artifacty 0.10.3 → 0.10.5

package/README.md

@@ -163,6 +163,11 @@ the payload explicitly identifies the agent through `agent` or `sourceAgent`.
 Plain Markdown from these agents stays a normal
 `document` unless you pass an explicit `artifactType`.
 
+When `format` is omitted, Artifacty infers common formats from filename,
+content type, and content. HTML files and HTML fragments such as
+`<section>...</section>` are stored as `html` so the browser viewer renders
+them as HTML instead of plain text.
+
 ## Agent Handoff Example
 
 One agent can publish a continuation artifact, then another agent can discover it, read the context, and append the next version.
@@ -318,6 +323,7 @@ Schema and storage:
 - Archive hides artifacts from default lists without deleting versions.
 - Bundle artifacts store multiple files or base64 assets as portable JSON.
 - Supported formats are `html`, `markdown`, `text`, `json`, `code`, `svg`, `mermaid`, `react`, `sarif`, `csv`, `image`, and `video`.
+- Native create/import paths infer `html` from HTML documents or fragments when no explicit format is supplied.
 - Diagram, component, source snippet, analysis report, table, and media assets use `diagram`, `component`, `snippet`, `analysis-report`, `table`, and `asset` artifact types.
 - Copilot/Cursor examples cover PR reviews, screenshots, demo recordings, and visual evidence bundles.
 - See [docs/artifact-schema-v1.md](docs/artifact-schema-v1.md).

package/docs/integrations.md

@@ -319,7 +319,7 @@ Supported converter inputs:
 - GitHub Copilot: markdown/text/json outputs; Artifacty-compatible JSON payloads; structured handoff, review, diff, and verification JSON payloads with `agent` or `sourceAgent` set to `github-copilot` or `copilot`.
 - Cursor: markdown/text/json outputs; Artifacty-compatible JSON payloads; structured handoff, review, diff, verification, screenshot, demo/video, and visual evidence bundle JSON payloads with `agent` or `sourceAgent` set to `cursor`.
 - Gemini: `returnDisplay`, `llmContent`, text blocks, or local markdown/text/json files.
-- Generic: file extension, content type, HTML doctype, JSON shape, media data URLs, and markdown headings are used to infer format and title.
+- Generic: file extension, content type, HTML doctype/fragments, JSON shape, media data URLs, and markdown headings are used to infer format and title. Generic `text/plain` uploads are upgraded to a more specific format, such as `html`, when filename or content makes that clear.
 
 The converter adds `imported` and source-agent tags, preserves the raw content as an immutable Artifacty version, and records source details under `metadata.artifactyImport`.
 

package/docs/network-sharing.md

@@ -44,9 +44,9 @@ When Artifacty binds outside loopback, startup output includes a warning that th
 
 ## Browser Write Behavior
 
-Remote browsers can read shared pages, but write actions are intentionally conservative. Mutating browser routes reject non-local `Origin` headers to reduce CSRF risk. For LAN sharing, prefer API or MCP writes with an explicit token header.
+Remote browsers can read shared pages and can submit browser forms when the request is same-origin with the Artifacty host, for example `Origin: http://10.0.0.50:8787` with `Host: 10.0.0.50:8787`. Mutating browser routes reject cross-origin requests to reduce CSRF risk. For scripts and agents, prefer API or MCP writes with an explicit token header.
 
-Do not relax the origin check just to make remote browser writes easier. A future team dashboard should use a dedicated policy that combines same-origin remote requests, explicit token validation, and clear operator intent.
+Do not disable the origin check just to make remote browser writes easier. Same-origin central dashboard writes should pass; writes initiated from another website should fail with `NON_LOCAL_ORIGIN`.
 
 ## Renderer Guidance
 

package/docs/threat-model.md

@@ -68,9 +68,10 @@ reachable from the user's browser.
 
 Controls:
 
-- Mutating browser routes reject non-local `Origin` headers.
+- Mutating browser routes allow loopback or same-origin requests and reject
+  cross-origin writes.
 - API routes require a token when configured.
-- LAN/team mode does not relax browser-origin checks.
+- LAN/team mode does not allow arbitrary browser origins.
 
 ### Untrusted Artifact Rendering
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "artifacty",
-  "version": "0.10.3",
+  "version": "0.10.5",
   "description": "Local artifact exchange for heterogeneous LLM agents via HTTP and MCP.",
   "type": "module",
   "keywords": [

package/src/lib/converters.js

@@ -36,7 +36,12 @@ export function convertAgentArtifact(input = {}) {
     optionalString(decoded.title) ||
     inferTitle({ content, format, fileName, sourceAgent });
 
-  const contentType = explicitContentType || decoded.contentType || media?.mimeType || contentTypeForFormat(format);
+  const contentType = resolvedContentType({
+    format,
+    explicitContentType,
+    decodedContentType: decoded.contentType,
+    mediaMimeType: media?.mimeType
+  });
   const artifactType = normalizeArtifactType(
     input.artifactType ||
       input.artifact_type ||
@@ -77,6 +82,14 @@ export function convertAgentArtifact(input = {}) {
   };
 }
 
+function resolvedContentType({ format, explicitContentType, decodedContentType, mediaMimeType }) {
+  const candidate = explicitContentType || decodedContentType || mediaMimeType;
+  if (candidate && !(isGenericTextContentType(candidate) && format !== "text")) {
+    return candidate;
+  }
+  return mediaMimeType || contentTypeForFormat(format);
+}
+
 export function detectFormat({ content = "", contentType = "", fileName = "" } = {}) {
   const type = optionalString(contentType).toLowerCase();
   if (type.includes("vnd.ant.code") || type.includes("source-code")) {
@@ -112,10 +125,6 @@ export function detectFormat({ content = "", contentType = "", fileName = "" } =
   if (type.includes("json")) {
     return "json";
   }
-  if (type.startsWith("text/")) {
-    return "text";
-  }
-
   const lowerName = optionalString(fileName).toLowerCase();
   if (lowerName.endsWith(".sarif") || lowerName.endsWith(".sarif.json")) {
     return "sarif";
@@ -172,7 +181,7 @@ export function detectFormat({ content = "", contentType = "", fileName = "" } =
   if (looksLikeMediaDataUrl(trimmed, "video")) {
     return "video";
   }
-  if (/^<!doctype html/i.test(trimmed) || /^<html[\s>]/i.test(trimmed)) {
+  if (looksLikeHtml(trimmed)) {
     return "html";
   }
   if (looksLikeSarif(trimmed)) {
@@ -187,6 +196,9 @@ export function detectFormat({ content = "", contentType = "", fileName = "" } =
   if (/^#{1,3}\s+\S/m.test(trimmed) || /^[-*]\s+\S/m.test(trimmed)) {
     return "markdown";
   }
+  if (type.startsWith("text/")) {
+    return "text";
+  }
   return "text";
 }
 
@@ -1175,6 +1187,19 @@ function isSarifObject(value) {
     (typeof value.version === "string" || optionalString(value.$schema).toLowerCase().includes("sarif"));
 }
 
+function looksLikeHtml(value) {
+  const trimmed = optionalString(value);
+  if (/^<!doctype html/i.test(trimmed) || /^<html[\s>]/i.test(trimmed)) {
+    return true;
+  }
+  const withoutLeadingComment = trimmed.replace(/^<!--[\s\S]*?-->\s*/, "");
+  return htmlTagPattern().test(withoutLeadingComment);
+}
+
+function htmlTagPattern() {
+  return /^<\/?(?:a|article|aside|body|br|button|canvas|code|div|fieldset|figcaption|figure|footer|form|h[1-6]|head|header|hr|iframe|img|input|label|li|link|main|meta|nav|ol|option|p|pre|script|section|select|span|style|table|tbody|td|textarea|tfoot|th|thead|title|tr|ul|video|audio)(?:\s|>|\/)/i;
+}
+
 function looksLikeCsv(value) {
   const lines = optionalString(value)
     .split(/\r?\n/)
@@ -1307,6 +1332,10 @@ function isSupportedVideoMime(value) {
   return new Set(["video/mp4", "video/webm"]).has(optionalString(value).toLowerCase().split(";")[0]);
 }
 
+function isGenericTextContentType(value) {
+  return optionalString(value).toLowerCase().split(";")[0] === "text/plain";
+}
+
 function looksLikeMermaid(value) {
   const firstMeaningfulLine = optionalString(value)
     .split(/\r?\n/)

package/src/lib/storage.js

@@ -1721,7 +1721,7 @@ function normalizeArtifactInput(input, options) {
   return {
     title,
     content,
-    format: normalizeFormat(input.format || inferFormat(input.contentType)),
+    format: normalizeFormat(input.format || inferFormat(input.contentType, content)),
     contentType: normalizeOptionalString(input.contentType),
     artifactType: normalizeArtifactType(input.artifactType || input.artifact_type || inferArtifactType(input)),
     schemaVersion: normalizeSchemaVersion(input.schemaVersion || input.schema_version),
@@ -1758,9 +1758,9 @@ function normalizeSchemaVersion(value) {
 function inferArtifactType(input) {
   let format;
   try {
-    format = normalizeFormat(input.format || inferFormat(input.contentType));
+    format = normalizeFormat(input.format || inferFormat(input.contentType, input.content));
   } catch {
-    format = normalizeOptionalString(input.format || inferFormat(input.contentType));
+    format = normalizeOptionalString(input.format || inferFormat(input.contentType, input.content));
   }
   if (format === "html") {
     return "html-page";
@@ -2011,7 +2011,7 @@ function verifyPassword(password, stored) {
   return actualBuffer.length === expectedBuffer.length && timingSafeEqual(actualBuffer, expectedBuffer);
 }
 
-function inferFormat(contentType) {
+function inferFormat(contentType, content = "") {
   const value = normalizeOptionalString(contentType).toLowerCase();
   if (value.includes("vnd.ant.code") || value.includes("source-code")) {
     return "code";
@@ -2046,9 +2046,21 @@ function inferFormat(contentType) {
   if (value.includes("json")) {
     return "json";
   }
+  const trimmed = normalizeOptionalString(content);
+  if (looksLikeHtml(trimmed)) {
+    return "html";
+  }
   return "text";
 }
 
+function looksLikeHtml(value) {
+  if (/^<!doctype html/i.test(value) || /^<html[\s>]/i.test(value)) {
+    return true;
+  }
+  const withoutLeadingComment = value.replace(/^<!--[\s\S]*?-->\s*/, "");
+  return /^<\/?(?:a|article|aside|body|br|button|canvas|code|div|fieldset|figcaption|figure|footer|form|h[1-6]|head|header|hr|iframe|img|input|label|li|link|main|meta|nav|ol|option|p|pre|script|section|select|span|style|table|tbody|td|textarea|tfoot|th|thead|title|tr|ul|video|audio)(?:\s|>|\/)/i.test(withoutLeadingComment);
+}
+
 function makeArtifactId(title) {
   const slug = title
     .toLowerCase()

package/src/server.js

@@ -816,11 +816,25 @@ export function assertLocalOrigin(request) {
     return;
   }
 
-  const parsed = new URL(origin);
+  let parsed;
+  try {
+    parsed = new URL(origin);
+  } catch {
+    throw Object.assign(new Error(`Rejected invalid origin: ${origin}`), {
+      statusCode: 403,
+      code: "NON_LOCAL_ORIGIN"
+    });
+  }
+
   const hostname = parsed.hostname.toLowerCase();
-  const allowed = hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1";
+  const host = String(request.headers.host || "").toLowerCase();
+  const allowed =
+    hostname === "localhost" ||
+    hostname === "127.0.0.1" ||
+    hostname === "::1" ||
+    (host && parsed.host.toLowerCase() === host && (parsed.protocol === "http:" || parsed.protocol === "https:"));
   if (!allowed) {
-    throw Object.assign(new Error(`Rejected non-local origin: ${origin}`), {
+    throw Object.assign(new Error(`Rejected untrusted origin: ${origin}`), {
       statusCode: 403,
       code: "NON_LOCAL_ORIGIN"
     });