@agent-inspect/studio 6.0.0

package/dist/index.mjs

@@ -0,0 +1,991 @@
+import { readFile, access, mkdir, readdir, stat } from 'fs/promises';
+import path5 from 'path';
+import { loadSessionRunRecords, buildSessionIndex, runSuite, buildRunTimeline, extractOutcomesFromTraceEvents, resolveTraceDir, searchTraces, TraceDirectory, loadTraceMetadataList } from 'agent-inspect/advanced';
+import { resolveWorkspaceLocation, readWorkspaceManifestFile } from 'agent-inspect/workspace';
+import Database from 'better-sqlite3';
+import { createServer } from 'http';
+import { runTraceChecks, createRunStatusRule } from 'agent-inspect/checks';
+import { diffRuns, manualTraceEventsToComparableRun } from 'agent-inspect/diff';
+import { persistedInspectEventsToTraceEvents } from 'agent-inspect/persisted';
+import { openTrace } from 'agent-inspect/readers';
+
+// packages/studio/src/registry.ts
+var STUDIO_REGISTRY_SCHEMA_VERSION = "1.0";
+var STUDIO_REGISTRY_FILENAMES = [
+  "studio-registry.json",
+  ".agent-inspect/studio-registry.json"
+];
+var MAX_REGISTRY_BYTES = 256 * 1024;
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isSafeRelativePath(p) {
+  const trimmed = p.trim();
+  if (trimmed === "" || trimmed.startsWith("/") || trimmed.startsWith("\\")) return false;
+  if (/^[a-zA-Z]:/.test(trimmed)) return false;
+  return !trimmed.split(/[/\\]+/).some((seg) => seg === "..");
+}
+function parseStudioRegistry(input) {
+  const errors = [];
+  if (!isPlainObject(input)) {
+    return { ok: false, errors: ["registry must be a JSON object"] };
+  }
+  if (input.schemaVersion !== STUDIO_REGISTRY_SCHEMA_VERSION) {
+    errors.push(`schemaVersion must be "${STUDIO_REGISTRY_SCHEMA_VERSION}"`);
+  }
+  if (typeof input.name !== "string" || input.name.trim() === "") {
+    errors.push("name must be a non-empty string");
+  }
+  if (!Array.isArray(input.projects) || input.projects.length === 0) {
+    errors.push("projects must be a non-empty array");
+  }
+  const projects = [];
+  if (Array.isArray(input.projects)) {
+    for (const [index, item] of input.projects.entries()) {
+      if (!isPlainObject(item)) {
+        errors.push(`projects[${index}] must be an object`);
+        continue;
+      }
+      const id = typeof item.id === "string" ? item.id.trim() : "";
+      const projectPath = typeof item.path === "string" ? item.path.trim() : "";
+      if (!id) errors.push(`projects[${index}].id must be a non-empty string`);
+      if (!projectPath) errors.push(`projects[${index}].path must be a non-empty string`);
+      const label = typeof item.label === "string" ? item.label.trim() : void 0;
+      const suiteConfigs = Array.isArray(item.suiteConfigs) ? item.suiteConfigs.filter((value) => typeof value === "string") : void 0;
+      projects.push({
+        id,
+        path: projectPath,
+        ...label ? { label } : {},
+        ...suiteConfigs && suiteConfigs.length > 0 ? { suiteConfigs } : {}
+      });
+    }
+  }
+  let importConfig;
+  if (input.import !== void 0) {
+    if (!isPlainObject(input.import)) {
+      errors.push("import must be an object");
+    } else {
+      importConfig = {};
+      if (input.import.ciArtifactsDir !== void 0) {
+        const dir = String(input.import.ciArtifactsDir).trim();
+        if (!isSafeRelativePath(dir)) {
+          errors.push("import.ciArtifactsDir must be a safe relative path");
+        } else {
+          importConfig.ciArtifactsDir = dir;
+        }
+      }
+      if (input.import.bundlesDir !== void 0) {
+        const dir = String(input.import.bundlesDir).trim();
+        if (!isSafeRelativePath(dir)) {
+          errors.push("import.bundlesDir must be a safe relative path");
+        } else {
+          importConfig.bundlesDir = dir;
+        }
+      }
+    }
+  }
+  if (errors.length > 0) return { ok: false, errors };
+  return {
+    ok: true,
+    registry: {
+      schemaVersion: STUDIO_REGISTRY_SCHEMA_VERSION,
+      name: String(input.name).trim(),
+      projects,
+      ...importConfig ? { import: importConfig } : {}
+    },
+    errors: []
+  };
+}
+async function readStudioRegistryFile(filePath) {
+  try {
+    const raw = await readFile(filePath, "utf8");
+    if (raw.length > MAX_REGISTRY_BYTES) {
+      return { ok: false, path: filePath, errors: ["registry file exceeds size limit"] };
+    }
+    const parsed = parseStudioRegistry(JSON.parse(raw));
+    return { ...parsed, path: filePath };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return { ok: false, path: filePath, errors: [message] };
+  }
+}
+function resolveRegistryProjectPath(registryDir, projectPath) {
+  return path5.isAbsolute(projectPath) ? path5.resolve(projectPath) : path5.resolve(registryDir, projectPath);
+}
+var STUDIO_DB_SCHEMA_VERSION = "1.0";
+var DEFAULT_STUDIO_DB_FILENAME = "studio.db";
+var SCHEMA_SQL = `
+CREATE TABLE IF NOT EXISTS meta (
+  key TEXT PRIMARY KEY,
+  value TEXT NOT NULL
+);
+CREATE TABLE IF NOT EXISTS projects (
+  id TEXT PRIMARY KEY,
+  label TEXT,
+  path TEXT NOT NULL,
+  workspace_dir TEXT NOT NULL,
+  project_name TEXT,
+  redaction_profile TEXT,
+  trace_count INTEGER NOT NULL DEFAULT 0,
+  imported_at TEXT NOT NULL
+);
+CREATE TABLE IF NOT EXISTS runs (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  project_id TEXT NOT NULL,
+  run_id TEXT NOT NULL,
+  name TEXT,
+  status TEXT,
+  file TEXT,
+  started_at REAL,
+  duration_ms REAL,
+  session_id TEXT,
+  UNIQUE(project_id, run_id)
+);
+CREATE INDEX IF NOT EXISTS idx_runs_project ON runs(project_id);
+CREATE INDEX IF NOT EXISTS idx_runs_status ON runs(status);
+`;
+function resolveStudioDbPath(options) {
+  if (options.dbPath && options.dbPath.trim() !== "") {
+    const raw = options.dbPath.trim();
+    if (raw.startsWith("postgres://") || raw.startsWith("postgresql://")) {
+      return raw;
+    }
+    return path5.resolve(options.cwd ?? process.cwd(), raw);
+  }
+  return path5.resolve(
+    options.cwd ?? process.cwd(),
+    ".agent-inspect",
+    DEFAULT_STUDIO_DB_FILENAME
+  );
+}
+function isPostgresDbPath(dbPath) {
+  return dbPath.startsWith("postgres://") || dbPath.startsWith("postgresql://");
+}
+function openStudioDb(dbPath) {
+  if (isPostgresDbPath(dbPath)) {
+    throw new Error(
+      "Postgres studio databases are not implemented in v6.0.0; use a SQLite file path."
+    );
+  }
+  const dir = path5.dirname(dbPath);
+  void mkdir(dir, { recursive: true });
+  const db = new Database(dbPath);
+  db.pragma("journal_mode = WAL");
+  db.exec(SCHEMA_SQL);
+  const insertMeta = db.prepare(
+    "INSERT INTO meta(key, value) VALUES(?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value"
+  );
+  insertMeta.run("schemaVersion", STUDIO_DB_SCHEMA_VERSION);
+  insertMeta.run("driver", "better-sqlite3");
+  return db;
+}
+function upsertStudioProject(db, row) {
+  db.prepare(
+    `INSERT INTO projects(id, label, path, workspace_dir, project_name, redaction_profile, trace_count, imported_at)
+     VALUES (@id, @label, @path, @workspaceDir, @projectName, @redactionProfile, @traceCount, @importedAt)
+     ON CONFLICT(id) DO UPDATE SET
+       label = excluded.label,
+       path = excluded.path,
+       workspace_dir = excluded.workspace_dir,
+       project_name = excluded.project_name,
+       redaction_profile = excluded.redaction_profile,
+       trace_count = excluded.trace_count,
+       imported_at = excluded.imported_at`
+  ).run({
+    id: row.id,
+    label: row.label,
+    path: row.path,
+    workspaceDir: row.workspaceDir,
+    projectName: row.projectName,
+    redactionProfile: row.redactionProfile,
+    traceCount: row.traceCount,
+    importedAt: row.importedAt
+  });
+}
+function replaceProjectRuns(db, projectId, runs) {
+  const tx = db.transaction(() => {
+    db.prepare("DELETE FROM runs WHERE project_id = ?").run(projectId);
+    const insert = db.prepare(
+      `INSERT INTO runs(project_id, run_id, name, status, file, started_at, duration_ms, session_id)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?)`
+    );
+    for (const run of runs) {
+      insert.run(
+        projectId,
+        run.runId,
+        run.name ?? null,
+        run.status ?? null,
+        run.file ?? null,
+        run.startedAt ?? null,
+        run.durationMs ?? null,
+        run.sessionId ?? null
+      );
+    }
+  });
+  tx();
+}
+function getStudioProject(db, projectId) {
+  return db.prepare(
+    `SELECT id, label, path, workspace_dir AS workspaceDir, project_name AS projectName,
+              redaction_profile AS redactionProfile, trace_count AS traceCount, imported_at AS importedAt
+       FROM projects WHERE id = ?`
+  ).get(projectId);
+}
+function listProjectRuns(db, projectId, limit = 200) {
+  const rows = db.prepare(
+    `SELECT project_id AS projectId, run_id AS runId, name, status, file,
+              started_at AS startedAt, duration_ms AS durationMs, session_id AS sessionId
+       FROM runs WHERE project_id = ? ORDER BY started_at DESC LIMIT ?`
+  ).all(projectId, limit);
+  return rows;
+}
+function searchProjectRuns(db, projectId, query, limit = 50) {
+  const pattern = `%${query}%`;
+  return db.prepare(
+    `SELECT project_id AS projectId, run_id AS runId, name, status, file,
+              started_at AS startedAt, duration_ms AS durationMs, session_id AS sessionId
+       FROM runs
+       WHERE project_id = ?
+         AND (run_id LIKE ? OR IFNULL(name, '') LIKE ? OR IFNULL(status, '') LIKE ?)
+       ORDER BY started_at DESC
+       LIMIT ?`
+  ).all(projectId, pattern, pattern, pattern, limit);
+}
+
+// packages/studio/src/import.ts
+async function discoverSuiteConfigs(projectRoot, configured) {
+  if (configured && configured.length > 0) {
+    return configured.map((rel) => path5.resolve(projectRoot, rel));
+  }
+  const found = [];
+  try {
+    const entries = await readdir(projectRoot);
+    for (const entry of entries) {
+      if (entry.endsWith(".suite.json")) {
+        found.push(path5.join(projectRoot, entry));
+      }
+    }
+  } catch {
+  }
+  return found.sort();
+}
+async function loadProjectRuns(workspaceDir, traceDirs) {
+  const runs = [];
+  for (const rel of traceDirs) {
+    const traceDir = resolveTraceDir({ dir: path5.join(workspaceDir, rel) });
+    const td = new TraceDirectory({ dir: traceDir });
+    const files = await td.list();
+    const metas = await loadTraceMetadataList(
+      traceDir,
+      files,
+      (fileName) => td.getPath(fileName)
+    );
+    for (const meta of metas) {
+      runs.push({
+        projectId: "",
+        runId: meta.runId,
+        ...meta.name !== void 0 ? { name: meta.name } : {},
+        status: meta.status,
+        file: path5.basename(meta.filePath),
+        ...meta.startedAt !== void 0 ? { startedAt: meta.startedAt } : {},
+        ...meta.durationMs !== void 0 ? { durationMs: meta.durationMs } : {}
+      });
+    }
+  }
+  return runs.sort((a, b) => (b.startedAt ?? 0) - (a.startedAt ?? 0));
+}
+async function importStudioRegistry(options) {
+  const registryDir = path5.dirname(options.registryPath);
+  const warnings = [];
+  const projects = [];
+  const importedAt = (/* @__PURE__ */ new Date()).toISOString();
+  for (const project of options.registry.projects) {
+    const imported = await importStudioProject({
+      db: options.db,
+      registryDir,
+      project,
+      importedAt,
+      warnings
+    });
+    if (imported) projects.push(imported);
+  }
+  return {
+    registryName: options.registry.name,
+    projects,
+    warnings
+  };
+}
+async function importStudioProject(options) {
+  const projectRoot = resolveRegistryProjectPath(
+    options.registryDir,
+    options.project.path
+  );
+  const location = resolveWorkspaceLocation(projectRoot);
+  const manifestRead = await readWorkspaceManifestFile(location);
+  if (!manifestRead.ok || manifestRead.manifest === void 0) {
+    options.warnings.push(
+      `project "${options.project.id}": ${manifestRead.errors.join("; ") || "workspace.json missing"}`
+    );
+    return void 0;
+  }
+  const runs = await loadProjectRuns(
+    location.workspaceDir,
+    manifestRead.manifest.traceDirs
+  );
+  const suiteConfigPaths = await discoverSuiteConfigs(
+    projectRoot,
+    options.project.suiteConfigs
+  );
+  const row = {
+    id: options.project.id,
+    label: options.project.label ?? options.project.id,
+    path: projectRoot,
+    workspaceDir: location.workspaceDir,
+    projectName: manifestRead.manifest.project,
+    redactionProfile: manifestRead.manifest.redactionProfile,
+    traceCount: runs.length,
+    importedAt: options.importedAt
+  };
+  upsertStudioProject(options.db, row);
+  replaceProjectRuns(
+    options.db,
+    options.project.id,
+    runs.map((run) => ({ ...run, projectId: options.project.id }))
+  );
+  return { ...row, suiteConfigPaths };
+}
+async function resolveStudioRegistryPath(options) {
+  if (options.workspacePath && options.workspacePath.trim() !== "") {
+    return path5.resolve(options.cwd ?? process.cwd(), options.workspacePath);
+  }
+  const cwd = path5.resolve(options.cwd ?? process.cwd());
+  for (const rel of STUDIO_REGISTRY_FILENAMES) {
+    const candidate = path5.join(cwd, rel);
+    try {
+      await access(candidate);
+      return candidate;
+    } catch {
+    }
+  }
+  return path5.join(cwd, STUDIO_REGISTRY_FILENAMES[0]);
+}
+
+// packages/studio/src/context.ts
+async function createStudioContext(options = {}) {
+  const cwd = options.cwd ?? process.cwd();
+  const registryPath = await resolveStudioRegistryPath({
+    ...options.workspacePath !== void 0 ? { workspacePath: options.workspacePath } : {},
+    cwd
+  });
+  const registryRead = await readStudioRegistryFile(registryPath);
+  if (!registryRead.ok || registryRead.registry === void 0) {
+    throw new Error(registryRead.errors.join("; ") || "invalid studio registry");
+  }
+  const dbPath = resolveStudioDbPath({
+    ...options.dbPath !== void 0 ? { dbPath: options.dbPath } : {},
+    cwd
+  });
+  const db = openStudioDb(dbPath);
+  const importResult = await importStudioRegistry({
+    db,
+    registry: registryRead.registry,
+    registryPath
+  });
+  return {
+    db,
+    dbPath,
+    registryPath,
+    registry: registryRead.registry,
+    importResult,
+    projects: importResult.projects
+  };
+}
+function summarizeProjects(projects) {
+  return projects.map((project) => ({
+    id: project.id,
+    label: project.label ?? project.id,
+    projectName: project.projectName,
+    traceCount: project.traceCount,
+    redactionProfile: project.redactionProfile,
+    importedAt: project.importedAt
+  }));
+}
+
+// packages/studio/src/html.ts
+var studioIndexHtml = `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <title>AgentInspect Studio</title>
+  <style>
+    body { font-family: system-ui, sans-serif; margin: 1.5rem; line-height: 1.4; }
+    h1 { font-size: 1.25rem; }
+    .muted { color: #666; }
+  </style>
+</head>
+<body>
+  <h1>AgentInspect Studio</h1>
+  <p class="muted">Self-hosted, read-only. JSONL and workspace manifests remain canonical.</p>
+  <p id="status">Loading health\u2026</p>
+  <script>
+    fetch("/api/health")
+      .then((res) => res.json())
+      .then((data) => {
+        document.getElementById("status").textContent =
+          data.ok ? "Studio is running (read-only)." : "Studio health check failed.";
+      })
+      .catch(() => {
+        document.getElementById("status").textContent = "Studio health check failed.";
+      });
+  </script>
+</body>
+</html>`;
+function getImportedProject(db, projects, projectId) {
+  const cached = projects.find((item) => item.id === projectId);
+  if (cached) return { project: cached };
+  const row = getStudioProject(db, projectId);
+  if (!row) return void 0;
+  return {
+    project: {
+      ...row,
+      suiteConfigPaths: []
+    }
+  };
+}
+async function loadTraceDirMetas(workspaceDir, traceDirs) {
+  const metas = [];
+  for (const rel of traceDirs) {
+    const traceDir = resolveTraceDir({ dir: path5.join(workspaceDir, rel) });
+    const td = new TraceDirectory({ dir: traceDir });
+    const files = await td.list();
+    const listed = await loadTraceMetadataList(
+      traceDir,
+      files,
+      (fileName) => td.getPath(fileName)
+    );
+    metas.push(...listed);
+  }
+  return metas;
+}
+async function loadProjectRunsView(ctx, db, limit = 200) {
+  return listProjectRuns(db, ctx.project.id, limit);
+}
+async function loadProjectSessionsView(ctx) {
+  const location = resolveWorkspaceLocation(ctx.project.path);
+  const manifestRead = await readWorkspaceManifestFile(location);
+  const traceDirs = manifestRead.manifest?.traceDirs ?? ["runs"];
+  const metas = await loadTraceDirMetas(ctx.project.workspaceDir, traceDirs);
+  const runs = await loadSessionRunRecords(metas);
+  return buildSessionIndex(runs, { correlateByGroupId: true });
+}
+async function loadProjectSuitesView(ctx) {
+  const suites = [];
+  for (const configPath of ctx.project.suiteConfigPaths) {
+    try {
+      const result = await runSuite({
+        configPath,
+        cwd: path5.dirname(configPath)
+      });
+      suites.push({
+        suiteName: result.suiteName,
+        configPath: result.configPath,
+        ok: result.ok,
+        status: result.status,
+        summary: result.summary,
+        cases: result.cases.map((item) => ({
+          id: item.id,
+          status: item.status,
+          ...item.runId !== void 0 ? { runId: item.runId } : {},
+          ...item.message !== void 0 ? { message: item.message } : {}
+        }))
+      });
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      suites.push({
+        suiteName: path5.basename(configPath),
+        configPath,
+        ok: false,
+        status: "error",
+        summary: { total: 0, passed: 0, failed: 0, skipped: 0 },
+        cases: [],
+        error: message
+      });
+    }
+  }
+  return { suites };
+}
+async function loadProjectChecksView(ctx) {
+  const metas = await loadTraceDirMetas(ctx.project.workspaceDir, ["runs"]);
+  const results = [];
+  for (const meta of metas.slice(0, 20)) {
+    try {
+      const read = await openTrace({ type: "file", path: meta.filePath });
+      const result = runTraceChecks(
+        { read },
+        { rules: [createRunStatusRule()], select: ["run.status"], runId: meta.runId }
+      );
+      results.push({
+        runId: meta.runId,
+        ok: result.ok,
+        summary: result.summary
+      });
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      results.push({ runId: meta.runId, ok: false, error: message });
+    }
+  }
+  return { checks: results };
+}
+async function loadProjectSearchView(ctx, db, params) {
+  const q = params.get("q")?.trim() ?? "";
+  if (q) {
+    return {
+      query: q,
+      results: searchProjectRuns(
+        db,
+        ctx.project.id,
+        q,
+        Number(params.get("limit") ?? 50)
+      )
+    };
+  }
+  const metas = await loadTraceDirMetas(ctx.project.workspaceDir, ["runs"]);
+  const traceDir = resolveTraceDir({
+    dir: path5.join(ctx.project.workspaceDir, "runs")
+  });
+  const results = await searchTraces(metas, {
+    traceDir,
+    ...params.get("status") ? { status: params.get("status") } : {},
+    ...params.get("name") ? { name: params.get("name") ?? void 0 } : {},
+    ...params.get("tool") ? { tool: params.get("tool") ?? void 0 } : {},
+    limit: Number(params.get("limit") ?? 50)
+  });
+  return { query: q, results };
+}
+async function loadProjectDiffView(ctx, params) {
+  const leftRunId = params.get("left");
+  const rightRunId = params.get("right");
+  if (!leftRunId || !rightRunId) {
+    throw new Error("left and right run ids are required.");
+  }
+  const metas = await loadTraceDirMetas(ctx.project.workspaceDir, ["runs"]);
+  const leftMeta = metas.find((item) => item.runId === leftRunId);
+  const rightMeta = metas.find((item) => item.runId === rightRunId);
+  if (!leftMeta || !rightMeta) {
+    throw new Error("One or both runs were not found in the project workspace.");
+  }
+  const leftRead = await openTrace({ type: "file", path: leftMeta.filePath });
+  const rightRead = await openTrace({ type: "file", path: rightMeta.filePath });
+  const diff = diffRuns(
+    manualTraceEventsToComparableRun(
+      persistedInspectEventsToTraceEvents(leftRead.events)
+    ),
+    manualTraceEventsToComparableRun(
+      persistedInspectEventsToTraceEvents(rightRead.events)
+    )
+  );
+  return {
+    leftRunId,
+    rightRunId,
+    summary: diff.summary,
+    differences: diff.differences.slice(0, 50).map((item) => ({
+      kind: item.kind,
+      message: item.message
+    }))
+  };
+}
+async function loadProjectReportsView(ctx) {
+  const reportsDir = path5.join(ctx.project.workspaceDir, "reports");
+  const reports = [];
+  try {
+    const files = await readdir(reportsDir);
+    for (const file of files) {
+      const filePath = path5.join(reportsDir, file);
+      const info = await stat(filePath);
+      if (!info.isFile()) continue;
+      reports.push({ name: file, path: filePath, sizeBytes: info.size });
+    }
+  } catch {
+  }
+  return { reports: reports.sort((a, b) => a.name.localeCompare(b.name)) };
+}
+async function loadProjectObservationsView(ctx) {
+  const metas = await loadTraceDirMetas(ctx.project.workspaceDir, ["runs"]);
+  const observations = [];
+  for (const meta of metas.slice(0, 20)) {
+    try {
+      const read = await openTrace({ type: "file", path: meta.filePath });
+      const legacy = persistedInspectEventsToTraceEvents(read.events);
+      observations.push({
+        runId: meta.runId,
+        items: extractOutcomesFromTraceEvents(legacy),
+        timeline: buildRunTimeline(legacy, { focus: "all" }).entries.filter((entry) => entry.type === "tool").map((entry) => entry.name)
+      });
+    } catch {
+      observations.push({ runId: meta.runId, items: [], timeline: [] });
+    }
+  }
+  return { observations };
+}
+async function loadProjectGuardrailsView(ctx) {
+  return {
+    guardrails: {
+      message: "Guardrail evaluation is available via CLI (`agent-inspect scan`). Studio surfaces structural status only in v6.0.",
+      redactionProfile: ctx.project.redactionProfile ?? "share",
+      circuitWarnings: []
+    }
+  };
+}
+async function loadProjectRedactionView(ctx) {
+  return {
+    redaction: {
+      profile: ctx.project.redactionProfile ?? "share",
+      hint: "Structural share-safety posture from workspace.json \u2014 not certification.",
+      bundleCommand: `npx agent-inspect bundle <runId> --profile ${ctx.project.redactionProfile ?? "share"}`
+    }
+  };
+}
+async function loadBundleExportView(ctx, params) {
+  const runId = params.get("runId");
+  if (!runId) {
+    throw new Error("runId query parameter is required.");
+  }
+  return {
+    projectId: ctx.project.id,
+    runId,
+    readOnly: true,
+    redactionProfile: ctx.project.redactionProfile ?? "share",
+    cliHint: `npx agent-inspect bundle ${runId} --profile ${ctx.project.redactionProfile ?? "share"} --dir ${path5.join(ctx.project.workspaceDir, "runs")}`,
+    note: "Studio does not mutate traces or upload bundles. Run the CLI locally to assemble a share-safe bundle."
+  };
+}
+
+// packages/studio/src/auth.ts
+function resolveStudioAuthMode(options) {
+  return options.auth === "basic" ? "basic" : "none";
+}
+function resolveStudioPassword(options) {
+  if (!options.passwordEnv) return void 0;
+  const value = process.env[options.passwordEnv]?.trim();
+  return value && value.length > 0 ? value : void 0;
+}
+function parseBasicAuth(header) {
+  if (!header || !header.startsWith("Basic ")) return void 0;
+  try {
+    const decoded = Buffer.from(header.slice(6), "base64").toString("utf8");
+    const separator = decoded.indexOf(":");
+    if (separator < 0) return void 0;
+    return decoded.slice(separator + 1);
+  } catch {
+    return void 0;
+  }
+}
+function isStudioRequestAuthorized(req, options) {
+  const mode = resolveStudioAuthMode(options);
+  if (mode === "none") return true;
+  const expected = resolveStudioPassword(options);
+  if (!expected) return false;
+  const provided = parseBasicAuth(req.headers.authorization);
+  return provided === expected;
+}
+function studioAuthRequiredResponse() {
+  return {
+    status: 401,
+    body: { error: "Unauthorized" },
+    headers: {
+      "www-authenticate": 'Basic realm="AgentInspect Studio"'
+    }
+  };
+}
+
+// packages/studio/src/routes.ts
+function sendJson(res, status, body, headers = {}) {
+  const payload = JSON.stringify(body);
+  res.writeHead(status, {
+    "content-type": "application/json; charset=utf-8",
+    "cache-control": "no-store",
+    ...headers
+  });
+  res.end(payload);
+}
+function notFound(res, message) {
+  sendJson(res, 404, { error: message });
+}
+function decodeSegment(segment) {
+  if (!segment) return "";
+  try {
+    return decodeURIComponent(segment);
+  } catch {
+    return segment;
+  }
+}
+async function handleStudioRoute(req, res, ctx, options, pathname, url) {
+  if (!isStudioRequestAuthorized(req, options)) {
+    const auth = studioAuthRequiredResponse();
+    sendJson(res, auth.status, auth.body, auth.headers);
+    return true;
+  }
+  if (pathname === "/api/health") {
+    sendJson(res, 200, {
+      ok: true,
+      readOnly: true,
+      mode: "studio",
+      registryName: ctx.registry.name,
+      registryPath: ctx.registryPath,
+      dbPath: ctx.dbPath,
+      projects: summarizeProjects(ctx.projects),
+      warnings: ctx.importResult.warnings
+    });
+    return true;
+  }
+  if (pathname === "/api/projects") {
+    sendJson(res, 200, {
+      registryName: ctx.registry.name,
+      projects: summarizeProjects(ctx.projects),
+      warnings: ctx.importResult.warnings
+    });
+    return true;
+  }
+  const projectMatch = pathname.match(/^\/api\/projects\/([^/]+)(?:\/(.*))?$/);
+  if (projectMatch) {
+    const projectId = decodeSegment(projectMatch[1]);
+    const subpath = projectMatch[2] ?? "";
+    const projectCtx = getImportedProject(ctx.db, ctx.projects, projectId);
+    if (!projectCtx) {
+      notFound(res, `Project not found: ${projectId}`);
+      return true;
+    }
+    if (subpath === "runs" || subpath === "") {
+      sendJson(res, 200, {
+        projectId,
+        runs: await loadProjectRunsView(projectCtx, ctx.db)
+      });
+      return true;
+    }
+    if (subpath === "sessions") {
+      sendJson(res, 200, {
+        projectId,
+        ...await loadProjectSessionsView(projectCtx)
+      });
+      return true;
+    }
+    if (subpath === "suites") {
+      sendJson(res, 200, {
+        projectId,
+        ...await loadProjectSuitesView(projectCtx)
+      });
+      return true;
+    }
+    if (subpath === "checks") {
+      sendJson(res, 200, {
+        projectId,
+        ...await loadProjectChecksView(projectCtx)
+      });
+      return true;
+    }
+    if (subpath === "observations") {
+      sendJson(res, 200, {
+        projectId,
+        ...await loadProjectObservationsView(projectCtx)
+      });
+      return true;
+    }
+    if (subpath === "guardrails") {
+      sendJson(res, 200, {
+        projectId,
+        ...await loadProjectGuardrailsView(projectCtx)
+      });
+      return true;
+    }
+    if (subpath === "redaction") {
+      sendJson(res, 200, {
+        projectId,
+        ...await loadProjectRedactionView(projectCtx)
+      });
+      return true;
+    }
+    if (subpath === "reports") {
+      sendJson(res, 200, {
+        projectId,
+        ...await loadProjectReportsView(projectCtx)
+      });
+      return true;
+    }
+    notFound(res, `Unknown project route: /${subpath}`);
+    return true;
+  }
+  if (pathname === "/api/search") {
+    const projectId = url.searchParams.get("projectId");
+    if (!projectId) {
+      sendJson(res, 400, { error: "projectId query parameter is required." });
+      return true;
+    }
+    const projectCtx = getImportedProject(ctx.db, ctx.projects, projectId);
+    if (!projectCtx) {
+      notFound(res, `Project not found: ${projectId}`);
+      return true;
+    }
+    sendJson(res, 200, {
+      projectId,
+      ...await loadProjectSearchView(projectCtx, ctx.db, url.searchParams)
+    });
+    return true;
+  }
+  if (pathname === "/api/diff") {
+    const projectId = url.searchParams.get("projectId");
+    if (!projectId) {
+      sendJson(res, 400, { error: "projectId query parameter is required." });
+      return true;
+    }
+    const projectCtx = getImportedProject(ctx.db, ctx.projects, projectId);
+    if (!projectCtx) {
+      notFound(res, `Project not found: ${projectId}`);
+      return true;
+    }
+    try {
+      sendJson(res, 200, {
+        projectId,
+        ...await loadProjectDiffView(projectCtx, url.searchParams)
+      });
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      sendJson(res, 400, { error: message });
+    }
+    return true;
+  }
+  if (pathname === "/api/reports") {
+    const projectId = url.searchParams.get("projectId");
+    if (!projectId) {
+      sendJson(res, 400, { error: "projectId query parameter is required." });
+      return true;
+    }
+    const projectCtx = getImportedProject(ctx.db, ctx.projects, projectId);
+    if (!projectCtx) {
+      notFound(res, `Project not found: ${projectId}`);
+      return true;
+    }
+    sendJson(res, 200, {
+      projectId,
+      ...await loadProjectReportsView(projectCtx)
+    });
+    return true;
+  }
+  if (pathname === "/api/bundles/export") {
+    const projectId = url.searchParams.get("projectId");
+    if (!projectId) {
+      sendJson(res, 400, { error: "projectId query parameter is required." });
+      return true;
+    }
+    const projectCtx = getImportedProject(ctx.db, ctx.projects, projectId);
+    if (!projectCtx) {
+      notFound(res, `Project not found: ${projectId}`);
+      return true;
+    }
+    try {
+      sendJson(res, 200, await loadBundleExportView(projectCtx, url.searchParams));
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      sendJson(res, 400, { error: message });
+    }
+    return true;
+  }
+  return false;
+}
+
+// packages/studio/src/server.ts
+var DEFAULT_HOST = "127.0.0.1";
+var DEFAULT_PORT = 7340;
+function badRequest(res, message) {
+  res.writeHead(400, {
+    "content-type": "application/json; charset=utf-8",
+    "cache-control": "no-store"
+  });
+  res.end(JSON.stringify({ error: message }));
+}
+function resolveHost(options) {
+  if (options.server === true) {
+    return options.host ?? "0.0.0.0";
+  }
+  return options.host ?? DEFAULT_HOST;
+}
+function createStudioServer(options = {}) {
+  const host = resolveHost(options);
+  const port = options.port ?? DEFAULT_PORT;
+  let contextPromise = options.context ? Promise.resolve(options.context) : void 0;
+  if (host === "0.0.0.0") {
+    console.warn(
+      "[AgentInspect studio] Binding to 0.0.0.0 exposes workspace evidence on the network. Use 127.0.0.1 unless you accept that risk."
+    );
+    if (options.auth !== "basic") {
+      console.warn(
+        "[AgentInspect studio] Non-localhost binding without --auth basic is discouraged for production use."
+      );
+    }
+  }
+  const server = createServer(async (req, res) => {
+    try {
+      if (req.method !== "GET" && req.method !== "HEAD") {
+        return badRequest(res, "Only GET is supported.");
+      }
+      if (!contextPromise) {
+        contextPromise = createStudioContext(options);
+      }
+      const ctx = await contextPromise;
+      const url = new URL(req.url ?? "/", `http://${host}:${port}`);
+      const pathname = url.pathname;
+      if (pathname === "/" || pathname === "/index.html") {
+        if (req.method === "HEAD") {
+          res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+          res.end();
+          return;
+        }
+        res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+        res.end(studioIndexHtml);
+        return;
+      }
+      const handled = await handleStudioRoute(req, res, ctx, options, pathname, url);
+      if (!handled) {
+        res.writeHead(404, {
+          "content-type": "application/json; charset=utf-8",
+          "cache-control": "no-store"
+        });
+        res.end(JSON.stringify({ error: `Unknown route: ${pathname}` }));
+      }
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      res.writeHead(500, {
+        "content-type": "application/json; charset=utf-8",
+        "cache-control": "no-store"
+      });
+      res.end(JSON.stringify({ error: message }));
+    }
+  });
+  return server;
+}
+async function startStudioServer(options = {}) {
+  const host = resolveHost(options);
+  const port = options.port ?? DEFAULT_PORT;
+  const ctx = options.context ?? await createStudioContext(options);
+  const server = createStudioServer({ ...options, context: ctx });
+  return new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(port, host, () => {
+      const address = server.address();
+      const resolvedPort = typeof address === "object" && address ? address.port : port;
+      resolve({
+        host,
+        port: resolvedPort,
+        url: `http://${host === "0.0.0.0" ? "127.0.0.1" : host}:${resolvedPort}/`,
+        mode: "studio",
+        ...options.workspacePath !== void 0 ? { workspacePath: options.workspacePath } : {},
+        dbPath: ctx.dbPath,
+        registryName: ctx.registry.name,
+        projectCount: ctx.projects.length
+      });
+    });
+  });
+}
+
+export { createStudioContext, createStudioServer, parseStudioRegistry, readStudioRegistryFile, startStudioServer, studioIndexHtml, summarizeProjects };
+//# sourceMappingURL=index.mjs.map
+//# sourceMappingURL=index.mjs.map