artifacty 0.10.5 → 0.10.7

package/README.md

@@ -252,7 +252,7 @@ By default Artifacty stores files under `~/.artifacty`.
 ARTIFACTY_HOME=/path/to/shared/store artifacty serve
 ```
 
-Artifact metadata is stored in `artifacty.sqlite`; artifact content is stored as immutable version files under `artifacts/`. The current browser server URL is written to `server.json` so MCP tools can return the correct links when the default port falls back. Existing `index.json` stores are migrated automatically on first access.
+Artifact metadata is stored in `artifacty.sqlite`; artifact content is stored as append-only version files under `artifacts/` for normal create and update flows. Administrators can repair or delete individual bad versions from the browser, and those exceptional actions are recorded in the audit log. The current browser server URL is written to `server.json` so MCP tools can return the correct links when the default port falls back. Existing `index.json` stores are migrated automatically on first access.
 
 Search uses a SQLite FTS5 index when the local Node SQLite build supports it. The index covers the latest version body plus title, tags, source agent, artifact type, format, and metadata summary. If FTS5 is unavailable, Artifacty keeps working with metadata search. Rebuild or check the store when needed:
 
@@ -302,8 +302,9 @@ Browser routes:
 - `/`: list artifacts with search, tag, and source filters.
 - `/new`: create an Artifacty-native artifact with the CodeMirror editor.
 - `/import`: paste an external agent artifact and convert it with automatic editor mode detection.
-- `/artifacts/:id/edit`: save a new version with Markdown, HTML, JSON, text, code, SVG, Mermaid, React, SARIF, CSV, image, or video syntax support.
+- `/artifacts/:id/edit`: save a new version with Markdown, HTML, JSON, text, code, SVG, Mermaid, React, SARIF, CSV, image, or video syntax support. Browser edits that do not change the artifact are recorded as `update-noop` audit events without creating a version.
 - `/artifacts/:id/diff`: compare versions.
+- `/admin/artifacts/:id/versions`: administrator-only repair/delete screen for individual versions.
 - `/api/audit`: list audit events.
 
 List APIs support pagination with `limit` and `offset`. Responses keep the top-level `artifacts` array and include `pagination` and `search` metadata:
@@ -320,10 +321,11 @@ The browser UI defaults to English. Add `?lang=ko` to any browser route to use K
 Schema and storage:
 
 - Metadata lives in SQLite with `schemaVersion: 1`, `artifactType`, `publisherId`, and `archivedAt`.
-- Archive hides artifacts from default lists without deleting versions.
+- Archive hides artifacts from default lists without deleting versions. Admin version repair/delete is available for correcting accidental or sensitive historical versions and records `version-repair` or `version-delete` audit events.
 - Bundle artifacts store multiple files or base64 assets as portable JSON.
 - Supported formats are `html`, `markdown`, `text`, `json`, `code`, `svg`, `mermaid`, `react`, `sarif`, `csv`, `image`, and `video`.
 - Native create/import paths infer `html` from HTML documents or fragments when no explicit format is supplied.
+- `sourceAgent` is canonicalized before storage. Aliases such as `claude-code`, `Claude Code`, `github-copilot`, and `gemini-cli` are stored as `claude`, `copilot`, and `gemini`; legacy `unknown` rows are backfilled only when version metadata, audit data, or source-agent tags provide a known agent.
 - Diagram, component, source snippet, analysis report, table, and media assets use `diagram`, `component`, `snippet`, `analysis-report`, `table`, and `asset` artifact types.
 - Copilot/Cursor examples cover PR reviews, screenshots, demo recordings, and visual evidence bundles.
 - See [docs/artifact-schema-v1.md](docs/artifact-schema-v1.md).
@@ -341,7 +343,7 @@ Schema and storage:
 - Non-local sharing is intended for trusted LAN or VPN sessions. Prefer a specific interface IP over `0.0.0.0`, keep React rendering disabled, and see [docs/network-sharing.md](docs/network-sharing.md).
 - Non-local binding prints a startup warning because Artifacty does not terminate TLS.
 - Artifact content is scanned for common API keys and private keys before storage. Use `--allow-secrets` or `ARTIFACTY_ALLOW_SECRETS=true` only for intentional exceptions.
-- Creates, updates, reads, imports, archives, and restores write audit events to SQLite. Legacy artifacts without a stored publisher are best-effort backfilled from their first `create` or `import` audit actor.
+- Creates, updates, reads, imports, archives, restores, no-op browser edits, and admin version repair/delete actions write audit events to SQLite. Legacy artifacts without a stored publisher are best-effort backfilled from their first `create` or `import` audit actor.
 - CodeMirror editor/viewer and renderer assets are served from local npm dependencies through a package allowlist, not from a public CDN. JavaScript asset routes answer `Origin: null` requests with `Access-Control-Allow-Origin: null` so sandboxed renderer iframes can import local ESM without `allow-same-origin`.
 - Mutating HTTP routes reject non-local browser origins.
 - HTML artifacts render in a sandboxed iframe.

package/docs/artifact-schema-v1.md

@@ -50,10 +50,18 @@ Artifacty store. For authenticated central servers this is the personal token
 owner's email; `publisherName` and `publisherUserId` are included when the
 server can map the request to a local user record. Legacy artifacts are
 best-effort backfilled from the first `create` or `import` audit actor.
+Known source-agent aliases are canonicalized before storage. For example,
+`claude-code`, `Claude Code`, and `anthropic` become `claude`;
+`github-copilot` becomes `copilot`; and `gemini-cli` becomes `gemini`.
+Existing `unknown` rows are upgraded only when version metadata, audit data, or
+source-agent tags provide one of the known agent identities.
 
 ## Version Record
 
-Each version is immutable and points at one content file.
+Normal create and update flows append versions, and each version points at one
+content file. Administrator repair/delete actions are exceptional maintenance
+operations for correcting accidental or sensitive historical versions; they
+write `version-repair` or `version-delete` audit events.
 
 ```json
 {
@@ -115,7 +123,7 @@ Metadata is free-form JSON, but converter-generated metadata uses these keys:
 
 ## Archive Semantics
 
-Artifacts are not deleted by P0 behavior. Archive sets `archivedAt` and hides the artifact from default list results. `includeArchived=true` includes archived records. Restore clears `archivedAt`. Versions and content files remain unchanged.
+Artifacts are not deleted by P0 behavior. Archive sets `archivedAt` and hides the artifact from default list results. `includeArchived=true` includes archived records. Restore clears `archivedAt`. Regular archive/restore leaves versions and content files unchanged. Administrators may repair or delete individual versions from `/admin/artifacts/:id/versions`; the last remaining version cannot be deleted.
 
 ## Bundle Format
 

package/docs/integrations.md

@@ -321,7 +321,7 @@ Supported converter inputs:
 - Gemini: `returnDisplay`, `llmContent`, text blocks, or local markdown/text/json files.
 - Generic: file extension, content type, HTML doctype/fragments, JSON shape, media data URLs, and markdown headings are used to infer format and title. Generic `text/plain` uploads are upgraded to a more specific format, such as `html`, when filename or content makes that clear.
 
-The converter adds `imported` and source-agent tags, preserves the raw content as an immutable Artifacty version, and records source details under `metadata.artifactyImport`.
+The converter canonicalizes source-agent aliases, adds `imported` and source-agent tags, preserves the raw content as an immutable Artifacty version, and records source details under `metadata.artifactyImport`. For example, `claude-code` and `Claude Code` are stored as `claude`.
 
 Fixture examples for Copilot/Cursor PR review, screenshot, demo recording, and
 visual evidence bundle live under `test/fixtures/` and are covered by converter
@@ -347,11 +347,14 @@ tests.
 - `GET /artifacts/:id`: browser viewer.
 - `GET /artifacts/:id/react-frame?version=n`: gated React renderer frame. Returns content only when `ARTIFACTY_ENABLE_REACT_RENDERER=true`.
 - `GET /artifacts/:id/edit`: browser version editor.
-- `POST /artifacts/:id/edit`: append a version from the browser editor.
+- `POST /artifacts/:id/edit`: append a version from the browser editor. Unchanged browser edits record `update-noop` without creating another version.
 - `POST /artifacts/:id/archive`: archive from the browser.
 - `POST /artifacts/:id/restore`: restore from the browser.
 - `GET /artifacts/:id/diff`: compare two versions.
 - `GET /artifacts/:id/raw?version=n`: raw content.
+- `GET /admin/artifacts/:id/versions`: administrator-only version repair/delete screen.
+- `POST /admin/artifacts/:id/versions/:version/repair`: administrator-only replacement of one version's content and format.
+- `POST /admin/artifacts/:id/versions/:version/delete`: administrator-only deletion of one version. The last remaining version cannot be deleted.
 
 When `ARTIFACTY_API_TOKEN` is configured, `/api/*` routes require either `Authorization: Bearer <token>` or `x-artifacty-token: <token>`. When users exist, personal tokens issued from `/account` also authenticate API and MCP requests, set created artifacts' `publisherId` to the token owner's email, and map audit `actor` to the same identity. Browser forms can also carry `?token=<token>` in the URL, which is copied to hidden form fields for local team workflows.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "artifacty",
-  "version": "0.10.5",
+  "version": "0.10.7",
   "description": "Local artifact exchange for heterogeneous LLM agents via HTTP and MCP.",
   "type": "module",
   "keywords": [

package/src/lib/agents.js

@@ -0,0 +1,53 @@
+export const KNOWN_SOURCE_AGENTS = new Set([
+  "artifacty",
+  "claude",
+  "codex",
+  "copilot",
+  "cursor",
+  "gemini",
+  "generic",
+  "mcp",
+  "unknown"
+]);
+
+const SOURCE_AGENT_ALIASES = new Map([
+  ["anthropic", "claude"],
+  ["claude-ai", "claude"],
+  ["claude-code", "claude"],
+  ["claude-code-cli", "claude"],
+  ["claude_cli", "claude"],
+  ["github-copilot", "copilot"],
+  ["copilot-chat", "copilot"],
+  ["vscode-copilot", "copilot"],
+  ["vs-code-copilot", "copilot"],
+  ["cursor-ai", "cursor"],
+  ["gemini-cli", "gemini"],
+  ["google", "gemini"],
+  ["openai", "codex"],
+  ["openai-codex", "codex"],
+  ["codex-cli", "codex"],
+  ["chatgpt", "codex"]
+]);
+
+export function normalizeSourceAgent(value, options = {}) {
+  const defaultValue = options.defaultValue ?? "unknown";
+  const allowAuto = options.allowAuto === true;
+  const normalized = String(value ?? "").trim().toLowerCase();
+  if (!normalized) {
+    return defaultValue;
+  }
+  if (normalized === "auto") {
+    return allowAuto ? "auto" : defaultValue;
+  }
+  const slug = normalized.replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "");
+  const canonical = SOURCE_AGENT_ALIASES.get(normalized) || SOURCE_AGENT_ALIASES.get(slug) || slug;
+  if (KNOWN_SOURCE_AGENTS.has(canonical)) {
+    return canonical;
+  }
+  return canonical || defaultValue;
+}
+
+export function isUnknownSourceAgent(value) {
+  const normalized = normalizeSourceAgent(value, { defaultValue: "unknown" });
+  return normalized === "unknown" || normalized === "generic" || normalized === "auto";
+}

package/src/lib/converters.js

@@ -1,9 +1,9 @@
 import path from "node:path";
 import { createHash } from "node:crypto";
+import { normalizeSourceAgent } from "./agents.js";
 import { ARTIFACT_TYPES, contentTypeForFormat, normalizeFormat } from "./storage.js";
 
 const CONTINUATION_AGENTS = new Set(["codex", "copilot", "cursor"]);
-const KNOWN_AGENTS = new Set(["auto", "artifacty", "claude", "codex", "copilot", "cursor", "gemini", "generic"]);
 
 export function convertAgentArtifact(input = {}) {
   const originalAgent = normalizeAgent(input.agent || input.sourceAgent || input.source_agent || "auto");
@@ -28,8 +28,11 @@ export function convertAgentArtifact(input = {}) {
   if (media) {
     content = media.content;
   }
-  const sourceAgent = optionalString(input.sourceAgent || input.source_agent || decoded.sourceAgent) ||
-    (originalAgent === "auto" ? detectAgent(parsed, fileName) : originalAgent);
+  const explicitSourceAgent = optionalString(input.sourceAgent || input.source_agent || decoded.sourceAgent);
+  const detectedSourceAgent = originalAgent === "auto" ? detectAgent(parsed, fileName) : originalAgent;
+  const sourceAgent = explicitSourceAgent
+    ? normalizeAgent(explicitSourceAgent)
+    : normalizeAgent(detectedSourceAgent || "unknown");
 
   const title =
     optionalString(input.title) ||
@@ -1387,29 +1390,10 @@ function cleanTitle(value) {
 }
 
 function normalizeAgent(value) {
-  const normalized = optionalString(value).toLowerCase();
-  if (!normalized) {
-    return "auto";
-  }
-  if (normalized === "claude-code" || normalized === "anthropic") {
-    return "claude";
-  }
-  if (normalized === "gemini-cli" || normalized === "google") {
-    return "gemini";
-  }
-  if (normalized === "github-copilot" || normalized === "copilot-chat" || normalized === "vscode-copilot" || normalized === "vs-code-copilot") {
-    return "copilot";
-  }
-  if (normalized === "cursor-ai") {
-    return "cursor";
-  }
-  if (normalized === "openai" || normalized === "chatgpt") {
-    return "codex";
-  }
-  if (KNOWN_AGENTS.has(normalized)) {
-    return normalized;
-  }
-  return normalized.replace(/[^a-z0-9-]+/g, "-") || "generic";
+  return normalizeSourceAgent(value, {
+    defaultValue: "auto",
+    allowAuto: true
+  });
 }
 
 function normalizeTags(tags) {

package/src/lib/render.js

@@ -189,6 +189,83 @@ export function renderNewArtifactPage({ baseUrl, authToken = "", locale = DEFAUL
   return renderArtifactFormPage({ mode: "new", baseUrl, authToken, locale, currentPath });
 }
 
+export function renderAdminArtifactVersionsPage({ artifact, selectedVersion, content, baseUrl, user, error = "", locale = DEFAULT_LOCALE, currentPath = "/" }) {
+  const view = viewContext(locale, currentPath);
+  const artifactPath = `/artifacts/${encodeURIComponent(artifact.id)}`;
+  const versionRows = artifact.versions.map((version) => {
+    const active = version.version === selectedVersion.version ? " active" : "";
+    const deleteDisabled = artifact.versions.length <= 1 ? " disabled" : "";
+    return `
+      <tr>
+        <td><a class="version${active}" href="${view.href(`/admin/artifacts/${encodeURIComponent(artifact.id)}/versions?version=${version.version}`)}">v${version.version}</a></td>
+        <td>${formatBadge(version.format)}</td>
+        <td>${escapeHtml(version.createdAt)}</td>
+        <td><code>${escapeHtml(version.sha256.slice(0, 12))}</code></td>
+        <td>${escapeHtml(String(version.sizeBytes))}</td>
+        <td>
+          <form class="inline-action" method="post" action="/admin/artifacts/${encodeURIComponent(artifact.id)}/versions/${version.version}/delete">
+            ${localeInput(view.locale)}
+            <input name="reason" placeholder="Reason">
+            <button type="submit"${deleteDisabled}>Delete</button>
+          </form>
+        </td>
+      </tr>
+    `;
+  }).join("");
+
+  return pageShell({
+    title: `Manage versions · ${artifact.title}`,
+    body: `
+      <header class="topbar">
+        <div>
+          <h1>Manage versions</h1>
+          <p>${escapeHtml(artifact.title)} · ${escapeHtml(artifact.id)} · ${escapeHtml(baseUrl)}</p>
+        </div>
+        <nav>
+          <a href="${view.href(artifactPath)}">Artifact</a>
+          <a href="${view.href(`${artifactPath}/diff`)}">${view.text("nav.diff")}</a>
+          ${authNav(user)}
+          ${languageSwitcher(view)}
+        </nav>
+      </header>
+      <main class="artifact-editor">
+        ${error ? `<p class="auth-error">${escapeHtml(error)}</p>` : ""}
+        <section class="meta-card">
+          <h2>Versions</h2>
+          <table class="data-table">
+            <thead><tr><th>Version</th><th>Format</th><th>Created</th><th>SHA</th><th>Bytes</th><th>Action</th></tr></thead>
+            <tbody>${versionRows}</tbody>
+          </table>
+        </section>
+        <form class="editor-form" method="post" action="/admin/artifacts/${encodeURIComponent(artifact.id)}/versions/${selectedVersion.version}/repair">
+          ${localeInput(view.locale)}
+          <section class="editor-fields">
+            <label class="field">
+              <span>${view.text("form.format")}</span>
+              ${formatSelect(selectedVersion.format)}
+            </label>
+            <label class="field">
+              <span>Reason</span>
+              <input name="reason" value="" autocomplete="off">
+            </label>
+          </section>
+          <section class="field content-field">
+            <label for="artifact-content">v${selectedVersion.version} content</label>
+            <textarea id="artifact-content" name="content" data-artifacty-editor data-editor-format="${escapeAttribute(selectedVersion.format)}" spellcheck="false" required>${escapeHtml(content)}</textarea>
+          </section>
+          <footer class="editor-actions">
+            <a href="${view.href(`${artifactPath}?version=${selectedVersion.version}`)}">View version</a>
+            <button type="submit">Repair version</button>
+          </footer>
+        </form>
+      </main>
+    `,
+    head: editorHead(),
+    afterBody: editorScript(view.locale),
+    locale: view.locale
+  });
+}
+
 export function renderImportArtifactPage({ baseUrl, authToken = "", locale = DEFAULT_LOCALE, currentPath = "/import" }) {
   const view = viewContext(locale, currentPath);
   const title = view.raw("form.importTitle");
@@ -509,7 +586,7 @@ export function renderAdminUsersPage({ baseUrl, user, users = [], importResult =
   });
 }
 
-export function renderArtifactPage({ artifact, version, content, baseUrl, authToken = "", locale = DEFAULT_LOCALE, currentPath = "/" }) {
+export function renderArtifactPage({ artifact, version, content, baseUrl, authToken = "", locale = DEFAULT_LOCALE, currentPath = "/", user = null }) {
   const view = viewContext(locale, currentPath);
   const versionLinks = artifact.versions
     .map((item) => {
@@ -543,7 +620,9 @@ export function renderArtifactPage({ artifact, version, content, baseUrl, authTo
           <a href="${view.href("/")}">${view.text("nav.index")}</a>
           <a href="${view.href(`/artifacts/${encodeURIComponent(artifact.id)}/edit`)}">${view.text("nav.edit")}</a>
           <a href="${view.href(`/artifacts/${encodeURIComponent(artifact.id)}/diff`)}">${view.text("nav.diff")}</a>
+          ${user?.role === "admin" ? `<a href="${view.href(`/admin/artifacts/${encodeURIComponent(artifact.id)}/versions`)}">Versions</a>` : ""}
           <a href="${view.href(rawUrl)}">${view.text("nav.raw")}</a>
+          ${authNav(user)}
           ${languageSwitcher(view)}
         </nav>
       </header>

package/src/lib/storage.js

@@ -1,9 +1,10 @@
 import { createHash, randomBytes, randomUUID, scryptSync, timingSafeEqual } from "node:crypto";
-import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, statSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { readFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import path from "node:path";
 import { DatabaseSync } from "node:sqlite";
+import { isUnknownSourceAgent, normalizeSourceAgent } from "./agents.js";
 import { assertNoSecrets, securityConfig } from "./security.js";
 
 export const STORE_VERSION = 4;
@@ -182,13 +183,32 @@ export async function createArtifact(store = createStore(), input = {}) {
 export async function updateArtifact(store = createStore(), id, input = {}) {
   const secretScan = assertNoSecrets(input, securityConfig());
   input = withSecretScan(input, secretScan);
-  const normalized = normalizeArtifactInput(input, { requireContent: true, requireTitle: false });
+  const normalized = normalizeArtifactInput(input, {
+    requireContent: true,
+    requireTitle: false,
+    defaultSourceAgent: ""
+  });
   const db = openDatabase(store);
 
   try {
     let artifact;
     transaction(db, () => {
       artifact = findArtifactById(db, id);
+      const latest = artifact.versions.find((version) => version.version === artifact.latestVersion);
+      if (input.skipNoop && latest) {
+        const latestContent = readFileSync(path.join(store.home, latest.path), "utf8");
+        if (isNoopVersionUpdate(artifact, latest, latestContent, normalized)) {
+          insertAuditRecord(db, {
+            action: "update-noop",
+            artifactId: artifact.id,
+            version: artifact.latestVersion,
+            sourceAgent: artifact.sourceAgent,
+            audit: input.audit,
+            metadata: { reason: "no changes detected" }
+          });
+          return;
+        }
+      }
       const now = new Date().toISOString();
       const nextVersion = artifact.latestVersion + 1;
       const version = writeVersionFile(store, artifact.id, nextVersion, normalized, now);
@@ -234,6 +254,163 @@ export async function updateArtifact(store = createStore(), id, input = {}) {
   }
 }
 
+export async function replaceArtifactVersion(store = createStore(), id, versionNumber, input = {}) {
+  const secretScan = assertNoSecrets(input, securityConfig());
+  input = withSecretScan(input, secretScan);
+  const normalized = normalizeArtifactInput(input, {
+    requireContent: true,
+    requireTitle: false,
+    defaultSourceAgent: ""
+  });
+  const targetVersion = Number(versionNumber);
+  if (!Number.isInteger(targetVersion) || targetVersion < 1) {
+    throw Object.assign(new Error(`Invalid artifact version: ${versionNumber}`), {
+      code: "INVALID_VERSION",
+      statusCode: 400
+    });
+  }
+  const db = openDatabase(store);
+
+  try {
+    let artifact;
+    transaction(db, () => {
+      artifact = findArtifactById(db, id);
+      const existing = artifact.versions.find((version) => version.version === targetVersion);
+      if (!existing) {
+        throw Object.assign(new Error(`Artifact version not found: ${id}@${targetVersion}`), {
+          code: "ARTIFACT_VERSION_NOT_FOUND",
+          statusCode: 404
+        });
+      }
+
+      const now = new Date().toISOString();
+      const previousPath = existing.path;
+      const repairedMetadata = {
+        ...existing.metadata,
+        ...normalized.metadata,
+        adminRepair: {
+          repairedAt: now,
+          reason: normalizeOptionalString(input.reason),
+          previousSha256: existing.sha256,
+          previousSizeBytes: existing.sizeBytes,
+          previousPath
+        }
+      };
+      const replacement = writeVersionFile(store, artifact.id, targetVersion, {
+        ...normalized,
+        metadata: repairedMetadata
+      }, existing.createdAt);
+
+      if (previousPath !== replacement.path) {
+        removeVersionFile(store, previousPath);
+      }
+
+      db.prepare(`
+        UPDATE artifact_versions
+        SET created_at = ?, format = ?, content_type = ?, path = ?, size_bytes = ?, sha256 = ?, metadata_json = ?
+        WHERE artifact_id = ? AND version = ?
+      `).run(
+        replacement.createdAt,
+        replacement.format,
+        replacement.contentType,
+        replacement.path,
+        replacement.sizeBytes,
+        replacement.sha256,
+        JSON.stringify(replacement.metadata || {}),
+        artifact.id,
+        targetVersion
+      );
+
+      artifact.versions = artifact.versions.map((version) => version.version === targetVersion ? replacement : version);
+      artifact.updatedAt = now;
+      db.prepare("UPDATE artifacts SET updated_at = ? WHERE id = ?").run(now, artifact.id);
+      if (targetVersion === artifact.latestVersion) {
+        upsertSearchIndex(db, artifact, replacement, normalized.content);
+      }
+      insertAuditRecord(db, {
+        action: "version-repair",
+        artifactId: artifact.id,
+        version: targetVersion,
+        sourceAgent: artifact.sourceAgent,
+        audit: input.audit,
+        metadata: {
+          reason: normalizeOptionalString(input.reason),
+          previousSha256: existing.sha256,
+          newSha256: replacement.sha256,
+          previousPath
+        }
+      });
+    });
+
+    return getArtifact(store, id, { version: targetVersion });
+  } finally {
+    db.close();
+  }
+}
+
+export async function deleteArtifactVersion(store = createStore(), id, versionNumber, options = {}) {
+  const targetVersion = Number(versionNumber);
+  if (!Number.isInteger(targetVersion) || targetVersion < 1) {
+    throw Object.assign(new Error(`Invalid artifact version: ${versionNumber}`), {
+      code: "INVALID_VERSION",
+      statusCode: 400
+    });
+  }
+  const db = openDatabase(store);
+
+  try {
+    let artifact;
+    transaction(db, () => {
+      artifact = findArtifactById(db, id);
+      if (artifact.versions.length <= 1) {
+        throw Object.assign(new Error("Cannot delete the only version of an artifact"), {
+          code: "ONLY_VERSION_DELETE_BLOCKED",
+          statusCode: 400
+        });
+      }
+      const existing = artifact.versions.find((version) => version.version === targetVersion);
+      if (!existing) {
+        throw Object.assign(new Error(`Artifact version not found: ${id}@${targetVersion}`), {
+          code: "ARTIFACT_VERSION_NOT_FOUND",
+          statusCode: 404
+        });
+      }
+
+      const now = new Date().toISOString();
+      db.prepare("DELETE FROM artifact_versions WHERE artifact_id = ? AND version = ?").run(artifact.id, targetVersion);
+      removeVersionFile(store, existing.path);
+      artifact.versions = artifact.versions.filter((version) => version.version !== targetVersion);
+      artifact.latestVersion = Math.max(...artifact.versions.map((version) => version.version));
+      artifact.updatedAt = now;
+      db.prepare("UPDATE artifacts SET latest_version = ?, updated_at = ? WHERE id = ?").run(
+        artifact.latestVersion,
+        now,
+        artifact.id
+      );
+
+      const latest = artifact.versions.find((version) => version.version === artifact.latestVersion);
+      const latestContent = readFileSync(path.join(store.home, latest.path), "utf8");
+      upsertSearchIndex(db, artifact, latest, latestContent);
+      insertAuditRecord(db, {
+        action: "version-delete",
+        artifactId: artifact.id,
+        version: targetVersion,
+        sourceAgent: artifact.sourceAgent,
+        audit: options.audit,
+        metadata: {
+          reason: normalizeOptionalString(options.reason),
+          deletedSha256: existing.sha256,
+          deletedPath: existing.path
+        }
+      });
+    });
+
+    return withLatestContent(store, artifact);
+  } finally {
+    db.close();
+  }
+}
+
 export async function archiveArtifact(store = createStore(), id, options = {}) {
   const db = openDatabase(store);
   try {
@@ -299,7 +476,7 @@ export async function listArtifactsPage(store = createStore(), filters = {}) {
   const query = normalizeOptionalString(filters.query);
   const normalizedQuery = query.toLowerCase();
   const tag = normalizeOptionalString(filters.tag).toLowerCase();
-  const sourceAgent = normalizeOptionalString(filters.sourceAgent).toLowerCase();
+  const sourceAgent = normalizeSourceAgent(filters.sourceAgent, { defaultValue: "" }).toLowerCase();
 
   try {
     if (query && searchIndexAvailable(db)) {
@@ -1082,6 +1259,7 @@ function openDatabase(store) {
   `);
   initializeSchema(db);
   migrateJsonIndex(db, store);
+  normalizeStoredSourceAgents(db, store);
   syncSearchIndexIfEmpty(db, store);
   return db;
 }
@@ -1324,6 +1502,123 @@ function migrateJsonIndex(db, store) {
   });
 }
 
+const INFERABLE_SOURCE_AGENTS = new Set(["claude", "codex", "copilot", "cursor", "gemini"]);
+
+function normalizeStoredSourceAgents(db, store) {
+  const rows = db.prepare(`
+    SELECT id, source_agent, tags_json
+    FROM artifacts
+  `).all();
+  const updateArtifact = db.prepare("UPDATE artifacts SET source_agent = ?, tags_json = ? WHERE id = ?");
+  let changed = false;
+
+  transaction(db, () => {
+    for (const row of rows) {
+      const normalized = normalizeSourceAgent(row.source_agent, { defaultValue: "unknown" });
+      const inferred = isUnknownSourceAgent(normalized)
+        ? inferStoredSourceAgent(db, row)
+        : normalized;
+      const nextSourceAgent = inferred || normalized;
+      const nextTags = normalizeStoredSourceTags(row.tags_json, nextSourceAgent);
+      if (nextSourceAgent !== row.source_agent || nextTags !== row.tags_json) {
+        updateArtifact.run(nextSourceAgent, nextTags, row.id);
+        changed = true;
+      }
+    }
+
+    const auditRows = db.prepare(`
+      SELECT id, source_agent
+      FROM audit_log
+      WHERE source_agent IS NOT NULL
+        AND TRIM(source_agent) != ''
+    `).all();
+    const updateAudit = db.prepare("UPDATE audit_log SET source_agent = ? WHERE id = ?");
+    for (const row of auditRows) {
+      const normalized = normalizeSourceAgent(row.source_agent, { defaultValue: "" });
+      if (normalized && normalized !== row.source_agent) {
+        updateAudit.run(normalized, row.id);
+        changed = true;
+      }
+    }
+  });
+
+  if (changed) {
+    rebuildSearchIndexInDb(db, store);
+  }
+}
+
+function inferStoredSourceAgent(db, artifactRow) {
+  const tagCandidate = firstInferableSourceAgent(parseJson(artifactRow.tags_json, []));
+  if (tagCandidate) {
+    return tagCandidate;
+  }
+
+  const versionRows = db.prepare(`
+    SELECT metadata_json
+    FROM artifact_versions
+    WHERE artifact_id = ?
+    ORDER BY version DESC
+  `).all(artifactRow.id);
+  for (const row of versionRows) {
+    const metadata = parseJson(row.metadata_json, {});
+    const candidate = firstInferableSourceAgent([
+      metadata.sourceAgent,
+      metadata.source_agent,
+      metadata.agent,
+      metadata.artifactyImport?.sourceAgent,
+      metadata.artifactyImport?.originalAgent
+    ]);
+    if (candidate) {
+      return candidate;
+    }
+  }
+
+  const auditRows = db.prepare(`
+    SELECT source_agent
+    FROM audit_log
+    WHERE artifact_id = ?
+      AND source_agent IS NOT NULL
+      AND TRIM(source_agent) != ''
+    ORDER BY created_at DESC
+  `).all(artifactRow.id);
+  return firstInferableSourceAgent(auditRows.map((row) => row.source_agent));
+}
+
+function normalizeStoredSourceTags(tagsJson, sourceAgent) {
+  const tags = parseJson(tagsJson, []);
+  if (!Array.isArray(tags)) {
+    return JSON.stringify([]);
+  }
+  const normalizedTags = [];
+  for (const tag of tags) {
+    const trimmed = normalizeOptionalString(tag);
+    if (!trimmed) {
+      continue;
+    }
+    const canonical = inferableSourceAgent(trimmed);
+    const next = canonical || (trimmed === "unknown" && INFERABLE_SOURCE_AGENTS.has(sourceAgent) ? sourceAgent : trimmed);
+    if (!normalizedTags.includes(next)) {
+      normalizedTags.push(next);
+    }
+  }
+  return JSON.stringify(normalizedTags);
+}
+
+function firstInferableSourceAgent(values) {
+  for (const value of values || []) {
+    const candidate = inferableSourceAgent(value);
+    if (candidate) {
+      return candidate;
+    }
+  }
+  return "";
+}
+
+function inferableSourceAgent(value) {
+  const normalized = normalizeSourceAgent(value, { defaultValue: "" });
+  return INFERABLE_SOURCE_AGENTS.has(normalized) ? normalized : "";
+}
+
 function ensureSearchTable(db) {
   try {
     const existing = db.prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'artifact_search'").get();
@@ -1547,7 +1842,7 @@ function insertArtifactRecord(db, artifact) {
     artifact.title,
     normalizeArtifactType(artifact.artifactType || artifact.artifact_type || "document"),
     normalizeSchemaVersion(artifact.schemaVersion || artifact.schema_version),
-    artifact.sourceAgent || artifact.source_agent || "unknown",
+    normalizeSourceAgent(artifact.sourceAgent || artifact.source_agent, { defaultValue: "unknown" }),
     normalizeOptionalString(artifact.publisherId || artifact.publisher_id) || null,
     normalizeOptionalString(artifact.publisherName || artifact.publisher_name) || null,
     normalizeOptionalString(artifact.publisherUserId || artifact.publisher_user_id) || null,
@@ -1691,6 +1986,38 @@ function writeVersionFile(store, id, versionNumber, input, createdAt) {
   };
 }
 
+function removeVersionFile(store, relativePath) {
+  const absolutePath = path.join(store.home, relativePath);
+  if (existsSync(absolutePath)) {
+    rmSync(absolutePath, { force: true });
+  }
+}
+
+function isNoopVersionUpdate(artifact, latest, latestContent, normalized) {
+  const nextTitle = normalized.title || artifact.title;
+  const nextSourceAgent = normalized.sourceAgent || artifact.sourceAgent;
+  const nextArtifactType = normalized.artifactType || artifact.artifactType;
+  const nextSchemaVersion = normalized.schemaVersion || artifact.schemaVersion;
+  const nextTags = normalized.tags.length > 0 ? normalized.tags : artifact.tags;
+  const nextContentType = normalized.contentType || contentTypeForFormat(normalized.format);
+
+  return nextTitle === artifact.title &&
+    nextSourceAgent === artifact.sourceAgent &&
+    nextArtifactType === artifact.artifactType &&
+    nextSchemaVersion === artifact.schemaVersion &&
+    tagsEqual(nextTags, artifact.tags) &&
+    normalized.content === latestContent &&
+    normalized.format === latest.format &&
+    nextContentType === latest.contentType;
+}
+
+function tagsEqual(left = [], right = []) {
+  if (left.length !== right.length) {
+    return false;
+  }
+  return left.every((item, index) => item === right[index]);
+}
+
 async function withLatestContent(store, artifact) {
   const latest = await readArtifactVersion(store, artifact, artifact.latestVersion);
   return {
@@ -1725,7 +2052,9 @@ function normalizeArtifactInput(input, options) {
     contentType: normalizeOptionalString(input.contentType),
     artifactType: normalizeArtifactType(input.artifactType || input.artifact_type || inferArtifactType(input)),
     schemaVersion: normalizeSchemaVersion(input.schemaVersion || input.schema_version),
-    sourceAgent: normalizeOptionalString(input.sourceAgent || input.source_agent || input.agent) || "unknown",
+    sourceAgent: normalizeSourceAgent(input.sourceAgent || input.source_agent || input.agent, {
+      defaultValue: options.defaultSourceAgent ?? "unknown"
+    }),
     tags: normalizeTags(input.tags),
     metadata: normalizeMetadata(input.metadata)
   };

package/src/server.js

@@ -14,6 +14,7 @@ import {
   createSession,
   createStore,
   createUser,
+  deleteArtifactVersion,
   getArtifact,
   getSessionUser,
   importUsersFromCsv,
@@ -25,6 +26,7 @@ import {
   revokeApiToken,
   revokeSession,
   restoreArtifact,
+  replaceArtifactVersion,
   setUserActive,
   updateArtifact,
   verifyUserPassword
@@ -41,6 +43,7 @@ import {
   renderArtifactFormPage,
   renderArtifactPage,
   renderAccountPage,
+  renderAdminArtifactVersionsPage,
   renderAdminUsersPage,
   renderPasswordPage,
   renderReactFramePage,
@@ -410,6 +413,63 @@ export async function handleRequest({ request, response, store, host, port, secu
     return sendRedirect(response, "/admin/users");
   }
 
+  const adminVersionsMatch = /^\/admin\/artifacts\/([^/]+)\/versions$/.exec(pathname);
+  if (adminVersionsMatch && method === "GET") {
+    if (!currentUser) {
+      return sendRedirect(response, "/login");
+    }
+    requireAdmin(currentUser);
+    const artifact = await getArtifact(store, adminVersionsMatch[1], {
+      version: url.searchParams.get("version") || undefined
+    });
+    return sendHtml(response, renderAdminArtifactVersionsPage({
+      artifact,
+      selectedVersion: artifact.version,
+      content: artifact.content,
+      baseUrl,
+      user: currentUser,
+      locale,
+      currentPath
+    }), 200, headOnly);
+  }
+
+  const adminVersionActionMatch = /^\/admin\/artifacts\/([^/]+)\/versions\/(\d+)\/(repair|delete)$/.exec(pathname);
+  if (adminVersionActionMatch && method === "POST") {
+    assertLocalOrigin(request);
+    if (!currentUser) {
+      return sendRedirect(response, "/login");
+    }
+    requireAdmin(currentUser);
+    request.artifactyAuth = {
+      type: "session",
+      actor: currentUser.email,
+      user: currentUser,
+      role: currentUser.role
+    };
+    const body = await readFormBody(request);
+    const bodyLocale = localeFromBodyOrUrl(body, url);
+    const artifactId = adminVersionActionMatch[1];
+    const versionNumber = Number(adminVersionActionMatch[2]);
+    const action = adminVersionActionMatch[3];
+    if (action === "repair") {
+      await replaceArtifactVersion(store, artifactId, versionNumber, {
+        content: body.content,
+        format: body.format,
+        reason: body.reason,
+        metadata: {
+          repairedVia: "artifacty-admin"
+        },
+        audit: auditContext(request, "web-admin")
+      });
+    } else {
+      await deleteArtifactVersion(store, artifactId, versionNumber, {
+        reason: body.reason,
+        audit: auditContext(request, "web-admin")
+      });
+    }
+    return sendRedirect(response, localizedHref(`/admin/artifacts/${encodeURIComponent(artifactId)}/versions`, bodyLocale));
+  }
+
   if (pathname === "/mcp") {
     if (!mcpHttp) {
       return sendJson(response, { error: "Not found" }, 404, headOnly);
@@ -585,6 +645,7 @@ export async function handleRequest({ request, response, store, host, port, secu
       metadata: {
         updatedVia: "artifacty-web"
       },
+      skipNoop: true,
       audit: auditContext(request, "web")
     });
     return sendRedirect(response, localizedHref(`/artifacts/${encodeURIComponent(artifact.id)}`, bodyLocale));
@@ -697,7 +758,8 @@ export async function handleRequest({ request, response, store, host, port, secu
       baseUrl,
       authToken,
       locale,
-      currentPath
+      currentPath,
+      user: currentUser
     }), 200, headOnly);
   }