What

Two small additions to browser_execute:

A5 (light) — adds ctx.ask({ permission: "browser_execute", patterns: ["*"], always: ["*"], metadata: {} }) to the Level-2 wrapper. The default agent ruleset has "*": "allow" (agent.ts:88) so this auto-allows by default — no user-visible change. But it makes opencode.json's existing controls work:

{
  "tools": { "browser_execute": false }       // deny
  "permission": { "browser_execute": "ask" }  // prompt every call
}

A7 — streaming output to TUI. Adds an optional onChunk hook on Level-1 ExecuteContext invoked with the accumulated output on every stream chunk. Level 2 supplies a hook that calls ctx.metadata({ metadata: { output: preview(...) }}), mirroring bash.ts exactly (preview tail-truncates to 30k chars). The TUI's existing metadata subscription renders incremental output live.

Why this shape

• Level 1 stays free of opencode types (Tool.Context, ctx.metadata). The hook is a generic Effect.Effect<void> callback, keeping the Level-1 surface portable.
• onChunk receives full accumulated output, not deltas. Simpler for "set current output" semantics; matches how bash drives ctx.metadata.
• Stream.runForEach instead of Stream.mkString. Same Effect.all([drain, exitCode], { concurrency: 2 }) shape.

Tests on the sprite

• bun run typecheck (filtered turbo) — 5/5 pass.
• Streaming smoke (Level-1 with onChunk): 4 chunks delivered during a run; final output and exitCode unchanged.
• uv-missing path: 0 chunks (short-circuits before stream), exit 127, hint returned.
• Happy path: full output captured, real exit code returned.

Roadmap

• A5 (full session-level permission prompt) deferred — browser tools are on by default; users disable via opencode.json.
• A6 (helpers.py allowlist) deferred — revisit when binary distribution lands and the file path question reopens.
• This closes Phase A for now.