chainlesschain 0.162.157 → 0.162.159

package/src/repl/remote-approval.js

@@ -0,0 +1,111 @@
+/**
+ * REPL-side remote-approval glue (gap-analysis 批26 — 批17/18 REPL 遗留收口).
+ *
+ * Interactive sessions race the LOCAL terminal prompt against a paired
+ * device's decision (headless gates on the remote decision alone):
+ *
+ *   - local answer first  → settle the device card too (resolveLocally
+ *     publishes permission.resolved so the phone/web UI clears it)
+ *   - remote answer first → cancel the local readline prompt and print
+ *     the outcome
+ *   - remote leg times out or the bridge closes mid-ask → NOT a decision:
+ *     keep waiting on the terminal. A silent phone must never auto-deny a
+ *     user sitting at the keyboard — the fail-closed timeout is headless
+ *     semantics only.
+ *
+ * Pure over an injected bridge + local prompt handle ({promise, cancel}),
+ * so the race is unit-testable without a WS server or readline.
+ */
+
+/**
+ * Normalize the shapes the REPL's two confirmers receive (ApprovalGate
+ * `{tool, args, riskLevel}` / settings-hook `{tool, args, rule, reason}`)
+ * into the bridge's `{tool, action, detail}` ask payload.
+ */
+export function describeAskContext({
+  tool,
+  args,
+  rule = null,
+  reason = null,
+  riskLevel = null,
+} = {}) {
+  const detail =
+    typeof args?.command === "string"
+      ? args.command
+      : typeof args?.path === "string"
+        ? args.path
+        : args
+          ? JSON.stringify(args).slice(0, 2000)
+          : null;
+  return {
+    tool: tool || null,
+    action: rule
+      ? `ask-rule:${rule}`
+      : reason || (riskLevel ? `${riskLevel}-risk` : null),
+    detail,
+  };
+}
+
+// Remote outcomes that are NOT a decision for an interactive session: the
+// devices went silent (timeout) or the bridge was torn down mid-ask (closed).
+const NON_DECISIVE_REMOTE = new Set(["timeout", "closed"]);
+
+/**
+ * Race the local interactive prompt against the paired-device decision.
+ *
+ * @param {object} opts
+ * @param {import("../lib/remote-approval-bridge.js").RemoteApprovalBridge} opts.bridge
+ * @param {{tool?, action?, detail?}} opts.ask - describeAskContext() payload
+ * @param {{promise: Promise<boolean>, cancel?: () => void}} opts.local -
+ *   the already-started local prompt; `cancel` closes its readline when the
+ *   device answers first (implementations must mute their idle-timeout
+ *   message after cancel).
+ * @param {(text: string) => void} [opts.writeOut]
+ * @returns {Promise<boolean>} approved
+ */
+export async function raceLocalAndRemote({
+  bridge,
+  ask = {},
+  local,
+  writeOut = () => {},
+}) {
+  let requestId = null;
+  const remoteLeg = bridge
+    .requestDecision({
+      ...ask,
+      onRequestId: (id) => {
+        requestId = id;
+      },
+    })
+    .then((decision) => ({ src: "remote", decision }));
+  const localLeg = local.promise.then(
+    (approved) => ({ src: "local", approved: approved === true }),
+    () => ({ src: "local", approved: false }),
+  );
+  let winner = await Promise.race([remoteLeg, localLeg]);
+  if (
+    winner.src === "remote" &&
+    NON_DECISIVE_REMOTE.has(winner.decision?.via)
+  ) {
+    winner = await localLeg;
+  }
+  if (winner.src === "local") {
+    if (requestId) {
+      try {
+        bridge.resolveLocally(requestId, winner.approved);
+      } catch {
+        // clearing the device card is best-effort
+      }
+    }
+    return winner.approved;
+  }
+  try {
+    local.cancel?.();
+  } catch {
+    // readline already closed
+  }
+  writeOut(
+    `\n  ✓ ${winner.decision.approved ? "allowed" : "denied"} from paired device\n`,
+  );
+  return winner.decision.approved === true;
+}

package/src/repl/slash-command-registry.js

@@ -35,7 +35,13 @@ export class SlashCommandRegistry {
   }
 
   getCommand(name) {
-    return this._commands.get(name);
+    const direct = this._commands.get(name);
+    if (direct) return direct;
+    // Alias resolution: a command registered with aliases answers to them too.
+    for (const cmd of this._commands.values()) {
+      if (cmd.aliases && cmd.aliases.includes(name)) return cmd;
+    }
+    return undefined;
   }
 
   getAllCommands() {
@@ -43,7 +49,7 @@ export class SlashCommandRegistry {
   }
 
   hasCommand(name) {
-    return this._commands.has(name);
+    return Boolean(this.getCommand(name));
   }
 
   _registerBuiltinCommands() {
@@ -188,8 +194,10 @@ export class SlashCommandRegistry {
       ],
     ];
 
+    // Claude-Code 2.1.205 parity: /checkup is an alias of /doctor.
+    const ALIASES = { "/doctor": ["/checkup"] };
     for (const [name, description, handler] of commands) {
-      this.register(name, { description, handler });
+      this.register(name, { description, handler, aliases: ALIASES[name] });
     }
   }
 }

package/src/repl/voice-dictation.js

@@ -0,0 +1,132 @@
+/**
+ * Voice dictation for the agent REPL (gap-2026-07-11 P2#11).
+ *
+ * Claude Code's `/voice` dictates a prompt by speech. cc generalizes it to a
+ * pluggable STT backend with a strict local-first priority so nothing leaves
+ * the box unless the user opts into cloud transcription:
+ *
+ *   local Whisper  >  system STT (OS dictation)  >  cloud (opt-in)
+ *
+ * Two capture modes mirror the upstream UX:
+ *   - hold : push-to-talk — record while a key is held, transcribe on release.
+ *   - tap  : toggle — tap to start, tap again to stop.
+ *
+ * Real audio capture is a host binding (a Whisper binary, an OS dictation API);
+ * it is injected, so on a host with no backend — or a headless/SSH session where
+ * there is no microphone — `/voice` degrades to a clear message instead of
+ * pretending to listen. This module is the pure decision core (mode/command
+ * parse, environment degradation, backend priority, status render).
+ */
+
+export const VOICE_MODES = Object.freeze(["off", "hold", "tap"]);
+export const DEFAULT_VOICE_MODE = "off";
+
+/**
+ * STT backends in priority order. `local` never sends audio off the box;
+ * `cloud` requires explicit opt-in (config voice.allowCloud). Each entry names
+ * the capability probe the host binding fills in.
+ */
+export const STT_BACKENDS = Object.freeze([
+  { id: "whisper-local", kind: "local", label: "local Whisper" },
+  { id: "system-stt", kind: "system", label: "system STT" },
+  { id: "cloud", kind: "cloud", label: "cloud transcription" },
+]);
+
+/**
+ * Parse `/voice [hold|tap|off|status]`. Returns null for non-/voice input,
+ * `{ error }` for a bad arg, else `{ action }`. Bare `/voice` shows status.
+ * Pure.
+ */
+export function parseVoiceCommand(input) {
+  const t = String(input || "").trim();
+  if (t !== "/voice" && !t.startsWith("/voice ")) return null;
+  const arg = t.slice("/voice".length).trim().toLowerCase();
+  if (!arg || arg === "status") return { action: "status" };
+  if (arg === "hold" || arg === "ptt" || arg === "push")
+    return { action: "hold" };
+  if (arg === "tap" || arg === "toggle") return { action: "tap" };
+  if (arg === "off" || arg === "stop" || arg === "0") return { action: "off" };
+  return {
+    error: `Unknown /voice option "${arg}". Use: hold | tap | off | status`,
+  };
+}
+
+/**
+ * Decide whether voice capture is usable in this environment. Headless / SSH /
+ * CI sessions have no local microphone, so dictation degrades. Pure over the
+ * passed env + tty flags.
+ * @returns {{ supported, reason }}
+ */
+export function detectVoiceEnvironment({ env = {}, isTTY = true } = {}) {
+  if (!isTTY) {
+    return {
+      supported: false,
+      reason: "not a TTY — no interactive microphone",
+    };
+  }
+  if (env.SSH_TTY || env.SSH_CONNECTION) {
+    return {
+      supported: false,
+      reason:
+        "remote SSH session — capture audio locally and paste, or use a cloud STT relay",
+    };
+  }
+  if (isTruthy(env.CI)) {
+    return { supported: false, reason: "CI environment — no microphone" };
+  }
+  if (isTruthy(env.CC_NO_VOICE)) {
+    return { supported: false, reason: "disabled via CC_NO_VOICE" };
+  }
+  return { supported: true, reason: "" };
+}
+
+/**
+ * Pick the highest-priority available STT backend. `available` is a map of
+ * backend id → boolean from the host capability probe. Cloud is only eligible
+ * when `allowCloud` is true (config voice.allowCloud). Returns
+ * `{ backend, reason }` or `{ backend: null, reason }`. Pure.
+ */
+export function resolveSttBackend({
+  available = {},
+  allowCloud = false,
+  prefer = null,
+} = {}) {
+  const eligible = STT_BACKENDS.filter((b) => {
+    if (!available[b.id]) return false;
+    if (b.kind === "cloud" && !allowCloud) return false;
+    return true;
+  });
+  if (eligible.length === 0) {
+    return {
+      backend: null,
+      reason:
+        "no STT backend available — install a local Whisper build or enable system dictation (voice.allowCloud for cloud)",
+    };
+  }
+  // Honor an explicit preference if it's eligible; else take the top priority.
+  const chosen =
+    (prefer && eligible.find((b) => b.id === prefer)) || eligible[0];
+  return { backend: chosen, reason: `using ${chosen.label}` };
+}
+
+/** One-line `/voice status`. Pure. */
+export function renderVoiceStatus({ mode = "off", backend = null, env } = {}) {
+  const m = VOICE_MODES.includes(mode) ? mode : "off";
+  if (env && !env.supported) {
+    return `Voice: unavailable — ${env.reason}.`;
+  }
+  if (m === "off") {
+    return "Voice: off. /voice hold (push-to-talk) or /voice tap (toggle).";
+  }
+  const be = backend ? backend.label : "no backend";
+  const how =
+    m === "hold" ? "hold the dictation key to talk" : "tap to start/stop";
+  return `Voice: ${m} — ${how}; ${be}.`;
+}
+
+function isTruthy(v) {
+  const n = String(v == null ? "" : v)
+    .toLowerCase()
+    .trim();
+  return n === "1" || n === "true" || n === "yes" || n === "on";
+}

package/src/runtime/agent-core.js

@@ -1291,6 +1291,38 @@ export async function executeTool(name, args, context = {}) {
     }
   }
 
+  // Session-store write guard (transcript tamper protection): JSONL
+  // transcripts under ~/.chainlesschain/sessions are hash-chained and treated
+  // as an audit surface — an agent editing a transcript rewrites the history
+  // that `cc session verify` and resume trust. Same posture as the
+  // sensitive-file guard: confirm-first, an explicit settings `allow` rule is
+  // the only bypass, headless without a confirmer fails closed.
+  if (
+    (name === "write_file" ||
+      name === "edit_file" ||
+      name === "notebook_edit") &&
+    settingsVerdict.decision !== "allow" &&
+    args?.path
+  ) {
+    const { sessionStorePathReason } =
+      await import("../lib/session-store-guard.js");
+    const storeReason = sessionStorePathReason(args.path, { cwd });
+    if (storeReason) {
+      const ok = await requestInteractivePermission(name, args, context, cwd, {
+        tool: name,
+        args,
+        rule: null,
+        reason: `session store: ${storeReason}`,
+      });
+      if (!ok) {
+        return {
+          error: `[Session Store] Writing "${args.path}" would modify a session transcript (${storeReason}) — denied. Add a settings allow rule to pre-authorize.`,
+          policy: { decision: "ask", via: "session-store-guard" },
+        };
+      }
+    }
+  }
+
   // Destructive-git guard (Claude-Code 2.1.183 parity: "destructive git
   // commands blocked when unintended"). The `git` tool otherwise runs any
   // command unguarded in auto mode — including `reset --hard`, `clean -fd`,
@@ -1438,6 +1470,14 @@ export async function executeTool(name, args, context = {}) {
       parentMessages: context.parentMessages,
       interaction: context.interaction,
       sessionId: context.sessionId || null,
+      // Parent LLM config — documented at toolContext as forwarded to
+      // spawn_sub_agent for provider/key inheritance; without this line it
+      // never actually reached executeToolInner (sub-agents silently fell
+      // back to config defaults and their usage was mis-attributed).
+      llmOptions: context.llmOptions || null,
+      // 用量归因: shared per-run sink for child-loop (sub-agent / isolated
+      // skill) token usage, drained by agentLoop as attributed events.
+      subAgentUsageSink: context.subAgentUsageSink || null,
       hostManagedToolPolicy: context.hostManagedToolPolicy || null,
       externalToolDescriptors: context.externalToolDescriptors || null,
       externalToolExecutors: context.externalToolExecutors || null,
@@ -2074,6 +2114,7 @@ async function executeToolInner(
     settingsHooks = null,
     signal = null,
     backgroundSubAgents = null,
+    subAgentUsageSink = null,
   },
 ) {
   const localToolDescriptor =
@@ -2706,6 +2747,21 @@ async function executeToolInner(
           }
           output = res.stdout ?? "";
         }
+        // PR/session linking (gap-2026-07-11 P1#9): a successful `gh pr …`
+        // (or `git push`) ties this session to the PR it touched. Async and
+        // best-effort — never delays or fails the tool result.
+        if (sessionId) {
+          import("../lib/pr-link-ledger.js")
+            .then((m) =>
+              m.recordFromShellCommand({
+                sessionId,
+                command: args.command,
+                output: String(output || ""),
+                cwd: args.cwd || cwd,
+              }),
+            )
+            .catch(() => {});
+        }
         return attachDescriptor(
           {
             stdout: output.substring(0, 30000),
@@ -2883,6 +2939,7 @@ async function executeToolInner(
           settingsHooks,
           signal,
           backgroundSubAgents,
+          subAgentUsageSink,
         }),
       );
     }
@@ -3187,6 +3244,111 @@ async function executeToolInner(
       }
     }
 
+    case "browser_state": {
+      // P1 #8: first-class Chrome CDP observation — the agent side of the
+      // "locate error → fix → verify" web loop against the user's real,
+      // logged-in browser (`cc browse chrome launch`). DOM is capped harder
+      // than the CLI command's 150k default so a page dump cannot flood the
+      // conversation; screenshots go to a generated temp file (never an
+      // agent-chosen path) to keep the tool strictly read-only.
+      try {
+        const { captureState } = await import("../lib/chrome-connector.js");
+        const screenshotPath = args.screenshot
+          ? path.join(os.tmpdir(), `cc-browser-state-${Date.now()}.png`)
+          : null;
+        const state = await captureState({
+          port: args.port != null ? Number(args.port) : undefined,
+          tab: args.tab != null ? Number(args.tab) : undefined,
+          reload: args.reload === true,
+          watchMs: args.watch_ms != null ? Number(args.watch_ms) : undefined,
+          includeDom: args.include_dom !== false,
+          domCap: args.dom_cap != null ? Number(args.dom_cap) : 40000,
+          screenshotPath,
+        });
+        if (!state.ok) {
+          return attachDescriptor({
+            error: `browser_state failed: ${state.error}`,
+          });
+        }
+        return attachDescriptor(state);
+      } catch (err) {
+        return attachDescriptor({
+          error: `browser_state failed: ${err.message}`,
+        });
+      }
+    }
+
+    case "browser_act": {
+      // Gap-analysis #6: the ACTION side of the Chrome connector.
+      // browser_state stays the read-only default; browser_act explicitly
+      // drives the user's logged-in browser (click/type/press/navigate/
+      // waitForSelector/screenshot/assertText) and is gated like run_code:
+      // HIGH risk through the ApprovalGate (CONFIRM even on the trusted/auto
+      // tier), pre-authorizable only by an explicit settings allow rule
+      // (ruleAllowed). Unlike run_code there is no legacy ungated behavior to
+      // preserve, so the gate applies whenever an ApprovalGate is wired —
+      // headless without a confirmer fails closed. Screenshot paths are
+      // generated inside performActions (never agent-chosen), and each
+      // executed step is audit-logged to ~/.chainlesschain/browser-actions/.
+      try {
+        if (
+          approvalGate &&
+          !ruleAllowed &&
+          typeof approvalGate.decide === "function"
+        ) {
+          const { APPROVAL_RISK, APPROVAL_DECISION } =
+            await import("@chainlesschain/session-core");
+          const summary = Array.isArray(args.actions)
+            ? args.actions
+                .map((a) => a?.type)
+                .filter(Boolean)
+                .slice(0, 10)
+                .join(",")
+            : "";
+          const gate = await approvalGate.decide({
+            sessionId,
+            riskLevel: APPROVAL_RISK.HIGH,
+            tool: "browser_act",
+            args: { actions: summary },
+          });
+          if (gate.decision !== APPROVAL_DECISION.ALLOW) {
+            const tierLabel =
+              typeof gate.policy === "string" ? `"${gate.policy}" ` : "";
+            return attachDescriptor({
+              error: `[ApprovalGate] browser_act denied by the ${tierLabel}approval policy (via ${gate.via}). Retrying won't help — driving the user's browser needs their approval. Tell the user (they can approve it or relax the policy) and continue with other work.`,
+              approval: {
+                decision: gate.decision,
+                via: gate.via,
+                riskLevel: "high",
+                policy: gate.policy,
+              },
+            });
+          }
+        }
+        const { performActions } = await import("../lib/chrome-connector.js");
+        const result = await performActions(args.actions, {
+          port: args.port != null ? Number(args.port) : undefined,
+          cdpUrl: args.cdp_url != null ? String(args.cdp_url) : null,
+          tab: args.tab != null ? Number(args.tab) : undefined,
+          continueOnError: args.continue_on_error === true,
+          sessionId: sessionId ? String(sessionId) : null,
+        });
+        if (!result.ok && result.error) {
+          // Nothing ran (validation / attach failure) — surface as an error.
+          // A step-level failure returns the per-step outcomes instead so the
+          // model can see exactly which step broke.
+          return attachDescriptor({
+            error: `browser_act failed: ${result.error}`,
+          });
+        }
+        return attachDescriptor(result);
+      } catch (err) {
+        return attachDescriptor({
+          error: `browser_act failed: ${err.message}`,
+        });
+      }
+    }
+
     case "search_files": {
       // An explicit directory scopes the search to one root; otherwise span
       // cwd plus any --add-dir roots so cross-package searches find matches.
@@ -3395,13 +3557,46 @@ async function executeToolInner(
       // Check if skill requests isolation (via SKILL.md frontmatter)
       const skillIsolation = match.isolation === true;
       if (skillIsolation) {
+        // 用量归因: an isolated skill runs as a child loop whose real token
+        // usage would otherwise be invisible — forward it into the parent
+        // run's sink tagged origin:"skill" so `cc session usage --by skill`
+        // can break it out. A nested frame passes through unchanged.
+        const skillUsageSink = Array.isArray(subAgentUsageSink)
+          ? subAgentUsageSink
+          : null;
+        let skillSubRef = null;
         // Run skill through isolated sub-agent context
         const subCtx = SubAgentContext.create({
           role: `skill-${args.skill_name}`,
           task: `Execute the "${args.skill_name}" skill with input: ${(args.input || "").substring(0, 200)}`,
           allowedTools: ["read_file", "search_files", "list_dir"],
           cwd,
+          onUsage: skillUsageSink
+            ? (u) => {
+                try {
+                  skillUsageSink.push(
+                    u && u.attribution
+                      ? u
+                      : {
+                          provider: u?.provider ?? null,
+                          model: u?.model ?? null,
+                          usage: u?.usage || null,
+                          attribution: {
+                            origin: "skill",
+                            skill: args.skill_name,
+                            subagentId: skillSubRef?.id || null,
+                            parentSessionId: sessionId || null,
+                            depth: (subAgentDepth || 0) + 1,
+                          },
+                        },
+                  );
+                } catch (_e) {
+                  // usage forwarding is best-effort
+                }
+              }
+            : null,
         });
+        skillSubRef = subCtx;
         try {
           const result = await subCtx.run(args.input);
           return attachDescriptor({
@@ -3986,6 +4181,27 @@ function _backgroundSubAgentResultText(entry) {
   );
 }
 
+/**
+ * Drain the run's attributed child-loop usage sink (spawn_sub_agent /
+ * isolated run_skill — see toolContext.subAgentUsageSink), re-yielding each
+ * record as a regular `token-usage` event that carries its `attribution`
+ * frame. Consumers that ignore `attribution` see ordinary usage events;
+ * attribution-aware consumers (REPL persistence, headless runner) can split
+ * child spend from the main conversation's.
+ */
+function* _drainSubAgentUsage(sink) {
+  while (Array.isArray(sink) && sink.length > 0) {
+    const u = sink.shift();
+    yield {
+      type: "token-usage",
+      provider: u?.provider ?? null,
+      model: u?.model ?? null,
+      usage: u?.usage || {},
+      attribution: u?.attribution || null,
+    };
+  }
+}
+
 async function _executeSpawnSubAgent(args, ctx) {
   // Nesting cap: refuse before any context/registry work.
   const currentDepth = ctx.subAgentDepth || 0;
@@ -4135,6 +4351,40 @@ async function _executeSpawnSubAgent(args, ctx) {
     model: mdModel || parentLlm.model || undefined,
   };
 
+  // 用量归因: forward the child's real token usage into the parent run's sink
+  // (threaded through toolContext) so agentLoop re-yields it as attributed
+  // `token-usage` events. A nested child's already-attributed record passes
+  // through unchanged (deepest frame wins). subCtxRef closes over the created
+  // context so the frame can carry the sub-agent's id.
+  const usageSink = Array.isArray(ctx.subAgentUsageSink)
+    ? ctx.subAgentUsageSink
+    : null;
+  let subCtxRef = null;
+  const onUsage = usageSink
+    ? (u) => {
+        try {
+          usageSink.push(
+            u && u.attribution
+              ? u
+              : {
+                  provider: u?.provider ?? null,
+                  model: u?.model ?? null,
+                  usage: u?.usage || null,
+                  attribution: {
+                    origin: "subagent",
+                    subagentId: subCtxRef?.id || null,
+                    role: subCtxRef?.role || role || null,
+                    parentSessionId,
+                    depth: currentDepth + 1,
+                  },
+                },
+          );
+        } catch (_e) {
+          // usage forwarding is best-effort
+        }
+      }
+    : null;
+
   const subCtx = SubAgentContext.create({
     role,
     task,
@@ -4148,7 +4398,9 @@ async function _executeSpawnSubAgent(args, ctx) {
     // Same shared counter object so the child's own spawns draw from the run's
     // single total-sub-agent pool (breadth cap spans the whole tree).
     subAgentBudget: ctx.subAgentBudget || null,
+    onUsage,
   });
+  subCtxRef = subCtx;
 
   const emit = (type, payload) => {
     if (!interaction || typeof interaction.emit !== "function") return;
@@ -5759,8 +6011,18 @@ export async function* agentLoop(messages, options) {
     // any are still running (it waits, injects, and gives the model one more
     // turn) so a background result can never be silently lost.
     backgroundSubAgents: new Map(),
+    // 用量归因: per-run sink for child-loop (spawn_sub_agent / isolated
+    // run_skill) token usage. Child loops consume their own generator events,
+    // so their real usage never reaches this loop's consumers — the spawn
+    // wiring pushes it here and the loop drains it at iteration boundaries as
+    // `token-usage` events carrying an `attribution` frame. Callers may pass
+    // their own array to observe it directly.
+    subAgentUsageSink: Array.isArray(options.subAgentUsageSink)
+      ? options.subAgentUsageSink
+      : [],
   };
   const backgroundSubAgents = toolContext.backgroundSubAgents;
+  const subAgentUsageSink = toolContext.subAgentUsageSink;
 
   throwIfAborted(signal);
 
@@ -5896,6 +6158,10 @@ export async function* agentLoop(messages, options) {
     budget.consume();
     throwIfAborted(signal);
 
+    // Surface attributed child-loop usage collected since the last boundary
+    // (blocking spawns push during executeTool; background spawns push live).
+    yield* _drainSubAgentUsage(subAgentUsageSink);
+
     // Emit progressive warnings (once per level)
     const level = budget.warningLevel();
     if (
@@ -6470,7 +6736,9 @@ export async function* agentLoop(messages, options) {
     }
   }
 
-  // Budget exhausted — yield exhaustion event + final message
+  // Budget exhausted — flush any child usage the final iteration produced,
+  // then yield exhaustion event + final message
+  yield* _drainSubAgentUsage(subAgentUsageSink);
   yield { type: "iteration-budget-exhausted", budget: budget.toSummary() };
   yield {
     type: "response-complete",
@@ -6523,6 +6791,15 @@ export function formatToolArgs(name, args) {
       return `${args.level || "info"}: ${(args.title || "").substring(0, 50)}`;
     case "publish_artifact":
       return `${args.kind || "other"}: ${(args.title || args.path || "").substring(0, 60)}`;
+    case "browser_state":
+      return `tab=${args.tab ?? 0} port=${args.port ?? 9222}${args.reload ? " reload" : ""}`;
+    case "browser_act": {
+      const kinds = Array.isArray(args.actions)
+        ? args.actions.map((a) => a?.type).filter(Boolean)
+        : [];
+      const head = kinds.slice(0, 4).join(",");
+      return `${kinds.length} action(s)${head ? `: ${head}` : ""}${kinds.length > 4 ? ",…" : ""} tab=${args.tab ?? 0} port=${args.port ?? 9222}`;
+    }
     case "schedule":
       return args.action === "cron"
         ? `cron ${args.cron || ""}`.trim()