diff --git a/docs/design/daemon-session-artifacts/session-artifacts-daemon-api-implementation-design.md b/docs/design/daemon-session-artifacts/session-artifacts-daemon-api-implementation-design.md
new file mode 100644
index 0000000000..c1223724b4
--- /dev/null
+++ b/docs/design/daemon-session-artifacts/session-artifacts-daemon-api-implementation-design.md
@@ -0,0 +1,1586 @@
+# Qwen-Code Daemon Session Artifacts API 可实施设计
+
+> 输入资料：session artifacts daemon API 初版草案与 artifact design v1 草案。
+>
+> 源码基线：当前 qwen-code 代码。  
+> 目标：基于现有 Daemon / ACP / SSE / SDK / hooks / extension 能力，设计一套可实施、可验证、边界清楚的 session artifacts API。
+
+## 1. 设计结论
+
+建议把 artifact 定义为：
+
+> **Session 中被显式登记的、用户可复用/点击/预览/下载/分享的结构化产物引用。普通源码变更不是 artifact；源码变更属于 file change / diff / patch history。**
+
+这个定义覆盖文件，也覆盖非文件 URL。关键不在于它是不是物理文件，而在于它是不是被系统明确声明为“产物”。Artifacts 面板应该展示 session outputs，而不是所有 agent 动过的东西。
+
+V1 完整能力建议包含：
+
+- capability：`session_artifacts`
+- artifact snapshot API：`GET /session/:id/artifacts`
+- artifact changed event：`artifact_changed`
+- tool result metadata：`ToolResult.artifacts?: ToolArtifact[]`
+- `ArtifactTool` structured artifact metadata
+- bridge 内存索引：`SessionArtifactStore`
+- SDK 方法：`DaemonClient.listSessionArtifacts()`、`DaemonSessionClient.artifacts()`
+- 模型/skill/agent 可调用的轻量工具：`record_artifact`
+- hook 输出 artifacts：`hookSpecificOutput.artifacts`
+- client 手动注入 API：`POST /session/:id/artifacts`
+- client 显式移除 API：`DELETE /session/:id/artifacts/:artifactId`
+- SDK 方法：`DaemonSessionClient.addArtifact()`
+- SDK 方法：`DaemonSessionClient.removeArtifact()`
+- managed / published storage 引用模型
+
+为了保持 V1 可控，不建议 V1 做：
+
+- workspace 扫描
+- 普通 `WRITE_FILE` / `EDIT` / `NOTEBOOK_EDIT` 自动进入 artifacts
+- 普通文本 URL 自动抽取
+- shell stdout 路径/URL 自动抽取
+- artifact 内容返回
+- artifact 历史版本
+- artifact 持久化恢复
+- 数据库/OSS/动态 iframe 沙箱
+
+## 2. Link 是否算 Artifact
+
+### 2.1 结论
+
+**算，但必须是“声明式 link artifact”。**
+
+例如这些应该算 artifact：
+
+- skill 根据资源 ID 拼出的内部数据平台表详情 URL。
+- agent 根据资源 ID 拼出的任务详情页、监控页、trace 页、lineage 页。
+- MCP 工具返回的 dashboard / notebook / report URL。
+- ArtifactTool 发布后的 HTML URL。
+- 用户或 client 明确添加到 session 产物区的 URL。
+
+这些不应该默认算 artifact：
+
+- assistant 普通回答里的任意 markdown link。
+- web_fetch 读到的网页 URL。
+- grep/shell 输出中偶然出现的 URL。
+- 引用资料、文档链接、参考链接。
+
+核心标准：
+
+| 类型                            | 是否进入 artifacts | 原因                                     |
+| ------------------------------- | -----------------: | ---------------------------------------- |
+| 普通源码编辑                    |                 否 | 属于 file change / diff，不是可复用产物  |
+| 明确登记的生成型 workspace 文件 |                 是 | report / HTML / PDF / image 等可复用输出 |
+| ArtifactTool 发布的 HTML URL    |                 是 | 工具明确发布                             |
+| skill 按规则拼出的业务详情 URL  | 是，但必须显式登记 | 用户需要右侧长期可点                     |
+| assistant 回答里的普通参考链接  |                 否 | 噪音大、容易误报                         |
+| shell stdout 中出现的 URL       |                 否 | 语义不可靠                               |
+| web_fetch 请求过的 URL          |                 否 | 这是输入/来源，不是产物                  |
+
+### 2.2 Link Artifact 的产品语义
+
+Link artifact 不是“网页内容”，而是“资源入口”。它应该在右侧产物区表现为可点击条目：
+
+- 标题：`用户画像资源详情`
+- 副标题：`internal data platform / prod`
+- 类型：`link`
+- URL host：`platform.example.com`
+- 来源：`ToolResult.artifacts` / `ArtifactTool` / `record_artifact` / hook / client
+
+Client 点击时打开 URL；Daemon 不读取、不验证、不预渲染该 URL。
+
+## 3. 当前代码基线
+
+### 3.1 Daemon REST 与 capability
+
+相关源码：
+
+- `packages/cli/src/serve/server.ts`
+- `packages/cli/src/serve/capabilities.ts`
+- `docs/developers/qwen-serve-protocol.md`
+
+现状：
+
+- `/capabilities` 返回 `features`，Client 必须基于 feature gate UI。
+- session 级只读状态接口采用 REST 风格：
+  - `GET /session/:id/status`
+  - `GET /session/:id/context`
+  - `GET /session/:id/tasks`
+  - `GET /session/:id/events`
+- capability 注册在 `SERVE_CAPABILITY_REGISTRY`。
+
+设计：
+
+- 新增 feature：`session_artifacts`
+- 新增 route：`GET /session/:id/artifacts`
+- 新增手动注入 mutation route：`POST /session/:id/artifacts`
+
+### 3.2 Session EventBus
+
+相关源码：
+
+- `packages/acp-bridge/src/eventBus.ts`
+- `packages/acp-bridge/src/bridge.ts`
+- `packages/acp-bridge/src/bridgeClient.ts`
+- `packages/sdk-typescript/src/daemon/events.ts`
+
+现状：
+
+- 每个 live session 有独立 `EventBus`。
+- EventBus 支持 id、bounded replay ring、`Last-Event-ID`、backpressure。
+- SDK 维护 known event list。
+
+设计：
+
+- artifact 实时更新复用现有 `/session/:id/events`。
+- 新增 event type：`artifact_changed`
+- Client 首次进入用 snapshot，之后用 event 增量；断线后重新拉 snapshot。
+
+### 3.3 Tool Result 与 ArtifactTool
+
+相关源码：
+
+- `packages/core/src/tools/tools.ts`
+- `packages/core/src/tools/tool-names.ts`
+- `packages/core/src/tools/artifact/artifact-tool.ts`
+- `packages/cli/src/acp-integration/session/Session.ts`
+- `packages/cli/src/acp-integration/session/emitters/ToolCallEmitter.ts`
+
+现状：
+
+- `ToolResult` 当前包含 `llmContent`、`returnDisplay`、`resultFilePaths?`、`error?`。
+- `ArtifactTool` 已能发布 HTML 并返回 URL，但没有结构化 artifact metadata。
+- `ToolCallEmitter.emitResult()` 的 `_meta` 已有扩展位。
+
+设计：
+
+- 增加 `ToolResult.artifacts?: ToolArtifact[]`。
+- `ArtifactTool` 成功时填充 `artifacts`。
+- `ToolCallEmitter.emitResult()` 把 artifacts 放入 `_meta.artifacts`。
+- BridgeClient 消费 `_meta.artifacts`，写入 session artifact store。
+
+### 3.4 Hooks / Extensions / Plugins 现状
+
+相关源码：
+
+- `packages/core/src/hooks/types.ts`
+- `packages/core/src/core/toolHookTriggers.ts`
+- `packages/core/src/hooks/hookRunner.ts`
+- `packages/core/src/hooks/sessionHooksManager.ts`
+- `packages/core/src/hooks/registerSkillHooks.ts`
+- `packages/core/src/extension/extensionManager.ts`
+- `docs/developers/channel-plugins.md`
+
+当前已有能力：
+
+- hook 事件包括 `PreToolUse`、`PostToolUse`、`PostToolBatch`、`SessionStart`、`Stop`、`SubagentStart`、`SubagentStop` 等。
+- hook 类型包括 command、HTTP、function、prompt。
+- command hook stdout 支持 JSON 形式的 `HookOutput`。
+- HTTP hook response 支持 JSON 形式的 `HookOutput`。
+- session hooks 可通过 `SessionHooksManager` 运行时注册。
+- skill frontmatter 可注册 session-scoped command/HTTP hooks。
+- extension 可提供 commands、skills、hooks、MCP servers、channels。
+- channel plugin 主要是消息平台适配，能观察 tool call / response chunk，但不是 daemon artifact 注入通道。
+
+当前缺口：
+
+- hook output 只有 `additionalContext`、decision、stopReason 等通用字段。
+- 当前没有标准 `hookSpecificOutput.artifacts`。
+- 当前 daemon 只有 `GET /workspace/hooks` 和 `GET /session/:id/hooks` 状态接口，没有“hook 主动注入 artifact”的 route。
+
+结论：
+
+- hooks/extensions 是很好的自定义 artifact 入口，但需要扩展 hook output schema。
+- channel plugin 不建议作为 artifact 注入主通道；它适合外部聊天平台展示，不适合维护 daemon session artifact index。
+
+## 4. API 设计
+
+### 4.1 Capability
+
+新增：
+
+```json
+"session_artifacts"
+```
+
+Client 只有看到该 feature 才展示 artifacts 面板和调用相关 API。
+
+### 4.2 List Artifacts
+
+```http
+GET /session/:id/artifacts
+```
+
+响应：
+
+```json
+{
+  "v": 1,
+  "sessionId": "session-123",
+  "artifacts": [
+    {
+      "id": "a1b2c3d4e5f6",
+      "kind": "link",
+      "storage": "external_url",
+      "title": "用户画像资源详情",
+      "description": "内部数据平台资源详情页",
+      "url": "https://platform.example.com/resources/user-profile",
+      "mimeType": "text/html",
+      "status": "available",
+      "source": "tool",
+      "toolCallId": "call_abc",
+      "toolName": "artifact",
+      "createdAt": "2026-06-26T10:00:00.000Z",
+      "updatedAt": "2026-06-26T10:00:00.000Z",
+      "metadata": {
+        "resourceType": "data_platform_resource",
+        "env": "prod"
+      }
+    }
+  ]
+}
+```
+
+### 4.3 Artifact Changed Event
+
+通过现有：
+
+```http
+GET /session/:id/events
+```
+
+新增 event：
+
+```json
+{
+  "v": 1,
+  "type": "artifact_changed",
+  "data": {
+    "sessionId": "session-123",
+    "change": {
+      "action": "created",
+      "artifactId": "a1b2c3d4e5f6",
+      "artifact": {
+        "id": "a1b2c3d4e5f6",
+        "kind": "link",
+        "storage": "external_url",
+        "title": "用户画像资源详情",
+        "description": "内部数据平台资源详情页",
+        "url": "https://platform.example.com/resources/user-profile",
+        "mimeType": "text/html",
+        "status": "available",
+        "source": "tool",
+        "toolCallId": "call_abc",
+        "toolName": "artifact",
+        "createdAt": "2026-06-26T10:00:00.000Z",
+        "updatedAt": "2026-06-26T10:00:00.000Z",
+        "metadata": {
+          "resourceType": "data_platform_resource",
+          "env": "prod"
+        }
+      }
+    }
+  }
+}
+```
+
+`change.action`：
+
+- `created`
+- `updated`
+- `removed`
+
+V1 主要产生 `created` / `updated`；eviction 或显式删除场景产生 `removed`。
+
+`artifact_changed.data.change.artifact` 在 `created` / `updated` / `removed` 时携带完整 `DaemonSessionArtifact`，shape 与 `GET /session/:id/artifacts` 中的单项一致；`removed` event 携带被删除前的最后完整 artifact。`removed` 必须携带 `reason`，V1 取值为 `eviction` 或 `explicit`。这样实时 UI 可以直接应用 event，不需要每条 event 后再 GET。Client 断线、丢 event 或收到未知 event type 时，再用 `GET /session/:id/artifacts` 做 snapshot sync。
+
+### 4.4 Client Manual Insert
+
+作为 V1 的 client 显式登记入口：
+
+```http
+POST /session/:id/artifacts
+```
+
+用途：
+
+- WebUI/IDE/外部 client 手动添加自定义 link artifact。
+- 扩展或集成层在不经过模型工具调用时向右侧产物面板插入资源。
+
+请求：
+
+```json
+{
+  "kind": "link",
+  "storage": "external_url",
+  "title": "任务详情",
+  "description": "调度任务 task_123 的详情页",
+  "url": "https://ops.example.com/tasks/task_123",
+  "mimeType": "text/html",
+  "metadata": {
+    "resourceType": "scheduler_task"
+  }
+}
+```
+
+响应：
+
+```json
+{
+  "v": 1,
+  "sessionId": "session-123",
+  "changes": [
+    {
+      "action": "created",
+      "artifactId": "a1b2c3d4e5f6",
+      "artifact": {
+        "id": "a1b2c3d4e5f6",
+        "kind": "link",
+        "storage": "external_url",
+        "title": "任务详情",
+        "description": "调度任务 task_123 的详情页",
+        "url": "https://ops.example.com/tasks/task_123",
+        "mimeType": "text/html",
+        "status": "available",
+        "source": "client",
+        "createdAt": "2026-06-26T10:00:00.000Z",
+        "updatedAt": "2026-06-26T10:00:00.000Z",
+        "metadata": {
+          "resourceType": "scheduler_task"
+        }
+      }
+    }
+  ]
+}
+```
+
+`changes` 中的每一项都必须同步发布为一条 `artifact_changed` SSE event。这样即使一次 POST 触发 upsert 和 eviction，client 也能收到 created/updated 以及 removed 的完整增量。同一次 mutation 内如果多个输入归一到同一个 identity，只能在 `changes` 中产生一条最终 change。事件发布顺序是协议约束：先按 `changes[]` 中的顺序发布 `created` / `updated`，再发布 `removed`，避免 client 的本地镜像短暂进入服务端从未存在过的状态。
+
+错误响应：
+
+```json
+{
+  "v": 1,
+  "error": {
+    "code": "VALIDATION_FAILED",
+    "message": "url must use http or https",
+    "field": "url"
+  }
+}
+```
+
+状态码：
+
+- `400 VALIDATION_FAILED`：字段校验失败，例如多 primary locator、不支持 URL scheme、metadata 超限。
+- `401 UNAUTHORIZED` / `403 FORBIDDEN`：mutation gate 或 bearer token 校验失败。
+- `404 SESSION_NOT_FOUND`：session 不存在。
+
+### 4.5 Client Delete
+
+作为 V1 的显式移除入口：
+
+```http
+DELETE /session/:id/artifacts/:artifactId
+```
+
+语义：
+
+- 只从当前 live session artifact store 移除该 artifact。
+- 不删除 workspace 文件、managed 文件或远端 URL。
+- 成功返回 `DaemonSessionArtifactMutationResult`，其中包含一条 `action: 'removed'`、`reason: 'explicit'` 的 change。
+- 如果 artifact 已经不存在，DELETE 仍按 idempotent success 处理，返回 `200` 和空 `changes: []`，不发布 SSE event。
+- 同步发布对应 `artifact_changed` SSE event。
+
+错误响应复用 Section 4.4 envelope；session 不存在仍返回 `404 SESSION_NOT_FOUND`。
+
+安全：
+
+- 这是 mutation route，应使用现有 mutation gate。
+- 有 bearer token 的 daemon 才允许远程 client 调用。
+- 不读取 URL。
+- 不自动打开 URL。
+
+### 4.6 V1 发布口径与兼容性
+
+V1 合并后应作为一项完整的 session artifact 管理能力发布试用，而不是只发布一个半成品接口。完整能力的最小闭环是：
+
+- Client 通过 `session_artifacts` capability 探测功能。
+- Daemon 提供 `GET /session/:id/artifacts` snapshot。
+- Daemon 通过现有 events stream 发布 `artifact_changed` 增量。
+- `ArtifactTool` / `ToolResult.artifacts`、`record_artifact`、hook artifacts、client POST 四类入口都进入同一个 store。
+- client DELETE 可从 live store 显式移除误登记 artifact。
+- store 统一执行 validation、normalization、identity 去重、soft reservation eviction。
+- SDK 能 list/add/remove，并能识别 `artifact_changed` event。
+
+建议以 experimental/capability-gated 形式先发布试用。这里的 experimental 表示实现和 UI 可以继续打磨，不表示协议可以随意破坏：已经暴露给 client 的字段和事件语义必须按下列兼容性规则演进。
+
+非 breaking 的后续扩展：
+
+- 在 response artifact 上增加 optional field。
+- 增加新的 `kind` / `status` / `source` / `storage` 字面量，但 typed SDK 必须把这些字段声明成 open union，client 必须容忍未知值：未知 `kind` 按 `other`，未知 `status` 显示为 unknown 状态且不阻断列表展示，未知 `source` 按未分组来源，未知 `storage` 仅按可用 `url` / `workspacePath` 做保守展示。
+- 增加新的 route，例如 `GET /session/:id/artifacts/:artifactId`、preview route、pin route。
+- 增加新的 event type，但现有 `artifact_changed` 语义不变。
+- 增加新的 capability，例如 `session_artifacts_preview`、`session_artifacts_persistence`。
+- 调整 soft reservation 的内部默认值，只要总上限和 eviction event 语义不破坏现有 client。
+
+需要新 capability 或新版本的 breaking 变更：
+
+- 修改 identity 规则导致同一个 URL/path 的 artifact id 改变。
+- 把现有 optional field 改成 required field。
+- 删除或改名现有字段。
+- 改变 `artifact_changed.data.change.action` 的 `created` / `updated` / `removed` 语义。
+- 改变 `GET /session/:id/artifacts` 的 envelope shape。
+- 让普通 assistant 文本链接或普通文件编辑默认进入 artifact list。
+
+## 5. 数据模型
+
+### 5.1 Public SDK 类型
+
+```ts
+type OpenStringUnion<T extends string> = T | (string & {});
+
+export type DaemonSessionArtifactKind = OpenStringUnion<
+  | 'file'
+  | 'link'
+  | 'image'
+  | 'video'
+  | 'audio'
+  | 'html'
+  | 'pdf'
+  | 'notebook'
+  | 'other'
+>;
+
+export type DaemonSessionArtifactStatus = OpenStringUnion<
+  'available' | 'missing'
+>;
+
+export type DaemonSessionArtifactSource = OpenStringUnion<
+  'tool' | 'hook' | 'client'
+>;
+
+export type DaemonSessionArtifactStorage = OpenStringUnion<
+  'workspace' | 'managed' | 'external_url' | 'published'
+>;
+
+export interface DaemonSessionArtifact {
+  id: string;
+  kind: DaemonSessionArtifactKind;
+  storage: DaemonSessionArtifactStorage;
+  title: string;
+  description?: string;
+  status: DaemonSessionArtifactStatus;
+  source: DaemonSessionArtifactSource;
+  createdAt: string;
+  updatedAt: string;
+  workspacePath?: string;
+  managedId?: string;
+  url?: string;
+  mimeType?: string;
+  sizeBytes?: number;
+  toolCallId?: string;
+  toolName?: string;
+  hookName?: string;
+  extensionId?: string;
+  clientId?: string;
+  metadata?: Record<string, string | number | boolean | null>;
+}
+
+export interface DaemonSessionArtifactsEnvelope {
+  v: 1;
+  sessionId: string;
+  artifacts: DaemonSessionArtifact[];
+}
+
+export interface DaemonArtifactChangedData {
+  sessionId: string;
+  change: DaemonSessionArtifactChange;
+}
+
+export interface DaemonSessionArtifactChange {
+  action: 'created' | 'updated' | 'removed';
+  artifactId: string;
+  artifact?: DaemonSessionArtifact;
+  reason?: 'eviction' | 'explicit';
+}
+
+export interface DaemonSessionArtifactMutationResult {
+  v: 1;
+  sessionId: string;
+  changes: DaemonSessionArtifactChange[];
+}
+```
+
+### 5.2 Core ToolArtifact 类型
+
+```ts
+export type ToolArtifactKind =
+  | 'file'
+  | 'link'
+  | 'image'
+  | 'video'
+  | 'audio'
+  | 'html'
+  | 'pdf'
+  | 'notebook'
+  | 'other';
+
+export type ToolArtifactStorage =
+  | 'workspace'
+  | 'managed'
+  | 'external_url'
+  | 'published';
+
+export interface ToolArtifact {
+  kind?: ToolArtifactKind;
+  storage?: ToolArtifactStorage;
+  title: string;
+  description?: string;
+  workspacePath?: string;
+  managedId?: string;
+  url?: string;
+  mimeType?: string;
+  metadata?: Record<string, string | number | boolean | null>;
+}
+```
+
+`ToolArtifactKind` / `ToolArtifactStorage` 的已知字面量集合必须只有一个实现来源，避免 core、acp-bridge、SDK 三处手工漂移。推荐做法：
+
+- 在 core 中定义 `TOOL_ARTIFACT_KINDS` / `TOOL_ARTIFACT_STORAGES` const tuple，并导出 `ToolArtifactKind` / `ToolArtifactStorage`。
+- acp-bridge 复用 core 类型作为输入校验的已知集合，并把 daemon public 类型声明为同一组值的协议投影。
+- SDK 不手写第二份已知 union；通过 acp-bridge 导出的协议类型或构建期生成的 `.d.ts` re-export 已知字面量，再在 response-facing 类型上包一层 open union，以便容忍未来 daemon 返回的新值。
+- 测试加一条 kind/storage round-trip，保证已知字面量在 core 输入、bridge store、SDK 输出中一致往返；另加 SDK unknown value fallback 测试，保证 open union 的运行时容错。
+
+并扩展：
+
+```ts
+export interface ToolResult {
+  llmContent: unknown;
+  returnDisplay: unknown;
+  resultFilePaths?: string[];
+  artifacts?: ToolArtifact[];
+  error?: unknown;
+}
+```
+
+### 5.3 Input 到 Public Artifact 的补全规则
+
+`ToolArtifact` 是工具返回的输入形态，`SessionArtifactInput` 是所有入口进入 store 前的统一内部输入形态，`DaemonSessionArtifact` 是对外返回形态。所有入口都必须先转换为 `SessionArtifactInput`，再由 `SessionArtifactStore` 补全公共字段。
+
+```ts
+export interface SessionArtifactInput extends ToolArtifact {
+  source: 'tool' | 'hook' | 'client';
+  toolCallId?: string;
+  toolName?: string;
+  hookName?: string;
+  extensionId?: string;
+  clientId?: string;
+  trustedPublisher?: true;
+  receivedSeq?: number;
+}
+```
+
+`trustedPublisher` 是 bridge/store 内部输入标志，不是 public schema 或 client/hook 可设置字段。V1 的 daemon/ACP 部署里，`qwen --acp` 子进程由 daemon 启动并以同一用户运行；因此当前实现把 completed `ArtifactTool` session update（`tool_call_update`、`status: 'completed'`、`_meta.toolName: 'artifact'`）视作唯一 trusted publisher 信号。这个信号不从 artifact payload 本身读取，也不对 client POST、hook notification、`record_artifact` 或其它 tool result 开放。
+
+如果未来支持远端 sandbox、多方 ACP participant 或非同信任域 agent，应新增不可伪造的 transport / in-process publisher identity，再替换该 V1 信任信号；在那之前不要把 payload 内的 `trustedPublisher` / `source` / `storage` 当作授权依据。
+
+来源转换规则：
+
+- `ArtifactTool` / daemon publisher：BridgeClient 只在 completed `ArtifactTool` session update 上补 `source: 'tool'`、`toolCallId`、`toolName`，并以内部 option 设置 `trustedPublisher: true`。
+- 其它 `ToolResult.artifacts`：复制 `ToolArtifact` 字段，补 `source: 'tool'`、`toolCallId`、`toolName`，但不设置 `trustedPublisher`。
+- `record_artifact`：作为 tool source 进入，同样补 `source: 'tool'`、`toolCallId`、`toolName: 'record_artifact'`，但不允许 `storage: 'published'`，也不能设置 `trustedPublisher`。
+- hook：复制 hook output artifacts，补 `source: 'hook'`、`hookName`、`extensionId`；如 hook 能拿到触发 tool context，也可补 `toolCallId` / `toolName`。Bridge 必须从 transport context 派生 `source: 'hook'`，不能信任 payload 里的 `source` 字段。
+- client POST：复制 body，补 `source: 'client'`、`clientId`，不允许 `storage: 'published'`，也不能设置 `trustedPublisher`。
+- `receivedSeq`：由 bridge/store 在接收输入时分配单调递增值，用于同一批内 deterministic ordering；外部输入不能指定该字段。
+- BridgeClient 不得根据 artifact payload 内的 `source`、`storage`、`managedId`、`url`、`trustedPublisher` 或其它 `_meta.artifacts[*]` 字段推断 `trustedPublisher`。V1 唯一例外是上述 completed `ArtifactTool` session update 信号。
+
+补全规则：
+
+- `id`：由 Section 7 的 identity hash 生成。
+- `source`：由入口上下文决定，tool result / ArtifactTool 为 `tool`，hook 为 `hook`，client POST 为 `client`。
+- `toolCallId` / `toolName`：由 tool call 上下文补入；hook/client 入口没有则不填。
+- `hookName` / `extensionId` / `clientId`：有上下文时补入，用于审计和 UI 分组。
+- `createdAt`：首次 upsert 时写入。
+- `updatedAt`：每次 upsert 时刷新。
+- `status`：workspace artifact upsert 时做 best-effort stat，存在且 containment check 通过则为 `available`，不存在或 symlink escape 则为 `missing`；managed / URL artifact 在 V1 不做本机 stat，始终为 `available`。
+- `storage` 默认值：
+  - 有 `workspacePath` 时为 `workspace`。
+  - 有 `storage: 'published'` 时必须来自 `trustedPublisher`，否则校验失败。
+  - 有 `managedId` 且没有 `url` 时为 `managed`。
+  - 有 `url` 时为 `external_url`。
+  - `ArtifactTool` 发布结果显式使用 `published`。
+- `kind` 默认值：
+  - `storage: 'published'` 且没有显式 `kind` 时为 `html`。
+  - 有 `url` 且没有 `workspacePath` 时为 `link`。
+  - 有 `workspacePath` 时按扩展名推断：`.html` -> `html`，图片扩展名 -> `image`，视频扩展名 -> `video`，音频扩展名 -> `audio`，`.pdf` -> `pdf`，`.ipynb` -> `notebook`，否则 `file`。
+  - 无法推断时为 `other`。
+
+### 5.4 字段约束
+
+- `workspacePath` 只对 workspace 内文件对外展示，且必须是 workspace-relative path。
+- `managedId` 是 daemon/qwen-home 托管产物引用，不能是本机绝对路径。
+- `url` 只接受明确登记的 URL 或 ArtifactTool 发布 URL。
+- `workspacePath`、`managedId`、`url` 必须且只能存在一个 primary locator；V1 拒绝普通输入同时携带多个 primary locator，避免同一逻辑资源按不同字段生成多个 identity。
+- 唯一例外是可信 `storage: 'published'`：`url` 是 primary locator，`managedId` 可作为可选 managed reference 一起返回，用于未来下载/预览；此时 identity 只按 `url` 计算，`managedId` 不参与 identity。该例外只接受 `trustedPublisher: true` 的内部输入。
+- 普通工具不得把 `~/.qwen`、`/tmp` 或其他本机绝对路径作为 `workspacePath` 返回。
+- `title` 必填，trim 后长度 1-200 字符，不允许 ASCII 控制字符；它是 plain text，不承载 HTML 或 markdown 语义。
+- `description` 是 UI 辅助 plain text，不进入模型上下文。
+- `description` trim 后最多 1000 字符，不允许 ASCII 控制字符，不承载 HTML 或 markdown 语义。
+- `metadata` 必须是小对象，只允许 primitive value。
+- `metadata` 不放 secret、token、cookie、签名私钥。
+- `sizeBytes` 是 best-effort。
+- `DaemonSessionArtifactsEnvelope` 不返回宿主机绝对 `workspaceCwd`；client 只依赖 `workspacePath` 这类相对路径和 `storage` 字段展示。
+
+## 6. Artifact 采集来源
+
+### 6.1 文件输出入口
+
+V1 不从普通文件编辑工具自动派生 artifact。
+
+不自动派生：
+
+- `ToolNames.WRITE_FILE`
+- `ToolNames.EDIT`
+- `ToolNames.NOTEBOOK_EDIT`
+- `read_file`
+- `grep_search`
+- `glob`
+- `list_directory`
+- `web_fetch`
+- `run_shell_command`
+
+原因：
+
+- 普通源码编辑、配置修改、测试修复属于 file change / diff / patch history。
+- 自动把每次 source edit 放入 artifacts 面板会制造大量噪音。
+- 右侧产物区应该保留给可复用、可预览、可下载或可分享的 session outputs。
+
+文件可以进入 artifact store 的条件：
+
+- 工具结果显式返回 `ToolResult.artifacts`。
+- `ArtifactTool` 发布输出。
+- V1 的 `record_artifact` / hook / client POST 显式登记。
+- 未来如需要便利派生，只允许生成型输出文件，并要求工具结果或结构化 metadata 标记为 artifact；不要从普通 `WRITE_FILE` / `EDIT` 默认推断。
+
+生成型输出示例：
+
+- report：`.html`、`.pdf`、`.md`
+- media：`.png`、`.jpg`、`.mp4`、`.mp3`
+- office/data：`.xlsx`、`.docx`、`.pptx`、`.csv`
+- notebook：作为交付物生成的 `.ipynb`
+
+即使是 notebook，也要区分“编辑已有 notebook 源文件”和“生成给用户查看/下载的 notebook artifact”。
+
+### 6.2 ArtifactTool
+
+`ArtifactTool` 成功发布后返回：
+
+```ts
+artifacts: [
+  {
+    kind: 'html',
+    storage: 'published',
+    title,
+    url,
+    managedId,
+    mimeType: 'text/html',
+  },
+];
+```
+
+保留现有 `llmContent`、`returnDisplay`、`resultFilePaths`，保证兼容。
+
+`ArtifactTool` 当前 local publisher 可能把内容写入 qwen home 下的托管目录，并返回 `file://` 或远端 URL。Daemon artifact API 不应把 qwen home 本机绝对路径作为 `workspacePath` 暴露；应使用：
+
+- `storage: 'published'`
+- `url`: 已发布的可打开 URL，也是 published artifact 的 primary locator
+- `managedId`: 可选的内部托管引用，不参与 identity
+- BridgeClient 在 completed `ArtifactTool` session update 上通过内部 option 设置 `trustedPublisher: true`。Bridge 不得从模型参数、hook payload、client POST body 或普通 `_meta.artifacts[*]` 字段推断该标志。
+
+如果未来要让 daemon client 下载或预览托管内容，应新增专门的 managed artifact route，而不是把本机绝对路径塞进 public artifact。
+
+### 6.3 record_artifact 工具
+
+作为 V1 的模型/skill 显式登记入口，新增轻量内置工具：
+
+```ts
+ToolNames.RECORD_ARTIFACT = 'record_artifact';
+```
+
+用途：
+
+- 模型显式登记非文件类产物。
+- skill / agent.md 可以要求模型在拼出业务 URL 后调用该工具。
+- 每次调用只登记一个 artifact；批量登记由模型多次调用工具完成，避免单次 tool call 出现部分成功/失败的反馈歧义。
+- 不做网络请求。
+- 不写 workspace 文件。
+- 只写 session artifact index。
+
+参数：
+
+```ts
+interface RecordArtifactParams {
+  title: string;
+  description?: string;
+  kind?: ToolArtifactKind;
+  storage?: Exclude<ToolArtifactStorage, 'published'>;
+  workspacePath?: string;
+  managedId?: string;
+  url?: string;
+  mimeType?: string;
+  metadata?: Record<string, string | number | boolean | null>;
+}
+```
+
+示例：
+
+```json
+{
+  "title": "用户画像资源详情",
+  "description": "内部数据平台生产环境资源详情页",
+  "kind": "link",
+  "storage": "external_url",
+  "url": "https://platform.example.com/resources/user-profile?env=prod",
+  "mimeType": "text/html",
+  "metadata": {
+    "resourceType": "data_platform_resource",
+    "env": "prod"
+  }
+}
+```
+
+返回：
+
+```ts
+return {
+  llmContent: {
+    recorded: true,
+    title: params.title,
+    location: params.workspacePath ?? params.managedId ?? params.url,
+    note: 'The daemon will expose the assigned artifact id through artifact_changed and list APIs.',
+  },
+  returnDisplay: 'Recorded artifact: 用户画像资源详情',
+  artifacts: [params],
+};
+```
+
+`record_artifact` 在返回前做参数级 validation；失败时返回工具错误，不产生 `ToolResult.artifacts`。因为单次调用只有一个 artifact，V1 不需要定义批量 partial success。server-assigned `id` 由 daemon store 生成，并通过 `artifact_changed` / `GET /session/:id/artifacts` 暴露给 client。
+
+`record_artifact` 不接受 `storage: 'published'`，也不接受 `url + managedId` 的 published 例外。模型/skill 只能登记 workspace、managed 或 external URL artifact；发布型 artifact 必须来自 ArtifactTool / daemon publisher。
+
+权限建议：
+
+- 不建议默认注册到所有 session；应 feature-gated，或由 skill/extension 显式启用。
+- 如果启用，可以默认 `allow`，因为它只修改 session UI metadata。
+- URL 不自动打开。
+- Client 展示 host，用户点击前可辨识目标。
+- 如果未来允许 `file://`，必须只允许 workspace 内文件；V1 不建议 `record_artifact` 接受 `file://` URL。
+- 与 hook/client POST 一样，必须经过统一 artifact validation。
+
+### 6.4 Hook 输出 artifacts
+
+作为 V1 的 hook/extension 显式登记入口扩展。当前 hooks 已支持 command/HTTP/function/prompt，并且 command/HTTP hook 可以返回 JSON `HookOutput`。建议扩展 `hookSpecificOutput`：
+
+```json
+{
+  "continue": true,
+  "hookSpecificOutput": {
+    "hookEventName": "PostToolUse",
+    "artifacts": [
+      {
+        "kind": "link",
+        "storage": "external_url",
+        "title": "调度任务详情",
+        "url": "https://ops.example.com/task/task_123",
+        "mimeType": "text/html",
+        "metadata": {
+          "resourceType": "scheduler_task"
+        }
+      }
+    ]
+  }
+}
+```
+
+适合场景：
+
+- PostToolUse hook 观察某个 MCP/tool 输出，按组织规则拼业务 URL。
+- extension 提供 hooks，把企业内部资源 URL 注入右侧产物区。
+- skill frontmatter 注册 PostToolUse hook，在 skill 生效期间自动登记 artifacts。
+- 工具失败后，PostToolUse hook 登记 error trace、失败运行 dashboard 或排障链接。
+- PostToolBatch artifacts 只有在具体运行时存在真实 PostToolBatch 调用点并能把结果送到 daemon bridge 时才接入；daemon ACP 主会话 V1 不假设该通道存在。
+
+需要代码改动：
+
+- `HookOutput.hookSpecificOutput.artifacts?: ToolArtifact[]`。
+- `packages/core/src/hooks/hookAggregator.ts` 的 `mergeWithOrLogic()` 必须为 `artifacts` 增加 concat 逻辑，不走现有 `hookSpecificOutput` last-writer-wins。
+- `packages/core/src/core/toolHookTriggers.ts` 的 `PostToolUseHookResult` / `PostToolBatchHookResult` 增加 `artifacts?: ToolArtifact[]`。
+- `firePostToolUseHook()` 返回 `artifacts?: ToolArtifact[]`。
+- `firePostToolBatchHook()` 返回 `artifacts?: ToolArtifact[]`。
+- `packages/core/src/core/coreToolScheduler.ts` 必须纳入实现计划，因为它是 `firePostToolBatchHook()` 的调用点，也有独立的 `firePostToolUseHook()` 路径。
+- 抽取共享 `collectHookArtifacts()` 或等价 helper，供 `coreToolScheduler.ts` 与 ACP `Session.ts` 两条 PostToolUse 路径复用同一 extraction / validation 前置逻辑，避免两处行为漂移。
+- `Session.runTool()` 收集 tool result artifacts 与 hook artifacts，但二者使用不同传输：tool result artifacts 只来自成功返回的 tool result；hook artifacts 不依赖工具成功，失败路径也可以进入 store。
+- ACP `Session.runTool()` 中，成功工具结果携带的 artifacts 继续附着到 `tool_call_update._meta.artifacts`；PostToolUse / PostToolUseFailure hook 返回的 artifacts 统一通过 `client.extNotification('qwen/notify/session/artifact-event', payload)` 单独发送。该 notification 必须在 hook artifacts 收集完成后同步 await；发送失败只记录 warning，不改变原工具失败/成功结果；这批 hook artifacts 不进入 daemon store，V1 不做持久重试。
+- hook artifacts 与 `record_artifact` / client POST 走同一套 validation：URL scheme、workspace path containment、metadata size/type。
+- batch-level artifacts 没有单一 tool call 时，只有在该运行时已经能向 bridge 发送 ACP `extNotification` 的情况下，才可使用 `qwen/notify/session/artifact-event`。
+
+`qwen/notify/session/artifact-event` payload：
+
+```json
+{
+  "artifacts": [
+    {
+      "kind": "link",
+      "storage": "external_url",
+      "title": "批处理任务详情",
+      "url": "https://ops.example.com/task/batch_123",
+      "mimeType": "text/html"
+    }
+  ],
+  "source": "hook",
+  "hookEventName": "PostToolBatch",
+  "hookName": "task-artifacts",
+  "extensionId": "example-extension"
+}
+```
+
+Transport 约定：
+
+- `qwen/notify/session/artifact-event` 是 ACP `extNotification`，不是 SSE event，也不是 client-facing HTTP route。
+- wire format 复用现有 `qwen/notify/session/*` 通知约定；例如 bridge 已有的 session notification demux 模式。
+- 发送方只能是已经处在 ACP session 通道内、且有能力发送 `extNotification` 的运行时或 extension bridge。ACP `Session.ts` 可以发送该通知；`coreToolScheduler.ts` 本身不能直接向 daemon 主会话发送该通知。
+- `BridgeClient` 在现有 `extNotification` 处理分支按 notification name demux：命中 `qwen/notify/session/artifact-event` 后读取 payload，转换为 `SessionArtifactInput[]`，再进入统一 ingest pipeline。
+- Bridge 必须从 notification transport context 派生 `source: 'hook'`，payload 中的 `source` 只能作为兼容性提示；如果 payload source 与 transport context 不一致，bridge 覆盖为 `hook` 并记录 debug/warning。Notification payload 不能设置 `trustedPublisher`；如果携带 `storage: 'published'`，按普通 untrusted input 校验失败处理。
+
+注意：`qwen/notify/session/artifact-event` 只是 explicit artifacts 的传输 envelope，不应形成第二套 store/validation/dedupe 管道。BridgeClient 必须把 `_meta.artifacts`、hook artifacts 与 `artifact-event.artifacts` 都转换为同一个 `SessionArtifactInput[]`，调用同一个 `ingestArtifacts()` / `SessionArtifactStore.upsertMany()`，复用同一套 validation、normalization、enrichment、eviction 和 `artifact_changed` 发布逻辑。ACP 主会话当前没有 PostToolBatch callsite，不能把 `coreToolScheduler.ts` 的 batch hook 当成 daemon artifacts 面板的默认来源；若后续要支持 daemon 主会话 batch artifacts，必须先增加真实调用点和测试。非 ACP 运行时如果没有 artifact notification sink，不能声明 daemon hook artifacts 支持。
+
+### 6.5 Client / Extension 直接插入
+
+对不想让模型调用工具的场景，提供：
+
+```http
+POST /session/:id/artifacts
+```
+
+适合：
+
+- IDE 插件把当前打开的预览 URL 加入产物区。
+- WebUI 用户手动添加一个资源链接。
+- Channel plugin 或外部集成在任务过程中登记平台资源。
+
+与 hook 输出的区别：
+
+- hook 输出适合 agent 执行链路内部。
+- POST route 适合 daemon client / UI / 外部集成。
+- POST body 必须经过统一 artifact validation，不允许任意本机绝对路径或不支持的 URL scheme。
+
+## 7. Store 与去重
+
+artifact identity：
+
+- workspace 文件：`sessionId + ':workspace:' + normalizedWorkspacePath`
+- managed 文件：`sessionId + ':managed:' + normalizedManagedId`
+- external / published URL：`sessionId + ':url:' + identityUrl`
+
+identity 只描述资源位置，不包含 `source`。tool、hook、client 对同一 URL 或路径的登记合并成一条 artifact，避免右侧面板重复展示同一资源。V1 不维护 `provenance[]`、信任级别或 retention class；首次成功登记者拥有该 artifact 的展示字段和来源审计字段，后续同 identity 登记只表达“同一个资源再次被观察到”。
+
+输入必须且只能携带一个定位字段：
+
+- `workspacePath`
+- `managedId`
+- `url`
+
+如果输入同时携带多个 primary locator，V1 直接拒绝，而不是尝试按优先级猜测 identity。这样可以避免一个 artifact 先按 `workspacePath` 去重、后续又按 `url` 去重而产生重复。
+
+`storage: 'published'` 是唯一例外：它必须携带 `url` 作为 primary locator，可以额外携带 `managedId` 作为 managed reference。published identity 仍按 `url` 计算；`managedId` 只用于未来下载/预览，不参与去重。该例外只接受带内部 `trustedPublisher: true` 的输入；hook、client POST、`record_artifact` 或普通工具返回 `storage: 'published'` 时按校验失败处理。
+
+对外 id：
+
+- 用 identity 的 sha256 前 12 位。
+
+### 7.1 Normalization
+
+`normalizedWorkspacePath`：
+
+- 输入必须是 workspace-relative path；如果入口传入绝对路径，先尝试转换为 workspace-relative path，失败则拒绝。
+- 使用 `path.resolve(workspaceCwd, input)` 得到绝对路径。
+- 校验 resolved path 必须位于 workspace 内：`path.relative(workspaceCwd, resolved)` 不能以 `..` 开头，且不能是绝对路径。
+- 如果目标已存在，使用 `fs.realpath` 检查 symlink 最终目标仍在 workspace 内；symlink 指向 workspace 外则拒绝。
+- 如果目标不存在，registration 可以保留该 artifact，但初始 `status` 必须是 `missing`；不能因为 `realpath` 失败就跳过 symlink containment。后续 GET TTL refresh 时必须重新执行同一 containment + realpath 检查。
+- 如果 refresh 时发现路径已变成指向 workspace 外的 symlink，artifact 保留但 `status` 变为 `missing`，并清除 best-effort `sizeBytes`；V1 绝不把该路径报告为 `available`。
+- 输出统一使用 POSIX slash，去掉开头的 `./`。
+- 不做大小写折叠；即使 macOS 默认文件系统大小写不敏感，identity 仍按字符串区分，避免跨平台行为不一致。
+
+`normalizedManagedId`：
+
+- 输入先 trim ASCII whitespace。
+- trim 后不能为空，长度不超过 200 字符。
+- 拒绝 ASCII 控制字符。
+- 拒绝 `/`、`\`、`..`，不允许表达路径层级或本机绝对路径语义。
+- 不做大小写折叠，identity 按字符串区分。
+- public `managedId` 返回 normalized 后的值。
+
+`identityUrl` 与 `url`：
+
+- 使用 WHATWG `new URL(input)` 解析，禁止字符串 `startsWith('http')` 这类宽松判断。
+- 除 `ArtifactTool` trusted published URL 外，普通 link artifact 只允许 `http:` / `https:`。
+- `url` 字段保存清理后的可点击 URL，供 client 打开；不要把 identity 用 URL 反写成可点击 URL。
+- identity 另用内部 `identityUrl` 计算，不作为 public 字段返回。
+- scheme 和 host 小写。
+- 默认端口归一化：`https:443` / `http:80` 不保留。
+- 保留 fragment；hash-routed SPA 中 fragment 可能是资源 identity 的一部分。
+- 保留 query 参数原始顺序；有些平台对 query 顺序敏感，V1 不做 query sort。
+- 拒绝或清除 `username` / `password`，不把 URL userinfo 存入 artifact store。
+
+去重行为：
+
+- 首次登记：`created`
+- 同 identity 再登记：`updated`
+- `createdAt` 保持不变。
+- `updatedAt` 更新，但不参与 eviction 排序。
+- 同一次 `upsertMany()` 内先按 identity 合并输入；同 identity 的 owner 由 `receivedSeq` 最小的输入决定，若没有 `receivedSeq` 则使用输入数组顺序。BridgeClient 不应把不同 transport event 的 artifacts 无序合并；如果必须合并，必须先分配 `receivedSeq` 再排序。每个最终 identity 只在 `changes[]` 里产生一条 change。若该 identity 在本批之前不存在则为 `created`，否则为 `updated`。
+- 展示字段 `title`、`description`、`source`、`toolCallId`、`toolName`、`hookName`、`extensionId`、`clientId` 采用 first-writer-wins，不被后续同 identity 输入覆盖。
+- 资源本体字段允许安全升级：同 URL identity 从 `external_url` 升级到 `published` 时，可以更新 `storage`、补充 `managedId`、更新 `kind` / `mimeType` / `sizeBytes`，并允许 publisher 覆盖 `title` / `description`，避免占位 link 标题永久遮蔽真实发布物。该升级只接受带内部 `trustedPublisher: true` 的 `storage: 'published'` 输入。
+- `managedId` 从空补齐为 published managed reference 是允许的；已有 `managedId` 不被后续普通输入覆盖。
+- `status` 和 `sizeBytes` 是 daemon 的 best-effort 派生字段，可以随 workspace stat 或 published artifact enrichment 刷新。
+- `metadata` 保存首次登记时通过校验的小对象；后续同 identity 只有 `source: 'tool'` 或 `source: 'client'` 的输入可以做受控富化：只添加不存在的 key，不覆盖已有 key，合并后重新校验 primitive-only 与 4KB 总大小。hook 对已存在 artifact 的 metadata 富化默认忽略。若合并后超限，只丢弃本次 metadata 富化并记录 warning，artifact 的其它安全升级仍可继续。
+- client POST 同 identity 不覆盖展示字段，也不改变 `retentionSource`；它只把内部 `clientRetained` 置为 `true`，用于表达用户手动保留意图。
+- 实现应在单个 `SessionArtifactStore.upsertMany()` 内同步处理，避免异步读改写竞态。
+
+内部 store 字段：
+
+- `retentionSource`：首次成功登记者的 `source`，创建时赋值，之后不随 client POST 或重复 upsert 改变。
+- `clientRetained`：布尔值，初始为 `source === 'client'`；任意通过 mutation gate 的 client POST 命中同 identity 时置为 `true`。`clientRetained` 不改变展示字段，也不迁移 `retentionSource` bucket。
+- `insertSeq`：store 内单调递增序号，创建 artifact 时赋值一次，永不刷新。
+- `receivedSeq`：输入接收顺序，只用于同批 deterministic coalescing，不作为 public 字段返回。
+
+配额与保留策略：
+
+- 每 session 最多 200 个 artifacts。
+- V1 使用 soft source reservation，reservation 按内部 `retentionSource` 归属：
+  - `tool`: 100
+  - `client`: 50
+  - `hook`: 50
+- reservation 是最低保留额度，不是硬上限；未使用额度可以被其它来源借用，直到全局 200 上限。
+- 新建 artifact 导致总量超过 200 时，按以下顺序选择 eviction candidate。本批 `upsertMany()` 新创建的 artifact 默认不进入候选池；eviction 先只在本批开始前已经存在的 artifacts 中选择候选。这样一个本批新登记的 missing artifact 可能在满 store 中挤掉仍然 live 的旧 artifact，这是 V1 为保证当前显式产物可见性作出的选择。
+  1. 优先裁剪 `status: 'missing'` 且 `clientRetained === false` 的 artifact。
+  2. 其次从 `retentionSource` 数量超过 reservation 的来源中裁剪 `clientRetained === false` 的 artifact。
+  3. 再裁剪 `clientRetained === false` 的最旧 artifact。
+  4. 如果所有 artifact 都是 `clientRetained === true`，裁剪最旧的 client-retained artifact。
+- eviction 使用 cached `missing` 优先级前，必须对即将作为候选的 workspace artifacts 做 best-effort status refresh / containment check；如果刷新后为 `available`，不能继续把它当 missing 优先裁剪。刷新失败时保留原 cached 状态。
+- `clientRetained` 是最后裁剪偏好，不是无限 pin，也不突破 200 全局上限或 soft reservation。所有 artifact 都是 client-retained 时，仍按最旧 client-retained artifact 裁剪。
+- 如果裁完旧 artifact 后，本批新创建 artifact 自身仍超过剩余容量，store 必须在生成 `changes[]` 前按 `receivedSeq` / 输入顺序保留前 N 个新 identity，丢弃超出的本批输入并记录 warning/diagnostics。被丢弃的新输入不进入 store，不产生 `created` 或 `removed` change，因此同一次 mutation 内同一 identity 不会出现 `created` 后又 `removed`。
+- “最旧”排序使用 `(createdAt, insertSeq)`，`insertSeq` 是 store 内部单调递增序号，用来稳定同毫秒或同批输入的 tiebreaker。
+- 同 identity 重复登记会刷新 `updatedAt`，但 eviction 不看 `updatedAt`；因此其它来源不能通过高频重复登记把一个旧 artifact 固定在保留集合里。
+- 返回 `createdAt` 升序。
+- 裁剪必须为每个被移除 artifact 发送 `artifact_changed` / `removed`。V1 不提供其它裁剪事件。
+- reservation 数值、`retentionSource`、`clientRetained` 与 `insertSeq` 是 V1 实现细节，不是 wire protocol 字段；后续可在不改变 API shape 的前提下调整默认值，或增加更细的 per-producer quota。
+
+### 7.2 V1 生命周期限制
+
+V1 的 store 是 live bridge session 内存索引：
+
+- bridge/session 重启后 artifacts 不恢复。
+- Client SSE 断线重连后应重新 `GET /session/:id/artifacts` 做 snapshot sync。
+- V1 不要求额外 `artifacts_reset` event；如果后续支持 session 继续存在但 artifact store 被清空的运行模式，再增加 `artifacts_reset` 或等价 snapshot-invalidated event。
+- 历史恢复、跨进程持久化和 session load replay 属于后续阶段。
+
+## 8. 内部实现链路
+
+以下 Phase 是同一 V1 完整能力的工程实施顺序，不代表对外拆成多个版本。实现 PR 可以按 Phase 拆小，但合并后的设计基准是一项完整 session artifacts 能力。
+
+### 8.1 Phase A: core types and ArtifactTool
+
+改动：
+
+- `packages/core/src/tools/tools.ts`
+  - 增加 `ToolArtifactKind`、`ToolArtifactStorage`、`ToolArtifact`。
+  - 扩展 `ToolResult.artifacts?`。
+- `packages/core/src/tools/artifact/artifact-tool.ts`
+  - 成功 publish 后填充 `artifacts`。
+  - 使用 `storage: 'published'`，不把 qwen home 本机路径作为 `workspacePath` 暴露。
+
+Phase A 先接入 `ToolResult.artifacts` 和 `ArtifactTool`；`record_artifact` 在 Phase D 接入，但仍属于同一个 V1 完整能力。
+
+### 8.2 Phase B: cli ACP session metadata
+
+改动：
+
+- `packages/cli/src/acp-integration/session/types.ts`
+  - `ToolCallResultParams.artifacts?`
+- `packages/cli/src/acp-integration/session/emitters/ToolCallEmitter.ts`
+  - `_meta.artifacts = params.artifacts`
+- `packages/cli/src/acp-integration/session/Session.ts`
+  - 工具成功后收集 `toolResult.artifacts`。
+  - PostToolUse hook artifacts 独立于工具成功/失败收集，用于 error trace / dashboard 等失败诊断产物。
+  - 失败路径 hook artifacts 不能依赖成功 result metadata；必要时直接调用 bridge artifact ingest。
+  - 不从普通 `WRITE_FILE` / `EDIT` / `NOTEBOOK_EDIT` 自动派生 artifacts。
+  - 传给 `emitResult()`。
+
+### 8.3 Phase C-1: acp-bridge store and events
+
+新增：
+
+- `packages/acp-bridge/src/sessionArtifacts.ts`
+  - 类型
+  - normalize
+  - validation
+  - id/hash
+  - `SessionArtifactStore`
+
+Bridge session entry 增加：
+
+```ts
+artifacts: SessionArtifactStore;
+```
+
+Bridge interface 增加：
+
+```ts
+getSessionArtifacts(sessionId: string): SessionArtifactsEnvelope;
+addSessionArtifacts(
+  sessionId: string,
+  artifacts: SessionArtifactInput[],
+): DaemonSessionArtifactMutationResult;
+removeSessionArtifact(
+  sessionId: string,
+  artifactId: string,
+): DaemonSessionArtifactMutationResult;
+```
+
+BridgeClient：
+
+- 从 `session_update/tool_call_update._meta.artifacts` 提取 artifacts。
+- 从 `qwen/notify/session/artifact-event` 提取 explicit notification artifacts。
+- 所有输入都转换为同一个 `SessionArtifactInput[]`。
+- 基于 transport context 分配 `source`、`receivedSeq`。`trustedPublisher` 只由 completed `ArtifactTool` session update 的 bridge-side ingest option 分配；BridgeClient 不得根据 artifact payload 字段或普通 `_meta.artifacts` 内容推断。
+- 统一调用 `ingestArtifacts()` / `SessionArtifactStore.upsertMany()`，不要为 notification artifacts 建第二套 validation 或 dedupe。
+- `upsertMany()` 返回 `DaemonSessionArtifactMutationResult`，包含 created/updated 以及 eviction 产生的 removed changes。
+- 对每个 change 发布 `artifact_changed`，先发布 created/updated，再发布 removed。
+- `removeSessionArtifact()` 从 store 删除 artifact，返回 `reason: 'explicit'` 的 removed change，并发布 `artifact_changed`。
+
+### 8.4 Phase C-2: serve snapshot API
+
+改动：
+
+- `packages/cli/src/serve/capabilities.ts`
+  - 增加 `session_artifacts`。
+- `packages/cli/src/serve/server.ts`
+  - 增加 `GET /session/:id/artifacts`。
+  - 增加 `DELETE /session/:id/artifacts/:artifactId`。
+
+GET 行为：
+
+- session 不存在：现有 404。
+- 无 artifacts：返回空数组。
+- workspace artifact 维护内部 status cache，例如 `lastStatAt`、`lastKnownSizeBytes`、`lastKnownStatus`。
+- upsert 时做一次 best-effort stat。
+- GET 默认使用 cache；仅当 `lastStatAt` 过期时按 TTL 刷新，例如 5-30 秒，并限制并发 stat 数量。刷新时必须重新执行 Section 7.1 的 workspace containment 与 realpath symlink check。
+- stat 失败：GET 返回 `status: 'missing'`，不删除 artifact。
+- stat 成功且 containment / realpath check 仍通过：如果此前 cache 是 `missing`，GET 返回 `status: 'available'`。
+- 如果 refresh 发现 symlink escape 或 workspace containment 失败，GET 返回 `status: 'missing'`，不返回新的 `sizeBytes`。
+- GET 可以静默刷新 status cache，但不得因为读请求发布 `artifact_changed`；V1 status 对 SSE 客户端是最终一致的。
+- 如果后续需要实时 status 事件，应由后台 refresh 或显式 refresh mutation 发布 `artifact_changed` / `updated`，不要放在 GET 热读路径。
+- managed / URL artifact 不探测本机路径，始终返回 `status: 'available'`。
+
+### 8.5 Phase C-3: SDK list/event support
+
+改动：
+
+- `packages/sdk-typescript/src/daemon/types.ts`
+  - 增加 artifact 类型。
+- `packages/sdk-typescript/src/daemon/events.ts`
+  - known event 增加 `artifact_changed`。
+- `packages/sdk-typescript/src/daemon/DaemonClient.ts`
+  - `listSessionArtifacts(sessionId, opts?, clientId?)`
+  - `addSessionArtifact(sessionId, artifact, clientId?)`
+  - `removeSessionArtifact(sessionId, artifactId, clientId?)`
+- `packages/sdk-typescript/src/daemon/DaemonSessionClient.ts`
+  - `artifacts(opts?)`
+  - `addArtifact(artifact)`
+  - `removeArtifact(artifactId)`
+- `packages/sdk-typescript/src/index.ts`
+  - 导出类型。
+
+SDK singular add 映射到 bridge plural mutation：`addSessionArtifact(a)` 包装为 `addSessionArtifacts(sessionId, [a])`，返回完整 `DaemonSessionArtifactMutationResult`，不丢弃 eviction 产生的 removed changes。
+
+### 8.6 Phase D: record_artifact explicit registration
+
+改动：
+
+- `packages/core/src/tools/tool-names.ts`
+  - 增加 `RECORD_ARTIFACT: 'record_artifact'`。
+- 新增 `packages/core/src/tools/record-artifact.ts`
+  - 实现 `RecordArtifactTool`。
+  - 参数使用 `workspacePath` / `managedId` / `url`，不接受任意本机绝对路径。
+  - 不接受 `storage: 'published'` 或 `url + managedId` published 例外。
+  - 输出 `ToolResult.artifacts`，复用 V1 store/event/list 链路。
+- `Config.createToolRegistry`
+  - feature-gated 或 skill/extension opt-in 注册，避免给所有 session 增加模型可见 tool。
+
+### 8.7 Phase E: hook artifacts explicit registration
+
+改动：
+
+- `packages/core/src/hooks/types.ts`
+  - `HookOutput.hookSpecificOutput.artifacts?: ToolArtifact[]`。
+- `packages/core/src/hooks/hookAggregator.ts`
+  - `mergeWithOrLogic()` 对 `artifacts` 多 hook concat，不走 last-writer-wins。
+- `packages/core/src/core/toolHookTriggers.ts`
+  - `PostToolUseHookResult` / `PostToolBatchHookResult` 增加 `artifacts?: ToolArtifact[]`。
+- `packages/core/src/core/coreToolScheduler.ts`
+  - 覆盖 core scheduler 的 PostToolUse / PostToolBatch artifacts 传播路径。
+- `packages/cli/src/acp-integration/session/Session.ts`
+  - 覆盖 ACP session 的 PostToolUse artifacts 传播路径。
+- 两条 PostToolUse 路径复用同一个 hook artifact collection helper。
+- ACP session V1 不声明 PostToolBatch artifacts 支持；如果产品要求 daemon 主会话 batch artifacts，必须在 ACP Session 增加真实 PostToolBatch callsite，而不是依赖 `coreToolScheduler.ts` 的非 daemon 主会话路径。
+- 其他运行时如已有 batch-level artifact notification，可通过 `qwen/notify/session/artifact-event` 发给 bridge。
+- BridgeClient 从 `qwen/notify/session/artifact-event` 提取 batch-level artifacts，走同一套 validation 和 upsert。
+
+### 8.8 Phase F: client POST / SDK add explicit registration
+
+改动：
+
+- `packages/cli/src/serve/server.ts`
+  - 增加 `POST /session/:id/artifacts`，走 `mutate({ strict: true })`。
+  - 增加 `DELETE /session/:id/artifacts/:artifactId`，走 `mutate({ strict: true })`。
+  - validate body。
+  - source 设置为 `client`。
+  - 转换为单元素 `SessionArtifactInput[]`，调用 bridge 的 `addSessionArtifacts()`。
+  - POST 不接受 `storage: 'published'` 或 `trustedPublisher`。
+  - DELETE 调用 bridge 的 `removeSessionArtifact()`；artifact 已不存在时返回空 `changes[]`，不发布 SSE。
+  - 发布 `artifact_changed`，先发布 created/updated，再发布 removed。
+- artifact add 不新增单数 bridge mutation；所有新增入口都走 `addSessionArtifacts()` / `upsertMany()`，避免 validation、coalescing、eviction 行为漂移。artifact remove 使用单独的 `removeSessionArtifact()`，因为它按 server-assigned artifact id 删除，不参与 input validation / identity coalescing。
+
+- SDK 增加：
+  - `DaemonClient.addSessionArtifact(sessionId, artifact, clientId?)`
+  - `DaemonSessionClient.addArtifact(artifact)`
+  - `DaemonClient.removeSessionArtifact(sessionId, artifactId, clientId?)`
+  - `DaemonSessionClient.removeArtifact(artifactId)`
+
+## 9. 安全边界
+
+### 9.1 URL
+
+- 普通 link artifact 只允许 `http:` / `https:`。
+- 必须使用 WHATWG `new URL(input)` 解析并检查 `parsed.protocol`，禁止基于字符串前缀判断。
+- 存储前拒绝或清除 `parsed.username` / `parsed.password`，避免 URL credential 泄漏。
+- `record_artifact` / hook / client POST 不允许 `file://`。
+- `ArtifactTool` 返回的 `file://` published URL 保持例外，因为它来自已授权 publish；remote daemon 场景应优先使用远端 publisher 的 `https:` URL。
+- Daemon 不 fetch URL。
+- Client 展示 host。
+- URL 不自动打开。
+- Client 不得因为 `kind: 'image' | 'video' | 'audio' | 'html'` 就自动把 external URL 填入 `<img>`、`<video>`、`<audio>`、`iframe` 或类似会发起网络请求的预览元素。V1 对 external URL 只展示图标、标题、host 和点击入口；远程预览必须等用户显式点击，或后续通过单独 preview capability 与 sandbox 策略启用。
+- Client 应对 loopback、RFC 1918、link-local、metadata service 等私网地址做 warning 或 block；Daemon V1 不解析 DNS，不承担 SSRF 防护的最终判断。
+
+### 9.2 Path
+
+- 对外只返回 `workspacePath`，它必须是 workspace-relative path。
+- workspace 外 path 不作为 file artifact 暴露。
+- `record_artifact` / hook / client POST 如果传 `workspacePath`，必须在 workspace 内。
+- 校验算法见 Section 7.1：`path.resolve` + `path.relative` containment check，目标存在时再做 `fs.realpath` symlink escape check；目标不存在时 artifact 可以进入 store，但必须标记为 `missing`，后续 GET/status refresh 继续重跑同一校验。
+- 拒绝 `..` escape、绝对路径 escape、symlink 指向 workspace 外、`~/.qwen`、`/tmp` 等本机外部路径。
+- `managedId` 只能引用 daemon-managed storage；trim 后不能为空，拒绝路径分隔符、`..`、控制字符和本机绝对路径语义。
+
+### 9.3 Metadata
+
+- 限制大小，例如 JSON stringify 后不超过 4KB。
+- 只允许 primitive value。
+- 不允许 nested object/array，避免 UI 和持久化复杂化。
+- 不放 secret、token、cookie、signed URL、私钥、访问凭证。
+- metadata string value 如果被 UI 展示，必须作为 untrusted plain text 渲染或 escape；metadata 不是 HTML/markdown 扩展点。
+- V1 不提供 `visibility`、`sensitivity`、`expiresAt`、`sourceId` 等无消费者字段；artifact visibility 固定为当前 session-local 语义。
+- audit 维度通过首次登记者的 `source` / `toolCallId` / `toolName` / `hookName` / `extensionId` / `clientId`、`createdAt`、`updatedAt` 承载。
+- 同 identity 后续登记默认不覆盖首次登记者的展示字段；唯一例外是 Section 7 定义的 trusted `external_url -> published` upgrade，此时 publisher 可以覆盖 `title` / `description`。metadata 只允许 Section 7 定义的受控富化，避免跨来源 metadata 注入。
+
+### 9.4 Text Fields
+
+- `title` / `description` 是 plain text，不是 HTML，也不是 markdown。
+- Daemon validation 必须做长度、trim、ASCII 控制字符拒绝；不要把子串黑名单当作 XSS 安全边界。
+- 所有可能进入 UI 的文本字段，包括 `title`、`description`、`metadata` string value、`toolName`、`hookName`、`extensionId`、`clientId`，client 都必须作为 untrusted text 渲染或 HTML escape，禁止通过 `innerHTML` 直接插入。
+
+### 9.5 Anti-spam
+
+- 每 session 最多 200 个 artifacts。
+- soft reservation 默认 `tool: 100`、`client: 50`、`hook: 50`，未使用额度可被其它来源借用。
+- `record_artifact` 每次 tool call 只登记 1 个 artifact。
+- `POST /session/:id/artifacts` 走现有 rate limit / mutation gate。
+- eviction 必须逐条发送 `artifact_changed` / `removed` event。
+- Client 可按 source/toolName 分组或折叠。
+
+### 9.6 Validation Diagnostics
+
+- `record_artifact` 参数校验失败时返回工具错误，不产生 artifact。
+- `POST /session/:id/artifacts` body 校验失败时返回 400。
+- `_meta.artifacts`、hook artifacts 或 `artifact-event` 中的单条 malformed artifact 不应破坏原始 tool/session event；bridge 应跳过该 artifact，并记录 warning-level log。
+- warning log 至少包含 sessionId、source、toolName / hookName / extensionId / clientId、失败字段和原因；不要记录 secret-like metadata value。
+- debug log 可以记录经过脱敏和长度截断的 rejected artifact payload。
+- 如果现有 telemetry/metrics 基础设施可用，增加 validation rejection counter，按 source 和 reason 打标签；如果暂时没有 metrics，日志是 V1 的最低要求。
+
+## 10. 与“普通链接”的边界
+
+右侧 artifacts 面板只展示声明式 artifacts；聊天正文仍可显示普通链接。
+
+不做自动抽取的原因：
+
+- 普通回答里的文档链接、引用链接、调试链接会大量误入产物区。
+- URL 可能是示例、模板、半成品、错误输出。
+- 自动抽取会让模型无法控制“哪些链接值得用户后续使用”。
+- 安全上，显式登记更容易做来源标记和 UI 警示。
+
+如果业务强烈需要从文本中提取 URL，应作为 Client 可选 UX：
+
+- 仅在聊天正文附近显示。
+- 不进入 daemon artifact store。
+- 不触发 `artifact_changed`。
+
+## 11. Skill / Agent 使用方式
+
+V1 提供 `record_artifact` 后，skill 或 agent.md 可以写：
+
+```md
+当你根据工具结果构造出可供用户查看的业务资源 URL 时，调用 record_artifact 工具登记它。
+
+登记规则：
+
+- title 使用资源的人类可读名称。
+- kind 使用 link。
+- storage 使用 external_url。
+- url 使用最终可点击 URL。
+- metadata.resourceType 填资源类型，例如 data_platform_resource、scheduler_task。
+- 不要把普通参考文档链接登记为 artifact。
+```
+
+模型执行后：
+
+1. 调用业务工具拿到资源 ID、任务 ID、节点 ID。
+2. 按 skill 规则拼 URL。
+3. 调用 `record_artifact`。
+4. Daemon 右侧产物区出现该 link。
+
+这个方案不要求 skill 编写 hook，也不要求 extension/plugin 代码，最适合多数业务规则。
+
+## 12. Hook / Extension 使用方式
+
+V1 提供 hook artifacts 后，extension 可在 `qwen-extension.json` 或 `hooks/hooks.json` 中提供 PostToolUse hook：
+
+```json
+{
+  "hooks": {
+    "PostToolUse": [
+      {
+        "matcher": "mcp__data_platform__get_resource",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node ${CLAUDE_PLUGIN_ROOT}/scripts/table-artifact.js"
+          }
+        ]
+      }
+    ]
+  }
+}
+```
+
+当前 qwen-code extension/hook 变量替换仍支持 `${CLAUDE_PLUGIN_ROOT}`；如果后续引入新的 qwen-specific root 变量，示例可随实现同步迁移。
+
+脚本 stdout：
+
+```json
+{
+  "continue": true,
+  "hookSpecificOutput": {
+    "hookEventName": "PostToolUse",
+    "artifacts": [
+      {
+        "kind": "link",
+        "storage": "external_url",
+        "title": "用户画像资源详情",
+        "url": "https://platform.example.com/resources/user-profile",
+        "mimeType": "text/html",
+        "metadata": {
+          "resourceType": "data_platform_resource"
+        }
+      }
+    ]
+  }
+}
+```
+
+这适合企业插件：把“如何从工具结果拼业务 URL”的逻辑固化在 extension 中，而不是写进每个 prompt。
+
+## 13. 测试计划
+
+### 13.1 Phase A core
+
+覆盖：
+
+- `ToolResult.artifacts` 类型编译。
+- `ArtifactTool` 成功返回 `storage: 'published'` 的 html artifact。
+- `ArtifactTool` 不把 qwen home 本机绝对路径作为 `workspacePath` 暴露。
+- `ToolArtifact.kind` / `storage` 默认推断规则有单测覆盖。
+
+命令：
+
+```bash
+cd packages/core && npx vitest run src/tools/artifact/artifact-tool.test.ts
+```
+
+### 13.2 Phase B cli session
+
+覆盖：
+
+- `ToolCallEmitter.emitResult()` 输出 `_meta.artifacts`。
+- `toolResult.artifacts` 被传给 `emitResult()`。
+- completed `ArtifactTool` session update 会通过 bridge-side ingest option 设置内部 `trustedPublisher: true`；`record_artifact`、其它 tool result、hook payload、client POST 不会设置，BridgeClient 也不能通过 artifact payload 字段推断。
+- `write_file/edit/notebook_edit` 普通源码修改不自动派生 artifact。
+- `read_file/grep/glob/shell` 不派生 artifact。
+- 工具失败时不收集失败 tool result 的 artifacts；PostToolUse hook 显式返回的诊断 artifacts 仍可进入 store。
+- 失败路径 hook artifacts 不依赖成功 result `_meta.artifacts`。
+
+命令：
+
+```bash
+cd packages/cli && npx vitest run src/acp-integration/session/emitters/ToolCallEmitter.test.ts
+cd packages/cli && npx vitest run src/acp-integration/session/Session.test.ts
+```
+
+### 13.3 Phase C-1 acp-bridge
+
+覆盖：
+
+- `SessionArtifactStore` created/updated/removed。
+- `ToolArtifact` 到 `DaemonSessionArtifact` 的 enrichment。
+- `SessionArtifactInput` 是所有入口统一的内部输入类型。
+- 默认 `kind` / `storage` 推断，覆盖 published->html、html/image/video/audio/pdf/notebook/file。
+- workspacePath / managedId / URL identity 去重，且 identity 不包含 source，跨 source 登记同一资源会合并为一条 artifact。
+- 同时携带多个 primary locator 的普通 artifact 被拒绝；只有 `trustedPublisher: true` 且 `storage: 'published'` 允许 `url + managedId`，identity 只按 `url`。
+- hook、client POST、`record_artifact` 或普通 tool result 伪造 `storage: 'published'` 会被拒绝或跳过并记录 warning。
+- managedId normalization：trim、空值拒绝、路径分隔符拒绝、`..` 拒绝、控制字符拒绝、大小写不折叠。
+- URL validation：scheme/host lowercase、default port 归一、fragment 保留、query 顺序保留、userinfo rejection/removal。
+- `url` 保存清理后的可点击 URL，identity 用内部 `identityUrl`，两者不混用。
+- Path validation：`../../etc/passwd`、workspace 外绝对路径、symlink escape 均被拒绝；不存在路径进入 store 时为 `missing`，GET TTL refresh 重新做 containment / realpath check。
+- Title/description validation：长度限制、trim、控制字符拒绝、plain text、明显 HTML/script payload 拒绝。
+- Metadata validation：大小限制、primitive-only、nested object/array 拒绝。
+- 同 identity upsert 对展示字段和来源字段采用 first-writer-wins。
+- 同 URL identity 支持可信 `external_url -> published` 资源本体升级，补齐 `managedId` / `kind` / `mimeType`，并允许 publisher 覆盖占位 `title` / `description`。
+- tool/client 后续 metadata 只能添加缺失 key，不能覆盖已有 key，合并后重新满足 4KB 和 primitive-only 约束。
+- hook 后续 metadata 富化默认忽略。
+- 同一批内重复 identity 按 `receivedSeq` / 输入数组顺序确定 owner，并在 `changes[]` 中只产生一条最终 change。
+- `retentionSource` 创建时赋值且不刷新；`clientRetained` 与 `retentionSource` 分离；`insertSeq` 创建时赋值且不刷新。
+- soft reservation eviction：未用额度可借用，missing 优先裁剪，client-retained 最后裁剪，`createdAt + insertSeq` 稳定排序，且逐条发送 `reason: 'eviction'` 的 removed event。
+- eviction 使用 missing 优先级前会刷新候选 workspace artifact 状态，避免 stale missing cache 优先裁剪已恢复文件。
+- eviction 不会优先裁剪本批刚创建的 missing artifact；如果本批自身超过剩余容量，超出的本批新输入在产生 changes 前被丢弃并记录 diagnostics，不产生同 identity 的 `created` + `removed`。
+- `clientRetained` 不突破全局 200 上限；全量 client-retained 时仍裁剪最旧项。
+- malformed artifact 会产生 warning log / diagnostics，不影响原始 event。
+- `_meta.artifacts` 被写入 store。
+- `artifact_changed` 发布。
+- `upsertMany()` / `addSessionArtifacts()` 返回包含 eviction changes 的 `DaemonSessionArtifactMutationResult`。
+- `removeSessionArtifact()` 返回 `reason: 'explicit'` 的 removed change。
+
+命令：
+
+```bash
+cd packages/acp-bridge && npx vitest run src/sessionArtifacts.test.ts
+cd packages/acp-bridge && npx vitest run src/bridgeClient.test.ts
+```
+
+### 13.4 Phase C-2 serve
+
+覆盖：
+
+- `/capabilities` 包含 `session_artifacts`。
+- `GET /session/:id/artifacts` 返回空列表。
+- 有 artifacts 时返回 envelope。
+- envelope 不返回宿主机绝对 `workspaceCwd`。
+- 未知 session 返回现有错误。
+- workspace artifact GET TTL refresh 时 best-effort stat，缺失文件返回 `status: 'missing'`，文件恢复后返回 `status: 'available'`。
+- GET TTL refresh 会重新做 workspace containment / symlink realpath check；symlink escape 返回 `missing`。
+- GET status refresh 不发布 `artifact_changed`；managed / URL artifact 不做本机 stat。
+- GET 使用 status cache / TTL，避免每次热读对所有 artifacts 做同步 stat。
+
+命令：
+
+```bash
+cd packages/cli && npx vitest run src/serve/server.test.ts
+```
+
+### 13.5 Phase C-3 SDK
+
+覆盖：
+
+- `listSessionArtifacts()` route 正确。
+- `artifact_changed` known event narrowing，event artifact 是完整 `DaemonSessionArtifact`。
+- public index 导出新增类型。
+- public response enum 类型是 open union，client 对未知 kind/status/source/storage 有 fallback。
+- SDK singular add 包装 bridge plural add 并返回完整 mutation result；SDK remove 调用 DELETE route。
+
+命令：
+
+```bash
+cd packages/sdk-typescript && npx vitest run src/daemon/DaemonClient.test.ts
+cd packages/sdk-typescript && npx vitest run src/daemon/events.test.ts
+```
+
+### 13.6 Phase D/E/F explicit registration tests
+
+`record_artifact`：
+
+- 校验 title / workspacePath / managedId / url。
+- 不允许空 `workspacePath + managedId + url`，也不允许普通输入同时传多个 primary locator。
+- 不允许 `storage: 'published'`。
+- 不允许不支持的 URL scheme。
+- URL userinfo 被拒绝或清除。
+- 返回 `ToolResult.artifacts`。
+- `llmContent` 返回结构化登记结果；每次 tool call 只登记一个 artifact。
+
+hook artifacts：
+
+- `HookOutput.hookSpecificOutput.artifacts` 通过 `createHookOutput()`、`toolHookTriggers.ts` 进入 `PostToolUseHookResult` / `PostToolBatchHookResult`。
+- `hookAggregator.ts` 的 `mergeWithOrLogic()` 多 hook artifacts concat。
+- `coreToolScheduler.ts` 和 ACP `Session.ts` 两条路径都能传播 PostToolUse artifacts。
+- 两条 PostToolUse 路径复用共享 hook artifact collection helper。
+- ACP main session 不声明 PostToolBatch artifacts；如后续增加真实 callsite，需要单测覆盖。
+- PostToolUse / PostToolUseFailure hook artifacts 通过 `qwen/notify/session/artifact-event` extNotification 单独进入 bridge，不依赖成功 tool result `_meta.artifacts`。
+- 已有 batch notification 的运行时可通过 `qwen/notify/session/artifact-event` 被写入 store。
+- hook artifacts 与其他入口经过同一 validation。
+- hook payload `source` 由 bridge 按 transport context 派生，不能伪造 tool source 或 trusted publisher。
+- 工具失败时 hook 返回的 error/dashboard artifact 仍能进入 store。
+
+client POST / SDK add：
+
+- `POST /session/:id/artifacts` 成功 upsert。
+- `POST` 返回 `DaemonSessionArtifactMutationResult`，包含 created/updated 以及 eviction removed changes。
+- `POST` 触发 upsert + eviction 时，验证每个 `changes[]` 项都同步发布为 `artifact_changed` SSE event，且 created/updated 先于 removed。
+- `POST` 在未授权/无 mutation token 时被拒绝。
+- `POST` 对 workspace 外 path、path traversal、symlink escape 返回 400。
+- `POST` 对 `storage: 'published'`、多 primary locator、metadata 超限返回结构化错误 envelope。
+- `POST` 通过 bridge `addSessionArtifacts()` 单一路径写入。
+- `DaemonClient.addSessionArtifact()` body 正确。
+- `DELETE /session/:id/artifacts/:artifactId` 命中时返回 `reason: 'explicit'` 的 removed change，并发布对应 SSE event，不删除底层文件或 URL。
+- `DELETE /session/:id/artifacts/:artifactId` 未命中时幂等返回空 `changes[]`，不发布 SSE event。
+
+### 13.7 跨包集成测试
+
+覆盖完整链路：
+
+1. tool 返回 `ToolResult.artifacts`。
+2. `ToolCallEmitter` 写入 `_meta.artifacts`。
+3. `BridgeClient` 从 event 中提取 artifacts。
+4. `SessionArtifactStore` validate / normalize / upsert。
+5. SSE 发送 `artifact_changed`。
+6. `GET /session/:id/artifacts` 返回同一个 artifact。
+7. Client 断线重连后重新拉 snapshot 能恢复当前内存状态。
+8. 填充 artifacts 到接近上限后新增 artifact，断言 SSE 同时包含 created 与 `reason: 'eviction'` 的 removed event，随后 GET 只返回裁剪后的状态。
+
+### 13.8 手工验收
+
+场景 A：文件产物
+
+1. ArtifactTool 发布 `lineage.html`。
+2. `GET /session/:id/artifacts` 返回 `storage: 'published'` 的 html artifact。
+3. SSE 收到 `artifact_changed`。
+
+场景 B：普通源码编辑不进入产物区
+
+1. agent 修改源码文件。
+2. file change / diff 正常出现。
+3. artifact list 不变化。
+
+场景 C：显式业务链接产物
+
+1. skill 要求模型拼内部资源详情 URL。
+2. 模型调用 `record_artifact`。
+3. 右侧产物区出现 link artifact。
+
+场景 D：hook 产物
+
+1. extension 注册 PostToolUse hook。
+2. hook 根据 tool output 返回 artifacts。
+3. 右侧产物区出现 hook source artifact。
+
+场景 E：普通链接不进入产物区
+
+1. assistant 回复 markdown link。
+2. artifact list 不变化。
+
+## 14. 验收标准
+
+V1 完整能力实现后至少满足：
+
+- `session_artifacts` feature 存在。
+- `GET /session/:id/artifacts` 可用。
+- `artifact_changed` event 可用。
+- `ArtifactTool` 生成 published html artifact。
+- `ToolResult.artifacts` 能进入 daemon artifact store。
+- `record_artifact` 能登记 link / workspace artifact，且 feature-gated 或 opt-in 注册。
+- hook 能通过 `hookSpecificOutput.artifacts` 注入 artifact，多个 hook artifacts concat。
+- client 可通过 `POST /session/:id/artifacts` 注入 artifact。
+- client 可通过 `DELETE /session/:id/artifacts/:artifactId` 显式移除误登记 artifact。
+- 普通 `WRITE_FILE` / `EDIT` / `NOTEBOOK_EDIT` 不自动进入 artifact list。
+- 普通 assistant 文本 URL 不进入 artifact list。
+- SDK 能 list/add/remove artifacts，能识别 `artifact_changed`。
+- SDK remove 对已不存在 artifact 的 idempotent empty result 映射正确。
+- workspacePath / URL / metadata 安全边界有单测。
+- managedId normalization 有单测。
+- 同 identity first-writer-wins、published upgrade、metadata controlled enrichment、soft reservation eviction 有单测。
+- eviction 会逐条通知 client 移除。
+- validation failure 有 warning log / diagnostics。
+- hook/client/record_artifact 三个入口经过同一 validation。
+- `npm run build && npm run typecheck` 通过。
+
+## 15. 推荐落地顺序
+
+V1 内部建议按以下顺序实现；这是工程排期，不是能力拆分：
+
+1. `ToolArtifact` + `ToolResult.artifacts?`
+2. `ArtifactTool` structured artifacts
+3. `ToolCallEmitter._meta.artifacts`
+4. `Session.runTool()` 只收集 `toolResult.artifacts`
+5. `SessionArtifactStore` validation / normalize / enrichment / upsert
+6. BridgeClient 消费 `_meta.artifacts`
+7. `GET /session/:id/artifacts`
+8. SDK list/event 类型
+9. `RecordArtifactTool`
+10. hook output artifacts
+11. `qwen/notify/session/artifact-event`
+12. `POST /session/:id/artifacts`
+13. SDK addArtifact
+14. managed / published storage 引用补齐
+15. 协议文档与 tests
+
+## 16. 后续路线
+
+Phase 2：历史恢复
+
+- artifacts 写入 chat recording metadata。
+- HistoryReplayer 重放 artifacts。
+- `session/load` 后 artifact list 可恢复。
+
+Phase 3：详情与预览
+
+- `GET /session/:id/artifacts/:artifactId`
+- preview metadata。
+- 图片/PDF/HTML 预览策略。
+
+Phase 4：安全动态预览
+
+- 独立 sandbox origin。
+- iframe sandbox。
+- HTML/React artifact shim。
+
+Phase 5：长期存储
+
+- OSS/MinIO。
+- retention policy。
+- pin/delete/version history。
+
+## 17. 总结
+
+Link 可以是 artifact，但必须显式登记。右侧产物区不应该自动收集所有文本链接。
+
+V1 对外是一项完整能力，内部由统一 store 和四类入口组成：
+
+1. **工具入口**：`ToolResult.artifacts` / `ArtifactTool` 产生结构化 artifact metadata。
+2. **模型/skill 入口**：`record_artifact` 工具。
+3. **hook/extension 入口**：`hookSpecificOutput.artifacts`。
+4. **client 入口**：`POST /session/:id/artifacts`。
+
+这些入口最终都进入同一个 `SessionArtifactStore`，通过同一个 `GET /session/:id/artifacts` 查询，通过同一个 `artifact_changed` SSE 事件更新 UI。这样能覆盖业务 link、文件、HTML、图片、视频等产物，同时保持协议简单、来源清晰、边界可控。最重要的边界是：Artifacts 是被声明的 session outputs，不是所有普通文件编辑或普通链接的集合。
diff --git a/docs/users/configuration/settings.md b/docs/users/configuration/settings.md
index 9b57195942..345e9dc39f 100644
--- a/docs/users/configuration/settings.md
+++ b/docs/users/configuration/settings.md
@@ -503,7 +503,7 @@ LSP server configuration is done through `.lsp.json` files in your project root
 | `experimental.cron`                    | boolean | Enable in-session cron/loop tools (`cron_create`, `cron_list`, `cron_delete`) so the model can create recurring prompts. Can be disabled via the `QWEN_CODE_DISABLE_CRON=1` environment variable. Requires restart.                                                                                        | `true`  |
 | `experimental.cronRecurringMaxAgeDays` | number  | Days a recurring cron/loop job lives before auto-expiring (it fires one final time, then is deleted). Set to `0` to disable expiry so jobs run until deleted — useful for long-running daemon deployments. Can be overridden via the `QWEN_CODE_CRON_MAX_AGE_DAYS` environment variable. Requires restart. | `7`     |
 | `experimental.agentTeam`               | boolean | Enable agent-team collaboration tools (`team_create`, `task_create`, `task_update`, `send_message`, etc.) for multi-agent coordination. Can also be enabled via `QWEN_CODE_ENABLE_AGENT_TEAM=1`. Requires restart.                                                                                         | `false` |
-| `experimental.artifact`                | boolean | Enable the Artifact tool, letting the model publish a self-contained HTML page and open it in the browser. Interactive, non-SDK sessions only. Toggle via `QWEN_CODE_ENABLE_ARTIFACT=1` / `QWEN_CODE_DISABLE_ARTIFACT=1`. Requires restart.                                                                | `false` |
+| `experimental.artifact`                | boolean | Enable the Artifact tool, letting the model publish a self-contained HTML page and open it in the browser. Interactive, non-SDK sessions only. `QWEN_CODE_ENABLE_ARTIFACT=1` enables metadata-only `record_artifact` for non-SDK daemon sessions and also enables the Artifact tool in interactive sessions; `QWEN_CODE_DISABLE_ARTIFACT=1` disables both. Requires restart. | `false` |
 | `experimental.emitToolUseSummaries`    | boolean | Generate a short LLM-based label after each tool-call batch completes. See [Tool-Use Summaries](../features/tool-use-summaries). Requires a fast model to be configured (`fastModel`); silently skipped otherwise. Can be overridden per-session with `QWEN_CODE_EMIT_TOOL_USE_SUMMARIES=0` or `=1`.       | `true`  |
 
 #### mcpServers
diff --git a/integration-tests/cli/qwen-serve-routes.test.ts b/integration-tests/cli/qwen-serve-routes.test.ts
index cedfcba460..f8b2dbd802 100644
--- a/integration-tests/cli/qwen-serve-routes.test.ts
+++ b/integration-tests/cli/qwen-serve-routes.test.ts
@@ -247,6 +247,7 @@ describe('qwen serve — capabilities envelope', () => {
       'session_prompt',
       'session_cancel',
       'session_events',
+      'session_artifacts',
       'slow_client_warning',
       'typed_event_schema',
       'session_set_model',
diff --git a/packages/acp-bridge/package.json b/packages/acp-bridge/package.json
index e9b28d8bb7..78fd94cfbf 100644
--- a/packages/acp-bridge/package.json
+++ b/packages/acp-bridge/package.json
@@ -47,6 +47,10 @@
       "types": "./dist/bridgeTypes.d.ts",
       "import": "./dist/bridgeTypes.js"
     },
+    "./sessionArtifacts": {
+      "types": "./dist/sessionArtifacts.d.ts",
+      "import": "./dist/sessionArtifacts.js"
+    },
     "./daemonEventTypes": {
       "types": "./dist/daemonEventTypes.d.ts",
       "import": "./dist/daemonEventTypes.js"
diff --git a/packages/acp-bridge/src/bridge.test.ts b/packages/acp-bridge/src/bridge.test.ts
index bfb6f7d032..cbbbba44bb 100644
--- a/packages/acp-bridge/src/bridge.test.ts
+++ b/packages/acp-bridge/src/bridge.test.ts
@@ -105,6 +105,84 @@ describe('createAcpSessionBridge', () => {
     );
   });
 
+  it('sanitizes client artifact provenance fields', async () => {
+    const bridge = makeBridge({
+      channelFactory: async () => makeChannel().channel,
+    });
+    const session = await bridge.spawnOrAttach({ workspaceCwd: WS_A });
+    try {
+      await bridge.addSessionArtifact(
+        session.sessionId,
+        {
+          title: 'Client link',
+          url: 'https://example.com/client',
+          toolName: 'artifact',
+          hookEventName: 'PostToolUse',
+          toolCallId: 'call-forged',
+          clientId: 'forged-client',
+        },
+        { clientId: session.clientId },
+      );
+
+      const snapshot = await bridge.getSessionArtifacts(session.sessionId);
+      expect(snapshot.artifacts).toMatchObject([
+        {
+          title: 'Client link',
+          source: 'client',
+          clientId: session.clientId,
+        },
+      ]);
+      expect(snapshot.artifacts[0]).not.toHaveProperty('toolName');
+      expect(snapshot.artifacts[0]).not.toHaveProperty('hookEventName');
+      expect(snapshot.artifacts[0]).not.toHaveProperty('toolCallId');
+    } finally {
+      await bridge.shutdown();
+    }
+  });
+
+  it('keeps client artifacts owned by the issuing client', async () => {
+    const bridge = makeBridge({
+      channelFactory: async () => makeChannel().channel,
+    });
+    const first = await bridge.spawnOrAttach({ workspaceCwd: WS_A });
+    const second = await bridge.spawnOrAttach({ workspaceCwd: WS_A });
+    try {
+      const created = await bridge.addSessionArtifact(
+        first.sessionId,
+        {
+          title: 'Client link',
+          url: 'https://example.com/client',
+        },
+        { clientId: first.clientId },
+      );
+      const artifactId = created.changes[0]!.artifactId;
+
+      await expect(
+        bridge.removeSessionArtifact(first.sessionId, artifactId, {
+          clientId: second.clientId,
+        }),
+      ).resolves.toMatchObject({ changes: [] });
+      await expect(
+        bridge.removeSessionArtifact(first.sessionId, artifactId),
+      ).resolves.toMatchObject({ changes: [] });
+      await expect(
+        bridge.getSessionArtifacts(first.sessionId),
+      ).resolves.toMatchObject({
+        artifacts: [{ id: artifactId, clientId: first.clientId }],
+      });
+
+      await expect(
+        bridge.removeSessionArtifact(first.sessionId, artifactId, {
+          clientId: first.clientId,
+        }),
+      ).resolves.toMatchObject({
+        changes: [{ action: 'removed', artifactId, reason: 'explicit' }],
+      });
+    } finally {
+      await bridge.shutdown();
+    }
+  });
+
   it('uses bridge telemetry for channel/session/prompt dispatch and prompt metadata injection', async () => {
     const handle = makeChannel();
     const operations: string[] = [];
diff --git a/packages/acp-bridge/src/bridge.ts b/packages/acp-bridge/src/bridge.ts
index 792052d430..2c9d2121ee 100644
--- a/packages/acp-bridge/src/bridge.ts
+++ b/packages/acp-bridge/src/bridge.ts
@@ -100,6 +100,12 @@ import {
   type PermissionAuditPublisher,
 } from './permissionMediator.js';
 import { PermissionForbiddenError } from './bridgeErrors.js';
+import {
+  SessionArtifactStore,
+  type SessionArtifactChange,
+  type SessionArtifactInput,
+  type SessionArtifactMutationResult,
+} from './sessionArtifacts.js';
 
 const NOOP_BRIDGE_TELEMETRY: BridgeTelemetry = {
   captureContext: () => undefined,
@@ -241,6 +247,8 @@ interface SessionEntry {
   connection: ClientSideConnection;
   /** Per-session event bus drives `GET /session/:id/events`. */
   events: EventBus;
+  /** Per-session structured artifact registry. */
+  artifacts: SessionArtifactStore;
   /**
    * Tail of the per-session prompt queue. Each new prompt chains off the
    * resolved (or rejected) state of this promise so prompts run one at a
@@ -1341,6 +1349,7 @@ export function createAcpSessionBridge(opts: BridgeOptions): AcpSessionBridge {
         },
         async () => await channelFactory(boundWorkspace, childEnvOverrides),
       );
+      const sessionIds = new Set<string>();
       const client = new BridgeClient(
         // BfFut: ACP today carries a sessionId on every per-session
         // notification / request, so the no-sessionId branch is
@@ -1395,6 +1404,7 @@ export function createAcpSessionBridge(opts: BridgeOptions): AcpSessionBridge {
         // Mode A) never host a client MCP server, so the method stays
         // unreachable.
         opts.clientMcpSender,
+        (sessionId) => sessionIds.has(sessionId),
       );
       const connection = new ClientSideConnection(() => client, channel.stream);
 
@@ -1412,7 +1422,7 @@ export function createAcpSessionBridge(opts: BridgeOptions): AcpSessionBridge {
         channel,
         connection,
         client,
-        sessionIds: new Set(),
+        sessionIds,
         pendingRestoreIds: new Set(),
         sessionSpawnsInFlight: 0,
         workspaceControlInFlight: 0,
@@ -2255,6 +2265,7 @@ export function createAcpSessionBridge(opts: BridgeOptions): AcpSessionBridge {
       channel: ci.channel,
       connection: ci.connection,
       events,
+      artifacts: new SessionArtifactStore({ sessionId, workspaceCwd }),
       promptQueue: Promise.resolve(),
       pendingPromptCount: 0,
       pendingPromptList: [],
@@ -2282,6 +2293,43 @@ export function createAcpSessionBridge(opts: BridgeOptions): AcpSessionBridge {
     return entry;
   };
 
+  const publishArtifactChanges = (
+    entry: SessionEntry,
+    changes: SessionArtifactChange[],
+    originatorClientId?: string,
+  ): void => {
+    for (const change of changes) {
+      entry.events.publish({
+        type: 'artifact_changed',
+        data: { sessionId: entry.sessionId, change },
+        ...(originatorClientId ? { originatorClientId } : {}),
+      });
+    }
+  };
+
+  const makeClientArtifactInput = (
+    artifact: SessionArtifactInput,
+    clientId: string | undefined,
+  ): SessionArtifactInput => {
+    const input: SessionArtifactInput = {
+      title: artifact.title,
+      kind: artifact.kind,
+      storage: artifact.storage,
+      description: artifact.description,
+      workspacePath: artifact.workspacePath,
+      managedId: artifact.managedId,
+      url: artifact.url,
+      mimeType: artifact.mimeType,
+      sizeBytes: artifact.sizeBytes,
+      metadata: artifact.metadata,
+      source: 'client',
+    };
+    if (clientId) {
+      input.clientId = clientId;
+    }
+    return input;
+  };
+
   // A5: seed the snapshot caches from the agent's session-create response
   // (`newSession` / `loadSession` / `resumeSession` all return `models` +
   // `modes`). Without this the caches stay unset until the first change, so a
@@ -3964,6 +4012,32 @@ export function createAcpSessionBridge(opts: BridgeOptions): AcpSessionBridge {
       return { displayName: entry.displayName };
     },
 
+    async getSessionArtifacts(sessionId) {
+      const entry = byId.get(sessionId);
+      if (!entry) throw new SessionNotFoundError(sessionId);
+      return entry.artifacts.list();
+    },
+
+    async addSessionArtifact(sessionId, artifact, context) {
+      const entry = byId.get(sessionId);
+      if (!entry) throw new SessionNotFoundError(sessionId);
+      const clientId = resolveTrustedClientId(entry, context?.clientId);
+      const input = makeClientArtifactInput(artifact, clientId);
+      const result: SessionArtifactMutationResult =
+        await entry.artifacts.upsertMany([input], { strict: true });
+      publishArtifactChanges(entry, result.changes, clientId);
+      return result;
+    },
+
+    async removeSessionArtifact(sessionId, artifactId, context) {
+      const entry = byId.get(sessionId);
+      if (!entry) throw new SessionNotFoundError(sessionId);
+      const clientId = resolveTrustedClientId(entry, context?.clientId);
+      const result = await entry.artifacts.remove(artifactId, { clientId });
+      publishArtifactChanges(entry, result.changes, clientId);
+      return result;
+    },
+
     listWorkspaceSessions(workspaceCwd) {
       if (!path.isAbsolute(workspaceCwd)) return [];
       const key =
diff --git a/packages/acp-bridge/src/bridgeClient.test.ts b/packages/acp-bridge/src/bridgeClient.test.ts
index 0cefa41122..e4ad4b3e8d 100644
--- a/packages/acp-bridge/src/bridgeClient.test.ts
+++ b/packages/acp-bridge/src/bridgeClient.test.ts
@@ -32,15 +32,18 @@ import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import { promises as fsp } from 'node:fs';
 import * as os from 'node:os';
 import * as path from 'node:path';
+import { pathToFileURL } from 'node:url';
 import type {
   ReadTextFileRequest,
   ReadTextFileResponse,
+  SessionNotification,
   WriteTextFileRequest,
   WriteTextFileResponse,
 } from '@agentclientprotocol/sdk';
 import { RequestError } from '@agentclientprotocol/sdk';
 import {
   ClientMcpRegistrar,
+  ToolNames,
   type ClientMcpFrame,
 } from '@qwen-code/qwen-code-core';
 import type { JSONRPCMessage } from '@modelcontextprotocol/sdk/types.js';
@@ -50,6 +53,7 @@ import type { MidTurnQueueEntry } from './bridgeTypes.js';
 import type { ClientMcpMessageSender } from './bridgeOptions.js';
 import { CancelSentinelCollisionError } from './bridgeErrors.js';
 import { CANCEL_VOTE_SENTINEL } from './permissionMediator.js';
+import { SessionArtifactStore } from './sessionArtifacts.js';
 
 /**
  * Minimal-stub constructor for a `BridgeClient` whose only purpose is
@@ -544,6 +548,842 @@ describe('BridgeClient — original timestamp preservation', () => {
   });
 });
 
+describe('BridgeClient — artifact ingress', () => {
+  const noPermissionFlow = () => {
+    throw new Error('test: permission flow should not run');
+  };
+
+  it('stores tool result artifacts and publishes artifact_changed', async () => {
+    const workspace = await fsp.mkdtemp(
+      path.join(os.tmpdir(), 'qwen-bridge-artifacts-'),
+    );
+    try {
+      const sessionId = 'sess:artifacts';
+      const publish = vi.fn().mockReturnValue(true);
+      const artifactUrl = pathToFileURL(
+        path.join(workspace, 'dashboard.html'),
+      ).href;
+      const fakeEntry = {
+        sessionId,
+        events: { publish },
+        artifacts: new SessionArtifactStore({
+          sessionId,
+          workspaceCwd: workspace,
+        }),
+        pendingPermissionIds: new Set<string>(),
+        midTurnMessageQueue: [] as MidTurnQueueEntry[],
+        promptActive: true,
+      };
+      const client = new BridgeClient(
+        ((sid: string) => (sid === sessionId ? fakeEntry : undefined)) as never,
+        noPermissionFlow as never,
+        { request: noPermissionFlow } as never,
+        0,
+        Infinity,
+      );
+
+      await client.sessionUpdate({
+        sessionId,
+        update: {
+          sessionUpdate: 'tool_call_update',
+          toolCallId: 'call-artifact',
+          status: 'completed',
+          content: [],
+          _meta: {
+            toolName: ToolNames.ARTIFACT,
+            artifacts: [
+              {
+                title: 'Dashboard',
+                storage: 'published',
+                url: artifactUrl,
+                managedId: 'managed-1',
+              },
+            ],
+          },
+        },
+      } as Parameters<BridgeClient['sessionUpdate']>[0]);
+
+      expect(publish.mock.calls.map(([event]) => event.type)).toEqual([
+        'session_update',
+        'artifact_changed',
+      ]);
+      expect(publish).toHaveBeenCalledWith(
+        expect.objectContaining({ type: 'session_update' }),
+      );
+      expect(publish).toHaveBeenCalledWith(
+        expect.objectContaining({
+          type: 'artifact_changed',
+          data: {
+            sessionId,
+            change: expect.objectContaining({
+              action: 'created',
+              artifact: expect.objectContaining({
+                title: 'Dashboard',
+                storage: 'published',
+              }),
+            }),
+          },
+        }),
+      );
+      await expect(fakeEntry.artifacts.list()).resolves.toMatchObject({
+        artifacts: [
+          {
+            title: 'Dashboard',
+            storage: 'published',
+            managedId: 'managed-1',
+          },
+        ],
+      });
+    } finally {
+      await fsp.rm(workspace, { recursive: true, force: true });
+    }
+  });
+
+  it('strips raw tool artifacts from session updates before publishing', async () => {
+    const sessionId = 'sess:sanitized-artifacts';
+    const publish = vi.fn().mockReturnValue(true);
+    const upsertMany = vi.fn().mockResolvedValue({ changes: [] });
+    const fakeEntry = {
+      sessionId,
+      events: { publish },
+      artifacts: {
+        inputBatchLimit: () => 1,
+        upsertMany,
+      },
+      pendingPermissionIds: new Set<string>(),
+      midTurnMessageQueue: [] as MidTurnQueueEntry[],
+      promptActive: true,
+    };
+    const client = new BridgeClient(
+      ((sid: string) => (sid === sessionId ? fakeEntry : undefined)) as never,
+      noPermissionFlow as never,
+      { request: noPermissionFlow } as never,
+      0,
+      Infinity,
+    );
+    const stderr = vi
+      .spyOn(process.stderr, 'write')
+      .mockReturnValue(true as never);
+    try {
+      await client.sessionUpdate({
+        sessionId,
+        update: {
+          sessionUpdate: 'tool_call_update',
+          toolCallId: 'call-sanitize',
+          status: 'completed',
+          content: [],
+          _meta: {
+            toolName: ToolNames.ARTIFACT,
+            keep: 'visible',
+            artifacts: [
+              'not-an-artifact',
+              { title: 'One', url: 'https://example.com/1' },
+              { title: 'Two', url: 'https://example.com/2' },
+            ],
+          },
+        },
+      } as Parameters<BridgeClient['sessionUpdate']>[0]);
+
+      const sessionUpdate = publish.mock.calls
+        .map(([event]) => event as { type: string; data: SessionNotification })
+        .find((event) => event.type === 'session_update');
+      expect(sessionUpdate).toBeDefined();
+      const publishedMeta = (
+        sessionUpdate!.data.update as { _meta?: Record<string, unknown> }
+      )._meta;
+      expect(publishedMeta).toEqual({
+        toolName: ToolNames.ARTIFACT,
+        keep: 'visible',
+      });
+      expect(upsertMany).toHaveBeenCalledWith(
+        [expect.objectContaining({ title: 'One' })],
+        { trustedPublisher: true },
+      );
+      const logged = stderr.mock.calls.map((call) => String(call[0])).join('');
+      expect(logged).toContain('reason=malformed');
+      expect(logged).toContain('source=tool');
+      expect(logged).toContain('index=0');
+      expect(logged).toContain('artifact batch limit exceeded');
+      expect(logged).toContain('dropped=1');
+    } finally {
+      stderr.mockRestore();
+    }
+  });
+
+  it('stores artifacts from failed tool updates before stripping session metadata', async () => {
+    const sessionId = 'sess:failed-tool-artifacts';
+    const publish = vi.fn().mockReturnValue(true);
+    const upsertMany = vi.fn().mockResolvedValue({ changes: [] });
+    const fakeEntry = {
+      sessionId,
+      events: { publish },
+      artifacts: {
+        inputBatchLimit: () => 400,
+        upsertMany,
+      },
+      pendingPermissionIds: new Set<string>(),
+      midTurnMessageQueue: [] as MidTurnQueueEntry[],
+      promptActive: true,
+    };
+    const client = new BridgeClient(
+      ((sid: string) => (sid === sessionId ? fakeEntry : undefined)) as never,
+      noPermissionFlow as never,
+      { request: noPermissionFlow } as never,
+      0,
+      Infinity,
+    );
+
+    await client.sessionUpdate({
+      sessionId,
+      update: {
+        sessionUpdate: 'tool_call_update',
+        toolCallId: 'call-failed-artifact',
+        status: 'failed',
+        content: [],
+        _meta: {
+          toolName: 'record_artifact',
+          artifacts: [
+            {
+              title: 'Failure report',
+              workspacePath: 'reports/failure.html',
+            },
+          ],
+        },
+      },
+    } as Parameters<BridgeClient['sessionUpdate']>[0]);
+
+    expect(upsertMany).toHaveBeenCalledWith(
+      [
+        expect.objectContaining({
+          title: 'Failure report',
+          workspacePath: 'reports/failure.html',
+          source: 'tool',
+          toolCallId: 'call-failed-artifact',
+          toolName: 'record_artifact',
+        }),
+      ],
+      { trustedPublisher: false },
+    );
+    const sessionUpdate = publish.mock.calls
+      .map(([event]) => event as { type: string; data: SessionNotification })
+      .find((event) => event.type === 'session_update');
+    expect(
+      (sessionUpdate?.data.update as { _meta?: Record<string, unknown> })._meta,
+    ).toEqual({ toolName: 'record_artifact' });
+  });
+
+  it('does not store artifact metadata from non-tool session updates', async () => {
+    const sessionId = 'sess:non-tool-artifacts';
+    const publish = vi.fn().mockReturnValue(true);
+    const upsertMany = vi.fn().mockResolvedValue({ changes: [] });
+    const fakeEntry = {
+      sessionId,
+      events: { publish },
+      artifacts: {
+        inputBatchLimit: () => 1,
+        upsertMany,
+      },
+      pendingPermissionIds: new Set<string>(),
+      midTurnMessageQueue: [] as MidTurnQueueEntry[],
+      promptActive: true,
+    };
+    const client = new BridgeClient(
+      ((sid: string) => (sid === sessionId ? fakeEntry : undefined)) as never,
+      noPermissionFlow as never,
+      { request: noPermissionFlow } as never,
+      0,
+      Infinity,
+    );
+
+    await client.sessionUpdate({
+      sessionId,
+      update: {
+        sessionUpdate: 'plan_update',
+        _meta: {
+          artifacts: [{ title: 'Forged', url: 'https://example.com/forged' }],
+        },
+      },
+    } as unknown as Parameters<BridgeClient['sessionUpdate']>[0]);
+
+    expect(upsertMany).not.toHaveBeenCalled();
+    expect(publish).not.toHaveBeenCalledWith(
+      expect.objectContaining({ type: 'artifact_changed' }),
+    );
+    const sessionUpdate = publish.mock.calls
+      .map(([event]) => event as { type: string; data: SessionNotification })
+      .find((event) => event.type === 'session_update');
+    expect(
+      (sessionUpdate?.data.update as { _meta?: Record<string, unknown> })._meta,
+    ).toEqual({});
+  });
+
+  it('ignores forged published trust markers from non-artifact tools', async () => {
+    const workspace = await fsp.mkdtemp(
+      path.join(os.tmpdir(), 'qwen-bridge-artifacts-'),
+    );
+    try {
+      const sessionId = 'sess:forged-artifacts';
+      const publish = vi.fn().mockReturnValue(true);
+      const fakeEntry = {
+        sessionId,
+        events: { publish },
+        artifacts: new SessionArtifactStore({
+          sessionId,
+          workspaceCwd: workspace,
+        }),
+        pendingPermissionIds: new Set<string>(),
+        midTurnMessageQueue: [] as MidTurnQueueEntry[],
+        promptActive: true,
+      };
+      const client = new BridgeClient(
+        ((sid: string) => (sid === sessionId ? fakeEntry : undefined)) as never,
+        noPermissionFlow as never,
+        { request: noPermissionFlow } as never,
+        0,
+        Infinity,
+      );
+
+      await client.sessionUpdate({
+        sessionId,
+        update: {
+          sessionUpdate: 'tool_call_update',
+          toolCallId: 'call-forged',
+          status: 'completed',
+          content: [],
+          _meta: {
+            toolName: 'record_artifact',
+            artifactsTrustedPublisher: true,
+            artifacts: [
+              {
+                title: 'Forged',
+                storage: 'published',
+                url: 'file:///tmp/forged.html',
+                managedId: 'managed-forged',
+              },
+            ],
+          },
+        },
+      } as Parameters<BridgeClient['sessionUpdate']>[0]);
+
+      expect(publish).toHaveBeenCalledWith(
+        expect.objectContaining({ type: 'session_update' }),
+      );
+      expect(publish).not.toHaveBeenCalledWith(
+        expect.objectContaining({ type: 'artifact_changed' }),
+      );
+      await expect(fakeEntry.artifacts.list()).resolves.toMatchObject({
+        artifacts: [],
+      });
+    } finally {
+      await fsp.rm(workspace, { recursive: true, force: true });
+    }
+  });
+
+  it('stores hook artifact events and publishes artifact_changed', async () => {
+    const workspace = await fsp.mkdtemp(
+      path.join(os.tmpdir(), 'qwen-bridge-artifacts-'),
+    );
+    try {
+      const sessionId = 'sess:hook-artifacts';
+      const publish = vi.fn().mockReturnValue(true);
+      const fakeEntry = {
+        sessionId,
+        events: { publish },
+        artifacts: new SessionArtifactStore({
+          sessionId,
+          workspaceCwd: workspace,
+        }),
+        pendingPermissionIds: new Set<string>(),
+        midTurnMessageQueue: [] as MidTurnQueueEntry[],
+        promptActive: true,
+      };
+      const client = new BridgeClient(
+        ((sid: string) => (sid === sessionId ? fakeEntry : undefined)) as never,
+        noPermissionFlow as never,
+        { request: noPermissionFlow } as never,
+        0,
+        Infinity,
+      );
+
+      await client.extNotification('qwen/notify/session/artifact-event', {
+        sessionId,
+        hookEventName: 'PostToolUse',
+        artifacts: [
+          {
+            title: 'Hook dashboard',
+            url: 'https://example.com/hook-dashboard',
+          },
+        ],
+      });
+
+      expect(publish).toHaveBeenCalledWith(
+        expect.objectContaining({
+          type: 'artifact_changed',
+          data: {
+            sessionId,
+            change: expect.objectContaining({
+              action: 'created',
+              artifact: expect.objectContaining({
+                source: 'hook',
+                hookEventName: 'PostToolUse',
+                title: 'Hook dashboard',
+              }),
+            }),
+          },
+        }),
+      );
+      await expect(fakeEntry.artifacts.list()).resolves.toMatchObject({
+        artifacts: [
+          {
+            source: 'hook',
+            hookEventName: 'PostToolUse',
+            title: 'Hook dashboard',
+          },
+        ],
+      });
+    } finally {
+      await fsp.rm(workspace, { recursive: true, force: true });
+    }
+  });
+
+  it('drops artifact events for sessions outside this bridge channel', async () => {
+    const ownedSessionId = 'sess:owned-artifacts';
+    const forgedSessionId = 'sess:forged-artifacts';
+    const publish = vi.fn().mockReturnValue(true);
+    const resolveEntry = vi.fn((sid: string | undefined) =>
+      sid === forgedSessionId
+        ? {
+            sessionId: forgedSessionId,
+            events: { publish },
+            artifacts: {
+              inputBatchLimit: () => 400,
+              upsertMany: vi.fn().mockResolvedValue({ changes: [] }),
+            },
+            pendingPermissionIds: new Set<string>(),
+            midTurnMessageQueue: [] as MidTurnQueueEntry[],
+          }
+        : undefined,
+    );
+    const client = new BridgeClient(
+      resolveEntry as never,
+      noPermissionFlow as never,
+      { request: noPermissionFlow } as never,
+      0,
+      Infinity,
+      undefined,
+      undefined,
+      undefined,
+      undefined,
+      (sid) => sid === ownedSessionId,
+    );
+    const stderr = vi
+      .spyOn(process.stderr, 'write')
+      .mockReturnValue(true as never);
+    try {
+      await expect(
+        client.extNotification('qwen/notify/session/artifact-event', {
+          sessionId: forgedSessionId,
+          artifacts: [{ title: 'Forged', url: 'https://example.com/forged' }],
+        }),
+      ).resolves.toBeUndefined();
+
+      expect(resolveEntry).not.toHaveBeenCalled();
+      expect(publish).not.toHaveBeenCalled();
+      const logged = stderr.mock.calls.map((call) => String(call[0])).join('');
+      expect(logged).toContain('reason=session_not_owned');
+      expect(logged).toContain(forgedSessionId);
+    } finally {
+      stderr.mockRestore();
+    }
+  });
+
+  it('drops session updates for sessions outside this bridge channel', async () => {
+    const ownedSessionId = 'sess:owned-session-update';
+    const forgedSessionId = 'sess:forged-session-update';
+    const publish = vi.fn().mockReturnValue(true);
+    const upsertMany = vi.fn().mockResolvedValue({ changes: [] });
+    const resolveEntry = vi.fn((sid: string | undefined) =>
+      sid === forgedSessionId
+        ? {
+            sessionId: forgedSessionId,
+            events: { publish },
+            artifacts: {
+              inputBatchLimit: () => 400,
+              upsertMany,
+            },
+            pendingPermissionIds: new Set<string>(),
+            midTurnMessageQueue: [] as MidTurnQueueEntry[],
+          }
+        : undefined,
+    );
+    const client = new BridgeClient(
+      resolveEntry as never,
+      noPermissionFlow as never,
+      { request: noPermissionFlow } as never,
+      0,
+      Infinity,
+      undefined,
+      undefined,
+      undefined,
+      undefined,
+      (sid) => sid === ownedSessionId,
+    );
+    const stderr = vi
+      .spyOn(process.stderr, 'write')
+      .mockReturnValue(true as never);
+    try {
+      await client.sessionUpdate({
+        sessionId: forgedSessionId,
+        update: {
+          sessionUpdate: 'tool_call_update',
+          toolCallId: 'call-forged-session-update',
+          status: 'completed',
+          content: [],
+          _meta: {
+            toolName: ToolNames.ARTIFACT,
+            artifacts: [
+              {
+                title: 'Forged',
+                storage: 'published',
+                url: 'file:///tmp/forged.html',
+                managedId: 'managed-forged',
+              },
+            ],
+          },
+        },
+      } as Parameters<BridgeClient['sessionUpdate']>[0]);
+
+      expect(resolveEntry).not.toHaveBeenCalled();
+      expect(upsertMany).not.toHaveBeenCalled();
+      expect(publish).not.toHaveBeenCalled();
+      const logged = stderr.mock.calls.map((call) => String(call[0])).join('');
+      expect(logged).toContain('type=session_update');
+      expect(logged).toContain('reason=session_not_owned');
+      expect(logged).toContain(forgedSessionId);
+    } finally {
+      stderr.mockRestore();
+    }
+  });
+
+  it('allows session updates during an in-flight restore on this channel', async () => {
+    const sessionId = 'sess:restore-session-update';
+    const publish = vi.fn().mockReturnValue(true);
+    const client = new BridgeClient(
+      (() => undefined) as never,
+      ((sid: string) => (sid === sessionId ? { publish } : undefined)) as never,
+      { request: noPermissionFlow } as never,
+      0,
+      Infinity,
+      undefined,
+      undefined,
+      undefined,
+      undefined,
+      () => false,
+    );
+    client.markRestoreInFlight(sessionId);
+    try {
+      await client.sessionUpdate({
+        sessionId,
+        update: {
+          sessionUpdate: 'agent_message_chunk',
+          content: { type: 'text', text: 'restored' },
+        },
+      } as Parameters<BridgeClient['sessionUpdate']>[0]);
+
+      expect(publish).toHaveBeenCalledWith(
+        expect.objectContaining({
+          type: 'session_update',
+          data: expect.objectContaining({ sessionId }),
+        }),
+      );
+    } finally {
+      client.clearRestoreInFlight(sessionId);
+    }
+  });
+
+  it('allows artifact events during an in-flight restore on this channel', async () => {
+    const sessionId = 'sess:restore-artifact-event';
+    const publish = vi.fn().mockReturnValue(true);
+    const upsertMany = vi.fn().mockResolvedValue({ changes: [] });
+    const fakeEntry = {
+      sessionId,
+      events: { publish },
+      artifacts: {
+        inputBatchLimit: () => 400,
+        upsertMany,
+      },
+      pendingPermissionIds: new Set<string>(),
+      midTurnMessageQueue: [] as MidTurnQueueEntry[],
+    };
+    const client = new BridgeClient(
+      ((sid: string) => (sid === sessionId ? fakeEntry : undefined)) as never,
+      noPermissionFlow as never,
+      { request: noPermissionFlow } as never,
+      0,
+      Infinity,
+      undefined,
+      undefined,
+      undefined,
+      undefined,
+      () => false,
+    );
+    client.markRestoreInFlight(sessionId);
+    try {
+      await client.extNotification('qwen/notify/session/artifact-event', {
+        sessionId,
+        hookEventName: 'PostToolUse',
+        artifacts: [
+          {
+            title: 'Restored hook artifact',
+            url: 'https://example.com/restored-hook',
+          },
+        ],
+      });
+
+      expect(upsertMany).toHaveBeenCalledWith(
+        [
+          expect.objectContaining({
+            source: 'hook',
+            hookEventName: 'PostToolUse',
+            title: 'Restored hook artifact',
+          }),
+        ],
+        undefined,
+      );
+    } finally {
+      client.clearRestoreInFlight(sessionId);
+    }
+  });
+
+  it('logs and drops artifact events when store ingestion fails', async () => {
+    const sessionId = 'sess:artifact-error';
+    const publish = vi.fn().mockReturnValue(true);
+    const fakeEntry = {
+      sessionId,
+      events: { publish },
+      artifacts: {
+        inputBatchLimit: () => 400,
+        upsertMany: vi
+          .fn()
+          .mockRejectedValue(new Error('artifact store unavailable')),
+      },
+      pendingPermissionIds: new Set<string>(),
+      midTurnMessageQueue: [] as MidTurnQueueEntry[],
+      promptActive: true,
+    };
+    const client = new BridgeClient(
+      ((sid: string) => (sid === sessionId ? fakeEntry : undefined)) as never,
+      noPermissionFlow as never,
+      { request: noPermissionFlow } as never,
+      0,
+      Infinity,
+    );
+    const stderr = vi
+      .spyOn(process.stderr, 'write')
+      .mockReturnValue(true as never);
+    try {
+      await expect(
+        client.extNotification('qwen/notify/session/artifact-event', {
+          sessionId,
+          artifacts: [{ title: 'Dropped', url: 'https://example.com/drop' }],
+        }),
+      ).resolves.toBeUndefined();
+      expect(publish).not.toHaveBeenCalled();
+      const logged = stderr.mock.calls.map((call) => String(call[0])).join('');
+      expect(logged).toContain('artifact store unavailable');
+      expect(logged).toContain('"name":"Error"');
+      expect(logged).toContain('"stack":');
+    } finally {
+      stderr.mockRestore();
+    }
+  });
+
+  it('caps oversized artifact event batches before store ingestion', async () => {
+    const sessionId = 'sess:artifact-batch-cap';
+    const publish = vi.fn().mockReturnValue(true);
+    const upsertMany = vi.fn().mockResolvedValue({ changes: [] });
+    const fakeEntry = {
+      sessionId,
+      events: { publish },
+      artifacts: {
+        inputBatchLimit: () => 2,
+        upsertMany,
+      },
+      pendingPermissionIds: new Set<string>(),
+      midTurnMessageQueue: [] as MidTurnQueueEntry[],
+      promptActive: true,
+    };
+    const client = new BridgeClient(
+      ((sid: string) => (sid === sessionId ? fakeEntry : undefined)) as never,
+      noPermissionFlow as never,
+      { request: noPermissionFlow } as never,
+      0,
+      Infinity,
+    );
+    const lateArtifact = {};
+    Object.defineProperty(lateArtifact, 'title', {
+      get: () => {
+        throw new Error('artifact past cap should not be mapped');
+      },
+    });
+    const stderr = vi
+      .spyOn(process.stderr, 'write')
+      .mockReturnValue(true as never);
+    try {
+      await client.extNotification('qwen/notify/session/artifact-event', {
+        sessionId,
+        artifacts: [
+          { title: 'One', url: 'https://example.com/1' },
+          { title: 'Two', url: 'https://example.com/2' },
+          lateArtifact,
+        ],
+      });
+
+      expect(upsertMany).toHaveBeenCalledWith(
+        [
+          expect.objectContaining({ title: 'One' }),
+          expect.objectContaining({ title: 'Two' }),
+        ],
+        undefined,
+      );
+      const logged = stderr.mock.calls.map((call) => String(call[0])).join('');
+      expect(logged).toContain('artifact batch limit exceeded');
+      expect(logged).toContain('dropped=1');
+    } finally {
+      stderr.mockRestore();
+    }
+  });
+
+  it('stores hook artifact events for child-initiated turns', async () => {
+    const sessionId = 'sess:child-artifacts';
+    const publish = vi.fn().mockReturnValue(true);
+    const workspace = await fsp.mkdtemp(
+      path.join(os.tmpdir(), 'qwen-bridge-artifacts-'),
+    );
+    const fakeEntry = {
+      sessionId,
+      events: { publish },
+      artifacts: new SessionArtifactStore({
+        sessionId,
+        workspaceCwd: workspace,
+      }),
+      pendingPermissionIds: new Set<string>(),
+      midTurnMessageQueue: [] as MidTurnQueueEntry[],
+      promptActive: false,
+    };
+    const client = new BridgeClient(
+      ((sid: string) => (sid === sessionId ? fakeEntry : undefined)) as never,
+      noPermissionFlow as never,
+      { request: noPermissionFlow } as never,
+      0,
+      Infinity,
+    );
+    try {
+      await expect(
+        client.extNotification('qwen/notify/session/artifact-event', {
+          sessionId,
+          source: 'hook',
+          hookEventName: 'PostToolUse',
+          toolName: 'read_file',
+          toolCallId: 'call-idle',
+          artifacts: [{ title: 'Idle', url: 'https://example.com/idle' }],
+        }),
+      ).resolves.toBeUndefined();
+      await expect(fakeEntry.artifacts.list()).resolves.toMatchObject({
+        artifacts: [
+          expect.objectContaining({
+            title: 'Idle',
+            source: 'hook',
+            hookEventName: 'PostToolUse',
+            toolName: 'read_file',
+            toolCallId: 'call-idle',
+          }),
+        ],
+      });
+      expect(publish).toHaveBeenCalledWith(
+        expect.objectContaining({
+          type: 'artifact_changed',
+        }),
+      );
+    } finally {
+      await fsp.rm(workspace, { recursive: true, force: true });
+    }
+  });
+
+  it('logs and drops artifact events for unknown sessions', async () => {
+    const client = new BridgeClient(
+      (() => undefined) as never,
+      noPermissionFlow as never,
+      { request: noPermissionFlow } as never,
+      0,
+      Infinity,
+    );
+    const stderr = vi
+      .spyOn(process.stderr, 'write')
+      .mockReturnValue(true as never);
+    try {
+      await expect(
+        client.extNotification('qwen/notify/session/artifact-event', {
+          sessionId: 'sess:missing',
+          artifacts: [{ title: 'Lost', url: 'https://example.com/lost' }],
+        }),
+      ).resolves.toBeUndefined();
+      const logged = stderr.mock.calls.map((call) => String(call[0])).join('');
+      expect(logged).toContain('reason=session_not_found');
+      expect(logged).toContain('sess:missing');
+    } finally {
+      stderr.mockRestore();
+    }
+  });
+
+  it('logs and drops malformed artifact events before resolving a session', async () => {
+    const publish = vi.fn().mockReturnValue(true);
+    const resolveEntry = vi.fn(() => ({
+      sessionId: 'sess:malformed',
+      events: { publish },
+      artifacts: new SessionArtifactStore({
+        sessionId: 'sess:malformed',
+        workspaceCwd: process.cwd(),
+      }),
+      pendingPermissionIds: new Set<string>(),
+      midTurnMessageQueue: [] as MidTurnQueueEntry[],
+      promptActive: true,
+    }));
+    const client = new BridgeClient(
+      resolveEntry as never,
+      noPermissionFlow as never,
+      { request: noPermissionFlow } as never,
+      0,
+      Infinity,
+    );
+    const stderr = vi
+      .spyOn(process.stderr, 'write')
+      .mockReturnValue(true as never);
+    try {
+      await expect(
+        client.extNotification('qwen/notify/session/artifact-event', {
+          artifacts: [{ title: 'Missing session' }],
+        }),
+      ).resolves.toBeUndefined();
+      await expect(
+        client.extNotification('qwen/notify/session/artifact-event', {
+          sessionId: 'sess:malformed',
+          artifacts: 'not-array',
+        }),
+      ).resolves.toBeUndefined();
+
+      expect(resolveEntry).not.toHaveBeenCalled();
+      expect(publish).not.toHaveBeenCalled();
+      const logged = stderr.mock.calls.map((call) => String(call[0])).join('');
+      expect(logged).toContain('reason=malformed');
+      expect(logged).toContain('session=<missing>');
+      expect(logged).toContain('session=sess:malformed');
+    } finally {
+      stderr.mockRestore();
+    }
+  });
+});
+
 /**
  * Wenshao review #4335 / 3271978365 — `requestPermission`'s pre-publish
  * `CancelSentinelCollisionError` guard prevents an orphan SSE
@@ -818,7 +1658,9 @@ describe('BridgeClient — reverse tool channel (qwen/control/client_mcp/message
    * the serve layer). The registrar pushes outbound frames to `onFrame` so the
    * test can answer them like the extension's WS would.
    */
-  function makeClientWithRegistrar(registrar: ClientMcpRegistrar): BridgeClient {
+  function makeClientWithRegistrar(
+    registrar: ClientMcpRegistrar,
+  ): BridgeClient {
     const sender: ClientMcpMessageSender = (serverName: string) =>
       registrar.hasServer(serverName)
         ? (payload: unknown) =>
diff --git a/packages/acp-bridge/src/bridgeClient.ts b/packages/acp-bridge/src/bridgeClient.ts
index 4f409d3a85..9d2f39c4e7 100644
--- a/packages/acp-bridge/src/bridgeClient.ts
+++ b/packages/acp-bridge/src/bridgeClient.ts
@@ -40,6 +40,15 @@ import type {
 } from './permission.js';
 import { CancelSentinelCollisionError } from './bridgeErrors.js';
 import { writeStderrLine } from './internal/stderrLine.js';
+import type {
+  SessionArtifactChange,
+  SessionArtifactInput,
+  SessionArtifactStore,
+} from './sessionArtifacts.js';
+
+// Keep in sync with core `ToolNames.ARTIFACT`; acp-bridge avoids a runtime
+// import from core for this hot demux path.
+const PUBLISH_ARTIFACT_TOOL_NAME = 'artifact';
 
 /**
  * Duck-type check for `FsError` from `cli/src/serve/fs/errors.ts`.
@@ -70,6 +79,144 @@ function isFsErrorShape(err: unknown): err is FsErrorShape {
   );
 }
 
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+
+function artifactPayloadFields(
+  artifact: Record<string, unknown>,
+): SessionArtifactInput {
+  return {
+    title: artifact['title'] as string,
+    kind: artifact['kind'] as SessionArtifactInput['kind'],
+    storage: artifact['storage'] as SessionArtifactInput['storage'],
+    description: artifact['description'] as string | undefined,
+    workspacePath: artifact['workspacePath'] as string | undefined,
+    managedId: artifact['managedId'] as string | undefined,
+    url: artifact['url'] as string | undefined,
+    mimeType: artifact['mimeType'] as string | undefined,
+    sizeBytes: artifact['sizeBytes'] as number | undefined,
+    metadata: artifact['metadata'] as SessionArtifactInput['metadata'],
+  };
+}
+
+function extractCappedArtifactInputs(
+  rawArtifacts: unknown[],
+  limit: number,
+  sessionId: string,
+  source: 'tool' | 'hook',
+  toInput: (artifact: Record<string, unknown>) => SessionArtifactInput,
+): SessionArtifactInput[] {
+  const artifacts: SessionArtifactInput[] = [];
+  for (let index = 0; index < rawArtifacts.length; index++) {
+    const artifact = rawArtifacts[index];
+    if (!isRecord(artifact)) {
+      writeStderrLine(
+        `[artifacts] session=${sessionId} action=dropped reason=malformed source=${source} index=${index}`,
+      );
+      continue;
+    }
+    if (artifacts.length >= limit) {
+      writeStderrLine(
+        `[artifacts] session=${sessionId} action=dropped reason="artifact batch limit exceeded" source=${source} dropped=${rawArtifacts.length - index}`,
+      );
+      break;
+    }
+    artifacts.push(toInput(artifact));
+  }
+  return artifacts;
+}
+
+function artifactIngestionErrorReason(error: unknown): unknown {
+  if (!(error instanceof Error)) {
+    return String(error);
+  }
+  return {
+    name: error.name,
+    message: error.message,
+    stack: error.stack?.split('\n').slice(0, 4).join('\n'),
+  };
+}
+
+function extractSessionUpdateArtifacts(
+  params: SessionNotification,
+  updateMeta: Record<string, unknown> | undefined,
+  limit: number,
+  sessionId: string,
+): SessionArtifactInput[] {
+  const rawArtifacts = updateMeta?.['artifacts'];
+  if (!Array.isArray(rawArtifacts)) {
+    return [];
+  }
+  const update = params.update as {
+    sessionUpdate?: unknown;
+    status?: unknown;
+    toolCallId?: unknown;
+  };
+  if (
+    update.sessionUpdate !== 'tool_call_update' ||
+    (update.status !== 'completed' &&
+      update.status !== 'failed' &&
+      update.status !== 'cancelled')
+  ) {
+    return [];
+  }
+  const toolCallId =
+    typeof update.toolCallId === 'string' ? update.toolCallId : undefined;
+  const toolName =
+    typeof updateMeta?.['toolName'] === 'string'
+      ? updateMeta['toolName']
+      : undefined;
+  return extractCappedArtifactInputs(
+    rawArtifacts,
+    limit,
+    sessionId,
+    'tool',
+    (artifact) => ({
+      ...artifactPayloadFields(artifact),
+      source: 'tool' as const,
+      toolCallId,
+      toolName,
+    }),
+  );
+}
+
+function sanitizeSessionUpdateArtifacts(
+  params: SessionNotification,
+  updateMeta: Record<string, unknown> | undefined,
+): SessionNotification {
+  if (!Array.isArray(updateMeta?.['artifacts'])) {
+    return params;
+  }
+  const sanitizedMeta = { ...updateMeta };
+  delete sanitizedMeta['artifacts'];
+  const update = {
+    ...(params.update as Record<string, unknown>),
+    _meta: sanitizedMeta,
+  } as SessionNotification['update'];
+  return {
+    ...params,
+    update,
+  };
+}
+
+function isTrustedArtifactToolUpdate(
+  params: SessionNotification,
+  updateMeta: Record<string, unknown> | undefined,
+): boolean {
+  const update = params.update as {
+    sessionUpdate?: unknown;
+    status?: unknown;
+  };
+  // ToolCallEmitter stamps _meta.toolName from the actual tool invocation. The
+  // artifact payload itself is never allowed to self-declare publisher trust.
+  return (
+    update.sessionUpdate === 'tool_call_update' &&
+    update.status === 'completed' &&
+    updateMeta?.['toolName'] === PUBLISH_ARTIFACT_TOOL_NAME
+  );
+}
+
 /**
  * Rethrow an FsError as a structured ACP `RequestError` so the
  * agent's RPC client sees `data.errorKind` / `data.hint` /
@@ -207,6 +354,7 @@ function sliceLineRange(
 export interface BridgeClientSessionEntry {
   sessionId: string;
   events: EventBus;
+  artifacts: SessionArtifactStore;
   pendingPermissionIds: Set<string>;
   /**
    * Mid-turn user messages queued by the browser, drained here when the ACP
@@ -215,6 +363,8 @@ export interface BridgeClientSessionEntry {
    * `extMethod` can splice it. See `SessionEntry.midTurnMessageQueue`.
    */
   midTurnMessageQueue: MidTurnQueueEntry[];
+  /** True while a prompt is executing for this session. */
+  promptActive?: boolean;
   activePromptOriginatorClientId?: string;
   /**
    * True while the bridge drives a model roundtrip; the
@@ -332,6 +482,7 @@ export class BridgeClient implements Client {
      * `methodNotFound` (no client-hosted server can exist without it).
      */
     private readonly clientMcpSender?: ClientMcpMessageSender,
+    private readonly ownsSession: (sessionId: string) => boolean = () => true,
   ) {}
 
   async requestPermission(
@@ -418,6 +569,15 @@ export class BridgeClient implements Client {
   }
 
   async sessionUpdate(params: SessionNotification): Promise<void> {
+    if (
+      !this.ownsSession(params.sessionId) &&
+      !this.inFlightRestoreIds.has(params.sessionId)
+    ) {
+      writeStderrLine(
+        `[demux] session=${params.sessionId} type=session_update action=dropped reason=session_not_owned`,
+      );
+      return;
+    }
     const entry = this.resolveEntry(params.sessionId);
     const events =
       entry?.events ?? this.resolvePendingRestoreEvents(params.sessionId);
@@ -471,12 +631,28 @@ export class BridgeClient implements Client {
       typeof originalTs === 'number' && Number.isFinite(originalTs)
         ? originalTs
         : undefined;
+    const artifacts = entry?.artifacts
+      ? extractSessionUpdateArtifacts(
+          params,
+          updateMeta,
+          entry.artifacts.inputBatchLimit(),
+          entry.sessionId,
+        )
+      : [];
+    const publishParams = sanitizeSessionUpdateArtifacts(params, updateMeta);
     events.publish({
       type: 'session_update',
-      data: params,
+      data: publishParams,
       ...originator,
       ...(serverTimestamp !== undefined ? { _meta: { serverTimestamp } } : {}),
     });
+    if (entry) {
+      if (artifacts.length > 0) {
+        await this.upsertAndPublishArtifacts(entry, artifacts, {
+          trustedPublisher: isTrustedArtifactToolUpdate(params, updateMeta),
+        });
+      }
+    }
   }
 
   /**
@@ -658,11 +834,12 @@ export class BridgeClient implements Client {
   }
 
   /**
-   * Handle child->bridge ACP `extNotification` calls. Six methods are
-   * recognized — `qwen/notify/session/model-update`,
+   * Handle child->bridge ACP `extNotification` calls. Recognized methods are
+   * `qwen/notify/session/model-update`,
    * `qwen/notify/session/mode-update`,
    * `qwen/notify/session/title-update` (auto/in-process session titles),
    * `qwen/notify/session/prompt-suggestion` (followup assist),
+   * `qwen/notify/session/artifact-event` (hook artifacts),
    * `qwen/notify/session/terminal-sequence`, and
    * `qwen/notify/session/mcp-budget-event` — each translated into a
    * session-scoped SSE frame. Unknown methods are dropped silently
@@ -741,6 +918,10 @@ export class BridgeClient implements Client {
       this.publishExtNotification(sessionId, 'terminal_sequence', rest);
       return;
     }
+    if (method === 'qwen/notify/session/artifact-event') {
+      await this.handleArtifactEvent(params);
+      return;
+    }
     if (method !== 'qwen/notify/session/mcp-budget-event') return;
     const sessionId = params['sessionId'];
     if (typeof sessionId !== 'string') return;
@@ -765,6 +946,91 @@ export class BridgeClient implements Client {
     this.publishExtNotification(sessionId, type, rest);
   }
 
+  private async handleArtifactEvent(
+    params: Record<string, unknown>,
+  ): Promise<void> {
+    const sessionId = params['sessionId'];
+    const rawArtifacts = params['artifacts'];
+    if (typeof sessionId !== 'string' || !Array.isArray(rawArtifacts)) {
+      writeStderrLine(
+        `[demux] session=${typeof sessionId === 'string' ? sessionId : '<missing>'} type=artifact_event action=dropped reason=malformed`,
+      );
+      return;
+    }
+    if (
+      !this.ownsSession(sessionId) &&
+      !this.inFlightRestoreIds.has(sessionId)
+    ) {
+      writeStderrLine(
+        `[demux] session=${sessionId} type=artifact_event action=dropped reason=session_not_owned`,
+      );
+      return;
+    }
+    const entry = this.resolveEntry(sessionId);
+    if (!entry) {
+      writeStderrLine(
+        `[demux] session=${sessionId} type=artifact_event action=dropped reason=session_not_found`,
+      );
+      return;
+    }
+    const hookEventName =
+      typeof params['hookEventName'] === 'string'
+        ? params['hookEventName']
+        : undefined;
+    const toolName =
+      typeof params['toolName'] === 'string' ? params['toolName'] : undefined;
+    const toolCallId =
+      typeof params['toolCallId'] === 'string'
+        ? params['toolCallId']
+        : undefined;
+    const artifacts = extractCappedArtifactInputs(
+      rawArtifacts,
+      entry.artifacts.inputBatchLimit(),
+      entry.sessionId,
+      'hook',
+      (artifact) => ({
+        ...artifactPayloadFields(artifact),
+        source: 'hook' as const,
+        hookEventName,
+        toolName,
+        toolCallId,
+      }),
+    );
+    await this.upsertAndPublishArtifacts(entry, artifacts);
+  }
+
+  private async upsertAndPublishArtifacts(
+    entry: BridgeClientSessionEntry,
+    artifacts: SessionArtifactInput[],
+    options?: Parameters<SessionArtifactStore['upsertMany']>[1],
+  ): Promise<void> {
+    try {
+      const result = await entry.artifacts.upsertMany(artifacts, options);
+      this.publishArtifactChanges(entry, result.changes);
+    } catch (error) {
+      writeStderrLine(
+        `[artifacts] session=${entry.sessionId} action=dropped reason=${JSON.stringify(
+          artifactIngestionErrorReason(error),
+        )}`,
+      );
+    }
+  }
+
+  private publishArtifactChanges(
+    entry: BridgeClientSessionEntry,
+    changes: SessionArtifactChange[],
+  ): void {
+    for (const change of changes) {
+      entry.events.publish({
+        type: 'artifact_changed',
+        data: { sessionId: entry.sessionId, change },
+        ...(entry.activePromptOriginatorClientId
+          ? { originatorClientId: entry.activePromptOriginatorClientId }
+          : {}),
+      });
+    }
+  }
+
   private publishExtNotification(
     sessionId: string,
     type: string,
diff --git a/packages/acp-bridge/src/bridgeTypes.ts b/packages/acp-bridge/src/bridgeTypes.ts
index 2dc9fbee46..992c5eb64d 100644
--- a/packages/acp-bridge/src/bridgeTypes.ts
+++ b/packages/acp-bridge/src/bridgeTypes.ts
@@ -17,6 +17,11 @@ import type {
 } from '@agentclientprotocol/sdk';
 import type { BridgeEvent, SubscribeOptions } from './eventBus.js';
 import type { PermissionPolicy } from './permission.js';
+import type {
+  SessionArtifactInput,
+  SessionArtifactMutationResult,
+  SessionArtifactsEnvelope,
+} from './sessionArtifacts.js';
 import type {
   ServeSessionContextStatus,
   ServeSessionHooksStatus,
@@ -494,6 +499,33 @@ export interface AcpSessionBridge {
     context?: BridgeClientRequestContext,
   ): SessionMetadataUpdate;
 
+  /**
+   * List the structured artifacts registered for a live session. Throws
+   * `SessionNotFoundError` when the id is unknown.
+   */
+  getSessionArtifacts(sessionId: string): Promise<SessionArtifactsEnvelope>;
+
+  /**
+   * Register a client-supplied artifact for the session. Client artifacts use
+   * the daemon-issued client id from the request context for retention/audit;
+   * request bodies cannot self-assign client ids.
+   */
+  addSessionArtifact(
+    sessionId: string,
+    artifact: SessionArtifactInput,
+    context?: BridgeClientRequestContext,
+  ): Promise<SessionArtifactMutationResult>;
+
+  /**
+   * Remove an artifact from the session. Missing artifact ids are idempotent
+   * no-ops; unknown session ids still throw `SessionNotFoundError`.
+   */
+  removeSessionArtifact(
+    sessionId: string,
+    artifactId: string,
+    context?: BridgeClientRequestContext,
+  ): Promise<SessionArtifactMutationResult>;
+
   /**
    * Cast a vote on a pending `permission_request` (first-responder wins).
    */
diff --git a/packages/acp-bridge/src/index.ts b/packages/acp-bridge/src/index.ts
index 316d85e5f2..e36239d7fb 100644
--- a/packages/acp-bridge/src/index.ts
+++ b/packages/acp-bridge/src/index.ts
@@ -12,6 +12,7 @@ export * from './permissionMediator.js';
 export * from './workspacePaths.js';
 export * from './status.js';
 export * from './bridgeErrors.js';
+export * from './sessionArtifacts.js';
 export * from './bridgeTypes.js';
 export * from './bridgeOptions.js';
 export * from './spawnChannel.js';
diff --git a/packages/acp-bridge/src/sessionArtifacts.test.ts b/packages/acp-bridge/src/sessionArtifacts.test.ts
new file mode 100644
index 0000000000..31dae0a417
--- /dev/null
+++ b/packages/acp-bridge/src/sessionArtifacts.test.ts
@@ -0,0 +1,1702 @@
+/**
+ * @license
+ * Copyright 2026 Qwen Team
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { createHash } from 'node:crypto';
+import { promises as fs } from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+import {
+  SessionArtifactStore,
+  SessionArtifactValidationError,
+} from './sessionArtifacts.js';
+
+describe('SessionArtifactStore', () => {
+  let workspace: string;
+
+  beforeEach(async () => {
+    workspace = await fs.mkdtemp(path.join(os.tmpdir(), 'qwen-artifacts-'));
+  });
+
+  afterEach(async () => {
+    vi.useRealTimers();
+    await fs.rm(workspace, { recursive: true, force: true });
+  });
+
+  function managedIdForWorkspacePath(workspacePath: string): string {
+    return createHash('sha1')
+      .update(path.resolve(workspace, workspacePath))
+      .digest('hex')
+      .slice(0, 16);
+  }
+
+  it('lists, removes, and idempotently ignores missing artifact deletes', async () => {
+    const store = new SessionArtifactStore({
+      sessionId: 's1',
+      workspaceCwd: workspace,
+    });
+
+    const created = await store.upsertMany(
+      [
+        {
+          title: 'Lineage',
+          source: 'client',
+          url: 'https://example.com/lineage',
+        },
+      ],
+      { strict: true },
+    );
+    const artifactId = created.changes[0]?.artifactId;
+
+    expect(created.changes).toHaveLength(1);
+    await expect(store.list()).resolves.toMatchObject({
+      v: 1,
+      sessionId: 's1',
+      artifacts: [
+        {
+          id: artifactId,
+          storage: 'external_url',
+          source: 'client',
+          clientRetained: true,
+        },
+      ],
+    });
+
+    await expect(store.remove(artifactId!)).resolves.toMatchObject({
+      changes: [{ action: 'removed', artifactId, reason: 'explicit' }],
+    });
+    await expect(store.remove(artifactId!)).resolves.toMatchObject({
+      changes: [],
+    });
+  });
+
+  it('prevents one client from removing another client retained artifact', async () => {
+    const store = new SessionArtifactStore({
+      sessionId: 's1-client-owner',
+      workspaceCwd: workspace,
+    });
+
+    const created = await store.upsertMany([
+      {
+        title: 'Client link',
+        source: 'client',
+        clientId: 'client-a',
+        url: 'https://example.com/client-a',
+      },
+    ]);
+    const artifactId = created.changes[0]!.artifactId;
+
+    const stderr = vi
+      .spyOn(process.stderr, 'write')
+      .mockReturnValue(true as never);
+    try {
+      await expect(
+        store.remove(artifactId, { clientId: 'client-b' }),
+      ).resolves.toMatchObject({ changes: [] });
+      await expect(store.remove(artifactId)).resolves.toMatchObject({
+        changes: [],
+      });
+      const logged = stderr.mock.calls.map((call) => String(call[0])).join('');
+      expect(logged).toContain('remove_denied');
+      expect(logged).toContain('client-a');
+      expect(logged).toContain('client-b');
+      expect(logged).toContain('<anonymous>');
+    } finally {
+      stderr.mockRestore();
+    }
+    await expect(store.list()).resolves.toMatchObject({
+      artifacts: [{ id: artifactId, clientId: 'client-a' }],
+    });
+
+    await expect(
+      store.remove(artifactId, { clientId: 'client-a' }),
+    ).resolves.toMatchObject({
+      changes: [{ action: 'removed', artifactId, reason: 'explicit' }],
+    });
+  });
+
+  it('serializes concurrent store operations', async () => {
+    const store = new SessionArtifactStore({
+      sessionId: 's1-queue',
+      workspaceCwd: workspace,
+    });
+
+    const first = store.upsertMany([
+      { title: 'First', url: 'https://example.com/first' },
+    ]);
+    const second = store.upsertMany([
+      { title: 'Second', url: 'https://example.com/second' },
+    ]);
+    const listed = store.list();
+
+    await expect(first).resolves.toMatchObject({
+      changes: [
+        {
+          action: 'created',
+          artifact: { title: 'First' },
+        },
+      ],
+    });
+    await expect(second).resolves.toMatchObject({
+      changes: [
+        {
+          action: 'created',
+          artifact: { title: 'Second' },
+        },
+      ],
+    });
+    await expect(listed).resolves.toMatchObject({
+      artifacts: [{ title: 'First' }, { title: 'Second' }],
+    });
+
+    const firstId = (await first).changes[0]?.artifactId;
+    const removed = store.remove(firstId!);
+    const afterRemove = store.list();
+
+    await expect(removed).resolves.toMatchObject({
+      changes: [
+        {
+          action: 'removed',
+          artifactId: firstId,
+          reason: 'explicit',
+        },
+      ],
+    });
+    await expect(afterRemove).resolves.toMatchObject({
+      artifacts: [{ title: 'Second' }],
+    });
+  });
+
+  it('rejects untrusted published artifacts and allows trusted published upgrades', async () => {
+    const store = new SessionArtifactStore({
+      sessionId: 's2',
+      workspaceCwd: workspace,
+    });
+
+    await expect(
+      store.upsertMany(
+        [
+          {
+            title: 'Forged',
+            storage: 'published',
+            url: 'https://example.com/artifact',
+          },
+        ],
+        { strict: true },
+      ),
+    ).rejects.toBeInstanceOf(SessionArtifactValidationError);
+    await store.upsertMany([
+      { title: 'Link', url: 'https://example.com/artifact' },
+    ]);
+    const upgraded = await store.upsertMany(
+      [
+        {
+          title: 'Published',
+          storage: 'published',
+          url: 'https://example.com/artifact',
+          managedId: 'managed-1',
+        },
+      ],
+      { trustedPublisher: true },
+    );
+
+    expect(upgraded.changes).toHaveLength(1);
+    expect(upgraded.changes[0]).toMatchObject({
+      action: 'updated',
+      artifact: {
+        title: 'Published',
+        storage: 'published',
+        managedId: 'managed-1',
+      },
+    });
+    expect(upgraded.changes[0]?.artifact).not.toHaveProperty('workspacePath');
+  });
+
+  it('uses managedId as identity when published artifacts also include a url', async () => {
+    const store = new SessionArtifactStore({
+      sessionId: 's2-managed-identity',
+      workspaceCwd: workspace,
+    });
+
+    const first = await store.upsertMany(
+      [
+        {
+          title: 'Published A',
+          storage: 'published',
+          managedId: 'managed-a',
+          url: 'https://example.com/shared',
+        },
+      ],
+      { strict: true, trustedPublisher: true },
+    );
+    const second = await store.upsertMany(
+      [
+        {
+          title: 'Published B',
+          storage: 'published',
+          managedId: 'managed-b',
+          url: 'https://example.com/shared',
+        },
+      ],
+      { strict: true, trustedPublisher: true },
+    );
+
+    expect(first.changes[0]?.action).toBe('created');
+    expect(second.changes[0]?.action).toBe('created');
+    expect((await store.list()).artifacts).toEqual([
+      expect.objectContaining({ managedId: 'managed-a' }),
+      expect.objectContaining({ managedId: 'managed-b' }),
+    ]);
+  });
+
+  it('updates a republished managed artifact when its published url changes', async () => {
+    const store = new SessionArtifactStore({
+      sessionId: 's2-published-refresh',
+      workspaceCwd: workspace,
+    });
+
+    await store.upsertMany(
+      [
+        {
+          title: 'Published A',
+          storage: 'published',
+          managedId: 'managed-a',
+          url: 'https://old.example.com/artifact',
+        },
+      ],
+      { strict: true, trustedPublisher: true },
+    );
+    const refreshed = await store.upsertMany(
+      [
+        {
+          title: 'Published B',
+          storage: 'published',
+          managedId: 'managed-a',
+          url: 'https://new.example.com/artifact',
+        },
+      ],
+      { strict: true, trustedPublisher: true },
+    );
+
+    expect(refreshed.changes).toHaveLength(1);
+    expect(refreshed.changes[0]).toMatchObject({
+      action: 'updated',
+      artifact: {
+        title: 'Published B',
+        url: 'https://new.example.com/artifact',
+      },
+    });
+    expect((await store.list()).artifacts).toHaveLength(1);
+  });
+
+  it('upgrades a workspace artifact when the artifact tool publishes the same path', async () => {
+    const store = new SessionArtifactStore({
+      sessionId: 's2-workspace-published',
+      workspaceCwd: workspace,
+    });
+    await fs.mkdir(path.join(workspace, 'reports'), { recursive: true });
+    const artifactPath = path.join(workspace, 'reports/dashboard.html');
+    const artifactUrl = pathToFileURL(artifactPath).href;
+    await fs.writeFile(artifactPath, 'hello');
+
+    const created = await store.upsertMany(
+      [{ title: 'Draft', workspacePath: 'reports/dashboard.html' }],
+      { strict: true },
+    );
+    const upgraded = await store.upsertMany(
+      [
+        {
+          title: 'Published dashboard',
+          storage: 'published',
+          managedId: managedIdForWorkspacePath('reports/dashboard.html'),
+          url: artifactUrl,
+          mimeType: 'text/html',
+        },
+      ],
+      { strict: true, trustedPublisher: true },
+    );
+
+    const publishedId = upgraded.changes[0]?.artifact?.id;
+    expect(publishedId).toBeDefined();
+    expect(publishedId).not.toBe(created.changes[0]?.artifactId);
+    expect(upgraded.changes).toHaveLength(1);
+    expect(upgraded.changes[0]).toMatchObject({
+      action: 'updated',
+      artifactId: publishedId,
+      artifact: {
+        storage: 'published',
+        title: 'Published dashboard',
+        managedId: managedIdForWorkspacePath('reports/dashboard.html'),
+        url: artifactUrl,
+      },
+    });
+    expect(upgraded.changes[0]?.artifact).not.toHaveProperty('workspacePath');
+    expect((await store.list()).artifacts).toMatchObject([{ id: publishedId }]);
+
+    const republished = await store.upsertMany(
+      [
+        {
+          title: 'Republished dashboard',
+          storage: 'published',
+          managedId: managedIdForWorkspacePath('reports/dashboard.html'),
+          url: artifactUrl,
+          mimeType: 'text/html',
+        },
+      ],
+      { strict: true, trustedPublisher: true },
+    );
+
+    expect(republished.changes).toHaveLength(1);
+    expect(republished.changes[0]).toMatchObject({
+      action: 'updated',
+      artifactId: publishedId,
+      artifact: {
+        id: publishedId,
+        storage: 'published',
+        title: 'Republished dashboard',
+        managedId: managedIdForWorkspacePath('reports/dashboard.html'),
+        url: artifactUrl,
+      },
+    });
+    expect((await store.list()).artifacts).toHaveLength(1);
+  });
+
+  it('keeps published artifacts detached when their original workspace path is recorded again', async () => {
+    const store = new SessionArtifactStore({
+      sessionId: 's2-published-rerecord-workspace',
+      workspaceCwd: workspace,
+    });
+    await fs.mkdir(path.join(workspace, 'reports'), { recursive: true });
+    const artifactPath = path.join(workspace, 'reports/dashboard.html');
+    const artifactUrl = pathToFileURL(artifactPath).href;
+    await fs.writeFile(artifactPath, 'hello');
+
+    await store.upsertMany(
+      [{ title: 'Draft', workspacePath: 'reports/dashboard.html' }],
+      { strict: true },
+    );
+    const upgraded = await store.upsertMany(
+      [
+        {
+          title: 'Published dashboard',
+          storage: 'published',
+          managedId: managedIdForWorkspacePath('reports/dashboard.html'),
+          url: artifactUrl,
+          mimeType: 'text/html',
+        },
+      ],
+      { strict: true, trustedPublisher: true },
+    );
+    const publishedId = upgraded.changes[0]?.artifactId;
+
+    const repeated = await store.upsertMany(
+      [{ title: 'Draft again', workspacePath: 'reports/dashboard.html' }],
+      { strict: true },
+    );
+
+    expect(repeated.changes).toEqual([]);
+    const artifact = (await store.list()).artifacts[0];
+    expect(artifact).toMatchObject({
+      id: publishedId,
+      storage: 'published',
+      status: 'available',
+      url: artifactUrl,
+    });
+    expect(artifact).not.toHaveProperty('workspacePath');
+
+    await fs.rm(artifactPath);
+    vi.useFakeTimers();
+    vi.setSystemTime(new Date(Date.now() + 6_000));
+    try {
+      await expect(store.list()).resolves.toMatchObject({
+        artifacts: [
+          expect.objectContaining({
+            id: publishedId,
+            storage: 'published',
+            status: 'available',
+          }),
+        ],
+      });
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+
+  it('accepts trusted published file urls outside the workspace', async () => {
+    const store = new SessionArtifactStore({
+      sessionId: 's2-published-file-url',
+      workspaceCwd: workspace,
+    });
+    const outside = await fs.mkdtemp(path.join(os.tmpdir(), 'qwen-outside-'));
+    try {
+      await fs.writeFile(path.join(outside, 'secret.html'), 'secret');
+      await expect(
+        store.upsertMany(
+          [
+            {
+              title: 'Outside file',
+              storage: 'published',
+              managedId: 'outside-file',
+              url: pathToFileURL(path.join(outside, 'secret.html')).href,
+            },
+          ],
+          { strict: true, trustedPublisher: true },
+        ),
+      ).resolves.toMatchObject({
+        changes: [
+          {
+            artifact: {
+              storage: 'published',
+              url: pathToFileURL(path.join(outside, 'secret.html')).href,
+            },
+          },
+        ],
+      });
+    } finally {
+      await fs.rm(outside, { recursive: true, force: true });
+    }
+  });
+
+  it('rejects untrusted file urls', async () => {
+    const store = new SessionArtifactStore({
+      sessionId: 's2-untrusted-file-url',
+      workspaceCwd: workspace,
+    });
+
+    await expect(
+      store.upsertMany(
+        [
+          {
+            title: 'Local file',
+            url: pathToFileURL(path.join(workspace, 'report.html')).href,
+          },
+        ],
+        { strict: true },
+      ),
+    ).rejects.toMatchObject({ field: 'url' });
+  });
+
+  it('evicts non-retained old artifacts before client-retained artifacts', async () => {
+    const store = new SessionArtifactStore({
+      sessionId: 's3',
+      workspaceCwd: workspace,
+      maxArtifacts: 2,
+    });
+
+    const client = await store.upsertMany([
+      {
+        title: 'Client link',
+        source: 'client',
+        url: 'https://example.com/client',
+      },
+    ]);
+    const tool = await store.upsertMany([
+      { title: 'Tool link', url: 'https://example.com/tool' },
+    ]);
+    const overflow = await store.upsertMany([
+      { title: 'New link', url: 'https://example.com/new' },
+    ]);
+
+    expect(overflow.changes).toContainEqual(
+      expect.objectContaining({
+        action: 'removed',
+        artifactId: tool.changes[0]?.artifactId,
+        reason: 'eviction',
+      }),
+    );
+    expect((await store.list()).artifacts.map((a) => a.id)).toContain(
+      client.changes[0]?.artifactId,
+    );
+  });
+
+  it('evicts the oldest client-retained artifact when no other overflow candidate exists', async () => {
+    const store = new SessionArtifactStore({
+      sessionId: 's3-retained',
+      workspaceCwd: workspace,
+      maxArtifacts: 2,
+    });
+
+    const first = await store.upsertMany([
+      {
+        title: 'Retained one',
+        source: 'client',
+        url: 'https://example.com/retained-one',
+      },
+    ]);
+    const second = await store.upsertMany([
+      {
+        title: 'Retained two',
+        source: 'client',
+        url: 'https://example.com/retained-two',
+      },
+    ]);
+
+    const overflow = await store.upsertMany([
+      { title: 'Tool overflow', url: 'https://example.com/tool-overflow' },
+    ]);
+
+    expect(overflow.changes).toContainEqual(
+      expect.objectContaining({
+        action: 'removed',
+        artifactId: first.changes[0]?.artifactId,
+        reason: 'eviction',
+      }),
+    );
+    expect(
+      (await store.list()).artifacts.map((artifact) => artifact.id),
+    ).toEqual([second.changes[0]?.artifactId, overflow.changes[0]?.artifactId]);
+  });
+
+  it('drops newest artifacts created in the same batch when no older eviction candidate exists', async () => {
+    const store = new SessionArtifactStore({
+      sessionId: 's3-same-batch-overflow',
+      workspaceCwd: workspace,
+      maxArtifacts: 1,
+    });
+    const stderr = vi
+      .spyOn(process.stderr, 'write')
+      .mockReturnValue(true as never);
+
+    try {
+      const overflow = await store.upsertMany([
+        { title: 'First link', url: 'https://example.com/first' },
+        { title: 'Second link', url: 'https://example.com/second' },
+      ]);
+
+      expect(overflow.changes).toHaveLength(1);
+      expect(overflow.changes[0]?.artifact).toMatchObject({
+        title: 'First link',
+      });
+      await expect(store.list()).resolves.toMatchObject({
+        artifacts: [{ title: 'First link' }],
+      });
+
+      const logged = stderr.mock.calls.map((call) => String(call[0])).join('');
+      expect(logged).toContain('action=dropped');
+      expect(logged).toContain('max artifacts exceeded');
+    } finally {
+      stderr.mockRestore();
+    }
+  });
+
+  it('rejects workspace path traversal', async () => {
+    const store = new SessionArtifactStore({
+      sessionId: 's4',
+      workspaceCwd: workspace,
+    });
+
+    await expect(
+      store.upsertMany([{ title: 'Escape', workspacePath: '../outside.txt' }], {
+        strict: true,
+      }),
+    ).rejects.toMatchObject({ field: 'workspacePath' });
+  });
+
+  it('accepts workspace entries whose names start with two dots', async () => {
+    const store = new SessionArtifactStore({
+      sessionId: 's4-dot-prefix',
+      workspaceCwd: workspace,
+    });
+    await fs.mkdir(path.join(workspace, '..data'), { recursive: true });
+    await fs.writeFile(path.join(workspace, '..data/report.html'), 'hello');
+
+    await expect(
+      store.upsertMany(
+        [{ title: 'Projected volume', workspacePath: '..data/report.html' }],
+        { strict: true },
+      ),
+    ).resolves.toMatchObject({
+      changes: [
+        {
+          artifact: {
+            workspacePath: '..data/report.html',
+            status: 'available',
+          },
+        },
+      ],
+    });
+  });
+
+  it('drops invalid artifacts in non-strict batches and keeps valid ones', async () => {
+    const store = new SessionArtifactStore({
+      sessionId: 's4-non-strict',
+      workspaceCwd: workspace,
+    });
+    const stderr = vi
+      .spyOn(process.stderr, 'write')
+      .mockReturnValue(true as never);
+
+    try {
+      const result = await store.upsertMany([
+        {
+          title: 'Forged',
+          storage: 'published',
+          url: 'https://example.com/forged',
+        },
+        {
+          title: 'Valid',
+          url: 'https://example.com/valid',
+        },
+      ]);
+
+      expect(result.changes).toHaveLength(1);
+      expect(result.changes[0]?.artifact).toMatchObject({ title: 'Valid' });
+      const logged = stderr.mock.calls.map((call) => String(call[0])).join('');
+      expect(logged).toContain('published artifacts are reserved');
+    } finally {
+      stderr.mockRestore();
+    }
+  });
+
+  it('keeps first display fields and only enriches missing metadata keys', async () => {
+    const store = new SessionArtifactStore({
+      sessionId: 's5',
+      workspaceCwd: workspace,
+    });
+
+    await store.upsertMany([
+      {
+        title: 'Tool title',
+        source: 'tool',
+        toolName: 'first_tool',
+        url: 'https://example.com/resource',
+        metadata: { owner: 'first' },
+      },
+    ]);
+
+    const clientUpdate = await store.upsertMany([
+      {
+        title: 'Client title',
+        source: 'client',
+        clientId: 'client-1',
+        url: 'https://example.com/resource',
+        metadata: { owner: 'client', retainedBy: 'client' },
+      },
+    ]);
+    expect(clientUpdate.changes[0]?.artifact).toMatchObject({
+      title: 'Tool title',
+      source: 'tool',
+      toolName: 'first_tool',
+      clientRetained: true,
+      metadata: { owner: 'first' },
+    });
+    expect(clientUpdate.changes[0]?.artifact).not.toHaveProperty('clientId');
+
+    await store.upsertMany([
+      {
+        title: 'Hook title',
+        source: 'hook',
+        hookEventName: 'PostToolUse',
+        url: 'https://example.com/resource',
+        metadata: { hookKey: 'ignored' },
+      },
+    ]);
+
+    const repeatedTool = await store.upsertMany([
+      {
+        title: 'Second tool title',
+        source: 'tool',
+        toolName: 'second_tool',
+        url: 'https://example.com/resource',
+        metadata: { toolKey: 'added', toString: 'own-key' },
+      },
+    ]);
+    expect(repeatedTool.changes[0]?.artifact).toMatchObject({
+      title: 'Tool title',
+      source: 'tool',
+      toolName: 'first_tool',
+      metadata: {
+        owner: 'first',
+        toolKey: 'added',
+        toString: 'own-key',
+      },
+    });
+    expect(
+      Object.hasOwn(
+        repeatedTool.changes[0]?.artifact?.metadata ?? {},
+        'toString',
+      ),
+    ).toBe(true);
+    expect(repeatedTool.changes[0]?.artifact?.metadata).not.toHaveProperty(
+      'hookKey',
+    );
+  });
+
+  it('logs and keeps existing metadata when a merge would exceed the limit', async () => {
+    const store = new SessionArtifactStore({
+      sessionId: 's5-metadata-overflow',
+      workspaceCwd: workspace,
+    });
+    const largeValue = 'x'.repeat(4070);
+    const stderr = vi
+      .spyOn(process.stderr, 'write')
+      .mockReturnValue(true as never);
+
+    try {
+      const created = await store.upsertMany(
+        [
+          {
+            title: 'Link',
+            url: 'https://example.com/resource',
+            metadata: { blob: largeValue },
+          },
+        ],
+        { strict: true },
+      );
+      const artifactId = created.changes[0]?.artifactId;
+
+      const repeated = await store.upsertMany(
+        [
+          {
+            title: 'Ignored title',
+            url: 'https://example.com/resource',
+            metadata: { extra: 'y'.repeat(20) },
+          },
+        ],
+        { strict: true },
+      );
+
+      expect(repeated.changes).toEqual([]);
+      expect((await store.list()).artifacts[0]?.metadata).toEqual({
+        blob: largeValue,
+      });
+      const logged = stderr.mock.calls.map((call) => String(call[0])).join('');
+      expect(logged).toContain('metadata_merge_dropped');
+      expect(logged).toContain(artifactId);
+    } finally {
+      stderr.mockRestore();
+    }
+  });
+
+  it('does not merge client metadata into a published tool artifact', async () => {
+    const store = new SessionArtifactStore({
+      sessionId: 's5-published-metadata-source',
+      workspaceCwd: workspace,
+    });
+
+    await store.upsertMany(
+      [
+        {
+          title: 'Published',
+          storage: 'published',
+          url: 'https://example.com/published',
+          metadata: { publisher: 'tool' },
+        },
+      ],
+      { strict: true, trustedPublisher: true },
+    );
+
+    const clientUpdate = await store.upsertMany([
+      {
+        title: 'Client link',
+        source: 'client',
+        clientId: 'client-1',
+        url: 'https://example.com/published',
+        metadata: { injected: 'client' },
+      },
+    ]);
+
+    expect(clientUpdate.changes[0]?.artifact).toMatchObject({
+      source: 'tool',
+      clientRetained: true,
+      metadata: { publisher: 'tool' },
+    });
+    expect(clientUpdate.changes[0]?.artifact?.metadata).not.toHaveProperty(
+      'injected',
+    );
+  });
+
+  it('coalesces duplicate identities within one upsert batch', async () => {
+    const store = new SessionArtifactStore({
+      sessionId: 's5-coalesce',
+      workspaceCwd: workspace,
+    });
+
+    const result = await store.upsertMany([
+      {
+        title: 'Tool title',
+        source: 'tool',
+        toolName: 'first_tool',
+        url: 'https://example.com/same',
+        metadata: { owner: 'tool' },
+      },
+      {
+        title: 'Client title',
+        source: 'client',
+        clientId: 'client-1',
+        url: 'https://example.com/same',
+        metadata: { retainedBy: 'client' },
+      },
+      {
+        title: 'Hook title',
+        source: 'hook',
+        hookEventName: 'PostToolUse',
+        url: 'https://example.com/same',
+        metadata: { hookKey: 'ignored' },
+      },
+    ]);
+
+    expect(result.changes).toHaveLength(1);
+    expect(result.changes[0]?.artifact).toMatchObject({
+      title: 'Tool title',
+      source: 'tool',
+      toolName: 'first_tool',
+      clientRetained: true,
+      metadata: { owner: 'tool' },
+    });
+    expect(result.changes[0]?.artifact).not.toHaveProperty('clientId');
+    expect(result.changes[0]?.artifact).not.toHaveProperty('hookEventName');
+    expect(result.changes[0]?.artifact?.metadata).not.toHaveProperty('hookKey');
+    await expect(store.list()).resolves.toMatchObject({
+      artifacts: [{ title: 'Tool title' }],
+    });
+  });
+
+  it('infers artifact kind from storage and workspace extensions', async () => {
+    const store = new SessionArtifactStore({
+      sessionId: 's5-kind',
+      workspaceCwd: workspace,
+    });
+
+    const result = await store.upsertMany([
+      { title: 'Page', workspacePath: 'reports/index.html' },
+      { title: 'Image', workspacePath: 'screenshots/app.png' },
+      { title: 'Notebook', workspacePath: 'analysis/run.ipynb' },
+      { title: 'Unknown file', workspacePath: 'artifacts/blob.unknown' },
+      { title: 'Managed item', managedId: 'ext-123' },
+    ]);
+
+    expect(result.changes.map((change) => change.artifact?.kind)).toEqual([
+      'html',
+      'image',
+      'notebook',
+      'file',
+      'other',
+    ]);
+  });
+
+  it('rejects unsafe display markup in title and description', async () => {
+    const store = new SessionArtifactStore({
+      sessionId: 's5-markup',
+      workspaceCwd: workspace,
+    });
+
+    await expect(
+      store.upsertMany(
+        [{ title: '<img src=x onerror=alert(1)>', url: 'https://example.com' }],
+        { strict: true },
+      ),
+    ).rejects.toMatchObject({ field: 'title' });
+
+    await expect(
+      store.upsertMany(
+        [{ title: 'onload=alert(1)', url: 'https://example.com/onload' }],
+        { strict: true },
+      ),
+    ).rejects.toMatchObject({ field: 'title' });
+
+    await expect(
+      store.upsertMany(
+        [
+          {
+            title: 'conversation=value',
+            description: 'configuration=value',
+            url: 'https://example.com/benign',
+          },
+        ],
+        { strict: true },
+      ),
+    ).resolves.toMatchObject({
+      changes: [{ action: 'created' }],
+    });
+
+    await expect(
+      store.upsertMany(
+        [
+          {
+            title: 'Report',
+            description: 'javascript:alert(1)',
+            url: 'https://example.com',
+          },
+        ],
+        { strict: true },
+      ),
+    ).rejects.toMatchObject({ field: 'description' });
+
+    await expect(
+      store.upsertMany(
+        [
+          {
+            title: '<style>body{background:url(https://example.com/x)}</style>',
+            url: 'https://example.com/style',
+          },
+        ],
+        { strict: true },
+      ),
+    ).rejects.toMatchObject({ field: 'title' });
+
+    await expect(
+      store.upsertMany(
+        [
+          {
+            title: 'Workspace payload',
+            workspacePath: '<img src=x onerror=alert(1)>.html',
+          },
+        ],
+        { strict: true },
+      ),
+    ).rejects.toMatchObject({ field: 'workspacePath' });
+
+    await expect(
+      store.upsertMany(
+        [
+          {
+            title: 'Managed payload',
+            managedId: '<script>alert(1)</script>',
+          },
+        ],
+        { strict: true },
+      ),
+    ).rejects.toMatchObject({ field: 'managedId' });
+
+    for (const managedId of ['../secret', 'folder/item', 'folder\\item']) {
+      await expect(
+        store.upsertMany([{ title: 'Managed path', managedId }], {
+          strict: true,
+        }),
+      ).rejects.toMatchObject({ field: 'managedId' });
+    }
+
+    await expect(
+      store.upsertMany(
+        [
+          {
+            title: 'safe\u2028evil',
+            url: 'https://example.com/line-separator',
+          },
+        ],
+        { strict: true },
+      ),
+    ).rejects.toMatchObject({ field: 'title' });
+
+    await expect(
+      store.upsertMany(
+        [
+          {
+            title: 'safe\u2066evil',
+            url: 'https://example.com/bidi-isolate',
+          },
+        ],
+        { strict: true },
+      ),
+    ).rejects.toMatchObject({ field: 'title' });
+
+    await expect(
+      store.upsertMany(
+        [
+          {
+            title: 'Report',
+            description: '<a href="data:text/html,<script>alert(1)</script>">',
+            url: 'https://example.com/data',
+          },
+        ],
+        { strict: true },
+      ),
+    ).rejects.toMatchObject({ field: 'description' });
+
+    await expect(
+      store.upsertMany(
+        [
+          {
+            title: 'Report',
+            description: 'data:text/javascript,alert(1)',
+            url: 'https://example.com/data-js',
+          },
+        ],
+        { strict: true },
+      ),
+    ).rejects.toMatchObject({ field: 'description' });
+
+    await expect(
+      store.upsertMany(
+        [
+          {
+            title: 'Report',
+            description:
+              'data:image/svg+xml;base64,PHN2ZyBvbmxvYWQ9YWxlcnQoMSk+',
+            url: 'https://example.com/data-svg',
+          },
+        ],
+        { strict: true },
+      ),
+    ).rejects.toMatchObject({ field: 'description' });
+
+    await expect(
+      store.upsertMany(
+        [
+          {
+            title: '&lt;script&gt;alert(1)&lt;/script&gt;',
+            url: 'https://example.com/entity',
+          },
+        ],
+        { strict: true },
+      ),
+    ).rejects.toMatchObject({ field: 'title' });
+
+    await expect(
+      store.upsertMany(
+        [
+          {
+            title: 'safe\u202eevil',
+            url: 'https://example.com/bidi',
+          },
+        ],
+        { strict: true },
+      ),
+    ).rejects.toMatchObject({ field: 'title' });
+
+    await expect(
+      store.upsertMany(
+        [
+          {
+            title: 'Report',
+            url: 'https://example.com/metadata',
+            metadata: { preview: '<iframe src="https://example.com">' },
+          },
+        ],
+        { strict: true },
+      ),
+    ).rejects.toMatchObject({ field: 'metadata' });
+
+    await expect(
+      store.upsertMany(
+        [
+          {
+            title: 'Report',
+            url: 'https://example.com/metadata-key',
+            metadata: { '<script>': 'unsafe key' },
+          },
+        ],
+        { strict: true },
+      ),
+    ).rejects.toMatchObject({ field: 'metadata' });
+
+    await expect(
+      store.upsertMany(
+        [
+          {
+            title: 'Report',
+            url: 'https://example.com/mime',
+            mimeType: 'text/html<script>',
+          },
+        ],
+        { strict: true },
+      ),
+    ).rejects.toMatchObject({ field: 'mimeType' });
+  });
+
+  it('rejects external urls with credentials', async () => {
+    const store = new SessionArtifactStore({
+      sessionId: 's5-url-credentials',
+      workspaceCwd: workspace,
+    });
+
+    await expect(
+      store.upsertMany(
+        [
+          {
+            title: 'Credentialed link',
+            url: 'https://user:pass@example.com/report',
+          },
+        ],
+        { strict: true },
+      ),
+    ).rejects.toMatchObject({ field: 'url' });
+  });
+
+  it('accepts line whitespace in descriptions but not titles', async () => {
+    const store = new SessionArtifactStore({
+      sessionId: 's5-line-whitespace',
+      workspaceCwd: workspace,
+    });
+
+    await expect(
+      store.upsertMany(
+        [
+          {
+            title: 'Multiline report',
+            description: 'Line one\nLine two\tindented\r\nLine three',
+            url: 'https://example.com/multiline',
+          },
+        ],
+        { strict: true },
+      ),
+    ).resolves.toMatchObject({
+      changes: [
+        {
+          artifact: {
+            description: 'Line one\nLine two\tindented\r\nLine three',
+          },
+        },
+      ],
+    });
+
+    await expect(
+      store.upsertMany(
+        [
+          {
+            title: 'Bad\nTitle',
+            url: 'https://example.com/bad-title',
+          },
+        ],
+        { strict: true },
+      ),
+    ).rejects.toMatchObject({ field: 'title' });
+  });
+
+  it('does not create empty metadata or emit ghost updates', async () => {
+    const store = new SessionArtifactStore({
+      sessionId: 's5-empty-metadata',
+      workspaceCwd: workspace,
+    });
+
+    const created = await store.upsertMany([
+      {
+        title: 'Link',
+        url: 'https://example.com/resource',
+        metadata: {},
+      },
+    ]);
+    expect(created.changes[0]?.artifact).not.toHaveProperty('metadata');
+
+    const repeated = await store.upsertMany([
+      {
+        title: 'Ignored later title',
+        url: 'https://example.com/resource',
+      },
+    ]);
+
+    expect(repeated.changes).toEqual([]);
+  });
+
+  it('rejects non-finite metadata numbers', async () => {
+    const store = new SessionArtifactStore({
+      sessionId: 's5-finite-metadata',
+      workspaceCwd: workspace,
+    });
+
+    await expect(
+      store.upsertMany(
+        [
+          {
+            title: 'NaN metadata',
+            url: 'https://example.com/nan',
+            metadata: { score: Number.NaN },
+          },
+        ],
+        { strict: true },
+      ),
+    ).rejects.toMatchObject({ field: 'metadata' });
+
+    await expect(
+      store.upsertMany(
+        [
+          {
+            title: 'Infinite metadata',
+            url: 'https://example.com/infinity',
+            metadata: { score: Number.POSITIVE_INFINITY },
+          },
+        ],
+        { strict: true },
+      ),
+    ).rejects.toMatchObject({ field: 'metadata' });
+  });
+
+  it('ignores metadata key order when detecting updates', async () => {
+    const store = new SessionArtifactStore({
+      sessionId: 's5-metadata-order',
+      workspaceCwd: workspace,
+    });
+
+    const created = await store.upsertMany([
+      {
+        title: 'Link',
+        url: 'https://example.com/resource',
+        metadata: { a: 1, b: 2 },
+      },
+    ]);
+    const firstUpdatedAt = created.changes[0]?.artifact?.updatedAt;
+
+    const repeated = await store.upsertMany([
+      {
+        title: 'Ignored later title',
+        url: 'https://example.com/resource',
+        metadata: { b: 2, a: 1 },
+      },
+    ]);
+
+    expect(repeated.changes).toEqual([]);
+    expect((await store.list()).artifacts[0]?.updatedAt).toBe(firstUpdatedAt);
+  });
+
+  it('rejects existing workspace symlinks that escape the workspace', async () => {
+    const store = new SessionArtifactStore({
+      sessionId: 's6',
+      workspaceCwd: workspace,
+    });
+    const outside = await fs.mkdtemp(path.join(os.tmpdir(), 'qwen-outside-'));
+    try {
+      await fs.writeFile(path.join(outside, 'secret.txt'), 'secret');
+      await fs.symlink(
+        path.join(outside, 'secret.txt'),
+        path.join(workspace, 'escape.txt'),
+      );
+
+      await expect(
+        store.upsertMany([{ title: 'Escape', workspacePath: 'escape.txt' }], {
+          strict: true,
+        }),
+      ).rejects.toMatchObject({ field: 'workspacePath' });
+    } finally {
+      vi.useRealTimers();
+      await fs.rm(outside, { recursive: true, force: true });
+    }
+  });
+
+  it('rejects workspace symlinks that resolve to the workspace root', async () => {
+    const store = new SessionArtifactStore({
+      sessionId: 's6-root-symlink',
+      workspaceCwd: workspace,
+    });
+    await fs.symlink(workspace, path.join(workspace, 'root-link'));
+
+    await expect(
+      store.upsertMany([{ title: 'Root', workspacePath: 'root-link' }], {
+        strict: true,
+      }),
+    ).rejects.toMatchObject({ field: 'workspacePath' });
+  });
+
+  it('rejects dangling symlinks that point outside the workspace', async () => {
+    const store = new SessionArtifactStore({
+      sessionId: 's6-dangling-symlink',
+      workspaceCwd: workspace,
+    });
+    const outside = await fs.mkdtemp(path.join(os.tmpdir(), 'qwen-outside-'));
+    try {
+      await fs.symlink(
+        path.join(outside, 'missing.txt'),
+        path.join(workspace, 'escape.txt'),
+      );
+
+      await expect(
+        store.upsertMany([{ title: 'Escape', workspacePath: 'escape.txt' }], {
+          strict: true,
+        }),
+      ).rejects.toMatchObject({ field: 'workspacePath' });
+    } finally {
+      await fs.rm(outside, { recursive: true, force: true });
+    }
+  });
+
+  it('marks dangling symlinks that point inside the workspace as missing', async () => {
+    const store = new SessionArtifactStore({
+      sessionId: 's6-dangling-internal-symlink',
+      workspaceCwd: workspace,
+    });
+    await fs.symlink(
+      'missing.txt',
+      path.join(workspace, 'internal-missing.txt'),
+    );
+
+    await expect(
+      store.upsertMany(
+        [
+          {
+            title: 'Missing internal link',
+            workspacePath: 'internal-missing.txt',
+          },
+        ],
+        { strict: true },
+      ),
+    ).resolves.toMatchObject({
+      changes: [
+        {
+          artifact: {
+            status: 'missing',
+            workspacePath: 'internal-missing.txt',
+          },
+        },
+      ],
+    });
+  });
+
+  it('clears size when a workspace artifact becomes missing', async () => {
+    const store = new SessionArtifactStore({
+      sessionId: 's7',
+      workspaceCwd: workspace,
+    });
+    await fs.writeFile(path.join(workspace, 'report.txt'), 'hello');
+    await store.upsertMany([{ title: 'Report', workspacePath: 'report.txt' }]);
+
+    expect((await store.list()).artifacts[0]).toMatchObject({
+      status: 'available',
+      sizeBytes: 5,
+    });
+
+    await fs.rm(path.join(workspace, 'report.txt'));
+    vi.useFakeTimers();
+    vi.setSystemTime(new Date(Date.now() + 6_000));
+    const missing = (await store.list()).artifacts[0];
+    expect(missing).toMatchObject({ status: 'missing' });
+    expect(missing).not.toHaveProperty('sizeBytes');
+  });
+
+  it('marks a stored workspace artifact missing if it later escapes by symlink', async () => {
+    const store = new SessionArtifactStore({
+      sessionId: 's7-symlink-refresh',
+      workspaceCwd: workspace,
+    });
+    const outside = await fs.mkdtemp(path.join(os.tmpdir(), 'qwen-outside-'));
+    try {
+      await fs.writeFile(path.join(workspace, 'report.txt'), 'hello');
+      await fs.writeFile(path.join(outside, 'secret.txt'), 'secret');
+      await store.upsertMany(
+        [{ title: 'Report', workspacePath: 'report.txt' }],
+        { strict: true },
+      );
+
+      await fs.rm(path.join(workspace, 'report.txt'));
+      await fs.symlink(
+        path.join(outside, 'secret.txt'),
+        path.join(workspace, 'report.txt'),
+      );
+
+      vi.useFakeTimers();
+      vi.setSystemTime(new Date(Date.now() + 6_000));
+      const artifact = (await store.list()).artifacts[0];
+      expect(artifact).toMatchObject({
+        status: 'missing',
+        storage: 'workspace',
+      });
+      expect(artifact).not.toHaveProperty('workspacePath');
+      expect(artifact).not.toHaveProperty('sizeBytes');
+    } finally {
+      vi.useRealTimers();
+      await fs.rm(outside, { recursive: true, force: true });
+    }
+  });
+
+  it('restores workspacePath when a healed artifact is recorded again', async () => {
+    const store = new SessionArtifactStore({
+      sessionId: 's7-symlink-healed',
+      workspaceCwd: workspace,
+    });
+    const outside = await fs.mkdtemp(path.join(os.tmpdir(), 'qwen-outside-'));
+    try {
+      await fs.writeFile(path.join(workspace, 'report.txt'), 'hello');
+      await fs.writeFile(path.join(outside, 'secret.txt'), 'secret');
+      const created = await store.upsertMany(
+        [{ title: 'Report', workspacePath: 'report.txt' }],
+        { strict: true },
+      );
+
+      await fs.rm(path.join(workspace, 'report.txt'));
+      await fs.symlink(
+        path.join(outside, 'secret.txt'),
+        path.join(workspace, 'report.txt'),
+      );
+
+      vi.useFakeTimers();
+      vi.setSystemTime(new Date(Date.now() + 6_000));
+      expect((await store.list()).artifacts[0]).not.toHaveProperty(
+        'workspacePath',
+      );
+
+      await fs.rm(path.join(workspace, 'report.txt'));
+      await fs.writeFile(path.join(workspace, 'report.txt'), 'healed');
+      const healed = await store.upsertMany([
+        { title: 'Report', workspacePath: 'report.txt' },
+      ]);
+
+      expect(healed.changes).toContainEqual(
+        expect.objectContaining({
+          action: 'updated',
+          artifactId: created.changes[0]?.artifactId,
+          artifact: expect.objectContaining({
+            status: 'available',
+            workspacePath: 'report.txt',
+            sizeBytes: 6,
+          }),
+        }),
+      );
+      expect((await store.list()).artifacts[0]).toMatchObject({
+        status: 'available',
+        workspacePath: 'report.txt',
+      });
+    } finally {
+      vi.useRealTimers();
+      await fs.rm(outside, { recursive: true, force: true });
+    }
+  });
+
+  it('resets cached workspace realpath after a refresh failure', async () => {
+    const store = new SessionArtifactStore({
+      sessionId: 's7-realpath-error',
+      workspaceCwd: workspace,
+    });
+    const realpathSpy = vi
+      .spyOn(fs, 'realpath')
+      .mockRejectedValueOnce(
+        Object.assign(new Error('permission denied'), { code: 'EACCES' }),
+      );
+
+    try {
+      await expect(
+        store.upsertMany([{ title: 'Denied', workspacePath: 'denied.txt' }], {
+          strict: true,
+        }),
+      ).rejects.toMatchObject({
+        code: 'VALIDATION_FAILED',
+        field: 'workspacePath',
+        message: 'workspacePath could not be inspected: permission denied',
+      });
+
+      await expect(
+        store.upsertMany([{ title: 'Denied', workspacePath: 'denied.txt' }], {
+          strict: true,
+        }),
+      ).resolves.toMatchObject({
+        changes: [expect.objectContaining({ action: 'created' })],
+      });
+    } finally {
+      realpathSpy.mockRestore();
+    }
+  });
+
+  it('marks workspace artifact missing when list refresh hits a transient fs error', async () => {
+    const store = new SessionArtifactStore({
+      sessionId: 's7-list-refresh-error',
+      workspaceCwd: workspace,
+    });
+    await fs.writeFile(path.join(workspace, 'report.txt'), 'hello');
+    await store.upsertMany([{ title: 'Report', workspacePath: 'report.txt' }], {
+      strict: true,
+    });
+
+    vi.useFakeTimers();
+    vi.setSystemTime(new Date(Date.now() + 6_000));
+    const realpathSpy = vi
+      .spyOn(fs, 'realpath')
+      .mockRejectedValueOnce(
+        Object.assign(new Error('permission denied'), { code: 'EACCES' }),
+      );
+    const stderr = vi
+      .spyOn(process.stderr, 'write')
+      .mockReturnValue(true as never);
+
+    try {
+      const artifact = (await store.list()).artifacts[0];
+      expect(artifact).toMatchObject({ status: 'missing' });
+      expect(artifact).not.toHaveProperty('sizeBytes');
+      const logged = stderr.mock.calls.map((call) => String(call[0])).join('');
+      expect(logged).toContain('status_refresh_failed');
+      expect(logged).toContain('permission denied');
+    } finally {
+      vi.useRealTimers();
+      realpathSpy.mockRestore();
+      stderr.mockRestore();
+    }
+  });
+
+  it('caches the workspace root realpath across artifact refreshes', async () => {
+    const store = new SessionArtifactStore({
+      sessionId: 's7-realpath-cache',
+      workspaceCwd: workspace,
+    });
+    await fs.writeFile(path.join(workspace, 'one.txt'), 'one');
+    await fs.writeFile(path.join(workspace, 'two.txt'), 'two');
+    const realpathSpy = vi.spyOn(fs, 'realpath');
+
+    try {
+      await store.upsertMany([
+        { title: 'One', workspacePath: 'one.txt' },
+        { title: 'Two', workspacePath: 'two.txt' },
+      ]);
+      await store.list();
+
+      expect(
+        realpathSpy.mock.calls.filter(([target]) => target === workspace),
+      ).toHaveLength(1);
+    } finally {
+      realpathSpy.mockRestore();
+    }
+  });
+
+  it('uses cached workspace status while the refresh ttl is fresh', async () => {
+    const store = new SessionArtifactStore({
+      sessionId: 's7-status-cache',
+      workspaceCwd: workspace,
+    });
+    await fs.writeFile(path.join(workspace, 'report.txt'), 'hello');
+    await store.upsertMany([{ title: 'Report', workspacePath: 'report.txt' }], {
+      strict: true,
+    });
+
+    const realpathSpy = vi.spyOn(fs, 'realpath');
+    try {
+      await store.list();
+      expect(realpathSpy).not.toHaveBeenCalled();
+    } finally {
+      realpathSpy.mockRestore();
+    }
+  });
+
+  it('refreshes stale missing candidates before eviction', async () => {
+    const store = new SessionArtifactStore({
+      sessionId: 's8',
+      workspaceCwd: workspace,
+      maxArtifacts: 2,
+    });
+    const restored = await store.upsertMany([
+      { title: 'Restored later', workspacePath: 'restored.txt' },
+    ]);
+    const stillMissing = await store.upsertMany([
+      { title: 'Still missing', workspacePath: 'still-missing.txt' },
+    ]);
+    await fs.writeFile(path.join(workspace, 'restored.txt'), 'ok');
+    vi.useFakeTimers();
+    vi.setSystemTime(new Date(Date.now() + 6_000));
+
+    const overflow = await store.upsertMany([
+      { title: 'New link', url: 'https://example.com/new' },
+    ]);
+
+    expect(overflow.changes).toContainEqual(
+      expect.objectContaining({
+        action: 'removed',
+        artifactId: stillMissing.changes[0]?.artifactId,
+        reason: 'eviction',
+      }),
+    );
+    expect(
+      (await store.list()).artifacts.map((artifact) => artifact.id),
+    ).toContain(restored.changes[0]?.artifactId);
+  });
+
+  it('keeps fresh cached workspace status during overflow eviction', async () => {
+    const store = new SessionArtifactStore({
+      sessionId: 's8-fresh-overflow-cache',
+      workspaceCwd: workspace,
+      maxArtifacts: 2,
+    });
+    const restored = await store.upsertMany([
+      { title: 'Restored later', workspacePath: 'restored.txt' },
+    ]);
+    await store.upsertMany([
+      { title: 'Still missing', workspacePath: 'still-missing.txt' },
+    ]);
+    await fs.writeFile(path.join(workspace, 'restored.txt'), 'ok');
+
+    const overflow = await store.upsertMany([
+      { title: 'New link', url: 'https://example.com/new' },
+    ]);
+
+    expect(overflow.changes).toContainEqual(
+      expect.objectContaining({
+        action: 'removed',
+        artifactId: restored.changes[0]?.artifactId,
+        reason: 'eviction',
+      }),
+    );
+  });
+
+  it('evicts from over-reserved sources before older artifacts from other sources', async () => {
+    const store = new SessionArtifactStore({
+      sessionId: 's9',
+      workspaceCwd: workspace,
+    });
+    await store.upsertMany([
+      ...Array.from({ length: 50 }, (_, index) => ({
+        title: `Hook ${index}`,
+        source: 'hook' as const,
+        url: `https://example.com/hook/${index}`,
+      })),
+      ...Array.from({ length: 50 }, (_, index) => ({
+        title: `Client ${index}`,
+        source: 'client' as const,
+        url: `https://example.com/client/${index}`,
+      })),
+      ...Array.from({ length: 100 }, (_, index) => ({
+        title: `Tool ${index}`,
+        source: 'tool' as const,
+        url: `https://example.com/tool/${index}`,
+      })),
+    ]);
+
+    const overflow = await store.upsertMany([
+      {
+        title: 'Tool overflow',
+        source: 'tool',
+        url: 'https://example.com/tool/overflow',
+      },
+    ]);
+
+    expect(overflow.changes).toContainEqual(
+      expect.objectContaining({
+        action: 'removed',
+        artifact: expect.objectContaining({
+          source: 'tool',
+          title: 'Tool 0',
+        }),
+        reason: 'eviction',
+      }),
+    );
+    expect((await store.list()).artifacts).toHaveLength(200);
+  });
+
+  it('emits one net removed change when an updated artifact is evicted', async () => {
+    const store = new SessionArtifactStore({
+      sessionId: 's10',
+      workspaceCwd: workspace,
+      maxArtifacts: 2,
+    });
+
+    const first = await store.upsertMany([
+      { title: 'First', url: 'https://example.com/first' },
+    ]);
+    await store.upsertMany([
+      { title: 'Second', url: 'https://example.com/second' },
+    ]);
+
+    const overflow = await store.upsertMany([
+      {
+        title: 'First renamed',
+        url: 'https://example.com/first',
+        metadata: { refreshed: true },
+      },
+      { title: 'Third', url: 'https://example.com/third' },
+    ]);
+    const firstId = first.changes[0]?.artifactId;
+
+    expect(
+      overflow.changes.filter((change) => change.artifactId === firstId),
+    ).toEqual([
+      expect.objectContaining({
+        action: 'removed',
+        artifactId: firstId,
+        reason: 'eviction',
+      }),
+    ]);
+    expect(overflow.changes).toContainEqual(
+      expect.objectContaining({
+        action: 'created',
+        artifact: expect.objectContaining({ title: 'Third' }),
+      }),
+    );
+  });
+});
diff --git a/packages/acp-bridge/src/sessionArtifacts.ts b/packages/acp-bridge/src/sessionArtifacts.ts
new file mode 100644
index 0000000000..e3bc45362a
--- /dev/null
+++ b/packages/acp-bridge/src/sessionArtifacts.ts
@@ -0,0 +1,1455 @@
+/**
+ * @license
+ * Copyright 2026 Qwen Team
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { createHash } from 'node:crypto';
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+import { writeStderrLine } from './internal/stderrLine.js';
+
+export type DaemonSessionArtifactKind =
+  | 'file'
+  | 'link'
+  | 'html'
+  | 'image'
+  | 'video'
+  | 'audio'
+  | 'pdf'
+  | 'notebook'
+  | 'other';
+
+export type DaemonSessionArtifactStorage =
+  | 'workspace'
+  | 'external_url'
+  | 'managed'
+  | 'published';
+
+export type DaemonSessionArtifactSource = 'tool' | 'hook' | 'client';
+
+export type DaemonSessionArtifactStatus = 'available' | 'missing';
+
+const SOURCE_RESERVATIONS: Record<DaemonSessionArtifactSource, number> = {
+  tool: 100,
+  client: 50,
+  hook: 50,
+};
+const WORKSPACE_STATUS_REFRESH_TTL_MS = 5_000;
+const WORKSPACE_STATUS_REFRESH_BATCH_SIZE = 20;
+
+export interface ToolArtifactLike {
+  kind?: DaemonSessionArtifactKind;
+  storage?: DaemonSessionArtifactStorage;
+  title: string;
+  description?: string;
+  workspacePath?: string;
+  managedId?: string;
+  url?: string;
+  mimeType?: string;
+  sizeBytes?: number;
+  metadata?: Record<string, string | number | boolean | null>;
+}
+
+export interface SessionArtifactInput extends ToolArtifactLike {
+  source?: DaemonSessionArtifactSource;
+  toolCallId?: string;
+  toolName?: string;
+  hookEventName?: string;
+  clientId?: string;
+}
+
+export interface DaemonSessionArtifact {
+  id: string;
+  kind: DaemonSessionArtifactKind;
+  storage: DaemonSessionArtifactStorage;
+  source: DaemonSessionArtifactSource;
+  status: DaemonSessionArtifactStatus;
+  title: string;
+  description?: string;
+  workspacePath?: string;
+  managedId?: string;
+  url?: string;
+  mimeType?: string;
+  sizeBytes?: number;
+  metadata?: Record<string, string | number | boolean | null>;
+  clientRetained: boolean;
+  createdAt: string;
+  updatedAt: string;
+  toolCallId?: string;
+  toolName?: string;
+  hookEventName?: string;
+  clientId?: string;
+}
+
+export type SessionArtifactRemovalReason = 'eviction' | 'explicit';
+
+export interface SessionArtifactChange {
+  action: 'created' | 'updated' | 'removed';
+  artifactId: string;
+  artifact?: DaemonSessionArtifact;
+  reason?: SessionArtifactRemovalReason;
+}
+
+export interface SessionArtifactsEnvelope {
+  v: 1;
+  sessionId: string;
+  artifacts: DaemonSessionArtifact[];
+  generatedAt: string;
+  limits: {
+    maxArtifacts: number;
+  };
+}
+
+export interface SessionArtifactMutationResult {
+  v: 1;
+  sessionId: string;
+  changes: SessionArtifactChange[];
+}
+
+export class SessionArtifactValidationError extends Error {
+  readonly code = 'VALIDATION_FAILED';
+
+  constructor(
+    message: string,
+    readonly field?: string,
+  ) {
+    super(message);
+    this.name = 'SessionArtifactValidationError';
+  }
+}
+
+interface SessionArtifactStoreOptions {
+  sessionId: string;
+  workspaceCwd: string;
+  maxArtifacts?: number;
+}
+
+interface NormalizedArtifact extends DaemonSessionArtifact {
+  identityKey: string;
+  receivedSeq: number;
+  retentionSource: DaemonSessionArtifactSource;
+  trustedPublisher: boolean;
+  lastStatAt?: number;
+}
+
+interface StoredArtifact extends NormalizedArtifact {
+  insertSeq: number;
+}
+
+export class SessionArtifactStore {
+  private readonly sessionId: string;
+  private readonly workspaceCwd: string;
+  private readonly maxArtifacts: number;
+  private readonly artifacts = new Map<string, StoredArtifact>();
+  private receivedSeq = 0;
+  private insertSeq = 0;
+  private realWorkspaceCwdPromise?: Promise<string>;
+  private operationQueue: Promise<void> = Promise.resolve();
+
+  constructor(options: SessionArtifactStoreOptions) {
+    this.sessionId = options.sessionId;
+    this.workspaceCwd = options.workspaceCwd;
+    this.maxArtifacts = options.maxArtifacts ?? 200;
+  }
+
+  inputBatchLimit(): number {
+    return this.maxArtifacts * 2;
+  }
+
+  async list(): Promise<SessionArtifactsEnvelope> {
+    return this.enqueue(async () => {
+      await this.refreshWorkspaceStatuses();
+      return {
+        v: 1,
+        sessionId: this.sessionId,
+        artifacts: Array.from(this.artifacts.values())
+          .sort((a, b) => a.insertSeq - b.insertSeq)
+          .map(toPublicArtifact),
+        generatedAt: new Date().toISOString(),
+        limits: { maxArtifacts: this.maxArtifacts },
+      };
+    });
+  }
+
+  async upsertMany(
+    inputs: SessionArtifactInput[],
+    options: { strict?: boolean; trustedPublisher?: boolean } = {},
+  ): Promise<SessionArtifactMutationResult> {
+    return this.enqueue(async () => {
+      const normalizedResults: NormalizedArtifact[] = [];
+      for (const input of inputs) {
+        try {
+          normalizedResults.push(
+            await this.normalizeInput(
+              input,
+              ++this.receivedSeq,
+              options.trustedPublisher === true,
+            ),
+          );
+        } catch (error) {
+          if (options.strict) {
+            throw error;
+          }
+          const message =
+            error instanceof Error ? error.message : String(error);
+          writeStderrLine(
+            `[artifacts] session=${this.sessionId} action=dropped reason=${JSON.stringify(
+              message,
+            )}`,
+          );
+        }
+      }
+      const changes: SessionArtifactChange[] = [];
+      for (const artifact of coalesceByIdentity(normalizedResults)) {
+        const existing =
+          this.artifacts.get(artifact.id) ??
+          this.findPublishedUpgradeTarget(artifact) ??
+          this.findPublishedWorkspaceTarget(artifact);
+        if (!existing) {
+          const stored: StoredArtifact = {
+            ...artifact,
+            insertSeq: ++this.insertSeq,
+          };
+          this.artifacts.set(stored.id, stored);
+          changes.push({
+            action: 'created',
+            artifactId: stored.id,
+            artifact: toPublicArtifact(stored),
+          });
+          continue;
+        }
+
+        const updated = mergeArtifact(existing, artifact);
+        if (updated.changed) {
+          if (updated.artifact.id !== existing.id) {
+            this.artifacts.delete(existing.id);
+          }
+          this.artifacts.set(updated.artifact.id, updated.artifact);
+          changes.push({
+            action: 'updated',
+            artifactId: updated.artifact.id,
+            artifact: toPublicArtifact(updated.artifact),
+          });
+        }
+      }
+
+      const createdIds = new Set(
+        changes
+          .filter((change) => change.action === 'created')
+          .map((change) => change.artifactId),
+      );
+      changes.push(...(await this.evictOverflow(createdIds, changes)));
+
+      return { v: 1, sessionId: this.sessionId, changes };
+    });
+  }
+
+  private findPublishedUpgradeTarget(
+    artifact: NormalizedArtifact,
+  ): StoredArtifact | undefined {
+    if (
+      artifact.storage !== 'published' ||
+      !artifact.trustedPublisher ||
+      !artifact.managedId ||
+      !artifact.url
+    ) {
+      return undefined;
+    }
+    const byUrl = this.artifacts.get(
+      stableArtifactId(this.sessionId, `url:${artifact.url}`),
+    );
+    if (
+      byUrl &&
+      (byUrl.storage !== 'published' || byUrl.managedId === artifact.managedId)
+    ) {
+      return byUrl;
+    }
+
+    for (const existing of this.artifacts.values()) {
+      if (
+        (existing.storage === 'workspace' &&
+          existing.workspacePath &&
+          artifact.managedId ===
+            managedIdForWorkspacePath(
+              this.workspaceCwd,
+              existing.workspacePath,
+            )) ||
+        (existing.storage === 'published' &&
+          existing.managedId === artifact.managedId)
+      ) {
+        return existing;
+      }
+    }
+
+    return undefined;
+  }
+
+  private findPublishedWorkspaceTarget(
+    artifact: NormalizedArtifact,
+  ): StoredArtifact | undefined {
+    if (artifact.storage !== 'workspace' || !artifact.workspacePath) {
+      return undefined;
+    }
+    const managedId = managedIdForWorkspacePath(
+      this.workspaceCwd,
+      artifact.workspacePath,
+    );
+    for (const existing of this.artifacts.values()) {
+      if (
+        existing.storage === 'published' &&
+        existing.managedId === managedId
+      ) {
+        return existing;
+      }
+    }
+    return undefined;
+  }
+
+  async remove(
+    artifactId: string,
+    options?: { clientId?: string },
+  ): Promise<SessionArtifactMutationResult> {
+    return this.enqueue(async () => {
+      const existing = this.artifacts.get(artifactId);
+      if (!existing) {
+        return { v: 1, sessionId: this.sessionId, changes: [] };
+      }
+      // Client-created artifacts with an owner require the same client id.
+      // Tool/hook artifacts are session-scoped outputs and may be removed by
+      // any caller that already passed session mutation auth.
+      if (
+        existing.source === 'client' &&
+        existing.clientId !== undefined &&
+        existing.clientId !== options?.clientId
+      ) {
+        writeStderrLine(
+          `[artifacts] session=${this.sessionId} action=remove_denied artifactId=${artifactId} owner=${existing.clientId} requester=${options?.clientId ?? '<anonymous>'}`,
+        );
+        return { v: 1, sessionId: this.sessionId, changes: [] };
+      }
+      this.artifacts.delete(artifactId);
+      return {
+        v: 1,
+        sessionId: this.sessionId,
+        changes: [
+          {
+            action: 'removed',
+            artifactId,
+            artifact: toPublicArtifact(existing),
+            reason: 'explicit',
+          },
+        ],
+      };
+    });
+  }
+
+  private enqueue<T>(operation: () => Promise<T>): Promise<T> {
+    const result = this.operationQueue.then(operation, operation);
+    this.operationQueue = result.then(
+      () => undefined,
+      () => undefined,
+    );
+    return result;
+  }
+
+  private async normalizeInput(
+    input: SessionArtifactInput,
+    receivedSeq: number,
+    trustedPublisherFromCaller: boolean,
+  ): Promise<NormalizedArtifact> {
+    if (!input || typeof input !== 'object') {
+      throw new SessionArtifactValidationError('Artifact must be an object');
+    }
+    const title = normalizeString(input.title, 'title', 200, true);
+    const description = normalizeString(
+      input.description,
+      'description',
+      1000,
+      false,
+    );
+    const source = input.source ?? 'tool';
+    if (source !== 'tool' && source !== 'hook' && source !== 'client') {
+      throw new SessionArtifactValidationError(
+        'source must be tool, hook, or client',
+        'source',
+      );
+    }
+
+    const trustedPublisher = trustedPublisherFromCaller;
+    const workspacePath = input.workspacePath
+      ? normalizeWorkspacePath(input.workspacePath, this.workspaceCwd)
+      : undefined;
+    const managedId = normalizeManagedId(input.managedId);
+    const rawStorage = input.storage;
+    const storage = inferStorage(rawStorage, {
+      workspacePath,
+      managedId,
+      url: input.url,
+      trustedPublisher,
+    });
+    const url = input.url
+      ? normalizeArtifactUrl(input.url, trustedPublisher)
+      : undefined;
+
+    validateLocator(storage, {
+      workspacePath,
+      managedId,
+      url,
+      trustedPublisher,
+    });
+
+    const metadata = normalizeMetadata(input.metadata);
+    const workspaceStatus = workspacePath
+      ? await this.getInitialWorkspaceStatus(workspacePath)
+      : undefined;
+    if (workspaceStatus?.escaped) {
+      throw new SessionArtifactValidationError(
+        'workspacePath must stay inside the workspace',
+        'workspacePath',
+      );
+    }
+    const kind = normalizeKind(
+      input.kind ?? inferKind({ storage, workspacePath, url }),
+    );
+    const now = new Date().toISOString();
+    const identityKey = buildIdentityKey({
+      storage,
+      workspacePath,
+      managedId,
+      url,
+    });
+    const id = stableArtifactId(this.sessionId, identityKey);
+
+    return {
+      id,
+      identityKey,
+      receivedSeq,
+      retentionSource: source,
+      trustedPublisher,
+      kind,
+      storage,
+      source,
+      status: workspaceStatus?.status ?? 'available',
+      ...(workspacePath ? { lastStatAt: Date.now() } : {}),
+      title,
+      description,
+      workspacePath,
+      managedId,
+      url,
+      mimeType: normalizeString(input.mimeType, 'mimeType', 120, false),
+      sizeBytes:
+        input.sizeBytes !== undefined
+          ? normalizeSizeBytes(input.sizeBytes)
+          : workspaceStatus?.sizeBytes,
+      metadata,
+      clientRetained: source === 'client',
+      createdAt: now,
+      updatedAt: now,
+      toolCallId: normalizeString(input.toolCallId, 'toolCallId', 200, false),
+      toolName: normalizeString(input.toolName, 'toolName', 200, false),
+      hookEventName: normalizeString(
+        input.hookEventName,
+        'hookEventName',
+        200,
+        false,
+      ),
+      clientId: normalizeString(input.clientId, 'clientId', 200, false),
+    };
+  }
+
+  private async refreshWorkspaceStatuses(): Promise<void> {
+    const now = Date.now();
+    const staleWorkspaceArtifacts = Array.from(this.artifacts.values())
+      .filter((artifact) => artifact.workspacePath)
+      .filter((artifact) => shouldRefreshWorkspaceStatus(artifact, now));
+
+    await runInBatches(
+      staleWorkspaceArtifacts,
+      WORKSPACE_STATUS_REFRESH_BATCH_SIZE,
+      (artifact) =>
+        this.refreshWorkspaceStatus(artifact, {
+          onError: 'missing',
+          now,
+        }),
+    );
+  }
+
+  private async getInitialWorkspaceStatus(workspacePath: string): Promise<{
+    status: DaemonSessionArtifactStatus;
+    sizeBytes?: number;
+    escaped?: boolean;
+  }> {
+    try {
+      return await getWorkspaceStatus(
+        this.workspaceCwd,
+        workspacePath,
+        this.getRealWorkspaceCwd(),
+      );
+    } catch (error) {
+      const reason = error instanceof Error ? error.message : String(error);
+      throw new SessionArtifactValidationError(
+        `workspacePath could not be inspected: ${reason}`,
+        'workspacePath',
+      );
+    }
+  }
+
+  private async refreshWorkspaceStatus(
+    artifact: StoredArtifact,
+    options: { onError: 'missing' | 'preserve'; now?: number },
+  ): Promise<void> {
+    if (!artifact.workspacePath) {
+      return;
+    }
+    try {
+      const status = await getWorkspaceStatus(
+        this.workspaceCwd,
+        artifact.workspacePath,
+        this.getRealWorkspaceCwd(),
+      );
+      artifact.status = status.status;
+      artifact.sizeBytes = status.sizeBytes;
+      if (status.escaped) {
+        artifact.status = 'missing';
+        artifact.sizeBytes = undefined;
+        delete artifact.workspacePath;
+      }
+      artifact.lastStatAt = options.now ?? Date.now();
+    } catch (error) {
+      writeStderrLine(
+        `[artifacts] session=${this.sessionId} action=status_refresh_failed artifactId=${artifact.id} reason=${JSON.stringify(
+          error instanceof Error ? error.message : String(error),
+        )}`,
+      );
+      if (options.onError === 'missing') {
+        artifact.status = 'missing';
+        artifact.sizeBytes = undefined;
+        artifact.lastStatAt = options.now ?? Date.now();
+      }
+      return;
+    }
+  }
+
+  private getRealWorkspaceCwd(): Promise<string> {
+    if (!this.realWorkspaceCwdPromise) {
+      const promise = fs.realpath(this.workspaceCwd).catch((error: unknown) => {
+        if (this.realWorkspaceCwdPromise === promise) {
+          this.realWorkspaceCwdPromise = undefined;
+        }
+        throw error;
+      });
+      this.realWorkspaceCwdPromise = promise;
+    }
+    return this.realWorkspaceCwdPromise;
+  }
+
+  private async evictOverflow(
+    createdIds: Set<string>,
+    changes: SessionArtifactChange[],
+  ): Promise<SessionArtifactChange[]> {
+    const removed: SessionArtifactChange[] = [];
+    if (this.artifacts.size <= this.maxArtifacts) {
+      return removed;
+    }
+
+    const createdInThisBatch = new Set(createdIds);
+    const candidates = Array.from(this.artifacts.values()).filter(
+      (artifact) => !createdInThisBatch.has(artifact.id),
+    );
+    const now = Date.now();
+    const staleWorkspaceCandidates = candidates
+      .filter((artifact) => artifact.workspacePath)
+      .filter((artifact) => shouldRefreshWorkspaceStatus(artifact, now));
+    await runInBatches(
+      staleWorkspaceCandidates,
+      WORKSPACE_STATUS_REFRESH_BATCH_SIZE,
+      (artifact) =>
+        this.refreshWorkspaceStatus(artifact, { onError: 'preserve', now }),
+    );
+    const sourceCounts = countByRetentionSource(this.artifacts.values());
+
+    while (this.artifacts.size > this.maxArtifacts) {
+      const artifact = selectEvictionCandidate(candidates, sourceCounts);
+      if (!artifact) break;
+      this.artifacts.delete(artifact.id);
+      candidates.splice(candidates.indexOf(artifact), 1);
+      sourceCounts[artifact.retentionSource]--;
+      removePriorChange(changes, artifact.id);
+      removed.push({
+        action: 'removed',
+        artifactId: artifact.id,
+        artifact: toPublicArtifact(artifact),
+        reason: 'eviction',
+      });
+    }
+
+    const overflowCreated = Array.from(this.artifacts.values())
+      .filter((artifact) => createdInThisBatch.has(artifact.id))
+      .sort((a, b) => b.receivedSeq - a.receivedSeq);
+    for (const artifact of overflowCreated) {
+      if (this.artifacts.size <= this.maxArtifacts) {
+        break;
+      }
+      this.artifacts.delete(artifact.id);
+      writeStderrLine(
+        `[artifacts] session=${this.sessionId} action=dropped reason="max artifacts exceeded" artifactId=${artifact.id}`,
+      );
+      removePriorChange(changes, artifact.id);
+    }
+
+    return removed;
+  }
+}
+
+function coalesceByIdentity(
+  artifacts: NormalizedArtifact[],
+): NormalizedArtifact[] {
+  const byId = new Map<string, NormalizedArtifact>();
+  for (const artifact of artifacts) {
+    const existing = byId.get(artifact.id);
+    if (!existing) {
+      byId.set(artifact.id, artifact);
+      continue;
+    }
+    byId.set(artifact.id, mergeBatchArtifact(existing, artifact));
+  }
+  return Array.from(byId.values()).sort(
+    (a, b) => a.receivedSeq - b.receivedSeq,
+  );
+}
+
+function mergeBatchArtifact(
+  existing: NormalizedArtifact,
+  next: NormalizedArtifact,
+): NormalizedArtifact {
+  const publishedUpgrade =
+    existing.storage !== 'published' &&
+    next.storage === 'published' &&
+    next.trustedPublisher;
+  if (publishedUpgrade) {
+    const merged: NormalizedArtifact = {
+      ...existing,
+      id: next.id,
+      identityKey: next.identityKey,
+      kind: next.kind,
+      storage: 'published',
+      status: next.status,
+      title: next.title,
+      description: next.description,
+      managedId: next.managedId ?? existing.managedId,
+      url: next.url ?? existing.url,
+      mimeType: next.mimeType ?? existing.mimeType,
+      sizeBytes: next.sizeBytes ?? existing.sizeBytes,
+      metadata: mergeMetadata(existing, next),
+      trustedPublisher: true,
+      createdAt: existing.createdAt,
+      receivedSeq: existing.receivedSeq,
+      retentionSource: existing.retentionSource,
+      clientRetained: existing.clientRetained || next.clientRetained,
+      lastStatAt: undefined,
+    };
+    delete merged.workspacePath;
+    return merged;
+  }
+  return {
+    ...existing,
+    status: next.status,
+    sizeBytes: mergeSizeBytes(existing, next),
+    metadata: mergeMetadata(existing, next),
+    clientRetained: existing.clientRetained || next.clientRetained,
+    trustedPublisher: existing.trustedPublisher || next.trustedPublisher,
+    lastStatAt: next.lastStatAt ?? existing.lastStatAt,
+  };
+}
+
+function mergeArtifact(
+  existing: StoredArtifact,
+  incoming: NormalizedArtifact,
+): { artifact: StoredArtifact; changed: boolean } {
+  const now = new Date().toISOString();
+  const publishedUpgrade =
+    existing.storage !== 'published' &&
+    incoming.storage === 'published' &&
+    incoming.trustedPublisher;
+  const publishedRefresh =
+    existing.storage === 'published' &&
+    incoming.storage === 'published' &&
+    incoming.trustedPublisher &&
+    incoming.managedId !== undefined &&
+    incoming.managedId === existing.managedId;
+  const publishedUpdate = publishedUpgrade || publishedRefresh;
+  const next: StoredArtifact = {
+    ...existing,
+    id: publishedUpdate ? incoming.id : existing.id,
+    identityKey: publishedUpdate ? incoming.identityKey : existing.identityKey,
+    kind: publishedUpdate ? incoming.kind : existing.kind,
+    storage: publishedUpgrade ? 'published' : existing.storage,
+    status:
+      existing.storage === 'published' && !publishedUpdate
+        ? existing.status
+        : incoming.status,
+    managedId: publishedUpdate
+      ? (incoming.managedId ?? existing.managedId)
+      : existing.managedId,
+    url: publishedUpdate ? (incoming.url ?? existing.url) : existing.url,
+    workspacePath:
+      publishedUpdate || existing.storage === 'published'
+        ? undefined
+        : (existing.workspacePath ?? incoming.workspacePath),
+    mimeType: publishedUpdate
+      ? (incoming.mimeType ?? existing.mimeType)
+      : existing.mimeType,
+    sizeBytes:
+      existing.storage === 'published' && !publishedUpdate
+        ? existing.sizeBytes
+        : mergeSizeBytes(existing, incoming),
+    metadata:
+      existing.storage === 'published' && !publishedUpdate
+        ? existing.metadata
+        : mergeMetadata(existing, incoming),
+    source: existing.source,
+    retentionSource: existing.retentionSource,
+    trustedPublisher: existing.trustedPublisher || incoming.trustedPublisher,
+    clientRetained: existing.clientRetained || incoming.clientRetained,
+    lastStatAt:
+      publishedUpdate || existing.storage === 'published'
+        ? undefined
+        : (incoming.lastStatAt ?? existing.lastStatAt),
+    updatedAt: existing.updatedAt,
+  };
+
+  if (publishedUpdate) {
+    next.title = incoming.title;
+    next.description = incoming.description;
+    delete next.workspacePath;
+  }
+
+  const changed = !publicArtifactsEqual(
+    toPublicArtifact(existing),
+    toPublicArtifact(next),
+  );
+  if (changed) {
+    next.updatedAt = now;
+  }
+  return { artifact: changed ? next : existing, changed };
+}
+
+function publicArtifactsEqual(
+  a: DaemonSessionArtifact,
+  b: DaemonSessionArtifact,
+): boolean {
+  return (
+    a.id === b.id &&
+    a.kind === b.kind &&
+    a.storage === b.storage &&
+    a.source === b.source &&
+    a.status === b.status &&
+    a.title === b.title &&
+    a.description === b.description &&
+    a.workspacePath === b.workspacePath &&
+    a.managedId === b.managedId &&
+    a.url === b.url &&
+    a.mimeType === b.mimeType &&
+    a.sizeBytes === b.sizeBytes &&
+    metadataEqual(a.metadata, b.metadata) &&
+    a.clientRetained === b.clientRetained &&
+    a.createdAt === b.createdAt &&
+    a.toolCallId === b.toolCallId &&
+    a.toolName === b.toolName &&
+    a.hookEventName === b.hookEventName &&
+    a.clientId === b.clientId
+  );
+}
+
+function metadataEqual(
+  a: Record<string, string | number | boolean | null> | undefined,
+  b: Record<string, string | number | boolean | null> | undefined,
+): boolean {
+  if (a === b) return true;
+  if (!a || !b) return false;
+  const aKeys = Object.keys(a);
+  const bKeys = Object.keys(b);
+  if (aKeys.length !== bKeys.length) return false;
+  return aKeys.every((key) => Object.hasOwn(b, key) && a[key] === b[key]);
+}
+
+function mergeSizeBytes(
+  existing: DaemonSessionArtifact,
+  incoming: DaemonSessionArtifact,
+): number | undefined {
+  if (incoming.sizeBytes !== undefined) {
+    return incoming.sizeBytes;
+  }
+  if (incoming.workspacePath && incoming.status === 'missing') {
+    return undefined;
+  }
+  return existing.sizeBytes;
+}
+
+function mergeMetadata(
+  existing: DaemonSessionArtifact,
+  incoming: NormalizedArtifact,
+): Record<string, string | number | boolean | null> | undefined {
+  if (
+    !incoming.metadata ||
+    incoming.source === 'hook' ||
+    incoming.source !== existing.source
+  ) {
+    return existing.metadata;
+  }
+  const merged = { ...(existing.metadata ?? {}) };
+  let changed = false;
+  for (const [key, value] of Object.entries(incoming.metadata)) {
+    if (!Object.hasOwn(merged, key)) {
+      merged[key] = value;
+      changed = true;
+    }
+  }
+  if (!changed) {
+    return existing.metadata;
+  }
+  if (!isMetadataWithinLimit(merged)) {
+    writeStderrLine(
+      `[artifacts] action=metadata_merge_dropped artifactId=${incoming.id} reason="metadata limit exceeded"`,
+    );
+    return existing.metadata;
+  }
+  return merged;
+}
+
+function isMetadataWithinLimit(
+  metadata: Record<string, string | number | boolean | null>,
+): boolean {
+  return Buffer.byteLength(JSON.stringify(metadata), 'utf8') <= 4096;
+}
+
+function countByRetentionSource(
+  artifacts: Iterable<StoredArtifact>,
+): Record<DaemonSessionArtifactSource, number> {
+  const counts: Record<DaemonSessionArtifactSource, number> = {
+    tool: 0,
+    client: 0,
+    hook: 0,
+  };
+  for (const artifact of artifacts) {
+    counts[artifact.retentionSource]++;
+  }
+  return counts;
+}
+
+function shouldRefreshWorkspaceStatus(
+  artifact: StoredArtifact,
+  now: number,
+): boolean {
+  return (
+    artifact.lastStatAt === undefined ||
+    now - artifact.lastStatAt >= WORKSPACE_STATUS_REFRESH_TTL_MS
+  );
+}
+
+function selectEvictionCandidate(
+  candidates: StoredArtifact[],
+  sourceCounts: Record<DaemonSessionArtifactSource, number>,
+): StoredArtifact | undefined {
+  return (
+    oldest(
+      candidates,
+      (artifact) => artifact.status === 'missing' && !artifact.clientRetained,
+    ) ??
+    oldest(
+      candidates,
+      (artifact) =>
+        !artifact.clientRetained &&
+        sourceCounts[artifact.retentionSource] >
+          SOURCE_RESERVATIONS[artifact.retentionSource],
+    ) ??
+    oldest(candidates, (artifact) => !artifact.clientRetained) ??
+    oldest(candidates)
+  );
+}
+
+function oldest(
+  artifacts: StoredArtifact[],
+  predicate: (artifact: StoredArtifact) => boolean = () => true,
+): StoredArtifact | undefined {
+  let selected: StoredArtifact | undefined;
+  for (const artifact of artifacts) {
+    if (!predicate(artifact)) {
+      continue;
+    }
+    if (!selected || compareOldest(artifact, selected) < 0) {
+      selected = artifact;
+    }
+  }
+  return selected;
+}
+
+function compareOldest(a: StoredArtifact, b: StoredArtifact): number {
+  const created = a.createdAt.localeCompare(b.createdAt);
+  if (created !== 0) return created;
+  return a.insertSeq - b.insertSeq;
+}
+
+function removePriorChange(
+  changes: SessionArtifactChange[],
+  artifactId: string,
+): void {
+  const index = changes.findIndex((change) => change.artifactId === artifactId);
+  if (index >= 0) {
+    changes.splice(index, 1);
+  }
+}
+
+function toPublicArtifact(
+  artifact: StoredArtifact | DaemonSessionArtifact,
+): DaemonSessionArtifact {
+  const {
+    id,
+    kind,
+    storage,
+    source,
+    status,
+    title,
+    description,
+    workspacePath,
+    managedId,
+    url,
+    mimeType,
+    sizeBytes,
+    metadata,
+    clientRetained,
+    createdAt,
+    updatedAt,
+    toolCallId,
+    toolName,
+    hookEventName,
+    clientId,
+  } = artifact;
+  return {
+    id,
+    kind,
+    storage,
+    source,
+    status,
+    title,
+    ...(description ? { description } : {}),
+    ...(workspacePath ? { workspacePath } : {}),
+    ...(managedId ? { managedId } : {}),
+    ...(url ? { url } : {}),
+    ...(mimeType ? { mimeType } : {}),
+    ...(sizeBytes !== undefined ? { sizeBytes } : {}),
+    ...(metadata ? { metadata } : {}),
+    clientRetained,
+    createdAt,
+    updatedAt,
+    ...(toolCallId ? { toolCallId } : {}),
+    ...(toolName ? { toolName } : {}),
+    ...(hookEventName ? { hookEventName } : {}),
+    ...(clientId ? { clientId } : {}),
+  };
+}
+
+function inferStorage(
+  requested: unknown,
+  locators: {
+    workspacePath?: string;
+    managedId?: string;
+    url?: string;
+    trustedPublisher: boolean;
+  },
+): DaemonSessionArtifactStorage {
+  if (requested !== undefined && typeof requested !== 'string') {
+    throw new SessionArtifactValidationError(
+      'storage must be a string',
+      'storage',
+    );
+  }
+  if (requested) {
+    if (
+      requested !== 'workspace' &&
+      requested !== 'external_url' &&
+      requested !== 'managed' &&
+      requested !== 'published'
+    ) {
+      throw new SessionArtifactValidationError(
+        'storage must be workspace, external_url, managed, or published',
+        'storage',
+      );
+    }
+    return requested as DaemonSessionArtifactStorage;
+  }
+  if (locators.workspacePath) return 'workspace';
+  if (locators.managedId) return 'managed';
+  if (locators.url && locators.trustedPublisher) return 'published';
+  return 'external_url';
+}
+
+function normalizeKind(kind: unknown): DaemonSessionArtifactKind {
+  if (
+    kind === 'file' ||
+    kind === 'link' ||
+    kind === 'html' ||
+    kind === 'image' ||
+    kind === 'video' ||
+    kind === 'audio' ||
+    kind === 'pdf' ||
+    kind === 'notebook' ||
+    kind === 'other'
+  ) {
+    return kind;
+  }
+  throw new SessionArtifactValidationError(
+    'kind must be a supported artifact kind',
+    'kind',
+  );
+}
+
+function validateLocator(
+  storage: DaemonSessionArtifactStorage,
+  locators: {
+    workspacePath?: string;
+    managedId?: string;
+    url?: string;
+    trustedPublisher: boolean;
+  },
+): void {
+  if (storage === 'published') {
+    if (!locators.trustedPublisher) {
+      throw new SessionArtifactValidationError(
+        'published artifacts are reserved for trusted publishers',
+        'storage',
+      );
+    }
+    if (!locators.url) {
+      throw new SessionArtifactValidationError(
+        'published artifacts require url',
+        'url',
+      );
+    }
+    if (locators.workspacePath) {
+      throw new SessionArtifactValidationError(
+        'published artifacts cannot include workspacePath',
+        'workspacePath',
+      );
+    }
+    return;
+  }
+
+  const locatorCount = [
+    locators.workspacePath,
+    locators.managedId,
+    locators.url,
+  ].filter(Boolean).length;
+  if (locatorCount !== 1) {
+    throw new SessionArtifactValidationError(
+      'provide exactly one of workspacePath, managedId, or url',
+    );
+  }
+  if (storage === 'workspace' && !locators.workspacePath) {
+    throw new SessionArtifactValidationError(
+      'workspace storage requires workspacePath',
+      'workspacePath',
+    );
+  }
+  if (storage === 'managed' && !locators.managedId) {
+    throw new SessionArtifactValidationError(
+      'managed storage requires managedId',
+      'managedId',
+    );
+  }
+  if (storage === 'external_url' && !locators.url) {
+    throw new SessionArtifactValidationError(
+      'external_url storage requires url',
+      'url',
+    );
+  }
+}
+
+function buildIdentityKey(input: {
+  storage: DaemonSessionArtifactStorage;
+  workspacePath?: string;
+  managedId?: string;
+  url?: string;
+}): string {
+  if (input.workspacePath) return `workspace:${input.workspacePath}`;
+  if (input.managedId) return `managed:${input.managedId}`;
+  if (input.url) return `url:${input.url}`;
+  throw new SessionArtifactValidationError(
+    'artifact identity requires workspacePath, managedId, or url',
+  );
+}
+
+function stableArtifactId(sessionId: string, identityKey: string): string {
+  return createHash('sha256')
+    .update(`${sessionId}:${identityKey}`)
+    .digest('hex')
+    .slice(0, 16);
+}
+
+function managedIdForWorkspacePath(
+  workspaceCwd: string,
+  workspacePath: string,
+): string {
+  return createHash('sha1')
+    .update(path.resolve(workspaceCwd, workspacePath))
+    .digest('hex')
+    .slice(0, 16);
+}
+
+function normalizeString(
+  value: unknown,
+  field: string,
+  maxLength: number,
+  required: true,
+): string;
+function normalizeString(
+  value: unknown,
+  field: string,
+  maxLength: number,
+  required: false,
+): string | undefined;
+function normalizeString(
+  value: unknown,
+  field: string,
+  maxLength: number,
+  required: boolean,
+): string | undefined {
+  if (value === undefined || value === null) {
+    if (required) {
+      throw new SessionArtifactValidationError(`${field} is required`, field);
+    }
+    return undefined;
+  }
+  if (typeof value !== 'string') {
+    throw new SessionArtifactValidationError(
+      `${field} must be a string`,
+      field,
+    );
+  }
+  const trimmed = value.trim();
+  if (!trimmed) {
+    if (required) {
+      throw new SessionArtifactValidationError(`${field} is required`, field);
+    }
+    return undefined;
+  }
+  if (trimmed.length > maxLength) {
+    throw new SessionArtifactValidationError(
+      `${field} exceeds ${maxLength} characters`,
+      field,
+    );
+  }
+  if (hasControlCharacter(trimmed, field === 'description')) {
+    throw new SessionArtifactValidationError(
+      `${field} contains control characters`,
+      field,
+    );
+  }
+  if (isDisplayField(field) && hasUnsafeDisplayPayload(trimmed)) {
+    throw new SessionArtifactValidationError(
+      `${field} contains unsafe markup`,
+      field,
+    );
+  }
+  return trimmed;
+}
+
+function normalizeManagedId(value: unknown): string | undefined {
+  const managedId = normalizeString(value, 'managedId', 200, false);
+  if (!managedId) return undefined;
+  if (
+    managedId.includes('/') ||
+    managedId.includes('\\') ||
+    managedId.includes('..') ||
+    path.isAbsolute(managedId) ||
+    path.win32.isAbsolute(managedId)
+  ) {
+    throw new SessionArtifactValidationError(
+      'managedId must be an opaque managed resource id',
+      'managedId',
+    );
+  }
+  return managedId;
+}
+
+function isDisplayField(field: string): boolean {
+  return (
+    field === 'title' ||
+    field === 'description' ||
+    field === 'mimeType' ||
+    field === 'workspacePath' ||
+    field === 'managedId'
+  );
+}
+
+function hasControlCharacter(
+  value: string,
+  allowLineWhitespace = false,
+): boolean {
+  for (let i = 0; i < value.length; i++) {
+    const code = value.charCodeAt(i);
+    if (
+      allowLineWhitespace &&
+      (code === 0x09 || code === 0x0a || code === 0x0d)
+    ) {
+      continue;
+    }
+    if (
+      code <= 0x1f ||
+      code === 0x7f ||
+      (code >= 0x200b && code <= 0x200f) ||
+      code === 0x2028 ||
+      code === 0x2029 ||
+      (code >= 0x202a && code <= 0x202e) ||
+      (code >= 0x2066 && code <= 0x2069) ||
+      code === 0xfeff
+    ) {
+      return true;
+    }
+  }
+  return false;
+}
+
+function hasUnsafeDisplayPayload(value: string): boolean {
+  return (
+    /<\s*\/?[a-z!]|&(?:#[0-9]+|#x[0-9a-f]+|[a-z][a-z0-9]+);|javascript\s*:|data\s*:\s*(?:text\/(?:html|javascript)|application\/javascript|image\/svg\+xml)/i.test(
+      value,
+    ) || /(?:^|[\s"'`<])on[a-z][a-z0-9-]*\s*=/i.test(value)
+  );
+}
+
+function normalizeWorkspacePath(raw: unknown, workspaceCwd: string): string {
+  const trimmed = normalizeString(raw, 'workspacePath', 500, true);
+  if (path.isAbsolute(trimmed)) {
+    throw new SessionArtifactValidationError(
+      'workspacePath must be relative to the workspace',
+      'workspacePath',
+    );
+  }
+  const absolute = path.resolve(workspaceCwd, trimmed);
+  const relative = path.relative(workspaceCwd, absolute);
+  if (!relative || isOutsidePath(relative)) {
+    throw new SessionArtifactValidationError(
+      'workspacePath must stay inside the workspace',
+      'workspacePath',
+    );
+  }
+  return relative.split(path.sep).join('/');
+}
+
+function normalizeArtifactUrl(raw: unknown, allowFile: boolean): string {
+  const trimmed = normalizeString(raw, 'url', 2048, true);
+  let parsed: URL;
+  try {
+    parsed = new URL(trimmed);
+  } catch {
+    throw new SessionArtifactValidationError('url must be valid', 'url');
+  }
+  if (parsed.username || parsed.password) {
+    throw new SessionArtifactValidationError(
+      'url must not include credentials',
+      'url',
+    );
+  }
+  if (
+    parsed.protocol !== 'http:' &&
+    parsed.protocol !== 'https:' &&
+    !(allowFile && parsed.protocol === 'file:')
+  ) {
+    throw new SessionArtifactValidationError(
+      allowFile
+        ? 'url must use http, https, or file'
+        : 'url must use http or https',
+      'url',
+    );
+  }
+  return parsed.href;
+}
+
+function normalizeMetadata(
+  metadata: unknown,
+): Record<string, string | number | boolean | null> | undefined {
+  if (metadata === undefined) {
+    return undefined;
+  }
+  if (
+    typeof metadata !== 'object' ||
+    metadata === null ||
+    Array.isArray(metadata)
+  ) {
+    throw new SessionArtifactValidationError(
+      'metadata must be an object',
+      'metadata',
+    );
+  }
+  const normalized: Record<string, string | number | boolean | null> = {};
+  for (const [key, value] of Object.entries(metadata)) {
+    if (!key) {
+      throw new SessionArtifactValidationError(
+        'metadata keys must not be empty',
+        'metadata',
+      );
+    }
+    if (key.length > 120) {
+      throw new SessionArtifactValidationError(
+        'metadata keys must be 120 characters or fewer',
+        'metadata',
+      );
+    }
+    if (hasControlCharacter(key) || hasUnsafeDisplayPayload(key)) {
+      throw new SessionArtifactValidationError(
+        'metadata keys contain unsafe content',
+        'metadata',
+      );
+    }
+    if (
+      value !== null &&
+      typeof value !== 'string' &&
+      typeof value !== 'number' &&
+      typeof value !== 'boolean'
+    ) {
+      throw new SessionArtifactValidationError(
+        'metadata values must be primitive',
+        'metadata',
+      );
+    }
+    if (typeof value === 'number' && !Number.isFinite(value)) {
+      throw new SessionArtifactValidationError(
+        'metadata numbers must be finite',
+        'metadata',
+      );
+    }
+    if (
+      typeof value === 'string' &&
+      (hasControlCharacter(value) || hasUnsafeDisplayPayload(value))
+    ) {
+      throw new SessionArtifactValidationError(
+        'metadata string values contain unsafe content',
+        'metadata',
+      );
+    }
+    normalized[key] = value;
+  }
+  if (Object.keys(normalized).length === 0) {
+    return undefined;
+  }
+  if (Buffer.byteLength(JSON.stringify(normalized), 'utf8') > 4096) {
+    throw new SessionArtifactValidationError(
+      'metadata must be 4096 bytes or fewer',
+      'metadata',
+    );
+  }
+  return normalized;
+}
+
+function normalizeSizeBytes(value: unknown): number {
+  if (typeof value !== 'number' || !Number.isSafeInteger(value) || value < 0) {
+    throw new SessionArtifactValidationError(
+      'sizeBytes must be a non-negative safe integer',
+      'sizeBytes',
+    );
+  }
+  return value;
+}
+
+function inferKind(input: {
+  storage: DaemonSessionArtifactStorage;
+  workspacePath?: string;
+  url?: string;
+}): DaemonSessionArtifactKind {
+  if (input.storage === 'published') return 'html';
+  if (input.url) return 'link';
+  const ext = input.workspacePath
+    ? path.extname(input.workspacePath).toLowerCase()
+    : '';
+  if (ext === '.html' || ext === '.htm') return 'html';
+  if (['.png', '.jpg', '.jpeg', '.gif', '.webp', '.svg'].includes(ext)) {
+    return 'image';
+  }
+  if (['.mp4', '.mov', '.webm'].includes(ext)) return 'video';
+  if (['.mp3', '.wav', '.m4a', '.ogg'].includes(ext)) return 'audio';
+  if (ext === '.pdf') return 'pdf';
+  if (ext === '.ipynb') return 'notebook';
+  return input.workspacePath ? 'file' : 'other';
+}
+
+async function getWorkspaceStatus(
+  workspaceCwd: string,
+  workspacePath: string,
+  realWorkspaceCwd: Promise<string>,
+): Promise<{
+  status: DaemonSessionArtifactStatus;
+  sizeBytes?: number;
+  escaped?: boolean;
+}> {
+  const absolutePath = path.resolve(workspaceCwd, workspacePath);
+  const realWorkspace = await realWorkspaceCwd;
+  try {
+    const realPath = await fs.realpath(absolutePath);
+    const relative = path.relative(realWorkspace, realPath);
+    if (!relative || isOutsidePath(relative)) {
+      return { status: 'missing', escaped: true };
+    }
+    const stat = await fs.stat(realPath);
+    return {
+      status: 'available',
+      ...(stat.isFile() ? { sizeBytes: stat.size } : {}),
+    };
+  } catch (error) {
+    if (!isNotFoundError(error)) {
+      throw error;
+    }
+    if (await danglingSymlinkEscapesWorkspace(absolutePath, realWorkspace)) {
+      return { status: 'missing', escaped: true };
+    }
+    return { status: 'missing' };
+  }
+}
+
+async function danglingSymlinkEscapesWorkspace(
+  absolutePath: string,
+  realWorkspace: string,
+): Promise<boolean> {
+  try {
+    const stat = await fs.lstat(absolutePath);
+    if (!stat.isSymbolicLink()) {
+      return false;
+    }
+    const target = await fs.readlink(absolutePath);
+    const parent = await fs.realpath(path.dirname(absolutePath));
+    const targetPath = path.resolve(parent, target);
+    return isOutsidePath(path.relative(realWorkspace, targetPath));
+  } catch (error) {
+    if (isNotFoundError(error)) {
+      return false;
+    }
+    throw error;
+  }
+}
+
+async function runInBatches<T>(
+  items: T[],
+  batchSize: number,
+  fn: (item: T) => Promise<void>,
+): Promise<void> {
+  for (let index = 0; index < items.length; index += batchSize) {
+    await Promise.all(items.slice(index, index + batchSize).map(fn));
+  }
+}
+
+function isNotFoundError(error: unknown): boolean {
+  if (typeof error !== 'object' || error === null || !('code' in error)) {
+    return false;
+  }
+  const code = (error as { code?: unknown }).code;
+  return code === 'ENOENT' || code === 'ENOTDIR';
+}
+
+function isOutsidePath(relative: string): boolean {
+  return (
+    relative === '..' ||
+    relative.startsWith(`..${path.sep}`) ||
+    path.isAbsolute(relative)
+  );
+}
diff --git a/packages/cli/src/acp-integration/session/Session.test.ts b/packages/cli/src/acp-integration/session/Session.test.ts
index 0bf16ccac6..30d3d183ca 100644
--- a/packages/cli/src/acp-integration/session/Session.test.ts
+++ b/packages/cli/src/acp-integration/session/Session.test.ts
@@ -3236,6 +3236,12 @@ describe('Session', () => {
               llmContent: 'nope',
               returnDisplay: 'failed',
               error: { message: 'tool blew up' },
+              artifacts: [
+                {
+                  title: 'Failure artifact',
+                  workspacePath: 'reports/failure.html',
+                },
+              ],
             }),
           }),
         };
@@ -3278,6 +3284,23 @@ describe('Session', () => {
           .find((ev) => ev.function_name === 'read_file');
         expect(toolEvent?.status).toBe('error');
         expect(toolEvent?.success).toBe(false);
+        expect(mockClient.sessionUpdate).toHaveBeenCalledWith(
+          expect.objectContaining({
+            sessionId: 'test-session-id',
+            update: expect.objectContaining({
+              sessionUpdate: 'tool_call_update',
+              status: 'failed',
+              _meta: expect.objectContaining({
+                artifacts: [
+                  {
+                    title: 'Failure artifact',
+                    workspacePath: 'reports/failure.html',
+                  },
+                ],
+              }),
+            }),
+          }),
+        );
       });
     });
 
@@ -8794,10 +8817,24 @@ describe('Session', () => {
       describe('PostToolUse hook', () => {
         it('fires PostToolUse hook after successful tool execution', async () => {
           const messageBus = {
-            request: vi.fn().mockResolvedValue({
-              success: true,
-              output: {},
-            }),
+            request: vi
+              .fn()
+              .mockImplementation(async (request: { eventName: string }) => ({
+                success: true,
+                output:
+                  request.eventName === 'PostToolUse'
+                    ? {
+                        hookSpecificOutput: {
+                          artifacts: [
+                            {
+                              title: 'Success report',
+                              workspacePath: 'reports/success.html',
+                            },
+                          ],
+                        },
+                      }
+                    : { decision: 'allow' },
+              })),
           };
           mockConfig.getMessageBus = vi.fn().mockReturnValue(messageBus);
           mockConfig.getDisableAllHooks = vi.fn().mockReturnValue(false);
@@ -8855,6 +8892,22 @@ describe('Session', () => {
             }),
             expect.anything(),
           );
+          expect(mockClient.extNotification).toHaveBeenCalledWith(
+            'qwen/notify/session/artifact-event',
+            expect.objectContaining({
+              sessionId: 'test-session-id',
+              source: 'hook',
+              hookEventName: 'PostToolUse',
+              toolName: 'read_file',
+              toolCallId: 'call-1',
+              artifacts: [
+                {
+                  title: 'Success report',
+                  workspacePath: 'reports/success.html',
+                },
+              ],
+            }),
+          );
         });
 
         it('stops execution when PostToolUse hook returns shouldStop', async () => {
@@ -8924,10 +8977,24 @@ describe('Session', () => {
       describe('PostToolUseFailure hook', () => {
         it('fires PostToolUseFailure hook when tool execution fails', async () => {
           const messageBus = {
-            request: vi.fn().mockResolvedValue({
-              success: true,
-              output: {},
-            }),
+            request: vi
+              .fn()
+              .mockImplementation(async (request: { eventName: string }) => ({
+                success: true,
+                output:
+                  request.eventName === 'PostToolUseFailure'
+                    ? {
+                        hookSpecificOutput: {
+                          artifacts: [
+                            {
+                              title: 'Failure report',
+                              workspacePath: 'reports/failure.html',
+                            },
+                          ],
+                        },
+                      }
+                    : { decision: 'allow' },
+              })),
           };
           mockConfig.getMessageBus = vi.fn().mockReturnValue(messageBus);
           mockConfig.getDisableAllHooks = vi.fn().mockReturnValue(false);
@@ -8981,6 +9048,22 @@ describe('Session', () => {
             }),
             expect.anything(),
           );
+          expect(mockClient.extNotification).toHaveBeenCalledWith(
+            'qwen/notify/session/artifact-event',
+            expect.objectContaining({
+              sessionId: 'test-session-id',
+              source: 'hook',
+              hookEventName: 'PostToolUseFailure',
+              toolName: 'read_file',
+              toolCallId: 'call-1',
+              artifacts: [
+                {
+                  title: 'Failure report',
+                  workspacePath: 'reports/failure.html',
+                },
+              ],
+            }),
+          );
         });
       });
 
@@ -9720,6 +9803,52 @@ describe('Session', () => {
       };
     }
 
+    it('does not fire PostToolBatch hooks from the ACP session path', async () => {
+      const messageBus = {
+        request: vi.fn().mockImplementation(async (request) => ({
+          success: true,
+          output: { decision: 'allow', eventName: request.eventName },
+        })),
+      };
+      mockConfig.getMessageBus = vi.fn().mockReturnValue(messageBus);
+      mockConfig.getDisableAllHooks = vi.fn().mockReturnValue(false);
+      mockConfig.hasHooksForEvent = vi
+        .fn()
+        .mockImplementation(
+          (eventName: string) => eventName === 'PostToolBatch',
+        );
+      mockConfig.getApprovalMode = vi.fn().mockReturnValue(ApprovalMode.YOLO);
+      const execute = vi.fn().mockResolvedValue({
+        llmContent: 'tool output',
+        returnDisplay: 'tool output',
+      });
+      mockToolRegistry.getTool.mockReturnValue(
+        mockAllowedTool('read_file', execute),
+      );
+
+      await (session as unknown as ToolCallInternals).runToolCalls(
+        new AbortController().signal,
+        'prompt-batch-artifacts',
+        [
+          {
+            id: 'read_call',
+            name: 'read_file',
+            args: { path: 'README.md' },
+          },
+        ],
+      );
+
+      expect(
+        messageBus.request.mock.calls.some(
+          ([request]) => request.eventName === 'PostToolBatch',
+        ),
+      ).toBe(false);
+      expect(mockClient.extNotification).not.toHaveBeenCalledWith(
+        'qwen/notify/session/artifact-event',
+        expect.objectContaining({ hookEventName: 'PostToolBatch' }),
+      );
+    });
+
     it('marks cancelled ask_user_question as a turn stop', async () => {
       const execute = vi.fn().mockResolvedValue({
         llmContent: 'should not execute',
diff --git a/packages/cli/src/acp-integration/session/Session.ts b/packages/cli/src/acp-integration/session/Session.ts
index 2c556d616a..5b3dc8a84d 100644
--- a/packages/cli/src/acp-integration/session/Session.ts
+++ b/packages/cli/src/acp-integration/session/Session.ts
@@ -31,6 +31,7 @@ import type {
   ToolCallRequestInfo,
   ToolCallResponseInfo,
   LoopTickResult,
+  ToolArtifact,
   VisionBridgeResult,
 } from '@qwen-code/qwen-code-core';
 import {
@@ -171,6 +172,7 @@ import {
 import { parseAcpModelOption } from '../../utils/acpModelUtils.js';
 import { classifyApiError } from '../../ui/hooks/useGeminiStream.js';
 import { getPersistScopeForModelSelection } from '../../config/modelProvidersScope.js';
+import { writeStderrLine } from '../../utils/stdioHelpers.js';
 import {
   buildExtensionMentionContext,
   EXTENSION_CONTEXT_BUDGET,
@@ -3978,7 +3980,6 @@ export class Session implements SessionContext {
         parts.push(await recordSkippedToolCall(remainingCall, message));
       }
     };
-
     // Bounded-concurrency runner: matches core's `runConcurrently`
     // behaviour (`coreToolScheduler.ts:1506`), capped by
     // `QWEN_CODE_MAX_TOOL_CONCURRENCY` (default 10). Results are returned
@@ -5011,6 +5012,11 @@ export class Session implements SessionContext {
               ? 'error'
               : 'success';
           const succeeded = status === 'success';
+          const responseError = toolResult.error
+            ? new Error(toolResult.error.message)
+            : aborted
+              ? new Error('Tool execution was cancelled')
+              : undefined;
 
           // Fire PostToolUse hook on successful execution (aligned with core path)
           if (
@@ -5053,6 +5059,12 @@ export class Session implements SessionContext {
               const contextPart = { text: postHookResult.additionalContext };
               responseParts.push(contextPart);
             }
+            await this.emitHookArtifactsNotification({
+              hookEventName: 'PostToolUse',
+              toolName,
+              toolCallId: callId,
+              artifacts: postHookResult.artifacts,
+            });
           } else if (
             hooksEnabledForTool &&
             messageBusForTool &&
@@ -5078,6 +5090,12 @@ export class Session implements SessionContext {
                 `PostToolUseFailure hook additional context for ${toolName}: ${failureHookResult.additionalContext}`,
               );
             }
+            await this.emitHookArtifactsNotification({
+              hookEventName: 'PostToolUseFailure',
+              toolName,
+              toolCallId: callId,
+              artifacts: failureHookResult.artifacts,
+            });
           }
 
           // Handle TodoWriteTool: extract todos and send plan update
@@ -5096,20 +5114,15 @@ export class Session implements SessionContext {
             // Still log and return function response for LLM
           } else {
             // Normal tool handling: emit result using ToolCallEmitter
-            const error = toolResult.error
-              ? new Error(toolResult.error.message)
-              : aborted
-                ? new Error('Tool execution was cancelled')
-                : undefined;
-
             await this.toolCallEmitter.emitResult({
               callId,
               toolName,
               args,
               message: responseParts,
               resultDisplay: toolResult.returnDisplay,
-              error,
+              error: responseError,
               success: succeeded,
+              artifacts: toolResult.artifacts,
             });
           }
 
@@ -5185,6 +5198,12 @@ export class Session implements SessionContext {
                 `PostToolUseFailure hook additional context for ${toolName}: ${failureHookResult.additionalContext}`,
               );
             }
+            await this.emitHookArtifactsNotification({
+              hookEventName: 'PostToolUseFailure',
+              toolName,
+              toolCallId: callId,
+              artifacts: failureHookResult.artifacts,
+            });
           }
 
           // Use ToolCallEmitter for error handling
@@ -5221,8 +5240,9 @@ export class Session implements SessionContext {
               error,
             );
 
+          const responseParts = errorResponse(error);
           return {
-            parts: errorResponse(error),
+            parts: responseParts,
             stopAfterPermissionCancel: nestedPermissionCancelled,
             loopDetected,
           };
@@ -5666,6 +5686,35 @@ export class Session implements SessionContext {
     }
   }
 
+  private async emitHookArtifactsNotification(args: {
+    hookEventName: 'PostToolUse' | 'PostToolUseFailure';
+    toolName?: string;
+    toolCallId?: string;
+    artifacts?: ToolArtifact[];
+  }): Promise<void> {
+    if (!args.artifacts || args.artifacts.length === 0) {
+      return;
+    }
+
+    try {
+      await this.client.extNotification('qwen/notify/session/artifact-event', {
+        v: 1,
+        sessionId: this.sessionId,
+        source: 'hook',
+        hookEventName: args.hookEventName,
+        toolName: args.toolName,
+        toolCallId: args.toolCallId,
+        artifacts: args.artifacts,
+      });
+    } catch (error) {
+      writeStderrLine(
+        `Hook artifact notification dropped for ${args.toolName ?? args.hookEventName}: ${
+          error instanceof Error ? error.message : String(error)
+        }`,
+      );
+    }
+  }
+
   /**
    * Fire a notification hook and forward any terminalSequence to the ACP
    * client as an extNotification. Fire-and-forget — errors are logged at
diff --git a/packages/cli/src/acp-integration/session/emitters/ToolCallEmitter.test.ts b/packages/cli/src/acp-integration/session/emitters/ToolCallEmitter.test.ts
index c41f3d219f..6306116673 100644
--- a/packages/cli/src/acp-integration/session/emitters/ToolCallEmitter.test.ts
+++ b/packages/cli/src/acp-integration/session/emitters/ToolCallEmitter.test.ts
@@ -179,6 +179,48 @@ describe('ToolCallEmitter', () => {
       );
     });
 
+    it('emits structured artifacts without a wire trust marker', async () => {
+      await emitter.emitResult({
+        toolName: ToolNames.ARTIFACT,
+        callId: 'call-artifact',
+        success: true,
+        message: createMockMessage('Published'),
+        artifacts: [
+          {
+            kind: 'html',
+            storage: 'published',
+            title: 'Dashboard',
+            url: 'file:///tmp/dashboard.html',
+            managedId: 'managed-1',
+          },
+        ],
+      });
+
+      expect(sendUpdateSpy).toHaveBeenCalledWith(
+        expect.objectContaining({
+          sessionUpdate: 'tool_call_update',
+          toolCallId: 'call-artifact',
+          status: 'completed',
+          _meta: expect.objectContaining({
+            toolName: ToolNames.ARTIFACT,
+            artifacts: [
+              expect.objectContaining({
+                title: 'Dashboard',
+                storage: 'published',
+              }),
+            ],
+          }),
+        }),
+      );
+      expect(
+        (
+          sendUpdateSpy.mock.calls[0]?.[0] as {
+            _meta?: Record<string, unknown>;
+          }
+        )._meta,
+      ).not.toHaveProperty('artifactsTrustedPublisher');
+    });
+
     it('should emit tool_call_update with failed status on failure', async () => {
       await emitter.emitResult({
         toolName: 'test_tool',
@@ -202,6 +244,35 @@ describe('ToolCallEmitter', () => {
       });
     });
 
+    it('emits structured artifacts from failed tool results', async () => {
+      await emitter.emitResult({
+        toolName: ToolNames.RECORD_ARTIFACT,
+        callId: 'call-failed-artifact',
+        success: false,
+        message: [],
+        error: new Error('record failed'),
+        artifacts: [
+          { title: 'Failure report', url: 'https://example.com/drop' },
+        ],
+      });
+
+      expect(sendUpdateSpy).toHaveBeenCalledWith(
+        expect.objectContaining({
+          sessionUpdate: 'tool_call_update',
+          toolCallId: 'call-failed-artifact',
+          status: 'failed',
+          _meta: expect.objectContaining({
+            artifacts: [
+              expect.objectContaining({
+                title: 'Failure report',
+                url: 'https://example.com/drop',
+              }),
+            ],
+          }),
+        }),
+      );
+    });
+
     it('should handle diff display format', async () => {
       await emitter.emitResult({
         toolName: 'edit_file',
diff --git a/packages/cli/src/acp-integration/session/emitters/ToolCallEmitter.ts b/packages/cli/src/acp-integration/session/emitters/ToolCallEmitter.ts
index 1eac67fa84..f1c0a14863 100644
--- a/packages/cli/src/acp-integration/session/emitters/ToolCallEmitter.ts
+++ b/packages/cli/src/acp-integration/session/emitters/ToolCallEmitter.ts
@@ -167,6 +167,9 @@ export class ToolCallEmitter extends BaseEmitter {
         ...(BaseEmitter.toEpochMs(params.timestamp) != null && {
           timestamp: BaseEmitter.toEpochMs(params.timestamp),
         }),
+        ...(params.artifacts && params.artifacts.length > 0
+          ? { artifacts: params.artifacts }
+          : {}),
       },
     };
 
diff --git a/packages/cli/src/acp-integration/session/types.ts b/packages/cli/src/acp-integration/session/types.ts
index f79c41ae76..90b0878c78 100644
--- a/packages/cli/src/acp-integration/session/types.ts
+++ b/packages/cli/src/acp-integration/session/types.ts
@@ -4,7 +4,7 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
-import type { Config } from '@qwen-code/qwen-code-core';
+import type { Config, ToolArtifact } from '@qwen-code/qwen-code-core';
 import type { Part } from '@google/genai';
 import type {
   SessionUpdate,
@@ -109,6 +109,8 @@ export interface ToolCallResultParams {
   resultDisplay?: unknown;
   /** Error if tool execution failed */
   error?: Error;
+  /** Structured artifacts produced by the tool result. */
+  artifacts?: ToolArtifact[];
   /** Original args (fallback for TodoWriteTool todos extraction) */
   args?: Record<string, unknown>;
   /** Optional subagent metadata */
diff --git a/packages/cli/src/config/settingsSchema.ts b/packages/cli/src/config/settingsSchema.ts
index 623ed04f3b..b1f66faf91 100644
--- a/packages/cli/src/config/settingsSchema.ts
+++ b/packages/cli/src/config/settingsSchema.ts
@@ -3022,7 +3022,7 @@ const SETTINGS_SCHEMA = {
         requiresRestart: true,
         default: false,
         description:
-          'Enable the Artifact tool (experimental). When enabled, the model can publish a self-contained HTML page as an interactive Artifact and open it in the browser. Interactive, non-SDK sessions only. Can also be enabled via QWEN_CODE_ENABLE_ARTIFACT=1, or hard-disabled via QWEN_CODE_DISABLE_ARTIFACT=1.',
+          'Enable the Artifact tool (experimental). When enabled, the model can publish a self-contained HTML page as an interactive Artifact and open it in the browser. Interactive, non-SDK sessions only. QWEN_CODE_ENABLE_ARTIFACT=1 enables the metadata-only record_artifact tool for non-SDK daemon sessions, and also enables the Artifact tool in interactive sessions. QWEN_CODE_DISABLE_ARTIFACT=1 hard-disables both.',
         showInDialog: true,
       },
       emitToolUseSummaries: {
diff --git a/packages/cli/src/i18n/locales/en.js b/packages/cli/src/i18n/locales/en.js
index 4878297dba..375a180103 100644
--- a/packages/cli/src/i18n/locales/en.js
+++ b/packages/cli/src/i18n/locales/en.js
@@ -186,6 +186,7 @@ export default {
   'toolDisplayName.SaveMemory': 'toolDisplayName.SaveMemory',
   'toolDisplayName.Agent': 'toolDisplayName.Agent',
   'toolDisplayName.Artifact': 'toolDisplayName.Artifact',
+  'toolDisplayName.RecordArtifact': 'toolDisplayName.RecordArtifact',
   'toolDisplayName.Skill': 'toolDisplayName.Skill',
   'toolDisplayName.EnterPlanMode': 'toolDisplayName.EnterPlanMode',
   'toolDisplayName.ExitPlanMode': 'toolDisplayName.ExitPlanMode',
diff --git a/packages/cli/src/i18n/locales/zh-TW.js b/packages/cli/src/i18n/locales/zh-TW.js
index 18c1d42f59..c9fb2ca196 100644
--- a/packages/cli/src/i18n/locales/zh-TW.js
+++ b/packages/cli/src/i18n/locales/zh-TW.js
@@ -177,6 +177,7 @@ export default {
   'toolDisplayName.SaveMemory': '儲存記憶',
   'toolDisplayName.Agent': 'Agent',
   'toolDisplayName.Artifact': '製品',
+  'toolDisplayName.RecordArtifact': '記錄製品',
   'toolDisplayName.Skill': '技能',
   'toolDisplayName.EnterPlanMode': '進入計畫模式',
   'toolDisplayName.ExitPlanMode': '退出計畫模式',
diff --git a/packages/cli/src/i18n/locales/zh.js b/packages/cli/src/i18n/locales/zh.js
index d2915433d3..c8269e1d59 100644
--- a/packages/cli/src/i18n/locales/zh.js
+++ b/packages/cli/src/i18n/locales/zh.js
@@ -178,6 +178,7 @@ export default {
   'toolDisplayName.SaveMemory': '保存记忆',
   'toolDisplayName.Agent': 'Agent',
   'toolDisplayName.Artifact': '制品',
+  'toolDisplayName.RecordArtifact': '记录制品',
   'toolDisplayName.Skill': '技能',
   'toolDisplayName.EnterPlanMode': '进入计划模式',
   'toolDisplayName.ExitPlanMode': '退出计划模式',
diff --git a/packages/cli/src/serve/acp-http/dispatch.ts b/packages/cli/src/serve/acp-http/dispatch.ts
index d16c53ac86..2f4a2f8233 100644
--- a/packages/cli/src/serve/acp-http/dispatch.ts
+++ b/packages/cli/src/serve/acp-http/dispatch.ts
@@ -41,6 +41,7 @@ import {
   SessionShellDisabledError,
   WorkspaceMismatchError,
 } from '@qwen-code/acp-bridge/bridgeErrors';
+import { SessionArtifactValidationError } from '@qwen-code/acp-bridge/sessionArtifacts';
 import { canonicalizeWorkspace } from '@qwen-code/acp-bridge/workspacePaths';
 import { writeStderrLine } from '../../utils/stdioHelpers.js';
 import { MAX_WORKSPACE_PATH_LENGTH } from '../fs/paths.js';
@@ -127,6 +128,9 @@ function errMsg(err: unknown): string {
 type PermissionResponse = Parameters<
   HttpAcpBridge['respondToSessionPermission']
 >[2];
+type AddSessionArtifactInput = Parameters<
+  HttpAcpBridge['addSessionArtifact']
+>[1];
 
 const SESSION_SHELL_METHOD = `${QWEN_METHOD_NS}session/shell`;
 const INVALID_PERMISSION_OUTCOME_ERROR =
@@ -160,6 +164,9 @@ const ALL_QWEN_VENDOR_METHODS: readonly string[] = [
   `${QWEN_METHOD_NS}session/context_usage`,
   `${QWEN_METHOD_NS}session/tasks`,
   `${QWEN_METHOD_NS}session/lsp`,
+  `${QWEN_METHOD_NS}session/artifacts`,
+  `${QWEN_METHOD_NS}session/artifacts/add`,
+  `${QWEN_METHOD_NS}session/artifacts/remove`,
   // Wave 1: memory
   `${QWEN_METHOD_NS}workspace/memory`,
   `${QWEN_METHOD_NS}workspace/memory/write`,
@@ -369,6 +376,36 @@ function parsePermissionResponse(
   return response as PermissionResponse;
 }
 
+function pickSessionArtifactInput(
+  params: Record<string, unknown>,
+): AddSessionArtifactInput {
+  const {
+    title,
+    kind,
+    storage,
+    description,
+    workspacePath,
+    managedId,
+    url,
+    mimeType,
+    sizeBytes,
+    metadata,
+  } = params;
+
+  return {
+    title,
+    kind,
+    storage,
+    description,
+    workspacePath,
+    managedId,
+    url,
+    mimeType,
+    sizeBytes,
+    metadata,
+  } as AddSessionArtifactInput;
+}
+
 /**
  * Map a thrown error to a JSON-RPC error code + a client-safe message.
  * Param-validation errors are echoed (they describe the client's own bad
@@ -464,6 +501,16 @@ function toRpcError(err: unknown): {
       data: { errorKind: 'client_id_required' },
     };
   }
+  if (err instanceof SessionArtifactValidationError) {
+    return {
+      code: RPC.INVALID_PARAMS,
+      message: err.message,
+      data: {
+        errorKind: 'artifact_validation_failed',
+        ...(err.field ? { field: err.field } : {}),
+      },
+    };
+  }
   const name = err instanceof Error ? err.name : '';
   switch (name) {
     case 'SessionArchivedError':
@@ -2288,6 +2335,49 @@ export class AcpDispatcher {
           return;
         }
 
+        case `${QWEN_METHOD_NS}session/artifacts`: {
+          const sessionId = String(params['sessionId'] ?? '');
+          if (!this.requireOwned(conn, sessionId, id)) return;
+          const result = await this.bridge.getSessionArtifacts(sessionId);
+          this.replyConn(conn, id, result as unknown);
+          return;
+        }
+
+        case `${QWEN_METHOD_NS}session/artifacts/add`: {
+          const sessionId = String(params['sessionId'] ?? '');
+          await this.withMutableOwned(conn, sessionId, id, async () => {
+            const result = await this.bridge.addSessionArtifact(
+              sessionId,
+              pickSessionArtifactInput(params),
+              this.sessionCtx(conn, sessionId, loopback),
+            );
+            this.replyConn(conn, id, result as unknown);
+          });
+          return;
+        }
+
+        case `${QWEN_METHOD_NS}session/artifacts/remove`: {
+          const sessionId = String(params['sessionId'] ?? '');
+          await this.withMutableOwned(conn, sessionId, id, async () => {
+            const artifactId = String(params['artifactId'] ?? '');
+            if (!artifactId) {
+              if (id !== undefined) {
+                conn.sendConn(
+                  error(id, RPC.INVALID_PARAMS, '`artifactId` is required'),
+                );
+              }
+              return;
+            }
+            const result = await this.bridge.removeSessionArtifact(
+              sessionId,
+              artifactId,
+              this.sessionCtx(conn, sessionId, loopback),
+            );
+            this.replyConn(conn, id, result as unknown);
+          });
+          return;
+        }
+
         case `${QWEN_METHOD_NS}workspace/memory`: {
           const result = await collectWorkspaceMemoryStatus(
             this.boundWorkspace,
diff --git a/packages/cli/src/serve/acp-http/index.ts b/packages/cli/src/serve/acp-http/index.ts
index 668b58a865..ce5656e0dd 100644
--- a/packages/cli/src/serve/acp-http/index.ts
+++ b/packages/cli/src/serve/acp-http/index.ts
@@ -188,6 +188,7 @@ const WS_READ_METHODS = new Set([
   '_qwen/session/context_usage',
   '_qwen/session/tasks',
   '_qwen/session/lsp',
+  '_qwen/session/artifacts',
   '_qwen/workspace/mcp',
   '_qwen/workspace/skills',
   '_qwen/workspace/providers',
diff --git a/packages/cli/src/serve/acp-http/transport.test.ts b/packages/cli/src/serve/acp-http/transport.test.ts
index 3602ec27c4..4053d98f52 100644
--- a/packages/cli/src/serve/acp-http/transport.test.ts
+++ b/packages/cli/src/serve/acp-http/transport.test.ts
@@ -17,6 +17,7 @@ import type {
   HttpAcpBridge,
 } from '@qwen-code/acp-bridge/bridgeTypes';
 import type { BridgeEvent } from '@qwen-code/acp-bridge/eventBus';
+import { SessionArtifactValidationError } from '@qwen-code/acp-bridge/sessionArtifacts';
 import {
   CancelSentinelCollisionError,
   InvalidClientIdError,
@@ -353,6 +354,51 @@ class FakeBridge {
       servers: [{ name: 'typescript', status: 'READY', languages: ['ts'] }],
     };
   }
+  lastAddedArtifact:
+    | {
+        sessionId: string;
+        artifact: Parameters<HttpAcpBridge['addSessionArtifact']>[1];
+        context: Parameters<HttpAcpBridge['addSessionArtifact']>[2];
+      }
+    | undefined;
+  lastArtifactListSessionId: string | undefined;
+  lastRemovedArtifact:
+    | {
+        sessionId: string;
+        artifactId: string;
+        context: Parameters<HttpAcpBridge['removeSessionArtifact']>[2];
+      }
+    | undefined;
+  async getSessionArtifacts(sessionId: string) {
+    this.lastArtifactListSessionId = sessionId;
+    return {
+      v: 1,
+      sessionId,
+      artifacts: [],
+      generatedAt: new Date().toISOString(),
+      limits: { maxArtifacts: 200 },
+    };
+  }
+  async addSessionArtifact(
+    sessionId: string,
+    artifact: Parameters<HttpAcpBridge['addSessionArtifact']>[1],
+    context: Parameters<HttpAcpBridge['addSessionArtifact']>[2],
+  ) {
+    this.lastAddedArtifact = { sessionId, artifact, context };
+    return { v: 1, sessionId, changes: [] };
+  }
+  async removeSessionArtifact(
+    sessionId: string,
+    artifactId: string,
+    context: Parameters<HttpAcpBridge['removeSessionArtifact']>[2],
+  ) {
+    this.lastRemovedArtifact = { sessionId, artifactId, context };
+    return {
+      v: 1,
+      sessionId,
+      changes: [{ action: 'removed' as const, artifactId, reason: 'explicit' }],
+    };
+  }
   async getWorkspaceToolsStatus() {
     return { v: 1, tools: [] };
   }
@@ -5449,6 +5495,331 @@ describe('ACP Streamable HTTP transport (over the wire)', () => {
       });
     });
 
+    it('_qwen/session/artifacts returns the session artifact snapshot', async () => {
+      const connId = await initialize();
+      const streamRes = openStream(connId);
+      await new Promise((r) => setTimeout(r, 30));
+      await post(connId, {
+        jsonrpc: '2.0',
+        id: 99,
+        method: 'session/new',
+        params: {},
+      });
+      await new Promise((r) => setTimeout(r, 30));
+      await post(connId, {
+        jsonrpc: '2.0',
+        id: 58,
+        method: '_qwen/session/artifacts',
+        params: { sessionId: 'sess-1' },
+      });
+      const frames = await takeFrames(await streamRes, 2);
+      expect(frames[1]).toMatchObject({
+        result: {
+          v: 1,
+          sessionId: 'sess-1',
+          artifacts: [],
+          limits: { maxArtifacts: 200 },
+        },
+      });
+      expect(bridge.lastArtifactListSessionId).toBe('sess-1');
+    });
+
+    it('_qwen/session/artifacts/add forwards only public artifact fields', async () => {
+      const connId = await initialize();
+      const streamRes = openStream(connId);
+      await new Promise((r) => setTimeout(r, 30));
+      await post(connId, {
+        jsonrpc: '2.0',
+        id: 99,
+        method: 'session/new',
+        params: {},
+      });
+      await new Promise((r) => setTimeout(r, 30));
+      await post(connId, {
+        jsonrpc: '2.0',
+        id: 58,
+        method: '_qwen/session/artifacts/add',
+        params: {
+          sessionId: 'sess-1',
+          title: 'Lineage',
+          kind: 'link',
+          storage: 'external_url',
+          url: 'https://example.test/lineage',
+          metadata: { table: 'fact_orders' },
+          source: 'tool',
+          trustedPublisher: true,
+          clientId: 'forged-client',
+          toolName: 'forged-tool',
+          hookEventName: 'forged-hook',
+        },
+      });
+      const frames = await takeFrames(await streamRes, 2);
+      expect(frames[1]).toMatchObject({
+        result: { v: 1, sessionId: 'sess-1', changes: [] },
+      });
+      expect(bridge.lastAddedArtifact?.sessionId).toBe('sess-1');
+      expect(bridge.lastAddedArtifact?.artifact).toMatchObject({
+        title: 'Lineage',
+        kind: 'link',
+        storage: 'external_url',
+        url: 'https://example.test/lineage',
+        metadata: { table: 'fact_orders' },
+      });
+      const artifact = bridge.lastAddedArtifact?.artifact as
+        | Record<string, unknown>
+        | undefined;
+      expect(artifact).not.toHaveProperty('sessionId');
+      expect(artifact).not.toHaveProperty('source');
+      expect(artifact).not.toHaveProperty('trustedPublisher');
+      expect(artifact).not.toHaveProperty('clientId');
+      expect(artifact).not.toHaveProperty('toolName');
+      expect(artifact).not.toHaveProperty('hookEventName');
+    });
+
+    it('_qwen/session/artifacts/add maps artifact validation errors to invalid params', async () => {
+      bridge.addSessionArtifact = async () => {
+        throw new SessionArtifactValidationError(
+          'url must use http or https',
+          'url',
+        );
+      };
+      const connId = await initialize();
+      const streamRes = openStream(connId);
+      await new Promise((r) => setTimeout(r, 30));
+      await post(connId, {
+        jsonrpc: '2.0',
+        id: 99,
+        method: 'session/new',
+        params: {},
+      });
+      await new Promise((r) => setTimeout(r, 30));
+      await post(connId, {
+        jsonrpc: '2.0',
+        id: 59,
+        method: '_qwen/session/artifacts/add',
+        params: {
+          sessionId: 'sess-1',
+          title: 'Bad URL',
+          url: 'file:///tmp/report.html',
+        },
+      });
+      const frames = await takeFrames(await streamRes, 2);
+      expect(frames[1]).toMatchObject({
+        error: {
+          code: -32602,
+          data: { errorKind: 'artifact_validation_failed', field: 'url' },
+        },
+      });
+    });
+
+    it('_qwen/session/artifacts/remove forwards artifact id', async () => {
+      const connId = await initialize();
+      const streamRes = openStream(connId);
+      await new Promise((r) => setTimeout(r, 30));
+      await post(connId, {
+        jsonrpc: '2.0',
+        id: 99,
+        method: 'session/new',
+        params: {},
+      });
+      await new Promise((r) => setTimeout(r, 30));
+      await post(connId, {
+        jsonrpc: '2.0',
+        id: 59,
+        method: '_qwen/session/artifacts/remove',
+        params: { sessionId: 'sess-1', artifactId: 'artifact-1' },
+      });
+      const frames = await takeFrames(await streamRes, 2);
+      expect(frames[1]).toMatchObject({
+        result: {
+          v: 1,
+          sessionId: 'sess-1',
+          changes: [
+            {
+              action: 'removed',
+              artifactId: 'artifact-1',
+              reason: 'explicit',
+            },
+          ],
+        },
+      });
+      expect(bridge.lastRemovedArtifact).toMatchObject({
+        sessionId: 'sess-1',
+        artifactId: 'artifact-1',
+      });
+    });
+
+    it('_qwen/session/artifacts/remove rejects missing artifact id', async () => {
+      const connId = await initialize();
+      const streamRes = openStream(connId);
+      await new Promise((r) => setTimeout(r, 30));
+      await post(connId, {
+        jsonrpc: '2.0',
+        id: 99,
+        method: 'session/new',
+        params: {},
+      });
+      await new Promise((r) => setTimeout(r, 30));
+      await post(connId, {
+        jsonrpc: '2.0',
+        id: 60,
+        method: '_qwen/session/artifacts/remove',
+        params: { sessionId: 'sess-1' },
+      });
+      const frames = await takeFrames(await streamRes, 2);
+      expect(frames[1]).toMatchObject({
+        error: {
+          code: -32602,
+          message: '`artifactId` is required',
+        },
+      });
+      expect(bridge.lastRemovedArtifact).toBeUndefined();
+    });
+
+    it('_qwen/session/artifacts/add holds the archive gate while mutating', async () => {
+      await withRuntimeDir(async () => {
+        const sessionId = '550e8400-e29b-41d4-a716-446655440131';
+        await writeStoredSession(sessionId);
+        let addStarted!: () => void;
+        let releaseAdd!: () => void;
+        const addStartedPromise = new Promise<void>((resolve) => {
+          addStarted = resolve;
+        });
+        const addReleasedPromise = new Promise<void>((resolve) => {
+          releaseAdd = resolve;
+        });
+        bridge.addSessionArtifact = async (sessionId, artifact, context) => {
+          bridge.lastAddedArtifact = { sessionId, artifact, context };
+          addStarted();
+          await addReleasedPromise;
+          return { v: 1, sessionId, changes: [] };
+        };
+
+        const connId = await initialize();
+        const stream = await openStream(connId);
+        const reader = frameReader(stream);
+        await post(connId, {
+          jsonrpc: '2.0',
+          id: 99,
+          method: 'session/load',
+          params: { sessionId },
+        });
+        expect(await reader.next()).toMatchObject({ id: 99 });
+
+        await post(connId, {
+          jsonrpc: '2.0',
+          id: 60,
+          method: '_qwen/session/artifacts/add',
+          params: {
+            sessionId,
+            title: 'Lineage',
+            url: 'https://example.test/lineage',
+          },
+        });
+        await addStartedPromise;
+
+        await post(connId, {
+          jsonrpc: '2.0',
+          id: 61,
+          method: '_qwen/sessions/archive',
+          params: { sessionIds: [sessionId] },
+        });
+        expect(await reader.next()).toMatchObject({
+          id: 61,
+          error: {
+            code: -32603,
+            data: { errorKind: 'session_archiving', sessionId },
+          },
+        });
+
+        releaseAdd();
+        expect(await reader.next()).toMatchObject({
+          id: 60,
+          result: { v: 1, sessionId, changes: [] },
+        });
+        reader.close();
+      });
+    });
+
+    it('_qwen/session/artifacts/remove holds the archive gate while mutating', async () => {
+      await withRuntimeDir(async () => {
+        const sessionId = '550e8400-e29b-41d4-a716-446655440132';
+        await writeStoredSession(sessionId);
+        let removeStarted!: () => void;
+        let releaseRemove!: () => void;
+        const removeStartedPromise = new Promise<void>((resolve) => {
+          removeStarted = resolve;
+        });
+        const removeReleasedPromise = new Promise<void>((resolve) => {
+          releaseRemove = resolve;
+        });
+        bridge.removeSessionArtifact = async (
+          sessionId,
+          artifactId,
+          context,
+        ) => {
+          bridge.lastRemovedArtifact = { sessionId, artifactId, context };
+          removeStarted();
+          await removeReleasedPromise;
+          return {
+            v: 1,
+            sessionId,
+            changes: [{ action: 'removed', artifactId, reason: 'explicit' }],
+          };
+        };
+
+        const connId = await initialize();
+        const stream = await openStream(connId);
+        const reader = frameReader(stream);
+        await post(connId, {
+          jsonrpc: '2.0',
+          id: 99,
+          method: 'session/load',
+          params: { sessionId },
+        });
+        expect(await reader.next()).toMatchObject({ id: 99 });
+
+        await post(connId, {
+          jsonrpc: '2.0',
+          id: 62,
+          method: '_qwen/session/artifacts/remove',
+          params: { sessionId, artifactId: 'artifact-1' },
+        });
+        await removeStartedPromise;
+
+        await post(connId, {
+          jsonrpc: '2.0',
+          id: 63,
+          method: '_qwen/sessions/archive',
+          params: { sessionIds: [sessionId] },
+        });
+        expect(await reader.next()).toMatchObject({
+          id: 63,
+          error: {
+            code: -32603,
+            data: { errorKind: 'session_archiving', sessionId },
+          },
+        });
+
+        releaseRemove();
+        expect(await reader.next()).toMatchObject({
+          id: 62,
+          result: {
+            v: 1,
+            sessionId,
+            changes: [
+              {
+                action: 'removed',
+                artifactId: 'artifact-1',
+                reason: 'explicit',
+              },
+            ],
+          },
+        });
+        reader.close();
+      });
+    });
+
     it('session methods reject unowned session', async () => {
       const connId = await initialize();
       const streamRes = openStream(connId);
diff --git a/packages/cli/src/serve/acp-session-bridge.ts b/packages/cli/src/serve/acp-session-bridge.ts
index 3d6f1b3c98..1935cab979 100644
--- a/packages/cli/src/serve/acp-session-bridge.ts
+++ b/packages/cli/src/serve/acp-session-bridge.ts
@@ -118,3 +118,5 @@ export {
   MAX_WORKSPACE_PATH_LENGTH,
   canonicalizeWorkspace,
 } from '@qwen-code/acp-bridge/workspacePaths';
+
+export { SessionArtifactValidationError } from '@qwen-code/acp-bridge/sessionArtifacts';
diff --git a/packages/cli/src/serve/capabilities.ts b/packages/cli/src/serve/capabilities.ts
index b8c0726a1a..986ba1d014 100644
--- a/packages/cli/src/serve/capabilities.ts
+++ b/packages/cli/src/serve/capabilities.ts
@@ -44,6 +44,7 @@ export const SERVE_CAPABILITY_REGISTRY = {
   session_prompt: { since: 'v1' },
   session_cancel: { since: 'v1' },
   session_events: { since: 'v1' },
+  session_artifacts: { since: 'v1' },
   // Daemon emits `slow_client_warning` synthetic frames at 75% queue
   // fill and honors `?maxQueued=N` (range [16, 2048]) on
   // `GET /session/:id/events`. Old daemons silently lack both — SDK
diff --git a/packages/cli/src/serve/routes/session.ts b/packages/cli/src/serve/routes/session.ts
index 38308fa986..79a66889d4 100644
--- a/packages/cli/src/serve/routes/session.ts
+++ b/packages/cli/src/serve/routes/session.ts
@@ -14,12 +14,14 @@ import {
   type ApprovalMode,
   type SessionArchiveState,
 } from '@qwen-code/qwen-code-core';
+import type { SessionArtifactInput } from '@qwen-code/acp-bridge/sessionArtifacts';
 import type { Application, Request, RequestHandler, Response } from 'express';
 import { writeStderrLine } from '../../utils/stdioHelpers.js';
 import {
   canonicalizeWorkspace,
   InvalidClientIdError,
   PromptQueueFullError,
+  SessionArtifactValidationError,
   SessionShellClientRequiredError,
   SessionShellDisabledError,
   type AcpSessionBridge,
@@ -63,6 +65,21 @@ interface RegisterSessionRoutesDeps {
   languageCodes: string[];
 }
 
+function sendArtifactValidationError(res: Response, err: unknown): boolean {
+  if (!(err instanceof SessionArtifactValidationError)) {
+    return false;
+  }
+  res.status(400).json({
+    v: 1,
+    error: {
+      code: err.code,
+      message: err.message,
+      ...(err.field ? { field: err.field } : {}),
+    },
+  });
+  return true;
+}
+
 export function registerSessionRoutes(
   app: Application,
   deps: RegisterSessionRoutesDeps,
@@ -506,6 +523,99 @@ export function registerSessionRoutes(
     }
   });
 
+  app.get('/session/:id/artifacts', async (req, res) => {
+    const sessionId = requireSessionId(req, res);
+    if (sessionId === null) return;
+    try {
+      res.status(200).json(await bridge.getSessionArtifacts(sessionId));
+    } catch (err) {
+      sendBridgeError(res, err, {
+        route: 'GET /session/:id/artifacts',
+        sessionId,
+      });
+    }
+  });
+
+  app.post(
+    '/session/:id/artifacts',
+    mutate({ strict: true }),
+    withMutableSession(
+      'POST /session/:id/artifacts',
+      async (req, res, sessionId) => {
+        const clientId = parseClientIdHeader(req, res);
+        if (clientId === null) return;
+        try {
+          const body = safeBody(req);
+          const artifact: SessionArtifactInput = {
+            title: body['title'] as SessionArtifactInput['title'],
+            kind: body['kind'] as SessionArtifactInput['kind'],
+            storage: body['storage'] as SessionArtifactInput['storage'],
+            description: body[
+              'description'
+            ] as SessionArtifactInput['description'],
+            workspacePath: body[
+              'workspacePath'
+            ] as SessionArtifactInput['workspacePath'],
+            managedId: body['managedId'] as SessionArtifactInput['managedId'],
+            url: body['url'] as SessionArtifactInput['url'],
+            mimeType: body['mimeType'] as SessionArtifactInput['mimeType'],
+            sizeBytes: body['sizeBytes'] as SessionArtifactInput['sizeBytes'],
+            metadata: body['metadata'] as SessionArtifactInput['metadata'],
+          };
+          const result = await bridge.addSessionArtifact(
+            sessionId,
+            artifact,
+            clientId !== undefined ? { clientId } : undefined,
+          );
+          res.status(200).json(result);
+        } catch (err) {
+          if (sendArtifactValidationError(res, err)) return;
+          sendBridgeError(res, err, {
+            route: 'POST /session/:id/artifacts',
+            sessionId,
+          });
+        }
+      },
+    ),
+  );
+
+  app.delete(
+    '/session/:id/artifacts/:artifactId',
+    mutate({ strict: true }),
+    withMutableSession(
+      'DELETE /session/:id/artifacts/:artifactId',
+      async (req, res, sessionId) => {
+        const artifactId = req.params['artifactId'];
+        const clientId = parseClientIdHeader(req, res);
+        if (clientId === null) return;
+        if (!artifactId) {
+          res.status(400).json({
+            v: 1,
+            error: {
+              code: 'VALIDATION_FAILED',
+              message: '`artifactId` route parameter is required',
+              field: 'artifactId',
+            },
+          });
+          return;
+        }
+        try {
+          const result = await bridge.removeSessionArtifact(
+            sessionId,
+            artifactId,
+            clientId !== undefined ? { clientId } : undefined,
+          );
+          res.status(200).json(result);
+        } catch (err) {
+          sendBridgeError(res, err, {
+            route: 'DELETE /session/:id/artifacts/:artifactId',
+            sessionId,
+          });
+        }
+      },
+    ),
+  );
+
   app.post(
     '/session/:id/tasks/:taskId/cancel',
     mutate({ strict: true }),
@@ -875,6 +985,7 @@ export function registerSessionRoutes(
 
   app.patch(
     '/session/:id/metadata',
+    mutate({ strict: true }),
     withMutableSession('PATCH /session/:id/metadata', (req, res, sessionId) => {
       const body = safeBody(req);
       const clientId = parseClientIdHeader(req, res);
diff --git a/packages/cli/src/serve/server.test.ts b/packages/cli/src/serve/server.test.ts
index cb3569cf71..6f463bb97e 100644
--- a/packages/cli/src/serve/server.test.ts
+++ b/packages/cli/src/serve/server.test.ts
@@ -64,6 +64,7 @@ import {
   PermissionPolicyNotImplementedError,
   PromptQueueFullError,
   RestoreInProgressError,
+  SessionArtifactValidationError,
   SessionShellClientRequiredError,
   SessionShellDisabledError,
   SessionBusyError,
@@ -185,6 +186,7 @@ const EXPECTED_STAGE1_FEATURES = [
   'session_prompt',
   'session_cancel',
   'session_events',
+  'session_artifacts',
   'slow_client_warning',
   'typed_event_schema',
   'session_set_model',
@@ -403,6 +405,9 @@ interface FakeBridgeOpts {
   ) => boolean;
   listImpl?: (workspaceCwd: string) => BridgeSessionSummary[];
   summaryImpl?: (sessionId: string) => BridgeSessionSummary;
+  getSessionArtifactsImpl?: AcpSessionBridge['getSessionArtifacts'];
+  addSessionArtifactImpl?: AcpSessionBridge['addSessionArtifact'];
+  removeSessionArtifactImpl?: AcpSessionBridge['removeSessionArtifact'];
   workspaceMcpImpl?: () => Promise<ServeWorkspaceMcpStatus>;
   workspaceMcpToolsImpl?: (
     serverName: string,
@@ -605,6 +610,17 @@ interface FakeBridge extends AcpSessionBridge {
   }>;
   listCalls: string[];
   summaryCalls: string[];
+  sessionArtifactsCalls: string[];
+  addSessionArtifactCalls: Array<{
+    sessionId: string;
+    artifact: Parameters<AcpSessionBridge['addSessionArtifact']>[1];
+    context?: BridgeClientRequestContext;
+  }>;
+  removeSessionArtifactCalls: Array<{
+    sessionId: string;
+    artifactId: string;
+    context?: BridgeClientRequestContext;
+  }>;
   workspaceMcpCalls: number;
   workspaceMcpToolsCalls: string[];
   workspaceMcpResourcesCalls: string[];
@@ -747,6 +763,10 @@ function fakeBridge(opts: FakeBridgeOpts = {}): FakeBridge {
   const sessionPermissionVotes: FakeBridge['sessionPermissionVotes'] = [];
   const listCalls: string[] = [];
   const summaryCalls: string[] = [];
+  const sessionArtifactsCalls: string[] = [];
+  const addSessionArtifactCalls: FakeBridge['addSessionArtifactCalls'] = [];
+  const removeSessionArtifactCalls: FakeBridge['removeSessionArtifactCalls'] =
+    [];
   let workspaceMcpCalls = 0;
   const workspaceMcpToolsCalls: string[] = [];
   const workspaceMcpResourcesCalls: string[] = [];
@@ -823,6 +843,59 @@ function fakeBridge(opts: FakeBridgeOpts = {}): FakeBridge {
     ((sessionId: string): BridgeSessionSummary => {
       throw new SessionNotFoundError(sessionId);
     });
+  const getSessionArtifactsImpl =
+    opts.getSessionArtifactsImpl ??
+    (async (sessionId: string) => ({
+      v: 1 as const,
+      sessionId,
+      artifacts: [],
+      generatedAt: '2026-01-01T00:00:00.000Z',
+      limits: { maxArtifacts: 200 },
+    }));
+  const addSessionArtifactImpl =
+    opts.addSessionArtifactImpl ??
+    (async (sessionId, artifact, context) => ({
+      v: 1 as const,
+      sessionId,
+      changes: [
+        {
+          action: 'created' as const,
+          artifactId: 'artifact-1',
+          artifact: {
+            id: 'artifact-1',
+            kind: artifact.kind ?? 'link',
+            storage: artifact.workspacePath ? 'workspace' : 'external_url',
+            source: 'client' as const,
+            status: 'available' as const,
+            title: artifact.title,
+            ...(artifact.url ? { url: artifact.url } : {}),
+            ...(artifact.workspacePath
+              ? { workspacePath: artifact.workspacePath }
+              : {}),
+            clientRetained: true,
+            createdAt: '2026-01-01T00:00:00.000Z',
+            updatedAt: '2026-01-01T00:00:00.000Z',
+            ...(context?.clientId ? { clientId: context.clientId } : {}),
+          },
+        },
+      ],
+    }));
+  const removeSessionArtifactImpl =
+    opts.removeSessionArtifactImpl ??
+    ((sessionId, artifactId) => ({
+      v: 1 as const,
+      sessionId,
+      changes:
+        artifactId === 'missing'
+          ? []
+          : [
+              {
+                action: 'removed' as const,
+                artifactId,
+                reason: 'explicit' as const,
+              },
+            ],
+    }));
   const workspaceMcpImpl =
     opts.workspaceMcpImpl ??
     (async () => ({
@@ -1173,6 +1246,9 @@ function fakeBridge(opts: FakeBridgeOpts = {}): FakeBridge {
     sessionPermissionVotes,
     listCalls,
     summaryCalls,
+    sessionArtifactsCalls,
+    addSessionArtifactCalls,
+    removeSessionArtifactCalls,
     workspaceMcpToolsCalls,
     workspaceMcpResourcesCalls,
     extensionEvents,
@@ -1322,6 +1398,26 @@ function fakeBridge(opts: FakeBridgeOpts = {}): FakeBridge {
       summaryCalls.push(sessionId);
       return summaryImpl(sessionId);
     },
+    async getSessionArtifacts(sessionId) {
+      sessionArtifactsCalls.push(sessionId);
+      return getSessionArtifactsImpl(sessionId);
+    },
+    async addSessionArtifact(sessionId, artifact, context) {
+      addSessionArtifactCalls.push({
+        sessionId,
+        artifact,
+        ...(context ? { context } : {}),
+      });
+      return addSessionArtifactImpl(sessionId, artifact, context);
+    },
+    async removeSessionArtifact(sessionId, artifactId, context) {
+      removeSessionArtifactCalls.push({
+        sessionId,
+        artifactId,
+        ...(context ? { context } : {}),
+      });
+      return removeSessionArtifactImpl(sessionId, artifactId, context);
+    },
     async getWorkspaceMcpStatus() {
       workspaceMcpCalls += 1;
       return workspaceMcpImpl();
@@ -6912,6 +7008,172 @@ describe('createServeApp', () => {
     });
   });
 
+  describe('session artifact routes', () => {
+    const tokenOpts: ServeOptions = { ...baseOpts, token: 'secret' };
+    const auth = (req: request.Test): request.Test =>
+      req
+        .set('Host', `127.0.0.1:${tokenOpts.port}`)
+        .set('Authorization', 'Bearer secret');
+
+    it('GET /session/:id/artifacts returns the bridge snapshot', async () => {
+      const bridge = fakeBridge({
+        getSessionArtifactsImpl: async (sessionId) => ({
+          v: 1,
+          sessionId,
+          artifacts: [
+            {
+              id: 'artifact-1',
+              kind: 'link',
+              storage: 'external_url',
+              source: 'tool',
+              status: 'available',
+              title: 'Lineage',
+              url: 'https://example.com/lineage',
+              clientRetained: false,
+              createdAt: '2026-01-01T00:00:00.000Z',
+              updatedAt: '2026-01-01T00:00:00.000Z',
+            },
+          ],
+          generatedAt: '2026-01-01T00:00:00.000Z',
+          limits: { maxArtifacts: 200 },
+        }),
+      });
+      const app = createServeApp(tokenOpts, undefined, { bridge });
+
+      const res = await auth(request(app).get('/session/session-A/artifacts'));
+
+      expect(res.status).toBe(200);
+      expect(res.body).toMatchObject({
+        v: 1,
+        sessionId: 'session-A',
+        artifacts: [{ id: 'artifact-1', title: 'Lineage' }],
+      });
+      expect(bridge.sessionArtifactsCalls).toEqual(['session-A']);
+    });
+
+    it('GET /session/:id/artifacts returns 404 for an unknown session', async () => {
+      const bridge = fakeBridge({
+        getSessionArtifactsImpl: async (sessionId) => {
+          throw new SessionNotFoundError(sessionId);
+        },
+      });
+      const app = createServeApp(tokenOpts, undefined, { bridge });
+
+      const res = await auth(request(app).get('/session/ghost/artifacts'));
+
+      expect(res.status).toBe(404);
+      expect(res.body.sessionId).toBe('ghost');
+      expect(bridge.sessionArtifactsCalls).toEqual(['ghost']);
+    });
+
+    it('POST /session/:id/artifacts requires strict mutation auth', async () => {
+      const bridge = fakeBridge();
+      const app = createServeApp(baseOpts, undefined, { bridge });
+
+      const res = await request(app)
+        .post('/session/session-A/artifacts')
+        .set('Host', `127.0.0.1:${baseOpts.port}`)
+        .send({ title: 'Lineage', url: 'https://example.com/lineage' });
+
+      expect(res.status).toBe(401);
+      expect(res.body.code).toBe('token_required');
+      expect(bridge.addSessionArtifactCalls).toHaveLength(0);
+    });
+
+    it('POST /session/:id/artifacts forwards body and client context', async () => {
+      const bridge = fakeBridge();
+      const app = createServeApp(tokenOpts, undefined, { bridge });
+
+      const res = await auth(request(app).post('/session/session-A/artifacts'))
+        .set('X-Qwen-Client-Id', 'client-1')
+        .send({ title: 'Lineage', url: 'https://example.com/lineage' });
+
+      expect(res.status).toBe(200);
+      expect(res.body).toMatchObject({
+        v: 1,
+        sessionId: 'session-A',
+        changes: [
+          {
+            action: 'created',
+            artifact: { title: 'Lineage', clientId: 'client-1' },
+          },
+        ],
+      });
+      expect(bridge.addSessionArtifactCalls).toEqual([
+        {
+          sessionId: 'session-A',
+          artifact: {
+            title: 'Lineage',
+            url: 'https://example.com/lineage',
+          },
+          context: { clientId: 'client-1' },
+        },
+      ]);
+    });
+
+    it('POST /session/:id/artifacts maps artifact validation errors', async () => {
+      const bridge = fakeBridge({
+        addSessionArtifactImpl: async () => {
+          throw new SessionArtifactValidationError(
+            'url scheme is not allowed',
+            'url',
+          );
+        },
+      });
+      const app = createServeApp(tokenOpts, undefined, { bridge });
+
+      const res = await auth(
+        request(app).post('/session/session-A/artifacts'),
+      ).send({ title: 'Bad link', url: 'javascript:alert(1)' });
+
+      expect(res.status).toBe(400);
+      expect(res.body).toEqual({
+        v: 1,
+        error: {
+          code: 'VALIDATION_FAILED',
+          message: 'url scheme is not allowed',
+          field: 'url',
+        },
+      });
+    });
+
+    it('DELETE /session/:id/artifacts/:artifactId requires strict mutation auth', async () => {
+      const bridge = fakeBridge();
+      const app = createServeApp(baseOpts, undefined, { bridge });
+
+      const res = await request(app)
+        .delete('/session/session-A/artifacts/artifact-1')
+        .set('Host', `127.0.0.1:${baseOpts.port}`);
+
+      expect(res.status).toBe(401);
+      expect(res.body.code).toBe('token_required');
+      expect(bridge.removeSessionArtifactCalls).toHaveLength(0);
+    });
+
+    it('DELETE /session/:id/artifacts/:artifactId is idempotent for missing artifacts', async () => {
+      const bridge = fakeBridge();
+      const app = createServeApp(tokenOpts, undefined, { bridge });
+
+      const res = await auth(
+        request(app).delete('/session/session-A/artifacts/missing'),
+      ).set('X-Qwen-Client-Id', 'client-1');
+
+      expect(res.status).toBe(200);
+      expect(res.body).toEqual({
+        v: 1,
+        sessionId: 'session-A',
+        changes: [],
+      });
+      expect(bridge.removeSessionArtifactCalls).toEqual([
+        {
+          sessionId: 'session-A',
+          artifactId: 'missing',
+          context: { clientId: 'client-1' },
+        },
+      ]);
+    });
+  });
+
   describe('POST /session/:id/model', () => {
     it('200 with the agent response on success', async () => {
       const bridge = fakeBridge({
@@ -10308,13 +10570,18 @@ describe('createServeApp', () => {
   });
 
   describe('PATCH /session/:id/metadata', () => {
+    const tokenOpts: ServeOptions = { ...baseOpts, token: 'secret' };
+    const auth = (req: request.Test): request.Test =>
+      req
+        .set('Host', `127.0.0.1:${tokenOpts.port}`)
+        .set('Authorization', 'Bearer secret');
+
     it('200 on successful metadata update', async () => {
       const bridge = fakeBridge();
-      const app = createServeApp(baseOpts, undefined, { bridge });
-      const res = await request(app)
-        .patch('/session/session-A/metadata')
-        .set('Host', `127.0.0.1:${baseOpts.port}`)
-        .send({ displayName: 'My Session' });
+      const app = createServeApp(tokenOpts, undefined, { bridge });
+      const res = await auth(
+        request(app).patch('/session/session-A/metadata'),
+      ).send({ displayName: 'My Session' });
       expect(res.status).toBe(200);
       expect(res.body).toEqual({
         sessionId: 'session-A',
@@ -10327,12 +10594,33 @@ describe('createServeApp', () => {
       });
     });
 
-    it('passes client identity context', async () => {
+    it('requires mutation auth before updating metadata', async () => {
       const bridge = fakeBridge();
-      const app = createServeApp(baseOpts, undefined, { bridge });
-      const res = await request(app)
+      const noTokenApp = createServeApp(baseOpts, undefined, { bridge });
+
+      const noToken = await request(noTokenApp)
         .patch('/session/session-A/metadata')
         .set('Host', `127.0.0.1:${baseOpts.port}`)
+        .send({ displayName: 'blocked' });
+      expect(noToken.status).toBe(401);
+      expect(noToken.body.code).toBe('token_required');
+      expect(bridge.updateMetadataCalls).toHaveLength(0);
+
+      const app = createServeApp(tokenOpts, undefined, { bridge });
+      const authed = await auth(
+        request(app).patch('/session/session-A/metadata'),
+      ).send({ displayName: 'allowed' });
+      expect(authed.status).toBe(200);
+      expect(bridge.updateMetadataCalls).toHaveLength(1);
+      expect(bridge.updateMetadataCalls[0]?.metadata).toEqual({
+        displayName: 'allowed',
+      });
+    });
+
+    it('passes client identity context', async () => {
+      const bridge = fakeBridge();
+      const app = createServeApp(tokenOpts, undefined, { bridge });
+      const res = await auth(request(app).patch('/session/session-A/metadata'))
         .set('X-Qwen-Client-Id', 'client-1')
         .send({ displayName: 'test' });
       expect(res.status).toBe(200);
@@ -10343,11 +10631,10 @@ describe('createServeApp', () => {
 
     it('400 when displayName is not a string', async () => {
       const bridge = fakeBridge();
-      const app = createServeApp(baseOpts, undefined, { bridge });
-      const res = await request(app)
-        .patch('/session/session-A/metadata')
-        .set('Host', `127.0.0.1:${baseOpts.port}`)
-        .send({ displayName: 123 });
+      const app = createServeApp(tokenOpts, undefined, { bridge });
+      const res = await auth(
+        request(app).patch('/session/session-A/metadata'),
+      ).send({ displayName: 123 });
       expect(res.status).toBe(400);
       expect(res.body.code).toBe('invalid_metadata');
       expect(res.body.field).toBe('displayName');
@@ -10359,11 +10646,10 @@ describe('createServeApp', () => {
           throw new SessionNotFoundError(sessionId);
         },
       });
-      const app = createServeApp(baseOpts, undefined, { bridge });
-      const res = await request(app)
-        .patch('/session/missing/metadata')
-        .set('Host', `127.0.0.1:${baseOpts.port}`)
-        .send({ displayName: 'test' });
+      const app = createServeApp(tokenOpts, undefined, { bridge });
+      const res = await auth(
+        request(app).patch('/session/missing/metadata'),
+      ).send({ displayName: 'test' });
       expect(res.status).toBe(404);
       expect(res.body.sessionId).toBe('missing');
     });
@@ -10377,11 +10663,10 @@ describe('createServeApp', () => {
           );
         },
       });
-      const app = createServeApp(baseOpts, undefined, { bridge });
-      const res = await request(app)
-        .patch('/session/session-A/metadata')
-        .set('Host', `127.0.0.1:${baseOpts.port}`)
-        .send({ displayName: 'x'.repeat(300) });
+      const app = createServeApp(tokenOpts, undefined, { bridge });
+      const res = await auth(
+        request(app).patch('/session/session-A/metadata'),
+      ).send({ displayName: 'x'.repeat(300) });
       expect(res.status).toBe(400);
       expect(res.body.code).toBe('invalid_metadata');
     });
diff --git a/packages/cli/src/serve/server/telemetry.ts b/packages/cli/src/serve/server/telemetry.ts
index dd4adec562..1767d16a96 100644
--- a/packages/cli/src/serve/server/telemetry.ts
+++ b/packages/cli/src/serve/server/telemetry.ts
@@ -53,6 +53,30 @@ export function resolveDaemonTelemetryRoute(
       sessionId: sessionMetadata[1],
     };
   }
+  const sessionArtifacts = path.match(/^\/session\/([^/]+)\/artifacts$/);
+  if (sessionArtifacts?.[1]) {
+    if (req.method === 'GET') {
+      return {
+        route: 'GET /session/:id/artifacts',
+        sessionId: sessionArtifacts[1],
+      };
+    }
+    if (req.method === 'POST') {
+      return {
+        route: 'POST /session/:id/artifacts',
+        sessionId: sessionArtifacts[1],
+      };
+    }
+  }
+  const sessionArtifact = path.match(
+    /^\/session\/([^/]+)\/artifacts\/([^/]+)$/,
+  );
+  if (sessionArtifact?.[1] && req.method === 'DELETE') {
+    return {
+      route: 'DELETE /session/:id/artifacts/:artifactId',
+      sessionId: sessionArtifact[1],
+    };
+  }
   const sessionPermission = path.match(
     /^\/session\/([^/]+)\/permission\/([^/]+)$/,
   );
diff --git a/packages/core/src/agents/runtime/agent-core.ts b/packages/core/src/agents/runtime/agent-core.ts
index 8ec00c15a3..6188dd7b44 100644
--- a/packages/core/src/agents/runtime/agent-core.ts
+++ b/packages/core/src/agents/runtime/agent-core.ts
@@ -145,6 +145,9 @@ export const EXCLUDED_TOOLS_FOR_SUBAGENTS: ReadonlySet<string> = new Set([
   // never enter or exit the user's worktree state independently.
   ToolNames.ENTER_WORKTREE,
   ToolNames.EXIT_WORKTREE,
+  // V1 session artifacts are owned by the parent daemon session.
+  ToolNames.ARTIFACT,
+  ToolNames.RECORD_ARTIFACT,
   // FIX-8 (SEC-I1): WORKFLOW is excluded to prevent unbounded recursive
   // fan-out: a subagent spawned by Workflow that calls Workflow would create
   // O(k^n) subagents.
diff --git a/packages/core/src/config/config.test.ts b/packages/core/src/config/config.test.ts
index 28fac59477..32c0ed676a 100644
--- a/packages/core/src/config/config.test.ts
+++ b/packages/core/src/config/config.test.ts
@@ -1923,6 +1923,49 @@ describe('Server Config (config.ts)', () => {
       expect(registeredNames).toContain(ToolNames.READ_MCP_RESOURCE);
     });
 
+    it('does not register artifact tools when artifacts are disabled', async () => {
+      const config = new Config({ ...baseParams });
+      await config.initialize();
+
+      const registeredNames = (
+        ToolRegistry.prototype.registerFactory as Mock
+      ).mock.calls.map((call) => call[0]);
+      expect(registeredNames).not.toContain(ToolNames.ARTIFACT);
+      expect(registeredNames).not.toContain(ToolNames.RECORD_ARTIFACT);
+    });
+
+    it('registers both artifact tools when artifacts are enabled', async () => {
+      const config = new Config({
+        ...baseParams,
+        artifactEnabled: true,
+        interactive: true,
+        sdkMode: false,
+      });
+      await config.initialize();
+
+      const registeredNames = (
+        ToolRegistry.prototype.registerFactory as Mock
+      ).mock.calls.map((call) => call[0]);
+      expect(registeredNames).toContain(ToolNames.ARTIFACT);
+      expect(registeredNames).toContain(ToolNames.RECORD_ARTIFACT);
+    });
+
+    it('registers only record_artifact for daemon artifact metadata', async () => {
+      const config = new Config({
+        ...baseParams,
+        artifactEnabled: true,
+        interactive: false,
+        sdkMode: false,
+      });
+      await config.initialize();
+
+      const registeredNames = (
+        ToolRegistry.prototype.registerFactory as Mock
+      ).mock.calls.map((call) => call[0]);
+      expect(registeredNames).not.toContain(ToolNames.ARTIFACT);
+      expect(registeredNames).toContain(ToolNames.RECORD_ARTIFACT);
+    });
+
     describe('isArtifactEnabled', () => {
       const originalForceEnable = process.env['QWEN_CODE_ENABLE_ARTIFACT'];
       const originalDisable = process.env['QWEN_CODE_DISABLE_ARTIFACT'];
@@ -1986,7 +2029,7 @@ describe('Server Config (config.ts)', () => {
         expect(config.isArtifactEnabled()).toBe(false);
       });
 
-      it('stays disabled outside interactive mode even when force-enabled', () => {
+      it('keeps the Artifact tool disabled for daemon CLI env enablement', () => {
         process.env['QWEN_CODE_ENABLE_ARTIFACT'] = '1';
 
         const config = new Config({
@@ -1996,6 +2039,19 @@ describe('Server Config (config.ts)', () => {
         });
 
         expect(config.isArtifactEnabled()).toBe(false);
+        expect(config.isRecordArtifactEnabled()).toBe(true);
+      });
+
+      it('lets daemon sessions record metadata from settings without publishing', () => {
+        const config = new Config({
+          ...baseParams,
+          artifactEnabled: true,
+          interactive: false,
+          sdkMode: false,
+        });
+
+        expect(config.isArtifactEnabled()).toBe(false);
+        expect(config.isRecordArtifactEnabled()).toBe(true);
       });
 
       it('lets QWEN_CODE_ENABLE_ARTIFACT force-enable interactive CLI use', () => {
diff --git a/packages/core/src/config/config.ts b/packages/core/src/config/config.ts
index 07922ac389..7ccd2cf926 100644
--- a/packages/core/src/config/config.ts
+++ b/packages/core/src/config/config.ts
@@ -1478,7 +1478,7 @@ export class Config {
    * the model later calls a tool that no longer exists (see
    * `CoreToolScheduler.getToolNotFoundMessage`). Self-heals: a name is dropped
    * from the set the moment the server reappears in the effective map.
-   */
+  */
   private readonly recentlyRemovedMcpServers = new Set<string>();
   private readonly topTierMcpServers:
     | Record<string, MCPServerConfig>
@@ -5005,11 +5005,20 @@ export class Config {
   isArtifactEnabled(): boolean {
     // Artifacts are experimental and opt-in. Publishing writes outside the
     // project and opens a browser, so it is limited to interactive, non-SDK
-    // sessions. QWEN_CODE_DISABLE_ARTIFACT hard-disables;
-    // QWEN_CODE_ENABLE_ARTIFACT force-enables (still subject to the
-    // interactive/SDK gate).
+    // sessions. QWEN_CODE_DISABLE_ARTIFACT hard-disables both artifact tools;
+    // QWEN_CODE_ENABLE_ARTIFACT force-enables interactive artifact tooling
+    // here. isRecordArtifactEnabled() also treats it as an opt-in for the
+    // metadata-only daemon record_artifact tool.
     if (process.env['QWEN_CODE_DISABLE_ARTIFACT'] === '1') return false;
-    if (this.sdkMode || !this.interactive) return false;
+    if (this.sdkMode) return false;
+    if (!this.interactive) return false;
+    if (process.env['QWEN_CODE_ENABLE_ARTIFACT'] === '1') return true;
+    return this.artifactEnabled;
+  }
+
+  isRecordArtifactEnabled(): boolean {
+    if (process.env['QWEN_CODE_DISABLE_ARTIFACT'] === '1') return false;
+    if (this.sdkMode) return false;
     if (process.env['QWEN_CODE_ENABLE_ARTIFACT'] === '1') return true;
     return this.artifactEnabled;
   }
@@ -6123,6 +6132,14 @@ export class Config {
         return new ArtifactTool(this);
       });
     }
+    if (this.isRecordArtifactEnabled()) {
+      await registerLazy(ToolNames.RECORD_ARTIFACT, async () => {
+        const { RecordArtifactTool } = await import(
+          '../tools/record-artifact.js'
+        );
+        return new RecordArtifactTool();
+      });
+    }
     if (this.isLspEnabled() && this.getLspClient()) {
       await registerLazy(ToolNames.LSP, async () => {
         const { LspTool } = await import('../tools/lsp.js');
diff --git a/packages/core/src/config/config.workflow-registration.test.ts b/packages/core/src/config/config.workflow-registration.test.ts
index 1a10b42251..9528301ded 100644
--- a/packages/core/src/config/config.workflow-registration.test.ts
+++ b/packages/core/src/config/config.workflow-registration.test.ts
@@ -169,4 +169,14 @@ describe('Workflow anti-recursion guard', () => {
     );
     expect(EXCLUDED_TOOLS_FOR_SUBAGENTS.has(ToolNames.WORKFLOW)).toBe(true);
   });
+
+  it('artifact tools are in EXCLUDED_TOOLS_FOR_SUBAGENTS', async () => {
+    const { EXCLUDED_TOOLS_FOR_SUBAGENTS } = await import(
+      '../agents/runtime/agent-core.js'
+    );
+    expect(EXCLUDED_TOOLS_FOR_SUBAGENTS.has(ToolNames.ARTIFACT)).toBe(true);
+    expect(EXCLUDED_TOOLS_FOR_SUBAGENTS.has(ToolNames.RECORD_ARTIFACT)).toBe(
+      true,
+    );
+  });
 });
diff --git a/packages/core/src/core/coreToolScheduler.test.ts b/packages/core/src/core/coreToolScheduler.test.ts
index 37b62c1256..59c855c4d7 100644
--- a/packages/core/src/core/coreToolScheduler.test.ts
+++ b/packages/core/src/core/coreToolScheduler.test.ts
@@ -2186,6 +2186,12 @@ describe('CoreToolScheduler', () => {
                       hookSpecificOutput: {
                         hookEventName: 'PostToolBatch',
                         additionalContext: 'batch context',
+                        artifacts: [
+                          {
+                            title: 'Batch report',
+                            workspacePath: 'batch.html',
+                          },
+                        ],
                       },
                     }
                   : { decision: 'allow' },
@@ -2283,13 +2289,20 @@ describe('CoreToolScheduler', () => {
       .calls as unknown as Array<[ToolCall[]]>;
     const completedCalls = completionCalls[0]?.[0];
     const lastCompletedCall = completedCalls?.at(-1);
-    const lastResponse =
+    const lastCompletedResponse =
       lastCompletedCall && 'response' in lastCompletedCall
-        ? lastCompletedCall.response.responseParts.at(-1)
+        ? lastCompletedCall.response
         : undefined;
+    const lastResponse = lastCompletedResponse?.responseParts.at(-1);
     expect(lastResponse?.functionResponse?.response?.['output']).toContain(
       'batch context',
     );
+    expect(lastCompletedResponse?.artifacts).toEqual([
+      {
+        title: 'Batch report',
+        workspacePath: 'batch.html',
+      },
+    ]);
     expect(
       (
         scheduler as unknown as {
@@ -6672,9 +6685,14 @@ describe('CoreToolScheduler telemetry spans', () => {
   }
 
   function buildScheduler(options: {
-    execute?: () => Promise<ToolResult>;
+    execute?: (
+      params: { [key: string]: unknown },
+      signal?: AbortSignal,
+      updateOutput?: (output: string) => void,
+    ) => Promise<ToolResult>;
     messageBus?: { request: ReturnType<typeof vi.fn> };
     disableHooks?: boolean;
+    canUpdateOutput?: boolean;
     includeSensitiveSpanAttributes?: boolean;
     sensitiveSpanAttributeMaxLength?: number;
   }): {
@@ -6683,6 +6701,7 @@ describe('CoreToolScheduler telemetry spans', () => {
   } {
     const mockTool = new MockTool({
       name: 'mockTool',
+      canUpdateOutput: options.canUpdateOutput,
       execute:
         options.execute ??
         vi.fn().mockResolvedValue({
@@ -6748,10 +6767,15 @@ describe('CoreToolScheduler telemetry spans', () => {
 
   async function runSingleTool(
     options: {
-      execute?: () => Promise<ToolResult>;
+      execute?: (
+        params: { [key: string]: unknown },
+        signal?: AbortSignal,
+        updateOutput?: (output: string) => void,
+      ) => Promise<ToolResult>;
       messageBus?: { request: ReturnType<typeof vi.fn> };
       disableHooks?: boolean;
       abortController?: AbortController;
+      canUpdateOutput?: boolean;
       throwSpanSetAttribute?: boolean;
       throwSpanSetStatus?: boolean;
       includeSensitiveSpanAttributes?: boolean;
@@ -6986,6 +7010,116 @@ describe('CoreToolScheduler telemetry spans', () => {
     expectSanitizedFailure(spanRecord, 'Tool execution failed', 'tool_error');
   });
 
+  it('preserves PostToolUseFailure artifacts on toolResult.error responses', async () => {
+    const messageBus = {
+      request: vi
+        .fn()
+        .mockResolvedValueOnce({
+          type: MessageBusType.HOOK_EXECUTION_RESPONSE,
+          correlationId: 'pre-hook',
+          success: true,
+          output: { decision: 'allow' },
+        })
+        .mockResolvedValueOnce({
+          type: MessageBusType.HOOK_EXECUTION_RESPONSE,
+          correlationId: 'failure-hook',
+          success: true,
+          output: {
+            hookSpecificOutput: {
+              artifacts: [
+                {
+                  title: 'Failure report',
+                  workspacePath: 'reports/failure.html',
+                },
+              ],
+            },
+          },
+        }),
+    };
+
+    const { completedCalls } = await runSingleTool({
+      messageBus,
+      disableHooks: false,
+      execute: vi.fn().mockResolvedValue({
+        llmContent: 'failed',
+        returnDisplay: 'failed',
+        error: {
+          message: 'tool failed',
+          type: ToolErrorType.EXECUTION_FAILED,
+        },
+      }),
+    });
+
+    const completedCall = completedCalls[0];
+    expect(completedCall.status).toBe('error');
+    if (completedCall.status === 'error') {
+      expect(completedCall.response.artifacts).toEqual([
+        {
+          title: 'Failure report',
+          workspacePath: 'reports/failure.html',
+        },
+      ]);
+    }
+  });
+
+  it('preserves PostToolUse artifacts on successful responses', async () => {
+    const messageBus = {
+      request: vi
+        .fn()
+        .mockResolvedValueOnce({
+          type: MessageBusType.HOOK_EXECUTION_RESPONSE,
+          correlationId: 'pre-hook',
+          success: true,
+          output: { decision: 'allow' },
+        })
+        .mockResolvedValueOnce({
+          type: MessageBusType.HOOK_EXECUTION_RESPONSE,
+          correlationId: 'post-hook',
+          success: true,
+          output: {
+            hookSpecificOutput: {
+              artifacts: [
+                {
+                  title: 'Hook report',
+                  workspacePath: 'reports/hook.html',
+                },
+              ],
+            },
+          },
+        }),
+    };
+
+    const { completedCalls } = await runSingleTool({
+      messageBus,
+      disableHooks: false,
+      execute: vi.fn().mockResolvedValue({
+        llmContent: 'ok',
+        returnDisplay: 'ok',
+        artifacts: [
+          {
+            title: 'Tool report',
+            workspacePath: 'reports/tool.html',
+          },
+        ],
+      }),
+    });
+
+    const completedCall = completedCalls[0];
+    expect(completedCall.status).toBe('success');
+    if (completedCall.status === 'success') {
+      expect(completedCall.response.artifacts).toEqual([
+        {
+          title: 'Tool report',
+          workspacePath: 'reports/tool.html',
+        },
+        {
+          title: 'Hook report',
+          workspacePath: 'reports/hook.html',
+        },
+      ]);
+    }
+  });
+
   it('sets tool failure status when span attribute recording fails', async () => {
     const { spanRecord, completedCalls } = await runSingleTool({
       throwSpanSetAttribute: true,
@@ -7617,6 +7751,146 @@ describe('CoreToolScheduler telemetry spans', () => {
     expect(failureHookSpan!.hookMetadata?.success).toBe(true);
   });
 
+  it('preserves PostToolUseFailure artifacts on user-abort cancellations', async () => {
+    const abortController = new AbortController();
+    const messageBus = {
+      request: vi.fn(async (req: { eventName: string }) => ({
+        type: MessageBusType.HOOK_EXECUTION_RESPONSE,
+        correlationId: `${req.eventName}-hook`,
+        success: true,
+        output:
+          req.eventName === 'PostToolUseFailure'
+            ? {
+                hookSpecificOutput: {
+                  artifacts: [
+                    {
+                      title: 'Cancel report',
+                      workspacePath: 'reports/cancel.html',
+                    },
+                  ],
+                },
+              }
+            : { decision: 'allow' },
+      })),
+    };
+
+    const { completedCalls } = await runSingleTool({
+      abortController,
+      messageBus,
+      disableHooks: false,
+      execute: vi.fn().mockImplementation(async () => {
+        abortController.abort();
+        throw new Error('aborted');
+      }),
+    });
+
+    const completedCall = completedCalls[0];
+    expect(completedCall.status).toBe('cancelled');
+    if (completedCall.status === 'cancelled') {
+      expect(completedCall.response.artifacts).toEqual([
+        {
+          title: 'Cancel report',
+          workspacePath: 'reports/cancel.html',
+        },
+      ]);
+    }
+  });
+
+  it('preserves PostToolUseFailure artifacts when an aborted tool resolves', async () => {
+    const abortController = new AbortController();
+    const messageBus = {
+      request: vi.fn(async (req: { eventName: string }) => ({
+        type: MessageBusType.HOOK_EXECUTION_RESPONSE,
+        correlationId: `${req.eventName}-hook`,
+        success: true,
+        output:
+          req.eventName === 'PostToolUseFailure'
+            ? {
+                hookSpecificOutput: {
+                  artifacts: [
+                    {
+                      title: 'Resolved cancel report',
+                      workspacePath: 'reports/resolved-cancel.html',
+                    },
+                  ],
+                },
+              }
+            : { decision: 'allow' },
+      })),
+    };
+
+    const { completedCalls } = await runSingleTool({
+      abortController,
+      messageBus,
+      disableHooks: false,
+      execute: vi.fn().mockImplementation(async () => {
+        abortController.abort();
+        return { llmContent: 'done', returnDisplay: 'done' };
+      }),
+    });
+
+    const completedCall = completedCalls[0];
+    expect(completedCall.status).toBe('cancelled');
+    if (completedCall.status === 'cancelled') {
+      expect(completedCall.response.artifacts).toEqual([
+        {
+          title: 'Resolved cancel report',
+          workspacePath: 'reports/resolved-cancel.html',
+        },
+      ]);
+    }
+  });
+
+  it('preserves live output when hook artifacts are attached to user-abort cancellations', async () => {
+    const abortController = new AbortController();
+    const messageBus = {
+      request: vi.fn(async (req: { eventName: string }) => ({
+        type: MessageBusType.HOOK_EXECUTION_RESPONSE,
+        correlationId: `${req.eventName}-hook`,
+        success: true,
+        output:
+          req.eventName === 'PostToolUseFailure'
+            ? {
+                hookSpecificOutput: {
+                  artifacts: [
+                    {
+                      title: 'Cancel report',
+                      workspacePath: 'reports/cancel.html',
+                    },
+                  ],
+                },
+              }
+            : { decision: 'allow' },
+      })),
+    };
+
+    const { completedCalls } = await runSingleTool({
+      abortController,
+      messageBus,
+      disableHooks: false,
+      canUpdateOutput: true,
+      execute: vi.fn(async (_params, _signal, updateOutput) => {
+        updateOutput?.('live output before abort');
+        abortController.abort();
+        throw new Error('aborted');
+      }),
+    });
+
+    const completedCall = completedCalls[0];
+    expect(completedCall.status).toBe('cancelled');
+    if (completedCall.status === 'cancelled') {
+      expect(completedCall.response.resultDisplay).toBe(
+        'live output before abort',
+      );
+      expect(completedCall.response.artifacts).toEqual([
+        {
+          title: 'Cancel report',
+          workspacePath: 'reports/cancel.html',
+        },
+      ]);
+    }
+  });
+
   it('PostToolUseFailure hook span records is_interrupt=false on real exception path (#4321)', async () => {
     // Companion to the abort test — same hook event but the
     // executeError-not-from-abort branch tags is_interrupt:false. A
@@ -7645,6 +7919,46 @@ describe('CoreToolScheduler telemetry spans', () => {
     expect(failureHookSpan!.hookMetadata?.success).toBe(true);
   });
 
+  it('preserves PostToolUseFailure artifacts on thrown exceptions', async () => {
+    const messageBus = {
+      request: vi.fn(async (req: { eventName: string }) => ({
+        type: MessageBusType.HOOK_EXECUTION_RESPONSE,
+        correlationId: `${req.eventName}-hook`,
+        success: true,
+        output:
+          req.eventName === 'PostToolUseFailure'
+            ? {
+                hookSpecificOutput: {
+                  artifacts: [
+                    {
+                      title: 'Exception report',
+                      workspacePath: 'reports/exception.html',
+                    },
+                  ],
+                },
+              }
+            : { decision: 'allow' },
+      })),
+    };
+
+    const { completedCalls } = await runSingleTool({
+      messageBus,
+      disableHooks: false,
+      execute: vi.fn().mockRejectedValue(new Error('real boom')),
+    });
+
+    const completedCall = completedCalls[0];
+    expect(completedCall.status).toBe('error');
+    if (completedCall.status === 'error') {
+      expect(completedCall.response.artifacts).toEqual([
+        {
+          title: 'Exception report',
+          workspacePath: 'reports/exception.html',
+        },
+      ]);
+    }
+  });
+
   it('every span recorded in a successful tool call is ended (#3731 Phase 2)', async () => {
     // Leak guard: every span we record should be ended by the time
     // schedule() returns. If a future change forgets to finalize a tool
diff --git a/packages/core/src/core/coreToolScheduler.ts b/packages/core/src/core/coreToolScheduler.ts
index 4cb69e853d..d740c81159 100644
--- a/packages/core/src/core/coreToolScheduler.ts
+++ b/packages/core/src/core/coreToolScheduler.ts
@@ -17,6 +17,7 @@ import type {
   AnyDeclarativeTool,
   AnyToolInvocation,
   ChatRecordingService,
+  ToolArtifact,
 } from '../index.js';
 import { createDebugLogger } from '../utils/debugLogger.js';
 import { compactToolResultDisplayForHistory } from '../utils/toolResultDisplayCompaction.js';
@@ -832,6 +833,7 @@ const createErrorResponse = (
   request: ToolCallRequestInfo,
   error: Error,
   errorType: ToolErrorType | undefined,
+  artifacts?: ToolArtifact[],
 ): ToolCallResponseInfo => ({
   callId: request.callId,
   error,
@@ -847,8 +849,45 @@ const createErrorResponse = (
   resultDisplay: error.message,
   errorType,
   contentLength: error.message.length,
+  ...(artifacts && artifacts.length > 0 ? { artifacts } : {}),
 });
 
+const createCancelledResponse = (
+  request: ToolCallRequestInfo,
+  reason: string,
+  artifacts?: ToolArtifact[],
+): ToolCallResponseInfo => {
+  const errorMessage = `[Operation Cancelled] Reason: ${reason}`;
+  return {
+    callId: request.callId,
+    responseParts: [
+      {
+        functionResponse: {
+          id: request.callId,
+          name: request.name,
+          response: { error: errorMessage },
+        },
+      },
+    ],
+    resultDisplay: undefined,
+    error: undefined,
+    errorType: undefined,
+    contentLength: errorMessage.length,
+    ...(artifacts && artifacts.length > 0 ? { artifacts } : {}),
+  };
+};
+
+function isToolCallResponseInfo(value: unknown): value is ToolCallResponseInfo {
+  if (typeof value !== 'object' || value === null) {
+    return false;
+  }
+  const candidate = value as Partial<ToolCallResponseInfo>;
+  return (
+    typeof candidate.callId === 'string' &&
+    Array.isArray(candidate.responseParts)
+  );
+}
+
 function serializeToolResponse(
   response: ToolCallResponseInfo,
 ): Record<string, unknown> {
@@ -991,6 +1030,34 @@ function withPostToolBatchAdditionalContext(
   return calls;
 }
 
+function withPostToolBatchArtifacts(
+  completedCalls: CompletedToolCall[],
+  artifacts: ToolArtifact[] | undefined,
+): CompletedToolCall[] {
+  if (!artifacts || artifacts.length === 0 || completedCalls.length === 0) {
+    return completedCalls;
+  }
+
+  const calls = [...completedCalls];
+  const lastIndex = calls.length - 1;
+  const lastCall = calls[lastIndex];
+  if (!lastCall) {
+    return completedCalls;
+  }
+
+  // PostToolBatch hook output is batch-level and carries no per-call target.
+  // Attach it to the last completed call so the bridge receives it once.
+  const existingArtifacts = lastCall.response.artifacts ?? [];
+  calls[lastIndex] = {
+    ...lastCall,
+    response: {
+      ...lastCall.response,
+      artifacts: [...existingArtifacts, ...artifacts],
+    },
+  };
+  return calls;
+}
+
 function withPostToolBatchStop(
   completedCalls: CompletedToolCall[],
   stopReason: string,
@@ -1183,7 +1250,7 @@ export class CoreToolScheduler {
   private setStatusInternal(
     targetCallId: string,
     status: 'cancelled',
-    reason: string,
+    reason: string | ToolCallResponseInfo,
   ): void;
   private setStatusInternal(
     targetCallId: string,
@@ -1295,31 +1362,39 @@ export class CoreToolScheduler {
             }
           }
 
+          const preservedResultDisplay =
+            this.compactResultDisplayForInteractiveHistory(resultDisplay);
           const errorMessage = `[Operation Cancelled] Reason: ${auxiliaryData}`;
+          const response = isToolCallResponseInfo(auxiliaryData)
+            ? {
+                ...auxiliaryData,
+                resultDisplay:
+                  auxiliaryData.resultDisplay ?? preservedResultDisplay,
+              }
+            : {
+                callId: currentCall.request.callId,
+                responseParts: [
+                  {
+                    functionResponse: {
+                      id: currentCall.request.callId,
+                      name: currentCall.request.name,
+                      response: {
+                        error: errorMessage,
+                      },
+                    },
+                  },
+                ],
+                resultDisplay: preservedResultDisplay,
+                error: undefined,
+                errorType: undefined,
+                contentLength: errorMessage.length,
+              };
           return {
             request: currentCall.request,
             tool: toolInstance,
             invocation,
             status: 'cancelled',
-            response: {
-              callId: currentCall.request.callId,
-              responseParts: [
-                {
-                  functionResponse: {
-                    id: currentCall.request.callId,
-                    name: currentCall.request.name,
-                    response: {
-                      error: errorMessage,
-                    },
-                  },
-                },
-              ],
-              resultDisplay:
-                this.compactResultDisplayForInteractiveHistory(resultDisplay),
-              error: undefined,
-              errorType: undefined,
-              contentLength: errorMessage.length,
-            },
+            response,
             durationMs,
             outcome,
           } as CancelledToolCall;
@@ -3464,6 +3539,7 @@ export class CoreToolScheduler {
       if (aborted) {
         // PostToolUseFailure Hook
         let cancelMessage = 'User cancelled tool execution.';
+        let failureHookArtifacts: ToolArtifact[] | undefined;
         if (hooksEnabled && messageBus) {
           const failureHookResult = await this.withHookSpan(
             {
@@ -3490,13 +3566,24 @@ export class CoreToolScheduler {
           if (failureHookResult.additionalContext) {
             cancelMessage += `\n\n${failureHookResult.additionalContext}`;
           }
+          failureHookArtifacts = failureHookResult.artifacts;
         }
         this.safelyAddToolResultAttributes(
           span,
           toolName,
           `CANCELLED: ${cancelMessage}`,
         );
-        this.setStatusInternal(callId, 'cancelled', cancelMessage);
+        this.setStatusInternal(
+          callId,
+          'cancelled',
+          failureHookArtifacts && failureHookArtifacts.length > 0
+            ? createCancelledResponse(
+                scheduledCall.request,
+                cancelMessage,
+                failureHookArtifacts,
+              )
+            : cancelMessage,
+        );
         setToolSpanCancelled(span);
         return; // Both code paths should return here
       }
@@ -3511,6 +3598,7 @@ export class CoreToolScheduler {
         // below, so the head/tail truncator never bisects a <system-reminder>
         // envelope or hook-injected context.
         let postToolUseAdditionalContext: string | undefined;
+        let postToolUseArtifacts: ToolArtifact[] | undefined;
         let reminderEnvelope: string | undefined;
 
         // PostToolUse Hook
@@ -3558,6 +3646,9 @@ export class CoreToolScheduler {
           if (postHookResult.additionalContext) {
             postToolUseAdditionalContext = postHookResult.additionalContext;
           }
+          if (postHookResult.artifacts && postHookResult.artifacts.length > 0) {
+            postToolUseArtifacts = postHookResult.artifacts;
+          }
 
           // Check if hook requested to stop execution
           if (postHookResult.shouldStop) {
@@ -3818,6 +3909,10 @@ export class CoreToolScheduler {
           typeof content === 'string' ? content.length : undefined;
 
         const response = convertToFunctionResponse(toolName, callId, content);
+        const artifacts = [
+          ...(toolResult.artifacts ?? []),
+          ...(postToolUseArtifacts ?? []),
+        ];
         const successResponse: ToolCallResponseInfo = {
           callId,
           responseParts: response,
@@ -3832,6 +3927,7 @@ export class CoreToolScheduler {
           ...('modelOverride' in toolResult
             ? { modelOverride: toolResult.modelOverride }
             : {}),
+          ...(artifacts.length > 0 ? { artifacts } : {}),
         };
         this.setStatusInternal(callId, 'success', successResponse);
         safeSetStatus(span, { code: SpanStatusCode.OK });
@@ -3847,6 +3943,7 @@ export class CoreToolScheduler {
         // It is a failure
         // PostToolUseFailure Hook
         let errorMessage = toolResult.error.message;
+        let failureHookArtifacts: ToolArtifact[] | undefined;
         if (hooksEnabled && messageBus) {
           const failureHookResult = await this.withHookSpan(
             {
@@ -3873,6 +3970,7 @@ export class CoreToolScheduler {
           if (failureHookResult.additionalContext) {
             errorMessage += `\n\n${failureHookResult.additionalContext}`;
           }
+          failureHookArtifacts = failureHookResult.artifacts;
         }
 
         // Truncate oversized error messages (e.g., large stderr)
@@ -3902,6 +4000,7 @@ export class CoreToolScheduler {
           scheduledCall.request,
           error,
           toolResult.error.type,
+          failureHookArtifacts,
         );
         this.setStatusInternal(callId, 'error', errorResponse);
         setToolSpanFailure(
@@ -3932,6 +4031,7 @@ export class CoreToolScheduler {
       if (aborted) {
         // PostToolUseFailure Hook (user interrupt)
         let cancelMessage = 'User cancelled tool execution.';
+        let failureHookArtifacts: ToolArtifact[] | undefined;
         if (hooksEnabled && messageBus) {
           const failureHookResult = await this.withHookSpan(
             {
@@ -3958,18 +4058,30 @@ export class CoreToolScheduler {
           if (failureHookResult.additionalContext) {
             cancelMessage += `\n\n${failureHookResult.additionalContext}`;
           }
+          failureHookArtifacts = failureHookResult.artifacts;
         }
         this.safelyAddToolResultAttributes(
           span,
           toolName,
           `CANCELLED: ${cancelMessage}`,
         );
-        this.setStatusInternal(callId, 'cancelled', cancelMessage);
+        this.setStatusInternal(
+          callId,
+          'cancelled',
+          failureHookArtifacts && failureHookArtifacts.length > 0
+            ? createCancelledResponse(
+                scheduledCall.request,
+                cancelMessage,
+                failureHookArtifacts,
+              )
+            : cancelMessage,
+        );
         setToolSpanCancelled(span);
         return;
       } else {
         // PostToolUseFailure Hook
         let exceptionErrorMessage = errorMessage;
+        let failureHookArtifacts: ToolArtifact[] | undefined;
         if (hooksEnabled && messageBus) {
           const failureHookResult = await this.withHookSpan(
             {
@@ -3996,6 +4108,7 @@ export class CoreToolScheduler {
           if (failureHookResult.additionalContext) {
             exceptionErrorMessage += `\n\n${failureHookResult.additionalContext}`;
           }
+          failureHookArtifacts = failureHookResult.artifacts;
         }
         this.safelyAddToolResultAttributes(
           span,
@@ -4011,6 +4124,7 @@ export class CoreToolScheduler {
               ? new Error(exceptionErrorMessage)
               : new Error(String(executionError)),
             ToolErrorType.UNHANDLED_EXCEPTION,
+            failureHookArtifacts,
           ),
         );
         setToolSpanFailure(
@@ -4085,6 +4199,7 @@ export class CoreToolScheduler {
                     success: true,
                     shouldStop: r.shouldStop,
                     hasAdditionalContext: !!r.additionalContext,
+                    hasArtifacts: !!r.artifacts?.length,
                     blockType: r.shouldStop ? 'stop' : undefined,
                     postBatchStop: r.shouldStop,
                     postBatchStopReason: r.shouldStop
@@ -4112,6 +4227,10 @@ export class CoreToolScheduler {
             completedCalls,
             batchHookResult.additionalContext,
           );
+          completedCalls = withPostToolBatchArtifacts(
+            completedCalls,
+            batchHookResult.artifacts,
+          );
         }
 
         // Per-message budget: offload the largest results if the batch's
diff --git a/packages/core/src/core/toolHookTriggers.test.ts b/packages/core/src/core/toolHookTriggers.test.ts
index ea69c38968..be8b7cc6c3 100644
--- a/packages/core/src/core/toolHookTriggers.test.ts
+++ b/packages/core/src/core/toolHookTriggers.test.ts
@@ -374,6 +374,48 @@ describe('toolHookTriggers', () => {
       });
     });
 
+    it('returns PostToolUse artifacts and context when execution stops', async () => {
+      const mockOutput = {
+        continue: false,
+        reason: 'Blocked after audit',
+        hookSpecificOutput: {
+          additionalContext: 'Audit details',
+          artifacts: [
+            {
+              title: 'Audit report',
+              workspacePath: 'reports/audit.html',
+            },
+          ],
+        },
+      };
+      const mockMessageBus = createMockMessageBus();
+      (mockMessageBus.request as ReturnType<typeof vi.fn>).mockResolvedValue({
+        success: true,
+        output: mockOutput,
+      });
+
+      const result = await firePostToolUseHook(
+        mockMessageBus,
+        'test-tool',
+        {},
+        {},
+        'test-id',
+        'auto',
+      );
+
+      expect(result).toEqual({
+        shouldStop: true,
+        stopReason: 'Blocked after audit',
+        additionalContext: 'Audit details',
+        artifacts: [
+          {
+            title: 'Audit report',
+            workspacePath: 'reports/audit.html',
+          },
+        ],
+      });
+    });
+
     it('should return shouldStop: false with additional context when available', async () => {
       const mockOutput = {
         hookSpecificOutput: {
@@ -401,6 +443,46 @@ describe('toolHookTriggers', () => {
       });
     });
 
+    it('returns PostToolUse artifacts', async () => {
+      const mockMessageBus = createMockMessageBus();
+      (mockMessageBus.request as ReturnType<typeof vi.fn>).mockResolvedValue({
+        success: true,
+        output: {
+          hookSpecificOutput: {
+            artifacts: [
+              {
+                title: 'Tool report',
+                workspacePath: 'reports/tool.html',
+              },
+              {
+                title: 'Malformed report',
+                workspacePath: 123,
+              },
+            ],
+          },
+        },
+      });
+
+      const result = await firePostToolUseHook(
+        mockMessageBus,
+        'test-tool',
+        {},
+        {},
+        'test-id',
+        'auto',
+      );
+
+      expect(result).toEqual({
+        shouldStop: false,
+        artifacts: [
+          {
+            title: 'Tool report',
+            workspacePath: 'reports/tool.html',
+          },
+        ],
+      });
+    });
+
     it('should handle hook execution errors gracefully', async () => {
       const mockMessageBus = createMockMessageBus();
       (mockMessageBus.request as ReturnType<typeof vi.fn>).mockRejectedValue(
@@ -502,6 +584,40 @@ describe('toolHookTriggers', () => {
       });
     });
 
+    it('returns PostToolBatch artifacts', async () => {
+      const mockMessageBus = createMockMessageBus();
+      (mockMessageBus.request as ReturnType<typeof vi.fn>).mockResolvedValue({
+        success: true,
+        output: {
+          hookSpecificOutput: {
+            artifacts: [
+              {
+                title: 'Batch report',
+                workspacePath: 'batch.html',
+              },
+              {
+                title: 'Bad report',
+                workspacePath: 123,
+              },
+            ],
+          },
+        },
+      });
+
+      const result = await firePostToolBatchHook(mockMessageBus, []);
+
+      expect(result).toEqual({
+        shouldStop: false,
+        additionalContext: undefined,
+        artifacts: [
+          {
+            title: 'Batch report',
+            workspacePath: 'batch.html',
+          },
+        ],
+      });
+    });
+
     it('should stop on deny decisions', async () => {
       const mockMessageBus = createMockMessageBus();
       (mockMessageBus.request as ReturnType<typeof vi.fn>).mockResolvedValue({
@@ -656,6 +772,44 @@ describe('toolHookTriggers', () => {
       });
     });
 
+    it('returns PostToolUseFailure artifacts', async () => {
+      const mockMessageBus = createMockMessageBus();
+      (mockMessageBus.request as ReturnType<typeof vi.fn>).mockResolvedValue({
+        success: true,
+        output: {
+          hookSpecificOutput: {
+            artifacts: [
+              {
+                title: 'Failure report',
+                workspacePath: 'reports/failure.html',
+              },
+              {
+                title: 'Malformed failure report',
+                metadata: [],
+              },
+            ],
+          },
+        },
+      });
+
+      const result = await firePostToolUseFailureHook(
+        mockMessageBus,
+        'test-id',
+        'test-tool',
+        {},
+        'error message',
+      );
+
+      expect(result).toEqual({
+        artifacts: [
+          {
+            title: 'Failure report',
+            workspacePath: 'reports/failure.html',
+          },
+        ],
+      });
+    });
+
     it('should handle hook execution errors gracefully', async () => {
       const mockMessageBus = createMockMessageBus();
       (mockMessageBus.request as ReturnType<typeof vi.fn>).mockRejectedValue(
diff --git a/packages/core/src/core/toolHookTriggers.ts b/packages/core/src/core/toolHookTriggers.ts
index 3c2547f047..4fb1619da2 100644
--- a/packages/core/src/core/toolHookTriggers.ts
+++ b/packages/core/src/core/toolHookTriggers.ts
@@ -21,6 +21,7 @@ import {
   type PostToolBatchToolCall,
 } from '../hooks/types.js';
 import { createDebugLogger } from '../utils/debugLogger.js';
+import type { ToolArtifact } from '../tools/tools.js';
 import type { Part, PartListUnion } from '@google/genai';
 
 const debugLogger = createDebugLogger('TOOL_HOOKS');
@@ -65,6 +66,8 @@ export interface PostToolUseHookResult {
   stopReason?: string;
   /** Additional context to append to tool response */
   additionalContext?: string;
+  /** Structured artifacts returned by post-tool hooks. */
+  artifacts?: ToolArtifact[];
   /** See PreToolUseHookResult.hookError. */
   hookError?: string;
 }
@@ -75,6 +78,8 @@ export interface PostToolUseHookResult {
 export interface PostToolUseFailureHookResult {
   /** Additional context about the failure */
   additionalContext?: string;
+  /** Structured artifacts returned by failure hooks. */
+  artifacts?: ToolArtifact[];
   /** See PreToolUseHookResult.hookError. */
   hookError?: string;
 }
@@ -89,6 +94,8 @@ export interface PostToolBatchHookResult {
   stopReason?: string;
   /** Additional context to append once for the whole batch */
   additionalContext?: string;
+  /** Structured artifacts returned by batch hooks. */
+  artifacts?: ToolArtifact[];
   /** See PreToolUseHookResult.hookError. */
   hookError?: string;
 }
@@ -279,20 +286,23 @@ export async function firePostToolUseHook(
       response.output,
     ) as PostToolUseHookOutput;
 
+    const additionalContext = postToolOutput.getAdditionalContext();
+    const artifacts = postToolOutput.getArtifacts();
+
     // Check if execution should stop
     if (postToolOutput.shouldStopExecution()) {
       return {
         shouldStop: true,
         stopReason: postToolOutput.getEffectiveReason(),
+        ...(additionalContext !== undefined ? { additionalContext } : {}),
+        ...(artifacts.length > 0 ? { artifacts } : {}),
       };
     }
 
-    // Get additional context
-    const additionalContext = postToolOutput.getAdditionalContext();
-
     return {
       shouldStop: false,
-      additionalContext,
+      ...(additionalContext !== undefined ? { additionalContext } : {}),
+      ...(artifacts.length > 0 ? { artifacts } : {}),
     };
   } catch (error) {
     // Hook errors should not affect tool result
@@ -372,9 +382,11 @@ export async function firePostToolUseFailureHook(
       response.output,
     ) as PostToolUseFailureHookOutput;
     const additionalContext = failureOutput.getAdditionalContext();
+    const artifacts = failureOutput.getArtifacts();
 
     return {
-      additionalContext,
+      ...(additionalContext !== undefined ? { additionalContext } : {}),
+      ...(artifacts.length > 0 ? { artifacts } : {}),
     };
   } catch (error) {
     // Hook errors should not affect error handling
@@ -432,11 +444,13 @@ export async function firePostToolBatchHook(
 
     const batchOutput = createHookOutput('PostToolBatch', response.output);
     const shouldStop = batchOutput.shouldStopExecution();
+    const artifacts = batchOutput.getArtifacts();
 
     return {
       shouldStop,
       stopReason: shouldStop ? batchOutput.getEffectiveReason() : undefined,
       additionalContext: batchOutput.getAdditionalContext(),
+      ...(artifacts.length > 0 ? { artifacts } : {}),
     };
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
diff --git a/packages/core/src/core/turn.ts b/packages/core/src/core/turn.ts
index 80194f1249..3852095bb2 100644
--- a/packages/core/src/core/turn.ts
+++ b/packages/core/src/core/turn.ts
@@ -16,6 +16,7 @@ import {
 } from '@google/genai';
 import type {
   ToolCallConfirmationDetails,
+  ToolArtifact,
   ToolResult,
   ToolResultDisplay,
 } from '../tools/tools.js';
@@ -125,6 +126,7 @@ export interface ToolCallResponseInfo {
   errorType: ToolErrorType | undefined;
   contentLength?: number;
   modelOverride?: string;
+  artifacts?: ToolArtifact[];
 }
 
 function normalizeRequestParts(req: PartListUnion): Part[] {
diff --git a/packages/core/src/hooks/hookAggregator.test.ts b/packages/core/src/hooks/hookAggregator.test.ts
index 3b5cb70906..ece02f8c80 100644
--- a/packages/core/src/hooks/hookAggregator.test.ts
+++ b/packages/core/src/hooks/hookAggregator.test.ts
@@ -209,6 +209,47 @@ describe('HookAggregator', () => {
       ).toBe('ctx\nctx2');
     });
 
+    it('should concatenate artifact arrays and drop malformed artifacts fields', () => {
+      const outputs: HookOutput[] = [
+        {
+          hookSpecificOutput: {
+            artifacts: [
+              {
+                title: 'Report',
+                workspacePath: 'report.html',
+              },
+              { workspacePath: 'missing-title.html' },
+              null,
+            ],
+          },
+        },
+        {
+          hookSpecificOutput: {
+            artifacts: { title: 'Malformed' },
+            other: 'kept',
+          },
+        },
+      ];
+
+      const results: HookExecutionResult[] = outputs.map((output) => ({
+        hookConfig: { type: HookType.Command, command: 'echo test' },
+        eventName: HookEventName.PostToolUse,
+        success: true,
+        output,
+        duration: 100,
+      }));
+
+      const result = aggregator.aggregateResults(
+        results,
+        HookEventName.PostToolUse,
+      );
+
+      expect(result.finalOutput?.hookSpecificOutput).toMatchObject({
+        artifacts: [{ title: 'Report', workspacePath: 'report.html' }],
+        other: 'kept',
+      });
+    });
+
     it('should preserve PostToolBatch stop decisions across multiple hooks', () => {
       const outputs: HookOutput[] = [
         { continue: false, stopReason: 'first hook stopped' },
diff --git a/packages/core/src/hooks/hookAggregator.ts b/packages/core/src/hooks/hookAggregator.ts
index b9ec1430d7..db3f7d99bb 100644
--- a/packages/core/src/hooks/hookAggregator.ts
+++ b/packages/core/src/hooks/hookAggregator.ts
@@ -14,8 +14,12 @@ import {
   PostToolBatchHookOutput,
   StopHookOutput,
   PermissionRequestHookOutput,
+  isToolArtifactLike,
 } from './types.js';
 import type { HookOutput, HookExecutionResult } from './types.js';
+import { createDebugLogger } from '../utils/debugLogger.js';
+
+const debugLogger = createDebugLogger('HOOK_AGGREGATOR');
 
 /**
  * Aggregated result from multiple hook executions
@@ -142,6 +146,7 @@ export class HookAggregator {
     const merged: HookOutput = {};
     const reasons: string[] = [];
     const additionalContexts: string[] = [];
+    const artifacts: unknown[] = [];
     let hasBlock = false;
     let hasContinueFalse = false;
     let stopReason: string | undefined;
@@ -172,7 +177,19 @@ export class HookAggregator {
       // Collect other hookSpecificOutput fields (later values win)
       if (output.hookSpecificOutput) {
         for (const [key, value] of Object.entries(output.hookSpecificOutput)) {
-          if (key !== 'additionalContext') {
+          if (key === 'artifacts' && Array.isArray(value)) {
+            const validArtifacts = value.filter(isToolArtifactLike);
+            artifacts.push(...validArtifacts);
+            if (validArtifacts.length !== value.length) {
+              debugLogger.warn(
+                'Dropped malformed hookSpecificOutput.artifacts entries',
+              );
+            }
+          } else if (key === 'artifacts') {
+            debugLogger.warn(
+              'Dropped malformed hookSpecificOutput.artifacts; expected array',
+            );
+          } else if (key !== 'additionalContext' && key !== 'artifacts') {
             otherHookSpecificFields[key] = value;
           }
         }
@@ -217,6 +234,9 @@ export class HookAggregator {
     if (additionalContexts.length > 0) {
       hookSpecificOutput['additionalContext'] = additionalContexts.join('\n');
     }
+    if (artifacts.length > 0) {
+      hookSpecificOutput['artifacts'] = artifacts;
+    }
 
     if (Object.keys(hookSpecificOutput).length > 0) {
       merged.hookSpecificOutput = hookSpecificOutput;
diff --git a/packages/core/src/hooks/types.test.ts b/packages/core/src/hooks/types.test.ts
index 9fbf70c58c..ac6e174e14 100644
--- a/packages/core/src/hooks/types.test.ts
+++ b/packages/core/src/hooks/types.test.ts
@@ -11,6 +11,7 @@ import {
   DefaultHookOutput,
   UserPromptExpansionHookOutput,
   HookEventName,
+  isToolArtifactLike,
 } from './types.js';
 
 describe('UserPromptSubmit getAdditionalContext', () => {
@@ -143,3 +144,40 @@ describe('terminalSequence on HookOutput', () => {
     expect(output.terminalSequence).toBeUndefined();
   });
 });
+
+describe('isToolArtifactLike', () => {
+  it('accepts primitive metadata values', () => {
+    expect(
+      isToolArtifactLike({
+        title: 'Report',
+        metadata: { label: 'daily', score: 1, pinned: true, optional: null },
+      }),
+    ).toBe(true);
+  });
+
+  it('rejects nested and non-finite metadata values', () => {
+    expect(
+      isToolArtifactLike({
+        title: 'Report',
+        metadata: { hints: { display: 'card' } },
+      }),
+    ).toBe(false);
+    expect(
+      isToolArtifactLike({
+        title: 'Report',
+        metadata: { score: Number.NaN },
+      }),
+    ).toBe(false);
+  });
+
+  it('rejects artifact sizes the daemon store would drop', () => {
+    for (const sizeBytes of [-1, 1.5, Number.MAX_SAFE_INTEGER + 1]) {
+      expect(
+        isToolArtifactLike({
+          title: 'Report',
+          sizeBytes,
+        }),
+      ).toBe(false);
+    }
+  });
+});
diff --git a/packages/core/src/hooks/types.ts b/packages/core/src/hooks/types.ts
index 55dc33d4dc..da76ed2e17 100644
--- a/packages/core/src/hooks/types.ts
+++ b/packages/core/src/hooks/types.ts
@@ -4,6 +4,7 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 import type { ChildProcess } from 'child_process';
+import type { ToolArtifact } from '../tools/tools.js';
 import { createDebugLogger } from '../utils/debugLogger.js';
 
 const debugLogger = createDebugLogger('TRUSTED_HOOKS');
@@ -288,6 +289,49 @@ export interface HookOutput {
   hookSpecificOutput?: Record<string, unknown>;
 }
 
+export function isToolArtifactLike(value: unknown): value is ToolArtifact {
+  if (typeof value !== 'object' || value === null) {
+    return false;
+  }
+  const artifact = value as Record<string, unknown>;
+  return (
+    typeof artifact['title'] === 'string' &&
+    isOptionalString(artifact, 'kind') &&
+    isOptionalString(artifact, 'storage') &&
+    isOptionalString(artifact, 'description') &&
+    isOptionalString(artifact, 'workspacePath') &&
+    isOptionalString(artifact, 'managedId') &&
+    isOptionalString(artifact, 'url') &&
+    isOptionalString(artifact, 'mimeType') &&
+    (artifact['sizeBytes'] === undefined ||
+      (typeof artifact['sizeBytes'] === 'number' &&
+        Number.isSafeInteger(artifact['sizeBytes']) &&
+        artifact['sizeBytes'] >= 0)) &&
+    (artifact['metadata'] === undefined ||
+      isToolArtifactMetadataLike(artifact['metadata']))
+  );
+}
+
+function isToolArtifactMetadataLike(value: unknown): boolean {
+  if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+    return false;
+  }
+  return Object.values(value).every(
+    (item) =>
+      item === null ||
+      typeof item === 'string' ||
+      typeof item === 'boolean' ||
+      (typeof item === 'number' && Number.isFinite(item)),
+  );
+}
+
+function isOptionalString(
+  value: Record<string, unknown>,
+  key: string,
+): boolean {
+  return value[key] === undefined || typeof value[key] === 'string';
+}
+
 export const MAX_USER_PROMPT_EXPANSION_ADDITIONAL_CONTEXT_LENGTH = 10_000;
 
 export function sanitizeUserPromptExpansionAdditionalContext(
@@ -398,6 +442,14 @@ export class DefaultHookOutput implements HookOutput {
     return undefined;
   }
 
+  getArtifacts(): ToolArtifact[] {
+    const artifacts = this.hookSpecificOutput?.['artifacts'];
+    if (!Array.isArray(artifacts)) {
+      return [];
+    }
+    return artifacts.filter(isToolArtifactLike);
+  }
+
   /**
    * Check if execution should be blocked and return error info
    */
@@ -728,6 +780,7 @@ export interface PostToolUseOutput extends HookOutput {
   hookSpecificOutput?: {
     hookEventName: 'PostToolUse';
     additionalContext?: string;
+    artifacts?: ToolArtifact[];
   };
 }
 
@@ -753,6 +806,7 @@ export interface PostToolUseFailureOutput extends HookOutput {
   hookSpecificOutput?: {
     hookEventName: 'PostToolUseFailure';
     additionalContext?: string;
+    artifacts?: ToolArtifact[];
   };
 }
 
@@ -788,6 +842,7 @@ export interface PostToolBatchOutput extends HookOutput {
   hookSpecificOutput?: {
     hookEventName: 'PostToolBatch';
     additionalContext?: string;
+    artifacts?: ToolArtifact[];
   };
 }
 
diff --git a/packages/core/src/index.ts b/packages/core/src/index.ts
index e642445964..d666bf71ba 100644
--- a/packages/core/src/index.ts
+++ b/packages/core/src/index.ts
@@ -172,6 +172,10 @@ export type {
   ArtifactTool,
   ArtifactToolParams,
 } from './tools/artifact/artifact-tool.js';
+export type {
+  RecordArtifactTool,
+  RecordArtifactParams,
+} from './tools/record-artifact.js';
 export type {
   ArtifactPublisher,
   PublishArtifactInput,
@@ -541,11 +545,13 @@ export {
   firePreToolUseHook,
   firePostToolUseHook,
   firePostToolUseFailureHook,
+  firePostToolBatchHook,
   type NotificationHookResult,
   type PermissionRequestHookResult,
   type PreToolUseHookResult,
   type PostToolUseHookResult,
   type PostToolUseFailureHookResult,
+  type PostToolBatchHookResult,
   generateToolUseId,
 } from './core/toolHookTriggers.js';
 
diff --git a/packages/core/src/tools/artifact/artifact-tool.test.ts b/packages/core/src/tools/artifact/artifact-tool.test.ts
index 4788a6d394..84b5ec8fad 100644
--- a/packages/core/src/tools/artifact/artifact-tool.test.ts
+++ b/packages/core/src/tools/artifact/artifact-tool.test.ts
@@ -70,6 +70,16 @@ describe('ArtifactTool', () => {
     expect(res.llmContent).toMatch(/Published artifact/);
     expect(res.llmContent).toMatch(/file:\/\//);
     expect(openSpy).toHaveBeenCalledTimes(1);
+    expect(res.artifacts).toMatchObject([
+      {
+        kind: 'html',
+        storage: 'published',
+        title: 'My Report',
+        mimeType: 'text/html',
+      },
+    ]);
+    expect(res.artifacts?.[0]?.url).toMatch(/^file:\/\//);
+    expect(res.artifacts?.[0]?.managedId).toBeTruthy();
 
     const published = res.resultFilePaths?.[0];
     expect(published).toBeTruthy();
diff --git a/packages/core/src/tools/artifact/artifact-tool.ts b/packages/core/src/tools/artifact/artifact-tool.ts
index 757ab2efc5..5dce543c61 100644
--- a/packages/core/src/tools/artifact/artifact-tool.ts
+++ b/packages/core/src/tools/artifact/artifact-tool.ts
@@ -178,6 +178,7 @@ class ArtifactToolInvocation extends BaseToolInvocation<
     }
 
     // Publish (idempotent per source path → stable URL).
+    let managedId: string;
     let url: string;
     let filePath: string | undefined;
     try {
@@ -185,6 +186,7 @@ class ArtifactToolInvocation extends BaseToolInvocation<
         { id: artifactIdFromPath(file_path), title, html },
         signal,
       );
+      managedId = published.id;
       url = published.url;
       filePath = published.filePath;
     } catch (err) {
@@ -225,6 +227,17 @@ class ArtifactToolInvocation extends BaseToolInvocation<
       llmContent,
       returnDisplay: `Published artifact **${title}**\n\n${url}`,
       resultFilePaths: filePath ? [filePath] : undefined,
+      artifacts: [
+        {
+          kind: 'html',
+          storage: 'published',
+          title,
+          url,
+          managedId,
+          mimeType: 'text/html',
+          sizeBytes: bytes,
+        },
+      ],
     };
   }
 }
diff --git a/packages/core/src/tools/record-artifact.test.ts b/packages/core/src/tools/record-artifact.test.ts
new file mode 100644
index 0000000000..d785d23e46
--- /dev/null
+++ b/packages/core/src/tools/record-artifact.test.ts
@@ -0,0 +1,334 @@
+/**
+ * @license
+ * Copyright 2026 Qwen Team
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { describe, expect, it } from 'vitest';
+import { RecordArtifactTool } from './record-artifact.js';
+
+const signal = new AbortController().signal;
+
+describe('RecordArtifactTool', () => {
+  it('records a link artifact without touching the resource', async () => {
+    const tool = new RecordArtifactTool();
+    const result = await tool
+      .build({
+        title: 'Table details',
+        url: 'https://example.com/tables/orders',
+        metadata: { table: 'orders' },
+      })
+      .execute(signal);
+
+    expect(result.error).toBeUndefined();
+    expect(result.artifacts).toMatchObject([
+      {
+        title: 'Table details',
+        storage: 'external_url',
+        url: 'https://example.com/tables/orders',
+        metadata: { table: 'orders' },
+      },
+    ]);
+  });
+
+  it('records workspace and managed artifacts with inferred storage', async () => {
+    const tool = new RecordArtifactTool();
+
+    await expect(
+      tool
+        .build({
+          title: 'Workspace report',
+          workspacePath: 'reports/summary.html',
+        })
+        .execute(signal),
+    ).resolves.toMatchObject({
+      artifacts: [
+        {
+          title: 'Workspace report',
+          storage: 'workspace',
+          workspacePath: 'reports/summary.html',
+        },
+      ],
+    });
+
+    await expect(
+      tool
+        .build({
+          title: 'Managed preview',
+          managedId: 'ext-123',
+        })
+        .execute(signal),
+    ).resolves.toMatchObject({
+      artifacts: [
+        {
+          title: 'Managed preview',
+          storage: 'managed',
+          managedId: 'ext-123',
+        },
+      ],
+    });
+  });
+
+  it('rejects published storage', () => {
+    const tool = new RecordArtifactTool();
+
+    expect(() =>
+      tool.build({
+        title: 'Forged',
+        storage: 'published' as never,
+        url: 'https://example.com/artifact',
+      }),
+    ).toThrow(/allowed values/);
+  });
+
+  it('requires exactly one locator', () => {
+    const tool = new RecordArtifactTool();
+
+    expect(() =>
+      tool.build({
+        title: 'Ambiguous',
+        workspacePath: 'report.html',
+        url: 'https://example.com/report',
+      }),
+    ).toThrow(/exactly one/);
+  });
+
+  it('rejects workspace traversal and unsafe urls before reporting success', () => {
+    const tool = new RecordArtifactTool();
+
+    expect(() =>
+      tool.build({
+        title: 'Escape',
+        workspacePath: '../secret.txt',
+      }),
+    ).toThrow(/workspacePath/);
+
+    expect(() =>
+      tool.build({
+        title: 'Credentials',
+        url: 'https://user:pass@example.com/resource',
+      }),
+    ).toThrow(/credentials/);
+
+    expect(() =>
+      tool.build({
+        title: 'FTP',
+        url: 'ftp://example.com/resource',
+      }),
+    ).toThrow(/http or https/);
+  });
+
+  it('rejects path-like managed ids before reporting success', () => {
+    const tool = new RecordArtifactTool();
+
+    for (const managedId of ['../secret', 'folder/item', 'folder\\item']) {
+      expect(() =>
+        tool.build({
+          title: 'Managed path',
+          managedId,
+        }),
+      ).toThrow(/opaque managed resource id/);
+    }
+  });
+
+  it('rejects storage values that do not match the locator', () => {
+    const tool = new RecordArtifactTool();
+
+    expect(() =>
+      tool.build({
+        title: 'Workspace mismatch',
+        storage: 'external_url',
+        workspacePath: 'report.html',
+      }),
+    ).toThrow(/storage.*workspace/);
+  });
+
+  it('rejects artifact metadata that the daemon store would drop', () => {
+    const tool = new RecordArtifactTool();
+
+    expect(() =>
+      tool.build({
+        title: 'Huge metadata',
+        url: 'https://example.com/resource',
+        metadata: { value: 'x'.repeat(4096) },
+      }),
+    ).toThrow(/metadata/);
+
+    for (const value of [Number.NaN, Number.POSITIVE_INFINITY]) {
+      expect(() =>
+        tool.build({
+          title: 'Non-finite metadata',
+          url: 'https://example.com/resource',
+          metadata: { value },
+        }),
+      ).toThrow(/metadata/);
+    }
+  });
+
+  it('rejects invalid artifact sizes before reporting success', () => {
+    const tool = new RecordArtifactTool();
+
+    for (const sizeBytes of [-1, 1.5, Number.MAX_SAFE_INTEGER + 1]) {
+      expect(() =>
+        tool.build({
+          title: 'Sized artifact',
+          url: 'https://example.com/resource',
+          sizeBytes,
+        }),
+      ).toThrow(/sizeBytes/);
+    }
+  });
+
+  it('rejects unsafe display markup before reporting success', () => {
+    const tool = new RecordArtifactTool();
+
+    expect(() =>
+      tool.build({
+        title: '<script>alert(1)</script>',
+        url: 'https://example.com/resource',
+      }),
+    ).toThrow(/unsafe markup/);
+
+    expect(() =>
+      tool.build({
+        title: 'External style',
+        description: '<style>body{display:none}</style>',
+        url: 'https://example.com/resource',
+      }),
+    ).toThrow(/unsafe markup/);
+
+    expect(() =>
+      tool.build({
+        title: 'Entity payload',
+        description: '&#x3c;script&#x3e;',
+        url: 'https://example.com/resource',
+      }),
+    ).toThrow(/unsafe markup/);
+
+    expect(() =>
+      tool.build({
+        title: 'Script data url',
+        description: 'data:text/javascript,alert(1)',
+        url: 'https://example.com/resource',
+      }),
+    ).toThrow(/unsafe markup/);
+
+    expect(() =>
+      tool.build({
+        title: 'SVG data url',
+        description: 'data:image/svg+xml;base64,PHN2ZyBvbmxvYWQ9YWxlcnQoMSk+',
+        url: 'https://example.com/resource',
+      }),
+    ).toThrow(/unsafe markup/);
+
+    expect(() =>
+      tool.build({
+        title: 'HTML mime',
+        mimeType: 'text/html<script>',
+        url: 'https://example.com/resource',
+      }),
+    ).toThrow(/unsafe markup/);
+
+    expect(() =>
+      tool.build({
+        title: 'Workspace payload',
+        workspacePath: '<img src=x onerror=alert(1)>.html',
+      }),
+    ).toThrow(/unsafe markup/);
+
+    expect(() =>
+      tool.build({
+        title: 'Managed payload',
+        managedId: '<script>alert(1)</script>',
+      }),
+    ).toThrow(/unsafe markup/);
+
+    expect(() =>
+      tool.build({
+        title: 'Metadata key',
+        url: 'https://example.com/resource',
+        metadata: { '<script>': 'unsafe key' },
+      }),
+    ).toThrow(/metadata/);
+
+    expect(() =>
+      tool.build({
+        title: 'Metadata value',
+        url: 'https://example.com/resource',
+        metadata: { preview: 'data:text/javascript,alert(1)' },
+      }),
+    ).toThrow(/metadata/);
+  });
+
+  it('allows benign words ending with on before equals signs', () => {
+    const tool = new RecordArtifactTool();
+
+    expect(() =>
+      tool.build({
+        title: 'conversation=value',
+        description: 'configuration=value',
+        url: 'https://example.com/resource',
+      }),
+    ).not.toThrow();
+  });
+
+  it('rejects Unicode control characters before reporting success', () => {
+    const tool = new RecordArtifactTool();
+
+    expect(() =>
+      tool.build({
+        title: 'Hidden\u202eTitle',
+        url: 'https://example.com/resource',
+      }),
+    ).toThrow(/control characters/);
+
+    expect(() =>
+      tool.build({
+        title: 'safe\u2028evil',
+        url: 'https://example.com/resource',
+      }),
+    ).toThrow(/control characters/);
+
+    expect(() =>
+      tool.build({
+        title: 'safe\u2066evil',
+        url: 'https://example.com/resource',
+      }),
+    ).toThrow(/control characters/);
+
+    expect(() =>
+      tool.build({
+        title: 'Metadata key',
+        url: 'https://example.com/resource',
+        metadata: { 'preview\u200b': 'hidden' },
+      }),
+    ).toThrow(/metadata/);
+  });
+
+  it('accepts line whitespace in descriptions but not titles', async () => {
+    const tool = new RecordArtifactTool();
+
+    await expect(
+      tool
+        .build({
+          title: 'Multiline report',
+          description: 'Line one\nLine two\tindented\r\nLine three',
+          url: 'https://example.com/resource',
+        })
+        .execute(signal),
+    ).resolves.toMatchObject({
+      artifacts: [
+        {
+          description: 'Line one\nLine two\tindented\r\nLine three',
+        },
+      ],
+    });
+
+    expect(() =>
+      tool.build({
+        title: 'Bad\nTitle',
+        url: 'https://example.com/resource',
+      }),
+    ).toThrow(/control characters/);
+  });
+});
diff --git a/packages/core/src/tools/record-artifact.ts b/packages/core/src/tools/record-artifact.ts
new file mode 100644
index 0000000000..f1ebf43a5d
--- /dev/null
+++ b/packages/core/src/tools/record-artifact.ts
@@ -0,0 +1,436 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import path from 'node:path';
+import type {
+  ToolArtifact,
+  ToolArtifactKind,
+  ToolArtifactStorage,
+  ToolInvocation,
+  ToolResult,
+} from './tools.js';
+import { BaseDeclarativeTool, BaseToolInvocation, Kind } from './tools.js';
+import { ToolDisplayNames, ToolNames } from './tool-names.js';
+
+export interface RecordArtifactParams {
+  title: string;
+  kind?: ToolArtifactKind;
+  storage?: Exclude<ToolArtifactStorage, 'published'>;
+  description?: string;
+  workspacePath?: string;
+  managedId?: string;
+  url?: string;
+  mimeType?: string;
+  sizeBytes?: number;
+  metadata?: Record<string, string | number | boolean | null>;
+}
+
+const DESCRIPTION = `Registers a session artifact so clients can show it in an artifacts panel. Use it after creating a useful file, URL, image, report, notebook, or other intermediate result that the user may want to open later.
+
+This tool only records metadata. It does not publish, upload, read, write, or verify the referenced resource. Provide exactly one locator: workspacePath, managedId, or url. Use the Artifact tool, not record_artifact, for published interactive HTML artifacts.`;
+
+class RecordArtifactInvocation extends BaseToolInvocation<
+  RecordArtifactParams,
+  ToolResult
+> {
+  override getDescription(): string {
+    return `Recording artifact ${this.params.title}`;
+  }
+
+  execute(_signal: AbortSignal): Promise<ToolResult> {
+    const artifact: ToolArtifact = {
+      title: this.params.title.trim(),
+      kind: this.params.kind,
+      storage: this.params.storage ?? inferStorage(this.params),
+      description: trimOptional(this.params.description),
+      workspacePath: trimOptional(this.params.workspacePath),
+      managedId: trimOptional(this.params.managedId),
+      url: trimOptional(this.params.url),
+      mimeType: trimOptional(this.params.mimeType),
+      sizeBytes: this.params.sizeBytes,
+      metadata: this.params.metadata,
+    };
+
+    return Promise.resolve({
+      llmContent: `Recorded artifact "${artifact.title}".`,
+      returnDisplay: `Recorded artifact **${artifact.title}**.`,
+      artifacts: [artifact],
+    });
+  }
+}
+
+export class RecordArtifactTool extends BaseDeclarativeTool<
+  RecordArtifactParams,
+  ToolResult
+> {
+  static readonly Name: string = ToolNames.RECORD_ARTIFACT;
+
+  constructor() {
+    super(
+      RecordArtifactTool.Name,
+      ToolDisplayNames.RECORD_ARTIFACT,
+      DESCRIPTION,
+      Kind.Other,
+      {
+        type: 'object',
+        properties: {
+          title: {
+            type: 'string',
+            description: 'Concise title shown in the client artifact list.',
+          },
+          kind: {
+            type: 'string',
+            enum: [
+              'file',
+              'link',
+              'html',
+              'image',
+              'video',
+              'audio',
+              'pdf',
+              'notebook',
+              'other',
+            ],
+            description: 'Best-effort artifact type for client rendering.',
+          },
+          storage: {
+            type: 'string',
+            enum: ['workspace', 'external_url', 'managed'],
+            description:
+              'Storage class. Omit it to infer from the provided locator.',
+          },
+          description: {
+            type: 'string',
+            description: 'Optional short description for the user.',
+          },
+          workspacePath: {
+            type: 'string',
+            description:
+              'Workspace-relative path for a file produced in the current workspace.',
+          },
+          managedId: {
+            type: 'string',
+            description:
+              'Opaque identifier for a resource managed by an extension or tool.',
+          },
+          url: {
+            type: 'string',
+            description:
+              'HTTP or HTTPS URL that the user can open for details.',
+          },
+          mimeType: {
+            type: 'string',
+            description: 'Optional MIME type.',
+          },
+          sizeBytes: {
+            type: 'integer',
+            minimum: 0,
+            description: 'Optional size in bytes.',
+          },
+          metadata: {
+            type: 'object',
+            additionalProperties: {
+              anyOf: [
+                { type: 'string' },
+                { type: 'number' },
+                { type: 'boolean' },
+                { type: 'null' },
+              ],
+            },
+            description:
+              'Small primitive metadata bag for client-specific display hints.',
+          },
+        },
+        required: ['title'],
+      },
+      true,
+      false,
+      true,
+      false,
+      'artifact url link file image report notebook dashboard',
+    );
+  }
+
+  protected override validateToolParamValues(
+    params: RecordArtifactParams,
+  ): string | null {
+    params.title = (params.title ?? '').trim();
+    const titleError = validateString(params.title, 'title', 200, true);
+    if (titleError) {
+      return titleError;
+    }
+    const descriptionError = validateString(
+      params.description,
+      'description',
+      1000,
+      false,
+    );
+    if (descriptionError) {
+      return descriptionError;
+    }
+    const mimeTypeError = validateString(
+      params.mimeType,
+      'mimeType',
+      120,
+      false,
+    );
+    if (mimeTypeError) {
+      return mimeTypeError;
+    }
+    if (params.kind && !isArtifactKind(params.kind)) {
+      return '"kind" must be a supported artifact kind';
+    }
+    if (
+      params.storage &&
+      params.storage !== 'workspace' &&
+      params.storage !== 'external_url' &&
+      params.storage !== 'managed'
+    ) {
+      return '"storage" must be workspace, external_url, or managed';
+    }
+    const locators = [
+      trimOptional(params.workspacePath),
+      trimOptional(params.managedId),
+      trimOptional(params.url),
+    ].filter(Boolean);
+    if (locators.length !== 1) {
+      return 'Provide exactly one of "workspacePath", "managedId", or "url"';
+    }
+
+    const inferredStorage = inferStorage(params);
+    if (params.storage && params.storage !== inferredStorage) {
+      return `"storage" must be "${inferredStorage}" for the provided locator`;
+    }
+
+    if (params.workspacePath) {
+      const workspacePathError = validateWorkspacePath(params.workspacePath);
+      if (workspacePathError) {
+        return workspacePathError;
+      }
+    }
+    if (params.managedId) {
+      const managedIdError = validateManagedId(params.managedId);
+      if (managedIdError) {
+        return managedIdError;
+      }
+    }
+    if (params.url) {
+      try {
+        const parsed = new URL(params.url);
+        if (parsed.username || parsed.password) {
+          return '"url" must not include credentials';
+        }
+        if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+          return '"url" must use http or https';
+        }
+      } catch {
+        return '"url" must be a valid URL';
+      }
+    }
+    if (
+      params.sizeBytes !== undefined &&
+      (!Number.isSafeInteger(params.sizeBytes) || params.sizeBytes < 0)
+    ) {
+      return '"sizeBytes" must be a non-negative safe integer';
+    }
+    const metadataError = validateMetadata(params.metadata);
+    if (metadataError) {
+      return metadataError;
+    }
+
+    return null;
+  }
+
+  protected createInvocation(
+    params: RecordArtifactParams,
+  ): ToolInvocation<RecordArtifactParams, ToolResult> {
+    return new RecordArtifactInvocation(params);
+  }
+}
+
+function inferStorage(
+  params: Pick<RecordArtifactParams, 'workspacePath' | 'managedId' | 'url'>,
+): Exclude<ToolArtifactStorage, 'published'> {
+  if (trimOptional(params.workspacePath)) {
+    return 'workspace';
+  }
+  if (trimOptional(params.managedId)) {
+    return 'managed';
+  }
+  return 'external_url';
+}
+
+function trimOptional(value: string | undefined): string | undefined {
+  const trimmed = value?.trim();
+  return trimmed ? trimmed : undefined;
+}
+
+function validateString(
+  value: string | undefined,
+  field: string,
+  maxLength: number,
+  required: boolean,
+): string | null {
+  const trimmed = value?.trim();
+  if (!trimmed) {
+    return required ? `Missing or empty "${field}"` : null;
+  }
+  if (trimmed.length > maxLength) {
+    return `"${field}" exceeds ${maxLength} characters`;
+  }
+  if (hasControlCharacter(trimmed, field === 'description')) {
+    return `"${field}" contains control characters`;
+  }
+  if (isDisplayField(field) && hasUnsafeDisplayPayload(trimmed)) {
+    return `"${field}" contains unsafe markup`;
+  }
+  return null;
+}
+
+function validateManagedId(value: string): string | null {
+  const trimmed = value.trim();
+  const stringError = validateString(trimmed, 'managedId', 200, true);
+  if (stringError) {
+    return stringError;
+  }
+  if (
+    trimmed.includes('/') ||
+    trimmed.includes('\\') ||
+    trimmed.includes('..') ||
+    path.isAbsolute(trimmed) ||
+    path.win32.isAbsolute(trimmed)
+  ) {
+    return '"managedId" must be an opaque managed resource id';
+  }
+  return null;
+}
+
+function isDisplayField(field: string): boolean {
+  return (
+    field === 'title' ||
+    field === 'description' ||
+    field === 'mimeType' ||
+    field === 'workspacePath' ||
+    field === 'managedId'
+  );
+}
+
+function hasControlCharacter(
+  value: string,
+  allowLineWhitespace = false,
+): boolean {
+  for (let i = 0; i < value.length; i++) {
+    const code = value.charCodeAt(i);
+    if (
+      allowLineWhitespace &&
+      (code === 0x09 || code === 0x0a || code === 0x0d)
+    ) {
+      continue;
+    }
+    if (
+      code <= 0x1f ||
+      code === 0x7f ||
+      (code >= 0x200b && code <= 0x200f) ||
+      code === 0x2028 ||
+      code === 0x2029 ||
+      (code >= 0x202a && code <= 0x202e) ||
+      (code >= 0x2066 && code <= 0x2069) ||
+      code === 0xfeff
+    ) {
+      return true;
+    }
+  }
+  return false;
+}
+
+function hasUnsafeDisplayPayload(value: string): boolean {
+  return (
+    /<\s*\/?[a-z!]|&(?:#[0-9]+|#x[0-9a-f]+|[a-z][a-z0-9]+);|javascript\s*:|data\s*:\s*(?:text\/(?:html|javascript)|application\/javascript|image\/svg\+xml)/i.test(
+      value,
+    ) || /(?:^|[\s"'`<])on[a-z][a-z0-9-]*\s*=/i.test(value)
+  );
+}
+
+function validateWorkspacePath(value: string): string | null {
+  const trimmed = value.trim();
+  const stringError = validateString(trimmed, 'workspacePath', 500, true);
+  if (stringError) {
+    return stringError;
+  }
+  if (path.isAbsolute(trimmed)) {
+    return '"workspacePath" must be relative to the workspace';
+  }
+  const normalized = path.normalize(trimmed);
+  if (
+    normalized === '..' ||
+    normalized.startsWith(`..${path.sep}`) ||
+    path.isAbsolute(normalized)
+  ) {
+    return '"workspacePath" must stay inside the workspace';
+  }
+  return null;
+}
+
+function validateMetadata(
+  metadata: Record<string, string | number | boolean | null> | undefined,
+): string | null {
+  if (metadata === undefined) {
+    return null;
+  }
+  if (
+    typeof metadata !== 'object' ||
+    metadata === null ||
+    Array.isArray(metadata)
+  ) {
+    return '"metadata" must be an object';
+  }
+  for (const [key, value] of Object.entries(metadata)) {
+    if (!key) {
+      return '"metadata" keys must not be empty';
+    }
+    if (key.length > 120) {
+      return '"metadata" keys must be 120 characters or fewer';
+    }
+    if (hasControlCharacter(key) || hasUnsafeDisplayPayload(key)) {
+      return '"metadata" keys contain unsafe content';
+    }
+    if (
+      value !== null &&
+      typeof value !== 'string' &&
+      typeof value !== 'number' &&
+      typeof value !== 'boolean'
+    ) {
+      return '"metadata" values must be primitive';
+    }
+    if (typeof value === 'number' && !Number.isFinite(value)) {
+      return '"metadata" numbers must be finite';
+    }
+    if (
+      typeof value === 'string' &&
+      (hasControlCharacter(value) || hasUnsafeDisplayPayload(value))
+    ) {
+      return '"metadata" string values contain unsafe content';
+    }
+  }
+  if (Buffer.byteLength(JSON.stringify(metadata), 'utf8') > 4096) {
+    return '"metadata" must be 4096 bytes or fewer';
+  }
+  return null;
+}
+
+function isArtifactKind(kind: string): kind is ToolArtifactKind {
+  return (
+    kind === 'file' ||
+    kind === 'link' ||
+    kind === 'html' ||
+    kind === 'image' ||
+    kind === 'video' ||
+    kind === 'audio' ||
+    kind === 'pdf' ||
+    kind === 'notebook' ||
+    kind === 'other'
+  );
+}
diff --git a/packages/core/src/tools/tool-names.ts b/packages/core/src/tools/tool-names.ts
index c679e24a5f..ff72e901ff 100644
--- a/packages/core/src/tools/tool-names.ts
+++ b/packages/core/src/tools/tool-names.ts
@@ -61,6 +61,7 @@ export const ToolNames = {
   // `get_app_state` / `perform_secondary_action` that no longer exist.
   WORKFLOW: 'workflow',
   ARTIFACT: 'artifact',
+  RECORD_ARTIFACT: 'record_artifact',
 } as const;
 
 /**
@@ -107,6 +108,7 @@ export const ToolDisplayNames = {
   // computer_use__* display names are not enumerated here (see ToolNames).
   WORKFLOW: 'Workflow',
   ARTIFACT: 'Artifact',
+  RECORD_ARTIFACT: 'RecordArtifact',
 } as const;
 
 // Migration from old tool names to new tool names
diff --git a/packages/core/src/tools/tools.ts b/packages/core/src/tools/tools.ts
index 34dffc6b30..ed00bc874f 100644
--- a/packages/core/src/tools/tools.ts
+++ b/packages/core/src/tools/tools.ts
@@ -440,6 +440,36 @@ export function isTool(obj: unknown): obj is AnyDeclarativeTool {
   );
 }
 
+export type ToolArtifactKind =
+  | 'file'
+  | 'link'
+  | 'html'
+  | 'image'
+  | 'video'
+  | 'audio'
+  | 'pdf'
+  | 'notebook'
+  | 'other';
+
+export type ToolArtifactStorage =
+  | 'workspace'
+  | 'external_url'
+  | 'managed'
+  | 'published';
+
+export interface ToolArtifact {
+  kind?: ToolArtifactKind;
+  storage?: ToolArtifactStorage;
+  title: string;
+  description?: string;
+  workspacePath?: string;
+  managedId?: string;
+  url?: string;
+  mimeType?: string;
+  sizeBytes?: number;
+  metadata?: Record<string, string | number | boolean | null>;
+}
+
 export interface ToolResult {
   /**
    * Content meant to be included in LLM history.
@@ -462,6 +492,13 @@ export interface ToolResult {
    */
   resultFilePaths?: string[];
 
+  /**
+   * Structured artifacts produced by this tool call. Daemon/session surfaces
+   * consume this as metadata only; the producer remains responsible for the
+   * underlying file, URL, or managed resource lifecycle.
+   */
+  artifacts?: ToolArtifact[];
+
   /**
    * If this property is present, the tool call is considered a failure.
    */
diff --git a/packages/sdk-typescript/scripts/build.js b/packages/sdk-typescript/scripts/build.js
index 812b1d1709..1256d7091a 100755
--- a/packages/sdk-typescript/scripts/build.js
+++ b/packages/sdk-typescript/scripts/build.js
@@ -39,8 +39,9 @@ const rootDir = join(__dirname, '..');
 // Bumped from 131KB to 132KB for the pending prompt queue feature.
 // Bumped from 132KB to 133KB for session archive/unarchive APIs and sessionless
 // workspace remember (managed memory client methods + event validation).
-// Bumped from 133KB to 134KB after merging both surfaces with main.
-const MAX_DAEMON_BROWSER_BUNDLE_BYTES = 134 * 1024;
+// Bumped from 133KB to 135KB after merging both surfaces plus session artifact
+// APIs and event validation.
+const MAX_DAEMON_BROWSER_BUNDLE_BYTES = 135 * 1024;
 // The opt-in `daemon/transports` browser bundle legitimately ships the concrete
 // ACP transports (AcpHttpTransport/AcpWsTransport/AutoReconnect + negotiate), so
 // it's larger than the default barrel — but still budgeted so a future PR can't
diff --git a/packages/sdk-typescript/src/daemon/DaemonClient.ts b/packages/sdk-typescript/src/daemon/DaemonClient.ts
index 04db97792b..11edbf14be 100644
--- a/packages/sdk-typescript/src/daemon/DaemonClient.ts
+++ b/packages/sdk-typescript/src/daemon/DaemonClient.ts
@@ -88,6 +88,9 @@ import type {
   DaemonRuntimeMcpAddResult,
   DaemonRuntimeMcpRemoveResult,
   DaemonToolToggleResult,
+  DaemonSessionArtifactInput,
+  DaemonSessionArtifactMutationResult,
+  DaemonSessionArtifactsEnvelope,
   DaemonRewindSnapshotInfo,
   DaemonRewindResult,
   ForkSessionRequest,
@@ -2958,6 +2961,50 @@ export class DaemonClient {
     this.transport.dispose();
   }
 
+  // -- Session artifacts ---------------------------------------------------
+
+  async listSessionArtifacts(
+    sessionId: string,
+    clientId?: string,
+  ): Promise<DaemonSessionArtifactsEnvelope> {
+    return await this.jsonRequest<DaemonSessionArtifactsEnvelope>(
+      `/session/${encodeURIComponent(sessionId)}/artifacts`,
+      'GET /session/:id/artifacts',
+      { clientId },
+    );
+  }
+
+  async addSessionArtifact(
+    sessionId: string,
+    artifact: DaemonSessionArtifactInput,
+    clientId?: string,
+  ): Promise<DaemonSessionArtifactMutationResult> {
+    return await this.jsonRequest<DaemonSessionArtifactMutationResult>(
+      `/session/${encodeURIComponent(sessionId)}/artifacts`,
+      'POST /session/:id/artifacts',
+      {
+        method: 'POST',
+        body: artifact,
+        clientId,
+      },
+    );
+  }
+
+  async removeSessionArtifact(
+    sessionId: string,
+    artifactId: string,
+    clientId?: string,
+  ): Promise<DaemonSessionArtifactMutationResult> {
+    return await this.jsonRequest<DaemonSessionArtifactMutationResult>(
+      `/session/${encodeURIComponent(sessionId)}/artifacts/${encodeURIComponent(artifactId)}`,
+      'DELETE /session/:id/artifacts/:artifactId',
+      {
+        method: 'DELETE',
+        clientId,
+      },
+    );
+  }
+
   // -- Session metadata ----------------------------------------------------
 
   /**
diff --git a/packages/sdk-typescript/src/daemon/DaemonSessionClient.ts b/packages/sdk-typescript/src/daemon/DaemonSessionClient.ts
index 5b1aaf9f7b..b8f317f297 100644
--- a/packages/sdk-typescript/src/daemon/DaemonSessionClient.ts
+++ b/packages/sdk-typescript/src/daemon/DaemonSessionClient.ts
@@ -30,6 +30,9 @@ import type {
   DaemonSessionLspStatus,
   DaemonSessionRecapResult,
   DaemonShellCommandResult,
+  DaemonSessionArtifactInput,
+  DaemonSessionArtifactMutationResult,
+  DaemonSessionArtifactsEnvelope,
   DaemonSessionState,
   DaemonSession,
   DaemonSessionStatsStatus,
@@ -407,6 +410,33 @@ export class DaemonSessionClient {
     return await this.client.heartbeat(this.sessionId, this.clientId);
   }
 
+  async artifacts(): Promise<DaemonSessionArtifactsEnvelope> {
+    return await this.client.listSessionArtifacts(
+      this.sessionId,
+      this.clientId,
+    );
+  }
+
+  async addArtifact(
+    artifact: DaemonSessionArtifactInput,
+  ): Promise<DaemonSessionArtifactMutationResult> {
+    return await this.client.addSessionArtifact(
+      this.sessionId,
+      artifact,
+      this.clientId,
+    );
+  }
+
+  async removeArtifact(
+    artifactId: string,
+  ): Promise<DaemonSessionArtifactMutationResult> {
+    return await this.client.removeSessionArtifact(
+      this.sessionId,
+      artifactId,
+      this.clientId,
+    );
+  }
+
   async setModel(modelId: string): Promise<SetModelResult> {
     return await this.client.setSessionModel(
       this.sessionId,
diff --git a/packages/sdk-typescript/src/daemon/acpRouteTable.ts b/packages/sdk-typescript/src/daemon/acpRouteTable.ts
index d95faea429..2fe8ccc285 100644
--- a/packages/sdk-typescript/src/daemon/acpRouteTable.ts
+++ b/packages/sdk-typescript/src/daemon/acpRouteTable.ts
@@ -243,6 +243,39 @@ export const ROUTE_TABLE: readonly RouteEntry[] = [
       }),
     },
   },
+  // GET /session/:id/artifacts → _qwen/session/artifacts
+  {
+    httpMethod: 'GET',
+    pattern: /^\/session\/([^/]+)\/artifacts$/,
+    mapping: {
+      method: '_qwen/session/artifacts',
+      extractParams: (segs) => ({ sessionId: segs[0] }),
+    },
+  },
+  // POST /session/:id/artifacts → _qwen/session/artifacts/add
+  {
+    httpMethod: 'POST',
+    pattern: /^\/session\/([^/]+)\/artifacts$/,
+    mapping: {
+      method: '_qwen/session/artifacts/add',
+      extractParams: (segs, body) => ({
+        ...(isRecord(body) ? body : {}),
+        sessionId: segs[0],
+      }),
+    },
+  },
+  // DELETE /session/:id/artifacts/:artifactId → _qwen/session/artifacts/remove
+  {
+    httpMethod: 'DELETE',
+    pattern: /^\/session\/([^/]+)\/artifacts\/([^/]+)$/,
+    mapping: {
+      method: '_qwen/session/artifacts/remove',
+      extractParams: (segs) => ({
+        sessionId: segs[0],
+        artifactId: segs[1],
+      }),
+    },
+  },
   // POST /session/:id/recap → _qwen/session/recap
   {
     httpMethod: 'POST',
diff --git a/packages/sdk-typescript/src/daemon/events.ts b/packages/sdk-typescript/src/daemon/events.ts
index ebf84973bb..b01a6e6b5b 100644
--- a/packages/sdk-typescript/src/daemon/events.ts
+++ b/packages/sdk-typescript/src/daemon/events.ts
@@ -8,6 +8,7 @@ import type {
   DaemonEvent,
   DaemonErrorKind,
   DaemonMcpTransport,
+  DaemonSessionArtifactChange,
   PermissionOutcome,
 } from './types.js';
 // Single source of truth: the daemon publisher owns the wire literal in
@@ -41,6 +42,7 @@ export const DAEMON_KNOWN_EVENT_TYPE_VALUES = [
   'session_died',
   'session_closed',
   'session_metadata_updated',
+  'artifact_changed',
   MID_TURN_MESSAGE_INJECTED_EVENT,
   PENDING_PROMPT_ADDED_EVENT,
   PENDING_PROMPT_STARTED_EVENT,
@@ -280,6 +282,12 @@ export interface DaemonSessionMetadataUpdatedData {
   [key: string]: unknown;
 }
 
+export interface DaemonArtifactChangedData {
+  sessionId: string;
+  change: DaemonSessionArtifactChange;
+  [key: string]: unknown;
+}
+
 /**
  * `mid_turn_message_injected` payload. Emitted when the daemon drains
  * browser-queued mid-turn messages into the running turn (web-shell mid-turn
@@ -869,6 +877,10 @@ export type DaemonSessionMetadataUpdatedEvent = DaemonEventEnvelope<
   'session_metadata_updated',
   DaemonSessionMetadataUpdatedData
 >;
+export type DaemonArtifactChangedEvent = DaemonEventEnvelope<
+  'artifact_changed',
+  DaemonArtifactChangedData
+>;
 export type DaemonMidTurnMessageInjectedEvent = DaemonEventEnvelope<
   typeof MID_TURN_MESSAGE_INJECTED_EVENT,
   DaemonMidTurnMessageInjectedData
@@ -1048,6 +1060,7 @@ export type DaemonSessionEvent =
   | DaemonSessionDiedEvent
   | DaemonSessionClosedEvent
   | DaemonSessionMetadataUpdatedEvent
+  | DaemonArtifactChangedEvent
   | DaemonMidTurnMessageInjectedEvent
   | DaemonPendingPromptEvent
   | DaemonSessionBranchedEvent;
@@ -1498,6 +1511,10 @@ export function asKnownDaemonEvent(
       return isSessionMetadataUpdatedData(event.data)
         ? (event as DaemonSessionMetadataUpdatedEvent)
         : undefined;
+    case 'artifact_changed':
+      return isArtifactChangedData(event.data)
+        ? (event as DaemonArtifactChangedEvent)
+        : undefined;
     case MID_TURN_MESSAGE_INJECTED_EVENT:
       return isMidTurnMessageInjectedData(event.data)
         ? (event as DaemonMidTurnMessageInjectedEvent)
@@ -2017,6 +2034,7 @@ export function reduceDaemonSessionEvent(
     case 'mcp_server_removed':
     case 'settings_reloaded':
     case 'extensions_changed':
+    case 'artifact_changed':
     case MID_TURN_MESSAGE_INJECTED_EVENT:
     case PENDING_PROMPT_ADDED_EVENT:
     case PENDING_PROMPT_STARTED_EVENT:
@@ -2452,6 +2470,22 @@ function isSessionMetadataUpdatedData(
   );
 }
 
+function isArtifactChangedData(
+  value: unknown,
+): value is DaemonArtifactChangedData {
+  if (!isRecord(value) || !isNonEmptyString(value['sessionId'])) {
+    return false;
+  }
+  const change = value['change'];
+  if (!isRecord(change) || !isNonEmptyString(change['artifactId'])) {
+    return false;
+  }
+  return (
+    isNonEmptyString(change['action']) &&
+    (change['reason'] === undefined || isNonEmptyString(change['reason']))
+  );
+}
+
 function isMidTurnMessageInjectedData(
   value: unknown,
 ): value is DaemonMidTurnMessageInjectedData {
diff --git a/packages/sdk-typescript/src/daemon/index.ts b/packages/sdk-typescript/src/daemon/index.ts
index 61ae908077..5d210ba73f 100644
--- a/packages/sdk-typescript/src/daemon/index.ts
+++ b/packages/sdk-typescript/src/daemon/index.ts
@@ -191,6 +191,8 @@ export {
 export type {
   DaemonAgentChangedData,
   DaemonAgentChangedEvent,
+  DaemonArtifactChangedData,
+  DaemonArtifactChangedEvent,
   DaemonApprovalModeChangedData,
   DaemonApprovalModeChangedEvent,
   DaemonClientEvictedData,
@@ -499,5 +501,15 @@ export type {
   PromptTextContent,
   SetModelResult,
   SetSessionLanguageResult,
+  DaemonSessionArtifact,
+  DaemonSessionArtifactChange,
+  DaemonSessionArtifactInput,
+  DaemonSessionArtifactKind,
+  DaemonSessionArtifactMutationResult,
+  DaemonSessionArtifactRemovalReason,
+  DaemonSessionArtifactsEnvelope,
+  DaemonSessionArtifactSource,
+  DaemonSessionArtifactStatus,
+  DaemonSessionArtifactStorage,
   SessionMetadataResult,
 } from './types.js';
diff --git a/packages/sdk-typescript/src/daemon/types.ts b/packages/sdk-typescript/src/daemon/types.ts
index d1b4464a4d..0fad4728a1 100644
--- a/packages/sdk-typescript/src/daemon/types.ts
+++ b/packages/sdk-typescript/src/daemon/types.ts
@@ -235,6 +235,112 @@ export interface SessionMetadataResult {
   displayName?: string;
 }
 
+type OpenStringUnion<T extends string> = T | (string & {});
+
+/** Known artifact kinds mirrored from the daemon/core contract. */
+export type KnownDaemonSessionArtifactKind =
+  | 'file'
+  | 'link'
+  | 'html'
+  | 'image'
+  | 'video'
+  | 'audio'
+  | 'pdf'
+  | 'notebook'
+  | 'other';
+
+export type DaemonSessionArtifactKind =
+  OpenStringUnion<KnownDaemonSessionArtifactKind>;
+
+export type KnownDaemonSessionArtifactStorage =
+  | 'workspace'
+  | 'external_url'
+  | 'managed'
+  | 'published';
+
+export type DaemonSessionArtifactStorage =
+  OpenStringUnion<KnownDaemonSessionArtifactStorage>;
+
+export type KnownDaemonSessionArtifactSource = 'tool' | 'hook' | 'client';
+
+export type DaemonSessionArtifactSource =
+  OpenStringUnion<KnownDaemonSessionArtifactSource>;
+
+export type KnownDaemonSessionArtifactStatus = 'available' | 'missing';
+
+export type DaemonSessionArtifactStatus =
+  OpenStringUnion<KnownDaemonSessionArtifactStatus>;
+
+export interface DaemonSessionArtifactInput {
+  kind?: KnownDaemonSessionArtifactKind;
+  storage?: Exclude<KnownDaemonSessionArtifactStorage, 'published'>;
+  title: string;
+  description?: string;
+  workspacePath?: string;
+  managedId?: string;
+  url?: string;
+  mimeType?: string;
+  sizeBytes?: number;
+  metadata?: Record<string, string | number | boolean | null>;
+}
+
+export interface DaemonSessionArtifact {
+  id: string;
+  kind: DaemonSessionArtifactKind;
+  storage: DaemonSessionArtifactStorage;
+  source: DaemonSessionArtifactSource;
+  status: DaemonSessionArtifactStatus;
+  title: string;
+  description?: string;
+  workspacePath?: string;
+  managedId?: string;
+  url?: string;
+  mimeType?: string;
+  sizeBytes?: number;
+  metadata?: Record<string, string | number | boolean | null>;
+  clientRetained: boolean;
+  createdAt: string;
+  updatedAt: string;
+  toolCallId?: string;
+  toolName?: string;
+  hookEventName?: string;
+  clientId?: string;
+}
+
+export type KnownDaemonSessionArtifactChangeAction =
+  | 'created'
+  | 'updated'
+  | 'removed';
+export type DaemonSessionArtifactChangeAction =
+  OpenStringUnion<KnownDaemonSessionArtifactChangeAction>;
+
+export type KnownDaemonSessionArtifactRemovalReason = 'eviction' | 'explicit';
+export type DaemonSessionArtifactRemovalReason =
+  OpenStringUnion<KnownDaemonSessionArtifactRemovalReason>;
+
+export interface DaemonSessionArtifactChange {
+  action: DaemonSessionArtifactChangeAction;
+  artifactId: string;
+  artifact?: DaemonSessionArtifact;
+  reason?: DaemonSessionArtifactRemovalReason;
+}
+
+export interface DaemonSessionArtifactsEnvelope {
+  v: 1;
+  sessionId: string;
+  artifacts: DaemonSessionArtifact[];
+  generatedAt: string;
+  limits: {
+    maxArtifacts: number;
+  };
+}
+
+export interface DaemonSessionArtifactMutationResult {
+  v: 1;
+  sessionId: string;
+  changes: DaemonSessionArtifactChange[];
+}
+
 export type DaemonStatus =
   | 'ok'
   | 'warning'
diff --git a/packages/sdk-typescript/test/unit/DaemonClient.test.ts b/packages/sdk-typescript/test/unit/DaemonClient.test.ts
index 63ca83b6a1..840919ef3a 100644
--- a/packages/sdk-typescript/test/unit/DaemonClient.test.ts
+++ b/packages/sdk-typescript/test/unit/DaemonClient.test.ts
@@ -184,6 +184,93 @@ describe('DaemonClient', () => {
     });
   });
 
+  describe('session artifacts', () => {
+    it('lists session artifacts with an encoded session id', async () => {
+      const envelope = {
+        v: 1 as const,
+        sessionId: 'session/1',
+        artifacts: [],
+        generatedAt: '2026-07-01T00:00:00.000Z',
+        limits: { maxArtifacts: 200 },
+      };
+      const { fetch, calls } = recordingFetch(() =>
+        jsonResponse(200, envelope),
+      );
+      const client = new DaemonClient({ baseUrl: 'http://daemon', fetch });
+
+      await expect(
+        client.listSessionArtifacts('session/1', 'client-1'),
+      ).resolves.toEqual(envelope);
+      expect(calls[0]).toMatchObject({
+        url: 'http://daemon/session/session%2F1/artifacts',
+        method: 'GET',
+        headers: {
+          'x-qwen-client-id': 'client-1',
+        },
+        body: null,
+      });
+    });
+
+    it('adds session artifacts with client identity and JSON body', async () => {
+      const result = {
+        v: 1 as const,
+        sessionId: 'session/1',
+        changes: [
+          {
+            action: 'created' as const,
+            artifactId: 'artifact-1',
+          },
+        ],
+      };
+      const { fetch, calls } = recordingFetch(() => jsonResponse(200, result));
+      const client = new DaemonClient({ baseUrl: 'http://daemon', fetch });
+      const artifact = {
+        title: 'Client report',
+        url: 'https://example.com/report',
+      };
+
+      await expect(
+        client.addSessionArtifact('session/1', artifact, 'client-1'),
+      ).resolves.toEqual(result);
+      expect(calls[0]).toMatchObject({
+        url: 'http://daemon/session/session%2F1/artifacts',
+        method: 'POST',
+        headers: {
+          'content-type': 'application/json',
+          'x-qwen-client-id': 'client-1',
+        },
+        body: JSON.stringify(artifact),
+      });
+    });
+
+    it('removes session artifacts with encoded ids and client identity', async () => {
+      const result = {
+        v: 1 as const,
+        sessionId: 'session/1',
+        changes: [
+          {
+            action: 'removed' as const,
+            artifactId: 'artifact/1',
+          },
+        ],
+      };
+      const { fetch, calls } = recordingFetch(() => jsonResponse(200, result));
+      const client = new DaemonClient({ baseUrl: 'http://daemon', fetch });
+
+      await expect(
+        client.removeSessionArtifact('session/1', 'artifact/1', 'client-1'),
+      ).resolves.toEqual(result);
+      expect(calls[0]).toMatchObject({
+        url: 'http://daemon/session/session%2F1/artifacts/artifact%2F1',
+        method: 'DELETE',
+        headers: {
+          'x-qwen-client-id': 'client-1',
+        },
+        body: null,
+      });
+    });
+  });
+
   describe('workspace file helpers', () => {
     it('validates daemon content hashes with the daemon regex', () => {
       expect(isDaemonContentHash(`sha256:${'a'.repeat(64)}`)).toBe(true);
diff --git a/packages/sdk-typescript/test/unit/DaemonSessionClient.test.ts b/packages/sdk-typescript/test/unit/DaemonSessionClient.test.ts
index 335edf43d6..f873846eaf 100644
--- a/packages/sdk-typescript/test/unit/DaemonSessionClient.test.ts
+++ b/packages/sdk-typescript/test/unit/DaemonSessionClient.test.ts
@@ -440,6 +440,77 @@ describe('DaemonSessionClient', () => {
     expect(calls[0]?.headers['x-qwen-client-id']).toBe('client-1');
   });
 
+  it('forwards artifact helpers through DaemonClient with the bound clientId', async () => {
+    const listEnvelope = {
+      v: 1 as const,
+      sessionId: 's-1',
+      artifacts: [],
+      generatedAt: '2026-07-01T00:00:00.000Z',
+      limits: { maxArtifacts: 200 },
+    };
+    const mutationResult = {
+      v: 1 as const,
+      sessionId: 's-1',
+      changes: [],
+    };
+    const { fetch, calls } = recordingFetch((req) => {
+      if (
+        req.method === 'GET' &&
+        req.url === 'http://daemon/session/s-1/artifacts'
+      ) {
+        return jsonResponse(200, listEnvelope);
+      }
+      if (
+        req.method === 'POST' &&
+        req.url === 'http://daemon/session/s-1/artifacts'
+      ) {
+        return jsonResponse(200, mutationResult);
+      }
+      if (
+        req.method === 'DELETE' &&
+        req.url === 'http://daemon/session/s-1/artifacts/artifact-1'
+      ) {
+        return jsonResponse(200, mutationResult);
+      }
+      return jsonResponse(500, {
+        error: `unexpected ${req.method} ${req.url}`,
+      });
+    });
+    const client = new DaemonClient({ baseUrl: 'http://daemon', fetch });
+    const session = new DaemonSessionClient({
+      client,
+      session: {
+        sessionId: 's-1',
+        workspaceCwd: '/work/a',
+        attached: true,
+        clientId: 'client-1',
+      },
+    });
+
+    await expect(session.artifacts()).resolves.toEqual(listEnvelope);
+    await expect(
+      session.addArtifact({
+        title: 'Client report',
+        url: 'https://example.com/report',
+      }),
+    ).resolves.toEqual(mutationResult);
+    await expect(session.removeArtifact('artifact-1')).resolves.toEqual(
+      mutationResult,
+    );
+
+    expect(calls.map((call) => call.headers['x-qwen-client-id'])).toEqual([
+      'client-1',
+      'client-1',
+      'client-1',
+    ]);
+    expect(calls[1]?.body).toBe(
+      JSON.stringify({
+        title: 'Client report',
+        url: 'https://example.com/report',
+      }),
+    );
+  });
+
   it('forwards recap through DaemonClient with the bound clientId and signal', async () => {
     const { fetch, calls } = recordingFetch(() =>
       jsonResponse(200, {
diff --git a/packages/sdk-typescript/test/unit/acpRouteTable.test.ts b/packages/sdk-typescript/test/unit/acpRouteTable.test.ts
index 883f5aed5d..a5eced81bd 100644
--- a/packages/sdk-typescript/test/unit/acpRouteTable.test.ts
+++ b/packages/sdk-typescript/test/unit/acpRouteTable.test.ts
@@ -231,6 +231,45 @@ describe('acpRouteTable – matchRoute', () => {
     expect(result!.mapping.method).toBe('_qwen/session/heartbeat');
   });
 
+  it('GET /session/:id/artifacts maps to _qwen/session/artifacts', () => {
+    const result = matchRoute('/session/s8/artifacts', 'GET');
+    expect(result).not.toBeNull();
+    expect(result!.mapping.method).toBe('_qwen/session/artifacts');
+    expect(
+      result!.mapping.extractParams(result!.segments, undefined, 'GET'),
+    ).toEqual({ sessionId: 's8' });
+  });
+
+  it('POST /session/:id/artifacts maps to _qwen/session/artifacts/add', () => {
+    const result = matchRoute('/session/s8/artifacts', 'POST');
+    expect(result).not.toBeNull();
+    expect(result!.mapping.method).toBe('_qwen/session/artifacts/add');
+    expect(
+      result!.mapping.extractParams(
+        result!.segments,
+        {
+          sessionId: 'body-session',
+          title: 'Lineage',
+          url: 'https://example.com/lineage',
+        },
+        'POST',
+      ),
+    ).toEqual({
+      sessionId: 's8',
+      title: 'Lineage',
+      url: 'https://example.com/lineage',
+    });
+  });
+
+  it('DELETE /session/:id/artifacts/:artifactId maps to _qwen/session/artifacts/remove', () => {
+    const result = matchRoute('/session/s8/artifacts/art%201', 'DELETE');
+    expect(result).not.toBeNull();
+    expect(result!.mapping.method).toBe('_qwen/session/artifacts/remove');
+    expect(
+      result!.mapping.extractParams(result!.segments, undefined, 'DELETE'),
+    ).toEqual({ sessionId: 's8', artifactId: 'art 1' });
+  });
+
   it('POST /session/:id/recap maps to _qwen/session/recap', () => {
     const result = matchRoute('/session/s9/recap', 'POST');
     expect(result).not.toBeNull();
diff --git a/packages/sdk-typescript/test/unit/daemonEvents.test.ts b/packages/sdk-typescript/test/unit/daemonEvents.test.ts
index 8d265d201c..88ac393803 100644
--- a/packages/sdk-typescript/test/unit/daemonEvents.test.ts
+++ b/packages/sdk-typescript/test/unit/daemonEvents.test.ts
@@ -155,6 +155,86 @@ describe('daemon event schema', () => {
     expect(isDaemonEventType(event, 'trust_change_requested')).toBe(true);
   });
 
+  it('recognizes artifact_changed as a known daemon event', () => {
+    const event: DaemonEvent = {
+      id: 3,
+      v: 1,
+      type: 'artifact_changed',
+      data: {
+        sessionId: 's-1',
+        change: {
+          action: 'created',
+          artifactId: 'art-1',
+          artifact: {
+            id: 'art-1',
+            kind: 'link',
+            storage: 'external_url',
+            source: 'client',
+            status: 'available',
+            title: 'Lineage',
+            url: 'https://example.com/lineage',
+            clientRetained: true,
+            createdAt: '2026-06-30T00:00:00.000Z',
+            updatedAt: '2026-06-30T00:00:00.000Z',
+          },
+        },
+      },
+    };
+
+    const known = asKnownDaemonEvent(event);
+
+    expect(known).toBe(event);
+    expect(known?.type).toBe('artifact_changed');
+    expect(isDaemonEventType(event, 'artifact_changed')).toBe(true);
+  });
+
+  it('keeps artifact_changed events with future artifact literals', () => {
+    const event: DaemonEvent = {
+      id: 4,
+      v: 1,
+      type: 'artifact_changed',
+      data: {
+        sessionId: 's-1',
+        change: {
+          action: 'created',
+          artifactId: 'art-2',
+          artifact: {
+            id: 'art-2',
+            kind: 'diagram',
+            storage: 'remote_preview',
+            source: 'extension',
+            status: 'warming',
+            title: 'Future artifact',
+            url: 'https://example.com/future',
+            clientRetained: false,
+            createdAt: '2026-06-30T00:00:00.000Z',
+            updatedAt: '2026-06-30T00:00:00.000Z',
+          },
+        },
+      },
+    };
+
+    expect(asKnownDaemonEvent(event)).toBe(event);
+  });
+
+  it('keeps artifact_changed events with future change literals', () => {
+    const event: DaemonEvent = {
+      id: 5,
+      v: 1,
+      type: 'artifact_changed',
+      data: {
+        sessionId: 's-1',
+        change: {
+          action: 'renamed',
+          artifactId: 'art-3',
+          reason: 'lifecycle_policy',
+        },
+      },
+    };
+
+    expect(asKnownDaemonEvent(event)).toBe(event);
+  });
+
   it('leaves malformed or unknown events on the raw DaemonEvent path', () => {
     expect(
       asKnownDaemonEvent({
diff --git a/packages/vscode-ide-companion/schemas/settings.schema.json b/packages/vscode-ide-companion/schemas/settings.schema.json
index eba68b0b18..748bacd9b2 100644
--- a/packages/vscode-ide-companion/schemas/settings.schema.json
+++ b/packages/vscode-ide-companion/schemas/settings.schema.json
@@ -2780,7 +2780,7 @@
           "default": false
         },
         "artifact": {
-          "description": "Enable the Artifact tool (experimental). When enabled, the model can publish a self-contained HTML page as an interactive Artifact and open it in the browser. Interactive, non-SDK sessions only. Can also be enabled via QWEN_CODE_ENABLE_ARTIFACT=1, or hard-disabled via QWEN_CODE_DISABLE_ARTIFACT=1.",
+          "description": "Enable the Artifact tool (experimental). When enabled, the model can publish a self-contained HTML page as an interactive Artifact and open it in the browser. Interactive, non-SDK sessions only. QWEN_CODE_ENABLE_ARTIFACT=1 enables the metadata-only record_artifact tool for non-SDK daemon sessions, and also enables the Artifact tool in interactive sessions. QWEN_CODE_DISABLE_ARTIFACT=1 hard-disables both.",
           "type": "boolean",
           "default": false
         },