@agent-inspect/studio 6.0.0 → 6.3.0

package/dist/index.cjs

@@ -1,10 +1,11 @@
 'use strict';
 
 var promises = require('fs/promises');
-var path5 = require('path');
+var path8 = require('path');
 var advanced = require('agent-inspect/advanced');
 var workspace = require('agent-inspect/workspace');
 var Database = require('better-sqlite3');
+var crypto = require('crypto');
 var http = require('http');
 var checks = require('agent-inspect/checks');
 var diff = require('agent-inspect/diff');
@@ -13,9 +14,29 @@ var readers = require('agent-inspect/readers');
 
 function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
 
-var path5__default = /*#__PURE__*/_interopDefault(path5);
+var path8__default = /*#__PURE__*/_interopDefault(path8);
 var Database__default = /*#__PURE__*/_interopDefault(Database);
 
+// packages/studio/src/registry.ts
+function isSafeRelativePath(p) {
+  const trimmed = p.trim();
+  if (trimmed === "" || trimmed.startsWith("/") || trimmed.startsWith("\\")) return false;
+  if (/^[a-zA-Z]:/.test(trimmed)) return false;
+  return !trimmed.split(/[/\\]+/).some((seg) => seg === "..");
+}
+function resolveUnderRoot(root, ...segments) {
+  const resolvedRoot = path8__default.default.resolve(root);
+  const resolved = path8__default.default.resolve(resolvedRoot, ...segments);
+  assertPathUnderRoot(resolved, resolvedRoot);
+  return resolved;
+}
+function assertPathUnderRoot(resolved, root) {
+  const rel = path8__default.default.relative(path8__default.default.resolve(root), path8__default.default.resolve(resolved));
+  if (rel.startsWith("..") || path8__default.default.isAbsolute(rel)) {
+    throw new Error("path escapes allowed registry root");
+  }
+}
+
 // packages/studio/src/registry.ts
 var STUDIO_REGISTRY_SCHEMA_VERSION = "1.0";
 var STUDIO_REGISTRY_FILENAMES = [
@@ -26,16 +47,10 @@ var MAX_REGISTRY_BYTES = 256 * 1024;
 function isPlainObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function isSafeRelativePath(p) {
-  const trimmed = p.trim();
-  if (trimmed === "" || trimmed.startsWith("/") || trimmed.startsWith("\\")) return false;
-  if (/^[a-zA-Z]:/.test(trimmed)) return false;
-  return !trimmed.split(/[/\\]+/).some((seg) => seg === "..");
-}
 function parseStudioRegistry(input) {
   const errors = [];
   if (!isPlainObject(input)) {
-    return { ok: false, errors: ["registry must be a JSON object"] };
+    return { ok: false, errors: ["registry must be a JSON object"], warnings: [] };
   }
   if (input.schemaVersion !== STUDIO_REGISTRY_SCHEMA_VERSION) {
     errors.push(`schemaVersion must be "${STUDIO_REGISTRY_SCHEMA_VERSION}"`);
@@ -89,35 +104,157 @@ function parseStudioRegistry(input) {
           importConfig.bundlesDir = dir;
         }
       }
+      if (input.import.fileDropDir !== void 0) {
+        const dir = String(input.import.fileDropDir).trim();
+        if (!isSafeRelativePath(dir)) {
+          errors.push("import.fileDropDir must be a safe relative path");
+        } else {
+          importConfig.fileDropDir = dir;
+        }
+      }
+      if (input.import.enabled !== void 0) {
+        if (typeof input.import.enabled !== "boolean") {
+          errors.push("import.enabled must be a boolean");
+        } else {
+          importConfig.enabled = input.import.enabled;
+        }
+      }
     }
   }
-  if (errors.length > 0) return { ok: false, errors };
+  let ingestConfig;
+  const ingestWarnings = [];
+  if (input.ingest !== void 0) {
+    if (!isPlainObject(input.ingest)) {
+      errors.push("ingest must be an object");
+    } else {
+      ingestConfig = {};
+      if (input.ingest.github !== void 0) {
+        if (!isPlainObject(input.ingest.github)) {
+          errors.push("ingest.github must be an object");
+        } else {
+          const github = {};
+          if (input.ingest.github.enabled !== void 0) {
+            if (typeof input.ingest.github.enabled !== "boolean") {
+              errors.push("ingest.github.enabled must be a boolean");
+            } else {
+              github.enabled = input.ingest.github.enabled;
+            }
+          }
+          if (input.ingest.github.tokenEnv !== void 0) {
+            const tokenEnv = String(input.ingest.github.tokenEnv).trim();
+            if (!/^[A-Z][A-Z0-9_]*$/.test(tokenEnv)) {
+              errors.push("ingest.github.tokenEnv must be an uppercase env var name");
+            } else {
+              github.tokenEnv = tokenEnv;
+            }
+          }
+          ingestConfig.github = github;
+        }
+      }
+      if (input.ingest.http !== void 0) {
+        if (!isPlainObject(input.ingest.http)) {
+          errors.push("ingest.http must be an object");
+        } else {
+          const http = {};
+          if (input.ingest.http.enabled !== void 0) {
+            if (typeof input.ingest.http.enabled !== "boolean") {
+              errors.push("ingest.http.enabled must be a boolean");
+            } else {
+              http.enabled = input.ingest.http.enabled;
+            }
+          }
+          if (input.ingest.http.path !== void 0) {
+            const ingestPath = String(input.ingest.http.path).trim();
+            if (!ingestPath.startsWith("/") || ingestPath.includes("..")) {
+              errors.push("ingest.http.path must be an absolute safe path");
+            } else {
+              http.path = ingestPath;
+            }
+          }
+          if (input.ingest.http.tokenEnv !== void 0) {
+            const tokenEnv = String(input.ingest.http.tokenEnv).trim();
+            if (!/^[A-Z][A-Z0-9_]*$/.test(tokenEnv)) {
+              errors.push("ingest.http.tokenEnv must be an uppercase env var name");
+            } else {
+              http.tokenEnv = tokenEnv;
+            }
+          }
+          if (input.ingest.http.maxBytes !== void 0) {
+            const maxBytes = Number(input.ingest.http.maxBytes);
+            if (!Number.isInteger(maxBytes) || maxBytes <= 0) {
+              errors.push("ingest.http.maxBytes must be a positive integer");
+            } else {
+              http.maxBytes = maxBytes;
+            }
+          }
+          ingestConfig.http = http;
+        }
+      }
+      if (input.ingest.bundleUpload !== void 0) {
+        if (!isPlainObject(input.ingest.bundleUpload)) {
+          errors.push("ingest.bundleUpload must be an object");
+        } else {
+          const bundleUpload = {};
+          if (input.ingest.bundleUpload.enabled !== void 0) {
+            if (typeof input.ingest.bundleUpload.enabled !== "boolean") {
+              errors.push("ingest.bundleUpload.enabled must be a boolean");
+            } else {
+              bundleUpload.enabled = input.ingest.bundleUpload.enabled;
+            }
+          }
+          if (input.ingest.bundleUpload.maxBytes !== void 0) {
+            const maxBytes = Number(input.ingest.bundleUpload.maxBytes);
+            if (!Number.isInteger(maxBytes) || maxBytes <= 0) {
+              errors.push("ingest.bundleUpload.maxBytes must be a positive integer");
+            } else {
+              bundleUpload.maxBytes = maxBytes;
+            }
+          }
+          ingestConfig.bundleUpload = bundleUpload;
+        }
+      }
+      const knownIngestKeys = /* @__PURE__ */ new Set(["github", "http", "bundleUpload"]);
+      for (const key of Object.keys(input.ingest)) {
+        if (!knownIngestKeys.has(key)) {
+          ingestWarnings.push(`ignored unknown ingest key: ${key}`);
+        }
+      }
+    }
+  }
+  if (errors.length > 0) return { ok: false, errors, warnings: ingestWarnings };
   return {
     ok: true,
     registry: {
       schemaVersion: STUDIO_REGISTRY_SCHEMA_VERSION,
       name: String(input.name).trim(),
       projects,
-      ...importConfig ? { import: importConfig } : {}
+      ...importConfig ? { import: importConfig } : {},
+      ...ingestConfig ? { ingest: ingestConfig } : {}
     },
-    errors: []
+    errors: [],
+    warnings: ingestWarnings
   };
 }
 async function readStudioRegistryFile(filePath) {
   try {
     const raw = await promises.readFile(filePath, "utf8");
     if (raw.length > MAX_REGISTRY_BYTES) {
-      return { ok: false, path: filePath, errors: ["registry file exceeds size limit"] };
+      return {
+        ok: false,
+        path: filePath,
+        errors: ["registry file exceeds size limit"],
+        warnings: []
+      };
     }
     const parsed = parseStudioRegistry(JSON.parse(raw));
     return { ...parsed, path: filePath };
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
-    return { ok: false, path: filePath, errors: [message] };
+    return { ok: false, path: filePath, errors: [message], warnings: [] };
   }
 }
 function resolveRegistryProjectPath(registryDir, projectPath) {
-  return path5__default.default.isAbsolute(projectPath) ? path5__default.default.resolve(projectPath) : path5__default.default.resolve(registryDir, projectPath);
+  return path8__default.default.isAbsolute(projectPath) ? path8__default.default.resolve(projectPath) : path8__default.default.resolve(registryDir, projectPath);
 }
 var STUDIO_DB_SCHEMA_VERSION = "1.0";
 var DEFAULT_STUDIO_DB_FILENAME = "studio.db";
@@ -150,6 +287,15 @@ CREATE TABLE IF NOT EXISTS runs (
 );
 CREATE INDEX IF NOT EXISTS idx_runs_project ON runs(project_id);
 CREATE INDEX IF NOT EXISTS idx_runs_status ON runs(status);
+CREATE TABLE IF NOT EXISTS ingest_files (
+  source_key TEXT PRIMARY KEY,
+  source_name TEXT NOT NULL,
+  dest_path TEXT NOT NULL,
+  kind TEXT NOT NULL CHECK(kind IN ('ci', 'bundle')),
+  content_hash TEXT NOT NULL,
+  imported_at TEXT NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_ingest_files_kind ON ingest_files(kind);
 `;
 function resolveStudioDbPath(options) {
   if (options.dbPath && options.dbPath.trim() !== "") {
@@ -157,9 +303,9 @@ function resolveStudioDbPath(options) {
     if (raw.startsWith("postgres://") || raw.startsWith("postgresql://")) {
       return raw;
     }
-    return path5__default.default.resolve(options.cwd ?? process.cwd(), raw);
+    return path8__default.default.resolve(options.cwd ?? process.cwd(), raw);
   }
-  return path5__default.default.resolve(
+  return path8__default.default.resolve(
     options.cwd ?? process.cwd(),
     ".agent-inspect",
     DEFAULT_STUDIO_DB_FILENAME
@@ -174,7 +320,7 @@ function openStudioDb(dbPath) {
       "Postgres studio databases are not implemented in v6.0.0; use a SQLite file path."
     );
   }
-  const dir = path5__default.default.dirname(dbPath);
+  const dir = path8__default.default.dirname(dbPath);
   void promises.mkdir(dir, { recursive: true });
   const db = new Database__default.default(dbPath);
   db.pragma("journal_mode = WAL");
@@ -258,18 +404,37 @@ function searchProjectRuns(db, projectId, query, limit = 50) {
        LIMIT ?`
   ).all(projectId, pattern, pattern, pattern, limit);
 }
+function findIngestFileBySourceKey(db, sourceKey) {
+  return db.prepare(
+    `SELECT source_key AS sourceKey, source_name AS sourceName, dest_path AS destPath,
+              kind, content_hash AS contentHash, imported_at AS importedAt
+       FROM ingest_files WHERE source_key = ?`
+  ).get(sourceKey);
+}
+function insertIngestFile(db, row) {
+  db.prepare(
+    `INSERT INTO ingest_files(source_key, source_name, dest_path, kind, content_hash, imported_at)
+     VALUES (@sourceKey, @sourceName, @destPath, @kind, @contentHash, @importedAt)
+     ON CONFLICT(source_key) DO UPDATE SET
+       source_name = excluded.source_name,
+       dest_path = excluded.dest_path,
+       kind = excluded.kind,
+       content_hash = excluded.content_hash,
+       imported_at = excluded.imported_at`
+  ).run(row);
+}
 
 // packages/studio/src/import.ts
 async function discoverSuiteConfigs(projectRoot, configured) {
   if (configured && configured.length > 0) {
-    return configured.map((rel) => path5__default.default.resolve(projectRoot, rel));
+    return configured.map((rel) => path8__default.default.resolve(projectRoot, rel));
   }
   const found = [];
   try {
     const entries = await promises.readdir(projectRoot);
     for (const entry of entries) {
       if (entry.endsWith(".suite.json")) {
-        found.push(path5__default.default.join(projectRoot, entry));
+        found.push(path8__default.default.join(projectRoot, entry));
       }
     }
   } catch {
@@ -279,7 +444,7 @@ async function discoverSuiteConfigs(projectRoot, configured) {
 async function loadProjectRuns(workspaceDir, traceDirs) {
   const runs = [];
   for (const rel of traceDirs) {
-    const traceDir = advanced.resolveTraceDir({ dir: path5__default.default.join(workspaceDir, rel) });
+    const traceDir = advanced.resolveTraceDir({ dir: path8__default.default.join(workspaceDir, rel) });
     const td = new advanced.TraceDirectory({ dir: traceDir });
     const files = await td.list();
     const metas = await advanced.loadTraceMetadataList(
@@ -293,7 +458,7 @@ async function loadProjectRuns(workspaceDir, traceDirs) {
         runId: meta.runId,
         ...meta.name !== void 0 ? { name: meta.name } : {},
         status: meta.status,
-        file: path5__default.default.basename(meta.filePath),
+        file: path8__default.default.basename(meta.filePath),
         ...meta.startedAt !== void 0 ? { startedAt: meta.startedAt } : {},
         ...meta.durationMs !== void 0 ? { durationMs: meta.durationMs } : {}
       });
@@ -302,7 +467,7 @@ async function loadProjectRuns(workspaceDir, traceDirs) {
   return runs.sort((a, b) => (b.startedAt ?? 0) - (a.startedAt ?? 0));
 }
 async function importStudioRegistry(options) {
-  const registryDir = path5__default.default.dirname(options.registryPath);
+  const registryDir = path8__default.default.dirname(options.registryPath);
   const warnings = [];
   const projects = [];
   const importedAt = (/* @__PURE__ */ new Date()).toISOString();
@@ -363,18 +528,242 @@ async function importStudioProject(options) {
 }
 async function resolveStudioRegistryPath(options) {
   if (options.workspacePath && options.workspacePath.trim() !== "") {
-    return path5__default.default.resolve(options.cwd ?? process.cwd(), options.workspacePath);
+    return path8__default.default.resolve(options.cwd ?? process.cwd(), options.workspacePath);
   }
-  const cwd = path5__default.default.resolve(options.cwd ?? process.cwd());
+  const cwd = path8__default.default.resolve(options.cwd ?? process.cwd());
   for (const rel of STUDIO_REGISTRY_FILENAMES) {
-    const candidate = path5__default.default.join(cwd, rel);
+    const candidate = path8__default.default.join(cwd, rel);
     try {
       await promises.access(candidate);
       return candidate;
     } catch {
     }
   }
-  return path5__default.default.join(cwd, STUDIO_REGISTRY_FILENAMES[0]);
+  return path8__default.default.join(cwd, STUDIO_REGISTRY_FILENAMES[0]);
+}
+function resolveImportDirs(registryPath, registry) {
+  const registryDir = path8__default.default.dirname(registryPath);
+  const importConfig = registry.import ?? {};
+  const fileDropDir = importConfig.fileDropDir ?? "imports/drop";
+  const ciArtifactsDir = importConfig.ciArtifactsDir ?? "imports/ci";
+  const bundlesDir = importConfig.bundlesDir ?? "imports/bundles";
+  return {
+    registryDir,
+    fileDropDir: resolveUnderRoot(registryDir, fileDropDir),
+    ciArtifactsDir: resolveUnderRoot(registryDir, ciArtifactsDir),
+    bundlesDir: resolveUnderRoot(registryDir, bundlesDir)
+  };
+}
+function uniqueDestPath(destDir, fileName, contentHash) {
+  const ext = path8__default.default.extname(fileName);
+  const base = path8__default.default.basename(fileName, ext);
+  const shortHash = contentHash.slice(0, 8);
+  return path8__default.default.join(destDir, `${base}-${shortHash}${ext}`);
+}
+function sanitizeSafeErrorMessage(message, secret) {
+  if (!secret || secret.length < 4) return message;
+  return message.split(secret).join("[redacted]");
+}
+function parseGitHubRepo(repo) {
+  const trimmed = repo.trim();
+  const match = /^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)$/.exec(trimmed);
+  if (!match) {
+    throw new Error("repo must be in owner/name format");
+  }
+  return { owner: match[1], name: match[2] };
+}
+function buildGitHubArtifactSourceKey(options) {
+  return `github:${options.owner}/${options.repo}/runs/${options.runId}/${options.artifactName}`;
+}
+
+// packages/studio/src/ingest/file-drop.ts
+var FILE_DROP_ARCHIVE_DIR = ".imported";
+var CI_EXTENSIONS = [".jsonl", ".suite.json"];
+var BUNDLE_EXTENSIONS = [".tgz", ".zip"];
+function classifyFile(fileName) {
+  const lower = fileName.toLowerCase();
+  if (CI_EXTENSIONS.some((ext) => lower.endsWith(ext))) return "ci";
+  if (BUNDLE_EXTENSIONS.some((ext) => lower.endsWith(ext))) return "bundle";
+  return void 0;
+}
+async function hashFile(filePath) {
+  const data = await promises.readFile(filePath);
+  return crypto.createHash("sha256").update(data).digest("hex");
+}
+async function importOneFile(options) {
+  const destPath = uniqueDestPath(options.destDir, options.fileName, options.contentHash);
+  assertPathUnderRoot(destPath, path8__default.default.dirname(options.destDir));
+  await promises.mkdir(options.destDir, { recursive: true });
+  await promises.copyFile(options.sourcePath, destPath);
+  insertIngestFile(options.db, {
+    sourceKey: options.sourceKey,
+    sourceName: options.fileName,
+    destPath,
+    kind: options.kind,
+    contentHash: options.contentHash,
+    importedAt: options.importedAt
+  });
+  let archived = false;
+  if (options.archiveAfterImport) {
+    await promises.mkdir(options.archiveDir, { recursive: true });
+    const archiveTarget = path8__default.default.join(options.archiveDir, options.fileName);
+    await promises.rename(options.sourcePath, archiveTarget);
+    archived = true;
+  }
+  return {
+    sourceKey: options.sourceKey,
+    sourceName: options.fileName,
+    destPath,
+    kind: options.kind,
+    contentHash: options.contentHash,
+    archived
+  };
+}
+async function importFileDrop(options) {
+  const warnings = [];
+  const errors = [];
+  const files = [];
+  if (!options.enabled) {
+    return {
+      skipped: true,
+      reason: "file-drop ingest is disabled; pass --ingest file-drop or use studio import drop",
+      scanned: 0,
+      imported: 0,
+      skippedFiles: 0,
+      errors,
+      warnings,
+      files
+    };
+  }
+  const dirs = resolveImportDirs(options.registryPath, options.registry);
+  let dropDir;
+  try {
+    dropDir = options.dropDir ? path8__default.default.isAbsolute(options.dropDir) ? (assertPathUnderRoot(options.dropDir, dirs.registryDir), options.dropDir) : resolveUnderRoot(dirs.registryDir, options.dropDir) : dirs.fileDropDir;
+    assertPathUnderRoot(dropDir, dirs.registryDir);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return {
+      skipped: false,
+      scanned: 0,
+      imported: 0,
+      skippedFiles: 0,
+      errors: [message],
+      warnings,
+      files
+    };
+  }
+  let entries;
+  try {
+    entries = await promises.readdir(dropDir);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return {
+      skipped: false,
+      scanned: 0,
+      imported: 0,
+      skippedFiles: 0,
+      errors: [`unable to read file-drop directory: ${message}`],
+      warnings,
+      files
+    };
+  }
+  const importedAt = (/* @__PURE__ */ new Date()).toISOString();
+  const archiveDir = path8__default.default.join(dropDir, FILE_DROP_ARCHIVE_DIR);
+  let scanned = 0;
+  let imported = 0;
+  let skippedFiles = 0;
+  for (const entry of entries.sort()) {
+    if (entry === FILE_DROP_ARCHIVE_DIR || entry.startsWith(".")) continue;
+    const sourcePath = path8__default.default.join(dropDir, entry);
+    let fileStat;
+    try {
+      fileStat = await promises.stat(sourcePath);
+    } catch {
+      warnings.push(`skipped unreadable entry: ${entry}`);
+      continue;
+    }
+    if (!fileStat.isFile()) continue;
+    const kind = classifyFile(entry);
+    if (!kind) continue;
+    scanned += 1;
+    const sourceKey = entry;
+    let contentHash;
+    try {
+      contentHash = await hashFile(sourcePath);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      errors.push(`failed to read ${entry}: ${message}`);
+      continue;
+    }
+    const existing = findIngestFileBySourceKey(options.db, sourceKey);
+    if (existing && existing.contentHash === contentHash) {
+      skippedFiles += 1;
+      continue;
+    }
+    const destDir = kind === "ci" ? dirs.ciArtifactsDir : dirs.bundlesDir;
+    try {
+      const importedFile = await importOneFile({
+        db: options.db,
+        sourcePath,
+        sourceKey,
+        fileName: entry,
+        kind,
+        destDir,
+        archiveAfterImport: options.archiveAfterImport === true,
+        archiveDir,
+        importedAt,
+        contentHash
+      });
+      files.push(importedFile);
+      imported += 1;
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      errors.push(`failed to import ${entry}: ${message}`);
+    }
+  }
+  return {
+    skipped: false,
+    scanned,
+    imported,
+    skippedFiles,
+    errors,
+    warnings,
+    files
+  };
+}
+async function importFileDropFromRegistry(options) {
+  return importFileDrop({
+    db: options.db,
+    registryPath: options.registryPath,
+    registry: options.registry,
+    enabled: options.enabled,
+    ...options.dropDir !== void 0 ? { dropDir: options.dropDir } : {},
+    ...options.archiveAfterImport !== void 0 ? { archiveAfterImport: options.archiveAfterImport } : {}
+  });
+}
+async function runStudioFileDropImport(options) {
+  const cwd = options.cwd ?? process.cwd();
+  const registryPath = await resolveStudioRegistryPath({
+    ...options.workspacePath !== void 0 ? { workspacePath: options.workspacePath } : {},
+    cwd
+  });
+  const registryRead = await readStudioRegistryFile(registryPath);
+  if (!registryRead.ok || registryRead.registry === void 0) {
+    throw new Error(registryRead.errors.join("; ") || "invalid studio registry");
+  }
+  const dbPath = resolveStudioDbPath({
+    ...options.dbPath !== void 0 ? { dbPath: options.dbPath } : {},
+    cwd
+  });
+  const db = openStudioDb(dbPath);
+  return importFileDropFromRegistry({
+    db,
+    registryPath,
+    registry: registryRead.registry,
+    enabled: true,
+    ...options.dropDir !== void 0 ? { dropDir: options.dropDir } : {},
+    ...options.archiveAfterImport !== void 0 ? { archiveAfterImport: options.archiveAfterImport } : {}
+  });
 }
 
 // packages/studio/src/context.ts
@@ -398,12 +787,23 @@ async function createStudioContext(options = {}) {
     registry: registryRead.registry,
     registryPath
   });
+  let fileDropResult;
+  if (options.ingestFileDrop === true) {
+    fileDropResult = await importFileDropFromRegistry({
+      db,
+      registryPath,
+      registry: registryRead.registry,
+      enabled: true,
+      ...options.archiveFileDrop === true ? { archiveAfterImport: true } : {}
+    });
+  }
   return {
     db,
     dbPath,
     registryPath,
     registry: registryRead.registry,
     importResult,
+    ...fileDropResult !== void 0 ? { fileDropResult } : {},
     projects: importResult.projects
   };
 }
@@ -417,6 +817,158 @@ function summarizeProjects(projects) {
     importedAt: project.importedAt
   }));
 }
+var DEFAULT_INGEST_TOKEN_ENV = "STUDIO_INGEST_TOKEN";
+function resolveIngestTokenEnv(options) {
+  const envName = options.tokenEnv?.trim() || options.registryTokenEnv?.trim() || DEFAULT_INGEST_TOKEN_ENV;
+  if (!/^[A-Z][A-Z0-9_]*$/.test(envName)) {
+    throw new Error("ingest token env name must be an uppercase identifier");
+  }
+  return envName;
+}
+function resolveIngestToken(envName) {
+  const token = process.env[envName]?.trim();
+  return token && token.length > 0 ? token : void 0;
+}
+function extractIngestTokenFromRequest(headers) {
+  const headerToken = firstHeader(headers["x-agentinspect-token"]) ?? firstHeader(headers["x-agent-inspect-token"]);
+  if (headerToken) return headerToken;
+  const auth = firstHeader(headers.authorization);
+  if (auth?.startsWith("Bearer ")) {
+    const token = auth.slice("Bearer ".length).trim();
+    return token.length > 0 ? token : void 0;
+  }
+  return void 0;
+}
+function firstHeader(value) {
+  if (Array.isArray(value)) return value[0]?.trim();
+  return value?.trim();
+}
+function isIngestTokenValid(provided, expected) {
+  if (!provided || !expected) return false;
+  const providedBuf = Buffer.from(provided);
+  const expectedBuf = Buffer.from(expected);
+  if (providedBuf.length !== expectedBuf.length) return false;
+  return crypto.timingSafeEqual(providedBuf, expectedBuf);
+}
+
+// packages/studio/src/ingest/http.ts
+var DEFAULT_HTTP_INGEST_BASE_PATH = "/api/ingest";
+var HTTP_INGEST_BUNDLE_PATH = "/api/ingest/bundle";
+var HTTP_INGEST_ARTIFACT_PATH = "/api/ingest/artifact";
+var DEFAULT_MAX_INGEST_BYTES = 52428800;
+function resolveHttpIngestConfig(options, registryEnabled) {
+  const http = options.context?.registry.ingest?.http;
+  const enabled = options.ingestHttp === true || registryEnabled === true || http?.enabled === true;
+  const basePath = (http?.path ?? DEFAULT_HTTP_INGEST_BASE_PATH).trim() || DEFAULT_HTTP_INGEST_BASE_PATH;
+  const tokenEnv = resolveIngestTokenEnv({
+    ...options.ingestTokenEnv !== void 0 ? { tokenEnv: options.ingestTokenEnv } : {},
+    ...http?.tokenEnv !== void 0 ? { registryTokenEnv: http.tokenEnv } : {}
+  });
+  const maxBytes = http?.maxBytes ?? DEFAULT_MAX_INGEST_BYTES;
+  return { enabled, basePath, tokenEnv, maxBytes };
+}
+function sendJson(res, status, body) {
+  res.writeHead(status, {
+    "content-type": "application/json; charset=utf-8",
+    "cache-control": "no-store"
+  });
+  res.end(JSON.stringify(body));
+}
+async function readBoundedRequestBody(req, maxBytes) {
+  const chunks = [];
+  let total = 0;
+  for await (const chunk of req) {
+    const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+    total += buf.length;
+    if (total > maxBytes) {
+      throw new Error("request body exceeds size limit");
+    }
+    chunks.push(buf);
+  }
+  return Buffer.concat(chunks);
+}
+function isHttpIngestRoute(pathname, config) {
+  return pathname === HTTP_INGEST_BUNDLE_PATH || pathname === HTTP_INGEST_ARTIFACT_PATH || pathname === `${config.basePath}/bundle` || pathname === `${config.basePath}/artifact`;
+}
+async function handleHttpIngestRequest(req, res, ctx, options, pathname) {
+  const config = resolveHttpIngestConfig(options, ctx.registry.ingest?.http?.enabled);
+  if (!isHttpIngestRoute(pathname, config)) return false;
+  if (!config.enabled) {
+    sendJson(res, 404, { error: "HTTP ingest is disabled" });
+    return true;
+  }
+  if (req.method !== "POST") {
+    sendJson(res, 405, { error: "Method not allowed" });
+    return true;
+  }
+  const expectedToken = resolveIngestToken(config.tokenEnv);
+  const providedToken = extractIngestTokenFromRequest(req.headers);
+  if (!isIngestTokenValid(providedToken, expectedToken)) {
+    sendJson(res, 403, { error: "Invalid or missing ingest token" });
+    return true;
+  }
+  let body;
+  try {
+    body = await readBoundedRequestBody(req, config.maxBytes);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    const status = message.includes("size limit") ? 413 : 400;
+    sendJson(res, status, { error: sanitizeSafeErrorMessage(message, expectedToken) });
+    return true;
+  }
+  if (body.length === 0) {
+    sendJson(res, 400, { error: "Empty request body" });
+    return true;
+  }
+  try {
+    const isBundle = pathname === HTTP_INGEST_BUNDLE_PATH || pathname === `${config.basePath}/bundle`;
+    const isArtifact = pathname === HTTP_INGEST_ARTIFACT_PATH || pathname === `${config.basePath}/artifact`;
+    if (!isBundle && !isArtifact) {
+      sendJson(res, 404, { error: "Unknown ingest route" });
+      return true;
+    }
+    const dirs = resolveImportDirs(ctx.registryPath, ctx.registry);
+    const contentHash = crypto.createHash("sha256").update(body).digest("hex");
+    const importedAt = (/* @__PURE__ */ new Date()).toISOString();
+    const fileName = isBundle ? `http-bundle-${contentHash.slice(0, 8)}.bin` : `http-artifact-${contentHash.slice(0, 8)}.zip`;
+    const destDir = isBundle ? dirs.bundlesDir : dirs.ciArtifactsDir;
+    const destPath = uniqueDestPath(destDir, fileName, contentHash);
+    assertPathUnderRoot(destPath, dirs.registryDir);
+    await promises.mkdir(destDir, { recursive: true });
+    await promises.writeFile(destPath, body);
+    const sourceKey = isBundle ? `http:bundle:${contentHash}` : buildGitHubArtifactSourceKey({
+      owner: "http",
+      repo: "ingest",
+      runId: importedAt,
+      artifactName: fileName
+    });
+    insertIngestFile(ctx.db, {
+      sourceKey,
+      sourceName: fileName,
+      destPath,
+      kind: isBundle ? "bundle" : "ci",
+      contentHash,
+      importedAt
+    });
+    const registryImport = await importStudioRegistry({
+      db: ctx.db,
+      registry: ctx.registry,
+      registryPath: ctx.registryPath
+    });
+    sendJson(res, 200, {
+      ok: true,
+      imported: true,
+      kind: isBundle ? "bundle" : "artifact",
+      destPath,
+      warnings: registryImport.warnings
+    });
+    return true;
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    sendJson(res, 500, { error: sanitizeSafeErrorMessage(message, expectedToken) });
+    return true;
+  }
+}
 
 // packages/studio/src/html.ts
 var studioIndexHtml = `<!DOCTYPE html>
@@ -462,7 +1014,7 @@ function getImportedProject(db, projects, projectId) {
 async function loadTraceDirMetas(workspaceDir, traceDirs) {
   const metas = [];
   for (const rel of traceDirs) {
-    const traceDir = advanced.resolveTraceDir({ dir: path5__default.default.join(workspaceDir, rel) });
+    const traceDir = advanced.resolveTraceDir({ dir: path8__default.default.join(workspaceDir, rel) });
     const td = new advanced.TraceDirectory({ dir: traceDir });
     const files = await td.list();
     const listed = await advanced.loadTraceMetadataList(
@@ -491,7 +1043,7 @@ async function loadProjectSuitesView(ctx) {
     try {
       const result = await advanced.runSuite({
         configPath,
-        cwd: path5__default.default.dirname(configPath)
+        cwd: path8__default.default.dirname(configPath)
       });
       suites.push({
         suiteName: result.suiteName,
@@ -509,7 +1061,7 @@ async function loadProjectSuitesView(ctx) {
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
       suites.push({
-        suiteName: path5__default.default.basename(configPath),
+        suiteName: path8__default.default.basename(configPath),
         configPath,
         ok: false,
         status: "error",
@@ -558,7 +1110,7 @@ async function loadProjectSearchView(ctx, db, params) {
   }
   const metas = await loadTraceDirMetas(ctx.project.workspaceDir, ["runs"]);
   const traceDir = advanced.resolveTraceDir({
-    dir: path5__default.default.join(ctx.project.workspaceDir, "runs")
+    dir: path8__default.default.join(ctx.project.workspaceDir, "runs")
   });
   const results = await advanced.searchTraces(metas, {
     traceDir,
@@ -602,12 +1154,12 @@ async function loadProjectDiffView(ctx, params) {
   };
 }
 async function loadProjectReportsView(ctx) {
-  const reportsDir = path5__default.default.join(ctx.project.workspaceDir, "reports");
+  const reportsDir = path8__default.default.join(ctx.project.workspaceDir, "reports");
   const reports = [];
   try {
     const files = await promises.readdir(reportsDir);
     for (const file of files) {
-      const filePath = path5__default.default.join(reportsDir, file);
+      const filePath = path8__default.default.join(reportsDir, file);
       const info = await promises.stat(filePath);
       if (!info.isFile()) continue;
       reports.push({ name: file, path: filePath, sizeBytes: info.size });
@@ -662,7 +1214,7 @@ async function loadBundleExportView(ctx, params) {
     runId,
     readOnly: true,
     redactionProfile: ctx.project.redactionProfile ?? "share",
-    cliHint: `npx agent-inspect bundle ${runId} --profile ${ctx.project.redactionProfile ?? "share"} --dir ${path5__default.default.join(ctx.project.workspaceDir, "runs")}`,
+    cliHint: `npx agent-inspect bundle ${runId} --profile ${ctx.project.redactionProfile ?? "share"} --dir ${path8__default.default.join(ctx.project.workspaceDir, "runs")}`,
     note: "Studio does not mutate traces or upload bundles. Run the CLI locally to assemble a share-safe bundle."
   };
 }
@@ -706,7 +1258,7 @@ function studioAuthRequiredResponse() {
 }
 
 // packages/studio/src/routes.ts
-function sendJson(res, status, body, headers = {}) {
+function sendJson2(res, status, body, headers = {}) {
   const payload = JSON.stringify(body);
   res.writeHead(status, {
     "content-type": "application/json; charset=utf-8",
@@ -716,7 +1268,7 @@ function sendJson(res, status, body, headers = {}) {
   res.end(payload);
 }
 function notFound(res, message) {
-  sendJson(res, 404, { error: message });
+  sendJson2(res, 404, { error: message });
 }
 function decodeSegment(segment) {
   if (!segment) return "";
@@ -729,11 +1281,11 @@ function decodeSegment(segment) {
 async function handleStudioRoute(req, res, ctx, options, pathname, url) {
   if (!isStudioRequestAuthorized(req, options)) {
     const auth = studioAuthRequiredResponse();
-    sendJson(res, auth.status, auth.body, auth.headers);
+    sendJson2(res, auth.status, auth.body, auth.headers);
     return true;
   }
   if (pathname === "/api/health") {
-    sendJson(res, 200, {
+    sendJson2(res, 200, {
       ok: true,
       readOnly: true,
       mode: "studio",
@@ -746,7 +1298,7 @@ async function handleStudioRoute(req, res, ctx, options, pathname, url) {
     return true;
   }
   if (pathname === "/api/projects") {
-    sendJson(res, 200, {
+    sendJson2(res, 200, {
       registryName: ctx.registry.name,
       projects: summarizeProjects(ctx.projects),
       warnings: ctx.importResult.warnings
@@ -763,56 +1315,56 @@ async function handleStudioRoute(req, res, ctx, options, pathname, url) {
       return true;
     }
     if (subpath === "runs" || subpath === "") {
-      sendJson(res, 200, {
+      sendJson2(res, 200, {
         projectId,
         runs: await loadProjectRunsView(projectCtx, ctx.db)
       });
       return true;
     }
     if (subpath === "sessions") {
-      sendJson(res, 200, {
+      sendJson2(res, 200, {
         projectId,
         ...await loadProjectSessionsView(projectCtx)
       });
       return true;
     }
     if (subpath === "suites") {
-      sendJson(res, 200, {
+      sendJson2(res, 200, {
         projectId,
         ...await loadProjectSuitesView(projectCtx)
       });
       return true;
     }
     if (subpath === "checks") {
-      sendJson(res, 200, {
+      sendJson2(res, 200, {
         projectId,
         ...await loadProjectChecksView(projectCtx)
       });
       return true;
     }
     if (subpath === "observations") {
-      sendJson(res, 200, {
+      sendJson2(res, 200, {
         projectId,
         ...await loadProjectObservationsView(projectCtx)
       });
       return true;
     }
     if (subpath === "guardrails") {
-      sendJson(res, 200, {
+      sendJson2(res, 200, {
         projectId,
         ...await loadProjectGuardrailsView(projectCtx)
       });
       return true;
     }
     if (subpath === "redaction") {
-      sendJson(res, 200, {
+      sendJson2(res, 200, {
         projectId,
         ...await loadProjectRedactionView(projectCtx)
       });
       return true;
     }
     if (subpath === "reports") {
-      sendJson(res, 200, {
+      sendJson2(res, 200, {
         projectId,
         ...await loadProjectReportsView(projectCtx)
       });
@@ -824,7 +1376,7 @@ async function handleStudioRoute(req, res, ctx, options, pathname, url) {
   if (pathname === "/api/search") {
     const projectId = url.searchParams.get("projectId");
     if (!projectId) {
-      sendJson(res, 400, { error: "projectId query parameter is required." });
+      sendJson2(res, 400, { error: "projectId query parameter is required." });
       return true;
     }
     const projectCtx = getImportedProject(ctx.db, ctx.projects, projectId);
@@ -832,7 +1384,7 @@ async function handleStudioRoute(req, res, ctx, options, pathname, url) {
       notFound(res, `Project not found: ${projectId}`);
       return true;
     }
-    sendJson(res, 200, {
+    sendJson2(res, 200, {
       projectId,
       ...await loadProjectSearchView(projectCtx, ctx.db, url.searchParams)
     });
@@ -841,7 +1393,7 @@ async function handleStudioRoute(req, res, ctx, options, pathname, url) {
   if (pathname === "/api/diff") {
     const projectId = url.searchParams.get("projectId");
     if (!projectId) {
-      sendJson(res, 400, { error: "projectId query parameter is required." });
+      sendJson2(res, 400, { error: "projectId query parameter is required." });
       return true;
     }
     const projectCtx = getImportedProject(ctx.db, ctx.projects, projectId);
@@ -850,20 +1402,20 @@ async function handleStudioRoute(req, res, ctx, options, pathname, url) {
       return true;
     }
     try {
-      sendJson(res, 200, {
+      sendJson2(res, 200, {
         projectId,
         ...await loadProjectDiffView(projectCtx, url.searchParams)
       });
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
-      sendJson(res, 400, { error: message });
+      sendJson2(res, 400, { error: message });
     }
     return true;
   }
   if (pathname === "/api/reports") {
     const projectId = url.searchParams.get("projectId");
     if (!projectId) {
-      sendJson(res, 400, { error: "projectId query parameter is required." });
+      sendJson2(res, 400, { error: "projectId query parameter is required." });
       return true;
     }
     const projectCtx = getImportedProject(ctx.db, ctx.projects, projectId);
@@ -871,7 +1423,7 @@ async function handleStudioRoute(req, res, ctx, options, pathname, url) {
       notFound(res, `Project not found: ${projectId}`);
       return true;
     }
-    sendJson(res, 200, {
+    sendJson2(res, 200, {
       projectId,
       ...await loadProjectReportsView(projectCtx)
     });
@@ -880,7 +1432,7 @@ async function handleStudioRoute(req, res, ctx, options, pathname, url) {
   if (pathname === "/api/bundles/export") {
     const projectId = url.searchParams.get("projectId");
     if (!projectId) {
-      sendJson(res, 400, { error: "projectId query parameter is required." });
+      sendJson2(res, 400, { error: "projectId query parameter is required." });
       return true;
     }
     const projectCtx = getImportedProject(ctx.db, ctx.projects, projectId);
@@ -889,10 +1441,10 @@ async function handleStudioRoute(req, res, ctx, options, pathname, url) {
       return true;
     }
     try {
-      sendJson(res, 200, await loadBundleExportView(projectCtx, url.searchParams));
+      sendJson2(res, 200, await loadBundleExportView(projectCtx, url.searchParams));
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
-      sendJson(res, 400, { error: message });
+      sendJson2(res, 400, { error: message });
     }
     return true;
   }
@@ -931,15 +1483,21 @@ function createStudioServer(options = {}) {
   }
   const server = http.createServer(async (req, res) => {
     try {
-      if (req.method !== "GET" && req.method !== "HEAD") {
-        return badRequest(res, "Only GET is supported.");
-      }
+      const method = req.method ?? "GET";
+      const url = new URL(req.url ?? "/", `http://${host}:${port}`);
+      const pathname = url.pathname;
       if (!contextPromise) {
         contextPromise = createStudioContext(options);
       }
       const ctx = await contextPromise;
-      const url = new URL(req.url ?? "/", `http://${host}:${port}`);
-      const pathname = url.pathname;
+      const httpConfig = resolveHttpIngestConfig(options, ctx.registry.ingest?.http?.enabled);
+      if (isHttpIngestRoute(pathname, httpConfig)) {
+        const handled2 = await handleHttpIngestRequest(req, res, ctx, options, pathname);
+        if (handled2) return;
+      }
+      if (method !== "GET" && method !== "HEAD") {
+        return badRequest(res, "Only GET is supported.");
+      }
       if (pathname === "/" || pathname === "/index.html") {
         if (req.method === "HEAD") {
           res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
@@ -992,13 +1550,382 @@ async function startStudioServer(options = {}) {
     });
   });
 }
+var DEFAULT_GITHUB_TOKEN_ENV = "GITHUB_TOKEN";
+var GITHUB_API_BASE = "https://api.github.com";
+var MAX_ARTIFACT_BYTES = 52428800;
+function resolveTokenEnv(registry, override) {
+  const fromRegistry = registry.ingest?.github?.tokenEnv?.trim();
+  const envName = override?.trim() || fromRegistry || DEFAULT_GITHUB_TOKEN_ENV;
+  if (!/^[A-Z][A-Z0-9_]*$/.test(envName)) {
+    throw new Error("token env name must be an uppercase identifier");
+  }
+  return envName;
+}
+function resolveToken(envName) {
+  const token = process.env[envName]?.trim();
+  if (!token) {
+    throw new Error(`missing GitHub token in environment variable ${envName}`);
+  }
+  return token;
+}
+function githubHeaders(token) {
+  return {
+    Authorization: `Bearer ${token}`,
+    Accept: "application/vnd.github+json",
+    "X-GitHub-Api-Version": "2022-11-28",
+    "User-Agent": "agent-inspect-studio-ingest"
+  };
+}
+async function readResponseBody(response, maxBytes) {
+  const lengthHeader = response.headers.get("content-length");
+  if (lengthHeader) {
+    const length = Number(lengthHeader);
+    if (Number.isFinite(length) && length > maxBytes) {
+      throw new Error("artifact exceeds size limit");
+    }
+  }
+  const arrayBuffer = await response.arrayBuffer();
+  if (arrayBuffer.byteLength > maxBytes) {
+    throw new Error("artifact exceeds size limit");
+  }
+  return Buffer.from(arrayBuffer);
+}
+async function downloadGitHubArtifactArchive(options) {
+  const fetchFn = options.fetchImpl ?? fetch;
+  const { owner, name } = parseGitHubRepo(options.repo);
+  const runId = options.runId.trim();
+  const artifactName = options.artifactName.trim();
+  if (!/^\d+$/.test(runId)) {
+    throw new Error("run-id must be a numeric workflow run id");
+  }
+  if (artifactName === "") {
+    throw new Error("artifact name must be non-empty");
+  }
+  const listUrl = `${GITHUB_API_BASE}/repos/${owner}/${name}/actions/runs/${runId}/artifacts`;
+  const listResponse = await fetchFn(listUrl, {
+    headers: githubHeaders(options.token)
+  });
+  if (!listResponse.ok) {
+    throw new Error(`GitHub artifact lookup failed (${listResponse.status})`);
+  }
+  const payload = await listResponse.json();
+  const artifact = payload.artifacts?.find((item) => item.name === artifactName);
+  if (!artifact?.archive_download_url) {
+    throw new Error(`artifact not found for run ${runId}: ${artifactName}`);
+  }
+  if (artifact.expired === true) {
+    throw new Error(`artifact expired for run ${runId}: ${artifactName}`);
+  }
+  if (typeof artifact.size_in_bytes === "number" && artifact.size_in_bytes > MAX_ARTIFACT_BYTES) {
+    throw new Error("artifact exceeds size limit");
+  }
+  const downloadResponse = await fetchFn(artifact.archive_download_url, {
+    headers: githubHeaders(options.token),
+    redirect: "follow"
+  });
+  if (!downloadResponse.ok) {
+    throw new Error(`GitHub artifact download failed (${downloadResponse.status})`);
+  }
+  return readResponseBody(downloadResponse, MAX_ARTIFACT_BYTES);
+}
+async function importGitHubArtifact(options) {
+  const registryImportWarnings = [];
+  const errors = [];
+  if (!options.enabled) {
+    return {
+      skipped: true,
+      reason: "GitHub artifact ingest is disabled; use studio import github explicitly",
+      imported: false,
+      registryImportWarnings,
+      errors
+    };
+  }
+  let token;
+  let tokenEnv;
+  try {
+    const { owner, name } = parseGitHubRepo(options.repo);
+    tokenEnv = resolveTokenEnv(options.registry, options.tokenEnv);
+    token = resolveToken(tokenEnv);
+    const sourceKey = buildGitHubArtifactSourceKey({
+      owner,
+      repo: name,
+      runId: options.runId,
+      artifactName: options.artifactName
+    });
+    const archive = await downloadGitHubArtifactArchive({
+      repo: options.repo,
+      runId: options.runId,
+      artifactName: options.artifactName,
+      token,
+      ...options.fetchImpl !== void 0 ? { fetchImpl: options.fetchImpl } : {}
+    });
+    const contentHash = crypto.createHash("sha256").update(archive).digest("hex");
+    const existing = findIngestFileBySourceKey(options.db, sourceKey);
+    if (existing && existing.contentHash === contentHash) {
+      return {
+        skipped: false,
+        imported: false,
+        sourceKey,
+        contentHash,
+        destPath: existing.destPath,
+        registryImportWarnings,
+        errors
+      };
+    }
+    const dirs = resolveImportDirs(options.registryPath, options.registry);
+    const fileName = `${options.artifactName}.zip`;
+    const destPath = uniqueDestPath(dirs.bundlesDir, fileName, contentHash);
+    assertPathUnderRoot(destPath, dirs.registryDir);
+    await promises.mkdir(dirs.bundlesDir, { recursive: true });
+    await promises.writeFile(destPath, archive);
+    const importedAt = (/* @__PURE__ */ new Date()).toISOString();
+    insertIngestFile(options.db, {
+      sourceKey,
+      sourceName: fileName,
+      destPath,
+      kind: "bundle",
+      contentHash,
+      importedAt
+    });
+    const registryImport = await importStudioRegistry({
+      db: options.db,
+      registry: options.registry,
+      registryPath: options.registryPath
+    });
+    registryImportWarnings.push(...registryImport.warnings);
+    return {
+      skipped: false,
+      imported: true,
+      sourceKey,
+      contentHash,
+      destPath,
+      registryImportWarnings,
+      errors
+    };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    errors.push(sanitizeSafeErrorMessage(message, token));
+    return {
+      skipped: false,
+      imported: false,
+      registryImportWarnings,
+      errors
+    };
+  }
+}
+async function runStudioGitHubArtifactImport(options) {
+  const cwd = options.cwd ?? process.cwd();
+  const registryPath = await resolveStudioRegistryPath({
+    ...options.workspacePath !== void 0 ? { workspacePath: options.workspacePath } : {},
+    cwd
+  });
+  const registryRead = await readStudioRegistryFile(registryPath);
+  if (!registryRead.ok || registryRead.registry === void 0) {
+    throw new Error(registryRead.errors.join("; ") || "invalid studio registry");
+  }
+  const dbPath = resolveStudioDbPath({
+    ...options.dbPath !== void 0 ? { dbPath: options.dbPath } : {},
+    cwd
+  });
+  const db = openStudioDb(dbPath);
+  return importGitHubArtifact({
+    db,
+    registryPath,
+    registry: registryRead.registry,
+    repo: options.repo,
+    runId: options.runId,
+    artifactName: options.artifact,
+    enabled: true,
+    ...options.tokenEnv !== void 0 ? { tokenEnv: options.tokenEnv } : {},
+    ...options.fetchImpl !== void 0 ? { fetchImpl: options.fetchImpl } : {}
+  });
+}
+async function pathExists(filePath) {
+  try {
+    await promises.access(filePath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function validateBundleDirectory(bundleDir) {
+  const errors = [];
+  const metadataPath = path8__default.default.join(bundleDir, "metadata.json");
+  if (!await pathExists(metadataPath)) {
+    errors.push("bundle missing metadata.json");
+    return errors;
+  }
+  try {
+    const raw = await promises.readFile(metadataPath, "utf8");
+    const parsed = JSON.parse(raw);
+    if (typeof parsed.agentInspectVersion !== "string") {
+      errors.push("bundle metadata.json missing agentInspectVersion");
+    }
+    if (!Array.isArray(parsed.runIds) || parsed.runIds.length === 0) {
+      errors.push("bundle metadata.json missing runIds");
+    }
+  } catch {
+    errors.push("bundle metadata.json is invalid JSON");
+  }
+  return errors;
+}
+async function copyDirectoryRecursive(sourceDir, destDir) {
+  await promises.mkdir(destDir, { recursive: true });
+  const entries = await promises.readdir(sourceDir, { withFileTypes: true });
+  for (const entry of entries) {
+    const from = path8__default.default.join(sourceDir, entry.name);
+    const to = path8__default.default.join(destDir, entry.name);
+    if (entry.isDirectory()) {
+      await copyDirectoryRecursive(from, to);
+    } else if (entry.isFile()) {
+      await promises.copyFile(from, to);
+    }
+  }
+}
+async function importBundleUpload(options) {
+  const registryImportWarnings = [];
+  const errors = [];
+  if (!options.enabled) {
+    return {
+      skipped: true,
+      reason: "bundle upload ingest is disabled; use studio import bundle explicitly",
+      imported: false,
+      errors,
+      registryImportWarnings
+    };
+  }
+  const bundlePath = path8__default.default.resolve(options.bundlePath);
+  let bundleStat;
+  try {
+    bundleStat = await promises.stat(bundlePath);
+  } catch {
+    return {
+      skipped: false,
+      imported: false,
+      errors: ["bundle path does not exist"],
+      registryImportWarnings
+    };
+  }
+  if (!bundleStat.isDirectory()) {
+    return {
+      skipped: false,
+      imported: false,
+      errors: ["bundle path must be a directory produced by agent-inspect bundle"],
+      registryImportWarnings
+    };
+  }
+  const validationErrors = await validateBundleDirectory(bundlePath);
+  if (validationErrors.length > 0) {
+    return {
+      skipped: false,
+      imported: false,
+      errors: validationErrors,
+      registryImportWarnings
+    };
+  }
+  const metadataRaw = await promises.readFile(path8__default.default.join(bundlePath, "metadata.json"), "utf8");
+  const contentHash = crypto.createHash("sha256").update(metadataRaw).digest("hex");
+  const sourceKey = `bundle:${bundlePath}`;
+  const existing = findIngestFileBySourceKey(options.db, sourceKey);
+  if (existing && existing.contentHash === contentHash) {
+    return {
+      skipped: false,
+      imported: false,
+      destPath: existing.destPath,
+      sourceKey,
+      errors,
+      registryImportWarnings
+    };
+  }
+  const dirs = resolveImportDirs(options.registryPath, options.registry);
+  const folderName = path8__default.default.basename(bundlePath);
+  const destPath = uniqueDestPath(dirs.bundlesDir, folderName, contentHash);
+  assertPathUnderRoot(destPath, dirs.registryDir);
+  try {
+    await copyDirectoryRecursive(bundlePath, destPath);
+    insertIngestFile(options.db, {
+      sourceKey,
+      sourceName: folderName,
+      destPath,
+      kind: "bundle",
+      contentHash,
+      importedAt: (/* @__PURE__ */ new Date()).toISOString()
+    });
+    const registryImport = await importStudioRegistry({
+      db: options.db,
+      registry: options.registry,
+      registryPath: options.registryPath
+    });
+    registryImportWarnings.push(...registryImport.warnings);
+    return {
+      skipped: false,
+      imported: true,
+      destPath,
+      sourceKey,
+      errors,
+      registryImportWarnings
+    };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return {
+      skipped: false,
+      imported: false,
+      errors: [message],
+      registryImportWarnings
+    };
+  }
+}
+async function runStudioBundleUploadImport(options) {
+  const cwd = options.cwd ?? process.cwd();
+  const registryPath = await resolveStudioRegistryPath({
+    ...options.workspacePath !== void 0 ? { workspacePath: options.workspacePath } : {},
+    cwd
+  });
+  const registryRead = await readStudioRegistryFile(registryPath);
+  if (!registryRead.ok || registryRead.registry === void 0) {
+    throw new Error(registryRead.errors.join("; ") || "invalid studio registry");
+  }
+  const dbPath = resolveStudioDbPath({
+    ...options.dbPath !== void 0 ? { dbPath: options.dbPath } : {},
+    cwd
+  });
+  const db = openStudioDb(dbPath);
+  return importBundleUpload({
+    db,
+    registryPath,
+    registry: registryRead.registry,
+    bundlePath: options.bundlePath,
+    enabled: true
+  });
+}
 
+exports.HTTP_INGEST_ARTIFACT_PATH = HTTP_INGEST_ARTIFACT_PATH;
+exports.HTTP_INGEST_BUNDLE_PATH = HTTP_INGEST_BUNDLE_PATH;
 exports.createStudioContext = createStudioContext;
 exports.createStudioServer = createStudioServer;
+exports.downloadGitHubArtifactArchive = downloadGitHubArtifactArchive;
+exports.extractIngestTokenFromRequest = extractIngestTokenFromRequest;
+exports.handleHttpIngestRequest = handleHttpIngestRequest;
+exports.importBundleUpload = importBundleUpload;
+exports.importFileDrop = importFileDrop;
+exports.importFileDropFromRegistry = importFileDropFromRegistry;
+exports.importGitHubArtifact = importGitHubArtifact;
+exports.isHttpIngestRoute = isHttpIngestRoute;
+exports.isIngestTokenValid = isIngestTokenValid;
+exports.openStudioDb = openStudioDb;
 exports.parseStudioRegistry = parseStudioRegistry;
 exports.readStudioRegistryFile = readStudioRegistryFile;
+exports.resolveHttpIngestConfig = resolveHttpIngestConfig;
+exports.resolveIngestToken = resolveIngestToken;
+exports.resolveIngestTokenEnv = resolveIngestTokenEnv;
+exports.resolveStudioDbPath = resolveStudioDbPath;
+exports.resolveStudioRegistryPath = resolveStudioRegistryPath;
+exports.runStudioBundleUploadImport = runStudioBundleUploadImport;
+exports.runStudioFileDropImport = runStudioFileDropImport;
+exports.runStudioGitHubArtifactImport = runStudioGitHubArtifactImport;
 exports.startStudioServer = startStudioServer;
 exports.studioIndexHtml = studioIndexHtml;
 exports.summarizeProjects = summarizeProjects;
+exports.validateBundleDirectory = validateBundleDirectory;
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map