artifacty 0.1.2 → 0.2.0

package/AGENTS.md

@@ -8,11 +8,11 @@ Artifacty shares LLM artifacts over HTTP, CLI, and MCP.
 - `src/mcp-server.js`: MCP stdio server exposing Artifacty tools.
 - `src/cli.js`: command-line interface for serving, publishing, importing, listing, and reading artifacts.
 - `src/lib/storage.js`: SQLite metadata store and immutable version-file handling.
-- `src/lib/converters.js`: agent artifact conversion rules for Claude, Codex, Gemini, and generic payloads.
+- `src/lib/converters.js`: agent artifact conversion rules for Claude, Codex, Gemini, GitHub Copilot, Cursor, and generic payloads.
 - `src/lib/installer.js`: MCP config installers for Claude, Codex, and Gemini.
 - `src/lib/render.js`: server-rendered dashboard, viewer, and editor HTML.
 - `test/*.test.js`: Node test runner suites.
-- `docs/integrations.md`: setup notes for Claude Code, Codex, and Gemini CLI.
+- `docs/integrations.md`: setup notes for Claude Code, Codex, Gemini CLI, GitHub Copilot in VS Code, and Cursor.
 
 ## Build, Test, and Development Commands
 

package/README.md

@@ -5,7 +5,7 @@
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 [![Node.js >=22.5](https://img.shields.io/badge/node-%3E%3D22.5-339933.svg)](package.json)
 
-Artifacty is a local, agent-to-agent artifact exchange for LLM workflows. Claude, Codex, Gemini, and other MCP-capable tools can publish an artifact once, then other agents can list, read, update, and continue from it without copying content through chat.
+Artifacty is a local, agent-to-agent artifact exchange for LLM workflows. Claude, Codex, Gemini, GitHub Copilot, Cursor, and other MCP-capable tools can publish an artifact once, then other agents can list, read, update, and continue from it without copying content through chat.
 
 ![Artifacty overview showing multiple AI agents sharing artifacts through a local exchange](docs/assets/artifacty.png)
 
@@ -70,6 +70,8 @@ Install MCP configuration for local agents:
 artifacty install claude
 artifacty install codex --dry-run
 artifacty install gemini
+artifacty install copilot
+artifacty install cursor
 artifacty install all
 artifacty check
 ```
@@ -77,7 +79,7 @@ artifacty check
 Use `artifacty install codex --timeout 30000` or
 `artifacty install gemini --timeout 30000` to tune supported MCP client timeouts.
 
-See [docs/integrations.md](docs/integrations.md) for Claude Code, Codex, and Gemini CLI setup.
+See [docs/integrations.md](docs/integrations.md) for Claude Code, Codex, Gemini CLI, GitHub Copilot in VS Code, and Cursor setup.
 
 ## Quick Start
 
@@ -113,11 +115,14 @@ Import an artifact produced by another agent and convert it to Artifacty format:
 artifacty import --agent claude --file ./deploy-failures.html --tag review
 artifacty import --agent gemini --content '{"title":"Plan","returnDisplay":"# Plan\n- Ship it"}'
 artifacty import --agent codex --content '{"agent":"codex","title":"Implementation Handoff","goal":"Continue Phase 3","changedFiles":[{"path":"src/lib/render.js","status":"modified"}],"nextSteps":["Add CodeMirror read-only viewer"]}'
+artifacty import --agent copilot --content '{"agent":"github-copilot","title":"PR Review","findings":[{"severity":"medium","file":"src/app.js","line":42,"title":"Handle missing state"}]}'
+artifacty import --agent cursor --content '{"sourceAgent":"cursor","title":"Cursor Handoff","summary":"Editor pass complete.","nextSteps":["Run visual QA."]}'
 ```
 
-Codex structured payloads can become `handoff`, `bundle`, `diff-walkthrough`,
-`code-review`, or `test-report` artifacts when the payload explicitly identifies
-Codex through `agent` or `sourceAgent`. Plain Codex Markdown stays a normal
+Codex, GitHub Copilot, and Cursor structured payloads can become `handoff`,
+`bundle`, `diff-walkthrough`, `code-review`, or `test-report` artifacts when
+the payload explicitly identifies the agent through `agent` or `sourceAgent`.
+Plain Markdown from these agents stays a normal
 `document` unless you pass an explicit `artifactType`.
 
 ## Agent Handoff Example
@@ -236,7 +241,7 @@ Browser routes:
 - `/`: list artifacts with search, tag, and source filters.
 - `/new`: create an Artifacty-native artifact with the CodeMirror editor.
 - `/import`: paste an external agent artifact and convert it with automatic editor mode detection.
-- `/artifacts/:id/edit`: save a new version with Markdown, HTML, JSON, text, code, SVG, Mermaid, or React syntax support.
+- `/artifacts/:id/edit`: save a new version with Markdown, HTML, JSON, text, code, SVG, Mermaid, React, SARIF, CSV, image, or video syntax support.
 - `/artifacts/:id/diff`: compare versions.
 - `/api/audit`: list audit events.
 
@@ -249,8 +254,9 @@ Schema and storage:
 - Metadata lives in SQLite with `schemaVersion: 1`, `artifactType`, and `archivedAt`.
 - Archive hides artifacts from default lists without deleting versions.
 - Bundle artifacts store multiple files or base64 assets as portable JSON.
-- Supported formats are `html`, `markdown`, `text`, `json`, `code`, `svg`, `mermaid`, and `react`.
-- Diagram, component, and source snippet artifacts use `diagram`, `component`, and `snippet` artifact types.
+- Supported formats are `html`, `markdown`, `text`, `json`, `code`, `svg`, `mermaid`, `react`, `sarif`, `csv`, `image`, and `video`.
+- Diagram, component, source snippet, analysis report, table, and media assets use `diagram`, `component`, `snippet`, `analysis-report`, `table`, and `asset` artifact types.
+- Copilot/Cursor examples cover PR reviews, screenshots, demo recordings, and visual evidence bundles.
 - See [docs/artifact-schema-v1.md](docs/artifact-schema-v1.md).
 - See [docs/sarif-csv-artifact-plan.md](docs/sarif-csv-artifact-plan.md) for the SARIF/CSV output artifact roadmap.
 
@@ -268,6 +274,9 @@ Schema and storage:
 - SVG artifacts render in a scriptless sandboxed iframe and are sanitized for `<script>`, `on*` attributes, and `javascript:` links in the viewer. The raw source remains unchanged.
 - Mermaid artifacts render with the vendored local Mermaid package in a sandboxed iframe without `allow-same-origin`.
 - React artifacts are source-only by default. Set `ARTIFACTY_ENABLE_REACT_RENDERER=true` to execute them in a sandboxed frame with a frame-scoped CSP that permits JSX transformation.
+- SARIF artifacts render a bounded findings summary and keep the full formatted JSON behind a raw-source details panel.
+- CSV artifacts render as an escaped, bounded table; `/raw` preserves the original text.
+- Image and video artifacts store base64 media inline, render safe previews, and decode bytes through `/raw`.
 - Artifact content should still be treated as untrusted; use the raw view when handing content back to an agent.
 
 See [docs/release-checklist.md](docs/release-checklist.md) before publishing or running a shared instance.

package/docs/artifact-schema-v1.md

@@ -35,6 +35,8 @@ Allowed `artifactType` values:
 - `diagram`
 - `component`
 - `snippet`
+- `analysis-report`
+- `table`
 - `unknown`
 
 Unknown legacy or external types should be mapped to `unknown`, not rejected during conversion. Native create/update rejects unsupported explicit types.
@@ -57,7 +59,11 @@ Each version is immutable and points at one content file.
 ```
 
 Allowed `format` values are `html`, `markdown`, `text`, `json`, `code`, `svg`,
-`mermaid`, and `react`.
+`mermaid`, `react`, `sarif`, `csv`, `image`, and `video`.
+
+Common `artifactType` values include `document`, `handoff`, `code-review`,
+`test-report`, `dashboard`, `bundle`, `diagram`, `component`, `snippet`,
+`analysis-report`, and `table`.
 
 ## Renderer Policy
 
@@ -74,6 +80,11 @@ viewer concern and must treat all source as untrusted:
 - `react`: source-only by default. `ARTIFACTY_ENABLE_REACT_RENDERER=true`
   enables a separate sandboxed frame with frame-scoped CSP for JSX transform and
   execution.
+- `sarif`: bounded findings summary plus a formatted raw JSON details panel.
+- `csv`: RFC 4180-style escaped table rendering with bounded rows and columns.
+- `image`: base64 media source rendered with `<img>`; `/raw` decodes bytes.
+- `video`: base64 media source rendered with `<video controls>`; `/raw` decodes
+  bytes.
 
 ## Metadata
 
@@ -85,9 +96,12 @@ Metadata is free-form JSON, but converter-generated metadata uses these keys:
 - `bundlePolicy`: how bundled files were preserved.
 - `language`: source language for code or component artifacts when supplied by an
   upstream agent.
-- `codexContinuation`: structured Codex handoff metadata such as changed files,
-  commands, tests, blockers, decisions, next steps, findings, diff text, and
-  residual risk.
+- `continuation`: structured handoff/review/verification metadata for agent
+  outputs, including changed files, commands, tests, blockers, decisions, next
+  steps, findings, diff text, and residual risk.
+- `<agent>Continuation`: compatibility mirror for structured continuation
+  metadata, such as `codexContinuation`, `copilotContinuation`, or
+  `cursorContinuation`.
 
 ## Archive Semantics
 
@@ -118,4 +132,12 @@ Gemini multimodal payloads use the same bundle type with `parts` and `assets`.
 
 ## Asset Policy
 
-Base64 assets are preserved inline inside bundle JSON with `encoding: "base64"`, `mimeType`, `sizeBytes`, and `sha256`. Consumers must treat decoded assets as untrusted. Large binary asset externalization is intentionally deferred; schema v1 keeps all converted assets inspectable and portable.
+Base64 assets are preserved inline inside bundle JSON with `encoding: "base64"`, `mimeType`, `sizeBytes`, and `sha256`. Consumers must treat decoded assets as untrusted.
+
+First-class `image` and `video` artifacts store base64 content in the immutable
+version file. Importers should set `metadata.encoding: "base64"` and
+`metadata.mimeType` to one of the supported media types. Browser `/raw` decodes
+the stored base64 into bytes with the media content type, while API and MCP reads
+return the stored base64 string. Supported media types are PNG, JPEG, GIF, WebP,
+MP4, and WebM. Large binary externalization is intentionally deferred; schema v1
+keeps converted assets inspectable and portable.

package/docs/integrations.md

@@ -42,7 +42,7 @@ Create artifacts directly in the browser at `http://127.0.0.1:8787/new`.
 
 For LAN or VPN sharing, keep the default local binding unless you intentionally need another machine to reach the server. See [network-sharing.md](network-sharing.md) before using `--host 0.0.0.0`.
 
-The browser create/import/edit screens use CodeMirror 6 for Markdown, HTML, JSON, source-like text, SVG, Mermaid, and React artifact editing. Editor and renderer assets are served from local npm dependencies through `/assets/*.js` and allowlisted `/vendor/npm/*` module routes. For sandboxed iframe imports, `Origin: null` requests receive `Access-Control-Allow-Origin: null`, which lets opaque-origin iframes import local ESM without `allow-same-origin`.
+The browser create/import/edit screens use CodeMirror 6 for Markdown, HTML, JSON, source-like text, SVG, Mermaid, React, SARIF, CSV, image, and video artifact editing. Editor and renderer assets are served from local npm dependencies through `/assets/*.js` and allowlisted `/vendor/npm/*` module routes. For sandboxed iframe imports, `Origin: null` requests receive `Access-Control-Allow-Origin: null`, which lets opaque-origin iframes import local ESM without `allow-same-origin`.
 
 The browser UI defaults to English. Add `?lang=ko` to browser routes to use Korean UI labels; API and MCP payloads are not localized.
 
@@ -70,6 +70,8 @@ Artifacty can write MCP configuration for supported local agents:
 node src/cli.js install claude
 node src/cli.js install codex --dry-run
 node src/cli.js install gemini
+node src/cli.js install copilot
+node src/cli.js install cursor
 node src/cli.js install all
 node src/cli.js check
 ```
@@ -77,6 +79,8 @@ node src/cli.js check
 - Claude: writes project `.mcp.json`. Claude Code's startup timeout is controlled by the parent `MCP_TIMEOUT` environment variable and defaults to 30 seconds, so Artifacty does not add a per-server `.mcp.json` `timeout` field.
 - Codex: writes or replaces the `[mcp_servers.artifacty]` block in `~/.codex/config.toml` unless `--config` is provided. The generated block uses a 30 second startup timeout so slower Windows or cold-start environments can load the MCP server reliably.
 - Gemini: writes project `.gemini/settings.json` with a 30 second timeout.
+- GitHub Copilot in VS Code: writes workspace `.vscode/mcp.json` using the VS Code `servers` shape. Pass `--config` to target a user-profile `mcp.json` instead.
+- Cursor: writes project `.cursor/mcp.json` using the Cursor `mcpServers` shape. Pass `--config ~/.cursor/mcp.json` for global Cursor setup.
 - `--dry-run` returns the generated config without writing it.
 - `--timeout <ms>` adjusts Codex `startup_timeout_sec` and Gemini `timeout`. It does not change Claude Code startup behavior; set `MCP_TIMEOUT` before launching Claude Code if you need a larger value there.
 - `check` starts the local MCP server and verifies required tools through `initialize` and `tools/list`.
@@ -114,7 +118,7 @@ Project-scoped `.mcp.json` shape:
 }
 ```
 
-Claude plugins can bundle MCP servers, so this MCP server can later be wrapped as a plugin. The MVP keeps the server standalone so Claude, Codex, Gemini, and other MCP clients use the same integration surface.
+Claude plugins can bundle MCP servers, so this MCP server can later be wrapped as a plugin. The MVP keeps the server standalone so Claude, Codex, Gemini, GitHub Copilot, Cursor, and other MCP clients use the same integration surface.
 
 Claude Code uses a 30 second MCP startup timeout by default. If a slower
 environment needs more time, launch Claude Code with a larger `MCP_TIMEOUT`
@@ -181,7 +185,7 @@ Then run `/mcp` inside Gemini CLI to confirm that the Artifacty tools are connec
 
 - `artifacty_create`: create a new Artifacty-native artifact.
 - `artifacty_publish`: backwards-compatible alias for `artifacty_create`.
-- `artifacty_import`: convert a Claude, Codex, Gemini, Artifacty, or generic artifact payload into Artifacty format and save it.
+- `artifacty_import`: convert a Claude, Codex, Gemini, GitHub Copilot, Cursor, Artifacty, or generic artifact payload into Artifacty format and save it.
 - `artifacty_list`: discover artifacts by query, tag, or source agent.
 - `artifacty_get`: read artifact metadata and content.
 - `artifacty_update`: append a new version.
@@ -200,6 +204,10 @@ Use `artifacty_import` or the CLI `import` command when the artifact was produce
 node src/cli.js import --agent claude --file ./artifact.html --tag review
 node src/cli.js import --agent codex --file ./handoff.md --tag handoff
 node src/cli.js import --agent codex --content '{"agent":"codex","title":"Verification","verification":{"status":"passed","commands":[{"command":"npm test","status":"passed"}]}}'
+node src/cli.js import --agent copilot --content '{"agent":"github-copilot","title":"PR Review","findings":[{"severity":"medium","file":"src/app.js","line":42,"title":"Handle missing state"}]}'
+node src/cli.js import --agent cursor --content '{"sourceAgent":"cursor","title":"Cursor Handoff","summary":"Editor pass complete.","nextSteps":["Run visual QA."]}'
+node src/cli.js import --agent cursor --file ./browser-screenshot.png --tag visual
+node src/cli.js import --agent cursor --file ./demo.webm --tag demo
 node src/cli.js import --agent gemini --content '{"title":"Options","returnDisplay":"# Options\n- A\n- B"}'
 ```
 
@@ -207,11 +215,17 @@ Supported converter inputs:
 
 - Claude: local `.html`, `.htm`, `.md`, `.svg`, `.mmd`, `.jsx`, `.tsx`, source files, or JSON payloads with `title`/`content`/Claude artifact `type`.
 - Codex: markdown/text/json handoff files; Artifacty-compatible JSON payloads; structured handoff, bundle, diff, review, and verification JSON payloads with `agent` or `sourceAgent` set to `codex`.
+- GitHub Copilot: markdown/text/json outputs; Artifacty-compatible JSON payloads; structured handoff, review, diff, and verification JSON payloads with `agent` or `sourceAgent` set to `github-copilot` or `copilot`.
+- Cursor: markdown/text/json outputs; Artifacty-compatible JSON payloads; structured handoff, review, diff, verification, screenshot, demo/video, and visual evidence bundle JSON payloads with `agent` or `sourceAgent` set to `cursor`.
 - Gemini: `returnDisplay`, `llmContent`, text blocks, or local markdown/text/json files.
-- Generic: file extension, content type, HTML doctype, JSON shape, and markdown headings are used to infer format and title.
+- Generic: file extension, content type, HTML doctype, JSON shape, media data URLs, and markdown headings are used to infer format and title.
 
 The converter adds `imported` and source-agent tags, preserves the raw content as an immutable Artifacty version, and records source details under `metadata.artifactyImport`.
 
+Fixture examples for Copilot/Cursor PR review, screenshot, demo recording, and
+visual evidence bundle live under `test/fixtures/` and are covered by converter
+tests.
+
 ## HTTP API
 
 - `GET /`: dashboard.
@@ -245,6 +259,9 @@ Renderer notes:
 - `svg` artifacts render in a scriptless sandboxed iframe after viewer-side sanitization; `/raw` still returns the original SVG.
 - `mermaid` artifacts load the vendored local Mermaid bundle from `/vendor/npm/mermaid/...` in a sandboxed iframe without `allow-same-origin`. The JavaScript asset route answers the iframe's `Origin: null` module request with `Access-Control-Allow-Origin: null`.
 - `react` artifacts are source-only unless `ARTIFACTY_ENABLE_REACT_RENDERER=true` is set. When enabled, JSX transformation and React execution happen only in `/artifacts/:id/react-frame`, with `unsafe-eval` scoped to that frame CSP.
+- `sarif` artifacts render a bounded findings summary and keep the complete formatted JSON available in the browser viewer and `/raw`.
+- `csv` artifacts render as an escaped table with bounded rows and columns; `/raw` preserves the original CSV text.
+- `image` and `video` artifacts store base64 content inline, render with native browser media elements, and decode bytes through `/raw`.
 
 ## Background Service
 

package/docs/sarif-csv-artifact-plan.md

@@ -1,65 +1,44 @@
-# SARIF and CSV Artifact Support Plan
-
-This plan scopes SARIF and CSV support to **output artifacts** that Codex or
-other agents generate for downstream review. It does not cover Codex input
-context, appshots, thread state, or client-specific UI state.
-
-## Goals
-
-- Preserve SARIF and CSV files as immutable Artifacty versions.
-- Classify common Codex Security exports without requiring manual
-  `artifactType` overrides.
-- Render CSV outputs in a readable table view while keeping `/raw` unchanged.
-- Keep SARIF as JSON-first, with future room for a findings-focused viewer.
-
-## Current Behavior
-
-- `.sarif` content is stored as `json` when the payload is valid JSON, but it
-  currently falls back to `artifactType: "unknown"`.
-- `.csv` and `text/csv` content can be stored as `text`, but there is no CSV
-  detection, table renderer, or artifact-type inference.
-- Security findings exported as JSON, CSV, or SARIF can be shared today, but the
-  browsing experience is not yet tailored to review workflows.
-
-## Phase 1: Detection and Taxonomy
-
-- Detect `.sarif` and `application/sarif+json` as `json`.
-- Detect SARIF shape (`version`, `runs[]`, `tool.driver`) and classify as
-  `code-review`.
-- Detect `.csv` and `text/csv` as either a new `csv` format or `text` with
-  `metadata.delimitedText`.
-- Infer `code-review` for CSV/SARIF files named like `findings`, `security`,
-  `review`, or containing columns such as `severity`, `file`, and `message`.
-
-Exit criteria: CLI, HTTP, and MCP imports classify SARIF and common findings CSV
-without explicit overrides.
-
-## Phase 2: CSV Viewer
-
-- Add a lightweight RFC 4180-style CSV parser for browser rendering.
-- Render CSV as a scrollable table with sticky headers and escaped cell content.
-- Cap rendered rows and columns for very large files, with a visible truncation
-  notice and a link to `/raw`.
-- Preserve plain text fallback when parsing fails.
-
-Exit criteria: CSV artifacts are readable in the browser and raw fidelity is
-unchanged.
-
-## Phase 3: SARIF Summary Viewer
-
-- Keep SARIF source as JSON.
-- Add an optional summary above the JSON view: rule id, severity/level, message,
-  file URI, region, and result count by level.
-- Avoid implementing the complete SARIF spec in v1; parse only stable top-level
-  fields and fail closed to JSON rendering.
-
-Exit criteria: SARIF exports are useful for quick triage while preserving the
-full JSON source.
-
-## Tests
-
-- Converter fixtures: Codex Security SARIF, findings CSV, generic CSV, malformed
-  CSV, and large CSV.
-- Storage round trips: content type, extension, size, hash, and `/raw` fidelity.
-- Server rendering: CSV table escaping, truncation notice, SARIF summary fallback.
-- MCP schema and import tests for explicit and inferred artifact types.
+# SARIF and CSV Artifact Support
+
+Artifacty supports SARIF and CSV as **output artifacts** that Codex and other
+agents can hand off for downstream review. This scope excludes Codex input
+context, appshots, thread state, and client-specific UI state.
+
+## Implemented Behavior
+
+- `sarif` and `csv` are first-class `format` values across HTTP, CLI, MCP,
+  storage, and browser forms.
+- `.sarif`, `.sarif.json`, `application/sarif+json`, `.csv`, and `text/csv`
+  inputs are detected during import.
+- SARIF top-level objects with `version` and `runs[]` are imported as
+  `analysis-report` artifacts.
+- CSV inputs default to `table`; CSV files that look like security or review
+  findings infer `analysis-report`.
+- `/raw` always returns the original stored source.
+
+## Browser Rendering
+
+- SARIF renders a bounded findings summary with run, result, error, warning,
+  and note counts.
+- SARIF result rows show level, rule id, message, first location, and tool name.
+- The full formatted SARIF JSON remains available in a details panel.
+- CSV renders as an escaped table with bounded rows and columns.
+- Malformed CSV or non-SARIF JSON fails closed to escaped source or formatted
+  JSON fallback.
+
+## Verification Coverage
+
+- Storage round trips cover format enums, content types, extensions, and type
+  inference.
+- Converter tests cover SARIF extension/MIME/object detection, findings CSV,
+  and generic CSV.
+- Server tests cover SARIF summary rendering, CSV escaping, `/raw` fidelity,
+  and browser form options.
+- MCP tests assert the new format and artifact type enums are exposed.
+
+## Future Extensions
+
+- Add real-world fixtures from CodeQL, Semgrep, Trivy, and other scanners.
+- Add sorting/filtering for SARIF levels and CSV columns.
+- Add optional download helpers for filtered CSV/SARIF views without changing
+  immutable source storage.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "artifacty",
-  "version": "0.1.2",
+  "version": "0.2.0",
   "description": "Local artifact exchange for heterogeneous LLM agents via HTTP and MCP.",
   "type": "module",
   "keywords": [

package/src/cli.js

@@ -145,7 +145,7 @@ async function main() {
   if (command === "install") {
     const agent = options._[0];
     if (!agent) {
-      throw new Error("install requires an agent: claude, codex, gemini, or all");
+      throw new Error("install requires an agent: claude, codex, gemini, copilot, cursor, or all");
     }
     const result = await installAgent(agent, {
       projectDir: options.projectDir || process.cwd(),
@@ -311,7 +311,11 @@ function parseArgs(args) {
 
 async function readContent(options) {
   if (options.file) {
-    return readFile(options.file, "utf8");
+    const filePath = path.resolve(options.file);
+    if (shouldReadFileAsBase64(options, filePath)) {
+      return (await readFile(filePath)).toString("base64");
+    }
+    return readFile(filePath, "utf8");
   }
   if (options.content !== undefined) {
     return options.content;
@@ -319,6 +323,16 @@ async function readContent(options) {
   throw new Error("Provide --file or --content");
 }
 
+function shouldReadFileAsBase64(options, filePath) {
+  const format = String(options.format || "").toLowerCase();
+  const contentType = String(options.contentType || "").toLowerCase();
+  return format === "image" ||
+    format === "video" ||
+    contentType.startsWith("image/") ||
+    contentType.startsWith("video/") ||
+    /\.(png|jpe?g|gif|webp|mp4|webm)$/i.test(filePath);
+}
+
 async function withUrls(store, artifact) {
   const publicBaseUrl = await resolvePublicBaseUrl(store);
   return {
@@ -349,8 +363,8 @@ Usage:
   artifacty status [--home ~/.artifacty]
   artifacty stop [--home ~/.artifacty] [--timeout 5000] [--force]
   artifacty publish --title <title> (--file <path> | --content <text>) [--format html|markdown|text|json|code|svg|mermaid|react] [--source agent] [--tag tag]
-  artifacty import --agent claude|codex|gemini|auto (--file <path> | --content <text>) [--title <title>] [--format html|markdown|text|json|code|svg|mermaid|react] [--tag tag]
-  artifacty install claude|codex|gemini|all [--dry-run] [--config <path>] [--server-path <path>] [--url http://127.0.0.1:8787] [--timeout 30000]
+  artifacty import --agent claude|codex|gemini|copilot|cursor|auto (--file <path> | --content <text>) [--title <title>] [--format html|markdown|text|json|code|svg|mermaid|react] [--tag tag]
+  artifacty install claude|codex|gemini|copilot|cursor|all [--dry-run] [--config <path>] [--server-path <path>] [--url http://127.0.0.1:8787] [--timeout 30000]
   artifacty check [--server-path <path>] [--timeout 5000]
   artifacty update <id> (--file <path> | --content <text>) [--title <title>] [--format html|markdown|text|json|code|svg|mermaid|react]
   artifacty archive <id>

package/src/client/editor.js

@@ -15,7 +15,7 @@ const messages = {
   ...(globalThis.ARTIFACTY_I18N || {})
 };
 
-const SUPPORTED_FORMATS = ["markdown", "html", "json", "text", "code", "svg", "mermaid", "react"];
+const SUPPORTED_FORMATS = ["markdown", "html", "json", "text", "code", "svg", "mermaid", "react", "sarif", "csv", "image", "video"];
 
 const editorTheme = EditorView.theme({
   "&": {
@@ -128,7 +128,7 @@ function enhanceTextarea(textarea) {
   updatePreview();
 
   function updateToolbar(format) {
-    formatJsonButton.hidden = format !== "json";
+    formatJsonButton.hidden = format !== "json" && format !== "sarif";
     status.textContent = formatLabel(format);
   }
 
@@ -158,7 +158,7 @@ function enhanceTextarea(textarea) {
       return;
     }
 
-    if (format === "json") {
+    if (format === "json" || format === "sarif") {
       const pre = document.createElement("pre");
       try {
         pre.textContent = JSON.stringify(JSON.parse(content), null, 2);
@@ -191,7 +191,7 @@ function languageExtension(format) {
   if (format === "html" || format === "svg") {
     return html();
   }
-  if (format === "json") {
+  if (format === "json" || format === "sarif") {
     return json();
   }
   if (format === "markdown") {
@@ -212,6 +212,18 @@ function detectFormat({ explicit, fileName, content }) {
   if (lowerName.endsWith(".md") || lowerName.endsWith(".markdown")) {
     return "markdown";
   }
+  if (lowerName.endsWith(".sarif") || lowerName.endsWith(".sarif.json")) {
+    return "sarif";
+  }
+  if (lowerName.endsWith(".csv")) {
+    return "csv";
+  }
+  if (/\.(png|jpe?g|gif|webp)$/.test(lowerName)) {
+    return "image";
+  }
+  if (/\.(mp4|webm)$/.test(lowerName)) {
+    return "video";
+  }
   if (lowerName.endsWith(".json")) {
     return "json";
   }
@@ -241,6 +253,18 @@ function detectFormat({ explicit, fileName, content }) {
   if (trimmed.startsWith("<!doctype") || trimmed.startsWith("<html") || trimmed.startsWith("<")) {
     return "html";
   }
+  if (looksLikeSarif(trimmed)) {
+    return "sarif";
+  }
+  if (looksLikeCsv(trimmed)) {
+    return "csv";
+  }
+  if (/^data:image\/(?:png|jpeg|gif|webp);base64,/i.test(trimmed)) {
+    return "image";
+  }
+  if (/^data:video\/(?:mp4|webm);base64,/i.test(trimmed)) {
+    return "video";
+  }
   if (trimmed.startsWith("{") || trimmed.startsWith("[")) {
     return "json";
   }
@@ -255,6 +279,54 @@ function formatLabel(format) {
   return messages.mode.replaceAll("{format}", label);
 }
 
+function looksLikeSarif(value) {
+  const trimmed = String(value || "").trim();
+  if (!trimmed.startsWith("{")) {
+    return false;
+  }
+  try {
+    const parsed = JSON.parse(trimmed);
+    return parsed &&
+      typeof parsed === "object" &&
+      Array.isArray(parsed.runs) &&
+      (typeof parsed.version === "string" || String(parsed.$schema || "").toLowerCase().includes("sarif"));
+  } catch {
+    return false;
+  }
+}
+
+function looksLikeCsv(value) {
+  const lines = String(value || "")
+    .trim()
+    .split(/\r?\n/)
+    .map((line) => line.trimEnd())
+    .filter(Boolean)
+    .slice(0, 5);
+  if (lines.length < 2 || lines[0].trimStart().startsWith("|")) {
+    return false;
+  }
+  const counts = lines.map(csvFieldCount);
+  return counts[0] > 1 && counts.every((count) => count === counts[0]);
+}
+
+function csvFieldCount(line) {
+  let count = 1;
+  let inQuotes = false;
+  for (let index = 0; index < line.length; index += 1) {
+    const char = line[index];
+    if (char === "\"") {
+      if (inQuotes && line[index + 1] === "\"") {
+        index += 1;
+      } else {
+        inQuotes = !inQuotes;
+      }
+    } else if (char === "," && !inQuotes) {
+      count += 1;
+    }
+  }
+  return count;
+}
+
 function invalidJsonMessage(error) {
   return messages.invalidJson.replaceAll("{message}", error.message);
 }