artifacty 0.10.4 → 0.10.6

package/README.md

@@ -163,6 +163,11 @@ the payload explicitly identifies the agent through `agent` or `sourceAgent`.
 Plain Markdown from these agents stays a normal
 `document` unless you pass an explicit `artifactType`.
 
+When `format` is omitted, Artifacty infers common formats from filename,
+content type, and content. HTML files and HTML fragments such as
+`<section>...</section>` are stored as `html` so the browser viewer renders
+them as HTML instead of plain text.
+
 ## Agent Handoff Example
 
 One agent can publish a continuation artifact, then another agent can discover it, read the context, and append the next version.
@@ -247,7 +252,7 @@ By default Artifacty stores files under `~/.artifacty`.
 ARTIFACTY_HOME=/path/to/shared/store artifacty serve
 ```
 
-Artifact metadata is stored in `artifacty.sqlite`; artifact content is stored as immutable version files under `artifacts/`. The current browser server URL is written to `server.json` so MCP tools can return the correct links when the default port falls back. Existing `index.json` stores are migrated automatically on first access.
+Artifact metadata is stored in `artifacty.sqlite`; artifact content is stored as append-only version files under `artifacts/` for normal create and update flows. Administrators can repair or delete individual bad versions from the browser, and those exceptional actions are recorded in the audit log. The current browser server URL is written to `server.json` so MCP tools can return the correct links when the default port falls back. Existing `index.json` stores are migrated automatically on first access.
 
 Search uses a SQLite FTS5 index when the local Node SQLite build supports it. The index covers the latest version body plus title, tags, source agent, artifact type, format, and metadata summary. If FTS5 is unavailable, Artifacty keeps working with metadata search. Rebuild or check the store when needed:
 
@@ -297,8 +302,9 @@ Browser routes:
 - `/`: list artifacts with search, tag, and source filters.
 - `/new`: create an Artifacty-native artifact with the CodeMirror editor.
 - `/import`: paste an external agent artifact and convert it with automatic editor mode detection.
-- `/artifacts/:id/edit`: save a new version with Markdown, HTML, JSON, text, code, SVG, Mermaid, React, SARIF, CSV, image, or video syntax support.
+- `/artifacts/:id/edit`: save a new version with Markdown, HTML, JSON, text, code, SVG, Mermaid, React, SARIF, CSV, image, or video syntax support. Browser edits that do not change the artifact are recorded as `update-noop` audit events without creating a version.
 - `/artifacts/:id/diff`: compare versions.
+- `/admin/artifacts/:id/versions`: administrator-only repair/delete screen for individual versions.
 - `/api/audit`: list audit events.
 
 List APIs support pagination with `limit` and `offset`. Responses keep the top-level `artifacts` array and include `pagination` and `search` metadata:
@@ -315,9 +321,10 @@ The browser UI defaults to English. Add `?lang=ko` to any browser route to use K
 Schema and storage:
 
 - Metadata lives in SQLite with `schemaVersion: 1`, `artifactType`, `publisherId`, and `archivedAt`.
-- Archive hides artifacts from default lists without deleting versions.
+- Archive hides artifacts from default lists without deleting versions. Admin version repair/delete is available for correcting accidental or sensitive historical versions and records `version-repair` or `version-delete` audit events.
 - Bundle artifacts store multiple files or base64 assets as portable JSON.
 - Supported formats are `html`, `markdown`, `text`, `json`, `code`, `svg`, `mermaid`, `react`, `sarif`, `csv`, `image`, and `video`.
+- Native create/import paths infer `html` from HTML documents or fragments when no explicit format is supplied.
 - Diagram, component, source snippet, analysis report, table, and media assets use `diagram`, `component`, `snippet`, `analysis-report`, `table`, and `asset` artifact types.
 - Copilot/Cursor examples cover PR reviews, screenshots, demo recordings, and visual evidence bundles.
 - See [docs/artifact-schema-v1.md](docs/artifact-schema-v1.md).
@@ -335,7 +342,7 @@ Schema and storage:
 - Non-local sharing is intended for trusted LAN or VPN sessions. Prefer a specific interface IP over `0.0.0.0`, keep React rendering disabled, and see [docs/network-sharing.md](docs/network-sharing.md).
 - Non-local binding prints a startup warning because Artifacty does not terminate TLS.
 - Artifact content is scanned for common API keys and private keys before storage. Use `--allow-secrets` or `ARTIFACTY_ALLOW_SECRETS=true` only for intentional exceptions.
-- Creates, updates, reads, imports, archives, and restores write audit events to SQLite. Legacy artifacts without a stored publisher are best-effort backfilled from their first `create` or `import` audit actor.
+- Creates, updates, reads, imports, archives, restores, no-op browser edits, and admin version repair/delete actions write audit events to SQLite. Legacy artifacts without a stored publisher are best-effort backfilled from their first `create` or `import` audit actor.
 - CodeMirror editor/viewer and renderer assets are served from local npm dependencies through a package allowlist, not from a public CDN. JavaScript asset routes answer `Origin: null` requests with `Access-Control-Allow-Origin: null` so sandboxed renderer iframes can import local ESM without `allow-same-origin`.
 - Mutating HTTP routes reject non-local browser origins.
 - HTML artifacts render in a sandboxed iframe.

package/docs/artifact-schema-v1.md

@@ -53,7 +53,10 @@ best-effort backfilled from the first `create` or `import` audit actor.
 
 ## Version Record
 
-Each version is immutable and points at one content file.
+Normal create and update flows append versions, and each version points at one
+content file. Administrator repair/delete actions are exceptional maintenance
+operations for correcting accidental or sensitive historical versions; they
+write `version-repair` or `version-delete` audit events.
 
 ```json
 {
@@ -115,7 +118,7 @@ Metadata is free-form JSON, but converter-generated metadata uses these keys:
 
 ## Archive Semantics
 
-Artifacts are not deleted by P0 behavior. Archive sets `archivedAt` and hides the artifact from default list results. `includeArchived=true` includes archived records. Restore clears `archivedAt`. Versions and content files remain unchanged.
+Artifacts are not deleted by P0 behavior. Archive sets `archivedAt` and hides the artifact from default list results. `includeArchived=true` includes archived records. Restore clears `archivedAt`. Regular archive/restore leaves versions and content files unchanged. Administrators may repair or delete individual versions from `/admin/artifacts/:id/versions`; the last remaining version cannot be deleted.
 
 ## Bundle Format
 

package/docs/integrations.md

@@ -319,7 +319,7 @@ Supported converter inputs:
 - GitHub Copilot: markdown/text/json outputs; Artifacty-compatible JSON payloads; structured handoff, review, diff, and verification JSON payloads with `agent` or `sourceAgent` set to `github-copilot` or `copilot`.
 - Cursor: markdown/text/json outputs; Artifacty-compatible JSON payloads; structured handoff, review, diff, verification, screenshot, demo/video, and visual evidence bundle JSON payloads with `agent` or `sourceAgent` set to `cursor`.
 - Gemini: `returnDisplay`, `llmContent`, text blocks, or local markdown/text/json files.
-- Generic: file extension, content type, HTML doctype, JSON shape, media data URLs, and markdown headings are used to infer format and title.
+- Generic: file extension, content type, HTML doctype/fragments, JSON shape, media data URLs, and markdown headings are used to infer format and title. Generic `text/plain` uploads are upgraded to a more specific format, such as `html`, when filename or content makes that clear.
 
 The converter adds `imported` and source-agent tags, preserves the raw content as an immutable Artifacty version, and records source details under `metadata.artifactyImport`.
 
@@ -347,11 +347,14 @@ tests.
 - `GET /artifacts/:id`: browser viewer.
 - `GET /artifacts/:id/react-frame?version=n`: gated React renderer frame. Returns content only when `ARTIFACTY_ENABLE_REACT_RENDERER=true`.
 - `GET /artifacts/:id/edit`: browser version editor.
-- `POST /artifacts/:id/edit`: append a version from the browser editor.
+- `POST /artifacts/:id/edit`: append a version from the browser editor. Unchanged browser edits record `update-noop` without creating another version.
 - `POST /artifacts/:id/archive`: archive from the browser.
 - `POST /artifacts/:id/restore`: restore from the browser.
 - `GET /artifacts/:id/diff`: compare two versions.
 - `GET /artifacts/:id/raw?version=n`: raw content.
+- `GET /admin/artifacts/:id/versions`: administrator-only version repair/delete screen.
+- `POST /admin/artifacts/:id/versions/:version/repair`: administrator-only replacement of one version's content and format.
+- `POST /admin/artifacts/:id/versions/:version/delete`: administrator-only deletion of one version. The last remaining version cannot be deleted.
 
 When `ARTIFACTY_API_TOKEN` is configured, `/api/*` routes require either `Authorization: Bearer <token>` or `x-artifacty-token: <token>`. When users exist, personal tokens issued from `/account` also authenticate API and MCP requests, set created artifacts' `publisherId` to the token owner's email, and map audit `actor` to the same identity. Browser forms can also carry `?token=<token>` in the URL, which is copied to hidden form fields for local team workflows.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "artifacty",
-  "version": "0.10.4",
+  "version": "0.10.6",
   "description": "Local artifact exchange for heterogeneous LLM agents via HTTP and MCP.",
   "type": "module",
   "keywords": [

package/src/lib/converters.js

@@ -36,7 +36,12 @@ export function convertAgentArtifact(input = {}) {
     optionalString(decoded.title) ||
     inferTitle({ content, format, fileName, sourceAgent });
 
-  const contentType = explicitContentType || decoded.contentType || media?.mimeType || contentTypeForFormat(format);
+  const contentType = resolvedContentType({
+    format,
+    explicitContentType,
+    decodedContentType: decoded.contentType,
+    mediaMimeType: media?.mimeType
+  });
   const artifactType = normalizeArtifactType(
     input.artifactType ||
       input.artifact_type ||
@@ -77,6 +82,14 @@ export function convertAgentArtifact(input = {}) {
   };
 }
 
+function resolvedContentType({ format, explicitContentType, decodedContentType, mediaMimeType }) {
+  const candidate = explicitContentType || decodedContentType || mediaMimeType;
+  if (candidate && !(isGenericTextContentType(candidate) && format !== "text")) {
+    return candidate;
+  }
+  return mediaMimeType || contentTypeForFormat(format);
+}
+
 export function detectFormat({ content = "", contentType = "", fileName = "" } = {}) {
   const type = optionalString(contentType).toLowerCase();
   if (type.includes("vnd.ant.code") || type.includes("source-code")) {
@@ -112,10 +125,6 @@ export function detectFormat({ content = "", contentType = "", fileName = "" } =
   if (type.includes("json")) {
     return "json";
   }
-  if (type.startsWith("text/")) {
-    return "text";
-  }
-
   const lowerName = optionalString(fileName).toLowerCase();
   if (lowerName.endsWith(".sarif") || lowerName.endsWith(".sarif.json")) {
     return "sarif";
@@ -172,7 +181,7 @@ export function detectFormat({ content = "", contentType = "", fileName = "" } =
   if (looksLikeMediaDataUrl(trimmed, "video")) {
     return "video";
   }
-  if (/^<!doctype html/i.test(trimmed) || /^<html[\s>]/i.test(trimmed)) {
+  if (looksLikeHtml(trimmed)) {
     return "html";
   }
   if (looksLikeSarif(trimmed)) {
@@ -187,6 +196,9 @@ export function detectFormat({ content = "", contentType = "", fileName = "" } =
   if (/^#{1,3}\s+\S/m.test(trimmed) || /^[-*]\s+\S/m.test(trimmed)) {
     return "markdown";
   }
+  if (type.startsWith("text/")) {
+    return "text";
+  }
   return "text";
 }
 
@@ -1175,6 +1187,19 @@ function isSarifObject(value) {
     (typeof value.version === "string" || optionalString(value.$schema).toLowerCase().includes("sarif"));
 }
 
+function looksLikeHtml(value) {
+  const trimmed = optionalString(value);
+  if (/^<!doctype html/i.test(trimmed) || /^<html[\s>]/i.test(trimmed)) {
+    return true;
+  }
+  const withoutLeadingComment = trimmed.replace(/^<!--[\s\S]*?-->\s*/, "");
+  return htmlTagPattern().test(withoutLeadingComment);
+}
+
+function htmlTagPattern() {
+  return /^<\/?(?:a|article|aside|body|br|button|canvas|code|div|fieldset|figcaption|figure|footer|form|h[1-6]|head|header|hr|iframe|img|input|label|li|link|main|meta|nav|ol|option|p|pre|script|section|select|span|style|table|tbody|td|textarea|tfoot|th|thead|title|tr|ul|video|audio)(?:\s|>|\/)/i;
+}
+
 function looksLikeCsv(value) {
   const lines = optionalString(value)
     .split(/\r?\n/)
@@ -1307,6 +1332,10 @@ function isSupportedVideoMime(value) {
   return new Set(["video/mp4", "video/webm"]).has(optionalString(value).toLowerCase().split(";")[0]);
 }
 
+function isGenericTextContentType(value) {
+  return optionalString(value).toLowerCase().split(";")[0] === "text/plain";
+}
+
 function looksLikeMermaid(value) {
   const firstMeaningfulLine = optionalString(value)
     .split(/\r?\n/)

package/src/lib/render.js

@@ -189,6 +189,83 @@ export function renderNewArtifactPage({ baseUrl, authToken = "", locale = DEFAUL
   return renderArtifactFormPage({ mode: "new", baseUrl, authToken, locale, currentPath });
 }
 
+export function renderAdminArtifactVersionsPage({ artifact, selectedVersion, content, baseUrl, user, error = "", locale = DEFAULT_LOCALE, currentPath = "/" }) {
+  const view = viewContext(locale, currentPath);
+  const artifactPath = `/artifacts/${encodeURIComponent(artifact.id)}`;
+  const versionRows = artifact.versions.map((version) => {
+    const active = version.version === selectedVersion.version ? " active" : "";
+    const deleteDisabled = artifact.versions.length <= 1 ? " disabled" : "";
+    return `
+      <tr>
+        <td><a class="version${active}" href="${view.href(`/admin/artifacts/${encodeURIComponent(artifact.id)}/versions?version=${version.version}`)}">v${version.version}</a></td>
+        <td>${formatBadge(version.format)}</td>
+        <td>${escapeHtml(version.createdAt)}</td>
+        <td><code>${escapeHtml(version.sha256.slice(0, 12))}</code></td>
+        <td>${escapeHtml(String(version.sizeBytes))}</td>
+        <td>
+          <form class="inline-action" method="post" action="/admin/artifacts/${encodeURIComponent(artifact.id)}/versions/${version.version}/delete">
+            ${localeInput(view.locale)}
+            <input name="reason" placeholder="Reason">
+            <button type="submit"${deleteDisabled}>Delete</button>
+          </form>
+        </td>
+      </tr>
+    `;
+  }).join("");
+
+  return pageShell({
+    title: `Manage versions · ${artifact.title}`,
+    body: `
+      <header class="topbar">
+        <div>
+          <h1>Manage versions</h1>
+          <p>${escapeHtml(artifact.title)} · ${escapeHtml(artifact.id)} · ${escapeHtml(baseUrl)}</p>
+        </div>
+        <nav>
+          <a href="${view.href(artifactPath)}">Artifact</a>
+          <a href="${view.href(`${artifactPath}/diff`)}">${view.text("nav.diff")}</a>
+          ${authNav(user)}
+          ${languageSwitcher(view)}
+        </nav>
+      </header>
+      <main class="artifact-editor">
+        ${error ? `<p class="auth-error">${escapeHtml(error)}</p>` : ""}
+        <section class="meta-card">
+          <h2>Versions</h2>
+          <table class="data-table">
+            <thead><tr><th>Version</th><th>Format</th><th>Created</th><th>SHA</th><th>Bytes</th><th>Action</th></tr></thead>
+            <tbody>${versionRows}</tbody>
+          </table>
+        </section>
+        <form class="editor-form" method="post" action="/admin/artifacts/${encodeURIComponent(artifact.id)}/versions/${selectedVersion.version}/repair">
+          ${localeInput(view.locale)}
+          <section class="editor-fields">
+            <label class="field">
+              <span>${view.text("form.format")}</span>
+              ${formatSelect(selectedVersion.format)}
+            </label>
+            <label class="field">
+              <span>Reason</span>
+              <input name="reason" value="" autocomplete="off">
+            </label>
+          </section>
+          <section class="field content-field">
+            <label for="artifact-content">v${selectedVersion.version} content</label>
+            <textarea id="artifact-content" name="content" data-artifacty-editor data-editor-format="${escapeAttribute(selectedVersion.format)}" spellcheck="false" required>${escapeHtml(content)}</textarea>
+          </section>
+          <footer class="editor-actions">
+            <a href="${view.href(`${artifactPath}?version=${selectedVersion.version}`)}">View version</a>
+            <button type="submit">Repair version</button>
+          </footer>
+        </form>
+      </main>
+    `,
+    head: editorHead(),
+    afterBody: editorScript(view.locale),
+    locale: view.locale
+  });
+}
+
 export function renderImportArtifactPage({ baseUrl, authToken = "", locale = DEFAULT_LOCALE, currentPath = "/import" }) {
   const view = viewContext(locale, currentPath);
   const title = view.raw("form.importTitle");
@@ -509,7 +586,7 @@ export function renderAdminUsersPage({ baseUrl, user, users = [], importResult =
   });
 }
 
-export function renderArtifactPage({ artifact, version, content, baseUrl, authToken = "", locale = DEFAULT_LOCALE, currentPath = "/" }) {
+export function renderArtifactPage({ artifact, version, content, baseUrl, authToken = "", locale = DEFAULT_LOCALE, currentPath = "/", user = null }) {
   const view = viewContext(locale, currentPath);
   const versionLinks = artifact.versions
     .map((item) => {
@@ -543,7 +620,9 @@ export function renderArtifactPage({ artifact, version, content, baseUrl, authTo
           <a href="${view.href("/")}">${view.text("nav.index")}</a>
           <a href="${view.href(`/artifacts/${encodeURIComponent(artifact.id)}/edit`)}">${view.text("nav.edit")}</a>
           <a href="${view.href(`/artifacts/${encodeURIComponent(artifact.id)}/diff`)}">${view.text("nav.diff")}</a>
+          ${user?.role === "admin" ? `<a href="${view.href(`/admin/artifacts/${encodeURIComponent(artifact.id)}/versions`)}">Versions</a>` : ""}
           <a href="${view.href(rawUrl)}">${view.text("nav.raw")}</a>
+          ${authNav(user)}
           ${languageSwitcher(view)}
         </nav>
       </header>

package/src/lib/storage.js

@@ -1,5 +1,5 @@
 import { createHash, randomBytes, randomUUID, scryptSync, timingSafeEqual } from "node:crypto";
-import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, statSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { readFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import path from "node:path";
@@ -189,6 +189,21 @@ export async function updateArtifact(store = createStore(), id, input = {}) {
     let artifact;
     transaction(db, () => {
       artifact = findArtifactById(db, id);
+      const latest = artifact.versions.find((version) => version.version === artifact.latestVersion);
+      if (input.skipNoop && latest) {
+        const latestContent = readFileSync(path.join(store.home, latest.path), "utf8");
+        if (isNoopVersionUpdate(artifact, latest, latestContent, normalized)) {
+          insertAuditRecord(db, {
+            action: "update-noop",
+            artifactId: artifact.id,
+            version: artifact.latestVersion,
+            sourceAgent: artifact.sourceAgent,
+            audit: input.audit,
+            metadata: { reason: "no changes detected" }
+          });
+          return;
+        }
+      }
       const now = new Date().toISOString();
       const nextVersion = artifact.latestVersion + 1;
       const version = writeVersionFile(store, artifact.id, nextVersion, normalized, now);
@@ -234,6 +249,159 @@ export async function updateArtifact(store = createStore(), id, input = {}) {
   }
 }
 
+export async function replaceArtifactVersion(store = createStore(), id, versionNumber, input = {}) {
+  const secretScan = assertNoSecrets(input, securityConfig());
+  input = withSecretScan(input, secretScan);
+  const normalized = normalizeArtifactInput(input, { requireContent: true, requireTitle: false });
+  const targetVersion = Number(versionNumber);
+  if (!Number.isInteger(targetVersion) || targetVersion < 1) {
+    throw Object.assign(new Error(`Invalid artifact version: ${versionNumber}`), {
+      code: "INVALID_VERSION",
+      statusCode: 400
+    });
+  }
+  const db = openDatabase(store);
+
+  try {
+    let artifact;
+    transaction(db, () => {
+      artifact = findArtifactById(db, id);
+      const existing = artifact.versions.find((version) => version.version === targetVersion);
+      if (!existing) {
+        throw Object.assign(new Error(`Artifact version not found: ${id}@${targetVersion}`), {
+          code: "ARTIFACT_VERSION_NOT_FOUND",
+          statusCode: 404
+        });
+      }
+
+      const now = new Date().toISOString();
+      const previousPath = existing.path;
+      const repairedMetadata = {
+        ...existing.metadata,
+        ...normalized.metadata,
+        adminRepair: {
+          repairedAt: now,
+          reason: normalizeOptionalString(input.reason),
+          previousSha256: existing.sha256,
+          previousSizeBytes: existing.sizeBytes,
+          previousPath
+        }
+      };
+      const replacement = writeVersionFile(store, artifact.id, targetVersion, {
+        ...normalized,
+        metadata: repairedMetadata
+      }, existing.createdAt);
+
+      if (previousPath !== replacement.path) {
+        removeVersionFile(store, previousPath);
+      }
+
+      db.prepare(`
+        UPDATE artifact_versions
+        SET created_at = ?, format = ?, content_type = ?, path = ?, size_bytes = ?, sha256 = ?, metadata_json = ?
+        WHERE artifact_id = ? AND version = ?
+      `).run(
+        replacement.createdAt,
+        replacement.format,
+        replacement.contentType,
+        replacement.path,
+        replacement.sizeBytes,
+        replacement.sha256,
+        JSON.stringify(replacement.metadata || {}),
+        artifact.id,
+        targetVersion
+      );
+
+      artifact.versions = artifact.versions.map((version) => version.version === targetVersion ? replacement : version);
+      artifact.updatedAt = now;
+      db.prepare("UPDATE artifacts SET updated_at = ? WHERE id = ?").run(now, artifact.id);
+      if (targetVersion === artifact.latestVersion) {
+        upsertSearchIndex(db, artifact, replacement, normalized.content);
+      }
+      insertAuditRecord(db, {
+        action: "version-repair",
+        artifactId: artifact.id,
+        version: targetVersion,
+        sourceAgent: artifact.sourceAgent,
+        audit: input.audit,
+        metadata: {
+          reason: normalizeOptionalString(input.reason),
+          previousSha256: existing.sha256,
+          newSha256: replacement.sha256,
+          previousPath
+        }
+      });
+    });
+
+    return getArtifact(store, id, { version: targetVersion });
+  } finally {
+    db.close();
+  }
+}
+
+export async function deleteArtifactVersion(store = createStore(), id, versionNumber, options = {}) {
+  const targetVersion = Number(versionNumber);
+  if (!Number.isInteger(targetVersion) || targetVersion < 1) {
+    throw Object.assign(new Error(`Invalid artifact version: ${versionNumber}`), {
+      code: "INVALID_VERSION",
+      statusCode: 400
+    });
+  }
+  const db = openDatabase(store);
+
+  try {
+    let artifact;
+    transaction(db, () => {
+      artifact = findArtifactById(db, id);
+      if (artifact.versions.length <= 1) {
+        throw Object.assign(new Error("Cannot delete the only version of an artifact"), {
+          code: "ONLY_VERSION_DELETE_BLOCKED",
+          statusCode: 400
+        });
+      }
+      const existing = artifact.versions.find((version) => version.version === targetVersion);
+      if (!existing) {
+        throw Object.assign(new Error(`Artifact version not found: ${id}@${targetVersion}`), {
+          code: "ARTIFACT_VERSION_NOT_FOUND",
+          statusCode: 404
+        });
+      }
+
+      const now = new Date().toISOString();
+      db.prepare("DELETE FROM artifact_versions WHERE artifact_id = ? AND version = ?").run(artifact.id, targetVersion);
+      removeVersionFile(store, existing.path);
+      artifact.versions = artifact.versions.filter((version) => version.version !== targetVersion);
+      artifact.latestVersion = Math.max(...artifact.versions.map((version) => version.version));
+      artifact.updatedAt = now;
+      db.prepare("UPDATE artifacts SET latest_version = ?, updated_at = ? WHERE id = ?").run(
+        artifact.latestVersion,
+        now,
+        artifact.id
+      );
+
+      const latest = artifact.versions.find((version) => version.version === artifact.latestVersion);
+      const latestContent = readFileSync(path.join(store.home, latest.path), "utf8");
+      upsertSearchIndex(db, artifact, latest, latestContent);
+      insertAuditRecord(db, {
+        action: "version-delete",
+        artifactId: artifact.id,
+        version: targetVersion,
+        sourceAgent: artifact.sourceAgent,
+        audit: options.audit,
+        metadata: {
+          reason: normalizeOptionalString(options.reason),
+          deletedSha256: existing.sha256,
+          deletedPath: existing.path
+        }
+      });
+    });
+
+    return withLatestContent(store, artifact);
+  } finally {
+    db.close();
+  }
+}
+
 export async function archiveArtifact(store = createStore(), id, options = {}) {
   const db = openDatabase(store);
   try {
@@ -1691,6 +1859,38 @@ function writeVersionFile(store, id, versionNumber, input, createdAt) {
   };
 }
 
+function removeVersionFile(store, relativePath) {
+  const absolutePath = path.join(store.home, relativePath);
+  if (existsSync(absolutePath)) {
+    rmSync(absolutePath, { force: true });
+  }
+}
+
+function isNoopVersionUpdate(artifact, latest, latestContent, normalized) {
+  const nextTitle = normalized.title || artifact.title;
+  const nextSourceAgent = normalized.sourceAgent || artifact.sourceAgent;
+  const nextArtifactType = normalized.artifactType || artifact.artifactType;
+  const nextSchemaVersion = normalized.schemaVersion || artifact.schemaVersion;
+  const nextTags = normalized.tags.length > 0 ? normalized.tags : artifact.tags;
+  const nextContentType = normalized.contentType || contentTypeForFormat(normalized.format);
+
+  return nextTitle === artifact.title &&
+    nextSourceAgent === artifact.sourceAgent &&
+    nextArtifactType === artifact.artifactType &&
+    nextSchemaVersion === artifact.schemaVersion &&
+    tagsEqual(nextTags, artifact.tags) &&
+    normalized.content === latestContent &&
+    normalized.format === latest.format &&
+    nextContentType === latest.contentType;
+}
+
+function tagsEqual(left = [], right = []) {
+  if (left.length !== right.length) {
+    return false;
+  }
+  return left.every((item, index) => item === right[index]);
+}
+
 async function withLatestContent(store, artifact) {
   const latest = await readArtifactVersion(store, artifact, artifact.latestVersion);
   return {
@@ -1721,7 +1921,7 @@ function normalizeArtifactInput(input, options) {
   return {
     title,
     content,
-    format: normalizeFormat(input.format || inferFormat(input.contentType)),
+    format: normalizeFormat(input.format || inferFormat(input.contentType, content)),
     contentType: normalizeOptionalString(input.contentType),
     artifactType: normalizeArtifactType(input.artifactType || input.artifact_type || inferArtifactType(input)),
     schemaVersion: normalizeSchemaVersion(input.schemaVersion || input.schema_version),
@@ -1758,9 +1958,9 @@ function normalizeSchemaVersion(value) {
 function inferArtifactType(input) {
   let format;
   try {
-    format = normalizeFormat(input.format || inferFormat(input.contentType));
+    format = normalizeFormat(input.format || inferFormat(input.contentType, input.content));
   } catch {
-    format = normalizeOptionalString(input.format || inferFormat(input.contentType));
+    format = normalizeOptionalString(input.format || inferFormat(input.contentType, input.content));
   }
   if (format === "html") {
     return "html-page";
@@ -2011,7 +2211,7 @@ function verifyPassword(password, stored) {
   return actualBuffer.length === expectedBuffer.length && timingSafeEqual(actualBuffer, expectedBuffer);
 }
 
-function inferFormat(contentType) {
+function inferFormat(contentType, content = "") {
   const value = normalizeOptionalString(contentType).toLowerCase();
   if (value.includes("vnd.ant.code") || value.includes("source-code")) {
     return "code";
@@ -2046,9 +2246,21 @@ function inferFormat(contentType) {
   if (value.includes("json")) {
     return "json";
   }
+  const trimmed = normalizeOptionalString(content);
+  if (looksLikeHtml(trimmed)) {
+    return "html";
+  }
   return "text";
 }
 
+function looksLikeHtml(value) {
+  if (/^<!doctype html/i.test(value) || /^<html[\s>]/i.test(value)) {
+    return true;
+  }
+  const withoutLeadingComment = value.replace(/^<!--[\s\S]*?-->\s*/, "");
+  return /^<\/?(?:a|article|aside|body|br|button|canvas|code|div|fieldset|figcaption|figure|footer|form|h[1-6]|head|header|hr|iframe|img|input|label|li|link|main|meta|nav|ol|option|p|pre|script|section|select|span|style|table|tbody|td|textarea|tfoot|th|thead|title|tr|ul|video|audio)(?:\s|>|\/)/i.test(withoutLeadingComment);
+}
+
 function makeArtifactId(title) {
   const slug = title
     .toLowerCase()

package/src/server.js

@@ -14,6 +14,7 @@ import {
   createSession,
   createStore,
   createUser,
+  deleteArtifactVersion,
   getArtifact,
   getSessionUser,
   importUsersFromCsv,
@@ -25,6 +26,7 @@ import {
   revokeApiToken,
   revokeSession,
   restoreArtifact,
+  replaceArtifactVersion,
   setUserActive,
   updateArtifact,
   verifyUserPassword
@@ -41,6 +43,7 @@ import {
   renderArtifactFormPage,
   renderArtifactPage,
   renderAccountPage,
+  renderAdminArtifactVersionsPage,
   renderAdminUsersPage,
   renderPasswordPage,
   renderReactFramePage,
@@ -410,6 +413,63 @@ export async function handleRequest({ request, response, store, host, port, secu
     return sendRedirect(response, "/admin/users");
   }
 
+  const adminVersionsMatch = /^\/admin\/artifacts\/([^/]+)\/versions$/.exec(pathname);
+  if (adminVersionsMatch && method === "GET") {
+    if (!currentUser) {
+      return sendRedirect(response, "/login");
+    }
+    requireAdmin(currentUser);
+    const artifact = await getArtifact(store, adminVersionsMatch[1], {
+      version: url.searchParams.get("version") || undefined
+    });
+    return sendHtml(response, renderAdminArtifactVersionsPage({
+      artifact,
+      selectedVersion: artifact.version,
+      content: artifact.content,
+      baseUrl,
+      user: currentUser,
+      locale,
+      currentPath
+    }), 200, headOnly);
+  }
+
+  const adminVersionActionMatch = /^\/admin\/artifacts\/([^/]+)\/versions\/(\d+)\/(repair|delete)$/.exec(pathname);
+  if (adminVersionActionMatch && method === "POST") {
+    assertLocalOrigin(request);
+    if (!currentUser) {
+      return sendRedirect(response, "/login");
+    }
+    requireAdmin(currentUser);
+    request.artifactyAuth = {
+      type: "session",
+      actor: currentUser.email,
+      user: currentUser,
+      role: currentUser.role
+    };
+    const body = await readFormBody(request);
+    const bodyLocale = localeFromBodyOrUrl(body, url);
+    const artifactId = adminVersionActionMatch[1];
+    const versionNumber = Number(adminVersionActionMatch[2]);
+    const action = adminVersionActionMatch[3];
+    if (action === "repair") {
+      await replaceArtifactVersion(store, artifactId, versionNumber, {
+        content: body.content,
+        format: body.format,
+        reason: body.reason,
+        metadata: {
+          repairedVia: "artifacty-admin"
+        },
+        audit: auditContext(request, "web-admin")
+      });
+    } else {
+      await deleteArtifactVersion(store, artifactId, versionNumber, {
+        reason: body.reason,
+        audit: auditContext(request, "web-admin")
+      });
+    }
+    return sendRedirect(response, localizedHref(`/admin/artifacts/${encodeURIComponent(artifactId)}/versions`, bodyLocale));
+  }
+
   if (pathname === "/mcp") {
     if (!mcpHttp) {
       return sendJson(response, { error: "Not found" }, 404, headOnly);
@@ -585,6 +645,7 @@ export async function handleRequest({ request, response, store, host, port, secu
       metadata: {
         updatedVia: "artifacty-web"
       },
+      skipNoop: true,
       audit: auditContext(request, "web")
     });
     return sendRedirect(response, localizedHref(`/artifacts/${encodeURIComponent(artifact.id)}`, bodyLocale));
@@ -697,7 +758,8 @@ export async function handleRequest({ request, response, store, host, port, secu
       baseUrl,
       authToken,
       locale,
-      currentPath
+      currentPath,
+      user: currentUser
     }), 200, headOnly);
   }