diff --git a/data/scripts/o b/data/scripts/o
index d33e14a..571a930 100755
--- a/data/scripts/o
+++ b/data/scripts/o
@@ -41,7 +41,7 @@ CTX_SESSION=""   # Session name if in session/agent context
 CTX_AGENT=""     # Agent name if in agent context
 
 # ── Known commands (to distinguish from context) ─────────────────
-COMMANDS="read write rdwr ls new ctl prompt log tui env generate overview help"
+COMMANDS="read write rdwr ls new ctl prompt log tui env generate overview approve deny help"
 
 is_command() {
     local arg="$1"
@@ -275,6 +275,62 @@ cmd_log() {
     ollie-9p read "${PREFIX}/log" | tail -n "$lines"
 }
 
+cmd_approve() {
+    if [[ -z "$CTX_SESSION" ]]; then
+        echo "error: approve requires session context" >&2
+        echo "  usage: o <session> approve" >&2
+        exit 1
+    fi
+    local bypass_path="session/$CTX_SESSION/bypass"
+    local pending
+    pending=$(ollie-9p read "$bypass_path" 2>/dev/null || true)
+    if [[ -z "$pending" ]]; then
+        echo "no pending bypass request"
+        return 0
+    fi
+    local id
+    id=$(echo "$pending" | jq -r '.id' 2>/dev/null)
+    if [[ -z "$id" || "$id" == "null" ]]; then
+        echo "error: could not parse bypass request" >&2
+        exit 1
+    fi
+    local cmd cwd
+    cmd=$(echo "$pending" | jq -r '.cmd' 2>/dev/null)
+    cwd=$(echo "$pending" | jq -r '.cwd' 2>/dev/null)
+    echo "approving: $cmd"
+    echo "      cwd: $cwd"
+    printf '%s approve' "$id" | ollie-9p write "$bypass_path"
+    echo "approved"
+}
+
+cmd_deny() {
+    if [[ -z "$CTX_SESSION" ]]; then
+        echo "error: deny requires session context" >&2
+        echo "  usage: o <session> deny" >&2
+        exit 1
+    fi
+    local bypass_path="session/$CTX_SESSION/bypass"
+    local pending
+    pending=$(ollie-9p read "$bypass_path" 2>/dev/null || true)
+    if [[ -z "$pending" ]]; then
+        echo "no pending bypass request"
+        return 0
+    fi
+    local id
+    id=$(echo "$pending" | jq -r '.id' 2>/dev/null)
+    if [[ -z "$id" || "$id" == "null" ]]; then
+        echo "error: could not parse bypass request" >&2
+        exit 1
+    fi
+    local cmd cwd
+    cmd=$(echo "$pending" | jq -r '.cmd' 2>/dev/null)
+    cwd=$(echo "$pending" | jq -r '.cwd' 2>/dev/null)
+    echo "denying: $cmd"
+    echo "    cwd: $cwd"
+    printf '%s deny' "$id" | ollie-9p write "$bypass_path"
+    echo "denied"
+}
+
 cmd_new() {
     if [[ -z "$CTX_AGENT" ]]; then
         echo "usage: o <session>/<agent> new [cwd]" >&2
@@ -400,6 +456,8 @@ Commands (availability depends on context):
   Session level (o <session> ...):
     ls                    List session contents (agents, config)
     ctl <cmd>             Session control (kill, pause, resume)
+    approve               Approve pending bypass request
+    deny                  Deny pending bypass request
     read/write <path>     Access session files
 
   Agent level (o <session>/<agent> ...):
@@ -409,6 +467,8 @@ Commands (availability depends on context):
     prompt                Interactive multi-line prompt REPL
     log [-n N]            Show last N lines of agent log
     tui                   Launch tmux layout
+    approve               Approve pending bypass request (session-level)
+    deny                  Deny pending bypass request (session-level)
     read/write <path>     Access agent files (chat, cfg, etc.)
 
   Common:
@@ -425,7 +485,8 @@ Examples:
   o myproj ls                 # list session contents
   o myproj/coding prompt      # interactive prompt
   o myproj/coding read chat   # read chat stream
-  o myproj/coding ls /bypass  # list root bypass/ from agent context
+  o myproj approve            # approve pending bypass
+  o myproj/coding approve     # same (bypass is per-session)
   o generate "explain monads" # one-shot, no session
 EOF
 }
@@ -447,6 +508,8 @@ dispatch_cmd() {
         tui)      cmd_tui "$@" ;;
         env)      cmd_env "$@" ;;
         overview) cmd_overview "$@" ;;
+        approve)  cmd_approve "$@" ;;
+        deny)     cmd_deny "$@" ;;
         help|-h|--help) cmd_help ;;
         *)
             echo "unknown command: $cmd" >&2