@@ -446,6 +446,83 @@ function Get-ToolFamily($name) {
   return $null
 }
 
+# Human-readable one-liner for a tool's arguments (round-20 #6).
+#
+# The running-state message used to be built as
+#   "$verb " + (ConvertTo-Json $args -Compress)  truncated to 60 chars
+# which put this on an always-on-top, one-line pill:
+#
+#   Running {"command":"$ErrorActionPreference=\u0027Continue\u0027\n...
+#
+# Escaped quotes, a JSON key, and a truncation that can land mid-token.
+# `skill` is not in $TOOL_ACTIONS or $TOOL_FAMILIES, so it always took
+# that path -- one of the most frequent tools on screen was also the
+# least readable.
+#
+# Contract: return the single most informative field for the tool, or ''
+# when there is nothing worth showing. Callers render the verb alone in
+# that case. Raw JSON is never returned -- there is no fallback to it.
+#
+# Unknown tools get a generic sweep of the common field names before
+# giving up, because the tool taxonomy is hand-maintained and does not
+# cover every tool mcode ships.
+# NB: the second parameter must NOT be called `$args`. That name is a
+# reserved automatic variable in PowerShell, and binding a parameter to
+# it yields the unbound-argument Object[] rather than the object passed in
+# -- verified: `function T($n, $args) { $args.command }` called with
+# `[PSCustomObject]@{command='npm test'}` returns an empty string, because
+# the parameter arrives as Object[]. Symptom is a summary that is empty for
+# every single tool, which looks like "no data" rather than "bad binding".
+function Format-ToolArgs($name, $toolArgs) {
+  if (-not $toolArgs) { return '' }
+  $key  = ([string]$name).ToLowerInvariant()
+  $raw  = ''
+  switch ($key) {
+    'bash'          { $raw = [string]$toolArgs.command }
+    'shell'         { $raw = [string]$toolArgs.command }
+    'read'          { $raw = [string]$toolArgs.file_path }
+    'write'         { $raw = [string]$toolArgs.file_path }
+    'edit'          { $raw = [string]$toolArgs.file_path }
+    'notebookedit'  { $raw = [string]$toolArgs.notebook_path }
+    'grep'          { $raw = [string]$toolArgs.pattern }
+    'glob'          { $raw = [string]$toolArgs.pattern }
+    'list'          { $raw = [string]$toolArgs.path }
+    'search'        { $raw = [string]$toolArgs.query }
+    'web_search'    { $raw = [string]$toolArgs.query }
+    'web_fetch'     { $raw = [string]$toolArgs.url }
+    'skill'         { $raw = [string]$toolArgs.name }
+    'task'          { $raw = [string]$toolArgs.description }
+    'task_output'   { $raw = [string]$toolArgs.task_id }
+    'task_append'   { $raw = [string]$toolArgs.task_id }
+    'task_query'    { $raw = [string]$toolArgs.task_id }
+    default {
+      foreach ($f in 'name','command','file_path','path','pattern','query','url','description','task_id') {
+        if ($toolArgs.PSObject.Properties[$f]) {
+          $v = [string]$toolArgs.$f
+          if (-not [string]::IsNullOrWhiteSpace($v)) { $raw = $v; break }
+        }
+      }
+    }
+  }
+  if ([string]::IsNullOrWhiteSpace($raw)) { return '' }
+
+  # The pill is a single line. A PowerShell or bash command is frequently
+  # multi-line, so take the first non-empty line rather than letting the
+  # body spill in and get truncated mid-token.
+  $first = ''
+  foreach ($ln in ($raw -split "`r?`n")) {
+    if ($ln.Trim() -ne '') { $first = $ln.Trim(); break }
+  }
+  if ([string]::IsNullOrWhiteSpace($first)) { return '' }
+
+  # Same redaction the hook path applies, so a credential in a command
+  # cannot reach the pill or island.log through this route either.
+  $first = Protect-SecretText $first
+  $first = ($first -replace '\s+', ' ').Trim()
+  if ($first.Length -gt 60) { $first = $first.Substring(0, 57) + $DOTS }
+  return $first
+}
+
 # ask_user is the one tool whose "in flight" state means the agent is BLOCKED,
 # not busy. When the questionnaire pops, nothing progresses until the user
 # comes back and answers. Reporting it as `working` tells the user "leave it
@@ -543,17 +620,12 @@ function Infer-State($msg) {
       }
       $verb  = Get-ToolVerb $tool 'running'
       if (-not $verb) { $verb = Get-ToolVerbFallback $tool 'running' }
-      if ($args) {
-        # ConvertTo-Json is a single .NET call; keep it (no pipeline leak).
-        $argsJson = $args | ConvertTo-Json -Compress -Depth 2 -WarningAction SilentlyContinue
-        # Redact BEFORE truncating (round-20). This message reaches
-        # status.json, island.log and the pill, and `$args` is the raw
-        # tool argument object straight out of the session log -- so a
-        # Bash call carrying a bearer token or an API key was persisted
-        # verbatim even after the hook path was redacted.
-        $argsJson = Protect-SecretText $argsJson
-        if ($argsJson.Length -gt 60) { $argsJson = $argsJson.Substring(0, 57) + $DOTS }
-        return @{ state=$S_WORKING; message="$verb $argsJson"; family=(Get-ToolFamily $tool) }
+      # Readable summary, never raw JSON (round-20 #6). When there is
+      # nothing worth showing the pill wears the bare verb, which reads
+      # fine -- "Using" beats "Using {\"name\":\"...\"}".
+      $summary = Format-ToolArgs $tool $args
+      if ($summary) {
+        return @{ state=$S_WORKING; message="$verb $summary"; family=(Get-ToolFamily $tool) }
       }
       return @{ state=$S_WORKING; message=$verb; family=(Get-ToolFamily $tool) }
     }
 
@@ -478,6 +478,125 @@ ${block[0].replace(/\$payload\s*=$/, '')}
         `expected 2 -KeepSubStep call sites, found ${keeps.length}`);
 }
 
+// ---------------------------------------------------------------------------
+// 6. The pill never renders raw tool JSON (round-20 #6)
+// ---------------------------------------------------------------------------
+//
+// The detector's `running` message used to be built as
+//   "$verb " + (ConvertTo-Json $args -Compress) truncated to 60 chars
+// which put this on screen:
+//
+//   Running {"command":"$ErrorActionPreference=\u0027Continue\u0027\n...
+//
+// Escaped quotes, a JSON key, and a truncation that can land mid-token.
+// `skill` is not in $TOOL_ACTIONS / $TOOL_FAMILIES, so it always took that
+// JSON path -- meaning one of the most frequent tools on screen was the
+// least readable.
+//
+// The contract: a human-readable field, never the serialised argument
+// object. Unknown tools resolve to the verb alone rather than dumping
+// JSON, because "Using" is a fine pill and "Using {\"name\":...}" is not.
+{
+    const detectPath = join(PLUGIN_ROOT, 'mcode-status-detect.ps1');
+    const detect = readFileSync(detectPath, 'utf8');
+
+    let formatArgs;
+    try {
+        formatArgs = extractFn(detect, 'Format-ToolArgs');
+    } catch (e) {
+        bad('Format-ToolArgs is extractable', e.message);
+    }
+
+    if (!formatArgs) {
+        bad('tool summaries are human-readable, not raw JSON',
+            'Format-ToolArgs not found: the detector still renders ConvertTo-Json output');
+    } else {
+        ok('Format-ToolArgs is extractable');
+
+        const protectLibPath = join(PLUGIN_ROOT, 'scripts', 'lib', 'Protect-Text.ps1');
+        const harness = `
+$ErrorActionPreference = 'Stop'
+. '${protectLibPath.replace(/'/g, "''")}'
+${formatArgs}
+$cases = ConvertFrom-Json $env:ISLAND_TEST_CASES
+foreach ($c in $cases) {
+  # $c.a is already a PSCustomObject -- the outer ConvertFrom-Json turned
+  # the nested object into one. Re-parsing it fails on the '@'.
+  $r = Format-ToolArgs $c.t $c.a
+  '{0}={1}' -f $c.n, $r
+}
+`;
+
+        const cases = [
+            { n: 'bash',      t: 'bash',        a: { command: 'npm test' },                                   want: 'npm test' },
+            { n: 'bashMulti', t: 'bash',        a: { command: "$x = 'Stop'\nGet-ChildItem" },                  want: '$x' },
+            { n: 'read',      t: 'read',        a: { file_path: 'C:\\proj\\a\\file.ts' },                       want: 'file.ts' },
+            { n: 'write',     t: 'write',       a: { file_path: 'C:\\proj\\a\\out.json' },                      want: 'out.json' },
+            { n: 'edit',      t: 'edit',        a: { file_path: 'C:\\proj\\a\\x.ps1' },                         want: 'x.ps1' },
+            { n: 'grep',      t: 'grep',        a: { pattern: 'TODO' },                                       want: 'TODO' },
+            { n: 'glob',      t: 'glob',        a: { pattern: '**/*.ps1' },                                    want: '*.ps1' },
+            { n: 'websearch', t: 'web_search',  a: { query: 'mcode changelog' },                              want: 'mcode changelog' },
+            { n: 'webfetch',  t: 'web_fetch',   a: { url: 'https://example.com/y' },                          want: 'example.com' },
+            // skill is absent from the tool taxonomy: this is the case
+            // that was guaranteed to render as raw JSON.
+            { n: 'skill',     t: 'skill',       a: { name: 'docx' },                                           want: 'docx' },
+            { n: 'taskout',   t: 'task_output', a: { task_id: 'bg_abc123' },                                   want: 'bg_abc123' },
+            // Unknown tool with an unrecognised shape: verb-only, not JSON.
+            { n: 'unknown',   t: 'wibble',      a: { zzz: 1 },                                                want: '' },
+            // Credential in a command must still be redacted on this path.
+            { n: 'secret',    t: 'bash',        a: { command: "curl -H 'Authorization: Bearer eyJhbGciOi.SUPERSECRET'" } },
+        ];
+
+        const out = runPs(
+            `$env:ISLAND_TEST_CASES = '${JSON.stringify(cases).replace(/'/g, "''")}'\n` + harness);
+        const got = {};
+        for (const line of out.split(/\r?\n/)) {
+            const m = line.match(/^(\w+)=(.*)$/);
+            if (m) got[m[1]] = m[2];
+        }
+
+        for (const c of cases) {
+            if (!(c.n in got)) {
+                bad(`summary ${c.n}`, `no output produced (got ${JSON.stringify(out.trim())})`);
+                continue;
+            }
+            const v = got[c.n];
+            // The blanket rule, asserted for every case including the
+            // secret one: nothing JSON-shaped reaches the pill.
+            const jsonish = /\{\s*"|":\s*"|\\u00[0-9a-f]{2}/i.test(v);
+            if (jsonish) {
+                bad(`summary ${c.n}`, `renders raw JSON: ${JSON.stringify(v)}`);
+                continue;
+            }
+            if (c.want === '') {
+                // Unknown tool with nothing worth showing: must be empty,
+                // not merely "not JSON". A partial dump is still a dump.
+                if (v !== '') {
+                    bad(`summary ${c.n}`, `expected empty, got ${JSON.stringify(v)}`);
+                    continue;
+                }
+            } else if (c.want !== undefined) {
+                if (!v.toLowerCase().includes(String(c.want).toLowerCase())) {
+                    bad(`summary ${c.n}`, `expected to contain ${JSON.stringify(c.want)}, got ${JSON.stringify(v)}`);
+                    continue;
+                }
+            }
+            if (c.n === 'secret' && /SUPERSECRET/.test(v)) {
+                bad('summary secret', `credential survived: ${JSON.stringify(v)}`);
+                continue;
+            }
+            ok(`summary ${c.n}${c.want !== undefined ? ` -> ${JSON.stringify(v)}` : ' (redacted)'}`);
+        }
+
+        // A multi-line command must not spill its body onto a one-line pill.
+        if ('bashMulti' in got && /Get-ChildItem/.test(got.bashMulti)) {
+            bad('summary bashMulti', 'a multi-line command leaked its second line onto the pill');
+        } else if ('bashMulti' in got) {
+            ok('summary bashMulti keeps only the first line');
+        }
+    }
+}
+
 // ---------------------------------------------------------------------------
 // summary
 // ---------------------------------------------------------------------------