artifacty 0.1.1 → 0.2.0

package/AGENTS.md

@@ -8,11 +8,11 @@ Artifacty shares LLM artifacts over HTTP, CLI, and MCP.
 - `src/mcp-server.js`: MCP stdio server exposing Artifacty tools.
 - `src/cli.js`: command-line interface for serving, publishing, importing, listing, and reading artifacts.
 - `src/lib/storage.js`: SQLite metadata store and immutable version-file handling.
-- `src/lib/converters.js`: agent artifact conversion rules for Claude, Codex, Gemini, and generic payloads.
+- `src/lib/converters.js`: agent artifact conversion rules for Claude, Codex, Gemini, GitHub Copilot, Cursor, and generic payloads.
 - `src/lib/installer.js`: MCP config installers for Claude, Codex, and Gemini.
 - `src/lib/render.js`: server-rendered dashboard, viewer, and editor HTML.
 - `test/*.test.js`: Node test runner suites.
-- `docs/integrations.md`: setup notes for Claude Code, Codex, and Gemini CLI.
+- `docs/integrations.md`: setup notes for Claude Code, Codex, Gemini CLI, GitHub Copilot in VS Code, and Cursor.
 
 ## Build, Test, and Development Commands
 

package/README.md

@@ -5,7 +5,7 @@
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 [![Node.js >=22.5](https://img.shields.io/badge/node-%3E%3D22.5-339933.svg)](package.json)
 
-Artifacty is a local, agent-to-agent artifact exchange for LLM workflows. Claude, Codex, Gemini, and other MCP-capable tools can publish an artifact once, then other agents can list, read, update, and continue from it without copying content through chat.
+Artifacty is a local, agent-to-agent artifact exchange for LLM workflows. Claude, Codex, Gemini, GitHub Copilot, Cursor, and other MCP-capable tools can publish an artifact once, then other agents can list, read, update, and continue from it without copying content through chat.
 
 ![Artifacty overview showing multiple AI agents sharing artifacts through a local exchange](docs/assets/artifacty.png)
 
@@ -38,6 +38,17 @@ artifacty serve
 
 Open the URL printed by the server. Artifacty prefers `http://127.0.0.1:8787`; if that default port is busy and no explicit port was configured, it starts on the next available local port and records the actual URL for CLI and MCP responses.
 
+Run it in the background and return to your prompt:
+
+```bash
+artifacty start
+artifacty status
+artifacty stop
+```
+
+`artifacty serve --detach` is equivalent to `artifacty start`. Logs are written under `~/.artifacty/logs/`.
+These lifecycle commands use Node's detached process support and work on macOS, Linux, and Windows. `artifacty stop` uses Windows `taskkill` on Windows and process-group signals on macOS/Linux.
+
 Generate an API token at startup when you want to protect HTTP API and browser write routes:
 
 ```bash
@@ -50,7 +61,7 @@ The server prints the generated token plus `/new?token=...` and `/import?token=.
 
 ```bash
 artifacty token
-ARTIFACTY_API_TOKEN="$(artifacty token --raw)" artifacty serve
+artifacty start --api-token "$(artifacty token --raw)"
 ```
 
 Install MCP configuration for local agents:
@@ -59,6 +70,8 @@ Install MCP configuration for local agents:
 artifacty install claude
 artifacty install codex --dry-run
 artifacty install gemini
+artifacty install copilot
+artifacty install cursor
 artifacty install all
 artifacty check
 ```
@@ -66,7 +79,7 @@ artifacty check
 Use `artifacty install codex --timeout 30000` or
 `artifacty install gemini --timeout 30000` to tune supported MCP client timeouts.
 
-See [docs/integrations.md](docs/integrations.md) for Claude Code, Codex, and Gemini CLI setup.
+See [docs/integrations.md](docs/integrations.md) for Claude Code, Codex, Gemini CLI, GitHub Copilot in VS Code, and Cursor setup.
 
 ## Quick Start
 
@@ -102,11 +115,14 @@ Import an artifact produced by another agent and convert it to Artifacty format:
 artifacty import --agent claude --file ./deploy-failures.html --tag review
 artifacty import --agent gemini --content '{"title":"Plan","returnDisplay":"# Plan\n- Ship it"}'
 artifacty import --agent codex --content '{"agent":"codex","title":"Implementation Handoff","goal":"Continue Phase 3","changedFiles":[{"path":"src/lib/render.js","status":"modified"}],"nextSteps":["Add CodeMirror read-only viewer"]}'
+artifacty import --agent copilot --content '{"agent":"github-copilot","title":"PR Review","findings":[{"severity":"medium","file":"src/app.js","line":42,"title":"Handle missing state"}]}'
+artifacty import --agent cursor --content '{"sourceAgent":"cursor","title":"Cursor Handoff","summary":"Editor pass complete.","nextSteps":["Run visual QA."]}'
 ```
 
-Codex structured payloads can become `handoff`, `bundle`, `diff-walkthrough`,
-`code-review`, or `test-report` artifacts when the payload explicitly identifies
-Codex through `agent` or `sourceAgent`. Plain Codex Markdown stays a normal
+Codex, GitHub Copilot, and Cursor structured payloads can become `handoff`,
+`bundle`, `diff-walkthrough`, `code-review`, or `test-report` artifacts when
+the payload explicitly identifies the agent through `agent` or `sourceAgent`.
+Plain Markdown from these agents stays a normal
 `document` unless you pass an explicit `artifactType`.
 
 ## Agent Handoff Example
@@ -166,6 +182,9 @@ artifacty audit --limit 20
 artifacty backup
 artifacty export --file ./artifacty-backup.json
 artifacty import-store --file ./artifacty-backup.json
+artifacty start
+artifacty status
+artifacty stop
 artifacty service install --dry-run
 ```
 
@@ -222,7 +241,7 @@ Browser routes:
 - `/`: list artifacts with search, tag, and source filters.
 - `/new`: create an Artifacty-native artifact with the CodeMirror editor.
 - `/import`: paste an external agent artifact and convert it with automatic editor mode detection.
-- `/artifacts/:id/edit`: save a new version with Markdown, HTML, JSON, text, code, SVG, Mermaid, or React syntax support.
+- `/artifacts/:id/edit`: save a new version with Markdown, HTML, JSON, text, code, SVG, Mermaid, React, SARIF, CSV, image, or video syntax support.
 - `/artifacts/:id/diff`: compare versions.
 - `/api/audit`: list audit events.
 
@@ -235,8 +254,9 @@ Schema and storage:
 - Metadata lives in SQLite with `schemaVersion: 1`, `artifactType`, and `archivedAt`.
 - Archive hides artifacts from default lists without deleting versions.
 - Bundle artifacts store multiple files or base64 assets as portable JSON.
-- Supported formats are `html`, `markdown`, `text`, `json`, `code`, `svg`, `mermaid`, and `react`.
-- Diagram, component, and source snippet artifacts use `diagram`, `component`, and `snippet` artifact types.
+- Supported formats are `html`, `markdown`, `text`, `json`, `code`, `svg`, `mermaid`, `react`, `sarif`, `csv`, `image`, and `video`.
+- Diagram, component, source snippet, analysis report, table, and media assets use `diagram`, `component`, `snippet`, `analysis-report`, `table`, and `asset` artifact types.
+- Copilot/Cursor examples cover PR reviews, screenshots, demo recordings, and visual evidence bundles.
 - See [docs/artifact-schema-v1.md](docs/artifact-schema-v1.md).
 - See [docs/sarif-csv-artifact-plan.md](docs/sarif-csv-artifact-plan.md) for the SARIF/CSV output artifact roadmap.
 
@@ -254,6 +274,9 @@ Schema and storage:
 - SVG artifacts render in a scriptless sandboxed iframe and are sanitized for `<script>`, `on*` attributes, and `javascript:` links in the viewer. The raw source remains unchanged.
 - Mermaid artifacts render with the vendored local Mermaid package in a sandboxed iframe without `allow-same-origin`.
 - React artifacts are source-only by default. Set `ARTIFACTY_ENABLE_REACT_RENDERER=true` to execute them in a sandboxed frame with a frame-scoped CSP that permits JSX transformation.
+- SARIF artifacts render a bounded findings summary and keep the full formatted JSON behind a raw-source details panel.
+- CSV artifacts render as an escaped, bounded table; `/raw` preserves the original text.
+- Image and video artifacts store base64 media inline, render safe previews, and decode bytes through `/raw`.
 - Artifact content should still be treated as untrusted; use the raw view when handing content back to an agent.
 
 See [docs/release-checklist.md](docs/release-checklist.md) before publishing or running a shared instance.

package/docs/artifact-schema-v1.md

@@ -35,6 +35,8 @@ Allowed `artifactType` values:
 - `diagram`
 - `component`
 - `snippet`
+- `analysis-report`
+- `table`
 - `unknown`
 
 Unknown legacy or external types should be mapped to `unknown`, not rejected during conversion. Native create/update rejects unsupported explicit types.
@@ -57,7 +59,11 @@ Each version is immutable and points at one content file.
 ```
 
 Allowed `format` values are `html`, `markdown`, `text`, `json`, `code`, `svg`,
-`mermaid`, and `react`.
+`mermaid`, `react`, `sarif`, `csv`, `image`, and `video`.
+
+Common `artifactType` values include `document`, `handoff`, `code-review`,
+`test-report`, `dashboard`, `bundle`, `diagram`, `component`, `snippet`,
+`analysis-report`, and `table`.
 
 ## Renderer Policy
 
@@ -74,6 +80,11 @@ viewer concern and must treat all source as untrusted:
 - `react`: source-only by default. `ARTIFACTY_ENABLE_REACT_RENDERER=true`
   enables a separate sandboxed frame with frame-scoped CSP for JSX transform and
   execution.
+- `sarif`: bounded findings summary plus a formatted raw JSON details panel.
+- `csv`: RFC 4180-style escaped table rendering with bounded rows and columns.
+- `image`: base64 media source rendered with `<img>`; `/raw` decodes bytes.
+- `video`: base64 media source rendered with `<video controls>`; `/raw` decodes
+  bytes.
 
 ## Metadata
 
@@ -85,9 +96,12 @@ Metadata is free-form JSON, but converter-generated metadata uses these keys:
 - `bundlePolicy`: how bundled files were preserved.
 - `language`: source language for code or component artifacts when supplied by an
   upstream agent.
-- `codexContinuation`: structured Codex handoff metadata such as changed files,
-  commands, tests, blockers, decisions, next steps, findings, diff text, and
-  residual risk.
+- `continuation`: structured handoff/review/verification metadata for agent
+  outputs, including changed files, commands, tests, blockers, decisions, next
+  steps, findings, diff text, and residual risk.
+- `<agent>Continuation`: compatibility mirror for structured continuation
+  metadata, such as `codexContinuation`, `copilotContinuation`, or
+  `cursorContinuation`.
 
 ## Archive Semantics
 
@@ -118,4 +132,12 @@ Gemini multimodal payloads use the same bundle type with `parts` and `assets`.
 
 ## Asset Policy
 
-Base64 assets are preserved inline inside bundle JSON with `encoding: "base64"`, `mimeType`, `sizeBytes`, and `sha256`. Consumers must treat decoded assets as untrusted. Large binary asset externalization is intentionally deferred; schema v1 keeps all converted assets inspectable and portable.
+Base64 assets are preserved inline inside bundle JSON with `encoding: "base64"`, `mimeType`, `sizeBytes`, and `sha256`. Consumers must treat decoded assets as untrusted.
+
+First-class `image` and `video` artifacts store base64 content in the immutable
+version file. Importers should set `metadata.encoding: "base64"` and
+`metadata.mimeType` to one of the supported media types. Browser `/raw` decodes
+the stored base64 into bytes with the media content type, while API and MCP reads
+return the stored base64 string. Supported media types are PNG, JPEG, GIF, WebP,
+MP4, and WebM. Large binary externalization is intentionally deferred; schema v1
+keeps converted assets inspectable and portable.

package/docs/integrations.md

@@ -20,11 +20,29 @@ npm start -- --generate-token
 
 The generated token is printed with ready-to-open create and import URLs.
 
+For prompt-friendly local background runs, use the lifecycle commands:
+
+```bash
+node src/cli.js start --port 8787
+node src/cli.js status
+node src/cli.js stop
+```
+
+`serve --detach` uses the same detached-process path as `start`. It writes `server.pid`, `server.json`, and logs under `ARTIFACTY_HOME` (default `~/.artifacty`). Prefer `start --api-token "$(node src/cli.js token --raw)"` when a background server needs API protection, because generated startup tokens are only visible in the server log.
+
+The lifecycle commands are intended to be cross-platform:
+
+- macOS and Linux: `stop` signals the detached process group first, then falls back to the server process id.
+- Windows: `start` hides the child console window, and `stop` uses `taskkill /PID <pid> /T`; `--force` adds `/F`.
+- All platforms: `status` combines the managed pid file with the HTTP `/health` endpoint, so a stale pid alone is not reported as healthy.
+
+For login/startup persistence, use the operating system's service manager. Artifacty's `service` command currently generates a macOS LaunchAgent plist; Linux systemd user units and Windows Task Scheduler/Service wrappers should be configured explicitly until first-class installers are added.
+
 Create artifacts directly in the browser at `http://127.0.0.1:8787/new`.
 
 For LAN or VPN sharing, keep the default local binding unless you intentionally need another machine to reach the server. See [network-sharing.md](network-sharing.md) before using `--host 0.0.0.0`.
 
-The browser create/import/edit screens use CodeMirror 6 for Markdown, HTML, JSON, source-like text, SVG, Mermaid, and React artifact editing. Editor and renderer assets are served from local npm dependencies through `/assets/*.js` and allowlisted `/vendor/npm/*` module routes. For sandboxed iframe imports, `Origin: null` requests receive `Access-Control-Allow-Origin: null`, which lets opaque-origin iframes import local ESM without `allow-same-origin`.
+The browser create/import/edit screens use CodeMirror 6 for Markdown, HTML, JSON, source-like text, SVG, Mermaid, React, SARIF, CSV, image, and video artifact editing. Editor and renderer assets are served from local npm dependencies through `/assets/*.js` and allowlisted `/vendor/npm/*` module routes. For sandboxed iframe imports, `Origin: null` requests receive `Access-Control-Allow-Origin: null`, which lets opaque-origin iframes import local ESM without `allow-same-origin`.
 
 The browser UI defaults to English. Add `?lang=ko` to browser routes to use Korean UI labels; API and MCP payloads are not localized.
 
@@ -52,6 +70,8 @@ Artifacty can write MCP configuration for supported local agents:
 node src/cli.js install claude
 node src/cli.js install codex --dry-run
 node src/cli.js install gemini
+node src/cli.js install copilot
+node src/cli.js install cursor
 node src/cli.js install all
 node src/cli.js check
 ```
@@ -59,6 +79,8 @@ node src/cli.js check
 - Claude: writes project `.mcp.json`. Claude Code's startup timeout is controlled by the parent `MCP_TIMEOUT` environment variable and defaults to 30 seconds, so Artifacty does not add a per-server `.mcp.json` `timeout` field.
 - Codex: writes or replaces the `[mcp_servers.artifacty]` block in `~/.codex/config.toml` unless `--config` is provided. The generated block uses a 30 second startup timeout so slower Windows or cold-start environments can load the MCP server reliably.
 - Gemini: writes project `.gemini/settings.json` with a 30 second timeout.
+- GitHub Copilot in VS Code: writes workspace `.vscode/mcp.json` using the VS Code `servers` shape. Pass `--config` to target a user-profile `mcp.json` instead.
+- Cursor: writes project `.cursor/mcp.json` using the Cursor `mcpServers` shape. Pass `--config ~/.cursor/mcp.json` for global Cursor setup.
 - `--dry-run` returns the generated config without writing it.
 - `--timeout <ms>` adjusts Codex `startup_timeout_sec` and Gemini `timeout`. It does not change Claude Code startup behavior; set `MCP_TIMEOUT` before launching Claude Code if you need a larger value there.
 - `check` starts the local MCP server and verifies required tools through `initialize` and `tools/list`.
@@ -96,7 +118,7 @@ Project-scoped `.mcp.json` shape:
 }
 ```
 
-Claude plugins can bundle MCP servers, so this MCP server can later be wrapped as a plugin. The MVP keeps the server standalone so Claude, Codex, Gemini, and other MCP clients use the same integration surface.
+Claude plugins can bundle MCP servers, so this MCP server can later be wrapped as a plugin. The MVP keeps the server standalone so Claude, Codex, Gemini, GitHub Copilot, Cursor, and other MCP clients use the same integration surface.
 
 Claude Code uses a 30 second MCP startup timeout by default. If a slower
 environment needs more time, launch Claude Code with a larger `MCP_TIMEOUT`
@@ -163,7 +185,7 @@ Then run `/mcp` inside Gemini CLI to confirm that the Artifacty tools are connec
 
 - `artifacty_create`: create a new Artifacty-native artifact.
 - `artifacty_publish`: backwards-compatible alias for `artifacty_create`.
-- `artifacty_import`: convert a Claude, Codex, Gemini, Artifacty, or generic artifact payload into Artifacty format and save it.
+- `artifacty_import`: convert a Claude, Codex, Gemini, GitHub Copilot, Cursor, Artifacty, or generic artifact payload into Artifacty format and save it.
 - `artifacty_list`: discover artifacts by query, tag, or source agent.
 - `artifacty_get`: read artifact metadata and content.
 - `artifacty_update`: append a new version.
@@ -182,6 +204,10 @@ Use `artifacty_import` or the CLI `import` command when the artifact was produce
 node src/cli.js import --agent claude --file ./artifact.html --tag review
 node src/cli.js import --agent codex --file ./handoff.md --tag handoff
 node src/cli.js import --agent codex --content '{"agent":"codex","title":"Verification","verification":{"status":"passed","commands":[{"command":"npm test","status":"passed"}]}}'
+node src/cli.js import --agent copilot --content '{"agent":"github-copilot","title":"PR Review","findings":[{"severity":"medium","file":"src/app.js","line":42,"title":"Handle missing state"}]}'
+node src/cli.js import --agent cursor --content '{"sourceAgent":"cursor","title":"Cursor Handoff","summary":"Editor pass complete.","nextSteps":["Run visual QA."]}'
+node src/cli.js import --agent cursor --file ./browser-screenshot.png --tag visual
+node src/cli.js import --agent cursor --file ./demo.webm --tag demo
 node src/cli.js import --agent gemini --content '{"title":"Options","returnDisplay":"# Options\n- A\n- B"}'
 ```
 
@@ -189,11 +215,17 @@ Supported converter inputs:
 
 - Claude: local `.html`, `.htm`, `.md`, `.svg`, `.mmd`, `.jsx`, `.tsx`, source files, or JSON payloads with `title`/`content`/Claude artifact `type`.
 - Codex: markdown/text/json handoff files; Artifacty-compatible JSON payloads; structured handoff, bundle, diff, review, and verification JSON payloads with `agent` or `sourceAgent` set to `codex`.
+- GitHub Copilot: markdown/text/json outputs; Artifacty-compatible JSON payloads; structured handoff, review, diff, and verification JSON payloads with `agent` or `sourceAgent` set to `github-copilot` or `copilot`.
+- Cursor: markdown/text/json outputs; Artifacty-compatible JSON payloads; structured handoff, review, diff, verification, screenshot, demo/video, and visual evidence bundle JSON payloads with `agent` or `sourceAgent` set to `cursor`.
 - Gemini: `returnDisplay`, `llmContent`, text blocks, or local markdown/text/json files.
-- Generic: file extension, content type, HTML doctype, JSON shape, and markdown headings are used to infer format and title.
+- Generic: file extension, content type, HTML doctype, JSON shape, media data URLs, and markdown headings are used to infer format and title.
 
 The converter adds `imported` and source-agent tags, preserves the raw content as an immutable Artifacty version, and records source details under `metadata.artifactyImport`.
 
+Fixture examples for Copilot/Cursor PR review, screenshot, demo recording, and
+visual evidence bundle live under `test/fixtures/` and are covered by converter
+tests.
+
 ## HTTP API
 
 - `GET /`: dashboard.
@@ -227,6 +259,9 @@ Renderer notes:
 - `svg` artifacts render in a scriptless sandboxed iframe after viewer-side sanitization; `/raw` still returns the original SVG.
 - `mermaid` artifacts load the vendored local Mermaid bundle from `/vendor/npm/mermaid/...` in a sandboxed iframe without `allow-same-origin`. The JavaScript asset route answers the iframe's `Origin: null` module request with `Access-Control-Allow-Origin: null`.
 - `react` artifacts are source-only unless `ARTIFACTY_ENABLE_REACT_RENDERER=true` is set. When enabled, JSX transformation and React execution happen only in `/artifacts/:id/react-frame`, with `unsafe-eval` scoped to that frame CSP.
+- `sarif` artifacts render a bounded findings summary and keep the complete formatted JSON available in the browser viewer and `/raw`.
+- `csv` artifacts render as an escaped table with bounded rows and columns; `/raw` preserves the original CSV text.
+- `image` and `video` artifacts store base64 content inline, render with native browser media elements, and decode bytes through `/raw`.
 
 ## Background Service
 

package/docs/sarif-csv-artifact-plan.md

@@ -1,65 +1,44 @@
-# SARIF and CSV Artifact Support Plan
-
-This plan scopes SARIF and CSV support to **output artifacts** that Codex or
-other agents generate for downstream review. It does not cover Codex input
-context, appshots, thread state, or client-specific UI state.
-
-## Goals
-
-- Preserve SARIF and CSV files as immutable Artifacty versions.
-- Classify common Codex Security exports without requiring manual
-  `artifactType` overrides.
-- Render CSV outputs in a readable table view while keeping `/raw` unchanged.
-- Keep SARIF as JSON-first, with future room for a findings-focused viewer.
-
-## Current Behavior
-
-- `.sarif` content is stored as `json` when the payload is valid JSON, but it
-  currently falls back to `artifactType: "unknown"`.
-- `.csv` and `text/csv` content can be stored as `text`, but there is no CSV
-  detection, table renderer, or artifact-type inference.
-- Security findings exported as JSON, CSV, or SARIF can be shared today, but the
-  browsing experience is not yet tailored to review workflows.
-
-## Phase 1: Detection and Taxonomy
-
-- Detect `.sarif` and `application/sarif+json` as `json`.
-- Detect SARIF shape (`version`, `runs[]`, `tool.driver`) and classify as
-  `code-review`.
-- Detect `.csv` and `text/csv` as either a new `csv` format or `text` with
-  `metadata.delimitedText`.
-- Infer `code-review` for CSV/SARIF files named like `findings`, `security`,
-  `review`, or containing columns such as `severity`, `file`, and `message`.
-
-Exit criteria: CLI, HTTP, and MCP imports classify SARIF and common findings CSV
-without explicit overrides.
-
-## Phase 2: CSV Viewer
-
-- Add a lightweight RFC 4180-style CSV parser for browser rendering.
-- Render CSV as a scrollable table with sticky headers and escaped cell content.
-- Cap rendered rows and columns for very large files, with a visible truncation
-  notice and a link to `/raw`.
-- Preserve plain text fallback when parsing fails.
-
-Exit criteria: CSV artifacts are readable in the browser and raw fidelity is
-unchanged.
-
-## Phase 3: SARIF Summary Viewer
-
-- Keep SARIF source as JSON.
-- Add an optional summary above the JSON view: rule id, severity/level, message,
-  file URI, region, and result count by level.
-- Avoid implementing the complete SARIF spec in v1; parse only stable top-level
-  fields and fail closed to JSON rendering.
-
-Exit criteria: SARIF exports are useful for quick triage while preserving the
-full JSON source.
-
-## Tests
-
-- Converter fixtures: Codex Security SARIF, findings CSV, generic CSV, malformed
-  CSV, and large CSV.
-- Storage round trips: content type, extension, size, hash, and `/raw` fidelity.
-- Server rendering: CSV table escaping, truncation notice, SARIF summary fallback.
-- MCP schema and import tests for explicit and inferred artifact types.
+# SARIF and CSV Artifact Support
+
+Artifacty supports SARIF and CSV as **output artifacts** that Codex and other
+agents can hand off for downstream review. This scope excludes Codex input
+context, appshots, thread state, and client-specific UI state.
+
+## Implemented Behavior
+
+- `sarif` and `csv` are first-class `format` values across HTTP, CLI, MCP,
+  storage, and browser forms.
+- `.sarif`, `.sarif.json`, `application/sarif+json`, `.csv`, and `text/csv`
+  inputs are detected during import.
+- SARIF top-level objects with `version` and `runs[]` are imported as
+  `analysis-report` artifacts.
+- CSV inputs default to `table`; CSV files that look like security or review
+  findings infer `analysis-report`.
+- `/raw` always returns the original stored source.
+
+## Browser Rendering
+
+- SARIF renders a bounded findings summary with run, result, error, warning,
+  and note counts.
+- SARIF result rows show level, rule id, message, first location, and tool name.
+- The full formatted SARIF JSON remains available in a details panel.
+- CSV renders as an escaped table with bounded rows and columns.
+- Malformed CSV or non-SARIF JSON fails closed to escaped source or formatted
+  JSON fallback.
+
+## Verification Coverage
+
+- Storage round trips cover format enums, content types, extensions, and type
+  inference.
+- Converter tests cover SARIF extension/MIME/object detection, findings CSV,
+  and generic CSV.
+- Server tests cover SARIF summary rendering, CSV escaping, `/raw` fidelity,
+  and browser form options.
+- MCP tests assert the new format and artifact type enums are exposed.
+
+## Future Extensions
+
+- Add real-world fixtures from CodeQL, Semgrep, Trivy, and other scanners.
+- Add sorting/filtering for SARIF levels and CSV columns.
+- Add optional download helpers for filtered CSV/SARIF views without changing
+  immutable source storage.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "artifacty",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "description": "Local artifact exchange for heterogeneous LLM agents via HTTP and MCP.",
   "type": "module",
   "keywords": [

package/src/cli.js

@@ -17,6 +17,7 @@ import { convertAgentArtifact } from "./lib/converters.js";
 import { checkMcpTools } from "./lib/check.js";
 import { installAgent } from "./lib/installer.js";
 import { serviceCommand } from "./lib/service.js";
+import { backgroundStatus, startBackgroundServer, stopBackgroundServer } from "./lib/background.js";
 import { resolvePublicBaseUrl } from "./lib/server-state.js";
 import { generateToken } from "./lib/token.js";
 import { startServer } from "./server.js";
@@ -44,6 +45,13 @@ async function main() {
   }
 
   if (command === "serve") {
+    if (options.detach) {
+      printJson(await startBackgroundServer({
+        ...serverOptions(options),
+        serverPath: path.join(PACKAGE_ROOT, "src", "server.js")
+      }));
+      return;
+    }
     if (options.generateToken && options.apiToken) {
       throw new Error("Use either --api-token or --generate-token, not both");
     }
@@ -67,6 +75,28 @@ async function main() {
     return;
   }
 
+  if (command === "start") {
+    printJson(await startBackgroundServer({
+      ...serverOptions(options),
+      serverPath: path.join(PACKAGE_ROOT, "src", "server.js")
+    }));
+    return;
+  }
+
+  if (command === "stop") {
+    printJson(await stopBackgroundServer({
+      home: options.home,
+      timeout: options.timeout,
+      force: options.force
+    }));
+    return;
+  }
+
+  if (command === "status") {
+    printJson(await backgroundStatus({ home: options.home }));
+    return;
+  }
+
   if (command === "publish") {
     const content = await readContent(options);
     const artifact = await createArtifact(store, {
@@ -115,7 +145,7 @@ async function main() {
   if (command === "install") {
     const agent = options._[0];
     if (!agent) {
-      throw new Error("install requires an agent: claude, codex, gemini, or all");
+      throw new Error("install requires an agent: claude, codex, gemini, copilot, cursor, or all");
     }
     const result = await installAgent(agent, {
       projectDir: options.projectDir || process.cwd(),
@@ -256,7 +286,7 @@ function parseArgs(args) {
     }
 
     const key = arg.slice(2);
-    if (key === "raw" || key === "dry-run" || key === "trust" || key === "include-archived" || key === "allow-secrets" || key === "generate-token") {
+    if (key === "raw" || key === "dry-run" || key === "trust" || key === "include-archived" || key === "allow-secrets" || key === "generate-token" || key === "detach" || key === "force") {
       options[toCamelCase(key)] = true;
       continue;
     }
@@ -281,7 +311,11 @@ function parseArgs(args) {
 
 async function readContent(options) {
   if (options.file) {
-    return readFile(options.file, "utf8");
+    const filePath = path.resolve(options.file);
+    if (shouldReadFileAsBase64(options, filePath)) {
+      return (await readFile(filePath)).toString("base64");
+    }
+    return readFile(filePath, "utf8");
   }
   if (options.content !== undefined) {
     return options.content;
@@ -289,6 +323,16 @@ async function readContent(options) {
   throw new Error("Provide --file or --content");
 }
 
+function shouldReadFileAsBase64(options, filePath) {
+  const format = String(options.format || "").toLowerCase();
+  const contentType = String(options.contentType || "").toLowerCase();
+  return format === "image" ||
+    format === "video" ||
+    contentType.startsWith("image/") ||
+    contentType.startsWith("video/") ||
+    /\.(png|jpe?g|gif|webp|mp4|webm)$/i.test(filePath);
+}
+
 async function withUrls(store, artifact) {
   const publicBaseUrl = await resolvePublicBaseUrl(store);
   return {
@@ -314,10 +358,13 @@ function printHelp() {
 
 Usage:
   artifacty token [--bytes 32] [--raw]
-  artifacty serve [--host 127.0.0.1] [--port 8787] [--home ~/.artifacty] [--generate-token] [--bytes 32]
+  artifacty serve [--host 127.0.0.1] [--port 8787] [--home ~/.artifacty] [--api-token token] [--generate-token] [--bytes 32] [--detach]
+  artifacty start [--host 127.0.0.1] [--port 8787] [--home ~/.artifacty] [--api-token token] [--timeout 5000]
+  artifacty status [--home ~/.artifacty]
+  artifacty stop [--home ~/.artifacty] [--timeout 5000] [--force]
   artifacty publish --title <title> (--file <path> | --content <text>) [--format html|markdown|text|json|code|svg|mermaid|react] [--source agent] [--tag tag]
-  artifacty import --agent claude|codex|gemini|auto (--file <path> | --content <text>) [--title <title>] [--format html|markdown|text|json|code|svg|mermaid|react] [--tag tag]
-  artifacty install claude|codex|gemini|all [--dry-run] [--config <path>] [--server-path <path>] [--url http://127.0.0.1:8787] [--timeout 30000]
+  artifacty import --agent claude|codex|gemini|copilot|cursor|auto (--file <path> | --content <text>) [--title <title>] [--format html|markdown|text|json|code|svg|mermaid|react] [--tag tag]
+  artifacty install claude|codex|gemini|copilot|cursor|all [--dry-run] [--config <path>] [--server-path <path>] [--url http://127.0.0.1:8787] [--timeout 30000]
   artifacty check [--server-path <path>] [--timeout 5000]
   artifacty update <id> (--file <path> | --content <text>) [--title <title>] [--format html|markdown|text|json|code|svg|mermaid|react]
   artifacty archive <id>
@@ -353,6 +400,20 @@ function stripInstallContentUnlessDryRun(result) {
   return rest;
 }
 
+function serverOptions(options) {
+  return {
+    host: options.host,
+    port: options.port,
+    home: options.home,
+    apiToken: options.apiToken,
+    shareMode: options.shareMode,
+    allowSecrets: options.allowSecrets,
+    generateToken: options.generateToken,
+    bytes: options.bytes,
+    timeout: options.timeout
+  };
+}
+
 function toCamelCase(value) {
   return value.replace(/-([a-z])/g, (_, letter) => letter.toUpperCase());
 }