diff --git a/packages/sdk/src/actions/exec-approval.ts b/packages/sdk/src/actions/exec-approval.ts
index 80fb44d5..cd098273 100644
--- a/packages/sdk/src/actions/exec-approval.ts
+++ b/packages/sdk/src/actions/exec-approval.ts
@@ -22,7 +22,7 @@ export interface ExecApprovalRequestPayload {
   riskLevel: "safe" | "needs-review" | "dangerous";
   /** Reasons for the risk assessment */
   riskReasons: string[];
-  /** When this approval expires (ms since epoch) */
+  /** When this approval expires (ms since epoch). -1 means no timeout. */
   expiresAtMs: number;
 }
 
diff --git a/packages/ui/src/components/exec-approval-item.tsx b/packages/ui/src/components/exec-approval-item.tsx
index 4487e0f3..662d6136 100644
--- a/packages/ui/src/components/exec-approval-item.tsx
+++ b/packages/ui/src/components/exec-approval-item.tsx
@@ -20,12 +20,17 @@ export interface ExecApprovalItemProps {
   onDecision: (decision: "allow-once" | "allow-always" | "deny") => void
 }
 
-function useCountdown(expiresAtMs: number): number {
-  const [remaining, setRemaining] = useState(() =>
-    Math.max(0, Math.ceil((expiresAtMs - Date.now()) / 1000)),
+function useCountdown(expiresAtMs: number): number | null {
+  const [remaining, setRemaining] = useState<number | null>(() =>
+    expiresAtMs < 0 ? null : Math.max(0, Math.ceil((expiresAtMs - Date.now()) / 1000)),
   )
 
   useEffect(() => {
+    if (expiresAtMs < 0) {
+      setRemaining(null)
+      return
+    }
+
     const id = setInterval(() => {
       const next = Math.max(0, Math.ceil((expiresAtMs - Date.now()) / 1000))
       setRemaining(next)
@@ -73,7 +78,7 @@ export const ExecApprovalItem = memo(function ExecApprovalItem({
             <HugeiconsIcon icon={CommandLineIcon} strokeWidth={2} className="size-3.5 shrink-0" />
             <span className="font-medium text-foreground">{riskLabel}</span>
           </div>
-          {remaining > 0 && !decided && (
+          {remaining !== null && remaining > 0 && !decided && (
             <span className="text-xs text-muted-foreground/60 font-[tabular-nums]">
               {remaining}s
             </span>
@@ -100,7 +105,7 @@ export const ExecApprovalItem = memo(function ExecApprovalItem({
         )}
 
         {/* Actions */}
-        {!decided && remaining > 0 ? (
+        {!decided && (remaining === null || remaining > 0) ? (
           <div className="flex items-center gap-2">
             <Button
               variant="outline"
diff --git a/src/agent/tools/exec-approval-types.ts b/src/agent/tools/exec-approval-types.ts
index cea40b52..51685dbc 100644
--- a/src/agent/tools/exec-approval-types.ts
+++ b/src/agent/tools/exec-approval-types.ts
@@ -32,7 +32,7 @@ export interface ExecApprovalRequest {
   riskLevel: "safe" | "needs-review" | "dangerous";
   /** Reasons for the risk assessment */
   riskReasons: string[];
-  /** When this approval expires (ms since epoch) */
+  /** When this approval expires (ms since epoch). -1 means no timeout. */
   expiresAtMs: number;
 }
 
diff --git a/src/hub/exec-approval-manager.test.ts b/src/hub/exec-approval-manager.test.ts
index 79ac55d0..27033022 100644
--- a/src/hub/exec-approval-manager.test.ts
+++ b/src/hub/exec-approval-manager.test.ts
@@ -88,6 +88,27 @@ describe("ExecApprovalManager", () => {
     expect(result.decision).toBe("deny");
   });
 
+  it("keeps approval pending indefinitely when timeoutMs is -1", async () => {
+    const promise = manager.requestApproval({
+      agentId: "agent-1",
+      command: "cmd",
+      riskLevel: "needs-review",
+      riskReasons: [],
+      timeoutMs: -1,
+    });
+
+    const request = sendToClient.mock.calls[0]![1];
+    expect(request.expiresAtMs).toBe(-1);
+
+    vi.advanceTimersByTime(60_000);
+    expect(manager.pendingCount).toBe(1);
+
+    manager.resolveApproval(request.approvalId, "allow-once");
+    const result = await promise;
+    expect(result.approved).toBe(true);
+    expect(result.decision).toBe("allow-once");
+  });
+
   it("honors askFallback full on timeout", async () => {
     const promise = manager.requestApproval({
       agentId: "agent-1",