@agent-inspect/studio 6.7.2 → 6.7.3

package/dist/index.cjs

@@ -862,9 +862,9 @@ var DEFAULT_HTTP_INGEST_BASE_PATH = "/api/ingest";
 var HTTP_INGEST_BUNDLE_PATH = "/api/ingest/bundle";
 var HTTP_INGEST_ARTIFACT_PATH = "/api/ingest/artifact";
 var DEFAULT_MAX_INGEST_BYTES = 52428800;
-function resolveHttpIngestConfig(options, registryEnabled) {
-  const http = options.context?.registry.ingest?.http;
-  const enabled = options.ingestHttp === true || registryEnabled === true || http?.enabled === true;
+function resolveHttpIngestConfig(options, registryHttp) {
+  const http = registryHttp ?? options.context?.registry.ingest?.http;
+  const enabled = options.ingestHttp === true || http?.enabled === true;
   const basePath = (http?.path ?? DEFAULT_HTTP_INGEST_BASE_PATH).trim() || DEFAULT_HTTP_INGEST_BASE_PATH;
   const tokenEnv = resolveIngestTokenEnv({
     ...options.ingestTokenEnv !== void 0 ? { tokenEnv: options.ingestTokenEnv } : {},
@@ -897,7 +897,7 @@ function isHttpIngestRoute(pathname, config) {
   return pathname === HTTP_INGEST_BUNDLE_PATH || pathname === HTTP_INGEST_ARTIFACT_PATH || pathname === `${config.basePath}/bundle` || pathname === `${config.basePath}/artifact`;
 }
 async function handleHttpIngestRequest(req, res, ctx, options, pathname) {
-  const config = resolveHttpIngestConfig(options, ctx.registry.ingest?.http?.enabled);
+  const config = resolveHttpIngestConfig(options, ctx.registry.ingest?.http);
   if (!isHttpIngestRoute(pathname, config)) return false;
   if (!config.enabled) {
     sendJson(res, 404, { error: "HTTP ingest is disabled" });
@@ -1344,8 +1344,6 @@ async function loadBundleExportView(ctx, params) {
     note: "Studio does not mutate traces or upload bundles. Run the CLI locally to assemble a share-safe bundle."
   };
 }
-
-// packages/studio/src/auth.ts
 function resolveStudioAuthMode(options) {
   return options.auth === "basic" ? "basic" : "none";
 }
@@ -1365,13 +1363,19 @@ function parseBasicAuth(header) {
     return void 0;
   }
 }
+function timingSafePasswordEqual(provided, expected) {
+  const providedDigest = crypto.createHash("sha256").update(provided, "utf8").digest();
+  const expectedDigest = crypto.createHash("sha256").update(expected, "utf8").digest();
+  return crypto.timingSafeEqual(providedDigest, expectedDigest);
+}
 function isStudioRequestAuthorized(req, options) {
   const mode = resolveStudioAuthMode(options);
   if (mode === "none") return true;
   const expected = resolveStudioPassword(options);
   if (!expected) return false;
   const provided = parseBasicAuth(req.headers.authorization);
-  return provided === expected;
+  if (provided === void 0) return false;
+  return timingSafePasswordEqual(provided, expected);
 }
 function studioAuthRequiredResponse() {
   return {
@@ -1616,7 +1620,7 @@ function createStudioServer(options = {}) {
         contextPromise = createStudioContext(options);
       }
       const ctx = await contextPromise;
-      const httpConfig = resolveHttpIngestConfig(options, ctx.registry.ingest?.http?.enabled);
+      const httpConfig = resolveHttpIngestConfig(options, ctx.registry.ingest?.http);
       if (isHttpIngestRoute(pathname, httpConfig)) {
         const handled2 = await handleHttpIngestRequest(req, res, ctx, options, pathname);
         if (handled2) return;
@@ -1895,6 +1899,28 @@ async function validateBundleDirectory(bundleDir) {
   }
   return errors;
 }
+async function hashBundleContents(bundleDir) {
+  const hash = crypto.createHash("sha256");
+  const walk = async (dir, relPrefix) => {
+    const entries = (await promises.readdir(dir, { withFileTypes: true })).sort(
+      (a, b) => a.name.localeCompare(b.name)
+    );
+    for (const entry of entries) {
+      const abs = path8__default.default.join(dir, entry.name);
+      const rel = relPrefix ? `${relPrefix}/${entry.name}` : entry.name;
+      if (entry.isDirectory()) {
+        await walk(abs, rel);
+      } else if (entry.isFile()) {
+        hash.update(rel);
+        hash.update("\0");
+        hash.update(await promises.readFile(abs));
+        hash.update("\0");
+      }
+    }
+  };
+  await walk(bundleDir, "");
+  return hash.digest("hex");
+}
 async function copyDirectoryRecursive(sourceDir, destDir) {
   await promises.mkdir(destDir, { recursive: true });
   const entries = await promises.readdir(sourceDir, { withFileTypes: true });
@@ -1949,8 +1975,7 @@ async function importBundleUpload(options) {
       registryImportWarnings
     };
   }
-  const metadataRaw = await promises.readFile(path8__default.default.join(bundlePath, "metadata.json"), "utf8");
-  const contentHash = crypto.createHash("sha256").update(metadataRaw).digest("hex");
+  const contentHash = await hashBundleContents(bundlePath);
   const sourceKey = `bundle:${bundlePath}`;
   const existing = findIngestFileBySourceKey(options.db, sourceKey);
   if (existing && existing.contentHash === contentHash) {