chainlesschain 0.162.156 → 0.162.157

package/src/lib/shell-selector.cjs

@@ -0,0 +1,203 @@
+"use strict";
+
+/**
+ * shell-selector — Windows / PowerShell first-class shell selection
+ * (gap-analysis P1 #8).
+ *
+ * Decides WHICH shell a `run_shell` command (or a settings hook with a
+ * `shell` field) executes under:
+ *
+ *   - per-call:   run_shell `{ shell: "powershell" | "pwsh" | "cmd" | "default" }`
+ *   - configured: settings `shell.windowsDefault` ("cmd" | "powershell" | "pwsh",
+ *                 layered .claude/settings.json, closest wins) or the
+ *                 CC_WINDOWS_SHELL env var (wins over settings)
+ *   - default:    unchanged platform default (cmd.exe via ComSpec on Windows,
+ *                 /bin/sh elsewhere) — the unconfigured path is byte-identical.
+ *
+ * PowerShell runs go through explicit argv (`powershell.exe -NoProfile
+ * [-ExecutionPolicy <p>] -Command <command>`), NOT `shell: "powershell.exe"`,
+ * so the enterprise ExecutionPolicy override (settings
+ * `shell.powershell.executionPolicy`) can be applied per-invocation without
+ * touching machine state. The policy value is validated against the fixed
+ * PowerShell enum — a settings typo can NOT smuggle extra argv.
+ *
+ * Scope notes:
+ *   - `windowsDefault` only applies on win32 (hence the name). A per-call
+ *     `pwsh` request is honored on any platform (PowerShell 7 is
+ *     cross-platform); `powershell`/`cmd` requests outside Windows fall back
+ *     to the platform default with a note.
+ *   - `-ExecutionPolicy` is only attached on win32 (POSIX pwsh has no policy).
+ *   - Hooks opt in per-hook via `{ "shell": "powershell" }` — the configured
+ *     windowsDefault deliberately does NOT rewrite existing hooks.
+ */
+
+const settingsLoader = require("./settings-loader.cjs");
+
+const SHELL_KINDS = Object.freeze(["default", "cmd", "powershell", "pwsh"]);
+
+/** The fixed PowerShell ExecutionPolicy enum (canonical casing). */
+const EXECUTION_POLICIES = Object.freeze([
+  "Restricted",
+  "AllSigned",
+  "RemoteSigned",
+  "Unrestricted",
+  "Bypass",
+  "Undefined",
+]);
+
+/** Normalize a shell kind; unknown/empty → null (fail to default). */
+function normalizeShellKind(value) {
+  if (typeof value !== "string") return null;
+  const v = value.trim().toLowerCase();
+  if (v === "powershell.exe" || v === "windowspowershell") return "powershell";
+  if (v === "pwsh.exe") return "pwsh";
+  if (v === "cmd.exe") return "cmd";
+  return SHELL_KINDS.includes(v) ? v : null;
+}
+
+/** Normalize an ExecutionPolicy to canonical casing; unknown → null. */
+function normalizeExecutionPolicy(value) {
+  if (typeof value !== "string") return null;
+  const v = value.trim().toLowerCase();
+  return EXECUTION_POLICIES.find((p) => p.toLowerCase() === v) || null;
+}
+
+/**
+ * Layered `shell` settings: `{ windowsDefault, powershell: { executionPolicy } }`.
+ * Closest layer wins per key; invalid values are ignored (fail-to-default).
+ * CC_WINDOWS_SHELL env overrides the settings-provided windowsDefault.
+ *
+ * @param {{ cwd?: string, env?: object, settingsFile?: string, onWarn?: Function }} [opts]
+ * @returns {{ windowsDefault: string|null, executionPolicy: string|null, files: string[] }}
+ */
+// Per-process memo: run_shell resolves the config on EVERY call, and the
+// layered settings walk is filesystem I/O. A short TTL keeps mid-session
+// settings edits honored without re-reading per tool call.
+const _configCache = new Map(); // key → { at, value }
+const CONFIG_CACHE_TTL_MS = 3000;
+
+function loadShellConfig(opts = {}) {
+  const cwd = opts.cwd || process.cwd();
+  const env = opts.env || process.env;
+  const cacheable = !opts.env && !opts.onWarn;
+  const cacheKey = cacheable ? `${cwd}|${opts.settingsFile || ""}` : null;
+  if (cacheKey) {
+    const hit = _configCache.get(cacheKey);
+    if (hit && Date.now() - hit.at < CONFIG_CACHE_TTL_MS) return hit.value;
+  }
+  let windowsDefault = null;
+  let executionPolicy = null;
+  const files = [];
+  try {
+    for (const file of settingsLoader.settingsPaths(cwd, opts.settingsFile)) {
+      const data = settingsLoader.readSettingsFile(file, {
+        onWarn: opts.onWarn,
+      });
+      const shell = data && typeof data === "object" ? data.shell : null;
+      if (!shell || typeof shell !== "object" || Array.isArray(shell)) continue;
+      const kind = normalizeShellKind(shell.windowsDefault);
+      if (kind) windowsDefault = kind;
+      const pol = normalizeExecutionPolicy(shell.powershell?.executionPolicy);
+      if (pol) executionPolicy = pol;
+      files.push(file);
+    }
+  } catch {
+    /* settings are best-effort — never fail shell resolution over them */
+  }
+  const envKind = normalizeShellKind(env.CC_WINDOWS_SHELL);
+  if (envKind) windowsDefault = envKind;
+  const value = { windowsDefault, executionPolicy, files };
+  if (cacheKey) _configCache.set(cacheKey, { at: Date.now(), value });
+  return value;
+}
+
+/** Test hook: drop the config memo. */
+function _clearShellConfigCache() {
+  _configCache.clear();
+}
+
+/**
+ * Build the explicit argv for a PowerShell invocation of `command`.
+ * @param {string} command
+ * @param {"powershell"|"pwsh"} kind
+ * @param {{ executionPolicy?: string|null, platform?: string }} [opts]
+ * @returns {{ file: string, argv: string[] }}
+ */
+function buildPowershellArgv(command, kind, opts = {}) {
+  const platform = opts.platform || process.platform;
+  const file = kind === "pwsh" ? "pwsh" : "powershell.exe";
+  const policy =
+    platform === "win32"
+      ? normalizeExecutionPolicy(opts.executionPolicy)
+      : null;
+  return {
+    file,
+    argv: [
+      "-NoProfile",
+      ...(policy ? ["-ExecutionPolicy", policy] : []),
+      "-Command",
+      String(command ?? ""),
+    ],
+  };
+}
+
+/**
+ * Resolve how to run one shell command.
+ *
+ * Precedence: per-call `requested` > configured windowsDefault (win32 only)
+ * > platform default. Returns either the default-shell marker (caller keeps
+ * its existing exec/spawn `shell: true` path — byte-identical) or an explicit
+ * `{ file, argv }` PowerShell invocation.
+ *
+ * @param {{ command: string, requested?: string, cwd?: string, env?: object,
+ *           platform?: string, settingsFile?: string,
+ *           config?: { windowsDefault?: string|null, executionPolicy?: string|null } }} opts
+ * @returns {{ kind: string, useDefaultShell: boolean, file?: string,
+ *            argv?: string[], note?: string }}
+ */
+function resolveShellInvocation(opts = {}) {
+  const platform = opts.platform || process.platform;
+  const config = opts.config || loadShellConfig(opts);
+  const requested = normalizeShellKind(opts.requested);
+  let kind =
+    requested ||
+    (platform === "win32" ? config.windowsDefault : null) ||
+    "default";
+  let note;
+
+  if (kind === "cmd") {
+    if (platform === "win32") {
+      // cmd IS the Windows default shell — take the untouched default path so
+      // an explicit `shell:"cmd"` opt-out of a PowerShell windowsDefault stays
+      // byte-identical to the historical behavior.
+      return { kind: "cmd", useDefaultShell: true };
+    }
+    note = "cmd is Windows-only; using the platform default shell";
+    return { kind: "default", useDefaultShell: true, note };
+  }
+  if (kind === "powershell" && platform !== "win32") {
+    // Windows PowerShell 5.1 doesn't exist off-Windows; pwsh might.
+    note =
+      "powershell (5.1) is Windows-only; using the platform default shell (request pwsh for PowerShell 7)";
+    return { kind: "default", useDefaultShell: true, note };
+  }
+  if (kind === "powershell" || kind === "pwsh") {
+    const { file, argv } = buildPowershellArgv(opts.command, kind, {
+      executionPolicy: config.executionPolicy,
+      platform,
+    });
+    return { kind, useDefaultShell: false, file, argv };
+  }
+  return { kind: "default", useDefaultShell: true };
+}
+
+module.exports = {
+  SHELL_KINDS,
+  EXECUTION_POLICIES,
+  normalizeShellKind,
+  normalizeExecutionPolicy,
+  loadShellConfig,
+  buildPowershellArgv,
+  resolveShellInvocation,
+  _clearShellConfigCache,
+};

package/src/lib/skill-loader.js

@@ -68,6 +68,19 @@ export function bundledSkillsDisabled(opts = {}) {
   }
 }
 
+/**
+ * Whether ALL skill layers are disabled — `cc agent --bare` sets CC_SKILLS=0
+ * (safe-mode "feature=0 disables" convention). Single gate: `loadAll` is the
+ * one place every layer funnels through, so this empties list_skills /
+ * run_skill / persona auto-activation in one check.
+ * @param {{ env?: object }} [opts]
+ * @returns {boolean}
+ */
+export function allSkillsDisabled(opts = {}) {
+  const raw = (opts.env || process.env).CC_SKILLS;
+  return raw != null && /^(0|false|no|off)$/i.test(String(raw).trim());
+}
+
 /** Layer names in priority order (lowest → highest) */
 export const LAYER_NAMES = [
   "bundled",
@@ -475,6 +488,12 @@ export class CLISkillLoader {
    * @returns {object[]} Resolved skill list
    */
   loadAll(options = {}) {
+    // `cc agent --bare` (CC_SKILLS=0): no skill layer loads at all — cache the
+    // empty result so getResolvedSkills stays cheap on every call.
+    if (allSkillsDisabled(options)) {
+      this._cache = [];
+      return this._cache;
+    }
     const layers = this.getLayerPaths();
     const skillMap = new Map();
     // Claude-Code `disableBundledSkills`: hide the built-in layer so only

package/src/lib/slash-dispatch.js

@@ -0,0 +1,34 @@
+/**
+ * `cc agent --disable-slash-commands` — REPL slash-dispatch bypass predicate.
+ *
+ * When active, a "/"-leading line is NOT dispatched to the built-in slash
+ * handlers (nor custom .claude/commands macros nor MCP prompt expansion): it
+ * reaches the model verbatim, the same fall-through an unmatched slash line
+ * already takes. `/exit` and `/quit` stay live so the session remains
+ * closable from the keyboard.
+ *
+ * The REPL swaps the dispatched string for a sentinel no handler can match
+ * (leading NUL — nothing in the dispatch chain starts with a control char)
+ * and restores the user's real text for the model turn.
+ */
+
+/** The dispatch sentinel — starts with NUL so no handler branch matches. */
+export function slashBypassSentinel() {
+  return String.fromCharCode(0) + "slash-bypassed";
+}
+
+/**
+ * Should this line bypass slash dispatch?
+ * @param {string} line     the trimmed input line
+ * @param {boolean} disabled  whether --disable-slash-commands is active
+ * @returns {boolean}
+ */
+export function slashDispatchBypassed(line, disabled) {
+  return (
+    disabled === true &&
+    typeof line === "string" &&
+    line.startsWith("/") &&
+    line !== "/exit" &&
+    line !== "/quit"
+  );
+}

package/src/repl/agent-repl.js

@@ -1262,6 +1262,24 @@ export async function startAgentRepl(options = {}) {
     options.vimMode === true || process.env.CC_VIM === "1" ? true : false;
   let _vim = null;
 
+  // --disable-slash-commands (Claude-Code parity): built-in slash dispatch,
+  // custom command macros and MCP prompt expansion are all bypassed — a
+  // "/"-leading line reaches the model verbatim, the same fall-through an
+  // unmatched slash line already takes. /exit and /quit stay live so the
+  // session remains closable from the keyboard.
+  const _slashCommandsDisabled =
+    options.disableSlashCommands === true ||
+    /^(1|true|yes|on)$/i.test(
+      String(process.env.CC_DISABLE_SLASH_COMMANDS || "").trim(),
+    );
+
+  // --ax-screen-reader / CC_SCREEN_READER: force the mono theme (no ANSI
+  // color codes) so output linearizes cleanly. The repainting status line is
+  // already killed by the CC_STATUSLINE=0 switch agent.js applies.
+  const _screenReaderMode = /^(1|true|yes|on)$/i.test(
+    String(process.env.CC_SCREEN_READER || "").trim(),
+  );
+
   // Color theme (Claude-Code `/theme` parity). Capture chalk's auto-detected
   // level BEFORE any theme touches it so `mono`→level 0 stays reversible, then
   // apply the persisted theme (config `cli.theme`). `mono` strips all color;
@@ -1282,6 +1300,10 @@ export async function startAgentRepl(options = {}) {
   } catch (_e) {
     /* config optional — keep default */
   }
+  // Screen-reader mode overrides the persisted theme: colors are invisible to
+  // a reader and ANSI codes are noise, so run mono for this session (the
+  // stored cli.theme is untouched — /theme still shows and can change it).
+  if (_screenReaderMode) _theme = "mono";
   applyThemeChalk(_theme, chalk, _chalkBaselineLevel);
   const themedPrompt = (text) => {
     const a = promptAccent(_theme);
@@ -1316,65 +1338,69 @@ export async function startAgentRepl(options = {}) {
     // cwd left unset on purpose: the completer resolves process.cwd() lazily
     // so it follows `/cd` mid-session.
     // Keep in sync with the rl.on("line") handlers + /help below.
-    slashCommands: [
-      "/add-dir",
-      "/agents",
-      "/auto",
-      "/btw",
-      "/cd",
-      "/clear",
-      "/compact",
-      "/config",
-      "/context",
-      "/copy",
-      "/cost",
-      "/cowork",
-      "/doctor",
-      "/effort",
-      "/exit",
-      "/export",
-      "/help",
-      "/hooks",
-      "/ide",
-      "/init",
-      "/mcp",
-      "/memory",
-      "/microcompact",
-      "/model",
-      "/output-style",
-      "/permissions",
-      "/plan",
-      "/pr-comments",
-      "/profile",
-      "/provider",
-      "/quit",
-      "/reindex",
-      "/release-notes",
-      "/reload-plugins",
-      "/reload-skills",
-      "/review",
-      "/rewind",
-      "/search",
-      "/session",
-      "/sessions",
-      "/stats",
-      "/status",
-      "/statusline",
-      "/sub-agents",
-      "/task",
-      "/tasks",
-      "/terminal-setup",
-      "/theme",
-      "/think",
-      "/todos",
-      "/ultrathink",
-      "/vim",
-    ],
+    // --disable-slash-commands: nothing to complete — "/" input is plain text.
+    slashCommands: _slashCommandsDisabled
+      ? []
+      : [
+          "/add-dir",
+          "/agents",
+          "/auto",
+          "/btw",
+          "/cd",
+          "/clear",
+          "/compact",
+          "/config",
+          "/context",
+          "/copy",
+          "/cost",
+          "/cowork",
+          "/doctor",
+          "/effort",
+          "/exit",
+          "/export",
+          "/help",
+          "/hooks",
+          "/ide",
+          "/init",
+          "/mcp",
+          "/memory",
+          "/microcompact",
+          "/model",
+          "/output-style",
+          "/permissions",
+          "/plan",
+          "/pr-comments",
+          "/profile",
+          "/provider",
+          "/quit",
+          "/reindex",
+          "/release-notes",
+          "/reload-plugins",
+          "/reload-skills",
+          "/review",
+          "/rewind",
+          "/search",
+          "/session",
+          "/sessions",
+          "/stats",
+          "/status",
+          "/statusline",
+          "/sub-agents",
+          "/task",
+          "/tasks",
+          "/terminal-setup",
+          "/theme",
+          "/think",
+          "/todos",
+          "/ultrathink",
+          "/vim",
+        ],
     // User/project custom commands (.claude/commands/*.md) join TAB completion
     // alongside the built-ins above. Sync + best-effort; the completer
     // TTL-caches the result so this filesystem walk runs at most once per few
     // seconds, and process.cwd() makes it follow `/cd` mid-session.
     getDynamicSlashCommands: () => {
+      if (_slashCommandsDisabled) return [];
       try {
         return discoverCommands(process.cwd()).map((cmd) => `/${cmd.name}`);
       } catch {
@@ -1719,7 +1745,20 @@ export async function startAgentRepl(options = {}) {
       _mlBuffer.length = 0;
     }
 
-    const trimmed = input.trim();
+    const rawLine = input.trim();
+    // --disable-slash-commands: hide "/"-leading input from every built-in
+    // slash handler below by dispatching a sentinel no handler can match; the
+    // turn tail restores the user's real text (promptText), so the line goes
+    // to the model verbatim — the same fall-through an unmatched slash line
+    // already takes. /exit and /quit stay live so the session can be closed.
+    // Predicate + sentinel are pure (lib/slash-dispatch.js, unit-tested).
+    const { slashDispatchBypassed, slashBypassSentinel } =
+      await import("../lib/slash-dispatch.js");
+    const _slashBypassed = slashDispatchBypassed(
+      rawLine,
+      _slashCommandsDisabled,
+    );
+    const trimmed = _slashBypassed ? slashBypassSentinel() : rawLine;
     if (!trimmed) {
       prompt();
       return;
@@ -4086,13 +4125,15 @@ export async function startAgentRepl(options = {}) {
     // parity. resolveSlashMacro maps a leading /name to a command macro and
     // expands its template; a non-match returns the line unchanged so a literal
     // prompt like "/etc/hosts" still reaches the LLM. Wire is unit-tested.
-    let promptText = trimmed;
+    // Under --disable-slash-commands the sentinel never reached a handler;
+    // restore the user's real text so the model sees it verbatim.
+    let promptText = _slashBypassed ? rawLine : trimmed;
 
     // MCP server-provided prompts (Claude-Code parity): `/mcp__<server>__<name>
     // [json-args]` fetches a rendered prompt template from the connected MCP
     // server and uses its text as this turn's input. Falls through unchanged
     // when the line isn't an MCP prompt command.
-    if (promptText.startsWith("/mcp__")) {
+    if (!_slashBypassed && promptText.startsWith("/mcp__")) {
       try {
         const expanded = await expandMcpPrompt(
           promptText,
@@ -4114,7 +4155,7 @@ export async function startAgentRepl(options = {}) {
     // `/pr-comments [<n>|<url>] [--repo owner/name]` (Claude-Code parity):
     // fetch a GitHub PR's reviews + conversation + inline comments via `gh` and
     // feed them as this turn's input so the agent can address the feedback.
-    if (promptText.startsWith("/pr-comments")) {
+    if (!_slashBypassed && promptText.startsWith("/pr-comments")) {
       try {
         const { expandPrComments } = await import("./pr-comments.js");
         const res = await expandPrComments(promptText);

package/src/runtime/agent-core.js

@@ -1041,6 +1041,7 @@ async function tryIdeDiffApprovalForEdit(
       hasIdeOpenDiff,
       requestIdeDiffApproval,
       formatReviewComments,
+      summarizeUserAmendments,
     } = await import("../lib/ide-context.js");
     const mcpLike = {
       mcpClient: context.mcpClient,
@@ -1056,15 +1057,22 @@ async function tryIdeDiffApprovalForEdit(
       title: `cc agent: ${name} ${path.basename(proposal.filePath)}`,
     });
     if (verdict?.outcome === "accepted") {
+      // When the reviewer amended the proposal in the diff before accepting,
+      // hand the agent the actual -/+ delta — not just a flag — so its model
+      // of the file matches what was really written (gap #4: the agent
+      // perceives the user's edits).
+      const amendments =
+        verdict.finalText != null && verdict.finalText !== proposal.newContent
+          ? summarizeUserAmendments(proposal.newContent, verdict.finalText)
+          : null;
       return {
         outcome: "accepted",
         result: {
           success: true,
           path: proposal.filePath,
           appliedVia: "ide-diff",
-          ...(verdict.finalText != null &&
-          verdict.finalText !== proposal.newContent
-            ? { userEdited: true }
+          ...(amendments
+            ? { userEdited: true, userAmendments: amendments }
             : {}),
           policy: { decision: "allow", rule, via: "ide-diff" },
         },
@@ -2431,6 +2439,24 @@ async function executeToolInner(
         }
       }
 
+      // P1 #8 Windows/PowerShell first-class: per-call args.shell or the
+      // configured settings `shell.windowsDefault` may route this command
+      // through PowerShell via explicit argv (`powershell.exe -NoProfile
+      // [-ExecutionPolicy <p>] -Command <cmd>`). The unconfigured path keeps
+      // the historical default shell byte-identical (useDefaultShell=true).
+      const { resolveShellInvocation } =
+        await import("../lib/shell-selector.cjs");
+      const shellInv = resolveShellInvocation({
+        command: args.command,
+        requested: args.shell,
+        cwd: args.cwd || cwd,
+      });
+      const shellMeta = shellInv.useDefaultShell
+        ? shellInv.note
+          ? { shell_note: shellInv.note }
+          : {}
+        : { shell: shellInv.kind };
+
       // Background: spawn, register, return a task_id immediately. The agent
       // polls output + completion via check_shell. No timeout — that's the whole
       // point of backgrounding (builds, test suites, dev servers).
@@ -2463,9 +2489,9 @@ async function executeToolInner(
           child: null,
         };
         try {
-          const child = spawn(args.command, {
+          const bgSpawnOpts = {
             cwd: task.cwd,
-            shell: true,
+            shell: shellInv.useDefaultShell,
             windowsHide: true,
             // Same agent-identity env as the foreground path: CLAUDECODE marks
             // "running under the agent"; the session id correlates work to the
@@ -2484,7 +2510,12 @@ async function executeToolInner(
             // the whole tree (shell + its grandchild command). No-op on Windows
             // where the tree is killed via taskkill /T instead.
             detached: process.platform !== "win32",
-          });
+          };
+          // PowerShell route: explicit argv (shell:false above); default route
+          // is the historical spawn(command, {shell:true}) byte-for-byte.
+          const child = shellInv.useDefaultShell
+            ? spawn(args.command, bgSpawnOpts)
+            : spawn(shellInv.file, shellInv.argv, bgSpawnOpts);
           task.child = child;
           if (child.stdout) {
             child.stdout.setEncoding("utf8");
@@ -2532,6 +2563,7 @@ async function executeToolInner(
             task_id: id,
             status: task.status,
             command: task.command,
+            ...shellMeta,
             hint: "Poll output and completion with the check_shell tool using this task_id. Kill long-lived servers with check_shell { task_id, kill: true } when done.",
             shellCommandPolicy: shellPolicy,
             approval: approvalOutcome,
@@ -2630,7 +2662,7 @@ async function executeToolInner(
       }
 
       try {
-        const output = execSync(args.command, {
+        const fgExecOpts = {
           cwd: args.cwd || cwd,
           encoding: "utf8",
           timeout: _resolveShellTimeout(args.timeout),
@@ -2649,10 +2681,35 @@ async function executeToolInner(
                 }
               : {}),
           },
-        });
+        };
+        let output;
+        if (shellInv.useDefaultShell) {
+          output = execSync(args.command, fgExecOpts);
+        } else {
+          // PowerShell route: explicit argv, no intermediate default shell.
+          // Reproduce execSync's contract so the shared catch shapes errors
+          // identically: throw on spawn error; throw an Error carrying
+          // status/stdout/stderr on non-zero exit.
+          const res = spawnSync(shellInv.file, shellInv.argv, {
+            ...fgExecOpts,
+            windowsHide: true,
+          });
+          if (res.error) throw res.error;
+          if (res.status !== 0) {
+            const e = new Error(
+              `Command failed (${shellInv.kind}, exit ${res.status}): ${args.command}`,
+            );
+            e.status = res.status;
+            e.stdout = res.stdout;
+            e.stderr = res.stderr;
+            throw e;
+          }
+          output = res.stdout ?? "";
+        }
         return attachDescriptor(
           {
             stdout: output.substring(0, 30000),
+            ...shellMeta,
             shellCommandPolicy: shellPolicy,
             approval: approvalOutcome,
           },
@@ -2672,6 +2729,7 @@ async function executeToolInner(
               : {}),
             stderr: (err.stderr || "").substring(0, 2000),
             exitCode: err.status,
+            ...shellMeta,
             shellCommandPolicy: shellPolicy,
             approval: approvalOutcome,
           },
@@ -3104,6 +3162,31 @@ async function executeToolInner(
       }
     }
 
+    case "publish_artifact": {
+      // P1 #10: copy a finished deliverable into the user's artifact store.
+      // Only METADATA returns to the conversation (the transcript never
+      // carries the file body); `cc artifacts` lists/inspects/cleans.
+      try {
+        const { ArtifactStore } = await import("../lib/artifact-store.js");
+        const store = new ArtifactStore();
+        const entry = store.publish({
+          filePath: path.resolve(cwd, String(args.path || "")),
+          title: args.title,
+          kind: args.kind,
+          ttlDays: args.ttl_days,
+          sessionId: sessionId ? String(sessionId) : null,
+        });
+        return attachDescriptor({
+          published: entry,
+          hint: "The user can browse this with `cc artifacts list` / `cc artifacts show <id>`.",
+        });
+      } catch (err) {
+        return attachDescriptor({
+          error: `publish_artifact failed: ${err.message}`,
+        });
+      }
+    }
+
     case "search_files": {
       // An explicit directory scopes the search to one root; otherwise span
       // cwd plus any --add-dir roots so cross-package searches find matches.
@@ -6438,6 +6521,8 @@ export function formatToolArgs(name, args) {
       return `"${(args.query || "").substring(0, 60)}"`;
     case "notify":
       return `${args.level || "info"}: ${(args.title || "").substring(0, 50)}`;
+    case "publish_artifact":
+      return `${args.kind || "other"}: ${(args.title || args.path || "").substring(0, 60)}`;
     case "schedule":
       return args.action === "cron"
         ? `cron ${args.cron || ""}`.trim()