artifacty 0.1.2 → 0.3.0

package/AGENTS.md

@@ -8,11 +8,11 @@ Artifacty shares LLM artifacts over HTTP, CLI, and MCP.
 - `src/mcp-server.js`: MCP stdio server exposing Artifacty tools.
 - `src/cli.js`: command-line interface for serving, publishing, importing, listing, and reading artifacts.
 - `src/lib/storage.js`: SQLite metadata store and immutable version-file handling.
-- `src/lib/converters.js`: agent artifact conversion rules for Claude, Codex, Gemini, and generic payloads.
+- `src/lib/converters.js`: agent artifact conversion rules for Claude, Codex, Gemini, GitHub Copilot, Cursor, and generic payloads.
 - `src/lib/installer.js`: MCP config installers for Claude, Codex, and Gemini.
 - `src/lib/render.js`: server-rendered dashboard, viewer, and editor HTML.
 - `test/*.test.js`: Node test runner suites.
-- `docs/integrations.md`: setup notes for Claude Code, Codex, and Gemini CLI.
+- `docs/integrations.md`: setup notes for Claude Code, Codex, Gemini CLI, GitHub Copilot in VS Code, and Cursor.
 
 ## Build, Test, and Development Commands
 
@@ -23,6 +23,8 @@ Artifacty shares LLM artifacts over HTTP, CLI, and MCP.
 - `node src/cli.js import --agent claude --file artifact.html`: convert and store an external artifact.
 - `node src/cli.js install claude --dry-run`: preview generated MCP config.
 - `node src/cli.js check`: verify MCP tool discovery.
+- `node src/cli.js index rebuild`: rebuild the optional SQLite FTS5 search index.
+- `node src/cli.js integrity`: verify version files, hashes, and orphaned files.
 
 ## Coding Style & Naming Conventions
 

package/README.md

@@ -5,7 +5,7 @@
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 [![Node.js >=22.5](https://img.shields.io/badge/node-%3E%3D22.5-339933.svg)](package.json)
 
-Artifacty is a local, agent-to-agent artifact exchange for LLM workflows. Claude, Codex, Gemini, and other MCP-capable tools can publish an artifact once, then other agents can list, read, update, and continue from it without copying content through chat.
+Artifacty is a local, agent-to-agent artifact exchange for LLM workflows. Claude, Codex, Gemini, GitHub Copilot, Cursor, and other MCP-capable tools can publish an artifact once, then other agents can list, read, update, and continue from it without copying content through chat.
 
 ![Artifacty overview showing multiple AI agents sharing artifacts through a local exchange](docs/assets/artifacty.png)
 
@@ -70,6 +70,8 @@ Install MCP configuration for local agents:
 artifacty install claude
 artifacty install codex --dry-run
 artifacty install gemini
+artifacty install copilot
+artifacty install cursor
 artifacty install all
 artifacty check
 ```
@@ -77,7 +79,7 @@ artifacty check
 Use `artifacty install codex --timeout 30000` or
 `artifacty install gemini --timeout 30000` to tune supported MCP client timeouts.
 
-See [docs/integrations.md](docs/integrations.md) for Claude Code, Codex, and Gemini CLI setup.
+See [docs/integrations.md](docs/integrations.md) for Claude Code, Codex, Gemini CLI, GitHub Copilot in VS Code, and Cursor setup.
 
 ## Quick Start
 
@@ -113,11 +115,14 @@ Import an artifact produced by another agent and convert it to Artifacty format:
 artifacty import --agent claude --file ./deploy-failures.html --tag review
 artifacty import --agent gemini --content '{"title":"Plan","returnDisplay":"# Plan\n- Ship it"}'
 artifacty import --agent codex --content '{"agent":"codex","title":"Implementation Handoff","goal":"Continue Phase 3","changedFiles":[{"path":"src/lib/render.js","status":"modified"}],"nextSteps":["Add CodeMirror read-only viewer"]}'
+artifacty import --agent copilot --content '{"agent":"github-copilot","title":"PR Review","findings":[{"severity":"medium","file":"src/app.js","line":42,"title":"Handle missing state"}]}'
+artifacty import --agent cursor --content '{"sourceAgent":"cursor","title":"Cursor Handoff","summary":"Editor pass complete.","nextSteps":["Run visual QA."]}'
 ```
 
-Codex structured payloads can become `handoff`, `bundle`, `diff-walkthrough`,
-`code-review`, or `test-report` artifacts when the payload explicitly identifies
-Codex through `agent` or `sourceAgent`. Plain Codex Markdown stays a normal
+Codex, GitHub Copilot, and Cursor structured payloads can become `handoff`,
+`bundle`, `diff-walkthrough`, `code-review`, or `test-report` artifacts when
+the payload explicitly identifies the agent through `agent` or `sourceAgent`.
+Plain Markdown from these agents stays a normal
 `document` unless you pass an explicit `artifactType`.
 
 ## Agent Handoff Example
@@ -160,6 +165,7 @@ List artifacts:
 
 ```bash
 artifacty list
+artifacty list --query review --limit 20 --offset 20
 ```
 
 Run the MCP server:
@@ -174,6 +180,8 @@ Operational commands:
 
 ```bash
 artifacty audit --limit 20
+artifacty index rebuild
+artifacty integrity
 artifacty backup
 artifacty export --file ./artifacty-backup.json
 artifacty import-store --file ./artifacty-backup.json
@@ -195,6 +203,13 @@ ARTIFACTY_HOME=/path/to/shared/store artifacty serve
 
 Artifact metadata is stored in `artifacty.sqlite`; artifact content is stored as immutable version files under `artifacts/`. The current browser server URL is written to `server.json` so MCP tools can return the correct links when the default port falls back. Existing `index.json` stores are migrated automatically on first access.
 
+Search uses a SQLite FTS5 index when the local Node SQLite build supports it. The index covers the latest version body plus title, tags, source agent, artifact type, format, and metadata summary. If FTS5 is unavailable, Artifacty keeps working with metadata search. Rebuild or check the store when needed:
+
+```bash
+artifacty index rebuild
+artifacty integrity
+```
+
 ## API Example
 
 Start a protected server in another terminal, or generate a reusable shell token first:
@@ -236,10 +251,17 @@ Browser routes:
 - `/`: list artifacts with search, tag, and source filters.
 - `/new`: create an Artifacty-native artifact with the CodeMirror editor.
 - `/import`: paste an external agent artifact and convert it with automatic editor mode detection.
-- `/artifacts/:id/edit`: save a new version with Markdown, HTML, JSON, text, code, SVG, Mermaid, or React syntax support.
+- `/artifacts/:id/edit`: save a new version with Markdown, HTML, JSON, text, code, SVG, Mermaid, React, SARIF, CSV, image, or video syntax support.
 - `/artifacts/:id/diff`: compare versions.
 - `/api/audit`: list audit events.
 
+List APIs support pagination with `limit` and `offset`. Responses keep the top-level `artifacts` array and include `pagination` and `search` metadata:
+
+```bash
+curl -s "http://127.0.0.1:8787/api/artifacts?q=handoff&limit=20&offset=0" \
+  -H "x-artifacty-token: $ARTIFACTY_API_TOKEN"
+```
+
 ## Interface Language
 
 The browser UI defaults to English. Add `?lang=ko` to any browser route to use Korean, for example `http://127.0.0.1:8787/new?lang=ko`. Forms and in-app links preserve the selected language. Documentation is maintained in English only.
@@ -249,8 +271,9 @@ Schema and storage:
 - Metadata lives in SQLite with `schemaVersion: 1`, `artifactType`, and `archivedAt`.
 - Archive hides artifacts from default lists without deleting versions.
 - Bundle artifacts store multiple files or base64 assets as portable JSON.
-- Supported formats are `html`, `markdown`, `text`, `json`, `code`, `svg`, `mermaid`, and `react`.
-- Diagram, component, and source snippet artifacts use `diagram`, `component`, and `snippet` artifact types.
+- Supported formats are `html`, `markdown`, `text`, `json`, `code`, `svg`, `mermaid`, `react`, `sarif`, `csv`, `image`, and `video`.
+- Diagram, component, source snippet, analysis report, table, and media assets use `diagram`, `component`, `snippet`, `analysis-report`, `table`, and `asset` artifact types.
+- Copilot/Cursor examples cover PR reviews, screenshots, demo recordings, and visual evidence bundles.
 - See [docs/artifact-schema-v1.md](docs/artifact-schema-v1.md).
 - See [docs/sarif-csv-artifact-plan.md](docs/sarif-csv-artifact-plan.md) for the SARIF/CSV output artifact roadmap.
 
@@ -268,6 +291,9 @@ Schema and storage:
 - SVG artifacts render in a scriptless sandboxed iframe and are sanitized for `<script>`, `on*` attributes, and `javascript:` links in the viewer. The raw source remains unchanged.
 - Mermaid artifacts render with the vendored local Mermaid package in a sandboxed iframe without `allow-same-origin`.
 - React artifacts are source-only by default. Set `ARTIFACTY_ENABLE_REACT_RENDERER=true` to execute them in a sandboxed frame with a frame-scoped CSP that permits JSX transformation.
+- SARIF artifacts render a bounded findings summary and keep the full formatted JSON behind a raw-source details panel.
+- CSV artifacts render as an escaped, bounded table; `/raw` preserves the original text.
+- Image and video artifacts store base64 media inline, render safe previews, and decode bytes through `/raw`.
 - Artifact content should still be treated as untrusted; use the raw view when handing content back to an agent.
 
 See [docs/release-checklist.md](docs/release-checklist.md) before publishing or running a shared instance.

package/docs/artifact-schema-v1.md

@@ -35,6 +35,8 @@ Allowed `artifactType` values:
 - `diagram`
 - `component`
 - `snippet`
+- `analysis-report`
+- `table`
 - `unknown`
 
 Unknown legacy or external types should be mapped to `unknown`, not rejected during conversion. Native create/update rejects unsupported explicit types.
@@ -57,7 +59,11 @@ Each version is immutable and points at one content file.
 ```
 
 Allowed `format` values are `html`, `markdown`, `text`, `json`, `code`, `svg`,
-`mermaid`, and `react`.
+`mermaid`, `react`, `sarif`, `csv`, `image`, and `video`.
+
+Common `artifactType` values include `document`, `handoff`, `code-review`,
+`test-report`, `dashboard`, `bundle`, `diagram`, `component`, `snippet`,
+`analysis-report`, and `table`.
 
 ## Renderer Policy
 
@@ -74,6 +80,11 @@ viewer concern and must treat all source as untrusted:
 - `react`: source-only by default. `ARTIFACTY_ENABLE_REACT_RENDERER=true`
   enables a separate sandboxed frame with frame-scoped CSP for JSX transform and
   execution.
+- `sarif`: bounded findings summary plus a formatted raw JSON details panel.
+- `csv`: RFC 4180-style escaped table rendering with bounded rows and columns.
+- `image`: base64 media source rendered with `<img>`; `/raw` decodes bytes.
+- `video`: base64 media source rendered with `<video controls>`; `/raw` decodes
+  bytes.
 
 ## Metadata
 
@@ -85,9 +96,12 @@ Metadata is free-form JSON, but converter-generated metadata uses these keys:
 - `bundlePolicy`: how bundled files were preserved.
 - `language`: source language for code or component artifacts when supplied by an
   upstream agent.
-- `codexContinuation`: structured Codex handoff metadata such as changed files,
-  commands, tests, blockers, decisions, next steps, findings, diff text, and
-  residual risk.
+- `continuation`: structured handoff/review/verification metadata for agent
+  outputs, including changed files, commands, tests, blockers, decisions, next
+  steps, findings, diff text, and residual risk.
+- `<agent>Continuation`: compatibility mirror for structured continuation
+  metadata, such as `codexContinuation`, `copilotContinuation`, or
+  `cursorContinuation`.
 
 ## Archive Semantics
 
@@ -118,4 +132,12 @@ Gemini multimodal payloads use the same bundle type with `parts` and `assets`.
 
 ## Asset Policy
 
-Base64 assets are preserved inline inside bundle JSON with `encoding: "base64"`, `mimeType`, `sizeBytes`, and `sha256`. Consumers must treat decoded assets as untrusted. Large binary asset externalization is intentionally deferred; schema v1 keeps all converted assets inspectable and portable.
+Base64 assets are preserved inline inside bundle JSON with `encoding: "base64"`, `mimeType`, `sizeBytes`, and `sha256`. Consumers must treat decoded assets as untrusted.
+
+First-class `image` and `video` artifacts store base64 content in the immutable
+version file. Importers should set `metadata.encoding: "base64"` and
+`metadata.mimeType` to one of the supported media types. Browser `/raw` decodes
+the stored base64 into bytes with the media content type, while API and MCP reads
+return the stored base64 string. Supported media types are PNG, JPEG, GIF, WebP,
+MP4, and WebM. Large binary externalization is intentionally deferred; schema v1
+keeps converted assets inspectable and portable.

package/docs/integrations.md

@@ -42,7 +42,7 @@ Create artifacts directly in the browser at `http://127.0.0.1:8787/new`.
 
 For LAN or VPN sharing, keep the default local binding unless you intentionally need another machine to reach the server. See [network-sharing.md](network-sharing.md) before using `--host 0.0.0.0`.
 
-The browser create/import/edit screens use CodeMirror 6 for Markdown, HTML, JSON, source-like text, SVG, Mermaid, and React artifact editing. Editor and renderer assets are served from local npm dependencies through `/assets/*.js` and allowlisted `/vendor/npm/*` module routes. For sandboxed iframe imports, `Origin: null` requests receive `Access-Control-Allow-Origin: null`, which lets opaque-origin iframes import local ESM without `allow-same-origin`.
+The browser create/import/edit screens use CodeMirror 6 for Markdown, HTML, JSON, source-like text, SVG, Mermaid, React, SARIF, CSV, image, and video artifact editing. Editor and renderer assets are served from local npm dependencies through `/assets/*.js` and allowlisted `/vendor/npm/*` module routes. For sandboxed iframe imports, `Origin: null` requests receive `Access-Control-Allow-Origin: null`, which lets opaque-origin iframes import local ESM without `allow-same-origin`.
 
 The browser UI defaults to English. Add `?lang=ko` to browser routes to use Korean UI labels; API and MCP payloads are not localized.
 
@@ -70,6 +70,8 @@ Artifacty can write MCP configuration for supported local agents:
 node src/cli.js install claude
 node src/cli.js install codex --dry-run
 node src/cli.js install gemini
+node src/cli.js install copilot
+node src/cli.js install cursor
 node src/cli.js install all
 node src/cli.js check
 ```
@@ -77,6 +79,8 @@ node src/cli.js check
 - Claude: writes project `.mcp.json`. Claude Code's startup timeout is controlled by the parent `MCP_TIMEOUT` environment variable and defaults to 30 seconds, so Artifacty does not add a per-server `.mcp.json` `timeout` field.
 - Codex: writes or replaces the `[mcp_servers.artifacty]` block in `~/.codex/config.toml` unless `--config` is provided. The generated block uses a 30 second startup timeout so slower Windows or cold-start environments can load the MCP server reliably.
 - Gemini: writes project `.gemini/settings.json` with a 30 second timeout.
+- GitHub Copilot in VS Code: writes workspace `.vscode/mcp.json` using the VS Code `servers` shape. Pass `--config` to target a user-profile `mcp.json` instead.
+- Cursor: writes project `.cursor/mcp.json` using the Cursor `mcpServers` shape. Pass `--config ~/.cursor/mcp.json` for global Cursor setup.
 - `--dry-run` returns the generated config without writing it.
 - `--timeout <ms>` adjusts Codex `startup_timeout_sec` and Gemini `timeout`. It does not change Claude Code startup behavior; set `MCP_TIMEOUT` before launching Claude Code if you need a larger value there.
 - `check` starts the local MCP server and verifies required tools through `initialize` and `tools/list`.
@@ -114,7 +118,7 @@ Project-scoped `.mcp.json` shape:
 }
 ```
 
-Claude plugins can bundle MCP servers, so this MCP server can later be wrapped as a plugin. The MVP keeps the server standalone so Claude, Codex, Gemini, and other MCP clients use the same integration surface.
+Claude plugins can bundle MCP servers, so this MCP server can later be wrapped as a plugin. The MVP keeps the server standalone so Claude, Codex, Gemini, GitHub Copilot, Cursor, and other MCP clients use the same integration surface.
 
 Claude Code uses a 30 second MCP startup timeout by default. If a slower
 environment needs more time, launch Claude Code with a larger `MCP_TIMEOUT`
@@ -181,7 +185,7 @@ Then run `/mcp` inside Gemini CLI to confirm that the Artifacty tools are connec
 
 - `artifacty_create`: create a new Artifacty-native artifact.
 - `artifacty_publish`: backwards-compatible alias for `artifacty_create`.
-- `artifacty_import`: convert a Claude, Codex, Gemini, Artifacty, or generic artifact payload into Artifacty format and save it.
+- `artifacty_import`: convert a Claude, Codex, Gemini, GitHub Copilot, Cursor, Artifacty, or generic artifact payload into Artifacty format and save it.
 - `artifacty_list`: discover artifacts by query, tag, or source agent.
 - `artifacty_get`: read artifact metadata and content.
 - `artifacty_update`: append a new version.
@@ -200,6 +204,10 @@ Use `artifacty_import` or the CLI `import` command when the artifact was produce
 node src/cli.js import --agent claude --file ./artifact.html --tag review
 node src/cli.js import --agent codex --file ./handoff.md --tag handoff
 node src/cli.js import --agent codex --content '{"agent":"codex","title":"Verification","verification":{"status":"passed","commands":[{"command":"npm test","status":"passed"}]}}'
+node src/cli.js import --agent copilot --content '{"agent":"github-copilot","title":"PR Review","findings":[{"severity":"medium","file":"src/app.js","line":42,"title":"Handle missing state"}]}'
+node src/cli.js import --agent cursor --content '{"sourceAgent":"cursor","title":"Cursor Handoff","summary":"Editor pass complete.","nextSteps":["Run visual QA."]}'
+node src/cli.js import --agent cursor --file ./browser-screenshot.png --tag visual
+node src/cli.js import --agent cursor --file ./demo.webm --tag demo
 node src/cli.js import --agent gemini --content '{"title":"Options","returnDisplay":"# Options\n- A\n- B"}'
 ```
 
@@ -207,11 +215,17 @@ Supported converter inputs:
 
 - Claude: local `.html`, `.htm`, `.md`, `.svg`, `.mmd`, `.jsx`, `.tsx`, source files, or JSON payloads with `title`/`content`/Claude artifact `type`.
 - Codex: markdown/text/json handoff files; Artifacty-compatible JSON payloads; structured handoff, bundle, diff, review, and verification JSON payloads with `agent` or `sourceAgent` set to `codex`.
+- GitHub Copilot: markdown/text/json outputs; Artifacty-compatible JSON payloads; structured handoff, review, diff, and verification JSON payloads with `agent` or `sourceAgent` set to `github-copilot` or `copilot`.
+- Cursor: markdown/text/json outputs; Artifacty-compatible JSON payloads; structured handoff, review, diff, verification, screenshot, demo/video, and visual evidence bundle JSON payloads with `agent` or `sourceAgent` set to `cursor`.
 - Gemini: `returnDisplay`, `llmContent`, text blocks, or local markdown/text/json files.
-- Generic: file extension, content type, HTML doctype, JSON shape, and markdown headings are used to infer format and title.
+- Generic: file extension, content type, HTML doctype, JSON shape, media data URLs, and markdown headings are used to infer format and title.
 
 The converter adds `imported` and source-agent tags, preserves the raw content as an immutable Artifacty version, and records source details under `metadata.artifactyImport`.
 
+Fixture examples for Copilot/Cursor PR review, screenshot, demo recording, and
+visual evidence bundle live under `test/fixtures/` and are covered by converter
+tests.
+
 ## HTTP API
 
 - `GET /`: dashboard.
@@ -245,6 +259,9 @@ Renderer notes:
 - `svg` artifacts render in a scriptless sandboxed iframe after viewer-side sanitization; `/raw` still returns the original SVG.
 - `mermaid` artifacts load the vendored local Mermaid bundle from `/vendor/npm/mermaid/...` in a sandboxed iframe without `allow-same-origin`. The JavaScript asset route answers the iframe's `Origin: null` module request with `Access-Control-Allow-Origin: null`.
 - `react` artifacts are source-only unless `ARTIFACTY_ENABLE_REACT_RENDERER=true` is set. When enabled, JSX transformation and React execution happen only in `/artifacts/:id/react-frame`, with `unsafe-eval` scoped to that frame CSP.
+- `sarif` artifacts render a bounded findings summary and keep the complete formatted JSON available in the browser viewer and `/raw`.
+- `csv` artifacts render as an escaped table with bounded rows and columns; `/raw` preserves the original CSV text.
+- `image` and `video` artifacts store base64 content inline, render with native browser media elements, and decode bytes through `/raw`.
 
 ## Background Service
 

package/docs/sarif-csv-artifact-plan.md

@@ -1,65 +1,44 @@
-# SARIF and CSV Artifact Support Plan
-
-This plan scopes SARIF and CSV support to **output artifacts** that Codex or
-other agents generate for downstream review. It does not cover Codex input
-context, appshots, thread state, or client-specific UI state.
-
-## Goals
-
-- Preserve SARIF and CSV files as immutable Artifacty versions.
-- Classify common Codex Security exports without requiring manual
-  `artifactType` overrides.
-- Render CSV outputs in a readable table view while keeping `/raw` unchanged.
-- Keep SARIF as JSON-first, with future room for a findings-focused viewer.
-
-## Current Behavior
-
-- `.sarif` content is stored as `json` when the payload is valid JSON, but it
-  currently falls back to `artifactType: "unknown"`.
-- `.csv` and `text/csv` content can be stored as `text`, but there is no CSV
-  detection, table renderer, or artifact-type inference.
-- Security findings exported as JSON, CSV, or SARIF can be shared today, but the
-  browsing experience is not yet tailored to review workflows.
-
-## Phase 1: Detection and Taxonomy
-
-- Detect `.sarif` and `application/sarif+json` as `json`.
-- Detect SARIF shape (`version`, `runs[]`, `tool.driver`) and classify as
-  `code-review`.
-- Detect `.csv` and `text/csv` as either a new `csv` format or `text` with
-  `metadata.delimitedText`.
-- Infer `code-review` for CSV/SARIF files named like `findings`, `security`,
-  `review`, or containing columns such as `severity`, `file`, and `message`.
-
-Exit criteria: CLI, HTTP, and MCP imports classify SARIF and common findings CSV
-without explicit overrides.
-
-## Phase 2: CSV Viewer
-
-- Add a lightweight RFC 4180-style CSV parser for browser rendering.
-- Render CSV as a scrollable table with sticky headers and escaped cell content.
-- Cap rendered rows and columns for very large files, with a visible truncation
-  notice and a link to `/raw`.
-- Preserve plain text fallback when parsing fails.
-
-Exit criteria: CSV artifacts are readable in the browser and raw fidelity is
-unchanged.
-
-## Phase 3: SARIF Summary Viewer
-
-- Keep SARIF source as JSON.
-- Add an optional summary above the JSON view: rule id, severity/level, message,
-  file URI, region, and result count by level.
-- Avoid implementing the complete SARIF spec in v1; parse only stable top-level
-  fields and fail closed to JSON rendering.
-
-Exit criteria: SARIF exports are useful for quick triage while preserving the
-full JSON source.
-
-## Tests
-
-- Converter fixtures: Codex Security SARIF, findings CSV, generic CSV, malformed
-  CSV, and large CSV.
-- Storage round trips: content type, extension, size, hash, and `/raw` fidelity.
-- Server rendering: CSV table escaping, truncation notice, SARIF summary fallback.
-- MCP schema and import tests for explicit and inferred artifact types.
+# SARIF and CSV Artifact Support
+
+Artifacty supports SARIF and CSV as **output artifacts** that Codex and other
+agents can hand off for downstream review. This scope excludes Codex input
+context, appshots, thread state, and client-specific UI state.
+
+## Implemented Behavior
+
+- `sarif` and `csv` are first-class `format` values across HTTP, CLI, MCP,
+  storage, and browser forms.
+- `.sarif`, `.sarif.json`, `application/sarif+json`, `.csv`, and `text/csv`
+  inputs are detected during import.
+- SARIF top-level objects with `version` and `runs[]` are imported as
+  `analysis-report` artifacts.
+- CSV inputs default to `table`; CSV files that look like security or review
+  findings infer `analysis-report`.
+- `/raw` always returns the original stored source.
+
+## Browser Rendering
+
+- SARIF renders a bounded findings summary with run, result, error, warning,
+  and note counts.
+- SARIF result rows show level, rule id, message, first location, and tool name.
+- The full formatted SARIF JSON remains available in a details panel.
+- CSV renders as an escaped table with bounded rows and columns.
+- Malformed CSV or non-SARIF JSON fails closed to escaped source or formatted
+  JSON fallback.
+
+## Verification Coverage
+
+- Storage round trips cover format enums, content types, extensions, and type
+  inference.
+- Converter tests cover SARIF extension/MIME/object detection, findings CSV,
+  and generic CSV.
+- Server tests cover SARIF summary rendering, CSV escaping, `/raw` fidelity,
+  and browser form options.
+- MCP tests assert the new format and artifact type enums are exposed.
+
+## Future Extensions
+
+- Add real-world fixtures from CodeQL, Semgrep, Trivy, and other scanners.
+- Add sorting/filtering for SARIF levels and CSV columns.
+- Add optional download helpers for filtered CSV/SARIF views without changing
+  immutable source storage.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "artifacty",
-  "version": "0.1.2",
+  "version": "0.3.0",
   "description": "Local artifact exchange for heterogeneous LLM agents via HTTP and MCP.",
   "type": "module",
   "keywords": [

package/src/cli.js

@@ -4,11 +4,13 @@ import path from "node:path";
 import { fileURLToPath } from "node:url";
 import {
   archiveArtifact,
+  checkStoreIntegrity,
   createArtifact,
   createStore,
   getArtifact,
   listAuditEvents,
-  listArtifacts,
+  listArtifactsPage,
+  rebuildSearchIndex,
   restoreArtifact,
   updateArtifact
 } from "./lib/storage.js";
@@ -145,7 +147,7 @@ async function main() {
   if (command === "install") {
     const agent = options._[0];
     if (!agent) {
-      throw new Error("install requires an agent: claude, codex, gemini, or all");
+      throw new Error("install requires an agent: claude, codex, gemini, copilot, cursor, or all");
     }
     const result = await installAgent(agent, {
       projectDir: options.projectDir || process.cwd(),
@@ -200,14 +202,37 @@ async function main() {
   }
 
   if (command === "list") {
-    const artifacts = await listArtifacts(store, {
+    const page = await listArtifactsPage(store, {
       query: options.query,
       tag: Array.isArray(options.tag) ? options.tag[0] : options.tag,
       sourceAgent: options.source,
       includeArchived: options.includeArchived,
-      limit: options.limit
+      limit: options.limit,
+      offset: options.offset
+    });
+    printJson({
+      artifacts: page.artifacts,
+      pagination: paginationJson(page),
+      search: page.search
     });
-    printJson({ artifacts });
+    return;
+  }
+
+  if ((command === "index" || command === "search") && options._[0] === "rebuild") {
+    const result = await rebuildSearchIndex(store);
+    printJson(result);
+    if (!result.fts5) {
+      process.exitCode = 1;
+    }
+    return;
+  }
+
+  if (command === "integrity" || command === "check-store") {
+    const result = await checkStoreIntegrity(store);
+    printJson(result);
+    if (!result.ok) {
+      process.exitCode = 1;
+    }
     return;
   }
 
@@ -298,7 +323,7 @@ function parseArgs(args) {
 
     if (key === "tag") {
       options.tag = [...(options.tag || []), value];
-    } else if (key === "port" || key === "limit" || key === "version" || key === "schema-version" || key === "timeout" || key === "bytes") {
+    } else if (key === "port" || key === "limit" || key === "offset" || key === "version" || key === "schema-version" || key === "timeout" || key === "bytes") {
       options[toCamelCase(key)] = Number(value);
     } else {
       options[toCamelCase(key)] = value;
@@ -311,7 +336,11 @@ function parseArgs(args) {
 
 async function readContent(options) {
   if (options.file) {
-    return readFile(options.file, "utf8");
+    const filePath = path.resolve(options.file);
+    if (shouldReadFileAsBase64(options, filePath)) {
+      return (await readFile(filePath)).toString("base64");
+    }
+    return readFile(filePath, "utf8");
   }
   if (options.content !== undefined) {
     return options.content;
@@ -319,6 +348,16 @@ async function readContent(options) {
   throw new Error("Provide --file or --content");
 }
 
+function shouldReadFileAsBase64(options, filePath) {
+  const format = String(options.format || "").toLowerCase();
+  const contentType = String(options.contentType || "").toLowerCase();
+  return format === "image" ||
+    format === "video" ||
+    contentType.startsWith("image/") ||
+    contentType.startsWith("video/") ||
+    /\.(png|jpe?g|gif|webp|mp4|webm)$/i.test(filePath);
+}
+
 async function withUrls(store, artifact) {
   const publicBaseUrl = await resolvePublicBaseUrl(store);
   return {
@@ -328,6 +367,17 @@ async function withUrls(store, artifact) {
   };
 }
 
+function paginationJson(page) {
+  return {
+    total: page.total,
+    limit: page.limit,
+    offset: page.offset,
+    hasMore: page.hasMore,
+    nextOffset: page.nextOffset,
+    previousOffset: page.previousOffset
+  };
+}
+
 function requireOption(options, name) {
   if (!options[name]) {
     throw new Error(`Missing required option --${name}`);
@@ -349,18 +399,20 @@ Usage:
   artifacty status [--home ~/.artifacty]
   artifacty stop [--home ~/.artifacty] [--timeout 5000] [--force]
   artifacty publish --title <title> (--file <path> | --content <text>) [--format html|markdown|text|json|code|svg|mermaid|react] [--source agent] [--tag tag]
-  artifacty import --agent claude|codex|gemini|auto (--file <path> | --content <text>) [--title <title>] [--format html|markdown|text|json|code|svg|mermaid|react] [--tag tag]
-  artifacty install claude|codex|gemini|all [--dry-run] [--config <path>] [--server-path <path>] [--url http://127.0.0.1:8787] [--timeout 30000]
+  artifacty import --agent claude|codex|gemini|copilot|cursor|auto (--file <path> | --content <text>) [--title <title>] [--format html|markdown|text|json|code|svg|mermaid|react] [--tag tag]
+  artifacty install claude|codex|gemini|copilot|cursor|all [--dry-run] [--config <path>] [--server-path <path>] [--url http://127.0.0.1:8787] [--timeout 30000]
   artifacty check [--server-path <path>] [--timeout 5000]
   artifacty update <id> (--file <path> | --content <text>) [--title <title>] [--format html|markdown|text|json|code|svg|mermaid|react]
   artifacty archive <id>
   artifacty restore <id>
   artifacty audit [--artifact <id>] [--limit 100]
+  artifacty index rebuild
+  artifacty integrity
   artifacty export --file <path>
   artifacty backup [--file <path>]
   artifacty import-store --file <path>
   artifacty service plist|install|uninstall [--dry-run] [--plist <path>]
-  artifacty list [--query text] [--tag tag] [--source agent] [--limit 50] [--include-archived]
+  artifacty list [--query text] [--tag tag] [--source agent] [--limit 50] [--offset 0] [--include-archived]
   artifacty show <id> [--version n] [--raw]
 
 Environment: