artifacty 0.10.1 → 0.10.3

package/README.md

@@ -314,7 +314,7 @@ The browser UI defaults to English. Add `?lang=ko` to any browser route to use K
 
 Schema and storage:
 
-- Metadata lives in SQLite with `schemaVersion: 1`, `artifactType`, and `archivedAt`.
+- Metadata lives in SQLite with `schemaVersion: 1`, `artifactType`, `publisherId`, and `archivedAt`.
 - Archive hides artifacts from default lists without deleting versions.
 - Bundle artifacts store multiple files or base64 assets as portable JSON.
 - Supported formats are `html`, `markdown`, `text`, `json`, `code`, `svg`, `mermaid`, `react`, `sarif`, `csv`, `image`, and `video`.
@@ -329,13 +329,13 @@ Schema and storage:
 
 - The HTTP server binds to `127.0.0.1` by default.
 - If `ARTIFACTY_API_TOKEN` is set, HTTP API routes require `Authorization: Bearer <token>` or `x-artifacty-token`; scripts should prefer headers over `?token=...` URLs.
-- When users exist, personal API tokens issued from `/account` also authenticate HTTP API and MCP requests, and audit logs record the token owner's email as `actor`.
+- When users exist, personal API tokens issued from `/account` also authenticate HTTP API and MCP requests. Created artifacts record the token owner's email as `publisherId`, and audit logs record the same identity as `actor`.
 - API token checks use timing-safe digest comparison.
 - Binding outside localhost requires both `ARTIFACTY_SHARE_MODE=lan` or `team` and `ARTIFACTY_API_TOKEN`.
 - Non-local sharing is intended for trusted LAN or VPN sessions. Prefer a specific interface IP over `0.0.0.0`, keep React rendering disabled, and see [docs/network-sharing.md](docs/network-sharing.md).
 - Non-local binding prints a startup warning because Artifacty does not terminate TLS.
 - Artifact content is scanned for common API keys and private keys before storage. Use `--allow-secrets` or `ARTIFACTY_ALLOW_SECRETS=true` only for intentional exceptions.
-- Creates, updates, reads, imports, archives, and restores write audit events to SQLite.
+- Creates, updates, reads, imports, archives, and restores write audit events to SQLite. Legacy artifacts without a stored publisher are best-effort backfilled from their first `create` or `import` audit actor.
 - CodeMirror editor/viewer and renderer assets are served from local npm dependencies through a package allowlist, not from a public CDN. JavaScript asset routes answer `Origin: null` requests with `Access-Control-Allow-Origin: null` so sandboxed renderer iframes can import local ESM without `allow-same-origin`.
 - Mutating HTTP routes reject non-local browser origins.
 - HTML artifacts render in a sandboxed iframe.

package/docs/artifact-schema-v1.md

@@ -11,6 +11,9 @@ Artifacty schema v1 defines the stable envelope shared by HTTP, CLI, MCP, conver
   "artifactType": "document",
   "title": "Readable title",
   "sourceAgent": "codex",
+  "publisherId": "user@example.com",
+  "publisherName": "User Name",
+  "publisherUserId": "user-record-id",
   "tags": ["handoff"],
   "createdAt": "2026-06-24T00:00:00.000Z",
   "updatedAt": "2026-06-24T00:00:00.000Z",
@@ -41,6 +44,13 @@ Allowed `artifactType` values:
 
 Unknown legacy or external types should be mapped to `unknown`, not rejected during conversion. Native create/update rejects unsupported explicit types.
 
+`sourceAgent` identifies the tool or model surface that produced the artifact,
+such as `codex` or `claude`. `publisherId` identifies who published it to the
+Artifacty store. For authenticated central servers this is the personal token
+owner's email; `publisherName` and `publisherUserId` are included when the
+server can map the request to a local user record. Legacy artifacts are
+best-effort backfilled from the first `create` or `import` audit actor.
+
 ## Version Record
 
 Each version is immutable and points at one content file.

package/docs/central-team-deployment-design.md

@@ -126,7 +126,8 @@ revoke personal API tokens from `/account`. CSV imports support
 `email,name,role,password,password_reset_required`; blank passwords are
 generated once and require a password change on first sign-in. Use personal
 tokens for `artifacty install ... --api-token` so MCP and API audit logs record
-the user's email as `actor`.
+the user's email as `actor` and created artifacts record the same email as
+`publisherId`.
 
 Production-like internal deployments should run Artifacty behind a TLS reverse
 proxy, keep `ARTIFACTY_ENABLE_REACT_RENDERER` disabled unless the team trusts
@@ -162,9 +163,9 @@ x-artifacty-actor: user@example.com
 x-artifacty-host: IRAE-MACBOOK
 ```
 
-The server records the authenticated user's email as the audit `actor` when a
-personal token is used. The `x-artifacty-actor` header remains a compatibility
-fallback for the bootstrap/global token path.
+The server records the authenticated user's email as the artifact `publisherId`
+and audit `actor` when a personal token is used. The `x-artifacty-actor` header
+remains a compatibility fallback for the bootstrap/global token path.
 
 ## Security Model
 

package/docs/integrations.md

@@ -130,9 +130,29 @@ their password before they can continue to `/account` and issue MCP/API tokens.
 - `--api-token <token>` is written into the generated MCP environment for bridge mode. For central servers, prefer a personal token issued from `/account`.
 - `--url <url>` remains a browser-link override and does not enable central MCP by itself.
 - `--timeout <ms>` adjusts Codex `startup_timeout_sec` and Gemini `timeout`. It does not change Claude Code startup behavior; set `MCP_TIMEOUT` before launching Claude Code if you need a larger value there.
+- Do not use `artifacty install all --config <path>`. Each MCP client uses a
+  different config file shape, so shared config overrides are rejected. Use
+  `artifacty install <agent> --config <path>` only when targeting one agent.
+- JSON-based installers preserve unrelated servers and replace only the
+  `artifacty` entry. If `mcpServers` or `servers` already exists but is not a
+  JSON object, Artifacty stops with an error instead of rewriting the file.
 - `check` starts the local MCP server and verifies required tools, resources, and prompts through MCP discovery methods.
 - `doctor` combines MCP discovery with runtime, storage, server, and service diagnostics.
 
+Codex troubleshooting:
+
+- If Codex reports a duplicate `mcp_servers.artifacty.env` or `artifacty.env`
+  key, update Artifacty and rerun the Codex installer. Older installs could
+  leave a legacy `[mcp_servers.artifacty.env]` child table behind while adding a
+  new inline `env = { ... }` value.
+
+```bash
+npm install -g artifacty@latest
+artifacty install codex \
+  --mcp-url http://10.0.0.50:8787/mcp \
+  --api-token "$ARTIFACTY_PERSONAL_TOKEN"
+```
+
 ## Client Compatibility Matrix
 
 | Client | Config shape | Scope | Timeout behavior | Restart requirement | Notes |
@@ -333,7 +353,7 @@ tests.
 - `GET /artifacts/:id/diff`: compare two versions.
 - `GET /artifacts/:id/raw?version=n`: raw content.
 
-When `ARTIFACTY_API_TOKEN` is configured, `/api/*` routes require either `Authorization: Bearer <token>` or `x-artifacty-token: <token>`. When users exist, personal tokens issued from `/account` also authenticate API and MCP requests and are mapped to the token owner's email in audit logs. Browser forms can also carry `?token=<token>` in the URL, which is copied to hidden form fields for local team workflows.
+When `ARTIFACTY_API_TOKEN` is configured, `/api/*` routes require either `Authorization: Bearer <token>` or `x-artifacty-token: <token>`. When users exist, personal tokens issued from `/account` also authenticate API and MCP requests, set created artifacts' `publisherId` to the token owner's email, and map audit `actor` to the same identity. Browser forms can also carry `?token=<token>` in the URL, which is copied to hidden form fields for local team workflows.
 
 Renderer notes:
 

package/docs/mcp-public-api.md

@@ -66,8 +66,9 @@ Prompts accept optional context arguments such as `artifactId`, `goal`, `scope`,
 - Local stdio remains the default. Enable the central HTTP endpoint with
   `artifacty serve --mcp-http` and install bridge mode with
   `artifacty install <agent> --mcp-url http://host:8787/mcp --api-token <token>`.
-- On central servers, use a personal token from `/account` so audit logs record
-  the token owner's email as the artifact actor.
+- On central servers, use a personal token from `/account` so created artifacts
+  include the token owner's email as `publisherId` and audit logs record the
+  same identity as `actor`.
 - Remote MCP currently uses bearer/header token auth. OAuth and per-user scoped
   tokens are future hardening work.
 - Binary media resources return stored base64 text through MCP; browser `/raw`

package/docs/threat-model.md

@@ -114,8 +114,8 @@ Controls:
 - The HTTP MCP endpoint is disabled unless explicitly enabled.
 - Remote MCP requests require the configured API token.
 - Stdio bridge mode sends tokens in headers, not URLs.
-- Personal tokens map requests to a server-side user record for audit actor
-  attribution.
+- Personal tokens map requests to a server-side user record for artifact
+  `publisherId` and audit `actor` attribution.
 - MCP writes go through the same secret scan and audit paths as CLI/HTTP writes.
 - MCP resources are read-only.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "artifacty",
-  "version": "0.10.1",
+  "version": "0.10.3",
   "description": "Local artifact exchange for heterogeneous LLM agents via HTTP and MCP.",
   "type": "module",
   "keywords": [

package/src/lib/i18n.js

@@ -45,6 +45,8 @@ const TRANSLATIONS = {
     "artifact.schema": "schema v{version}",
     "artifact.archived": "archived {date}",
     "artifact.bytes": "{size} bytes",
+    "artifact.publisher": "publisher {publisher}",
+    "artifact.publisherUnknown": "unknown publisher",
     "artifact.archive": "Archive",
     "artifact.restore": "Restore",
     "diff.title": "{title} Diff",
@@ -103,6 +105,8 @@ const TRANSLATIONS = {
     "artifact.schema": "스키마 v{version}",
     "artifact.archived": "보관됨 {date}",
     "artifact.bytes": "{size} 바이트",
+    "artifact.publisher": "게시자 {publisher}",
+    "artifact.publisherUnknown": "게시자 알 수 없음",
     "artifact.archive": "보관",
     "artifact.restore": "복원",
     "diff.title": "{title} 비교",

package/src/lib/installer.js

@@ -14,6 +14,9 @@ export async function installAgent(agent, options = {}) {
   }
 
   if (normalized === "all") {
+    if (options.configPath) {
+      throw new Error("install all does not support --config because each MCP client uses a different config file. Run install per agent when overriding config paths.");
+    }
     const results = [];
     for (const target of INSTALL_TARGETS) {
       results.push(await installAgent(target, options));
@@ -73,11 +76,12 @@ export function createMcpServerConfig(options = {}) {
 export async function installClaude(options = {}) {
   const projectDir = path.resolve(options.projectDir || process.cwd());
   const targetPath = path.resolve(options.configPath || path.join(projectDir, ".mcp.json"));
-  const existing = await readJsonFile(targetPath, {});
+  const existing = await readJsonConfigFile(targetPath);
+  const mcpServers = jsonObjectSection(existing, "mcpServers", targetPath);
   const next = {
     ...existing,
     mcpServers: {
-      ...(existing.mcpServers || {}),
+      ...mcpServers,
       artifacty: createMcpServerConfig(options)
     }
   };
@@ -93,11 +97,12 @@ export async function installClaude(options = {}) {
 export async function installGemini(options = {}) {
   const projectDir = path.resolve(options.projectDir || process.cwd());
   const targetPath = path.resolve(options.configPath || path.join(projectDir, ".gemini", "settings.json"));
-  const existing = await readJsonFile(targetPath, {});
+  const existing = await readJsonConfigFile(targetPath);
+  const mcpServers = jsonObjectSection(existing, "mcpServers", targetPath);
   const next = {
     ...existing,
     mcpServers: {
-      ...(existing.mcpServers || {}),
+      ...mcpServers,
       artifacty: {
         ...createMcpServerConfig(options),
         timeout: normalizeTimeoutMs(options.timeout),
@@ -117,11 +122,12 @@ export async function installGemini(options = {}) {
 export async function installCopilot(options = {}) {
   const projectDir = path.resolve(options.projectDir || process.cwd());
   const targetPath = path.resolve(options.configPath || path.join(projectDir, ".vscode", "mcp.json"));
-  const existing = await readJsonFile(targetPath, {});
+  const existing = await readJsonConfigFile(targetPath);
+  const servers = jsonObjectSection(existing, "servers", targetPath);
   const next = {
     ...existing,
     servers: {
-      ...(existing.servers || {}),
+      ...servers,
       artifacty: {
         type: "stdio",
         ...createMcpServerConfig(options)
@@ -140,11 +146,12 @@ export async function installCopilot(options = {}) {
 export async function installCursor(options = {}) {
   const projectDir = path.resolve(options.projectDir || process.cwd());
   const targetPath = path.resolve(options.configPath || path.join(projectDir, ".cursor", "mcp.json"));
-  const existing = await readJsonFile(targetPath, {});
+  const existing = await readJsonConfigFile(targetPath);
+  const mcpServers = jsonObjectSection(existing, "mcpServers", targetPath);
   const next = {
     ...existing,
     mcpServers: {
-      ...(existing.mcpServers || {}),
+      ...mcpServers,
       artifacty: createMcpServerConfig(options)
     }
   };
@@ -190,11 +197,35 @@ export function codexTomlBlock(config, options = {}) {
 }
 
 export function replaceTomlBlock(existing, dottedName, block) {
-  const trimmed = existing.trimEnd();
-  const pattern = new RegExp(`\\n?\\[${escapeRegExp(dottedName)}\\][\\s\\S]*?(?=\\n\\[[^\\]]+\\]|$)`);
-  if (pattern.test(trimmed)) {
-    return `${trimmed.replace(pattern, `\n${block.trimEnd()}`)}\n`;
+  const trimmedBlock = block.trimEnd();
+  const lines = existing.replace(/\r\n/g, "\n").split("\n");
+  const target = normalizeTomlDottedName(dottedName);
+  const start = lines.findIndex((line) => normalizeTomlDottedName(parseTomlTableHeader(line)) === target);
+
+  if (start !== -1) {
+    let end = lines.length;
+    for (let index = start + 1; index < lines.length; index += 1) {
+      const tableName = normalizeTomlDottedName(parseTomlTableHeader(lines[index]));
+      if (!tableName) {
+        continue;
+      }
+      if (tableName === target || tableName.startsWith(`${target}.`)) {
+        continue;
+      }
+      end = index;
+      break;
+    }
+
+    const prefix = lines.slice(0, start).join("\n").trimEnd();
+    const suffix = lines.slice(end).join("\n").trimStart();
+    return [
+      prefix,
+      trimmedBlock,
+      suffix
+    ].filter(Boolean).join("\n").trimEnd() + "\n";
   }
+
+  const trimmed = existing.trimEnd();
   return `${trimmed}${trimmed ? "\n\n" : ""}${block}`;
 }
 
@@ -216,20 +247,25 @@ async function writeInstallFile({ agent, path: targetPath, dryRun, content }) {
   };
 }
 
-async function readJsonFile(filePath, fallback) {
+async function readJsonConfigFile(filePath) {
   if (!existsSync(filePath)) {
-    return fallback;
+    return {};
   }
 
   const raw = await readTextFile(filePath, "");
   if (!raw.trim()) {
-    return fallback;
+    return {};
   }
+  let parsed;
   try {
-    return JSON.parse(raw);
+    parsed = JSON.parse(raw);
   } catch (error) {
     throw new Error(`Failed to parse ${filePath}: ${error.message}`);
   }
+  if (!isPlainObject(parsed)) {
+    throw new Error(`Invalid MCP config at ${filePath}: expected a JSON object`);
+  }
+  return parsed;
 }
 
 async function readTextFile(filePath, fallback) {
@@ -247,6 +283,20 @@ function normalizeAgent(agent) {
   return normalized;
 }
 
+function jsonObjectSection(config, key, filePath) {
+  if (config[key] === undefined) {
+    return {};
+  }
+  if (!isPlainObject(config[key])) {
+    throw new Error(`Invalid MCP config at ${filePath}: ${key} must be a JSON object`);
+  }
+  return config[key];
+}
+
+function isPlainObject(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+
 function normalizeTimeoutMs(value) {
   const timeout = Number(value ?? DEFAULT_MCP_TIMEOUT_MS);
   return Number.isFinite(timeout) && timeout > 0 ? timeout : DEFAULT_MCP_TIMEOUT_MS;
@@ -276,6 +326,47 @@ function quoteTomlString(value) {
   return JSON.stringify(String(value));
 }
 
-function escapeRegExp(value) {
-  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+function parseTomlTableHeader(line) {
+  const match = /^\s*\[([^\][\r\n]+)]\s*(?:#.*)?$/.exec(line);
+  return match ? match[1] : "";
+}
+
+function normalizeTomlDottedName(value) {
+  return splitTomlDottedName(value).join(".");
+}
+
+function splitTomlDottedName(value) {
+  const parts = [];
+  let current = "";
+  let quoted = false;
+  let quote = "";
+  let escaped = false;
+  for (const char of String(value || "").trim()) {
+    if (quoted) {
+      if (escaped) {
+        current += char;
+        escaped = false;
+      } else if (char === "\\" && quote === "\"") {
+        escaped = true;
+      } else if (char === quote) {
+        quoted = false;
+      } else {
+        current += char;
+      }
+      continue;
+    }
+    if (char === "\"" || char === "'") {
+      quoted = true;
+      quote = char;
+    } else if (char === ".") {
+      parts.push(current.trim());
+      current = "";
+    } else if (!/\s/.test(char)) {
+      current += char;
+    }
+  }
+  if (current || parts.length > 0) {
+    parts.push(current.trim());
+  }
+  return parts.filter(Boolean);
 }

package/src/lib/render.js

@@ -13,6 +13,7 @@ export function renderDashboard({ artifacts, baseUrl, filters = {}, pagination,
     .map((artifact) => {
       const tags = artifact.tags.map((tag) => `<span class="tag">${escapeHtml(tag)}</span>`).join("");
       const status = artifact.archivedAt ? statusBadge("archived") : "";
+      const publisher = publisherDisplay(artifact, view);
       const snippet = artifact.searchSnippet
         ? `<span class="row-snippet">${escapeHtml(artifact.searchSnippet)}</span>`
         : "";
@@ -24,6 +25,7 @@ export function renderDashboard({ artifacts, baseUrl, filters = {}, pagination,
             ${snippet}
           </span>
           <span>${escapeHtml(artifact.sourceAgent)}</span>
+          <span class="publisher-cell" title="${escapeAttribute(publisherTitle(artifact, view))}">${escapeHtml(publisher)}</span>
           ${typeBadge(artifact.artifactType || "document")}
           ${formatBadge(artifact.format || "text")}
           <span>v${artifact.latestVersion}</span>
@@ -527,6 +529,7 @@ export function renderArtifactPage({ artifact, version, content, baseUrl, authTo
   const rawUrl = `/artifacts/${encodeURIComponent(artifact.id)}/raw?version=${version.version}`;
   const archiveAction = artifact.archivedAt ? "restore" : "archive";
   const archiveLabel = artifact.archivedAt ? view.text("artifact.restore") : view.text("artifact.archive");
+  const publisher = publisherDisplay(artifact, view);
 
   return pageShell({
     title: artifact.title,
@@ -550,6 +553,7 @@ export function renderArtifactPage({ artifact, version, content, baseUrl, authTo
           ${typeBadge(artifact.artifactType || "document")}
           <span>${view.text("artifact.schema", { version: artifact.schemaVersion || 1 })}</span>
           ${artifact.archivedAt ? statusBadge(view.text("artifact.archived", { date: artifact.archivedAt })) : ""}
+          <span title="${escapeAttribute(publisherTitle(artifact, view))}">${view.text("artifact.publisher", { publisher })}</span>
           <span>${view.text("artifact.bytes", { size: version.sizeBytes })}</span>
           <span>${escapeHtml(version.createdAt)}</span>
           <span>${escapeHtml(version.sha256.slice(0, 12))}</span>
@@ -1295,8 +1299,8 @@ export function pageShell({ title, body, head = "", afterBody = "", locale = DEF
     }
     .artifact-row {
       display: grid;
-      grid-template-columns: minmax(220px, 1fr) 120px 120px 90px 64px minmax(120px, 220px);
-      gap: 16px;
+      grid-template-columns: minmax(220px, 1fr) 110px minmax(140px, 200px) 110px 84px 56px minmax(100px, 180px);
+      gap: 12px;
       align-items: center;
       min-height: 64px;
       padding: 14px 18px;
@@ -1343,6 +1347,13 @@ export function pageShell({ title, body, head = "", afterBody = "", locale = DEF
       font-size: 12.5px;
       color: var(--muted);
     }
+    .artifact-row .publisher-cell {
+      min-width: 0;
+      overflow: hidden;
+      text-overflow: ellipsis;
+      white-space: nowrap;
+      color: var(--text);
+    }
     .empty {
       color: var(--muted);
       font-size: 13px;
@@ -1828,6 +1839,19 @@ function formatBadge(value) {
   return `<span class="badge f-${escapeAttribute(slug)}">${escapeHtml(format)}</span>`;
 }
 
+function publisherDisplay(artifact, view) {
+  return artifact.publisherId || artifact.publisherName || view.text("artifact.publisherUnknown");
+}
+
+function publisherTitle(artifact, view) {
+  const id = artifact.publisherId || "";
+  const name = artifact.publisherName || "";
+  if (id && name && id !== name) {
+    return `${name} <${id}>`;
+  }
+  return id || name || view.text("artifact.publisherUnknown");
+}
+
 function statusBadge(label) {
   return `<span class="badge s-archived">${label}</span>`;
 }

package/src/lib/storage.js

@@ -6,7 +6,7 @@ import path from "node:path";
 import { DatabaseSync } from "node:sqlite";
 import { assertNoSecrets, securityConfig } from "./security.js";
 
-export const STORE_VERSION = 3;
+export const STORE_VERSION = 4;
 export const ARTIFACT_SCHEMA_VERSION = 1;
 export const MAX_ARTIFACT_BYTES = 16 * 1024 * 1024;
 export const USER_ROLES = ["admin", "user"];
@@ -141,6 +141,7 @@ export async function createArtifact(store = createStore(), input = {}) {
       const now = new Date().toISOString();
       const id = makeArtifactId(normalized.title);
       const version = writeVersionFile(store, id, 1, normalized, now);
+      const publisher = publisherFromAudit(input.audit);
 
       artifact = {
         id,
@@ -148,6 +149,9 @@ export async function createArtifact(store = createStore(), input = {}) {
         artifactType: normalized.artifactType,
         schemaVersion: normalized.schemaVersion,
         sourceAgent: normalized.sourceAgent,
+        publisherId: publisher.publisherId,
+        publisherName: publisher.publisherName,
+        publisherUserId: publisher.publisherUserId,
         tags: normalized.tags,
         createdAt: now,
         updatedAt: now,
@@ -461,15 +465,17 @@ function listArtifactsPageWithSql(db, filters) {
       LOWER(id) LIKE ? ESCAPE '\\' OR
       LOWER(title) LIKE ? ESCAPE '\\' OR
       LOWER(source_agent) LIKE ? ESCAPE '\\' OR
+      LOWER(COALESCE(publisher_id, '')) LIKE ? ESCAPE '\\' OR
+      LOWER(COALESCE(publisher_name, '')) LIKE ? ESCAPE '\\' OR
       LOWER(tags_json) LIKE ? ESCAPE '\\'
     )`);
-    params.push(like, like, like, like);
+    params.push(like, like, like, like, like, like);
   }
 
   const whereSql = clauses.length ? `WHERE ${clauses.join(" AND ")}` : "";
   const total = db.prepare(`SELECT COUNT(*) AS total FROM artifacts ${whereSql}`).get(...params).total;
   const rows = db.prepare(`
-    SELECT id, title, artifact_type, schema_version, source_agent, tags_json, created_at, updated_at, latest_version, archived_at
+    SELECT id, title, artifact_type, schema_version, source_agent, publisher_id, publisher_name, publisher_user_id, tags_json, created_at, updated_at, latest_version, archived_at
     FROM artifacts
     ${whereSql}
     ORDER BY updated_at DESC, created_at DESC
@@ -503,13 +509,16 @@ function listArtifactsPageWithFts(db, filters) {
       a.artifact_type,
       a.schema_version,
       a.source_agent,
+      a.publisher_id,
+      a.publisher_name,
+      a.publisher_user_id,
       a.tags_json,
       a.created_at,
       a.updated_at,
       a.latest_version,
       a.archived_at,
       bm25(artifact_search) AS search_rank,
-      snippet(artifact_search, 7, '', '', '...', 24) AS search_snippet
+      snippet(artifact_search, -1, '', '', '...', 24) AS search_snippet
     FROM artifact_search
     JOIN artifacts a ON a.id = artifact_search.artifact_id
     ${whereSql}
@@ -572,6 +581,9 @@ function artifactFromRow(db, row) {
     artifactType: row.artifact_type,
     schemaVersion: row.schema_version,
     sourceAgent: row.source_agent,
+    publisherId: row.publisher_id || null,
+    publisherName: row.publisher_name || null,
+    publisherUserId: row.publisher_user_id || null,
     tags: parseJson(row.tags_json, []),
     createdAt: row.created_at,
     updatedAt: row.updated_at,
@@ -589,6 +601,15 @@ function normalizeWhitespace(value) {
   return normalizeOptionalString(value).replace(/\s+/g, " ");
 }
 
+function publisherFromAudit(audit = {}) {
+  const publisherId = normalizeOptionalString(audit.publisherId || audit.actor) || null;
+  return {
+    publisherId,
+    publisherName: normalizeOptionalString(audit.publisherName || audit.userName) || null,
+    publisherUserId: normalizeOptionalString(audit.publisherUserId || audit.userId) || null
+  };
+}
+
 function toFtsQuery(value) {
   const tokens = normalizeOptionalString(value).match(/[\p{L}\p{N}_-]+/gu) || [];
   return tokens
@@ -986,6 +1007,9 @@ export function toArtifactSummary(artifact) {
     artifactType: artifact.artifactType,
     schemaVersion: artifact.schemaVersion,
     sourceAgent: artifact.sourceAgent,
+    publisherId: artifact.publisherId || null,
+    publisherName: artifact.publisherName || null,
+    publisherUserId: artifact.publisherUserId || null,
     tags: artifact.tags,
     createdAt: artifact.createdAt,
     updatedAt: artifact.updatedAt,
@@ -1075,6 +1099,9 @@ function initializeSchema(db) {
       artifact_type TEXT NOT NULL DEFAULT 'document',
       schema_version INTEGER NOT NULL DEFAULT 1,
       source_agent TEXT NOT NULL,
+      publisher_id TEXT,
+      publisher_name TEXT,
+      publisher_user_id TEXT,
       tags_json TEXT NOT NULL,
       created_at TEXT NOT NULL,
       updated_at TEXT NOT NULL,
@@ -1152,11 +1179,118 @@ function initializeSchema(db) {
   ensureColumn(db, "artifacts", "artifact_type", "TEXT NOT NULL DEFAULT 'document'");
   ensureColumn(db, "artifacts", "schema_version", "INTEGER NOT NULL DEFAULT 1");
   ensureColumn(db, "artifacts", "archived_at", "TEXT");
+  ensureColumn(db, "artifacts", "publisher_id", "TEXT");
+  ensureColumn(db, "artifacts", "publisher_name", "TEXT");
+  ensureColumn(db, "artifacts", "publisher_user_id", "TEXT");
   ensureColumn(db, "users", "password_reset_required", "INTEGER NOT NULL DEFAULT 0");
+  db.exec("CREATE INDEX IF NOT EXISTS idx_artifacts_publisher_id ON artifacts(publisher_id)");
+  backfillArtifactPublishers(db);
   db.prepare("INSERT OR REPLACE INTO meta (key, value) VALUES ('store_version', ?)").run(String(STORE_VERSION));
   ensureSearchTable(db);
 }
 
+function backfillArtifactPublishers(db) {
+  const rows = db.prepare(`
+    SELECT
+      id,
+      publisher_id,
+      (
+        SELECT actor
+        FROM audit_log
+        WHERE audit_log.artifact_id = artifacts.id
+          AND action IN ('create', 'import')
+          AND actor IS NOT NULL
+          AND TRIM(actor) != ''
+        ORDER BY created_at ASC
+        LIMIT 1
+      ) AS actor
+    FROM artifacts
+    WHERE publisher_id IS NULL
+      OR TRIM(publisher_id) = ''
+      OR publisher_id LIKE 'curl/%'
+      OR publisher_id LIKE 'Wget/%'
+      OR publisher_id LIKE 'HTTPie/%'
+      OR publisher_id LIKE 'PostmanRuntime/%'
+      OR publisher_id LIKE 'undici%'
+      OR publisher_id LIKE 'node-fetch%'
+      OR publisher_id LIKE 'Mozilla/%'
+  `).all();
+
+  if (rows.length === 0) {
+    enrichPublisherUsers(db);
+    return;
+  }
+
+  const update = db.prepare(`
+    UPDATE artifacts
+    SET publisher_id = ?, publisher_name = ?, publisher_user_id = ?
+    WHERE id = ?
+  `);
+
+  transaction(db, () => {
+    for (const row of rows) {
+      const existingPublisherId = normalizeOptionalString(row.publisher_id);
+      if (existingPublisherId && !isLikelyUserAgentActor(existingPublisherId)) {
+        continue;
+      }
+      const actor = normalizeOptionalString(row.actor);
+      const publisher = publisherForActor(db, actor);
+      if (!publisher.publisherId && !existingPublisherId) {
+        continue;
+      }
+      update.run(publisher.publisherId, publisher.publisherName, publisher.publisherUserId, row.id);
+    }
+    enrichPublisherUsers(db);
+  });
+}
+
+function enrichPublisherUsers(db) {
+  db.prepare(`
+    UPDATE artifacts
+    SET
+      publisher_user_id = COALESCE(
+        publisher_user_id,
+        (SELECT id FROM users WHERE LOWER(users.email) = LOWER(artifacts.publisher_id) LIMIT 1)
+      ),
+      publisher_name = COALESCE(
+        NULLIF(publisher_name, ''),
+        (SELECT name FROM users WHERE LOWER(users.email) = LOWER(artifacts.publisher_id) LIMIT 1)
+      )
+    WHERE publisher_id IS NOT NULL AND TRIM(publisher_id) != ''
+  `).run();
+}
+
+function publisherForActor(db, actor) {
+  const publisherId = normalizeOptionalString(actor);
+  if (!publisherId || isLikelyUserAgentActor(publisherId)) {
+    return {
+      publisherId: null,
+      publisherName: null,
+      publisherUserId: null
+    };
+  }
+
+  const user = db.prepare("SELECT id, email, name FROM users WHERE LOWER(email) = LOWER(?)").get(publisherId);
+  return {
+    publisherId: user?.email || publisherId,
+    publisherName: user?.name || null,
+    publisherUserId: user?.id || null
+  };
+}
+
+function isLikelyUserAgentActor(value) {
+  if (/^(curl|Wget|HTTPie|PostmanRuntime)\//i.test(value)) {
+    return true;
+  }
+  if (/^(undici|node-fetch)(\/|$)/i.test(value)) {
+    return true;
+  }
+  if (value.length < 24) {
+    return false;
+  }
+  return /\b(Mozilla|AppleWebKit|Chrome|Safari|Firefox|Edg)\b/i.test(value);
+}
+
 function migrateJsonIndex(db, store) {
   if (!existsSync(store.indexPath)) {
     return;
@@ -1192,11 +1326,17 @@ function migrateJsonIndex(db, store) {
 
 function ensureSearchTable(db) {
   try {
+    const existing = db.prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'artifact_search'").get();
+    if (existing && !searchTableHasPublisherColumns(db)) {
+      db.exec("DROP TABLE artifact_search");
+    }
     db.exec(`
       CREATE VIRTUAL TABLE IF NOT EXISTS artifact_search USING fts5(
         artifact_id UNINDEXED,
         title,
         source_agent,
+        publisher_id,
+        publisher_name,
         artifact_type,
         tags,
         format,
@@ -1212,9 +1352,14 @@ function ensureSearchTable(db) {
   }
 }
 
+function searchTableHasPublisherColumns(db) {
+  const columns = db.prepare("PRAGMA table_info(artifact_search)").all().map((row) => row.name);
+  return columns.includes("publisher_id") && columns.includes("publisher_name");
+}
+
 function searchIndexAvailable(db) {
   const row = db.prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'artifact_search'").get();
-  return Boolean(row) || ensureSearchTable(db);
+  return (Boolean(row) && searchTableHasPublisherColumns(db)) || ensureSearchTable(db);
 }
 
 function syncSearchIndexIfEmpty(db, store) {
@@ -1280,17 +1425,23 @@ function upsertSearchIndex(db, artifact, version, content) {
   db.prepare("DELETE FROM artifact_search WHERE artifact_id = ?").run(artifact.id);
   db.prepare(`
     INSERT INTO artifact_search (
-      artifact_id, title, source_agent, artifact_type, tags, format, metadata, content
+      artifact_id, title, source_agent, publisher_id, publisher_name, artifact_type, tags, format, metadata, content
     )
-    VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
   `).run(
     artifact.id,
     artifact.title,
     artifact.sourceAgent,
+    artifact.publisherId || "",
+    artifact.publisherName || "",
     artifact.artifactType,
     artifact.tags.join(" "),
     version.format,
-    metadataSearchText(version.metadata),
+    metadataSearchText({
+      ...(version.metadata || {}),
+      publisherId: artifact.publisherId || undefined,
+      publisherName: artifact.publisherName || undefined
+    }),
     content
   );
 }
@@ -1321,7 +1472,7 @@ function listStoreFiles(root) {
 
 function loadArtifacts(db) {
   const rows = db.prepare(`
-    SELECT id, title, artifact_type, schema_version, source_agent, tags_json, created_at, updated_at, latest_version, archived_at
+    SELECT id, title, artifact_type, schema_version, source_agent, publisher_id, publisher_name, publisher_user_id, tags_json, created_at, updated_at, latest_version, archived_at
     FROM artifacts
     ORDER BY updated_at DESC, created_at DESC
   `).all();
@@ -1332,6 +1483,9 @@ function loadArtifacts(db) {
     artifactType: row.artifact_type,
     schemaVersion: row.schema_version,
     sourceAgent: row.source_agent,
+    publisherId: row.publisher_id || null,
+    publisherName: row.publisher_name || null,
+    publisherUserId: row.publisher_user_id || null,
     tags: parseJson(row.tags_json, []),
     createdAt: row.created_at,
     updatedAt: row.updated_at,
@@ -1352,7 +1506,7 @@ function loadVersions(db, artifactId) {
 
 function findArtifactById(db, id) {
   const row = db.prepare(`
-    SELECT id, title, artifact_type, schema_version, source_agent, tags_json, created_at, updated_at, latest_version, archived_at
+    SELECT id, title, artifact_type, schema_version, source_agent, publisher_id, publisher_name, publisher_user_id, tags_json, created_at, updated_at, latest_version, archived_at
     FROM artifacts
     WHERE id = ?
   `).get(id);
@@ -1370,6 +1524,9 @@ function findArtifactById(db, id) {
     artifactType: row.artifact_type,
     schemaVersion: row.schema_version,
     sourceAgent: row.source_agent,
+    publisherId: row.publisher_id || null,
+    publisherName: row.publisher_name || null,
+    publisherUserId: row.publisher_user_id || null,
     tags: parseJson(row.tags_json, []),
     createdAt: row.created_at,
     updatedAt: row.updated_at,
@@ -1382,15 +1539,18 @@ function findArtifactById(db, id) {
 function insertArtifactRecord(db, artifact) {
   db.prepare(`
     INSERT INTO artifacts (
-      id, title, artifact_type, schema_version, source_agent, tags_json, created_at, updated_at, latest_version, archived_at
+      id, title, artifact_type, schema_version, source_agent, publisher_id, publisher_name, publisher_user_id, tags_json, created_at, updated_at, latest_version, archived_at
     )
-    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
   `).run(
     artifact.id,
     artifact.title,
     normalizeArtifactType(artifact.artifactType || artifact.artifact_type || "document"),
     normalizeSchemaVersion(artifact.schemaVersion || artifact.schema_version),
     artifact.sourceAgent || artifact.source_agent || "unknown",
+    normalizeOptionalString(artifact.publisherId || artifact.publisher_id) || null,
+    normalizeOptionalString(artifact.publisherName || artifact.publisher_name) || null,
+    normalizeOptionalString(artifact.publisherUserId || artifact.publisher_user_id) || null,
     JSON.stringify(artifact.tags || []),
     artifact.createdAt || artifact.created_at,
     artifact.updatedAt || artifact.updated_at,

package/src/server.js

@@ -967,8 +967,9 @@ function auditContext(request, surface) {
   const auth = request.artifactyAuth;
   return {
     surface,
-    actor: auth?.actor || request.headers["x-artifacty-actor"] || request.headers["user-agent"] || "unknown",
+    actor: auth?.actor || request.headers["x-artifacty-actor"] || "unknown",
     userId: auth?.user?.id || null,
+    publisherName: auth?.user?.name || null,
     tokenId: auth?.tokenId || null
   };
 }
@@ -992,7 +993,7 @@ async function requireRequestAuth({ store, request, url, body = {}, config }) {
   if (!authRequired) {
     return {
       type: "anonymous",
-      actor: request.headers["x-artifacty-actor"] || request.headers["user-agent"] || "anonymous"
+      actor: request.headers["x-artifacty-actor"] || "anonymous"
     };
   }