@agent-inspect/studio 6.7.1 → 6.7.3

package/README.md

@@ -1,16 +1,20 @@
 # @agent-inspect/studio
 
-Self-hosted, read-only Studio analyzer for multi-project AgentInspect workspaces. Customer-owned — no maintainer cloud.
+Customer-owned, read-only Studio analyzer for registered AgentInspect workspaces. **No maintainer-hosted cloud.**
+
+**Support level:** Beta — see [SUPPORT-LEVELS.md](https://github.com/rajudandigam/agent-inspect/blob/main/docs/SUPPORT-LEVELS.md).
 
 ## When to use
 
-- Team-internal browser UI over multiple AgentInspect workspaces
-- Localhost or explicitly configured self-hosted binding
+- Team-internal browser UI over one or more local workspaces
+- Localhost review of projects, runs, search, and imports
+- Explicit, opt-in ingest of files / GitHub artifacts / HTTP (all **disabled by default**)
 
 ## When not to use
 
 - Maintainer-hosted dashboards or SaaS
-- Trace mutation or ingest (use CLI writers; ingest is v6.1+)
+- Production HA / Postgres / enterprise SSO (not supported)
+- Trace mutation (Studio is read-only over registered workspaces)
 
 ## Install
 
@@ -18,17 +22,30 @@ Self-hosted, read-only Studio analyzer for multi-project AgentInspect workspaces
 npm install agent-inspect @agent-inspect/studio
 ```
 
-## Example
+Optional index: `@agent-inspect/index-sqlite` (Beta).
+
+## Two-minute start
 
 ```bash
 npx agent-inspect studio
+# default: http://127.0.0.1:7340
 npx agent-inspect studio --port 7340 --host 127.0.0.1
 ```
 
-## Privacy
+Register workspaces via the Studio registry / CLI docs. SQLite is the current supported store.
+
+## Privacy and network
+
+- Binds to **localhost** by default
+- **No default upload** or hidden telemetry
+- File-drop ingest: local only
+- GitHub artifact import: **explicit**; uses your credentials → GitHub
+- HTTP ingest: **disabled by default**; requires token + binding when enabled
+- See [NETWORK-BEHAVIOR.md](https://github.com/rajudandigam/agent-inspect/blob/main/docs/NETWORK-BEHAVIOR.md) · [SELF-HOSTING.md](https://github.com/rajudandigam/agent-inspect/blob/main/docs/SELF-HOSTING.md)
+
+## Current pages (honest)
 
-- Binds to localhost by default; read-only GET routes
-- No default upload or telemetry
+Useful HTML for projects, runs, and search. Sessions / suites / safety views may still be thinner than the underlying APIs (JSON-oriented). Treat Studio as Beta.
 
 ## API
 
@@ -38,9 +55,22 @@ npx agent-inspect studio --port 7340 --host 127.0.0.1
 
 `npx agent-inspect studio` (requires this package installed)
 
+## Limitations
+
+- No Postgres mode
+- Not a production APM
+- External design-partner evidence still pending for broad adoption claims
+- Docker Compose examples are customer-owned templates — verify before production use
+
 ## Docs
 
-- [SELF-HOSTED-STUDIO-V6.0.md](../../docs/proposals/SELF-HOSTED-STUDIO-V6.0.md)
+- [SELF-HOSTING.md](https://github.com/rajudandigam/agent-inspect/blob/main/docs/SELF-HOSTING.md)
+- [WORKSPACE.md](https://github.com/rajudandigam/agent-inspect/blob/main/docs/WORKSPACE.md)
+- [PRE-V7-PILOT-KIT.md](https://github.com/rajudandigam/agent-inspect/blob/main/docs/PRE-V7-PILOT-KIT.md)
+
+## Version
+
+Part of the fixed AgentInspect release line. See the npm badge / package manifest for the current version.
 
 ## License
 

package/dist/index.cjs

@@ -862,9 +862,9 @@ var DEFAULT_HTTP_INGEST_BASE_PATH = "/api/ingest";
 var HTTP_INGEST_BUNDLE_PATH = "/api/ingest/bundle";
 var HTTP_INGEST_ARTIFACT_PATH = "/api/ingest/artifact";
 var DEFAULT_MAX_INGEST_BYTES = 52428800;
-function resolveHttpIngestConfig(options, registryEnabled) {
-  const http = options.context?.registry.ingest?.http;
-  const enabled = options.ingestHttp === true || registryEnabled === true || http?.enabled === true;
+function resolveHttpIngestConfig(options, registryHttp) {
+  const http = registryHttp ?? options.context?.registry.ingest?.http;
+  const enabled = options.ingestHttp === true || http?.enabled === true;
   const basePath = (http?.path ?? DEFAULT_HTTP_INGEST_BASE_PATH).trim() || DEFAULT_HTTP_INGEST_BASE_PATH;
   const tokenEnv = resolveIngestTokenEnv({
     ...options.ingestTokenEnv !== void 0 ? { tokenEnv: options.ingestTokenEnv } : {},
@@ -897,7 +897,7 @@ function isHttpIngestRoute(pathname, config) {
   return pathname === HTTP_INGEST_BUNDLE_PATH || pathname === HTTP_INGEST_ARTIFACT_PATH || pathname === `${config.basePath}/bundle` || pathname === `${config.basePath}/artifact`;
 }
 async function handleHttpIngestRequest(req, res, ctx, options, pathname) {
-  const config = resolveHttpIngestConfig(options, ctx.registry.ingest?.http?.enabled);
+  const config = resolveHttpIngestConfig(options, ctx.registry.ingest?.http);
   if (!isHttpIngestRoute(pathname, config)) return false;
   if (!config.enabled) {
     sendJson(res, 404, { error: "HTTP ingest is disabled" });
@@ -1344,8 +1344,6 @@ async function loadBundleExportView(ctx, params) {
     note: "Studio does not mutate traces or upload bundles. Run the CLI locally to assemble a share-safe bundle."
   };
 }
-
-// packages/studio/src/auth.ts
 function resolveStudioAuthMode(options) {
   return options.auth === "basic" ? "basic" : "none";
 }
@@ -1365,13 +1363,19 @@ function parseBasicAuth(header) {
     return void 0;
   }
 }
+function timingSafePasswordEqual(provided, expected) {
+  const providedDigest = crypto.createHash("sha256").update(provided, "utf8").digest();
+  const expectedDigest = crypto.createHash("sha256").update(expected, "utf8").digest();
+  return crypto.timingSafeEqual(providedDigest, expectedDigest);
+}
 function isStudioRequestAuthorized(req, options) {
   const mode = resolveStudioAuthMode(options);
   if (mode === "none") return true;
   const expected = resolveStudioPassword(options);
   if (!expected) return false;
   const provided = parseBasicAuth(req.headers.authorization);
-  return provided === expected;
+  if (provided === void 0) return false;
+  return timingSafePasswordEqual(provided, expected);
 }
 function studioAuthRequiredResponse() {
   return {
@@ -1616,7 +1620,7 @@ function createStudioServer(options = {}) {
         contextPromise = createStudioContext(options);
       }
       const ctx = await contextPromise;
-      const httpConfig = resolveHttpIngestConfig(options, ctx.registry.ingest?.http?.enabled);
+      const httpConfig = resolveHttpIngestConfig(options, ctx.registry.ingest?.http);
       if (isHttpIngestRoute(pathname, httpConfig)) {
         const handled2 = await handleHttpIngestRequest(req, res, ctx, options, pathname);
         if (handled2) return;
@@ -1895,6 +1899,28 @@ async function validateBundleDirectory(bundleDir) {
   }
   return errors;
 }
+async function hashBundleContents(bundleDir) {
+  const hash = crypto.createHash("sha256");
+  const walk = async (dir, relPrefix) => {
+    const entries = (await promises.readdir(dir, { withFileTypes: true })).sort(
+      (a, b) => a.name.localeCompare(b.name)
+    );
+    for (const entry of entries) {
+      const abs = path8__default.default.join(dir, entry.name);
+      const rel = relPrefix ? `${relPrefix}/${entry.name}` : entry.name;
+      if (entry.isDirectory()) {
+        await walk(abs, rel);
+      } else if (entry.isFile()) {
+        hash.update(rel);
+        hash.update("\0");
+        hash.update(await promises.readFile(abs));
+        hash.update("\0");
+      }
+    }
+  };
+  await walk(bundleDir, "");
+  return hash.digest("hex");
+}
 async function copyDirectoryRecursive(sourceDir, destDir) {
   await promises.mkdir(destDir, { recursive: true });
   const entries = await promises.readdir(sourceDir, { withFileTypes: true });
@@ -1949,8 +1975,7 @@ async function importBundleUpload(options) {
       registryImportWarnings
     };
   }
-  const metadataRaw = await promises.readFile(path8__default.default.join(bundlePath, "metadata.json"), "utf8");
-  const contentHash = crypto.createHash("sha256").update(metadataRaw).digest("hex");
+  const contentHash = await hashBundleContents(bundlePath);
   const sourceKey = `bundle:${bundlePath}`;
   const existing = findIngestFileBySourceKey(options.db, sourceKey);
   if (existing && existing.contentHash === contentHash) {