                approvalId={approval._id}
-                organizationId={organizationId}
-                status={approval.status}
-                metadata={approval.metadata}
-                executedAt={approval.executedAt}
-                executionError={approval.executionError}
-              />
-            </div>
-          );
-        } else if (item.type === 'workflow_update_approval') {
-          const approval = item.data;
-          return (
-            <div
-              key={`workflow-update-approval-${approval._id}`}
-              className="flex justify-start"
-            >
-              <WorkflowUpdateApprovalCard
-                approvalId={approval._id}
-                organizationId={organizationId}
-                status={approval.status}
-                metadata={approval.metadata}
-                executedAt={approval.executedAt}
-                executionError={approval.executionError}
-              />
-            </div>
-          );
-        } else if (item.type === 'human_input_request') {
-          const request = item.data;
-          return (
-            <div
-              key={`human-input-${request._id}`}
-              className="flex justify-start"
-            >
-              <HumanInputRequestCard
-                approvalId={request._id}
-                status={request.status}
-                metadata={request.metadata}
-                onResponseSubmitted={onHumanInputResponseSubmitted}
-              />
-            </div>
+        if (item.type !== 'message') return null;
+
+        const message = item.data;
+
+        // Render human input response as a special system message
+        if (message.isHumanInputResponse && message.role === 'system') {
+          const match = message.content.match(
+            /^User responded to question "(.*?)": ([\s\S]+)$/,
           );
-        } else if (item.type === 'document_write_approval') {
-          const approval = item.data;
+          const response = match?.[2] ?? message.content;
+
           return (
-            <div
-              key={`document-write-${approval._id}`}
-              className="flex justify-start"
-            >
-              <DocumentWriteApprovalCard
-                approvalId={approval._id}
-                organizationId={organizationId}
-                status={approval.status}
-                metadata={approval.metadata}
-                executedAt={approval.executedAt}
-                executionError={approval.executionError}
-              />
+            <div key={message.key} className="flex justify-end">
+              <div className="bg-primary/10 text-primary flex items-center gap-2 rounded-full px-4 py-2 text-sm">
+                <CheckCircle2 className="size-4" />
+                <span>{response}</span>
+              </div>
             </div>
           );
         }
-        return null;
+
+        const shouldShow =
+          message.role === 'user' ||
+          message.content !== '' ||
+          message.isAborted;
+
+        return shouldShow ? (
+          <MessageBubble
+            key={message.key}
+            message={{
+              ...message,
+              role: message.role === 'user' ? 'user' : 'assistant',
+              threadId: threadId,
+            }}
+            onSendFollowUp={onSendFollowUp}
+          />
+        ) : null;
       })}
 
       <div ref={aiResponseAreaRef}>
         {isLoading && <ThinkingAnimation streamingMessage={activeMessage} />}
       </div>
+
+      {/* Single active approval always at the bottom */}
+      {activeApproval && (
+        <ApprovalCardRenderer
+          item={activeApproval}
+          organizationId={organizationId}
+          onHumanInputResponseSubmitted={onHumanInputResponseSubmitted}
+        />
+      )}
     </div>
   );
 }
diff --git a/services/platform/app/features/chat/components/workflow-update-approval-card.tsx b/services/platform/app/features/chat/components/workflow-update-approval-card.tsx
index 38eae7c9c..080df3b46 100644
--- a/services/platform/app/features/chat/components/workflow-update-approval-card.tsx
+++ b/services/platform/app/features/chat/components/workflow-update-approval-card.tsx
@@ -89,6 +89,19 @@ function WorkflowUpdateApprovalCardComponent({
         2,
       );
     }
+    if (metadata.updateType === 'multi_step_patch') {
+      return JSON.stringify(
+        {
+          steps: metadata.steps?.map((s) => ({
+            stepRecordId: s.stepRecordId,
+            stepName: s.stepName,
+            updates: s.stepUpdates,
+          })),
+        },
+        null,
+        2,
+      );
+    }
     return JSON.stringify(
       {
         stepRecordId: metadata.stepRecordId,
@@ -169,7 +182,9 @@ function WorkflowUpdateApprovalCardComponent({
             <Badge variant="outline" className="mt-0.5 text-[10px]">
               {metadata.updateType === 'full_save'
                 ? 'Update workflow'
-                : 'Update step'}
+                : metadata.updateType === 'multi_step_patch'
+                  ? `Update ${metadata.steps?.length ?? 0} steps`
+                  : 'Update step'}
             </Badge>
           </div>
         </HStack>
@@ -211,7 +226,9 @@ function WorkflowUpdateApprovalCardComponent({
             )}
             {metadata.updateType === 'full_save'
               ? `${metadata.stepsConfig?.length ?? 0} steps`
-              : `Step: ${metadata.stepName ?? 'unknown'}`}
+              : metadata.updateType === 'multi_step_patch'
+                ? `${metadata.steps?.length ?? 0} steps`
+                : `Step: ${metadata.stepName ?? 'unknown'}`}
           </button>
           <Tooltip content={copied ? 'Copied!' : 'Copy configuration'}>
             <button
@@ -261,6 +278,23 @@ function WorkflowUpdateApprovalCardComponent({
             </div>
           )}
 
+        {showDetails &&
+          metadata.updateType === 'multi_step_patch' &&
+          metadata.steps && (
+            <div className="bg-muted/50 space-y-1.5 rounded-md p-2">
+              {metadata.steps.map((step) => (
+                <div key={step.stepRecordId} className="space-y-0.5">
+                  <Text as="div" variant="label" className="text-[11px]">
+                    {step.stepName}
+                  </Text>
+                  <div className="text-muted-foreground pl-2 text-[10px]">
+                    {Object.keys(step.stepUpdates).join(', ')}
+                  </div>
+                </div>
+              ))}
+            </div>
+          )}
+
         {showDetails &&
           metadata.updateType === 'step_patch' &&
           metadata.stepUpdates && (
diff --git a/services/platform/app/features/chat/hooks/__tests__/use-merged-chat-items.test.ts b/services/platform/app/features/chat/hooks/__tests__/use-merged-chat-items.test.ts
new file mode 100644
index 000000000..c9106808c
--- /dev/null
+++ b/services/platform/app/features/chat/hooks/__tests__/use-merged-chat-items.test.ts
@@ -0,0 +1,190 @@
+import { renderHook } from '@testing-library/react';
+import { describe, it, expect } from 'vitest';
+
+import type { ChatItem } from '../use-merged-chat-items';
+import type { ChatMessage } from '../use-message-processing';
+
+import { useMergedChatItems } from '../use-merged-chat-items';
+
+function makeMessage(
+  id: string,
+  creationTime: number,
+  role: 'user' | 'assistant' = 'user',
+): ChatMessage {
+  return {
+    id,
+    key: id,
+    content: `Message ${id}`,
+    role,
+    timestamp: new Date(creationTime),
+    _creationTime: creationTime,
+  };
+}
+
+function makeApproval(
+  id: string,
+  status: 'pending' | 'executing' | 'completed' | 'rejected',
+  messageId: string,
+  creationTime: number,
+) {
+  return {
+    _id: id,
+    status,
+    metadata: {} as never,
+    _creationTime: creationTime,
+    messageId,
+  };
+}
+
+function getApprovalId(item: ChatItem | null): string | undefined {
+  if (!item || item.type === 'message') return undefined;
+  return item.data._id;
+}
+
+function getMessageId(item: ChatItem): string | undefined {
+  if (item.type !== 'message') return undefined;
+  return item.data.id;
+}
+
+const emptyParams = {
+  messages: [],
+  integrationApprovals: undefined,
+  workflowCreationApprovals: undefined,
+  workflowUpdateApprovals: undefined,
+  workflowRunApprovals: undefined,
+  humanInputRequests: undefined,
+  documentWriteApprovals: undefined,
+};
+
+describe('useMergedChatItems', () => {
+  it('returns empty results when no messages or approvals', () => {
+    const { result } = renderHook(() => useMergedChatItems(emptyParams));
+    expect(result.current.messages).toEqual([]);
+    expect(result.current.activeApproval).toBeNull();
+  });
+
+  it('returns messages only when no approvals exist', () => {
+    const msgs = [makeMessage('m1', 1000), makeMessage('m2', 2000)];
+    const { result } = renderHook(() =>
+      useMergedChatItems({ ...emptyParams, messages: msgs }),
+    );
+    expect(result.current.messages).toHaveLength(2);
+    expect(result.current.messages[0].type).toBe('message');
+    expect(result.current.activeApproval).toBeNull();
+  });
+
+  it('extracts a single pending approval as activeApproval', () => {
+    const msgs = [makeMessage('m1', 1000)];
+    const approvals = [makeApproval('a1', 'pending', 'm1', 1500)];
+    const { result } = renderHook(() =>
+      useMergedChatItems({
+        ...emptyParams,
+        messages: msgs,
+        integrationApprovals: approvals as never,
+      }),
+    );
+    expect(result.current.messages).toHaveLength(1);
+    expect(result.current.activeApproval).not.toBeNull();
+    expect(result.current.activeApproval?.type).toBe('approval');
+    expect(getApprovalId(result.current.activeApproval)).toBe('a1');
+  });
+
+  it('extracts executing approval as activeApproval', () => {
+    const msgs = [makeMessage('m1', 1000)];
+    const approvals = [makeApproval('a1', 'executing', 'm1', 1500)];
+    const { result } = renderHook(() =>
+      useMergedChatItems({
+        ...emptyParams,
+        messages: msgs,
+        workflowUpdateApprovals: approvals as never,
+      }),
+    );
+    expect(result.current.activeApproval).not.toBeNull();
+    expect(result.current.activeApproval?.type).toBe(
+      'workflow_update_approval',
+    );
+  });
+
+  it('hides completed approvals entirely', () => {
+    const msgs = [makeMessage('m1', 1000)];
+    const approvals = [makeApproval('a1', 'completed', 'm1', 1500)];
+    const { result } = renderHook(() =>
+      useMergedChatItems({
+        ...emptyParams,
+        messages: msgs,
+        integrationApprovals: approvals as never,
+      }),
+    );
+    expect(result.current.messages).toHaveLength(1);
+    expect(result.current.activeApproval).toBeNull();
+  });
+
+  it('hides rejected approvals entirely', () => {
+    const msgs = [makeMessage('m1', 1000)];
+    const approvals = [makeApproval('a1', 'rejected', 'm1', 1500)];
+    const { result } = renderHook(() =>
+      useMergedChatItems({
+        ...emptyParams,
+        messages: msgs,
+        integrationApprovals: approvals as never,
+      }),
+    );
+    expect(result.current.activeApproval).toBeNull();
+  });
+
+  it('picks the latest pending approval when multiple exist', () => {
+    const msgs = [makeMessage('m1', 1000), makeMessage('m2', 2000)];
+    const integrationApprovals = [makeApproval('a1', 'pending', 'm1', 1500)];
+    const workflowApprovals = [makeApproval('a2', 'pending', 'm2', 2500)];
+    const { result } = renderHook(() =>
+      useMergedChatItems({
+        ...emptyParams,
+        messages: msgs,
+        integrationApprovals: integrationApprovals as never,
+        workflowCreationApprovals: workflowApprovals as never,
+      }),
+    );
+    expect(result.current.activeApproval).not.toBeNull();
+    expect(getApprovalId(result.current.activeApproval)).toBe('a2');
+  });
+
+  it('ignores approvals with no matching messageId', () => {
+    const msgs = [makeMessage('m1', 1000)];
+    const approvals = [makeApproval('a1', 'pending', 'nonexistent', 1500)];
+    const { result } = renderHook(() =>
+      useMergedChatItems({
+        ...emptyParams,
+        messages: msgs,
+        integrationApprovals: approvals as never,
+      }),
+    );
+    expect(result.current.activeApproval).toBeNull();
+  });
+
+  it('filters completed and picks active from mixed statuses', () => {
+    const msgs = [makeMessage('m1', 1000)];
+    const approvals = [
+      makeApproval('a1', 'completed', 'm1', 1500),
+      makeApproval('a2', 'pending', 'm1', 2000),
+      makeApproval('a3', 'rejected', 'm1', 2500),
+    ];
+    const { result } = renderHook(() =>
+      useMergedChatItems({
+        ...emptyParams,
+        messages: msgs,
+        integrationApprovals: approvals as never,
+      }),
+    );
+    expect(result.current.activeApproval).not.toBeNull();
+    expect(getApprovalId(result.current.activeApproval)).toBe('a2');
+  });
+
+  it('sorts messages chronologically', () => {
+    const msgs = [makeMessage('m2', 2000), makeMessage('m1', 1000)];
+    const { result } = renderHook(() =>
+      useMergedChatItems({ ...emptyParams, messages: msgs }),
+    );
+    expect(getMessageId(result.current.messages[0])).toBe('m1');
+    expect(getMessageId(result.current.messages[1])).toBe('m2');
+  });
+});
diff --git a/services/platform/app/features/chat/hooks/queries.ts b/services/platform/app/features/chat/hooks/queries.ts
index 6eee6689c..f491b48b3 100644
--- a/services/platform/app/features/chat/hooks/queries.ts
+++ b/services/platform/app/features/chat/hooks/queries.ts
@@ -115,9 +115,9 @@ export function useThreadMessages(threadId: string | null) {
   return results;
 }
 
-function useApprovals(organizationId: string) {
+function useActiveApprovals(organizationId: string) {
   const { data, isLoading } = useConvexQuery(
-    api.approvals.queries.listApprovalsByOrganization,
+    api.approvals.queries.listActiveApprovalsByOrganization,
     { organizationId },
   );
 
@@ -139,7 +139,7 @@ export function useHumanInputRequests(
   organizationId: string,
   threadId: string | undefined,
 ) {
-  const { approvals, isLoading } = useApprovals(organizationId);
+  const { approvals, isLoading } = useActiveApprovals(organizationId);
 
   const humanInputRequests = useMemo((): HumanInputRequest[] => {
     if (!approvals || !threadId) return [];
@@ -195,7 +195,7 @@ export function useIntegrationApprovals(
   organizationId: string,
   threadId: string | undefined,
 ) {
-  const { approvals, isLoading } = useApprovals(organizationId);
+  const { approvals, isLoading } = useActiveApprovals(organizationId);
 
   const integrationApprovals = useMemo((): IntegrationApproval[] => {
     if (!approvals || !threadId) return [];
@@ -238,7 +238,7 @@ export function useWorkflowCreationApprovals(
   organizationId: string,
   threadId: string | undefined,
 ) {
-  const { approvals, isLoading } = useApprovals(organizationId);
+  const { approvals, isLoading } = useActiveApprovals(organizationId);
 
   const workflowCreationApprovals = useMemo((): WorkflowCreationApproval[] => {
     if (!approvals || !threadId) return [];
@@ -281,7 +281,7 @@ export function useWorkflowRunApprovals(
   organizationId: string,
   threadId: string | undefined,
 ) {
-  const { approvals, isLoading } = useApprovals(organizationId);
+  const { approvals, isLoading } = useActiveApprovals(organizationId);
 
   const workflowRunApprovals = useMemo((): WorkflowRunApproval[] => {
     if (!approvals || !threadId) return [];
@@ -324,7 +324,7 @@ export function useWorkflowUpdateApprovals(
   organizationId: string,
   threadId: string | undefined,
 ) {
-  const { approvals, isLoading } = useApprovals(organizationId);
+  const { approvals, isLoading } = useActiveApprovals(organizationId);
 
   const workflowUpdateApprovals = useMemo((): WorkflowUpdateApproval[] => {
     if (!approvals || !threadId) return [];
@@ -367,7 +367,7 @@ export function useDocumentWriteApprovals(
   organizationId: string,
   threadId: string | undefined,
 ) {
-  const { approvals, isLoading } = useApprovals(organizationId);
+  const { approvals, isLoading } = useActiveApprovals(organizationId);
 
   const documentWriteApprovals = useMemo((): DocumentWriteApproval[] => {
     if (!approvals || !threadId) return [];
diff --git a/services/platform/app/features/chat/hooks/use-merged-chat-items.ts b/services/platform/app/features/chat/hooks/use-merged-chat-items.ts
index a7b81a01f..bf78c8590 100644
--- a/services/platform/app/features/chat/hooks/use-merged-chat-items.ts
+++ b/services/platform/app/features/chat/hooks/use-merged-chat-items.ts
@@ -19,6 +19,8 @@ export type ChatItem =
   | { type: 'human_input_request'; data: HumanInputRequest }
   | { type: 'document_write_approval'; data: DocumentWriteApproval };
 
+type ApprovalChatItem = Exclude<ChatItem, { type: 'message' }>;
+
 interface UseMergedChatItemsParams {
   messages: ChatMessage[];
   integrationApprovals: IntegrationApproval[] | undefined;
@@ -29,9 +31,19 @@ interface UseMergedChatItemsParams {
   documentWriteApprovals: DocumentWriteApproval[] | undefined;
 }
 
+export interface MergedChatItemsResult {
+  messages: ChatItem[];
+  activeApproval: ChatItem | null;
+}
+
+function isActiveStatus(status: string) {
+  return status === 'pending' || status === 'executing';
+}
+
 /**
- * Hook to merge messages with approvals in chronological order.
- * Positions approvals right after their associated message.
+ * Hook to merge messages with approvals.
+ * Messages are returned chronologically.
+ * Only the latest active (pending/executing) approval is returned separately — completed/rejected are hidden.
  */
 export function useMergedChatItems({
   messages,
@@ -41,123 +53,95 @@ export function useMergedChatItems({
   workflowRunApprovals,
   humanInputRequests,
   documentWriteApprovals,
-}: UseMergedChatItemsParams): ChatItem[] {
-  return useMemo((): ChatItem[] => {
-    const items: ChatItem[] = [];
-
-    // Build maps for filtering and positioning approvals
+}: UseMergedChatItemsParams): MergedChatItemsResult {
+  return useMemo((): MergedChatItemsResult => {
+    // Build message items
     const loadedMessageIds = new Set<string>();
-    const messageTimeMap = new Map<string, number>();
     for (const message of messages || []) {
       loadedMessageIds.add(message.id);
-      const time = message._creationTime || message.timestamp.getTime();
-      messageTimeMap.set(message.id, time);
     }
 
-    // Add messages
-    for (const message of messages || []) {
-      items.push({ type: 'message', data: message });
-    }
-
-    // Filter and add integration approvals
-    const filteredIntegrationApprovals = (integrationApprovals || []).filter(
-      (approval) => {
-        if (!approval.messageId) return false;
-        return loadedMessageIds.has(approval.messageId);
-      },
-    );
+    const messageItems: ChatItem[] = (messages || []).map((message) => ({
+      type: 'message' as const,
+      data: message,
+    }));
+
+    // Sort messages chronologically
+    messageItems.sort((a, b) => {
+      if (a.type !== 'message' || b.type !== 'message') return 0;
+      const aTime = a.data._creationTime ?? a.data.timestamp.getTime();
+      const bTime = b.data._creationTime ?? b.data.timestamp.getTime();
+      return aTime - bTime;
+    });
 
-    for (const approval of filteredIntegrationApprovals) {
-      items.push({ type: 'approval', data: approval });
+    // Collect active approvals (pending/executing only, linked to loaded messages)
+    const activeApprovals: ApprovalChatItem[] = [];
+
+    for (const a of integrationApprovals ?? []) {
+      if (
+        a.messageId &&
+        loadedMessageIds.has(a.messageId) &&
+        isActiveStatus(a.status)
+      ) {
+        activeApprovals.push({ type: 'approval', data: a });
+      }
     }
-
-    // Filter and add workflow creation approvals
-    const filteredWorkflowApprovals = (workflowCreationApprovals || []).filter(
-      (approval) => {
-        if (!approval.messageId) return false;
-        return loadedMessageIds.has(approval.messageId);
-      },
-    );
-
-    for (const approval of filteredWorkflowApprovals) {
-      items.push({ type: 'workflow_approval', data: approval });
+    for (const a of workflowCreationApprovals ?? []) {
+      if (
+        a.messageId &&
+        loadedMessageIds.has(a.messageId) &&
+        isActiveStatus(a.status)
+      ) {
+        activeApprovals.push({ type: 'workflow_approval', data: a });
+      }
     }
-
-    // Filter and add workflow update approvals
-    const filteredWorkflowUpdateApprovals = (
-      workflowUpdateApprovals || []
-    ).filter((approval) => {
-      if (!approval.messageId) return false;
-      return loadedMessageIds.has(approval.messageId);
-    });
-
-    for (const approval of filteredWorkflowUpdateApprovals) {
-      items.push({ type: 'workflow_update_approval', data: approval });
+    for (const a of workflowUpdateApprovals ?? []) {
+      if (
+        a.messageId &&
+        loadedMessageIds.has(a.messageId) &&
+        isActiveStatus(a.status)
+      ) {
+        activeApprovals.push({ type: 'workflow_update_approval', data: a });
+      }
     }
-
-    // Filter and add workflow run approvals
-    const filteredWorkflowRunApprovals = (workflowRunApprovals || []).filter(
-      (approval) => {
-        if (!approval.messageId) return false;
-        return loadedMessageIds.has(approval.messageId);
-      },
-    );
-
-    for (const approval of filteredWorkflowRunApprovals) {
-      items.push({ type: 'workflow_run_approval', data: approval });
+    for (const a of workflowRunApprovals ?? []) {
+      if (
+        a.messageId &&
+        loadedMessageIds.has(a.messageId) &&
+        isActiveStatus(a.status)
+      ) {
+        activeApprovals.push({ type: 'workflow_run_approval', data: a });
+      }
     }
-
-    // Filter and add human input requests
-    const filteredHumanInputRequests = (humanInputRequests || []).filter(
-      (request) => {
-        if (!request.messageId) return false;
-        return loadedMessageIds.has(request.messageId);
-      },
-    );
-
-    for (const request of filteredHumanInputRequests) {
-      items.push({ type: 'human_input_request', data: request });
+    for (const a of humanInputRequests ?? []) {
+      if (
+        a.messageId &&
+        loadedMessageIds.has(a.messageId) &&
+        isActiveStatus(a.status)
+      ) {
+        activeApprovals.push({ type: 'human_input_request', data: a });
+      }
     }
-
-    // Filter and add document write approvals
-    const filteredDocumentWriteApprovals = (
-      documentWriteApprovals || []
-    ).filter((approval) => {
-      if (!approval.messageId) return false;
-      return loadedMessageIds.has(approval.messageId);
-    });
-
-    for (const approval of filteredDocumentWriteApprovals) {
-      items.push({ type: 'document_write_approval', data: approval });
+    for (const a of documentWriteApprovals ?? []) {
+      if (
+        a.messageId &&
+        loadedMessageIds.has(a.messageId) &&
+        isActiveStatus(a.status)
+      ) {
+        activeApprovals.push({ type: 'document_write_approval', data: a });
+      }
     }
 
-    // Sort items chronologically with approvals after their messages
-    items.sort((a, b) => {
-      const getItemSortKey = (item: ChatItem): number => {
-        if (item.type === 'message') {
-          return item.data._creationTime || item.data.timestamp.getTime();
-        }
-        const approval = item.data;
-        const messageTime = approval.messageId
-          ? messageTimeMap.get(approval.messageId)
-          : undefined;
-        if (messageTime !== undefined) {
-          // Use different offsets to maintain consistent ordering
-          let offset = 0.1;
-          if (item.type === 'workflow_approval') offset = 0.11;
-          if (item.type === 'workflow_update_approval') offset = 0.112;
-          if (item.type === 'workflow_run_approval') offset = 0.115;
-          if (item.type === 'human_input_request') offset = 0.12;
-          if (item.type === 'document_write_approval') offset = 0.125;
-          return messageTime + offset;
-        }
-        return approval._creationTime;
-      };
-
-      return getItemSortKey(a) - getItemSortKey(b);
-    });
+    // Pick the latest active approval by creation time
+    let activeApproval: ChatItem | null = null;
+    if (activeApprovals.length > 0) {
+      activeApprovals.sort(
+        (a, b) => b.data._creationTime - a.data._creationTime,
+      );
+      activeApproval = activeApprovals[0];
+    }
 
-    return items;
+    return { messages: messageItems, activeApproval };
   }, [
     messages,
     integrationApprovals,
diff --git a/services/platform/app/features/custom-agents/components/test-chat-panel.tsx b/services/platform/app/features/custom-agents/components/test-chat-panel.tsx
index ccfc7b221..f01d118e5 100644
--- a/services/platform/app/features/custom-agents/components/test-chat-panel.tsx
+++ b/services/platform/app/features/custom-agents/components/test-chat-panel.tsx
@@ -32,6 +32,7 @@ function TestChatPanelContent({
 
   const {
     displayItems,
+    activeApproval,
     isLoading,
     isUploading,
     threadId,
@@ -90,6 +91,7 @@ function TestChatPanelContent({
         <div className="flex flex-1 flex-col space-y-2.5 p-3">
           <TestMessageList
             displayItems={displayItems}
+            activeApproval={activeApproval}
             isLoading={isLoading}
             activeMessage={activeMessage}
             organizationId={organizationId}
diff --git a/services/platform/app/features/custom-agents/components/test-chat-panel/test-message-list.tsx b/services/platform/app/features/custom-agents/components/test-chat-panel/test-message-list.tsx
index 75e5d103d..a02a53776 100644
--- a/services/platform/app/features/custom-agents/components/test-chat-panel/test-message-list.tsx
+++ b/services/platform/app/features/custom-agents/components/test-chat-panel/test-message-list.tsx
@@ -9,17 +9,12 @@ import remarkGfm from 'remark-gfm';
 import type { ChatItem } from '@/app/features/chat/hooks/use-merged-chat-items';
 
 import { Text } from '@/app/components/ui/typography/text';
-import { DocumentWriteApprovalCard } from '@/app/features/chat/components/document-write-approval-card';
-import { HumanInputRequestCard } from '@/app/features/chat/components/human-input-request-card';
-import { IntegrationApprovalCard } from '@/app/features/chat/components/integration-approval-card';
+import { ApprovalCardRenderer } from '@/app/features/chat/components/approval-card-renderer';
 import {
   FileAttachmentDisplay,
   FilePartDisplay,
 } from '@/app/features/chat/components/message-bubble/file-displays';
 import { ThinkingAnimation } from '@/app/features/chat/components/thinking-animation';
-import { WorkflowCreationApprovalCard } from '@/app/features/chat/components/workflow-creation-approval-card';
-import { WorkflowRunApprovalCard } from '@/app/features/chat/components/workflow-run-approval-card';
-import { WorkflowUpdateApprovalCard } from '@/app/features/chat/components/workflow-update-approval-card';
 import { useT } from '@/lib/i18n/client';
 import { cn } from '@/lib/utils/cn';
 
@@ -27,6 +22,7 @@ import { AssistantMessageInfo } from './assistant-message-info';
 
 interface TestMessageListProps {
   displayItems: ChatItem[];
+  activeApproval: ChatItem | null;
   isLoading: boolean;
   activeMessage?: UIMessage;
   organizationId: string;
@@ -34,6 +30,7 @@ interface TestMessageListProps {
 
 export function TestMessageList({
   displayItems,
+  activeApproval,
   isLoading,
   activeMessage,
   organizationId,
@@ -58,110 +55,7 @@ export function TestMessageList({
   return (
     <>
       {displayItems.map((item) => {
-        if (item.type === 'approval') {
-          return (
-            <div
-              key={`approval-${item.data._id}`}
-              className="flex justify-start"
-            >
-              <IntegrationApprovalCard
-                approvalId={item.data._id}
-                organizationId={organizationId}
-                status={item.data.status}
-                metadata={item.data.metadata}
-                executedAt={item.data.executedAt}
-                executionError={item.data.executionError}
-              />
-            </div>
-          );
-        }
-
-        if (item.type === 'workflow_approval') {
-          return (
-            <div
-              key={`workflow-approval-${item.data._id}`}
-              className="flex justify-start"
-            >
-              <WorkflowCreationApprovalCard
-                approvalId={item.data._id}
-                organizationId={organizationId}
-                status={item.data.status}
-                metadata={item.data.metadata}
-                executedAt={item.data.executedAt}
-                executionError={item.data.executionError}
-              />
-            </div>
-          );
-        }
-
-        if (item.type === 'workflow_run_approval') {
-          return (
-            <div
-              key={`workflow-run-approval-${item.data._id}`}
-              className="flex justify-start"
-            >
-              <WorkflowRunApprovalCard
-                approvalId={item.data._id}
-                organizationId={organizationId}
-                status={item.data.status}
-                metadata={item.data.metadata}
-                executedAt={item.data.executedAt}
-                executionError={item.data.executionError}
-              />
-            </div>
-          );
-        }
-
-        if (item.type === 'workflow_update_approval') {
-          return (
-            <div
-              key={`workflow-update-approval-${item.data._id}`}
-              className="flex justify-start"
-            >
-              <WorkflowUpdateApprovalCard
-                approvalId={item.data._id}
-                organizationId={organizationId}
-                status={item.data.status}
-                metadata={item.data.metadata}
-                executedAt={item.data.executedAt}
-                executionError={item.data.executionError}
-              />
-            </div>
-          );
-        }
-
-        if (item.type === 'human_input_request') {
-          return (
-            <div
-              key={`human-input-${item.data._id}`}
-              className="flex justify-start"
-            >
-              <HumanInputRequestCard
-                approvalId={item.data._id}
-                status={item.data.status}
-                metadata={item.data.metadata}
-              />
-            </div>
-          );
-        }
-
-        if (item.type === 'document_write_approval') {
-          return (
-            <div
-              key={`document-write-${item.data._id}`}
-              className="flex justify-start"
-            >
-              <DocumentWriteApprovalCard
-                approvalId={item.data._id}
-                organizationId={organizationId}
-                status={item.data.status}
-                metadata={item.data.metadata}
-                executedAt={item.data.executedAt}
-                executionError={item.data.executionError}
-              />
-            </div>
-          );
-        }
+        if (item.type !== 'message') return null;
 
         const message = item.data;
         return (
@@ -229,6 +123,14 @@ export function TestMessageList({
         );
       })}
       {isLoading && <ThinkingAnimation streamingMessage={activeMessage} />}
+
+      {/* Single active approval always at the bottom */}
+      {activeApproval && (
+        <ApprovalCardRenderer
+          item={activeApproval}
+          organizationId={organizationId}
+        />
+      )}
     </>
   );
 }
diff --git a/services/platform/app/features/custom-agents/hooks/use-test-chat.ts b/services/platform/app/features/custom-agents/hooks/use-test-chat.ts
index af559f865..80aa8424d 100644
--- a/services/platform/app/features/custom-agents/hooks/use-test-chat.ts
+++ b/services/platform/app/features/custom-agents/hooks/use-test-chat.ts
@@ -184,7 +184,7 @@ export function useTestChat({
 
   const isUploading = uploadingFiles.length > 0;
 
-  const mergedItems = useMergedChatItems({
+  const { messages: mergedMessages, activeApproval } = useMergedChatItems({
     messages,
     integrationApprovals,
     workflowCreationApprovals,
@@ -195,14 +195,14 @@ export function useTestChat({
   });
 
   useEffect(() => {
-    if (mergedItems.length === 0) return;
+    if (mergedMessages.length === 0) return;
     const rafId = requestAnimationFrame(() => {
       if (containerRef.current) {
         throttledScrollToBottom(containerRef.current, 'auto');
       }
     });
     return () => cancelAnimationFrame(rafId);
-  }, [mergedItems.length, isLoading, throttledScrollToBottom]);
+  }, [mergedMessages.length, isLoading, throttledScrollToBottom]);
 
   useEffect(() => {
     return cleanup;
@@ -363,7 +363,8 @@ export function useTestChat({
   }, [threadId, deleteChatThread, clearChatState, onReset]);
 
   return {
-    displayItems: mergedItems,
+    displayItems: mergedMessages,
+    activeApproval,
     isLoading,
     isUploading,
     threadId,
diff --git a/services/platform/convex/_generated/api.d.ts b/services/platform/convex/_generated/api.d.ts
index 504a00a2d..034d7091f 100644
--- a/services/platform/convex/_generated/api.d.ts
+++ b/services/platform/convex/_generated/api.d.ts
@@ -681,6 +681,7 @@ import type * as workflow_engine_helpers_nodes_llm_extract_json_from_text from "
 import type * as workflow_engine_helpers_nodes_llm_types from "../workflow_engine/helpers/nodes/llm/types.js";
 import type * as workflow_engine_helpers_nodes_llm_types_workflow_termination from "../workflow_engine/helpers/nodes/llm/types/workflow_termination.js";
 import type * as workflow_engine_helpers_nodes_llm_utils_build_agent_steps_summary from "../workflow_engine/helpers/nodes/llm/utils/build_agent_steps_summary.js";
+import type * as workflow_engine_helpers_nodes_llm_utils_build_human_input_context from "../workflow_engine/helpers/nodes/llm/utils/build_human_input_context.js";
 import type * as workflow_engine_helpers_nodes_llm_utils_create_llm_result from "../workflow_engine/helpers/nodes/llm/utils/create_llm_result.js";
 import type * as workflow_engine_helpers_nodes_llm_utils_extract_tool_diagnostics from "../workflow_engine/helpers/nodes/llm/utils/extract_tool_diagnostics.js";
 import type * as workflow_engine_helpers_nodes_llm_utils_process_agent_result from "../workflow_engine/helpers/nodes/llm/utils/process_agent_result.js";
@@ -1540,6 +1541,7 @@ declare const fullApi: ApiFromModules<{
   "workflow_engine/helpers/nodes/llm/types": typeof workflow_engine_helpers_nodes_llm_types;
   "workflow_engine/helpers/nodes/llm/types/workflow_termination": typeof workflow_engine_helpers_nodes_llm_types_workflow_termination;
   "workflow_engine/helpers/nodes/llm/utils/build_agent_steps_summary": typeof workflow_engine_helpers_nodes_llm_utils_build_agent_steps_summary;
+  "workflow_engine/helpers/nodes/llm/utils/build_human_input_context": typeof workflow_engine_helpers_nodes_llm_utils_build_human_input_context;
   "workflow_engine/helpers/nodes/llm/utils/create_llm_result": typeof workflow_engine_helpers_nodes_llm_utils_create_llm_result;
   "workflow_engine/helpers/nodes/llm/utils/extract_tool_diagnostics": typeof workflow_engine_helpers_nodes_llm_utils_extract_tool_diagnostics;
   "workflow_engine/helpers/nodes/llm/utils/process_agent_result": typeof workflow_engine_helpers_nodes_llm_utils_process_agent_result;
diff --git a/services/platform/convex/agent_tools/workflows/internal_actions.ts b/services/platform/convex/agent_tools/workflows/internal_actions.ts
index 4049d012a..218316af9 100644
--- a/services/platform/convex/agent_tools/workflows/internal_actions.ts
+++ b/services/platform/convex/agent_tools/workflows/internal_actions.ts
@@ -391,6 +391,32 @@ export const executeApprovedWorkflowUpdate = internalAction({
             `Step "${metadata.stepName ?? metadata.stepRecordId}" not found — it may have been deleted`,
           );
         }
+      } else if (metadata.updateType === 'multi_step_patch') {
+        if (!metadata.steps || metadata.steps.length === 0) {
+          throw new Error(
+            'Invalid approval metadata: missing steps array for multi-step patch',
+          );
+        }
+
+        const results = await ctx.runMutation(
+          internal.wf_step_defs.internal_mutations.batchPatchSteps,
+          {
+            stepPatches: metadata.steps.map((s) => ({
+              stepRecordId: toId<'wfStepDefs'>(s.stepRecordId),
+              updates: s.stepUpdates,
+            })),
+          },
+        );
+
+        if (results.some((r) => r === null)) {
+          const missing = metadata.steps
+            .filter((_, i) => results[i] === null)
+            .map((s) => `"${s.stepName}"`)
+            .join(', ');
+          throw new Error(
+            `Steps ${missing} not found — they may have been deleted`,
+          );
+        }
       } else {
         throw new Error(`Unknown update type: ${String(metadata.updateType)}`);
       }
@@ -411,7 +437,9 @@ export const executeApprovedWorkflowUpdate = internalAction({
           const updateDetail =
             metadata.updateType === 'full_save'
               ? `All steps replaced (${metadata.stepsConfig?.length ?? 0} steps)`
-              : `Step "${metadata.stepName ?? 'unknown'}" updated`;
+              : metadata.updateType === 'multi_step_patch'
+                ? `${metadata.steps?.length ?? 0} steps updated: ${metadata.steps?.map((s) => `"${s.stepName}"`).join(', ')}`
+                : `Step "${metadata.stepName ?? 'unknown'}" updated`;
 
           const messageContent = `[WORKFLOW_UPDATED]
 The user has approved the workflow update request.
diff --git a/services/platform/convex/agent_tools/workflows/internal_mutations.ts b/services/platform/convex/agent_tools/workflows/internal_mutations.ts
index 8af2a956f..310424dce 100644
--- a/services/platform/convex/agent_tools/workflows/internal_mutations.ts
+++ b/services/platform/convex/agent_tools/workflows/internal_mutations.ts
@@ -412,6 +412,52 @@ export const createWorkflowStepUpdateApproval = internalMutation({
   },
 });
 
+export const createBatchWorkflowStepUpdateApproval = internalMutation({
+  args: {
+    organizationId: v.string(),
+    workflowId: v.id('wfDefinitions'),
+    workflowName: v.string(),
+    workflowVersionNumber: v.number(),
+    updateSummary: v.string(),
+    steps: v.array(
+      v.object({
+        stepRecordId: v.id('wfStepDefs'),
+        stepName: v.string(),
+        stepUpdates: jsonRecordValidator,
+      }),
+    ),
+    threadId: v.optional(v.string()),
+    messageId: v.optional(v.string()),
+  },
+  handler: async (ctx, args): Promise<Id<'approvals'>> => {
+    const metadata: WorkflowUpdateMetadata = {
+      updateType: 'multi_step_patch',
+      updateSummary: args.updateSummary,
+      workflowId: args.workflowId,
+      workflowName: args.workflowName,
+      workflowVersionNumber: args.workflowVersionNumber,
+      steps: args.steps.map((s) => ({
+        stepRecordId: s.stepRecordId,
+        stepName: s.stepName,
+        stepUpdates: Object.fromEntries(Object.entries(s.stepUpdates)),
+      })),
+      requestedAt: Date.now(),
+    };
+
+    const stepNames = args.steps.map((s) => `"${s.stepName}"`).join(', ');
+    return await createApproval(ctx, {
+      organizationId: args.organizationId,
+      resourceType: 'workflow_update',
+      resourceId: `workflow_update:${args.workflowId}:batch:${Date.now()}`,
+      priority: 'high',
+      description: `Update ${args.steps.length} steps (${stepNames}) in workflow "${args.workflowName}" — ${args.updateSummary}`,
+      threadId: args.threadId,
+      messageId: args.messageId,
+      metadata,
+    });
+  },
+});
+
 export const updateWorkflowUpdateApprovalWithResult = internalMutation({
   args: {
     approvalId: v.id('approvals'),
diff --git a/services/platform/convex/agent_tools/workflows/update_workflow_step_tool.ts b/services/platform/convex/agent_tools/workflows/update_workflow_step_tool.ts
index cdc597e00..23d0cfe90 100644
--- a/services/platform/convex/agent_tools/workflows/update_workflow_step_tool.ts
+++ b/services/platform/convex/agent_tools/workflows/update_workflow_step_tool.ts
@@ -1,8 +1,9 @@
 /**
  * Convex Tool: Update Workflow Step
  *
- * Updates an existing workflow step with built-in validation.
+ * Updates one or more workflow steps with built-in validation.
  * Requires user approval before changes are applied.
+ * Supports both single-step and batch updates.
  */
 
 import { createTool } from '@convex-dev/agent';
@@ -22,19 +23,187 @@ import {
 
 const debugLog = createDebugLog('DEBUG_AGENT_TOOLS', '[AgentTools]');
 
+const stepUpdatesSchema = z.object({
+  name: z.string().optional().describe('New step name'),
+  stepType: z
+    .enum(['start', 'llm', 'action', 'condition', 'loop'])
+    .optional()
+    .describe(
+      'New step type. Options: start (workflow entry point, optional inputSchema), llm (AI agent with tools), action (database/API operations), condition (branching logic), loop (iterate over collections)',
+    ),
+  config: z
+    .any()
+    .optional()
+    .describe(
+      'Updated config object. Must include ALL required fields for the step type.',
+    ),
+  nextSteps: z
+    .any()
+    .optional()
+    .describe(
+      'Updated next step connections. IMPORTANT: This is a TOP-LEVEL field in updates, NOT inside config! Keys are outcomes (e.g., "success", "failure", "true", "false"), values are stepSlugs to execute next. Example: { success: "send_email", failure: "log_error" }',
+    ),
+});
+
+/**
+ * Sanitize and repair malformed JSON from LLM output.
+ * Handles corrupted field names with control characters or excessive lengths.
+ */
+function sanitizeUpdates<T>(updates: T): T {
+  // Deep clone and re-parse to ensure clean JSON structure
+  const jsonStr = JSON.stringify(updates);
+  let sanitized: T = JSON.parse(jsonStr);
+
+  // Generic preserves input type — structural shape is maintained by key repair
+  const repairObject = <U>(obj: U): U => {
+    if (!obj || typeof obj !== 'object') {
+      return obj;
+    }
+
+    // Handle arrays by recursively repairing each element
+    if (Array.isArray(obj)) {
+      // oxlint-disable-next-line typescript/no-unsafe-type-assertion -- generic T preserves structural shape through array repair
+      return obj.map((item) => repairObject(item)) as U;
+    }
+
+    const repaired: Record<string, unknown> = {};
+    for (const [key, value] of Object.entries(
+      // oxlint-disable-next-line typescript/no-unsafe-type-assertion -- iterating Convex document fields; structural shape is Record<string, unknown>
+      obj as Record<string, unknown>,
+    )) {
+      let repairedKey = key;
+
+      // If key contains newlines or is too descriptive, try to extract the actual field name
+      // biome-ignore lint/suspicious/noControlCharactersInRegex: Intentionally matching control characters to detect and repair corrupted field names
+      if (/[\x00-\x1F\x7F]/.test(key) || key.length > 50) {
+        // Try to extract common field names from descriptive keys
+        const fieldNameMatch = key.match(
+          /^(config|userPrompt|systemPrompt|name|parameters|type|nextSteps|stepType)/i,
+        );
+        if (fieldNameMatch) {
+          // Normalize to proper camelCase
+          const lowerKey = fieldNameMatch[1].toLowerCase();
+          const camelCaseMap: Record<string, string> = {
+            userprompt: 'userPrompt',
+            systemprompt: 'systemPrompt',
+            nextsteps: 'nextSteps',
+            steptype: 'stepType',
+          };
+          repairedKey = camelCaseMap[lowerKey] ?? lowerKey;
+          debugLog('Repaired field name', {
+            original: key.slice(0, 50),
+            repaired: repairedKey,
+          });
+        } else {
+          // Can't repair this key, leave it as-is for validation to catch
+          repairedKey = key;
+        }
+      }
+
+      repaired[repairedKey] =
+        typeof value === 'object' && value !== null
+          ? repairObject(value)
+          : value;
+    }
+    // oxlint-disable-next-line typescript/no-unsafe-type-assertion -- generic T preserves structural shape through key repair
+    return repaired as U;
+  };
+
+  sanitized = repairObject(sanitized);
+
+  // Validate: check for extremely long field names and invalid characters
+  const validateObject = (obj: unknown, path = ''): void => {
+    if (!obj || typeof obj !== 'object') return;
+
+    // Handle arrays by recursively validating each element
+    if (Array.isArray(obj)) {
+      obj.forEach((item, index) => validateObject(item, `${path}[${index}]`));
+      return;
+    }
+
+    for (const [key, value] of Object.entries(obj)) {
+      // biome-ignore lint/suspicious/noControlCharactersInRegex: Intentionally matching control characters to reject them
+      const hasControlChars = /[\x00-\x1F\x7F]/.test(key);
+      if (hasControlChars) {
+        const escapedKey = JSON.stringify(key).slice(1, -1);
+        throw new Error(
+          `Invalid field name contains control characters: "${escapedKey.slice(0, 50)}${escapedKey.length > 50 ? '...' : ''}". Field names cannot contain newlines, tabs, or other control characters. This indicates malformed JSON from the LLM.`,
+        );
+      }
+
+      if (key.length > 100) {
+        throw new Error(
+          `Invalid field name detected (length: ${key.length}). This usually indicates malformed JSON from the LLM. Field path: ${path}.${key.slice(0, 50)}...`,
+        );
+      }
+
+      if (typeof value === 'object' && value !== null) {
+        validateObject(value, path ? `${path}.${key}` : key);
+      }
+    }
+  };
+
+  validateObject(sanitized);
+  return sanitized;
+}
+
+function validateStepUpdates(updates: {
+  name?: string;
+  stepType?: string;
+  config?: unknown;
+}): { errors: string[]; warnings: string[] } {
+  const errors: string[] = [];
+  const warnings: string[] = [];
+
+  if (updates.stepType && updates.config) {
+    const stepValidation = validateStepConfig({
+      stepSlug: 'update',
+      name: updates.name ?? 'Step',
+      stepType: updates.stepType,
+      config: updates.config,
+    });
+
+    if (!stepValidation.valid) {
+      errors.push(...stepValidation.errors);
+    }
+    if (stepValidation.warnings) {
+      warnings.push(...stepValidation.warnings);
+    }
+
+    const config = isRecord(updates.config) ? updates.config : undefined;
+    if (
+      updates.stepType === 'action' &&
+      config &&
+      'type' in config &&
+      typeof config.type === 'string'
+    ) {
+      const actionType = config.type;
+      if (isValidStepType(actionType)) {
+        warnings.push(
+          `Action type "${actionType}" matches a stepType name. Did you mean stepType: "${actionType}"?`,
+        );
+      }
+    }
+  }
+
+  return { errors, warnings };
+}
+
 export const updateWorkflowStepTool = {
   name: 'update_workflow_step' as const,
   tool: createTool({
-    description: `Update an existing workflow step configuration.
-Requires user approval — an approval card will be created for the user to review and confirm.
+    description: `Update one or more workflow steps. Requires user approval — an approval card will be created.
+
+**SINGLE STEP:**
+{ stepRecordId: "...", updates: { stepType: "...", config: {...}, nextSteps: {...} }, updateSummary: "..." }
+
+**BATCH (multiple steps in same workflow):**
+{ steps: [{ stepRecordId: "...", updates: {...} }, ...], updateSummary: "..." }
 
 **REQUIRED STEPS:**
-1. Call workflow_read(operation='get_step', stepId='...') to get current config
+1. Call workflow_read(operation='get_step', stepId='...') to get current config for each step
 2. Modify config based on current values (keep ALL required fields)
-3. Call this tool with stepRecordId, updates, and updateSummary
-
-**STRUCTURE:**
-{ stepRecordId: "...", updates: { stepType: "...", config: {...}, nextSteps: {...} }, updateSummary: "..." }
+3. Call this tool with the updates
 
 **APPROVAL:**
 When this tool returns { requiresApproval: true }, do NOT call this tool again.
@@ -42,34 +211,30 @@ Inform the user the update is ready for review in the chat UI.`,
     args: z.object({
       stepRecordId: z
         .string()
-        .describe('The step record ID (Convex Id<"wfStepDefs">)'),
-      updates: z
-        .object({
-          name: z.string().optional().describe('New step name'),
-          stepType: z
-            .enum(['start', 'llm', 'action', 'condition', 'loop'])
-            .optional()
-            .describe(
-              'New step type. Options: start (workflow entry point, optional inputSchema), llm (AI agent with tools), action (database/API operations), condition (branching logic), loop (iterate over collections)',
-            ),
-          config: z
-            .any()
-            .optional()
-            .describe(
-              'Updated config object. Must include ALL required fields for the step type.',
-            ),
-          nextSteps: z
-            .any()
-            .optional()
-            .describe(
-              'Updated next step connections. IMPORTANT: This is a TOP-LEVEL field in updates, NOT inside config! Keys are outcomes (e.g., "success", "failure", "true", "false"), values are stepSlugs to execute next. Example: { success: "send_email", failure: "log_error" }',
-            ),
-        })
-        .describe('Fields to update'),
+        .optional()
+        .describe(
+          'The step record ID for single-step update. Omit when using batch mode.',
+        ),
+      updates: stepUpdatesSchema
+        .optional()
+        .describe('Fields to update for single-step mode.'),
+      steps: z
+        .array(
+          z.object({
+            stepRecordId: z
+              .string()
+              .describe('The step record ID (Convex Id<"wfStepDefs">)'),
+            updates: stepUpdatesSchema.describe('Fields to update'),
+          }),
+        )
+        .optional()
+        .describe(
+          'Array of steps to update in batch mode. All steps must belong to the same workflow.',
+        ),
       updateSummary: z
         .string()
         .describe(
-          'Markdown-formatted summary of changes. Use bullet points for multiple changes. Example:\n- Updated email template with dynamic subject line\n- Changed recipient to use contact lookup',
+          'Markdown-formatted summary of changes. Use bullet points for multiple changes.',
         ),
     }),
     handler: async (
@@ -86,11 +251,6 @@ Inform the user the update is ready for review in the chat UI.`,
       validationErrors?: string[];
       validationWarnings?: string[];
     }> => {
-      debugLog('update_workflow_step tool called', {
-        stepRecordId: args.stepRecordId,
-        updates: args.updates,
-      });
-
       const { organizationId, threadId: currentThreadId, messageId } = ctx;
 
       if (!organizationId) {
@@ -104,231 +264,201 @@ Inform the user the update is ready for review in the chat UI.`,
 
       const threadId = await getApprovalThreadId(ctx, currentThreadId);
 
-      // Sanitize args.updates to prevent malformed JSON structures
-      // This handles cases where LLM generates corrupted JSON with field values merged into field names
-      let sanitizedUpdates = args.updates;
-      try {
-        // Deep clone and re-parse to ensure clean JSON structure
-        const jsonStr = JSON.stringify(args.updates);
-        sanitizedUpdates = JSON.parse(jsonStr);
-
-        // Attempt to repair common corruption patterns
-        // Pattern: Field names that look like descriptions instead of identifiers
-        // Generic preserves input type — structural shape is maintained by key repair
-        const repairObject = <T>(obj: T): T => {
-          if (!obj || typeof obj !== 'object') {
-            return obj;
-          }
-
-          // Handle arrays by recursively repairing each element
-          if (Array.isArray(obj)) {
-            // oxlint-disable-next-line typescript/no-unsafe-type-assertion -- generic T preserves structural shape through array repair
-            return obj.map((item) => repairObject(item)) as T;
-          }
-
-          const repaired: Record<string, unknown> = {};
-          for (const [key, value] of Object.entries(
-            // oxlint-disable-next-line typescript/no-unsafe-type-assertion -- iterating Convex document fields; structural shape is Record<string, unknown>
-            obj as Record<string, unknown>,
-          )) {
-            let repairedKey = key;
-
-            // If key contains newlines or is too descriptive, try to extract the actual field name
-            // biome-ignore lint/suspicious/noControlCharactersInRegex: Intentionally matching control characters to detect and repair corrupted field names
-            if (/[\x00-\x1F\x7F]/.test(key) || key.length > 50) {
-              // Try to extract common field names from descriptive keys
-              const fieldNameMatch = key.match(
-                /^(config|userPrompt|systemPrompt|name|parameters|type|nextSteps|stepType)/i,
-              );
-              if (fieldNameMatch) {
-                // Normalize to proper camelCase
-                const lowerKey = fieldNameMatch[1].toLowerCase();
-                const camelCaseMap: Record<string, string> = {
-                  userprompt: 'userPrompt',
-                  systemprompt: 'systemPrompt',
-                  nextsteps: 'nextSteps',
-                  steptype: 'stepType',
-                };
-                repairedKey = camelCaseMap[lowerKey] ?? lowerKey;
-                debugLog('Repaired field name', {
-                  original: key.slice(0, 50),
-                  repaired: repairedKey,
-                });
-              } else {
-                // Can't repair this key, leave it as-is for validation to catch
-                repairedKey = key;
-              }
-            }
-
-            repaired[repairedKey] =
-              typeof value === 'object' && value !== null
-                ? repairObject(value)
-                : value;
-          }
-          // oxlint-disable-next-line typescript/no-unsafe-type-assertion -- generic T preserves structural shape through key repair
-          return repaired as T;
-        };
+      // Determine mode: batch vs single
+      const isBatch = Array.isArray(args.steps) && args.steps.length > 0;
 
-        sanitizedUpdates = repairObject(sanitizedUpdates);
-
-        // Additional validation: check for extremely long field names and invalid characters
-        const validateObject = (obj: unknown, path = ''): void => {
-          if (!obj || typeof obj !== 'object') return;
-
-          // Handle arrays by recursively validating each element
-          if (Array.isArray(obj)) {
-            obj.forEach((item, index) =>
-              validateObject(item, `${path}[${index}]`),
-            );
-            return;
-          }
-
-          for (const [key, value] of Object.entries(obj)) {
-            // Check for control characters (including newlines, tabs, etc.)
-            // Control characters are ASCII 0-31 and 127
-            // biome-ignore lint/suspicious/noControlCharactersInRegex: Intentionally matching control characters to reject them
-            const hasControlChars = /[\x00-\x1F\x7F]/.test(key);
-            if (hasControlChars) {
-              // Show escaped version to make control chars visible
-              const escapedKey = JSON.stringify(key).slice(1, -1);
-              throw new Error(
-                `Invalid field name contains control characters: "${escapedKey.slice(0, 50)}${escapedKey.length > 50 ? '...' : ''}". Field names cannot contain newlines, tabs, or other control characters. This indicates malformed JSON from the LLM.`,
-              );
-            }
-
-            // Field names should never exceed 100 characters in normal usage
-            if (key.length > 100) {
-              throw new Error(
-                `Invalid field name detected (length: ${key.length}). This usually indicates malformed JSON from the LLM. Field path: ${path}.${key.slice(0, 50)}...`,
-              );
-            }
-
-            // Recursively validate nested objects
-            if (typeof value === 'object' && value !== null) {
-              validateObject(value, path ? `${path}.${key}` : key);
-            }
-          }
+      if (!isBatch && !args.stepRecordId) {
+        return {
+          success: false,
+          message:
+            'Either stepRecordId (single mode) or steps array (batch mode) is required.',
+          step: null,
         };
+      }
 
-        validateObject(sanitizedUpdates);
-      } catch (error) {
-        const errorMsg = error instanceof Error ? error.message : String(error);
-        debugLog('JSON sanitization failed', {
-          error: errorMsg,
-          originalUpdates: args.updates,
-        });
-
+      if (!isBatch && !args.updates) {
         return {
           success: false,
-          message: `Failed to parse tool arguments: ${errorMsg}
-
-IMPORTANT: This error means the tool call JSON is malformed. Common causes:
-1. Field names with newlines or special characters (field names should be simple identifiers like "config", "userPrompt", etc.)
-2. Missing quotes around string values
-3. Unescaped special characters in string values
-
-Please try again with a properly structured JSON object. Ensure all field names are simple identifiers without spaces or special characters.`,
+          message: 'updates is required for single-step mode.',
           step: null,
-          validationErrors: [errorMsg],
         };
       }
 
-      // Validate step config if both stepType and config are available.
-      // When only config is updated without stepType, we skip client-side validation
-      // since validateStepConfig requires stepType. The mutation itself validates
-      // the merged step data with the existing stepType from the database.
-      if (sanitizedUpdates.stepType && sanitizedUpdates.config) {
-        const stepValidation = validateStepConfig({
-          stepSlug: 'update', // Placeholder, actual slug comes from existing step
-          name: sanitizedUpdates.name ?? 'Step',
-          stepType: sanitizedUpdates.stepType,
-          config: sanitizedUpdates.config,
-        });
-
-        const errors: string[] = [];
-        const warnings: string[] = [];
-
-        if (!stepValidation.valid) {
-          errors.push(...stepValidation.errors);
-        }
-        if (stepValidation.warnings) {
-          warnings.push(...stepValidation.warnings);
-        }
-
-        // Additional warning for action type matching stepType
-        const config = isRecord(sanitizedUpdates.config)
-          ? sanitizedUpdates.config
-          : undefined;
-        if (
-          sanitizedUpdates.stepType === 'action' &&
-          config &&
-          'type' in config &&
-          typeof config.type === 'string'
-        ) {
-          const actionType = config.type;
-          if (isValidStepType(actionType)) {
-            warnings.push(
-              `Action type "${actionType}" matches a stepType name. Did you mean stepType: "${actionType}"?`,
-            );
-          }
-        }
-
-        if (errors.length > 0) {
+      // Normalize to array of step entries (guards above ensure values exist)
+      const stepEntries = isBatch
+        ? (args.steps ?? []).map((s) => ({
+            stepRecordId: s.stepRecordId,
+            updates: s.updates,
+          }))
+        : [
+            {
+              stepRecordId: args.stepRecordId ?? '',
+              updates: args.updates ?? {},
+            },
+          ];
+
+      // Sanitize and validate each step's updates
+      const sanitizedEntries: Array<{
+        stepRecordId: string;
+        updates: z.infer<typeof stepUpdatesSchema>;
+      }> = [];
+
+      for (const entry of stepEntries) {
+        try {
+          const sanitized = sanitizeUpdates(entry.updates);
+          sanitizedEntries.push({
+            stepRecordId: entry.stepRecordId,
+            updates: sanitized,
+          });
+        } catch (error) {
+          const errorMsg =
+            error instanceof Error ? error.message : String(error);
           return {
             success: false,
-            message: `Step validation failed with ${errors.length} error(s). Fix the errors and try again.`,
+            message: `Failed to parse tool arguments for step "${entry.stepRecordId}": ${errorMsg}\n\nPlease try again with properly structured JSON.`,
             step: null,
-            validationErrors: errors,
-            validationWarnings: warnings.length > 0 ? warnings : undefined,
+            validationErrors: [errorMsg],
           };
         }
       }
 
-      // Look up the step and its parent workflow for the approval card
-      const stepInfo = await ctx.runQuery(
-        internal.wf_step_defs.internal_queries.getStepWithWorkflowInfo,
-        { stepId: toId<'wfStepDefs'>(args.stepRecordId) },
-      );
+      // Validate step configs
+      const allErrors: string[] = [];
+      const allWarnings: string[] = [];
+      for (const entry of sanitizedEntries) {
+        const { errors, warnings } = validateStepUpdates(entry.updates);
+        allErrors.push(...errors);
+        allWarnings.push(...warnings);
+      }
 
-      if (!stepInfo) {
+      if (allErrors.length > 0) {
         return {
           success: false,
-          message: `Step "${args.stepRecordId}" not found or its parent workflow was deleted.`,
+          message: `Step validation failed with ${allErrors.length} error(s). Fix the errors and try again.`,
           step: null,
+          validationErrors: allErrors,
+          validationWarnings: allWarnings.length > 0 ? allWarnings : undefined,
         };
       }
 
-      try {
-        const approvalId = await ctx.runMutation(
-          internal.agent_tools.workflows.internal_mutations
-            .createWorkflowStepUpdateApproval,
-          {
-            organizationId,
-            workflowId: stepInfo.workflowId,
-            workflowName: stepInfo.workflowName,
-            workflowVersionNumber: stepInfo.workflowVersionNumber,
-            updateSummary: args.updateSummary,
-            stepRecordId: toId<'wfStepDefs'>(args.stepRecordId),
-            stepName: stepInfo.step.name,
-            stepUpdates: sanitizedUpdates,
-            threadId,
-            messageId,
-          },
+      // Look up all steps and verify they belong to the same workflow
+      const stepInfos = await Promise.all(
+        sanitizedEntries.map(async (entry) => {
+          const info = await ctx.runQuery(
+            internal.wf_step_defs.internal_queries.getStepWithWorkflowInfo,
+            { stepId: toId<'wfStepDefs'>(entry.stepRecordId) },
+          );
+          return { entry, info };
+        }),
+      );
+
+      // Check all steps exist and build verified list
+      const verifiedSteps: Array<{
+        entry: (typeof sanitizedEntries)[number];
+        info: NonNullable<(typeof stepInfos)[number]['info']>;
+      }> = [];
+
+      for (const { entry, info } of stepInfos) {
+        if (!info) {
+          return {
+            success: false,
+            message: `Step "${entry.stepRecordId}" not found or its parent workflow was deleted.`,
+            step: null,
+          };
+        }
+        verifiedSteps.push({ entry, info });
+      }
+
+      // Verify all steps belong to the same workflow (for batch)
+      if (verifiedSteps.length > 1) {
+        const workflowIds = new Set(
+          verifiedSteps.map((s) => s.info.workflowId),
         );
+        if (workflowIds.size > 1) {
+          return {
+            success: false,
+            message:
+              'All steps in a batch update must belong to the same workflow.',
+            step: null,
+          };
+        }
+      }
 
-        debugLog('update_workflow_step approval created', {
-          stepRecordId: args.stepRecordId,
-          approvalId,
-        });
+      const firstInfo = verifiedSteps[0].info;
 
-        return {
-          success: true,
-          requiresApproval: true,
-          approvalId,
-          approvalCreated: true,
-          approvalMessage: `APPROVAL CREATED SUCCESSFULLY: An approval card (ID: ${approvalId}) has been created below your message for updating step "${stepInfo.step.name}" in workflow "${stepInfo.workflowName}". The user must approve this update before changes will be applied.`,
-          message: `Step update for "${stepInfo.step.name}" is ready for approval. An approval card has been created below. Changes will be applied once the user approves it.`,
-        };
+      try {
+        if (isBatch) {
+          // Batch mode: create single approval for all steps
+          const approvalId = await ctx.runMutation(
+            internal.agent_tools.workflows.internal_mutations
+              .createBatchWorkflowStepUpdateApproval,
+            {
+              organizationId,
+              workflowId: firstInfo.workflowId,
+              workflowName: firstInfo.workflowName,
+              workflowVersionNumber: firstInfo.workflowVersionNumber,
+              updateSummary: args.updateSummary,
+              steps: verifiedSteps.map(({ entry, info }) => ({
+                stepRecordId: toId<'wfStepDefs'>(entry.stepRecordId),
+                stepName: info.step.name,
+                stepUpdates: entry.updates,
+              })),
+              threadId,
+              messageId,
+            },
+          );
+
+          debugLog('batch update_workflow_step approval created', {
+            stepCount: verifiedSteps.length,
+            approvalId,
+          });
+
+          const stepNames = verifiedSteps
+            .map(({ info }) => `"${info.step.name}"`)
+            .join(', ');
+
+          return {
+            success: true,
+            requiresApproval: true,
+            approvalId,
+            approvalCreated: true,
+            approvalMessage: `APPROVAL CREATED SUCCESSFULLY: An approval card (ID: ${approvalId}) has been created for updating ${stepInfos.length} steps (${stepNames}) in workflow "${firstInfo.workflowName}".`,
+            message: `Batch step update for ${stepInfos.length} steps is ready for approval. An approval card has been created below.`,
+          };
+        } else {
+          // Single step mode: existing behavior
+          const entry = sanitizedEntries[0];
+          const approvalId = await ctx.runMutation(
+            internal.agent_tools.workflows.internal_mutations
+              .createWorkflowStepUpdateApproval,
+            {
+              organizationId,
+              workflowId: firstInfo.workflowId,
+              workflowName: firstInfo.workflowName,
+              workflowVersionNumber: firstInfo.workflowVersionNumber,
+              updateSummary: args.updateSummary,
+              stepRecordId: toId<'wfStepDefs'>(entry.stepRecordId),
+              stepName: firstInfo.step.name,
+              stepUpdates: entry.updates,
+              threadId,
+              messageId,
+            },
+          );
+
+          debugLog('update_workflow_step approval created', {
+            stepRecordId: entry.stepRecordId,
+            approvalId,
+          });
+
+          return {
+            success: true,
+            requiresApproval: true,
+            approvalId,
+            approvalCreated: true,
+            approvalMessage: `APPROVAL CREATED SUCCESSFULLY: An approval card (ID: ${approvalId}) has been created below your message for updating step "${firstInfo.step.name}" in workflow "${firstInfo.workflowName}". The user must approve this update before changes will be applied.`,
+            message: `Step update for "${firstInfo.step.name}" is ready for approval. An approval card has been created below. Changes will be applied once the user approves it.`,
+          };
+        }
       } catch (error) {
         return {
           success: false,
diff --git a/services/platform/convex/approvals/helpers.ts b/services/platform/convex/approvals/helpers.ts
index d7bc0ac2e..b993c2e34 100644
--- a/services/platform/convex/approvals/helpers.ts
+++ b/services/platform/convex/approvals/helpers.ts
@@ -228,10 +228,47 @@ export async function listApprovalsByOrganization(
   return result;
 }
 
+export async function listActiveApprovalsByOrganization(
+  ctx: QueryCtx,
+  args: { organizationId: string; limit?: number },
+): Promise<Array<ApprovalItem>> {
+  const limit = args.limit ?? 1000;
+  const result: Array<ApprovalItem> = [];
+
+  for (const status of ['pending', 'executing'] as const) {
+    for await (const approval of ctx.db
+      .query('approvals')
+      .withIndex('by_org_status', (q) =>
+        q.eq('organizationId', args.organizationId).eq('status', status),
+      )
+      .order('desc')) {
+      result.push(approval);
+      if (result.length >= limit) break;
+    }
+    if (result.length >= limit) break;
+  }
+
+  result.sort((a, b) => b._creationTime - a._creationTime);
+  return result;
+}
+
 export async function createApproval(
   ctx: MutationCtx,
   args: CreateApprovalArgs,
 ): Promise<Id<'approvals'>> {
+  // Guard: only one active approval per thread
+  if (args.threadId) {
+    for await (const existing of ctx.db
+      .query('approvals')
+      .withIndex('by_threadId', (q) => q.eq('threadId', args.threadId))) {
+      if (existing.status === 'pending' || existing.status === 'executing') {
+        throw new Error(
+          'Cannot create approval: another approval is already pending on this thread. Wait for the existing approval to be resolved before creating a new one.',
+        );
+      }
+    }
+  }
+
   const approvalId = await ctx.db.insert('approvals', {
     organizationId: args.organizationId,
     wfExecutionId: args.wfExecutionId,
diff --git a/services/platform/convex/approvals/queries.ts b/services/platform/convex/approvals/queries.ts
index 3649e30d2..e5dd9f793 100644
--- a/services/platform/convex/approvals/queries.ts
+++ b/services/platform/convex/approvals/queries.ts
@@ -136,6 +136,28 @@ export const listApprovalsByOrganization = query({
   },
 });
 
+export const listActiveApprovalsByOrganization = query({
+  args: {
+    organizationId: v.string(),
+    limit: v.optional(v.number()),
+  },
+  returns: v.array(approvalItemValidator),
+  handler: async (ctx, args) => {
+    const authUser = await getAuthUserIdentity(ctx);
+    if (!authUser) {
+      return [];
+    }
+
+    try {
+      await getOrganizationMember(ctx, args.organizationId, authUser);
+    } catch {
+      return [];
+    }
+
+    return await ApprovalsHelpers.listActiveApprovalsByOrganization(ctx, args);
+  },
+});
+
 export const getPendingIntegrationApprovalsForThread = query({
   args: {
     threadId: v.string(),
diff --git a/services/platform/convex/approvals/types.ts b/services/platform/convex/approvals/types.ts
index d7ebcf04b..508a3a2e9 100644
--- a/services/platform/convex/approvals/types.ts
+++ b/services/platform/convex/approvals/types.ts
@@ -52,8 +52,19 @@ export interface WorkflowCreationMetadata {
   executionError?: string;
 }
 
+export interface StepPatchEntry {
+  stepRecordId: string;
+  stepName: string;
+  stepUpdates: {
+    name?: string;
+    stepType?: string;
+    config?: Record<string, unknown>;
+    nextSteps?: Record<string, string>;
+  };
+}
+
 export interface WorkflowUpdateMetadata {
-  updateType: 'full_save' | 'step_patch';
+  updateType: 'full_save' | 'step_patch' | 'multi_step_patch';
   updateSummary: string;
   workflowId: string;
   workflowName: string;
@@ -80,6 +91,7 @@ export interface WorkflowUpdateMetadata {
     config?: Record<string, unknown>;
     nextSteps?: Record<string, string>;
   };
+  steps?: StepPatchEntry[];
   requestedAt: number;
   executedAt?: number;
   executionError?: string;
diff --git a/services/platform/convex/lib/create_agent_config.ts b/services/platform/convex/lib/create_agent_config.ts
index 749f7b39d..57db0c8a3 100644
--- a/services/platform/convex/lib/create_agent_config.ts
+++ b/services/platform/convex/lib/create_agent_config.ts
@@ -80,9 +80,16 @@ export function createAgentConfig(opts: {
     );
   }
 
-  // Add disambiguation rule for agents with request_human_input tool
+  // Add human input enforcement and disambiguation rules for agents with request_human_input tool
   if (opts.convexToolNames?.includes('request_human_input')) {
     suffixParts.push(`
+**HUMAN INPUT RULE**
+When you need ANY information, confirmation, or decision from the user:
+- You MUST use the request_human_input tool to create an interactive input card
+- NEVER ask questions as plain text in your response — the user cannot reply to text
+- The ONLY way to collect user input is through the request_human_input tool
+- This applies to: clarifications, missing values, confirmations, preferences, follow-up questions
+
 **DISAMBIGUATION RULE**
 When searching for a specific record and finding MULTIPLE matches:
 1. DO NOT proceed with all matches or pick one arbitrarily
diff --git a/services/platform/convex/lib/variables/replace_variables_in_string.ts b/services/platform/convex/lib/variables/replace_variables_in_string.ts
index 5b46d6992..7beb020f6 100644
--- a/services/platform/convex/lib/variables/replace_variables_in_string.ts
+++ b/services/platform/convex/lib/variables/replace_variables_in_string.ts
@@ -35,8 +35,9 @@ export function replaceVariablesInString(
       const evalResult = jexlInstance.evalSync(expression, context);
 
       if (isNil(evalResult)) {
-        // Keep original if evaluation returns null/undefined
-        result += '';
+        // Preserve original template for unresolved variables — allows
+        // downstream processors to substitute them in a later pass.
+        result += `{{${expression}}}`;
       } else if (isString(evalResult)) {
         result += evalResult;
       } else if (isBoolean(evalResult) || isNumber(evalResult)) {
diff --git a/services/platform/convex/wf_executions/mutations.ts b/services/platform/convex/wf_executions/mutations.ts
index bf50a1cfa..d1b158205 100644
--- a/services/platform/convex/wf_executions/mutations.ts
+++ b/services/platform/convex/wf_executions/mutations.ts
@@ -109,7 +109,7 @@ export const cancelExecution = mutationWithRLS({
             threadId: approval.threadId,
             message: {
               role: 'system',
-              content: `[WORKFLOW_CANCELLED]\nThe user manually stopped the running workflow "${execution.workflowSlug ?? 'unknown'}".\n\nInstructions:\n- Acknowledge that the user cancelled the workflow execution\n- Do NOT speculate about technical errors\n- Ask if they would like to try again or take a different approach`,
+              content: `[WORKFLOW_CANCELLED]\nWorkflow "${execution.workflowSlug ?? 'unknown'}" was stopped.`,
             },
           });
         }
diff --git a/services/platform/convex/wf_step_defs/internal_mutations.ts b/services/platform/convex/wf_step_defs/internal_mutations.ts
index 3d51bee17..248829a4b 100644
--- a/services/platform/convex/wf_step_defs/internal_mutations.ts
+++ b/services/platform/convex/wf_step_defs/internal_mutations.ts
@@ -13,3 +13,20 @@ export const patchStep = internalMutation({
     return await updateStepHelper(ctx, args);
   },
 });
+
+export const batchPatchSteps = internalMutation({
+  args: {
+    stepPatches: v.array(
+      v.object({
+        stepRecordId: v.id('wfStepDefs'),
+        updates: jsonRecordValidator,
+      }),
+    ),
+  },
+  handler: async (ctx, args) => {
+    const results = await Promise.all(
+      args.stepPatches.map((patch) => updateStepHelper(ctx, patch)),
+    );
+    return results;
+  },
+});
diff --git a/services/platform/convex/workflow_engine/helpers/engine/execute_step_handler.ts b/services/platform/convex/workflow_engine/helpers/engine/execute_step_handler.ts
index 8346985ba..d18fb1cab 100644
--- a/services/platform/convex/workflow_engine/helpers/engine/execute_step_handler.ts
+++ b/services/platform/convex/workflow_engine/helpers/engine/execute_step_handler.ts
@@ -12,6 +12,7 @@ import { internal } from '../../../_generated/api';
 import { createDebugLog } from '../../../lib/debug_log';
 import { toId } from '../../../lib/type_cast_helpers';
 import { replaceVariables } from '../../../lib/variables/replace_variables';
+import { buildHumanInputContext } from '../nodes/llm/utils/build_human_input_context';
 import { buildStepsMap } from '../step_execution/build_steps_map';
 import { executeStepByType } from '../step_execution/execute_step_by_type';
 import { extractEssentialLoopVariables } from '../step_execution/extract_essential_loop_variables';
@@ -137,9 +138,21 @@ export async function handleExecuteStep(
     });
   }
 
+  // Build humanInputContext for LLM steps so {{humanInputContext}} is available
+  // during config-level variable substitution. This is ephemeral — only used for
+  // replaceVariables, NOT persisted into execution state (see persistExecutionResult).
+  let configVariables = fullVariables;
+  if (args.stepType === 'llm' && args.executionId) {
+    const humanInputContext = await buildHumanInputContext(
+      ctx,
+      args.executionId,
+    );
+    configVariables = { ...fullVariables, humanInputContext };
+  }
+
   const processedConfig = isSetVariablesAction
     ? stepDef.config
-    : replaceVariables(stepDef.config, fullVariables);
+    : replaceVariables(stepDef.config, configVariables);
 
   // Debug: Log after variable replacement for LLM steps
   if (args.stepType === 'llm' && isRecord(processedConfig)) {
diff --git a/services/platform/convex/workflow_engine/helpers/engine/on_workflow_complete.test.ts b/services/platform/convex/workflow_engine/helpers/engine/on_workflow_complete.test.ts
index f104fac3d..0de340cfb 100644
--- a/services/platform/convex/workflow_engine/helpers/engine/on_workflow_complete.test.ts
+++ b/services/platform/convex/workflow_engine/helpers/engine/on_workflow_complete.test.ts
@@ -259,6 +259,40 @@ describe('handleWorkflowComplete', () => {
     expect(typedArgs.messageContent).toContain('step timed out');
   });
 
+  it('does not schedule completion message for canceled workflows', async () => {
+    const exec = {
+      _id: 'exec_1',
+      organizationId: 'org_1',
+      workflowSlug: 'cancelled-workflow',
+      triggerData: { approvalId: 'approval_1', approvedBy: 'user_1' },
+      status: 'running',
+    };
+    const approval = {
+      _id: 'approval_1',
+      threadId: 'thread_1',
+      status: 'executing',
+    };
+    const { ctx, schedulerRunAfterArgs } = createMockCtx({
+      exec,
+      approval,
+    });
+
+    await handleWorkflowComplete(ctx, {
+      workflowId: 'component_wf_1',
+      context: { executionId: 'exec_1' },
+      result: { kind: 'canceled' },
+    });
+
+    // cancelExecution already posts [WORKFLOW_CANCELLED], so no message here
+    const triggerCalls = schedulerRunAfterArgs.filter(
+      ([, , callArgs]) =>
+        callArgs &&
+        typeof callArgs === 'object' &&
+        'messageContent' in callArgs,
+    );
+    expect(triggerCalls.length).toBe(0);
+  });
+
   it('does not schedule response when no approvalId in triggerData', async () => {
     const exec = {
       _id: 'exec_1',
diff --git a/services/platform/convex/workflow_engine/helpers/engine/on_workflow_complete.ts b/services/platform/convex/workflow_engine/helpers/engine/on_workflow_complete.ts
index f4d181ad7..968ab5930 100644
--- a/services/platform/convex/workflow_engine/helpers/engine/on_workflow_complete.ts
+++ b/services/platform/convex/workflow_engine/helpers/engine/on_workflow_complete.ts
@@ -96,7 +96,11 @@ export async function handleWorkflowComplete(
   if (!wasTerminal) {
     // Mark the triggering approval as completed/rejected now that the workflow is done
     await updateTriggeringApprovalStatus(ctx, exec, kind);
-    await postCompletionMessageToThread(ctx, exec, kind, result);
+    // Skip completion message for canceled workflows — cancelExecution
+    // already posts [WORKFLOW_CANCELLED] to the thread
+    if (kind !== 'canceled') {
+      await postCompletionMessageToThread(ctx, exec, kind, result);
+    }
   }
 }
 
diff --git a/services/platform/convex/workflow_engine/helpers/nodes/llm/execute_llm_node.ts b/services/platform/convex/workflow_engine/helpers/nodes/llm/execute_llm_node.ts
index e0ea2adc7..0164304fa 100644
--- a/services/platform/convex/workflow_engine/helpers/nodes/llm/execute_llm_node.ts
+++ b/services/platform/convex/workflow_engine/helpers/nodes/llm/execute_llm_node.ts
@@ -9,9 +9,6 @@ import type { Id } from '../../../../_generated/dataModel';
 import type { ActionCtx } from '../../../../_generated/server';
 import type { StepExecutionResult, LLMNodeConfig } from '../../../types';
 
-import { internal } from '../../../../_generated/api';
-import { createDebugLog } from '../../../../lib/debug_log';
-import { toId } from '../../../../lib/type_cast_helpers';
 // Agent execution
 import { executeAgentWithTools } from './execute_agent_with_tools';
 // Result creation
@@ -20,14 +17,16 @@ import { processPrompts } from './utils/process_prompts';
 // Validation
 import { validateAndNormalizeConfig } from './utils/validate_and_normalize_config';
 
-const debugLog = createDebugLog('DEBUG_WORKFLOW', '[LLMNode]');
-
 // =============================================================================
 // HELPER FUNCTION
 // =============================================================================
 
 /**
  * Execute LLM node logic (helper function)
+ *
+ * Note: humanInputContext is injected into variables by execute_step_handler.ts
+ * before config-level variable substitution. By the time this function receives
+ * the config, {{humanInputContext}} has already been resolved.
  */
 export async function executeLLMNode(
   ctx: ActionCtx,
@@ -41,44 +40,10 @@ export async function executeLLMNode(
   // 1. Validate and normalize configuration
   const normalizedConfig = validateAndNormalizeConfig(config);
 
-  // 2. Build prompt-scoped variables with {{humanInputContext}} support.
-  // We create a shallow copy instead of mutating `variables` because:
-  // - The original `variables` object is persisted to execution state by
-  //   persistExecutionResult() in execute_step_handler.ts after this function returns.
-  // - humanInputContext is an ephemeral, prompt-only value that must be freshly
-  //   computed from the DB on each step execution, not stored in execution state.
-  // - Storing it would cause stale context after human input replay: the persisted
-  //   value from run N would shadow the fresh query result in run N+1.
-  let promptVariables = variables;
-  if (executionId) {
-    const respondedApprovals = await ctx.runQuery(
-      internal.approvals.internal_queries.listRespondedForExecution,
-      { executionId: toId<'wfExecutions'>(executionId) },
-    );
-    const humanInputContext =
-      respondedApprovals.length > 0
-        ? [
-            '<human_input_context>',
-            'The following information was provided by the user during this workflow. Use these values directly — do not re-ask for information already provided.',
-            ...respondedApprovals.map(
-              (a: { question: string; response: string | string[] }) =>
-                `- Q: "${a.question}" → A: "${Array.isArray(a.response) ? a.response.join(', ') : a.response}"`,
-            ),
-            '</human_input_context>',
-          ].join('\n')
-        : '';
-    promptVariables = { ...variables, humanInputContext };
-    if (respondedApprovals.length > 0) {
-      debugLog('Built humanInputContext for prompt variables', {
-        responseCount: respondedApprovals.length,
-      });
-    }
-  }
-
-  // 3. Process prompts with variable substitution
-  const prompts = processPrompts(normalizedConfig, promptVariables);
+  // 2. Process prompts with variable substitution
+  const prompts = processPrompts(normalizedConfig, variables);
 
-  // 4. Execute using Convex agent with tools
+  // 3. Execute using Convex agent with tools
   const llmResult = await executeAgentWithTools(
     ctx,
     normalizedConfig,
@@ -86,13 +51,13 @@ export async function executeLLMNode(
     {
       executionId,
       organizationId,
-      threadId, // Pass shared threadId when reusing conversation context across steps
+      threadId,
       stepSlug,
     },
   );
 
-  // 5. Create and return result
+  // 4. Create and return result
   return createLLMResult(llmResult, normalizedConfig, {
-    threadId: llmResult.threadId, // Return the threadId used
+    threadId: llmResult.threadId,
   });
 }
diff --git a/services/platform/convex/workflow_engine/helpers/nodes/llm/utils/build_human_input_context.ts b/services/platform/convex/workflow_engine/helpers/nodes/llm/utils/build_human_input_context.ts
new file mode 100644
index 000000000..6765a1de4
--- /dev/null
+++ b/services/platform/convex/workflow_engine/helpers/nodes/llm/utils/build_human_input_context.ts
@@ -0,0 +1,38 @@
+/**
+ * Build humanInputContext string from responded approvals for prompt injection.
+ */
+
+import type { Id } from '../../../../../_generated/dataModel';
+import type { ActionCtx } from '../../../../../_generated/server';
+
+import { internal } from '../../../../../_generated/api';
+import { createDebugLog } from '../../../../../lib/debug_log';
+import { toId } from '../../../../../lib/type_cast_helpers';
+
+const debugLog = createDebugLog('DEBUG_WORKFLOW', '[LLMNode]');
+
+export async function buildHumanInputContext(
+  ctx: ActionCtx,
+  executionId: string | Id<'wfExecutions'>,
+): Promise<string> {
+  const respondedApprovals = await ctx.runQuery(
+    internal.approvals.internal_queries.listRespondedForExecution,
+    { executionId: toId<'wfExecutions'>(executionId) },
+  );
+
+  if (respondedApprovals.length === 0) return '';
+
+  debugLog('Built humanInputContext for prompt variables', {
+    responseCount: respondedApprovals.length,
+  });
+
+  return [
+    '<human_input_context>',
+    'The following information was provided by the user during this workflow. Use these values for the EXACT questions listed below — do not re-ask these specific questions. If you need NEW or DIFFERENT information not covered here, you MUST call request_human_input again.',
+    ...respondedApprovals.map(
+      (a: { question: string; response: string | string[] }) =>
+        `- Q: "${a.question}" → A: "${Array.isArray(a.response) ? a.response.join(', ') : a.response}"`,
+    ),
+    '</human_input_context>',
+  ].join('\n');
+}

From 5a8dfbad1b9283af6149065d0cdc494f524aaf66 Mon Sep 17 00:00:00 2001
From: larryro <371767072@qq.com>
Date: Fri, 20 Mar 2026 18:47:57 +0800
Subject: [PATCH 4/9] feat(platform): display system messages as collapsible
 chat items

Show all system messages (approval rejections, workflow cancellations,
etc.) in chat with a compact, expandable UI instead of filtering them
out. Human input response messages continue to render as user bubbles.
---
 .../chat/components/chat-messages.tsx         | 69 +++++++++++++-
 .../__tests__/use-message-processing.test.ts  | 90 +++++++++++++++++++
 .../chat/hooks/use-message-processing.ts      |  6 +-
 3 files changed, 158 insertions(+), 7 deletions(-)

diff --git a/services/platform/app/features/chat/components/chat-messages.tsx b/services/platform/app/features/chat/components/chat-messages.tsx
index 8a962b9ff..aea7c1ffc 100644
--- a/services/platform/app/features/chat/components/chat-messages.tsx
+++ b/services/platform/app/features/chat/components/chat-messages.tsx
@@ -1,12 +1,13 @@
 'use client';
 
 import type { UIMessage } from '@convex-dev/agent/react';
-import type { RefObject } from 'react';
 
-import { Loader2, CheckCircle2 } from 'lucide-react';
+import { Loader2, CheckCircle2, Info, ChevronDown } from 'lucide-react';
+import { memo, type RefObject, useCallback, useState } from 'react';
 
 import { Button } from '@/app/components/ui/primitives/button';
 import { useT } from '@/lib/i18n/client';
+import { cn } from '@/lib/utils/cn';
 
 import type { ChatItem } from '../hooks/use-merged-chat-items';
 
@@ -14,6 +15,61 @@ import { ApprovalCardRenderer } from './approval-card-renderer';
 import { MessageBubble } from './message-bubble';
 import { ThinkingAnimation } from './thinking-animation';
 
+const PREVIEW_LENGTH = 80;
+
+const CollapsibleSystemMessage = memo(function CollapsibleSystemMessage({
+  content,
+}: {
+  content: string;
+}) {
+  const [expanded, setExpanded] = useState(false);
+  const toggle = useCallback(() => setExpanded((prev) => !prev), []);
+
+  const lines = content.split('\n');
+  const nonEmptyLines = lines.filter((l) => l.trim() !== '');
+  const previewLines = nonEmptyLines.slice(0, 2);
+  const preview = previewLines.join(' ');
+  const lastPreviewIdx =
+    previewLines.length > 0
+      ? lines.indexOf(previewLines[previewLines.length - 1]!)
+      : 0;
+  const rest = lines
+    .slice(lastPreviewIdx + 1)
+    .join('\n')
+    .trimStart();
+  const hasMore = rest.length > 0;
+
+  return (
+    <div className="py-1" role="status">
+      <div className="bg-muted/50 text-muted-foreground overflow-hidden rounded-lg text-xs">
+        <button
+          type="button"
+          className="flex w-full items-start gap-2 px-3 py-1.5"
+          onClick={toggle}
+          disabled={!hasMore}
+          aria-expanded={expanded}
+        >
+          <Info className="mt-0.5 size-3.5 shrink-0" />
+          <span className="min-w-0 flex-1 text-left">{preview}</span>
+          {hasMore && (
+            <ChevronDown
+              className={cn(
+                'mt-0.5 ml-auto size-3.5 shrink-0 transition-transform',
+                expanded && 'rotate-180',
+              )}
+            />
+          )}
+        </button>
+        {expanded && (
+          <div className="border-muted max-h-60 overflow-y-auto border-t px-3 py-2 whitespace-pre-wrap">
+            {rest}
+          </div>
+        )}
+      </div>
+    </div>
+  );
+});
+
 interface ChatMessagesProps {
   items: ChatItem[];
   threadId: string | undefined;
@@ -100,6 +156,15 @@ export function ChatMessages({
           );
         }
 
+        if (message.role === 'system' && !message.isHumanInputResponse) {
+          return (
+            <CollapsibleSystemMessage
+              key={message.key}
+              content={message.content}
+            />
+          );
+        }
+
         const shouldShow =
           message.role === 'user' ||
           message.content !== '' ||
diff --git a/services/platform/app/features/chat/hooks/__tests__/use-message-processing.test.ts b/services/platform/app/features/chat/hooks/__tests__/use-message-processing.test.ts
index d0c7678e3..21cfe583e 100644
--- a/services/platform/app/features/chat/hooks/__tests__/use-message-processing.test.ts
+++ b/services/platform/app/features/chat/hooks/__tests__/use-message-processing.test.ts
@@ -680,6 +680,96 @@ describe('useMessageProcessing', () => {
     });
   });
 
+  describe('system messages', () => {
+    it('includes system messages in the output', () => {
+      mockUseUIMessages.mockReturnValue({
+        results: [
+          createUIMessage({
+            id: 'msg-1',
+            order: 0,
+            role: 'user',
+            text: 'Hi',
+          }),
+          createUIMessage({
+            id: 'msg-2',
+            order: 1,
+            role: 'system',
+            text: '[APPROVAL_REJECTED]\nThe user rejected the request.',
+            status: 'success',
+          }),
+          createUIMessage({
+            id: 'msg-3',
+            order: 2,
+            role: 'assistant',
+            text: 'Understood.',
+            status: 'success',
+          }),
+        ],
+        loadMore: mockLoadMore,
+        status: 'Exhausted',
+      } as unknown as ReturnType<typeof useUIMessages>);
+
+      const { result } = renderHook(() => useMessageProcessing('thread-1'));
+      const systemMsg = result.current.messages.find((m) => m.key === 'msg-2');
+      expect(systemMsg).toBeDefined();
+      expect(systemMsg?.role).toBe('system');
+      expect(systemMsg?.content).toContain('[APPROVAL_REJECTED]');
+    });
+
+    it('marks human input response system messages', () => {
+      mockUseUIMessages.mockReturnValue({
+        results: [
+          createUIMessage({
+            id: 'msg-1',
+            order: 0,
+            role: 'user',
+            text: 'Hi',
+          }),
+          createUIMessage({
+            id: 'msg-2',
+            order: 1,
+            role: 'system',
+            text: 'User responded to question "Confirm?": Yes',
+            status: 'success',
+          }),
+        ],
+        loadMore: mockLoadMore,
+        status: 'Exhausted',
+      } as unknown as ReturnType<typeof useUIMessages>);
+
+      const { result } = renderHook(() => useMessageProcessing('thread-1'));
+      const systemMsg = result.current.messages.find((m) => m.key === 'msg-2');
+      expect(systemMsg?.isHumanInputResponse).toBe(true);
+    });
+
+    it('includes workflow cancelled system messages', () => {
+      mockUseUIMessages.mockReturnValue({
+        results: [
+          createUIMessage({
+            id: 'msg-1',
+            order: 0,
+            role: 'user',
+            text: 'Run workflow',
+          }),
+          createUIMessage({
+            id: 'msg-2',
+            order: 1,
+            role: 'system',
+            text: '[WORKFLOW_CANCELLED]\nWorkflow "test" was stopped.',
+            status: 'success',
+          }),
+        ],
+        loadMore: mockLoadMore,
+        status: 'Exhausted',
+      } as unknown as ReturnType<typeof useUIMessages>);
+
+      const { result } = renderHook(() => useMessageProcessing('thread-1'));
+      const systemMsg = result.current.messages.find((m) => m.key === 'msg-2');
+      expect(systemMsg).toBeDefined();
+      expect(systemMsg?.role).toBe('system');
+    });
+  });
+
   describe('stripInternalFileReferences', () => {
     it('removes the attached files marker', () => {
       const input =
diff --git a/services/platform/app/features/chat/hooks/use-message-processing.ts b/services/platform/app/features/chat/hooks/use-message-processing.ts
index ac24c9484..9cee681a2 100644
--- a/services/platform/app/features/chat/hooks/use-message-processing.ts
+++ b/services/platform/app/features/chat/hooks/use-message-processing.ts
@@ -175,11 +175,7 @@ export function useMessageProcessing(
         if (m.role === 'assistant') {
           return m.order >= minUserOrder;
         }
-        // Keep system messages that are human input responses
-        if (
-          m.role === 'system' &&
-          m.text?.startsWith(HUMAN_INPUT_RESPONSE_PREFIX)
-        ) {
+        if (m.role === 'system') {
           return true;
         }
         return false;

From 7c9b97c655a09ca3cb7edfb1c71497e08a04d4fc Mon Sep 17 00:00:00 2001
From: larryro <371767072@qq.com>
Date: Fri, 20 Mar 2026 19:21:43 +0800
Subject: [PATCH 5/9] feat(platform): i18n approval cards, accessibility
 improvements, and atomic execution claims

Extract hardcoded strings into translation keys across all approval and
human input cards with a shared approvalCommon namespace. Add ARIA roles
and attributes to message lists and interactive form elements. Replace
read-then-check idempotency guards with an atomic claimWorkflowApprovalForExecution
mutation to prevent race conditions. Fix approval queries to only swallow
UnauthorizedError instead of all exceptions. Escape HTML entities in human
input context to prevent LLM injection.
---
 .../automation-assistant/message-list.tsx     |  8 ++-
 .../document-write-approval-card.tsx          |  9 ++-
 .../components/human-input-request-card.tsx   | 37 +++++++---
 .../components/integration-approval-card.tsx  | 11 ++-
 .../workflow-creation-approval-card.tsx       | 43 ++++++------
 .../components/workflow-run-approval-card.tsx | 31 ++++++---
 .../workflow-update-approval-card.tsx         | 49 +++++++------
 .../test-chat-panel/test-message-list.tsx     |  8 ++-
 .../agent_tools/workflows/internal_actions.ts | 26 +++++--
 .../workflows/internal_mutations.ts           | 14 ++++
 services/platform/convex/approvals/queries.ts | 26 ++++---
 .../llm/utils/build_human_input_context.ts    | 10 ++-
 services/platform/messages/en.json            | 68 +++++++++++++++++--
 13 files changed, 243 insertions(+), 97 deletions(-)

diff --git a/services/platform/app/features/automations/components/automation-assistant/message-list.tsx b/services/platform/app/features/automations/components/automation-assistant/message-list.tsx
index a62207c99..f70b7e1f7 100644
--- a/services/platform/app/features/automations/components/automation-assistant/message-list.tsx
+++ b/services/platform/app/features/automations/components/automation-assistant/message-list.tsx
@@ -102,7 +102,11 @@ export function MessageList({
   }
 
   return (
-    <>
+    <div
+      role="log"
+      aria-live="polite"
+      aria-label={t('assistant.messageHistory')}
+    >
       {displayMessages.map((message) => (
         <div
           key={message.id}
@@ -242,6 +246,6 @@ export function MessageList({
           )}
         </div>
       )}
-    </>
+    </div>
   );
 }
diff --git a/services/platform/app/features/chat/components/document-write-approval-card.tsx b/services/platform/app/features/chat/components/document-write-approval-card.tsx
index 50644b3e2..62886580f 100644
--- a/services/platform/app/features/chat/components/document-write-approval-card.tsx
+++ b/services/platform/app/features/chat/components/document-write-approval-card.tsx
@@ -47,6 +47,7 @@ function DocumentWriteApprovalCardComponent({
   className,
 }: DocumentWriteApprovalCardProps) {
   const { t } = useT('documentWriteApproval');
+  const { t: tCommon } = useT('approvalCommon');
   const { user } = useAuth();
   const [isApproving, setIsApproving] = useState(false);
   const [isRejecting, setIsRejecting] = useState(false);
@@ -68,7 +69,7 @@ function DocumentWriteApprovalCardComponent({
 
   const handleApprove = async () => {
     if (!user?.userId) {
-      setError(t('errorNotAuthenticated'));
+      setError(tCommon('errorNotAuthenticated'));
       return;
     }
     setIsApproving(true);
@@ -89,7 +90,7 @@ function DocumentWriteApprovalCardComponent({
 
   const handleReject = async () => {
     if (!user?.userId) {
-      setError(t('errorNotAuthenticated'));
+      setError(tCommon('errorNotAuthenticated'));
       return;
     }
     setIsRejecting(true);
@@ -100,7 +101,9 @@ function DocumentWriteApprovalCardComponent({
         status: 'rejected',
       });
     } catch (err) {
-      setError(err instanceof Error ? err.message : t('errorRejectFailed'));
+      setError(
+        err instanceof Error ? err.message : tCommon('errorRejectFailed'),
+      );
       console.error('Failed to reject document write:', err);
     } finally {
       setIsRejecting(false);
diff --git a/services/platform/app/features/chat/components/human-input-request-card.tsx b/services/platform/app/features/chat/components/human-input-request-card.tsx
index 9b3c320a2..193376592 100644
--- a/services/platform/app/features/chat/components/human-input-request-card.tsx
+++ b/services/platform/app/features/chat/components/human-input-request-card.tsx
@@ -19,6 +19,7 @@ import { HStack, Stack } from '@/app/components/ui/layout/layout';
 import { Button } from '@/app/components/ui/primitives/button';
 import { Text } from '@/app/components/ui/typography/text';
 import { useFormatDate } from '@/app/hooks/use-format-date';
+import { useT } from '@/lib/i18n/client';
 import { cn } from '@/lib/utils/cn';
 
 import { useSubmitHumanInputResponse } from '../hooks/mutations';
@@ -38,6 +39,8 @@ function HumanInputRequestCardComponent({
   className,
   onResponseSubmitted,
 }: HumanInputRequestCardProps) {
+  const { t } = useT('humanInputRequest');
+  const { t: tCommon } = useT('approvalCommon');
   const { formatDate } = useFormatDate();
   const [error, setError] = useState<string | null>(null);
   const [textValue, setTextValue] = useState('');
@@ -55,7 +58,7 @@ function HumanInputRequestCardComponent({
     switch (metadata.format) {
       case 'text_input':
         if (!textValue.trim()) {
-          setError('Please enter a response');
+          setError(t('errorEnterResponse'));
           return;
         }
         response = textValue.trim();
@@ -63,14 +66,14 @@ function HumanInputRequestCardComponent({
       case 'single_select':
       case 'yes_no':
         if (!selectedValue) {
-          setError('Please select an option');
+          setError(t('errorSelectOption'));
           return;
         }
         response = selectedValue;
         break;
       case 'multi_select':
         if (selectedValues.length === 0) {
-          setError('Please select at least one option');
+          setError(t('errorSelectAtLeastOne'));
           return;
         }
         response = selectedValues;
@@ -89,13 +92,15 @@ function HumanInputRequestCardComponent({
         },
         onError: (err) => {
           setError(
-            err instanceof Error ? err.message : 'Failed to submit response',
+            err instanceof Error ? err.message : tCommon('errorSubmitFailed'),
           );
           console.error('Failed to submit response:', err);
         },
       },
     );
   }, [
+    t,
+    tCommon,
     metadata.format,
     textValue,
     selectedValue,
@@ -124,7 +129,7 @@ function HumanInputRequestCardComponent({
               onChange={(e: React.ChangeEvent<HTMLTextAreaElement>) =>
                 setTextValue(e.target.value)
               }
-              placeholder={metadata.placeholder ?? 'Type your response...'}
+              placeholder={metadata.placeholder ?? t('placeholder')}
               className="min-h-[80px] text-sm"
               disabled={isSubmitting}
             />
@@ -147,6 +152,8 @@ function HumanInputRequestCardComponent({
                 <button
                   type="button"
                   key={value}
+                  role="radio"
+                  aria-checked={isSelected}
                   className={cn(
                     'flex items-start space-x-3 p-3 rounded-lg border transition-all cursor-pointer',
                     isSelected
@@ -159,6 +166,8 @@ function HumanInputRequestCardComponent({
                     value={value}
                     id={`option-${value}`}
                     className="mt-0.5"
+                    tabIndex={-1}
+                    aria-hidden="true"
                   />
                   <div className="flex-1">
                     <Label
@@ -189,6 +198,8 @@ function HumanInputRequestCardComponent({
                 <button
                   type="button"
                   key={value}
+                  role="checkbox"
+                  aria-checked={isChecked}
                   className={cn(
                     'flex items-start space-x-3 p-3 rounded-lg border transition-all cursor-pointer',
                     isChecked
@@ -203,6 +214,8 @@ function HumanInputRequestCardComponent({
                     id={`option-${value}`}
                     disabled={isSubmitting}
                     className="mt-0.5"
+                    tabIndex={-1}
+                    aria-hidden="true"
                   />
                   <div className="flex-1">
                     <Label
@@ -240,8 +253,10 @@ function HumanInputRequestCardComponent({
           {displayValue}
         </Text>
         <Text as="div" variant="caption">
-          Responded by {respondedBy} at{' '}
-          {formatDate(new Date(timestamp), 'long')}
+          {t('respondedByAt', {
+            name: respondedBy,
+            date: formatDate(new Date(timestamp), 'long'),
+          })}
         </Text>
       </Stack>
     );
@@ -259,7 +274,7 @@ function HumanInputRequestCardComponent({
         <HStack gap={3}>
           <MessageCircleQuestion className="text-primary size-5 shrink-0" />
           <div>
-            <div className="text-base font-semibold">Question</div>
+            <div className="text-base font-semibold">{t('questionTitle')}</div>
             <Badge variant="outline" className="mt-1 text-xs capitalize">
               {metadata.format.replace('_', ' ')}
             </Badge>
@@ -301,7 +316,7 @@ function HumanInputRequestCardComponent({
             ) : (
               <Send className="mr-2 size-4" />
             )}
-            Submit Response
+            {t('submit')}
           </Button>
         </Stack>
       ) : (
@@ -322,9 +337,9 @@ function HumanInputRequestCardComponent({
             className="shrink-0 text-xs capitalize"
           >
             {status === 'completed'
-              ? 'Responded'
+              ? t('statusResponded')
               : status === 'executing'
-                ? 'Processing'
+                ? t('statusProcessing')
                 : status}
           </Badge>
         </HStack>
diff --git a/services/platform/app/features/chat/components/integration-approval-card.tsx b/services/platform/app/features/chat/components/integration-approval-card.tsx
index 2f6f60a5a..78714a86c 100644
--- a/services/platform/app/features/chat/components/integration-approval-card.tsx
+++ b/services/platform/app/features/chat/components/integration-approval-card.tsx
@@ -48,6 +48,7 @@ function IntegrationApprovalCardComponent({
   className,
 }: IntegrationApprovalCardProps) {
   const { t } = useT('integrationApproval');
+  const { t: tCommon } = useT('approvalCommon');
   const { user } = useAuth();
   const [isApproving, setIsApproving] = useState(false);
   const [isRejecting, setIsRejecting] = useState(false);
@@ -62,7 +63,7 @@ function IntegrationApprovalCardComponent({
 
   const handleApprove = async () => {
     if (!user?.userId) {
-      setError('User not authenticated');
+      setError(tCommon('errorNotAuthenticated'));
       return;
     }
     setIsApproving(true);
@@ -76,9 +77,7 @@ function IntegrationApprovalCardComponent({
         approvalId,
       });
     } catch (err) {
-      setError(
-        err instanceof Error ? err.message : 'Failed to approve operation',
-      );
+      setError(err instanceof Error ? err.message : t('errorApproveFailed'));
       console.error('Failed to approve:', err);
     } finally {
       setIsApproving(false);
@@ -87,7 +86,7 @@ function IntegrationApprovalCardComponent({
 
   const handleReject = async () => {
     if (!user?.userId) {
-      setError('User not authenticated');
+      setError(tCommon('errorNotAuthenticated'));
       return;
     }
     setIsRejecting(true);
@@ -99,7 +98,7 @@ function IntegrationApprovalCardComponent({
       });
     } catch (err) {
       setError(
-        err instanceof Error ? err.message : 'Failed to reject operation',
+        err instanceof Error ? err.message : tCommon('errorRejectFailed'),
       );
       console.error('Failed to reject:', err);
     } finally {
diff --git a/services/platform/app/features/chat/components/workflow-creation-approval-card.tsx b/services/platform/app/features/chat/components/workflow-creation-approval-card.tsx
index 4cee3beda..fa81b30ba 100644
--- a/services/platform/app/features/chat/components/workflow-creation-approval-card.tsx
+++ b/services/platform/app/features/chat/components/workflow-creation-approval-card.tsx
@@ -28,6 +28,7 @@ import { useAuth } from '@/app/hooks/use-convex-auth';
 import { useCopyButton } from '@/app/hooks/use-copy';
 import { Id } from '@/convex/_generated/dataModel';
 import { WorkflowCreationMetadata } from '@/convex/approvals/types';
+import { useT } from '@/lib/i18n/client';
 import { cn } from '@/lib/utils/cn';
 import { isRecord } from '@/lib/utils/type-guards';
 
@@ -242,6 +243,8 @@ function WorkflowCreationApprovalCardComponent({
   className,
 }: WorkflowCreationApprovalCardProps) {
   const { user } = useAuth();
+  const { t } = useT('workflowCreationApproval');
+  const { t: tCommon } = useT('approvalCommon');
   const [isApproving, setIsApproving] = useState(false);
   const [isRejecting, setIsRejecting] = useState(false);
   const [error, setError] = useState<string | null>(null);
@@ -273,7 +276,7 @@ function WorkflowCreationApprovalCardComponent({
 
   const handleApprove = async () => {
     if (!user?.userId) {
-      setError('User not authenticated');
+      setError(tCommon('errorNotAuthenticated'));
       return;
     }
     setIsApproving(true);
@@ -287,9 +290,7 @@ function WorkflowCreationApprovalCardComponent({
         approvalId,
       });
     } catch (err) {
-      setError(
-        err instanceof Error ? err.message : 'Failed to create workflow',
-      );
+      setError(err instanceof Error ? err.message : t('errorCreateFailed'));
       console.error('Failed to approve:', err);
     } finally {
       setIsApproving(false);
@@ -298,7 +299,7 @@ function WorkflowCreationApprovalCardComponent({
 
   const handleReject = async () => {
     if (!user?.userId) {
-      setError('User not authenticated');
+      setError(tCommon('errorNotAuthenticated'));
       return;
     }
     setIsRejecting(true);
@@ -309,7 +310,9 @@ function WorkflowCreationApprovalCardComponent({
         status: 'rejected',
       });
     } catch (err) {
-      setError(err instanceof Error ? err.message : 'Failed to reject');
+      setError(
+        err instanceof Error ? err.message : tCommon('errorRejectFailed'),
+      );
       console.error('Failed to reject:', err);
     } finally {
       setIsRejecting(false);
@@ -353,14 +356,16 @@ function WorkflowCreationApprovalCardComponent({
             ) : (
               <ChevronRight className="size-3" />
             )}
-            {metadata.stepsConfig.length} steps
+            {t('stepsCount', { count: metadata.stepsConfig.length })}
           </button>
-          <Tooltip content={copied ? 'Copied!' : 'Copy configuration'}>
+          <Tooltip
+            content={copied ? tCommon('copied') : tCommon('copyConfiguration')}
+          >
             <button
               type="button"
               onClick={handleCopy}
               className="text-muted-foreground hover:text-foreground transition-colors"
-              aria-label="Copy workflow configuration"
+              aria-label={t('copyAriaLabel')}
             >
               {copied ? (
                 <Check className="size-3" />
@@ -466,7 +471,7 @@ function WorkflowCreationApprovalCardComponent({
           <Stack gap={1} className="mb-3">
             <HStack gap={1} className="text-xs text-green-600">
               <CheckCircle className="size-3" />
-              Workflow created successfully
+              {t('createdSuccessfully')}
             </HStack>
             {metadata.createdWorkflowId && (
               <Link
@@ -477,7 +482,7 @@ function WorkflowCreationApprovalCardComponent({
                 }}
                 className="text-primary flex items-center gap-1 text-xs hover:underline"
               >
-                View workflow
+                {tCommon('viewWorkflow')}
                 <ExternalLink className="size-3" />
               </Link>
             )}
@@ -515,7 +520,7 @@ function WorkflowCreationApprovalCardComponent({
       {/* Action Buttons */}
       {isPending && (
         <ActionRow gap={2}>
-          <Tooltip content="Approve and create this workflow">
+          <Tooltip content={t('approveTooltip')}>
             <Button
               size="sm"
               variant="primary"
@@ -524,11 +529,11 @@ function WorkflowCreationApprovalCardComponent({
               className="flex-1"
             >
               {isApproving && <Loader2 className="mr-1 size-4 animate-spin" />}
-              Create Workflow
+              {t('approve')}
             </Button>
           </Tooltip>
 
-          <Tooltip content="Cancel workflow creation">
+          <Tooltip content={t('rejectTooltip')}>
             <Button
               size="sm"
               variant="secondary"
@@ -537,7 +542,7 @@ function WorkflowCreationApprovalCardComponent({
               className="flex-1"
             >
               {isRejecting && <Loader2 className="mr-1 size-4 animate-spin" />}
-              Cancel
+              {tCommon('reject')}
             </Button>
           </Tooltip>
         </ActionRow>
@@ -548,12 +553,12 @@ function WorkflowCreationApprovalCardComponent({
         <HStack justify="between" align="center" className="mt-2">
           <Text as="div" variant="caption">
             {status === 'executing'
-              ? 'Workflow creation in progress...'
+              ? t('statusExecuting')
               : status === 'completed' && executionError
-                ? 'Workflow creation was approved but failed.'
+                ? t('statusCompletedFailed')
                 : status === 'completed'
-                  ? 'Workflow was created successfully.'
-                  : 'Workflow creation was cancelled.'}
+                  ? t('statusCompletedSuccess')
+                  : t('statusRejected')}
           </Text>
           <Badge
             variant={
diff --git a/services/platform/app/features/chat/components/workflow-run-approval-card.tsx b/services/platform/app/features/chat/components/workflow-run-approval-card.tsx
index 0519abeb8..166103d02 100644
--- a/services/platform/app/features/chat/components/workflow-run-approval-card.tsx
+++ b/services/platform/app/features/chat/components/workflow-run-approval-card.tsx
@@ -83,6 +83,7 @@ function WorkflowRunApprovalCardComponent({
   className,
 }: WorkflowRunApprovalCardProps) {
   const { t } = useT('workflowRunApproval');
+  const { t: tCommon } = useT('approvalCommon');
   const { user } = useAuth();
   const [isApproving, setIsApproving] = useState(false);
   const [isRejecting, setIsRejecting] = useState(false);
@@ -142,7 +143,7 @@ function WorkflowRunApprovalCardComponent({
 
   const handleApprove = async () => {
     if (!user?.userId) {
-      setError('User not authenticated');
+      setError(tCommon('errorNotAuthenticated'));
       return;
     }
     setIsApproving(true);
@@ -156,7 +157,7 @@ function WorkflowRunApprovalCardComponent({
         approvalId,
       });
     } catch (err) {
-      setError(err instanceof Error ? err.message : 'Failed to run workflow');
+      setError(err instanceof Error ? err.message : t('errorRunFailed'));
       console.error('Failed to approve workflow run:', err);
     } finally {
       setIsApproving(false);
@@ -165,7 +166,7 @@ function WorkflowRunApprovalCardComponent({
 
   const handleReject = async () => {
     if (!user?.userId) {
-      setError('User not authenticated');
+      setError(tCommon('errorNotAuthenticated'));
       return;
     }
     setIsRejecting(true);
@@ -176,7 +177,9 @@ function WorkflowRunApprovalCardComponent({
         status: 'rejected',
       });
     } catch (err) {
-      setError(err instanceof Error ? err.message : 'Failed to reject');
+      setError(
+        err instanceof Error ? err.message : tCommon('errorRejectFailed'),
+      );
       console.error('Failed to reject workflow run:', err);
     } finally {
       setIsRejecting(false);
@@ -190,7 +193,7 @@ function WorkflowRunApprovalCardComponent({
     try {
       await cancelExecution({ executionId });
     } catch (err) {
-      setError(err instanceof Error ? err.message : 'Failed to stop execution');
+      setError(err instanceof Error ? err.message : t('errorStopFailed'));
       console.error('Failed to cancel execution:', err);
     } finally {
       setIsCancelling(false);
@@ -294,7 +297,7 @@ function WorkflowRunApprovalCardComponent({
                   setError(
                     err instanceof Error
                       ? err.message
-                      : 'Failed to submit response',
+                      : tCommon('errorSubmitFailed'),
                   );
                 },
               },
@@ -471,11 +474,11 @@ function WorkflowRunApprovalCardComponent({
               onClick={handleReject}
               disabled={isProcessing}
               aria-busy={isRejecting}
-              aria-label={t('reject')}
+              aria-label={tCommon('reject')}
               className="flex-1"
             >
               {isRejecting && <Loader2 className="mr-1 size-4 animate-spin" />}
-              {t('reject')}
+              {tCommon('reject')}
             </Button>
           </Tooltip>
         </ActionRow>
@@ -541,6 +544,8 @@ function WorkflowHumanInputSection({
   isSubmitting,
   onSubmit,
 }: WorkflowHumanInputSectionProps) {
+  const { t } = useT('workflowRunApproval');
+  const { t: tCommon } = useT('approvalCommon');
   const meta = approval.metadata ?? {};
   const question = typeof meta.question === 'string' ? meta.question : '';
   const context = typeof meta.context === 'string' ? meta.context : undefined;
@@ -592,7 +597,7 @@ function WorkflowHumanInputSection({
           onChange={(e: React.ChangeEvent<HTMLTextAreaElement>) =>
             onInputChange(e.target.value)
           }
-          placeholder="Type your response..."
+          placeholder={t('humanInputPlaceholder')}
           className="min-h-[80px] text-sm"
           disabled={isSubmitting}
         />
@@ -605,6 +610,8 @@ function WorkflowHumanInputSection({
             <button
               key={val}
               type="button"
+              role="radio"
+              aria-checked={selectedValue === val}
               className={cn(
                 'flex items-start gap-3 rounded-lg border p-3 text-left transition-all',
                 selectedValue === val
@@ -615,6 +622,7 @@ function WorkflowHumanInputSection({
               disabled={isSubmitting}
             >
               <div
+                aria-hidden="true"
                 className={cn(
                   'mt-0.5 size-4 shrink-0 rounded-full border-2',
                   selectedValue === val
@@ -644,6 +652,8 @@ function WorkflowHumanInputSection({
             <button
               key={val}
               type="button"
+              role="checkbox"
+              aria-checked={isChecked}
               className={cn(
                 'flex items-start gap-3 rounded-lg border p-3 text-left transition-all',
                 isChecked
@@ -660,6 +670,7 @@ function WorkflowHumanInputSection({
               disabled={isSubmitting}
             >
               <div
+                aria-hidden="true"
                 className={cn(
                   'mt-0.5 size-4 shrink-0 rounded border',
                   isChecked
@@ -692,7 +703,7 @@ function WorkflowHumanInputSection({
         ) : (
           <Send className="mr-2 size-4" />
         )}
-        Submit response
+        {t('submitResponse')}
       </Button>
     </Stack>
   );
diff --git a/services/platform/app/features/chat/components/workflow-update-approval-card.tsx b/services/platform/app/features/chat/components/workflow-update-approval-card.tsx
index 080df3b46..bc468a982 100644
--- a/services/platform/app/features/chat/components/workflow-update-approval-card.tsx
+++ b/services/platform/app/features/chat/components/workflow-update-approval-card.tsx
@@ -30,6 +30,7 @@ import { useAuth } from '@/app/hooks/use-convex-auth';
 import { useCopyButton } from '@/app/hooks/use-copy';
 import { Id } from '@/convex/_generated/dataModel';
 import { WorkflowUpdateMetadata } from '@/convex/approvals/types';
+import { useT } from '@/lib/i18n/client';
 import { cn } from '@/lib/utils/cn';
 import { isRecord } from '@/lib/utils/type-guards';
 
@@ -72,6 +73,8 @@ function WorkflowUpdateApprovalCardComponent({
   executionError,
   className,
 }: WorkflowUpdateApprovalCardProps) {
+  const { t } = useT('workflowUpdateApproval');
+  const { t: tCommon } = useT('approvalCommon');
   const { user } = useAuth();
   const [isApproving, setIsApproving] = useState(false);
   const [isRejecting, setIsRejecting] = useState(false);
@@ -123,7 +126,7 @@ function WorkflowUpdateApprovalCardComponent({
 
   const handleApprove = async () => {
     if (!user?.userId) {
-      setError('User not authenticated');
+      setError(tCommon('errorNotAuthenticated'));
       return;
     }
     setIsApproving(true);
@@ -137,7 +140,7 @@ function WorkflowUpdateApprovalCardComponent({
         approvalId,
       });
     } catch (err) {
-      setError(err instanceof Error ? err.message : 'Failed to apply update');
+      setError(err instanceof Error ? err.message : t('errorApplyFailed'));
       console.error('Failed to approve workflow update:', err);
     } finally {
       setIsApproving(false);
@@ -146,7 +149,7 @@ function WorkflowUpdateApprovalCardComponent({
 
   const handleReject = async () => {
     if (!user?.userId) {
-      setError('User not authenticated');
+      setError(tCommon('errorNotAuthenticated'));
       return;
     }
     setIsRejecting(true);
@@ -157,7 +160,9 @@ function WorkflowUpdateApprovalCardComponent({
         status: 'rejected',
       });
     } catch (err) {
-      setError(err instanceof Error ? err.message : 'Failed to reject');
+      setError(
+        err instanceof Error ? err.message : tCommon('errorRejectFailed'),
+      );
       console.error('Failed to reject workflow update:', err);
     } finally {
       setIsRejecting(false);
@@ -181,10 +186,10 @@ function WorkflowUpdateApprovalCardComponent({
             </Text>
             <Badge variant="outline" className="mt-0.5 text-[10px]">
               {metadata.updateType === 'full_save'
-                ? 'Update workflow'
+                ? t('badgeFullSave')
                 : metadata.updateType === 'multi_step_patch'
-                  ? `Update ${metadata.steps?.length ?? 0} steps`
-                  : 'Update step'}
+                  ? t('badgeMultiStep', { count: metadata.steps?.length ?? 0 })
+                  : t('badgeStepPatch')}
             </Badge>
           </div>
         </HStack>
@@ -193,11 +198,11 @@ function WorkflowUpdateApprovalCardComponent({
       {/* Details list */}
       <div className="text-muted-foreground mb-3 space-y-0.5 text-xs">
         <div className="flex gap-1.5">
-          <span className="shrink-0">Version:</span>
+          <span className="shrink-0">{t('versionLabel')}</span>
           <span className="font-mono">{metadata.workflowVersionNumber}</span>
         </div>
         <div className="flex gap-1.5">
-          <span className="shrink-0">ID:</span>
+          <span className="shrink-0">{t('idLabel')}</span>
           <span className="font-mono">{metadata.workflowId}</span>
         </div>
       </div>
@@ -230,12 +235,14 @@ function WorkflowUpdateApprovalCardComponent({
                 ? `${metadata.steps?.length ?? 0} steps`
                 : `Step: ${metadata.stepName ?? 'unknown'}`}
           </button>
-          <Tooltip content={copied ? 'Copied!' : 'Copy configuration'}>
+          <Tooltip
+            content={copied ? tCommon('copied') : tCommon('copyConfiguration')}
+          >
             <button
               type="button"
               onClick={handleCopy}
               className="text-muted-foreground hover:text-foreground transition-colors"
-              aria-label="Copy update configuration"
+              aria-label={t('copyAriaLabel')}
             >
               {copied ? (
                 <Check className="size-3" />
@@ -323,14 +330,14 @@ function WorkflowUpdateApprovalCardComponent({
           <Stack gap={1} className="mb-3">
             <HStack gap={1} className="text-xs text-green-600">
               <CheckCircle className="size-3" />
-              Workflow updated successfully
+              {t('updatedSuccessfully')}
             </HStack>
             <Link
               to="/dashboard/$id/automations/$amId"
               params={{ id: organizationId, amId: metadata.workflowId }}
               className="text-primary flex items-center gap-1 text-xs hover:underline"
             >
-              View workflow
+              {tCommon('viewWorkflow')}
               <ExternalLink className="size-3" />
             </Link>
           </Stack>
@@ -367,7 +374,7 @@ function WorkflowUpdateApprovalCardComponent({
       {/* Action Buttons */}
       {isPending && (
         <ActionRow gap={2}>
-          <Tooltip content="Approve and apply this update">
+          <Tooltip content={t('approveTooltip')}>
             <Button
               size="sm"
               variant="primary"
@@ -376,11 +383,11 @@ function WorkflowUpdateApprovalCardComponent({
               className="flex-1"
             >
               {isApproving && <Loader2 className="mr-1 size-4 animate-spin" />}
-              Apply Update
+              {t('approve')}
             </Button>
           </Tooltip>
 
-          <Tooltip content="Cancel workflow update">
+          <Tooltip content={t('rejectTooltip')}>
             <Button
               size="sm"
               variant="secondary"
@@ -389,7 +396,7 @@ function WorkflowUpdateApprovalCardComponent({
               className="flex-1"
             >
               {isRejecting && <Loader2 className="mr-1 size-4 animate-spin" />}
-              Cancel
+              {tCommon('reject')}
             </Button>
           </Tooltip>
         </ActionRow>
@@ -400,12 +407,12 @@ function WorkflowUpdateApprovalCardComponent({
         <HStack justify="between" align="center" className="mt-2">
           <Text as="div" variant="caption">
             {status === 'executing'
-              ? 'Applying update...'
+              ? t('statusExecuting')
               : status === 'completed' && executionError
-                ? 'Update was approved but failed to apply.'
+                ? t('statusCompletedFailed')
                 : status === 'completed'
-                  ? 'Workflow was updated successfully.'
-                  : 'Workflow update was cancelled.'}
+                  ? t('statusCompletedSuccess')
+                  : t('statusRejected')}
           </Text>
           <Badge
             variant={
diff --git a/services/platform/app/features/custom-agents/components/test-chat-panel/test-message-list.tsx b/services/platform/app/features/custom-agents/components/test-chat-panel/test-message-list.tsx
index a02a53776..b127a1fde 100644
--- a/services/platform/app/features/custom-agents/components/test-chat-panel/test-message-list.tsx
+++ b/services/platform/app/features/custom-agents/components/test-chat-panel/test-message-list.tsx
@@ -53,7 +53,11 @@ export function TestMessageList({
   }
 
   return (
-    <>
+    <div
+      role="log"
+      aria-live="polite"
+      aria-label={t('customAgents.testChat.messageHistory')}
+    >
       {displayItems.map((item) => {
         if (item.type !== 'message') return null;
 
@@ -131,6 +135,6 @@ export function TestMessageList({
           organizationId={organizationId}
         />
       )}
-    </>
+    </div>
   );
 }
diff --git a/services/platform/convex/agent_tools/workflows/internal_actions.ts b/services/platform/convex/agent_tools/workflows/internal_actions.ts
index 218316af9..4d4fc5b7b 100644
--- a/services/platform/convex/agent_tools/workflows/internal_actions.ts
+++ b/services/platform/convex/agent_tools/workflows/internal_actions.ts
@@ -51,8 +51,13 @@ export const executeApprovedWorkflowCreation = internalAction({
       );
     }
 
-    // Idempotency guard: prevent double-execution from rapid clicks or retries
-    if (approval.executedAt) {
+    // Atomic claim: prevent double-execution from rapid clicks or retries
+    const claimed = await ctx.runMutation(
+      internal.agent_tools.workflows.internal_mutations
+        .claimWorkflowApprovalForExecution,
+      { approvalId: args.approvalId },
+    );
+    if (!claimed) {
       throw new Error(
         'This workflow creation approval has already been executed',
       );
@@ -177,8 +182,13 @@ export const executeApprovedWorkflowRun = internalAction({
       );
     }
 
-    // Idempotency guard: prevent double-execution from rapid clicks or retries
-    if (approval.executedAt) {
+    // Atomic claim: prevent double-execution from rapid clicks or retries
+    const claimed = await ctx.runMutation(
+      internal.agent_tools.workflows.internal_mutations
+        .claimWorkflowApprovalForExecution,
+      { approvalId: args.approvalId },
+    );
+    if (!claimed) {
       throw new Error('This workflow run approval has already been executed');
     }
 
@@ -304,7 +314,13 @@ export const executeApprovedWorkflowUpdate = internalAction({
       );
     }
 
-    if (approval.executedAt) {
+    // Atomic claim: prevent double-execution from rapid clicks or retries
+    const claimed = await ctx.runMutation(
+      internal.agent_tools.workflows.internal_mutations
+        .claimWorkflowApprovalForExecution,
+      { approvalId: args.approvalId },
+    );
+    if (!claimed) {
       throw new Error(
         'This workflow update approval has already been executed',
       );
diff --git a/services/platform/convex/agent_tools/workflows/internal_mutations.ts b/services/platform/convex/agent_tools/workflows/internal_mutations.ts
index 310424dce..8a2cacac8 100644
--- a/services/platform/convex/agent_tools/workflows/internal_mutations.ts
+++ b/services/platform/convex/agent_tools/workflows/internal_mutations.ts
@@ -25,6 +25,20 @@ const beforeGenerateHookRef = makeFunctionReference<'action'>(
 
 type ApprovalMetadata = Doc<'approvals'>['metadata'];
 
+export const claimWorkflowApprovalForExecution = internalMutation({
+  args: {
+    approvalId: v.id('approvals'),
+  },
+  returns: v.boolean(),
+  handler: async (ctx, args): Promise<boolean> => {
+    const approval = await ctx.db.get(args.approvalId);
+    if (!approval) throw new Error('Approval not found');
+    if (approval.executedAt) return false;
+    await ctx.db.patch(args.approvalId, { executedAt: Date.now() });
+    return true;
+  },
+});
+
 export const updateWorkflowApprovalWithResult = internalMutation({
   args: {
     approvalId: v.id('approvals'),
diff --git a/services/platform/convex/approvals/queries.ts b/services/platform/convex/approvals/queries.ts
index e5dd9f793..0f4fce3d8 100644
--- a/services/platform/convex/approvals/queries.ts
+++ b/services/platform/convex/approvals/queries.ts
@@ -4,6 +4,7 @@ import { v } from 'convex/values';
 import { query } from '../_generated/server';
 import { DEFAULT_COUNT_CAP } from '../lib/helpers/count_items_in_org';
 import { getAuthUserIdentity, getOrganizationMember } from '../lib/rls';
+import { UnauthorizedError } from '../lib/rls/errors';
 import * as ApprovalsHelpers from './helpers';
 import { listApprovalsPaginated as listApprovalsPaginatedHelper } from './list_approvals_paginated';
 import {
@@ -26,8 +27,9 @@ export const getApproval = query({
 
     try {
       await getOrganizationMember(ctx, approval.organizationId, authUser);
-    } catch {
-      return null;
+    } catch (error) {
+      if (error instanceof UnauthorizedError) return null;
+      throw error;
     }
 
     return approval;
@@ -48,8 +50,9 @@ export const approxCountApprovalsByStatus = query({
 
     try {
       await getOrganizationMember(ctx, args.organizationId, authUser);
-    } catch {
-      return 0;
+    } catch (error) {
+      if (error instanceof UnauthorizedError) return 0;
+      throw error;
     }
 
     if (args.status === 'pending') {
@@ -98,8 +101,9 @@ export const listApprovalsPaginated = query({
 
     try {
       await getOrganizationMember(ctx, args.organizationId, authUser);
-    } catch {
-      return emptyResult;
+    } catch (error) {
+      if (error instanceof UnauthorizedError) return emptyResult;
+      throw error;
     }
 
     return await listApprovalsPaginatedHelper(ctx, args);
@@ -128,8 +132,9 @@ export const listApprovalsByOrganization = query({
 
     try {
       await getOrganizationMember(ctx, args.organizationId, authUser);
-    } catch {
-      return [];
+    } catch (error) {
+      if (error instanceof UnauthorizedError) return [];
+      throw error;
     }
 
     return await ApprovalsHelpers.listApprovalsByOrganization(ctx, args);
@@ -150,8 +155,9 @@ export const listActiveApprovalsByOrganization = query({
 
     try {
       await getOrganizationMember(ctx, args.organizationId, authUser);
-    } catch {
-      return [];
+    } catch (error) {
+      if (error instanceof UnauthorizedError) return [];
+      throw error;
     }
 
     return await ApprovalsHelpers.listActiveApprovalsByOrganization(ctx, args);
diff --git a/services/platform/convex/workflow_engine/helpers/nodes/llm/utils/build_human_input_context.ts b/services/platform/convex/workflow_engine/helpers/nodes/llm/utils/build_human_input_context.ts
index 6765a1de4..60fb43dd3 100644
--- a/services/platform/convex/workflow_engine/helpers/nodes/llm/utils/build_human_input_context.ts
+++ b/services/platform/convex/workflow_engine/helpers/nodes/llm/utils/build_human_input_context.ts
@@ -26,12 +26,20 @@ export async function buildHumanInputContext(
     responseCount: respondedApprovals.length,
   });
 
+  const escapeForContext = (value: string) =>
+    value.replace(/</g, '&lt;').replace(/>/g, '&gt;');
+
+  const formatResponse = (response: string | string[]) =>
+    Array.isArray(response)
+      ? response.map(escapeForContext).join(', ')
+      : escapeForContext(response);
+
   return [
     '<human_input_context>',
     'The following information was provided by the user during this workflow. Use these values for the EXACT questions listed below — do not re-ask these specific questions. If you need NEW or DIFFERENT information not covered here, you MUST call request_human_input again.',
     ...respondedApprovals.map(
       (a: { question: string; response: string | string[] }) =>
-        `- Q: "${a.question}" → A: "${Array.isArray(a.response) ? a.response.join(', ') : a.response}"`,
+        `- Q: "${escapeForContext(a.question)}" → A: "${formatResponse(a.response)}"`,
     ),
     '</human_input_context>',
   ].join('\n');
diff --git a/services/platform/messages/en.json b/services/platform/messages/en.json
index 82e9cd32a..a8ed698f6 100644
--- a/services/platform/messages/en.json
+++ b/services/platform/messages/en.json
@@ -707,7 +707,8 @@
         "attachFiles": "Attach files",
         "send": "Send message",
         "previewImage": "Preview {filename}",
-        "removeAttachment": "Remove attachment"
+        "removeAttachment": "Remove attachment",
+        "messageHistory": "Message history"
       },
       "createDialog": {
         "continue": "Continue",
@@ -1901,7 +1902,8 @@
       },
       "viewMore": "View more",
       "viewLess": "View less",
-      "analyzeAttachments": "Please analyze the attached files."
+      "analyzeAttachments": "Please analyze the attached files.",
+      "messageHistory": "Message history"
     },
     "tester": {
       "inputLabel": "Test input (JSON)",
@@ -2100,9 +2102,58 @@
       "unread": "Unread"
     }
   },
+  "humanInputRequest": {
+    "questionTitle": "Question",
+    "placeholder": "Type your response...",
+    "submit": "Submit response",
+    "statusResponded": "Responded",
+    "statusProcessing": "Processing",
+    "errorEnterResponse": "Please enter a response",
+    "errorSelectOption": "Please select an option",
+    "errorSelectAtLeastOne": "Please select at least one option",
+    "respondedByAt": "Responded by {name} at {date}"
+  },
+  "approvalCommon": {
+    "reject": "Cancel",
+    "errorNotAuthenticated": "User not authenticated",
+    "errorRejectFailed": "Failed to reject",
+    "errorSubmitFailed": "Failed to submit response",
+    "copied": "Copied!",
+    "copyConfiguration": "Copy configuration",
+    "viewWorkflow": "View workflow"
+  },
+  "workflowCreationApproval": {
+    "approve": "Create workflow",
+    "approveTooltip": "Approve and create this workflow",
+    "rejectTooltip": "Cancel workflow creation",
+    "stepsCount": "{count} steps",
+    "copyAriaLabel": "Copy workflow configuration",
+    "createdSuccessfully": "Workflow created successfully",
+    "statusExecuting": "Workflow creation in progress...",
+    "statusCompletedFailed": "Workflow creation was approved but failed.",
+    "statusCompletedSuccess": "Workflow was created successfully.",
+    "statusRejected": "Workflow creation was cancelled.",
+    "errorCreateFailed": "Failed to create workflow"
+  },
+  "workflowUpdateApproval": {
+    "approve": "Apply update",
+    "approveTooltip": "Approve and apply this update",
+    "rejectTooltip": "Cancel workflow update",
+    "badgeFullSave": "Update workflow",
+    "badgeMultiStep": "Update {count} steps",
+    "badgeStepPatch": "Update step",
+    "versionLabel": "Version:",
+    "idLabel": "ID:",
+    "copyAriaLabel": "Copy update configuration",
+    "updatedSuccessfully": "Workflow updated successfully",
+    "statusExecuting": "Applying update...",
+    "statusCompletedFailed": "Update was approved but failed to apply.",
+    "statusCompletedSuccess": "Workflow was updated successfully.",
+    "statusRejected": "Workflow update was cancelled.",
+    "errorApplyFailed": "Failed to apply update"
+  },
   "workflowRunApproval": {
     "approve": "Run workflow",
-    "reject": "Cancel",
     "approveTooltip": "Approve and run this workflow",
     "rejectTooltip": "Cancel workflow execution",
     "statusExecuting": "Executing...",
@@ -2123,7 +2174,11 @@
     "hideOutput": "Hide output",
     "stopExecution": "Stop",
     "stopTooltip": "Stop workflow execution",
-    "statusPending": "Pending"
+    "statusPending": "Pending",
+    "errorRunFailed": "Failed to run workflow",
+    "errorStopFailed": "Failed to stop execution",
+    "humanInputPlaceholder": "Type your response...",
+    "submitResponse": "Submit response"
   },
   "documentWriteApproval": {
     "cardTitle": "Save to documents",
@@ -2143,9 +2198,7 @@
     "statusCompletedPartial": "Some documents failed to save.",
     "statusRejected": "This document save was rejected.",
     "allFilesFailed": "All {count} files failed to save",
-    "errorNotAuthenticated": "User not authenticated",
-    "errorSaveFailed": "Failed to save document",
-    "errorRejectFailed": "Failed to reject"
+    "errorSaveFailed": "Failed to save document"
   },
   "integrationApproval": {
     "approve": "Approve",
@@ -2157,6 +2210,7 @@
     "statusCompletedFailed": "This operation was approved but failed during execution.",
     "statusCompletedSuccess": "This operation was approved and executed successfully.",
     "statusRejected": "This operation was rejected.",
+    "errorApproveFailed": "Failed to approve operation",
     "moreParameters": "+{count} more",
     "showLess": "Show less"
   },

From 7d05986634a7265bde5f7735b88e371918715223 Mon Sep 17 00:00:00 2001
From: larryro <371767072@qq.com>
Date: Fri, 20 Mar 2026 19:45:32 +0800
Subject: [PATCH 6/9] feat(platform): remove redundant idempotency guards and
 improve system message formatting

Remove executedAt early-return checks from approval update mutations since
the atomic claim pattern now prevents double execution. Drop the server-side
concurrent generation guard in startAgentChat to avoid permanently deadlocking
threads when generation crashes. Format system message tags for readability.
---
 .../chat/components/chat-messages.tsx         |  6 ++-
 .../execute_approved_workflow_run.test.ts     | 37 +++++++++++--------
 .../workflows/internal_mutations.ts           |  3 --
 .../__tests__/start_agent_chat.test.ts        | 25 -------------
 .../convex/lib/agent_chat/start_agent_chat.ts | 10 ++---
 5 files changed, 30 insertions(+), 51 deletions(-)

diff --git a/services/platform/app/features/chat/components/chat-messages.tsx b/services/platform/app/features/chat/components/chat-messages.tsx
index aea7c1ffc..606a6e34d 100644
--- a/services/platform/app/features/chat/components/chat-messages.tsx
+++ b/services/platform/app/features/chat/components/chat-messages.tsx
@@ -25,7 +25,11 @@ const CollapsibleSystemMessage = memo(function CollapsibleSystemMessage({
   const [expanded, setExpanded] = useState(false);
   const toggle = useCallback(() => setExpanded((prev) => !prev), []);
 
-  const lines = content.split('\n');
+  const formatted = content.replace(
+    /\[([A-Z][A-Z_]+)\]/g,
+    (_, tag: string) => `[${tag.replaceAll('_', ' ')}]`,
+  );
+  const lines = formatted.split('\n');
   const nonEmptyLines = lines.filter((l) => l.trim() !== '');
   const previewLines = nonEmptyLines.slice(0, 2);
   const preview = previewLines.join(' ');
diff --git a/services/platform/convex/agent_tools/workflows/__tests__/execute_approved_workflow_run.test.ts b/services/platform/convex/agent_tools/workflows/__tests__/execute_approved_workflow_run.test.ts
index 1334a90fc..d51bf6ed4 100644
--- a/services/platform/convex/agent_tools/workflows/__tests__/execute_approved_workflow_run.test.ts
+++ b/services/platform/convex/agent_tools/workflows/__tests__/execute_approved_workflow_run.test.ts
@@ -15,6 +15,8 @@ vi.mock('../../../_generated/api', () => ({
     agent_tools: {
       workflows: {
         internal_mutations: {
+          claimWorkflowApprovalForExecution:
+            'mock-claimWorkflowApprovalForExecution',
           updateWorkflowRunApprovalWithResult:
             'mock-updateWorkflowRunApprovalWithResult',
           saveSystemMessage: 'mock-saveSystemMessage',
@@ -48,7 +50,11 @@ function createMockApproval(overrides?: Record<string, unknown>) {
 function createMockCtx(approval: ReturnType<typeof createMockApproval> | null) {
   return {
     runQuery: vi.fn().mockResolvedValue(approval),
-    runMutation: vi.fn().mockResolvedValue('exec-1'),
+    runMutation: vi.fn().mockImplementation((ref: string) => {
+      if (ref === 'mock-claimWorkflowApprovalForExecution') return true;
+      if (ref === 'mock-startWorkflow') return 'exec-1';
+      return undefined;
+    }),
   };
 }
 
@@ -129,8 +135,12 @@ describe('executeApprovedWorkflowRun', () => {
 
   it('throws on double execution (idempotency guard)', async () => {
     const handler = await getHandler();
-    const approval = createMockApproval({ executedAt: Date.now() });
+    const approval = createMockApproval();
     const ctx = createMockCtx(approval);
+    ctx.runMutation = vi.fn().mockImplementation((ref: string) => {
+      if (ref === 'mock-claimWorkflowApprovalForExecution') return false;
+      return undefined;
+    });
 
     await expect(
       handler(ctx, { approvalId: 'approval-1', approvedBy: 'user-1' }),
@@ -153,15 +163,11 @@ describe('executeApprovedWorkflowRun', () => {
     const handler = await getHandler();
     const approval = createMockApproval();
     const ctx = createMockCtx(approval);
-    ctx.runMutation
-      .mockResolvedValueOnce(undefined) // startWorkflow throws
-      .mockRejectedValueOnce(new Error('Start failed'));
-
-    // Re-mock to make startWorkflow fail
-    ctx.runMutation = vi
-      .fn()
-      .mockRejectedValueOnce(new Error('Start failed'))
-      .mockResolvedValueOnce(undefined);
+    ctx.runMutation = vi.fn().mockImplementation((ref: string) => {
+      if (ref === 'mock-claimWorkflowApprovalForExecution') return true;
+      if (ref === 'mock-startWorkflow') throw new Error('Start failed');
+      return undefined;
+    });
 
     await expect(
       handler(ctx, { approvalId: 'approval-1', approvedBy: 'user-1' }),
@@ -210,14 +216,13 @@ describe('executeApprovedWorkflowRun', () => {
     const approval = createMockApproval();
     const ctx = createMockCtx(approval);
 
-    let callCount = 0;
-    ctx.runMutation = vi.fn().mockImplementation((ref) => {
+    ctx.runMutation = vi.fn().mockImplementation((ref: string) => {
+      if (ref === 'mock-claimWorkflowApprovalForExecution') return true;
+      if (ref === 'mock-startWorkflow') return 'exec-1';
       if (ref === 'mock-saveSystemMessage') {
         throw new Error('Message save failed');
       }
-      callCount++;
-      if (callCount === 1) return 'exec-1'; // startWorkflow
-      return undefined; // updateWorkflowRunApprovalWithResult
+      return undefined;
     });
 
     const result = await handler(ctx, {
diff --git a/services/platform/convex/agent_tools/workflows/internal_mutations.ts b/services/platform/convex/agent_tools/workflows/internal_mutations.ts
index 8a2cacac8..7da3b08fa 100644
--- a/services/platform/convex/agent_tools/workflows/internal_mutations.ts
+++ b/services/platform/convex/agent_tools/workflows/internal_mutations.ts
@@ -48,7 +48,6 @@ export const updateWorkflowApprovalWithResult = internalMutation({
   handler: async (ctx, args): Promise<void> => {
     const approval = await ctx.db.get(args.approvalId);
     if (!approval) throw new Error('Approval not found');
-    if (approval.executedAt) return;
 
     // oxlint-disable-next-line typescript/no-unsafe-type-assertion -- approval.metadata is v.any() but always matches WorkflowCreationMetadata for workflow_creation approvals
     const metadata = (approval.metadata || {}) as WorkflowCreationMetadata;
@@ -288,7 +287,6 @@ export const updateWorkflowRunApprovalWithResult = internalMutation({
   handler: async (ctx, args): Promise<void> => {
     const approval = await ctx.db.get(args.approvalId);
     if (!approval) throw new Error('Approval not found');
-    if (approval.executedAt) return;
 
     // oxlint-disable-next-line typescript/no-unsafe-type-assertion -- approval.metadata is v.any() but always matches WorkflowRunMetadata for workflow_run approvals
     const metadata = (approval.metadata || {}) as WorkflowRunMetadata;
@@ -480,7 +478,6 @@ export const updateWorkflowUpdateApprovalWithResult = internalMutation({
   handler: async (ctx, args): Promise<void> => {
     const approval = await ctx.db.get(args.approvalId);
     if (!approval) throw new Error('Approval not found');
-    if (approval.executedAt) return;
 
     // oxlint-disable-next-line typescript/no-unsafe-type-assertion -- approval.metadata is v.any() but always matches WorkflowUpdateMetadata for workflow_update approvals
     const metadata = (approval.metadata || {}) as WorkflowUpdateMetadata;
diff --git a/services/platform/convex/lib/agent_chat/__tests__/start_agent_chat.test.ts b/services/platform/convex/lib/agent_chat/__tests__/start_agent_chat.test.ts
index 824709085..e66834287 100644
--- a/services/platform/convex/lib/agent_chat/__tests__/start_agent_chat.test.ts
+++ b/services/platform/convex/lib/agent_chat/__tests__/start_agent_chat.test.ts
@@ -1,4 +1,3 @@
-import { ConvexError } from 'convex/values';
 import { describe, it, expect, vi, beforeEach } from 'vitest';
 
 const mockListMessages = vi.fn();
@@ -98,30 +97,6 @@ describe('startAgentChat — concurrent generation guard', () => {
     mockSaveMessage.mockResolvedValue({ messageId: 'msg_1' });
   });
 
-  it('throws ConvexError when generationStatus is already generating', async () => {
-    const ctx = createMockCtx({
-      _id: 'meta_1',
-      generationStatus: 'generating',
-      streamId: 'existing-stream',
-    });
-
-    await expect(startAgentChat(createDefaultArgs(ctx))).rejects.toThrow(
-      ConvexError,
-    );
-  });
-
-  it('includes a descriptive message in the ConvexError', async () => {
-    const ctx = createMockCtx({
-      _id: 'meta_1',
-      generationStatus: 'generating',
-      streamId: 'existing-stream',
-    });
-
-    await expect(startAgentChat(createDefaultArgs(ctx))).rejects.toThrow(
-      /already being generated/,
-    );
-  });
-
   it('does not throw when generationStatus is idle', async () => {
     const ctx = createMockCtx({
       _id: 'meta_1',
diff --git a/services/platform/convex/lib/agent_chat/start_agent_chat.ts b/services/platform/convex/lib/agent_chat/start_agent_chat.ts
index b5b02771e..e82ee32a6 100644
--- a/services/platform/convex/lib/agent_chat/start_agent_chat.ts
+++ b/services/platform/convex/lib/agent_chat/start_agent_chat.ts
@@ -12,7 +12,6 @@
  */
 
 import { listMessages, saveMessage } from '@convex-dev/agent';
-import { ConvexError } from 'convex/values';
 
 import type { MutationCtx } from '../../_generated/server';
 import type { FileAttachment } from '../attachments';
@@ -119,11 +118,10 @@ export async function startAgentChat(
     .query('threadMetadata')
     .withIndex('by_threadId', (q) => q.eq('threadId', threadId))
     .first();
-  if (threadMeta?.generationStatus === 'generating') {
-    throw new ConvexError(
-      'A response is already being generated for this thread. Please wait for it to finish.',
-    );
-  }
+  // No server-side concurrent generation guard here. The frontend prevents
+  // duplicate submissions via the isThreadGenerating subscription + input disable.
+  // A server-side throw would risk permanently deadlocking a thread if the
+  // generation action crashes without resetting generationStatus.
   if (threadMeta) {
     await ctx.db.patch(threadMeta._id, {
       generationStatus: 'generating' as const,

From 5f90fdf19721c7563bf3e22412ed546061de508b Mon Sep 17 00:00:00 2001
From: larryro <371767072@qq.com>
Date: Fri, 20 Mar 2026 19:46:48 +0800
Subject: [PATCH 7/9] chore: add rule to exclude Claude Code attribution from
 PRs

---
 .claude/CLAUDE.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.claude/CLAUDE.md b/.claude/CLAUDE.md
index c71615802..4a886f21b 100644
--- a/.claude/CLAUDE.md
+++ b/.claude/CLAUDE.md
@@ -1,6 +1,7 @@
 ## Git
 
 - DO NOT include "Co-Authored-By" in commit messages.
+- DO NOT include "Generated with Claude Code" or any similar attribution in PR descriptions.
 
 ## Design Comments
 

From 498370997c9e39fb3f72e11df4e2cb8a0117f757 Mon Sep 17 00:00:00 2001
From: larryro <371767072@qq.com>
Date: Fri, 20 Mar 2026 20:05:11 +0800
Subject: [PATCH 8/9] feat(platform): strip leading punctuation from approval
 questions and clean up system messages

---
 .../chat/components/chat-messages.tsx         |  6 +--
 .../components/human-input-request-card.tsx   |  5 +-
 .../components/workflow-run-approval-card.tsx | 22 ++++++--
 services/platform/lib/utils/text.test.ts      | 50 +++++++++++++++++++
 services/platform/lib/utils/text.ts           |  5 ++
 5 files changed, 80 insertions(+), 8 deletions(-)
 create mode 100644 services/platform/lib/utils/text.test.ts
 create mode 100644 services/platform/lib/utils/text.ts

diff --git a/services/platform/app/features/chat/components/chat-messages.tsx b/services/platform/app/features/chat/components/chat-messages.tsx
index 606a6e34d..e083b7de6 100644
--- a/services/platform/app/features/chat/components/chat-messages.tsx
+++ b/services/platform/app/features/chat/components/chat-messages.tsx
@@ -15,8 +15,6 @@ import { ApprovalCardRenderer } from './approval-card-renderer';
 import { MessageBubble } from './message-bubble';
 import { ThinkingAnimation } from './thinking-animation';
 
-const PREVIEW_LENGTH = 80;
-
 const CollapsibleSystemMessage = memo(function CollapsibleSystemMessage({
   content,
 }: {
@@ -27,7 +25,7 @@ const CollapsibleSystemMessage = memo(function CollapsibleSystemMessage({
 
   const formatted = content.replace(
     /\[([A-Z][A-Z_]+)\]/g,
-    (_, tag: string) => `[${tag.replaceAll('_', ' ')}]`,
+    (_, tag: string) => `${tag.replaceAll('_', ' ')} -`,
   );
   const lines = formatted.split('\n');
   const nonEmptyLines = lines.filter((l) => l.trim() !== '');
@@ -35,7 +33,7 @@ const CollapsibleSystemMessage = memo(function CollapsibleSystemMessage({
   const preview = previewLines.join(' ');
   const lastPreviewIdx =
     previewLines.length > 0
-      ? lines.indexOf(previewLines[previewLines.length - 1]!)
+      ? lines.indexOf(previewLines[previewLines.length - 1])
       : 0;
   const rest = lines
     .slice(lastPreviewIdx + 1)
diff --git a/services/platform/app/features/chat/components/human-input-request-card.tsx b/services/platform/app/features/chat/components/human-input-request-card.tsx
index 193376592..7880d045d 100644
--- a/services/platform/app/features/chat/components/human-input-request-card.tsx
+++ b/services/platform/app/features/chat/components/human-input-request-card.tsx
@@ -21,6 +21,7 @@ import { Text } from '@/app/components/ui/typography/text';
 import { useFormatDate } from '@/app/hooks/use-format-date';
 import { useT } from '@/lib/i18n/client';
 import { cn } from '@/lib/utils/cn';
+import { stripLeadingPunctuation } from '@/lib/utils/text';
 
 import { useSubmitHumanInputResponse } from '../hooks/mutations';
 
@@ -284,7 +285,9 @@ function HumanInputRequestCardComponent({
 
       {/* Question */}
       <div className="mb-4">
-        <Text className="leading-relaxed">{metadata.question}</Text>
+        <Text className="leading-relaxed">
+          {stripLeadingPunctuation(metadata.question)}
+        </Text>
         {metadata.context && (
           <Text variant="caption" className="mt-2">
             {metadata.context}
diff --git a/services/platform/app/features/chat/components/workflow-run-approval-card.tsx b/services/platform/app/features/chat/components/workflow-run-approval-card.tsx
index 166103d02..2d56490c6 100644
--- a/services/platform/app/features/chat/components/workflow-run-approval-card.tsx
+++ b/services/platform/app/features/chat/components/workflow-run-approval-card.tsx
@@ -40,6 +40,9 @@ import {
 import { useAuth } from '@/app/hooks/use-convex-auth';
 import { useT } from '@/lib/i18n/client';
 import { cn } from '@/lib/utils/cn';
+import { stripLeadingPunctuation } from '@/lib/utils/text';
+
+import { markdownWrapperStyles } from './message-bubble/markdown-renderer';
 
 interface WorkflowRunApprovalCardProps {
   approvalId: Id<'approvals'>;
@@ -547,7 +550,10 @@ function WorkflowHumanInputSection({
   const { t } = useT('workflowRunApproval');
   const { t: tCommon } = useT('approvalCommon');
   const meta = approval.metadata ?? {};
-  const question = typeof meta.question === 'string' ? meta.question : '';
+  const question =
+    typeof meta.question === 'string'
+      ? stripLeadingPunctuation(meta.question)
+      : '';
   const context = typeof meta.context === 'string' ? meta.context : undefined;
   const format = typeof meta.format === 'string' ? meta.format : 'text_input';
   const rawOptions = Array.isArray(meta.options) ? meta.options : [];
@@ -581,12 +587,22 @@ function WorkflowHumanInputSection({
     <Stack gap={3} className="mb-3">
       <HStack gap={2} align="start">
         <MessageCircleQuestion className="text-primary mt-0.5 size-4 shrink-0" />
-        <div className="prose prose-sm dark:prose-invert prose-p:my-0.5 prose-ul:my-0.5 prose-ol:my-0.5 prose-li:my-0 max-w-none text-sm font-medium">
+        <div
+          className={cn(
+            markdownWrapperStyles,
+            'max-w-none text-sm font-medium',
+          )}
+        >
           <ReactMarkdown remarkPlugins={[remarkGfm]}>{question}</ReactMarkdown>
         </div>
       </HStack>
       {context && (
-        <div className="prose prose-sm dark:prose-invert prose-p:my-0.5 prose-ul:my-0.5 prose-li:my-0 text-muted-foreground max-w-none text-xs">
+        <div
+          className={cn(
+            markdownWrapperStyles,
+            'text-muted-foreground max-w-none text-xs',
+          )}
+        >
           <ReactMarkdown remarkPlugins={[remarkGfm]}>{context}</ReactMarkdown>
         </div>
       )}
diff --git a/services/platform/lib/utils/text.test.ts b/services/platform/lib/utils/text.test.ts
new file mode 100644
index 000000000..f7457802f
--- /dev/null
+++ b/services/platform/lib/utils/text.test.ts
@@ -0,0 +1,50 @@
+import { describe, expect, it } from 'vitest';
+
+import { stripLeadingPunctuation } from './text';
+
+describe('stripLeadingPunctuation', () => {
+  it('strips leading colon and space', () => {
+    expect(stripLeadingPunctuation(': hello')).toBe('hello');
+  });
+
+  it('strips leading full-width colon', () => {
+    expect(stripLeadingPunctuation('：hello')).toBe('hello');
+  });
+
+  it('strips multiple leading punctuation characters', () => {
+    expect(stripLeadingPunctuation(':：; hello')).toBe('hello');
+  });
+
+  it('strips leading dashes', () => {
+    expect(stripLeadingPunctuation('— hello')).toBe('hello');
+  });
+
+  it('strips leading dots and commas', () => {
+    expect(stripLeadingPunctuation('., hello')).toBe('hello');
+  });
+
+  it('strips leading whitespace', () => {
+    expect(stripLeadingPunctuation('  hello')).toBe('hello');
+  });
+
+  it('preserves text without leading punctuation', () => {
+    expect(stripLeadingPunctuation('hello world')).toBe('hello world');
+  });
+
+  it('preserves punctuation in the middle', () => {
+    expect(stripLeadingPunctuation('hello: world')).toBe('hello: world');
+  });
+
+  it('handles empty string', () => {
+    expect(stripLeadingPunctuation('')).toBe('');
+  });
+
+  it('handles string that is all punctuation', () => {
+    expect(stripLeadingPunctuation(':：;')).toBe('');
+  });
+
+  it('preserves numbered list content', () => {
+    const input = '请提供以下信息：\n1. 名称：\n2. 地址：';
+    expect(stripLeadingPunctuation(input)).toBe(input);
+  });
+});
diff --git a/services/platform/lib/utils/text.ts b/services/platform/lib/utils/text.ts
new file mode 100644
index 000000000..40e428b70
--- /dev/null
+++ b/services/platform/lib/utils/text.ts
@@ -0,0 +1,5 @@
+const LEADING_PUNCTUATION_RE = /^[\s:：;；,，.。!！?？…·\-—–]+/;
+
+export function stripLeadingPunctuation(text: string) {
+  return text.replace(LEADING_PUNCTUATION_RE, '');
+}

From 142a72b1ae0711e68409e16bd58b8acd2977e055 Mon Sep 17 00:00:00 2001
From: larryro <371767072@qq.com>
Date: Fri, 20 Mar 2026 20:15:12 +0800
Subject: [PATCH 9/9] fix(platform): resolve lint errors and update tests for
 atomic execution claim

Remove unused tCommon import, replace role="checkbox" with aria-pressed
on toggle buttons, and update test mocks to handle claimWorkflowApprovalForExecution.
---
 .../chat/components/human-input-request-card.tsx      |  3 +--
 .../chat/components/workflow-run-approval-card.tsx    |  4 +---
 .../execute_approved_workflow_update.test.ts          | 11 ++++++++++-
 3 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/services/platform/app/features/chat/components/human-input-request-card.tsx b/services/platform/app/features/chat/components/human-input-request-card.tsx
index 7880d045d..bc11ac647 100644
--- a/services/platform/app/features/chat/components/human-input-request-card.tsx
+++ b/services/platform/app/features/chat/components/human-input-request-card.tsx
@@ -199,8 +199,7 @@ function HumanInputRequestCardComponent({
                 <button
                   type="button"
                   key={value}
-                  role="checkbox"
-                  aria-checked={isChecked}
+                  aria-pressed={isChecked}
                   className={cn(
                     'flex items-start space-x-3 p-3 rounded-lg border transition-all cursor-pointer',
                     isChecked
diff --git a/services/platform/app/features/chat/components/workflow-run-approval-card.tsx b/services/platform/app/features/chat/components/workflow-run-approval-card.tsx
index 2d56490c6..0f83e1410 100644
--- a/services/platform/app/features/chat/components/workflow-run-approval-card.tsx
+++ b/services/platform/app/features/chat/components/workflow-run-approval-card.tsx
@@ -548,7 +548,6 @@ function WorkflowHumanInputSection({
   onSubmit,
 }: WorkflowHumanInputSectionProps) {
   const { t } = useT('workflowRunApproval');
-  const { t: tCommon } = useT('approvalCommon');
   const meta = approval.metadata ?? {};
   const question =
     typeof meta.question === 'string'
@@ -668,8 +667,7 @@ function WorkflowHumanInputSection({
             <button
               key={val}
               type="button"
-              role="checkbox"
-              aria-checked={isChecked}
+              aria-pressed={isChecked}
               className={cn(
                 'flex items-start gap-3 rounded-lg border p-3 text-left transition-all',
                 isChecked
diff --git a/services/platform/convex/agent_tools/workflows/__tests__/execute_approved_workflow_update.test.ts b/services/platform/convex/agent_tools/workflows/__tests__/execute_approved_workflow_update.test.ts
index fdb25ee4b..9c7106d99 100644
--- a/services/platform/convex/agent_tools/workflows/__tests__/execute_approved_workflow_update.test.ts
+++ b/services/platform/convex/agent_tools/workflows/__tests__/execute_approved_workflow_update.test.ts
@@ -23,6 +23,8 @@ vi.mock('../../../_generated/api', () => ({
     agent_tools: {
       workflows: {
         internal_mutations: {
+          claimWorkflowApprovalForExecution:
+            'mock-claimWorkflowApprovalForExecution',
           updateWorkflowUpdateApprovalWithResult:
             'mock-updateWorkflowUpdateApprovalWithResult',
           saveSystemMessage: 'mock-saveSystemMessage',
@@ -194,8 +196,12 @@ describe('executeApprovedWorkflowUpdate', () => {
 
   it('throws on double execution (idempotency guard)', async () => {
     const handler = await getHandler();
-    const approval = createMockApproval({ executedAt: Date.now() });
+    const approval = createMockApproval();
     const ctx = createMockCtx(approval);
+    ctx.runMutation = vi.fn().mockImplementation((ref: string) => {
+      if (ref === 'mock-claimWorkflowApprovalForExecution') return false;
+      return 'result-1';
+    });
 
     await expect(
       handler(ctx, { approvalId: 'approval-1', approvedBy: 'user-1' }),
@@ -258,6 +264,7 @@ describe('executeApprovedWorkflowUpdate', () => {
     const approval = createStepPatchApproval();
     const ctx = createMockCtx(approval);
     ctx.runMutation = vi.fn().mockImplementation((ref: string) => {
+      if (ref === 'mock-claimWorkflowApprovalForExecution') return true;
       if (ref === 'mock-patchStep') return null;
       return undefined;
     });
@@ -272,6 +279,7 @@ describe('executeApprovedWorkflowUpdate', () => {
     const approval = createMockApproval();
     const ctx = createMockCtx(approval);
     ctx.runMutation = vi.fn().mockImplementation((ref: string) => {
+      if (ref === 'mock-claimWorkflowApprovalForExecution') return true;
       if (ref === 'mock-saveWorkflowWithSteps') throw new Error('Save failed');
       return undefined;
     });
@@ -323,6 +331,7 @@ describe('executeApprovedWorkflowUpdate', () => {
     const ctx = createMockCtx(approval);
 
     ctx.runMutation = vi.fn().mockImplementation((ref: string) => {
+      if (ref === 'mock-claimWorkflowApprovalForExecution') return true;
       if (ref === 'mock-saveSystemMessage') {
         throw new Error('Message save failed');
       }