@agent-inspect/studio 6.0.0 → 6.3.0

package/dist/index.mjs

@@ -1,14 +1,35 @@
-import { readFile, access, mkdir, readdir, stat } from 'fs/promises';
-import path5 from 'path';
+import { readFile, mkdir, access, readdir, stat, writeFile, copyFile, rename } from 'fs/promises';
+import path8 from 'path';
 import { loadSessionRunRecords, buildSessionIndex, runSuite, buildRunTimeline, extractOutcomesFromTraceEvents, resolveTraceDir, searchTraces, TraceDirectory, loadTraceMetadataList } from 'agent-inspect/advanced';
 import { resolveWorkspaceLocation, readWorkspaceManifestFile } from 'agent-inspect/workspace';
 import Database from 'better-sqlite3';
+import { timingSafeEqual, createHash } from 'crypto';
 import { createServer } from 'http';
 import { runTraceChecks, createRunStatusRule } from 'agent-inspect/checks';
 import { diffRuns, manualTraceEventsToComparableRun } from 'agent-inspect/diff';
 import { persistedInspectEventsToTraceEvents } from 'agent-inspect/persisted';
 import { openTrace } from 'agent-inspect/readers';
 
+// packages/studio/src/registry.ts
+function isSafeRelativePath(p) {
+  const trimmed = p.trim();
+  if (trimmed === "" || trimmed.startsWith("/") || trimmed.startsWith("\\")) return false;
+  if (/^[a-zA-Z]:/.test(trimmed)) return false;
+  return !trimmed.split(/[/\\]+/).some((seg) => seg === "..");
+}
+function resolveUnderRoot(root, ...segments) {
+  const resolvedRoot = path8.resolve(root);
+  const resolved = path8.resolve(resolvedRoot, ...segments);
+  assertPathUnderRoot(resolved, resolvedRoot);
+  return resolved;
+}
+function assertPathUnderRoot(resolved, root) {
+  const rel = path8.relative(path8.resolve(root), path8.resolve(resolved));
+  if (rel.startsWith("..") || path8.isAbsolute(rel)) {
+    throw new Error("path escapes allowed registry root");
+  }
+}
+
 // packages/studio/src/registry.ts
 var STUDIO_REGISTRY_SCHEMA_VERSION = "1.0";
 var STUDIO_REGISTRY_FILENAMES = [
@@ -19,16 +40,10 @@ var MAX_REGISTRY_BYTES = 256 * 1024;
 function isPlainObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function isSafeRelativePath(p) {
-  const trimmed = p.trim();
-  if (trimmed === "" || trimmed.startsWith("/") || trimmed.startsWith("\\")) return false;
-  if (/^[a-zA-Z]:/.test(trimmed)) return false;
-  return !trimmed.split(/[/\\]+/).some((seg) => seg === "..");
-}
 function parseStudioRegistry(input) {
   const errors = [];
   if (!isPlainObject(input)) {
-    return { ok: false, errors: ["registry must be a JSON object"] };
+    return { ok: false, errors: ["registry must be a JSON object"], warnings: [] };
   }
   if (input.schemaVersion !== STUDIO_REGISTRY_SCHEMA_VERSION) {
     errors.push(`schemaVersion must be "${STUDIO_REGISTRY_SCHEMA_VERSION}"`);
@@ -82,35 +97,157 @@ function parseStudioRegistry(input) {
           importConfig.bundlesDir = dir;
         }
       }
+      if (input.import.fileDropDir !== void 0) {
+        const dir = String(input.import.fileDropDir).trim();
+        if (!isSafeRelativePath(dir)) {
+          errors.push("import.fileDropDir must be a safe relative path");
+        } else {
+          importConfig.fileDropDir = dir;
+        }
+      }
+      if (input.import.enabled !== void 0) {
+        if (typeof input.import.enabled !== "boolean") {
+          errors.push("import.enabled must be a boolean");
+        } else {
+          importConfig.enabled = input.import.enabled;
+        }
+      }
     }
   }
-  if (errors.length > 0) return { ok: false, errors };
+  let ingestConfig;
+  const ingestWarnings = [];
+  if (input.ingest !== void 0) {
+    if (!isPlainObject(input.ingest)) {
+      errors.push("ingest must be an object");
+    } else {
+      ingestConfig = {};
+      if (input.ingest.github !== void 0) {
+        if (!isPlainObject(input.ingest.github)) {
+          errors.push("ingest.github must be an object");
+        } else {
+          const github = {};
+          if (input.ingest.github.enabled !== void 0) {
+            if (typeof input.ingest.github.enabled !== "boolean") {
+              errors.push("ingest.github.enabled must be a boolean");
+            } else {
+              github.enabled = input.ingest.github.enabled;
+            }
+          }
+          if (input.ingest.github.tokenEnv !== void 0) {
+            const tokenEnv = String(input.ingest.github.tokenEnv).trim();
+            if (!/^[A-Z][A-Z0-9_]*$/.test(tokenEnv)) {
+              errors.push("ingest.github.tokenEnv must be an uppercase env var name");
+            } else {
+              github.tokenEnv = tokenEnv;
+            }
+          }
+          ingestConfig.github = github;
+        }
+      }
+      if (input.ingest.http !== void 0) {
+        if (!isPlainObject(input.ingest.http)) {
+          errors.push("ingest.http must be an object");
+        } else {
+          const http = {};
+          if (input.ingest.http.enabled !== void 0) {
+            if (typeof input.ingest.http.enabled !== "boolean") {
+              errors.push("ingest.http.enabled must be a boolean");
+            } else {
+              http.enabled = input.ingest.http.enabled;
+            }
+          }
+          if (input.ingest.http.path !== void 0) {
+            const ingestPath = String(input.ingest.http.path).trim();
+            if (!ingestPath.startsWith("/") || ingestPath.includes("..")) {
+              errors.push("ingest.http.path must be an absolute safe path");
+            } else {
+              http.path = ingestPath;
+            }
+          }
+          if (input.ingest.http.tokenEnv !== void 0) {
+            const tokenEnv = String(input.ingest.http.tokenEnv).trim();
+            if (!/^[A-Z][A-Z0-9_]*$/.test(tokenEnv)) {
+              errors.push("ingest.http.tokenEnv must be an uppercase env var name");
+            } else {
+              http.tokenEnv = tokenEnv;
+            }
+          }
+          if (input.ingest.http.maxBytes !== void 0) {
+            const maxBytes = Number(input.ingest.http.maxBytes);
+            if (!Number.isInteger(maxBytes) || maxBytes <= 0) {
+              errors.push("ingest.http.maxBytes must be a positive integer");
+            } else {
+              http.maxBytes = maxBytes;
+            }
+          }
+          ingestConfig.http = http;
+        }
+      }
+      if (input.ingest.bundleUpload !== void 0) {
+        if (!isPlainObject(input.ingest.bundleUpload)) {
+          errors.push("ingest.bundleUpload must be an object");
+        } else {
+          const bundleUpload = {};
+          if (input.ingest.bundleUpload.enabled !== void 0) {
+            if (typeof input.ingest.bundleUpload.enabled !== "boolean") {
+              errors.push("ingest.bundleUpload.enabled must be a boolean");
+            } else {
+              bundleUpload.enabled = input.ingest.bundleUpload.enabled;
+            }
+          }
+          if (input.ingest.bundleUpload.maxBytes !== void 0) {
+            const maxBytes = Number(input.ingest.bundleUpload.maxBytes);
+            if (!Number.isInteger(maxBytes) || maxBytes <= 0) {
+              errors.push("ingest.bundleUpload.maxBytes must be a positive integer");
+            } else {
+              bundleUpload.maxBytes = maxBytes;
+            }
+          }
+          ingestConfig.bundleUpload = bundleUpload;
+        }
+      }
+      const knownIngestKeys = /* @__PURE__ */ new Set(["github", "http", "bundleUpload"]);
+      for (const key of Object.keys(input.ingest)) {
+        if (!knownIngestKeys.has(key)) {
+          ingestWarnings.push(`ignored unknown ingest key: ${key}`);
+        }
+      }
+    }
+  }
+  if (errors.length > 0) return { ok: false, errors, warnings: ingestWarnings };
   return {
     ok: true,
     registry: {
       schemaVersion: STUDIO_REGISTRY_SCHEMA_VERSION,
       name: String(input.name).trim(),
       projects,
-      ...importConfig ? { import: importConfig } : {}
+      ...importConfig ? { import: importConfig } : {},
+      ...ingestConfig ? { ingest: ingestConfig } : {}
     },
-    errors: []
+    errors: [],
+    warnings: ingestWarnings
   };
 }
 async function readStudioRegistryFile(filePath) {
   try {
     const raw = await readFile(filePath, "utf8");
     if (raw.length > MAX_REGISTRY_BYTES) {
-      return { ok: false, path: filePath, errors: ["registry file exceeds size limit"] };
+      return {
+        ok: false,
+        path: filePath,
+        errors: ["registry file exceeds size limit"],
+        warnings: []
+      };
     }
     const parsed = parseStudioRegistry(JSON.parse(raw));
     return { ...parsed, path: filePath };
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
-    return { ok: false, path: filePath, errors: [message] };
+    return { ok: false, path: filePath, errors: [message], warnings: [] };
   }
 }
 function resolveRegistryProjectPath(registryDir, projectPath) {
-  return path5.isAbsolute(projectPath) ? path5.resolve(projectPath) : path5.resolve(registryDir, projectPath);
+  return path8.isAbsolute(projectPath) ? path8.resolve(projectPath) : path8.resolve(registryDir, projectPath);
 }
 var STUDIO_DB_SCHEMA_VERSION = "1.0";
 var DEFAULT_STUDIO_DB_FILENAME = "studio.db";
@@ -143,6 +280,15 @@ CREATE TABLE IF NOT EXISTS runs (
 );
 CREATE INDEX IF NOT EXISTS idx_runs_project ON runs(project_id);
 CREATE INDEX IF NOT EXISTS idx_runs_status ON runs(status);
+CREATE TABLE IF NOT EXISTS ingest_files (
+  source_key TEXT PRIMARY KEY,
+  source_name TEXT NOT NULL,
+  dest_path TEXT NOT NULL,
+  kind TEXT NOT NULL CHECK(kind IN ('ci', 'bundle')),
+  content_hash TEXT NOT NULL,
+  imported_at TEXT NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_ingest_files_kind ON ingest_files(kind);
 `;
 function resolveStudioDbPath(options) {
   if (options.dbPath && options.dbPath.trim() !== "") {
@@ -150,9 +296,9 @@ function resolveStudioDbPath(options) {
     if (raw.startsWith("postgres://") || raw.startsWith("postgresql://")) {
       return raw;
     }
-    return path5.resolve(options.cwd ?? process.cwd(), raw);
+    return path8.resolve(options.cwd ?? process.cwd(), raw);
   }
-  return path5.resolve(
+  return path8.resolve(
     options.cwd ?? process.cwd(),
     ".agent-inspect",
     DEFAULT_STUDIO_DB_FILENAME
@@ -167,7 +313,7 @@ function openStudioDb(dbPath) {
       "Postgres studio databases are not implemented in v6.0.0; use a SQLite file path."
     );
   }
-  const dir = path5.dirname(dbPath);
+  const dir = path8.dirname(dbPath);
   void mkdir(dir, { recursive: true });
   const db = new Database(dbPath);
   db.pragma("journal_mode = WAL");
@@ -251,18 +397,37 @@ function searchProjectRuns(db, projectId, query, limit = 50) {
        LIMIT ?`
   ).all(projectId, pattern, pattern, pattern, limit);
 }
+function findIngestFileBySourceKey(db, sourceKey) {
+  return db.prepare(
+    `SELECT source_key AS sourceKey, source_name AS sourceName, dest_path AS destPath,
+              kind, content_hash AS contentHash, imported_at AS importedAt
+       FROM ingest_files WHERE source_key = ?`
+  ).get(sourceKey);
+}
+function insertIngestFile(db, row) {
+  db.prepare(
+    `INSERT INTO ingest_files(source_key, source_name, dest_path, kind, content_hash, imported_at)
+     VALUES (@sourceKey, @sourceName, @destPath, @kind, @contentHash, @importedAt)
+     ON CONFLICT(source_key) DO UPDATE SET
+       source_name = excluded.source_name,
+       dest_path = excluded.dest_path,
+       kind = excluded.kind,
+       content_hash = excluded.content_hash,
+       imported_at = excluded.imported_at`
+  ).run(row);
+}
 
 // packages/studio/src/import.ts
 async function discoverSuiteConfigs(projectRoot, configured) {
   if (configured && configured.length > 0) {
-    return configured.map((rel) => path5.resolve(projectRoot, rel));
+    return configured.map((rel) => path8.resolve(projectRoot, rel));
   }
   const found = [];
   try {
     const entries = await readdir(projectRoot);
     for (const entry of entries) {
       if (entry.endsWith(".suite.json")) {
-        found.push(path5.join(projectRoot, entry));
+        found.push(path8.join(projectRoot, entry));
       }
     }
   } catch {
@@ -272,7 +437,7 @@ async function discoverSuiteConfigs(projectRoot, configured) {
 async function loadProjectRuns(workspaceDir, traceDirs) {
   const runs = [];
   for (const rel of traceDirs) {
-    const traceDir = resolveTraceDir({ dir: path5.join(workspaceDir, rel) });
+    const traceDir = resolveTraceDir({ dir: path8.join(workspaceDir, rel) });
     const td = new TraceDirectory({ dir: traceDir });
     const files = await td.list();
     const metas = await loadTraceMetadataList(
@@ -286,7 +451,7 @@ async function loadProjectRuns(workspaceDir, traceDirs) {
         runId: meta.runId,
         ...meta.name !== void 0 ? { name: meta.name } : {},
         status: meta.status,
-        file: path5.basename(meta.filePath),
+        file: path8.basename(meta.filePath),
         ...meta.startedAt !== void 0 ? { startedAt: meta.startedAt } : {},
         ...meta.durationMs !== void 0 ? { durationMs: meta.durationMs } : {}
       });
@@ -295,7 +460,7 @@ async function loadProjectRuns(workspaceDir, traceDirs) {
   return runs.sort((a, b) => (b.startedAt ?? 0) - (a.startedAt ?? 0));
 }
 async function importStudioRegistry(options) {
-  const registryDir = path5.dirname(options.registryPath);
+  const registryDir = path8.dirname(options.registryPath);
   const warnings = [];
   const projects = [];
   const importedAt = (/* @__PURE__ */ new Date()).toISOString();
@@ -356,18 +521,242 @@ async function importStudioProject(options) {
 }
 async function resolveStudioRegistryPath(options) {
   if (options.workspacePath && options.workspacePath.trim() !== "") {
-    return path5.resolve(options.cwd ?? process.cwd(), options.workspacePath);
+    return path8.resolve(options.cwd ?? process.cwd(), options.workspacePath);
   }
-  const cwd = path5.resolve(options.cwd ?? process.cwd());
+  const cwd = path8.resolve(options.cwd ?? process.cwd());
   for (const rel of STUDIO_REGISTRY_FILENAMES) {
-    const candidate = path5.join(cwd, rel);
+    const candidate = path8.join(cwd, rel);
     try {
       await access(candidate);
       return candidate;
     } catch {
     }
   }
-  return path5.join(cwd, STUDIO_REGISTRY_FILENAMES[0]);
+  return path8.join(cwd, STUDIO_REGISTRY_FILENAMES[0]);
+}
+function resolveImportDirs(registryPath, registry) {
+  const registryDir = path8.dirname(registryPath);
+  const importConfig = registry.import ?? {};
+  const fileDropDir = importConfig.fileDropDir ?? "imports/drop";
+  const ciArtifactsDir = importConfig.ciArtifactsDir ?? "imports/ci";
+  const bundlesDir = importConfig.bundlesDir ?? "imports/bundles";
+  return {
+    registryDir,
+    fileDropDir: resolveUnderRoot(registryDir, fileDropDir),
+    ciArtifactsDir: resolveUnderRoot(registryDir, ciArtifactsDir),
+    bundlesDir: resolveUnderRoot(registryDir, bundlesDir)
+  };
+}
+function uniqueDestPath(destDir, fileName, contentHash) {
+  const ext = path8.extname(fileName);
+  const base = path8.basename(fileName, ext);
+  const shortHash = contentHash.slice(0, 8);
+  return path8.join(destDir, `${base}-${shortHash}${ext}`);
+}
+function sanitizeSafeErrorMessage(message, secret) {
+  if (!secret || secret.length < 4) return message;
+  return message.split(secret).join("[redacted]");
+}
+function parseGitHubRepo(repo) {
+  const trimmed = repo.trim();
+  const match = /^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)$/.exec(trimmed);
+  if (!match) {
+    throw new Error("repo must be in owner/name format");
+  }
+  return { owner: match[1], name: match[2] };
+}
+function buildGitHubArtifactSourceKey(options) {
+  return `github:${options.owner}/${options.repo}/runs/${options.runId}/${options.artifactName}`;
+}
+
+// packages/studio/src/ingest/file-drop.ts
+var FILE_DROP_ARCHIVE_DIR = ".imported";
+var CI_EXTENSIONS = [".jsonl", ".suite.json"];
+var BUNDLE_EXTENSIONS = [".tgz", ".zip"];
+function classifyFile(fileName) {
+  const lower = fileName.toLowerCase();
+  if (CI_EXTENSIONS.some((ext) => lower.endsWith(ext))) return "ci";
+  if (BUNDLE_EXTENSIONS.some((ext) => lower.endsWith(ext))) return "bundle";
+  return void 0;
+}
+async function hashFile(filePath) {
+  const data = await readFile(filePath);
+  return createHash("sha256").update(data).digest("hex");
+}
+async function importOneFile(options) {
+  const destPath = uniqueDestPath(options.destDir, options.fileName, options.contentHash);
+  assertPathUnderRoot(destPath, path8.dirname(options.destDir));
+  await mkdir(options.destDir, { recursive: true });
+  await copyFile(options.sourcePath, destPath);
+  insertIngestFile(options.db, {
+    sourceKey: options.sourceKey,
+    sourceName: options.fileName,
+    destPath,
+    kind: options.kind,
+    contentHash: options.contentHash,
+    importedAt: options.importedAt
+  });
+  let archived = false;
+  if (options.archiveAfterImport) {
+    await mkdir(options.archiveDir, { recursive: true });
+    const archiveTarget = path8.join(options.archiveDir, options.fileName);
+    await rename(options.sourcePath, archiveTarget);
+    archived = true;
+  }
+  return {
+    sourceKey: options.sourceKey,
+    sourceName: options.fileName,
+    destPath,
+    kind: options.kind,
+    contentHash: options.contentHash,
+    archived
+  };
+}
+async function importFileDrop(options) {
+  const warnings = [];
+  const errors = [];
+  const files = [];
+  if (!options.enabled) {
+    return {
+      skipped: true,
+      reason: "file-drop ingest is disabled; pass --ingest file-drop or use studio import drop",
+      scanned: 0,
+      imported: 0,
+      skippedFiles: 0,
+      errors,
+      warnings,
+      files
+    };
+  }
+  const dirs = resolveImportDirs(options.registryPath, options.registry);
+  let dropDir;
+  try {
+    dropDir = options.dropDir ? path8.isAbsolute(options.dropDir) ? (assertPathUnderRoot(options.dropDir, dirs.registryDir), options.dropDir) : resolveUnderRoot(dirs.registryDir, options.dropDir) : dirs.fileDropDir;
+    assertPathUnderRoot(dropDir, dirs.registryDir);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return {
+      skipped: false,
+      scanned: 0,
+      imported: 0,
+      skippedFiles: 0,
+      errors: [message],
+      warnings,
+      files
+    };
+  }
+  let entries;
+  try {
+    entries = await readdir(dropDir);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return {
+      skipped: false,
+      scanned: 0,
+      imported: 0,
+      skippedFiles: 0,
+      errors: [`unable to read file-drop directory: ${message}`],
+      warnings,
+      files
+    };
+  }
+  const importedAt = (/* @__PURE__ */ new Date()).toISOString();
+  const archiveDir = path8.join(dropDir, FILE_DROP_ARCHIVE_DIR);
+  let scanned = 0;
+  let imported = 0;
+  let skippedFiles = 0;
+  for (const entry of entries.sort()) {
+    if (entry === FILE_DROP_ARCHIVE_DIR || entry.startsWith(".")) continue;
+    const sourcePath = path8.join(dropDir, entry);
+    let fileStat;
+    try {
+      fileStat = await stat(sourcePath);
+    } catch {
+      warnings.push(`skipped unreadable entry: ${entry}`);
+      continue;
+    }
+    if (!fileStat.isFile()) continue;
+    const kind = classifyFile(entry);
+    if (!kind) continue;
+    scanned += 1;
+    const sourceKey = entry;
+    let contentHash;
+    try {
+      contentHash = await hashFile(sourcePath);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      errors.push(`failed to read ${entry}: ${message}`);
+      continue;
+    }
+    const existing = findIngestFileBySourceKey(options.db, sourceKey);
+    if (existing && existing.contentHash === contentHash) {
+      skippedFiles += 1;
+      continue;
+    }
+    const destDir = kind === "ci" ? dirs.ciArtifactsDir : dirs.bundlesDir;
+    try {
+      const importedFile = await importOneFile({
+        db: options.db,
+        sourcePath,
+        sourceKey,
+        fileName: entry,
+        kind,
+        destDir,
+        archiveAfterImport: options.archiveAfterImport === true,
+        archiveDir,
+        importedAt,
+        contentHash
+      });
+      files.push(importedFile);
+      imported += 1;
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      errors.push(`failed to import ${entry}: ${message}`);
+    }
+  }
+  return {
+    skipped: false,
+    scanned,
+    imported,
+    skippedFiles,
+    errors,
+    warnings,
+    files
+  };
+}
+async function importFileDropFromRegistry(options) {
+  return importFileDrop({
+    db: options.db,
+    registryPath: options.registryPath,
+    registry: options.registry,
+    enabled: options.enabled,
+    ...options.dropDir !== void 0 ? { dropDir: options.dropDir } : {},
+    ...options.archiveAfterImport !== void 0 ? { archiveAfterImport: options.archiveAfterImport } : {}
+  });
+}
+async function runStudioFileDropImport(options) {
+  const cwd = options.cwd ?? process.cwd();
+  const registryPath = await resolveStudioRegistryPath({
+    ...options.workspacePath !== void 0 ? { workspacePath: options.workspacePath } : {},
+    cwd
+  });
+  const registryRead = await readStudioRegistryFile(registryPath);
+  if (!registryRead.ok || registryRead.registry === void 0) {
+    throw new Error(registryRead.errors.join("; ") || "invalid studio registry");
+  }
+  const dbPath = resolveStudioDbPath({
+    ...options.dbPath !== void 0 ? { dbPath: options.dbPath } : {},
+    cwd
+  });
+  const db = openStudioDb(dbPath);
+  return importFileDropFromRegistry({
+    db,
+    registryPath,
+    registry: registryRead.registry,
+    enabled: true,
+    ...options.dropDir !== void 0 ? { dropDir: options.dropDir } : {},
+    ...options.archiveAfterImport !== void 0 ? { archiveAfterImport: options.archiveAfterImport } : {}
+  });
 }
 
 // packages/studio/src/context.ts
@@ -391,12 +780,23 @@ async function createStudioContext(options = {}) {
     registry: registryRead.registry,
     registryPath
   });
+  let fileDropResult;
+  if (options.ingestFileDrop === true) {
+    fileDropResult = await importFileDropFromRegistry({
+      db,
+      registryPath,
+      registry: registryRead.registry,
+      enabled: true,
+      ...options.archiveFileDrop === true ? { archiveAfterImport: true } : {}
+    });
+  }
   return {
     db,
     dbPath,
     registryPath,
     registry: registryRead.registry,
     importResult,
+    ...fileDropResult !== void 0 ? { fileDropResult } : {},
     projects: importResult.projects
   };
 }
@@ -410,6 +810,158 @@ function summarizeProjects(projects) {
     importedAt: project.importedAt
   }));
 }
+var DEFAULT_INGEST_TOKEN_ENV = "STUDIO_INGEST_TOKEN";
+function resolveIngestTokenEnv(options) {
+  const envName = options.tokenEnv?.trim() || options.registryTokenEnv?.trim() || DEFAULT_INGEST_TOKEN_ENV;
+  if (!/^[A-Z][A-Z0-9_]*$/.test(envName)) {
+    throw new Error("ingest token env name must be an uppercase identifier");
+  }
+  return envName;
+}
+function resolveIngestToken(envName) {
+  const token = process.env[envName]?.trim();
+  return token && token.length > 0 ? token : void 0;
+}
+function extractIngestTokenFromRequest(headers) {
+  const headerToken = firstHeader(headers["x-agentinspect-token"]) ?? firstHeader(headers["x-agent-inspect-token"]);
+  if (headerToken) return headerToken;
+  const auth = firstHeader(headers.authorization);
+  if (auth?.startsWith("Bearer ")) {
+    const token = auth.slice("Bearer ".length).trim();
+    return token.length > 0 ? token : void 0;
+  }
+  return void 0;
+}
+function firstHeader(value) {
+  if (Array.isArray(value)) return value[0]?.trim();
+  return value?.trim();
+}
+function isIngestTokenValid(provided, expected) {
+  if (!provided || !expected) return false;
+  const providedBuf = Buffer.from(provided);
+  const expectedBuf = Buffer.from(expected);
+  if (providedBuf.length !== expectedBuf.length) return false;
+  return timingSafeEqual(providedBuf, expectedBuf);
+}
+
+// packages/studio/src/ingest/http.ts
+var DEFAULT_HTTP_INGEST_BASE_PATH = "/api/ingest";
+var HTTP_INGEST_BUNDLE_PATH = "/api/ingest/bundle";
+var HTTP_INGEST_ARTIFACT_PATH = "/api/ingest/artifact";
+var DEFAULT_MAX_INGEST_BYTES = 52428800;
+function resolveHttpIngestConfig(options, registryEnabled) {
+  const http = options.context?.registry.ingest?.http;
+  const enabled = options.ingestHttp === true || registryEnabled === true || http?.enabled === true;
+  const basePath = (http?.path ?? DEFAULT_HTTP_INGEST_BASE_PATH).trim() || DEFAULT_HTTP_INGEST_BASE_PATH;
+  const tokenEnv = resolveIngestTokenEnv({
+    ...options.ingestTokenEnv !== void 0 ? { tokenEnv: options.ingestTokenEnv } : {},
+    ...http?.tokenEnv !== void 0 ? { registryTokenEnv: http.tokenEnv } : {}
+  });
+  const maxBytes = http?.maxBytes ?? DEFAULT_MAX_INGEST_BYTES;
+  return { enabled, basePath, tokenEnv, maxBytes };
+}
+function sendJson(res, status, body) {
+  res.writeHead(status, {
+    "content-type": "application/json; charset=utf-8",
+    "cache-control": "no-store"
+  });
+  res.end(JSON.stringify(body));
+}
+async function readBoundedRequestBody(req, maxBytes) {
+  const chunks = [];
+  let total = 0;
+  for await (const chunk of req) {
+    const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+    total += buf.length;
+    if (total > maxBytes) {
+      throw new Error("request body exceeds size limit");
+    }
+    chunks.push(buf);
+  }
+  return Buffer.concat(chunks);
+}
+function isHttpIngestRoute(pathname, config) {
+  return pathname === HTTP_INGEST_BUNDLE_PATH || pathname === HTTP_INGEST_ARTIFACT_PATH || pathname === `${config.basePath}/bundle` || pathname === `${config.basePath}/artifact`;
+}
+async function handleHttpIngestRequest(req, res, ctx, options, pathname) {
+  const config = resolveHttpIngestConfig(options, ctx.registry.ingest?.http?.enabled);
+  if (!isHttpIngestRoute(pathname, config)) return false;
+  if (!config.enabled) {
+    sendJson(res, 404, { error: "HTTP ingest is disabled" });
+    return true;
+  }
+  if (req.method !== "POST") {
+    sendJson(res, 405, { error: "Method not allowed" });
+    return true;
+  }
+  const expectedToken = resolveIngestToken(config.tokenEnv);
+  const providedToken = extractIngestTokenFromRequest(req.headers);
+  if (!isIngestTokenValid(providedToken, expectedToken)) {
+    sendJson(res, 403, { error: "Invalid or missing ingest token" });
+    return true;
+  }
+  let body;
+  try {
+    body = await readBoundedRequestBody(req, config.maxBytes);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    const status = message.includes("size limit") ? 413 : 400;
+    sendJson(res, status, { error: sanitizeSafeErrorMessage(message, expectedToken) });
+    return true;
+  }
+  if (body.length === 0) {
+    sendJson(res, 400, { error: "Empty request body" });
+    return true;
+  }
+  try {
+    const isBundle = pathname === HTTP_INGEST_BUNDLE_PATH || pathname === `${config.basePath}/bundle`;
+    const isArtifact = pathname === HTTP_INGEST_ARTIFACT_PATH || pathname === `${config.basePath}/artifact`;
+    if (!isBundle && !isArtifact) {
+      sendJson(res, 404, { error: "Unknown ingest route" });
+      return true;
+    }
+    const dirs = resolveImportDirs(ctx.registryPath, ctx.registry);
+    const contentHash = createHash("sha256").update(body).digest("hex");
+    const importedAt = (/* @__PURE__ */ new Date()).toISOString();
+    const fileName = isBundle ? `http-bundle-${contentHash.slice(0, 8)}.bin` : `http-artifact-${contentHash.slice(0, 8)}.zip`;
+    const destDir = isBundle ? dirs.bundlesDir : dirs.ciArtifactsDir;
+    const destPath = uniqueDestPath(destDir, fileName, contentHash);
+    assertPathUnderRoot(destPath, dirs.registryDir);
+    await mkdir(destDir, { recursive: true });
+    await writeFile(destPath, body);
+    const sourceKey = isBundle ? `http:bundle:${contentHash}` : buildGitHubArtifactSourceKey({
+      owner: "http",
+      repo: "ingest",
+      runId: importedAt,
+      artifactName: fileName
+    });
+    insertIngestFile(ctx.db, {
+      sourceKey,
+      sourceName: fileName,
+      destPath,
+      kind: isBundle ? "bundle" : "ci",
+      contentHash,
+      importedAt
+    });
+    const registryImport = await importStudioRegistry({
+      db: ctx.db,
+      registry: ctx.registry,
+      registryPath: ctx.registryPath
+    });
+    sendJson(res, 200, {
+      ok: true,
+      imported: true,
+      kind: isBundle ? "bundle" : "artifact",
+      destPath,
+      warnings: registryImport.warnings
+    });
+    return true;
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    sendJson(res, 500, { error: sanitizeSafeErrorMessage(message, expectedToken) });
+    return true;
+  }
+}
 
 // packages/studio/src/html.ts
 var studioIndexHtml = `<!DOCTYPE html>
@@ -455,7 +1007,7 @@ function getImportedProject(db, projects, projectId) {
 async function loadTraceDirMetas(workspaceDir, traceDirs) {
   const metas = [];
   for (const rel of traceDirs) {
-    const traceDir = resolveTraceDir({ dir: path5.join(workspaceDir, rel) });
+    const traceDir = resolveTraceDir({ dir: path8.join(workspaceDir, rel) });
     const td = new TraceDirectory({ dir: traceDir });
     const files = await td.list();
     const listed = await loadTraceMetadataList(
@@ -484,7 +1036,7 @@ async function loadProjectSuitesView(ctx) {
     try {
       const result = await runSuite({
         configPath,
-        cwd: path5.dirname(configPath)
+        cwd: path8.dirname(configPath)
       });
       suites.push({
         suiteName: result.suiteName,
@@ -502,7 +1054,7 @@ async function loadProjectSuitesView(ctx) {
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
       suites.push({
-        suiteName: path5.basename(configPath),
+        suiteName: path8.basename(configPath),
         configPath,
         ok: false,
         status: "error",
@@ -551,7 +1103,7 @@ async function loadProjectSearchView(ctx, db, params) {
   }
   const metas = await loadTraceDirMetas(ctx.project.workspaceDir, ["runs"]);
   const traceDir = resolveTraceDir({
-    dir: path5.join(ctx.project.workspaceDir, "runs")
+    dir: path8.join(ctx.project.workspaceDir, "runs")
   });
   const results = await searchTraces(metas, {
     traceDir,
@@ -595,12 +1147,12 @@ async function loadProjectDiffView(ctx, params) {
   };
 }
 async function loadProjectReportsView(ctx) {
-  const reportsDir = path5.join(ctx.project.workspaceDir, "reports");
+  const reportsDir = path8.join(ctx.project.workspaceDir, "reports");
   const reports = [];
   try {
     const files = await readdir(reportsDir);
     for (const file of files) {
-      const filePath = path5.join(reportsDir, file);
+      const filePath = path8.join(reportsDir, file);
       const info = await stat(filePath);
       if (!info.isFile()) continue;
       reports.push({ name: file, path: filePath, sizeBytes: info.size });
@@ -655,7 +1207,7 @@ async function loadBundleExportView(ctx, params) {
     runId,
     readOnly: true,
     redactionProfile: ctx.project.redactionProfile ?? "share",
-    cliHint: `npx agent-inspect bundle ${runId} --profile ${ctx.project.redactionProfile ?? "share"} --dir ${path5.join(ctx.project.workspaceDir, "runs")}`,
+    cliHint: `npx agent-inspect bundle ${runId} --profile ${ctx.project.redactionProfile ?? "share"} --dir ${path8.join(ctx.project.workspaceDir, "runs")}`,
     note: "Studio does not mutate traces or upload bundles. Run the CLI locally to assemble a share-safe bundle."
   };
 }
@@ -699,7 +1251,7 @@ function studioAuthRequiredResponse() {
 }
 
 // packages/studio/src/routes.ts
-function sendJson(res, status, body, headers = {}) {
+function sendJson2(res, status, body, headers = {}) {
   const payload = JSON.stringify(body);
   res.writeHead(status, {
     "content-type": "application/json; charset=utf-8",
@@ -709,7 +1261,7 @@ function sendJson(res, status, body, headers = {}) {
   res.end(payload);
 }
 function notFound(res, message) {
-  sendJson(res, 404, { error: message });
+  sendJson2(res, 404, { error: message });
 }
 function decodeSegment(segment) {
   if (!segment) return "";
@@ -722,11 +1274,11 @@ function decodeSegment(segment) {
 async function handleStudioRoute(req, res, ctx, options, pathname, url) {
   if (!isStudioRequestAuthorized(req, options)) {
     const auth = studioAuthRequiredResponse();
-    sendJson(res, auth.status, auth.body, auth.headers);
+    sendJson2(res, auth.status, auth.body, auth.headers);
     return true;
   }
   if (pathname === "/api/health") {
-    sendJson(res, 200, {
+    sendJson2(res, 200, {
       ok: true,
       readOnly: true,
       mode: "studio",
@@ -739,7 +1291,7 @@ async function handleStudioRoute(req, res, ctx, options, pathname, url) {
     return true;
   }
   if (pathname === "/api/projects") {
-    sendJson(res, 200, {
+    sendJson2(res, 200, {
       registryName: ctx.registry.name,
       projects: summarizeProjects(ctx.projects),
       warnings: ctx.importResult.warnings
@@ -756,56 +1308,56 @@ async function handleStudioRoute(req, res, ctx, options, pathname, url) {
       return true;
     }
     if (subpath === "runs" || subpath === "") {
-      sendJson(res, 200, {
+      sendJson2(res, 200, {
         projectId,
         runs: await loadProjectRunsView(projectCtx, ctx.db)
       });
       return true;
     }
     if (subpath === "sessions") {
-      sendJson(res, 200, {
+      sendJson2(res, 200, {
         projectId,
         ...await loadProjectSessionsView(projectCtx)
       });
       return true;
     }
     if (subpath === "suites") {
-      sendJson(res, 200, {
+      sendJson2(res, 200, {
         projectId,
         ...await loadProjectSuitesView(projectCtx)
       });
       return true;
     }
     if (subpath === "checks") {
-      sendJson(res, 200, {
+      sendJson2(res, 200, {
         projectId,
         ...await loadProjectChecksView(projectCtx)
       });
       return true;
     }
     if (subpath === "observations") {
-      sendJson(res, 200, {
+      sendJson2(res, 200, {
         projectId,
         ...await loadProjectObservationsView(projectCtx)
       });
       return true;
     }
     if (subpath === "guardrails") {
-      sendJson(res, 200, {
+      sendJson2(res, 200, {
         projectId,
         ...await loadProjectGuardrailsView(projectCtx)
       });
       return true;
     }
     if (subpath === "redaction") {
-      sendJson(res, 200, {
+      sendJson2(res, 200, {
         projectId,
         ...await loadProjectRedactionView(projectCtx)
       });
       return true;
     }
     if (subpath === "reports") {
-      sendJson(res, 200, {
+      sendJson2(res, 200, {
         projectId,
         ...await loadProjectReportsView(projectCtx)
       });
@@ -817,7 +1369,7 @@ async function handleStudioRoute(req, res, ctx, options, pathname, url) {
   if (pathname === "/api/search") {
     const projectId = url.searchParams.get("projectId");
     if (!projectId) {
-      sendJson(res, 400, { error: "projectId query parameter is required." });
+      sendJson2(res, 400, { error: "projectId query parameter is required." });
       return true;
     }
     const projectCtx = getImportedProject(ctx.db, ctx.projects, projectId);
@@ -825,7 +1377,7 @@ async function handleStudioRoute(req, res, ctx, options, pathname, url) {
       notFound(res, `Project not found: ${projectId}`);
       return true;
     }
-    sendJson(res, 200, {
+    sendJson2(res, 200, {
       projectId,
       ...await loadProjectSearchView(projectCtx, ctx.db, url.searchParams)
     });
@@ -834,7 +1386,7 @@ async function handleStudioRoute(req, res, ctx, options, pathname, url) {
   if (pathname === "/api/diff") {
     const projectId = url.searchParams.get("projectId");
     if (!projectId) {
-      sendJson(res, 400, { error: "projectId query parameter is required." });
+      sendJson2(res, 400, { error: "projectId query parameter is required." });
       return true;
     }
     const projectCtx = getImportedProject(ctx.db, ctx.projects, projectId);
@@ -843,20 +1395,20 @@ async function handleStudioRoute(req, res, ctx, options, pathname, url) {
       return true;
     }
     try {
-      sendJson(res, 200, {
+      sendJson2(res, 200, {
         projectId,
         ...await loadProjectDiffView(projectCtx, url.searchParams)
       });
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
-      sendJson(res, 400, { error: message });
+      sendJson2(res, 400, { error: message });
     }
     return true;
   }
   if (pathname === "/api/reports") {
     const projectId = url.searchParams.get("projectId");
     if (!projectId) {
-      sendJson(res, 400, { error: "projectId query parameter is required." });
+      sendJson2(res, 400, { error: "projectId query parameter is required." });
       return true;
     }
     const projectCtx = getImportedProject(ctx.db, ctx.projects, projectId);
@@ -864,7 +1416,7 @@ async function handleStudioRoute(req, res, ctx, options, pathname, url) {
       notFound(res, `Project not found: ${projectId}`);
       return true;
     }
-    sendJson(res, 200, {
+    sendJson2(res, 200, {
       projectId,
       ...await loadProjectReportsView(projectCtx)
     });
@@ -873,7 +1425,7 @@ async function handleStudioRoute(req, res, ctx, options, pathname, url) {
   if (pathname === "/api/bundles/export") {
     const projectId = url.searchParams.get("projectId");
     if (!projectId) {
-      sendJson(res, 400, { error: "projectId query parameter is required." });
+      sendJson2(res, 400, { error: "projectId query parameter is required." });
       return true;
     }
     const projectCtx = getImportedProject(ctx.db, ctx.projects, projectId);
@@ -882,10 +1434,10 @@ async function handleStudioRoute(req, res, ctx, options, pathname, url) {
       return true;
     }
     try {
-      sendJson(res, 200, await loadBundleExportView(projectCtx, url.searchParams));
+      sendJson2(res, 200, await loadBundleExportView(projectCtx, url.searchParams));
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
-      sendJson(res, 400, { error: message });
+      sendJson2(res, 400, { error: message });
     }
     return true;
   }
@@ -924,15 +1476,21 @@ function createStudioServer(options = {}) {
   }
   const server = createServer(async (req, res) => {
     try {
-      if (req.method !== "GET" && req.method !== "HEAD") {
-        return badRequest(res, "Only GET is supported.");
-      }
+      const method = req.method ?? "GET";
+      const url = new URL(req.url ?? "/", `http://${host}:${port}`);
+      const pathname = url.pathname;
       if (!contextPromise) {
         contextPromise = createStudioContext(options);
       }
       const ctx = await contextPromise;
-      const url = new URL(req.url ?? "/", `http://${host}:${port}`);
-      const pathname = url.pathname;
+      const httpConfig = resolveHttpIngestConfig(options, ctx.registry.ingest?.http?.enabled);
+      if (isHttpIngestRoute(pathname, httpConfig)) {
+        const handled2 = await handleHttpIngestRequest(req, res, ctx, options, pathname);
+        if (handled2) return;
+      }
+      if (method !== "GET" && method !== "HEAD") {
+        return badRequest(res, "Only GET is supported.");
+      }
       if (pathname === "/" || pathname === "/index.html") {
         if (req.method === "HEAD") {
           res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
@@ -985,7 +1543,355 @@ async function startStudioServer(options = {}) {
     });
   });
 }
+var DEFAULT_GITHUB_TOKEN_ENV = "GITHUB_TOKEN";
+var GITHUB_API_BASE = "https://api.github.com";
+var MAX_ARTIFACT_BYTES = 52428800;
+function resolveTokenEnv(registry, override) {
+  const fromRegistry = registry.ingest?.github?.tokenEnv?.trim();
+  const envName = override?.trim() || fromRegistry || DEFAULT_GITHUB_TOKEN_ENV;
+  if (!/^[A-Z][A-Z0-9_]*$/.test(envName)) {
+    throw new Error("token env name must be an uppercase identifier");
+  }
+  return envName;
+}
+function resolveToken(envName) {
+  const token = process.env[envName]?.trim();
+  if (!token) {
+    throw new Error(`missing GitHub token in environment variable ${envName}`);
+  }
+  return token;
+}
+function githubHeaders(token) {
+  return {
+    Authorization: `Bearer ${token}`,
+    Accept: "application/vnd.github+json",
+    "X-GitHub-Api-Version": "2022-11-28",
+    "User-Agent": "agent-inspect-studio-ingest"
+  };
+}
+async function readResponseBody(response, maxBytes) {
+  const lengthHeader = response.headers.get("content-length");
+  if (lengthHeader) {
+    const length = Number(lengthHeader);
+    if (Number.isFinite(length) && length > maxBytes) {
+      throw new Error("artifact exceeds size limit");
+    }
+  }
+  const arrayBuffer = await response.arrayBuffer();
+  if (arrayBuffer.byteLength > maxBytes) {
+    throw new Error("artifact exceeds size limit");
+  }
+  return Buffer.from(arrayBuffer);
+}
+async function downloadGitHubArtifactArchive(options) {
+  const fetchFn = options.fetchImpl ?? fetch;
+  const { owner, name } = parseGitHubRepo(options.repo);
+  const runId = options.runId.trim();
+  const artifactName = options.artifactName.trim();
+  if (!/^\d+$/.test(runId)) {
+    throw new Error("run-id must be a numeric workflow run id");
+  }
+  if (artifactName === "") {
+    throw new Error("artifact name must be non-empty");
+  }
+  const listUrl = `${GITHUB_API_BASE}/repos/${owner}/${name}/actions/runs/${runId}/artifacts`;
+  const listResponse = await fetchFn(listUrl, {
+    headers: githubHeaders(options.token)
+  });
+  if (!listResponse.ok) {
+    throw new Error(`GitHub artifact lookup failed (${listResponse.status})`);
+  }
+  const payload = await listResponse.json();
+  const artifact = payload.artifacts?.find((item) => item.name === artifactName);
+  if (!artifact?.archive_download_url) {
+    throw new Error(`artifact not found for run ${runId}: ${artifactName}`);
+  }
+  if (artifact.expired === true) {
+    throw new Error(`artifact expired for run ${runId}: ${artifactName}`);
+  }
+  if (typeof artifact.size_in_bytes === "number" && artifact.size_in_bytes > MAX_ARTIFACT_BYTES) {
+    throw new Error("artifact exceeds size limit");
+  }
+  const downloadResponse = await fetchFn(artifact.archive_download_url, {
+    headers: githubHeaders(options.token),
+    redirect: "follow"
+  });
+  if (!downloadResponse.ok) {
+    throw new Error(`GitHub artifact download failed (${downloadResponse.status})`);
+  }
+  return readResponseBody(downloadResponse, MAX_ARTIFACT_BYTES);
+}
+async function importGitHubArtifact(options) {
+  const registryImportWarnings = [];
+  const errors = [];
+  if (!options.enabled) {
+    return {
+      skipped: true,
+      reason: "GitHub artifact ingest is disabled; use studio import github explicitly",
+      imported: false,
+      registryImportWarnings,
+      errors
+    };
+  }
+  let token;
+  let tokenEnv;
+  try {
+    const { owner, name } = parseGitHubRepo(options.repo);
+    tokenEnv = resolveTokenEnv(options.registry, options.tokenEnv);
+    token = resolveToken(tokenEnv);
+    const sourceKey = buildGitHubArtifactSourceKey({
+      owner,
+      repo: name,
+      runId: options.runId,
+      artifactName: options.artifactName
+    });
+    const archive = await downloadGitHubArtifactArchive({
+      repo: options.repo,
+      runId: options.runId,
+      artifactName: options.artifactName,
+      token,
+      ...options.fetchImpl !== void 0 ? { fetchImpl: options.fetchImpl } : {}
+    });
+    const contentHash = createHash("sha256").update(archive).digest("hex");
+    const existing = findIngestFileBySourceKey(options.db, sourceKey);
+    if (existing && existing.contentHash === contentHash) {
+      return {
+        skipped: false,
+        imported: false,
+        sourceKey,
+        contentHash,
+        destPath: existing.destPath,
+        registryImportWarnings,
+        errors
+      };
+    }
+    const dirs = resolveImportDirs(options.registryPath, options.registry);
+    const fileName = `${options.artifactName}.zip`;
+    const destPath = uniqueDestPath(dirs.bundlesDir, fileName, contentHash);
+    assertPathUnderRoot(destPath, dirs.registryDir);
+    await mkdir(dirs.bundlesDir, { recursive: true });
+    await writeFile(destPath, archive);
+    const importedAt = (/* @__PURE__ */ new Date()).toISOString();
+    insertIngestFile(options.db, {
+      sourceKey,
+      sourceName: fileName,
+      destPath,
+      kind: "bundle",
+      contentHash,
+      importedAt
+    });
+    const registryImport = await importStudioRegistry({
+      db: options.db,
+      registry: options.registry,
+      registryPath: options.registryPath
+    });
+    registryImportWarnings.push(...registryImport.warnings);
+    return {
+      skipped: false,
+      imported: true,
+      sourceKey,
+      contentHash,
+      destPath,
+      registryImportWarnings,
+      errors
+    };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    errors.push(sanitizeSafeErrorMessage(message, token));
+    return {
+      skipped: false,
+      imported: false,
+      registryImportWarnings,
+      errors
+    };
+  }
+}
+async function runStudioGitHubArtifactImport(options) {
+  const cwd = options.cwd ?? process.cwd();
+  const registryPath = await resolveStudioRegistryPath({
+    ...options.workspacePath !== void 0 ? { workspacePath: options.workspacePath } : {},
+    cwd
+  });
+  const registryRead = await readStudioRegistryFile(registryPath);
+  if (!registryRead.ok || registryRead.registry === void 0) {
+    throw new Error(registryRead.errors.join("; ") || "invalid studio registry");
+  }
+  const dbPath = resolveStudioDbPath({
+    ...options.dbPath !== void 0 ? { dbPath: options.dbPath } : {},
+    cwd
+  });
+  const db = openStudioDb(dbPath);
+  return importGitHubArtifact({
+    db,
+    registryPath,
+    registry: registryRead.registry,
+    repo: options.repo,
+    runId: options.runId,
+    artifactName: options.artifact,
+    enabled: true,
+    ...options.tokenEnv !== void 0 ? { tokenEnv: options.tokenEnv } : {},
+    ...options.fetchImpl !== void 0 ? { fetchImpl: options.fetchImpl } : {}
+  });
+}
+async function pathExists(filePath) {
+  try {
+    await access(filePath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function validateBundleDirectory(bundleDir) {
+  const errors = [];
+  const metadataPath = path8.join(bundleDir, "metadata.json");
+  if (!await pathExists(metadataPath)) {
+    errors.push("bundle missing metadata.json");
+    return errors;
+  }
+  try {
+    const raw = await readFile(metadataPath, "utf8");
+    const parsed = JSON.parse(raw);
+    if (typeof parsed.agentInspectVersion !== "string") {
+      errors.push("bundle metadata.json missing agentInspectVersion");
+    }
+    if (!Array.isArray(parsed.runIds) || parsed.runIds.length === 0) {
+      errors.push("bundle metadata.json missing runIds");
+    }
+  } catch {
+    errors.push("bundle metadata.json is invalid JSON");
+  }
+  return errors;
+}
+async function copyDirectoryRecursive(sourceDir, destDir) {
+  await mkdir(destDir, { recursive: true });
+  const entries = await readdir(sourceDir, { withFileTypes: true });
+  for (const entry of entries) {
+    const from = path8.join(sourceDir, entry.name);
+    const to = path8.join(destDir, entry.name);
+    if (entry.isDirectory()) {
+      await copyDirectoryRecursive(from, to);
+    } else if (entry.isFile()) {
+      await copyFile(from, to);
+    }
+  }
+}
+async function importBundleUpload(options) {
+  const registryImportWarnings = [];
+  const errors = [];
+  if (!options.enabled) {
+    return {
+      skipped: true,
+      reason: "bundle upload ingest is disabled; use studio import bundle explicitly",
+      imported: false,
+      errors,
+      registryImportWarnings
+    };
+  }
+  const bundlePath = path8.resolve(options.bundlePath);
+  let bundleStat;
+  try {
+    bundleStat = await stat(bundlePath);
+  } catch {
+    return {
+      skipped: false,
+      imported: false,
+      errors: ["bundle path does not exist"],
+      registryImportWarnings
+    };
+  }
+  if (!bundleStat.isDirectory()) {
+    return {
+      skipped: false,
+      imported: false,
+      errors: ["bundle path must be a directory produced by agent-inspect bundle"],
+      registryImportWarnings
+    };
+  }
+  const validationErrors = await validateBundleDirectory(bundlePath);
+  if (validationErrors.length > 0) {
+    return {
+      skipped: false,
+      imported: false,
+      errors: validationErrors,
+      registryImportWarnings
+    };
+  }
+  const metadataRaw = await readFile(path8.join(bundlePath, "metadata.json"), "utf8");
+  const contentHash = createHash("sha256").update(metadataRaw).digest("hex");
+  const sourceKey = `bundle:${bundlePath}`;
+  const existing = findIngestFileBySourceKey(options.db, sourceKey);
+  if (existing && existing.contentHash === contentHash) {
+    return {
+      skipped: false,
+      imported: false,
+      destPath: existing.destPath,
+      sourceKey,
+      errors,
+      registryImportWarnings
+    };
+  }
+  const dirs = resolveImportDirs(options.registryPath, options.registry);
+  const folderName = path8.basename(bundlePath);
+  const destPath = uniqueDestPath(dirs.bundlesDir, folderName, contentHash);
+  assertPathUnderRoot(destPath, dirs.registryDir);
+  try {
+    await copyDirectoryRecursive(bundlePath, destPath);
+    insertIngestFile(options.db, {
+      sourceKey,
+      sourceName: folderName,
+      destPath,
+      kind: "bundle",
+      contentHash,
+      importedAt: (/* @__PURE__ */ new Date()).toISOString()
+    });
+    const registryImport = await importStudioRegistry({
+      db: options.db,
+      registry: options.registry,
+      registryPath: options.registryPath
+    });
+    registryImportWarnings.push(...registryImport.warnings);
+    return {
+      skipped: false,
+      imported: true,
+      destPath,
+      sourceKey,
+      errors,
+      registryImportWarnings
+    };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return {
+      skipped: false,
+      imported: false,
+      errors: [message],
+      registryImportWarnings
+    };
+  }
+}
+async function runStudioBundleUploadImport(options) {
+  const cwd = options.cwd ?? process.cwd();
+  const registryPath = await resolveStudioRegistryPath({
+    ...options.workspacePath !== void 0 ? { workspacePath: options.workspacePath } : {},
+    cwd
+  });
+  const registryRead = await readStudioRegistryFile(registryPath);
+  if (!registryRead.ok || registryRead.registry === void 0) {
+    throw new Error(registryRead.errors.join("; ") || "invalid studio registry");
+  }
+  const dbPath = resolveStudioDbPath({
+    ...options.dbPath !== void 0 ? { dbPath: options.dbPath } : {},
+    cwd
+  });
+  const db = openStudioDb(dbPath);
+  return importBundleUpload({
+    db,
+    registryPath,
+    registry: registryRead.registry,
+    bundlePath: options.bundlePath,
+    enabled: true
+  });
+}
 
-export { createStudioContext, createStudioServer, parseStudioRegistry, readStudioRegistryFile, startStudioServer, studioIndexHtml, summarizeProjects };
+export { HTTP_INGEST_ARTIFACT_PATH, HTTP_INGEST_BUNDLE_PATH, createStudioContext, createStudioServer, downloadGitHubArtifactArchive, extractIngestTokenFromRequest, handleHttpIngestRequest, importBundleUpload, importFileDrop, importFileDropFromRegistry, importGitHubArtifact, isHttpIngestRoute, isIngestTokenValid, openStudioDb, parseStudioRegistry, readStudioRegistryFile, resolveHttpIngestConfig, resolveIngestToken, resolveIngestTokenEnv, resolveStudioDbPath, resolveStudioRegistryPath, runStudioBundleUploadImport, runStudioFileDropImport, runStudioGitHubArtifactImport, startStudioServer, studioIndexHtml, summarizeProjects, validateBundleDirectory };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map