@agent-inspect/studio 6.7.2 → 6.7.4

package/dist/index.d.cts

@@ -256,7 +256,7 @@ interface HttpIngestConfig {
     tokenEnv: string;
     maxBytes: number;
 }
-declare function resolveHttpIngestConfig(options: StudioServerOptions, registryEnabled?: boolean): HttpIngestConfig;
+declare function resolveHttpIngestConfig(options: StudioServerOptions, registryHttp?: StudioRegistryHttpIngest): HttpIngestConfig;
 declare function isHttpIngestRoute(pathname: string, config: HttpIngestConfig): boolean;
 declare function handleHttpIngestRequest(req: IncomingMessage, res: ServerResponse, ctx: StudioContext, options: StudioServerOptions, pathname: string): Promise<boolean>;
 

package/dist/index.d.ts

@@ -256,7 +256,7 @@ interface HttpIngestConfig {
     tokenEnv: string;
     maxBytes: number;
 }
-declare function resolveHttpIngestConfig(options: StudioServerOptions, registryEnabled?: boolean): HttpIngestConfig;
+declare function resolveHttpIngestConfig(options: StudioServerOptions, registryHttp?: StudioRegistryHttpIngest): HttpIngestConfig;
 declare function isHttpIngestRoute(pathname: string, config: HttpIngestConfig): boolean;
 declare function handleHttpIngestRequest(req: IncomingMessage, res: ServerResponse, ctx: StudioContext, options: StudioServerOptions, pathname: string): Promise<boolean>;
 

package/dist/index.mjs

@@ -855,9 +855,9 @@ var DEFAULT_HTTP_INGEST_BASE_PATH = "/api/ingest";
 var HTTP_INGEST_BUNDLE_PATH = "/api/ingest/bundle";
 var HTTP_INGEST_ARTIFACT_PATH = "/api/ingest/artifact";
 var DEFAULT_MAX_INGEST_BYTES = 52428800;
-function resolveHttpIngestConfig(options, registryEnabled) {
-  const http = options.context?.registry.ingest?.http;
-  const enabled = options.ingestHttp === true || registryEnabled === true || http?.enabled === true;
+function resolveHttpIngestConfig(options, registryHttp) {
+  const http = registryHttp ?? options.context?.registry.ingest?.http;
+  const enabled = options.ingestHttp === true || http?.enabled === true;
   const basePath = (http?.path ?? DEFAULT_HTTP_INGEST_BASE_PATH).trim() || DEFAULT_HTTP_INGEST_BASE_PATH;
   const tokenEnv = resolveIngestTokenEnv({
     ...options.ingestTokenEnv !== void 0 ? { tokenEnv: options.ingestTokenEnv } : {},
@@ -890,7 +890,7 @@ function isHttpIngestRoute(pathname, config) {
   return pathname === HTTP_INGEST_BUNDLE_PATH || pathname === HTTP_INGEST_ARTIFACT_PATH || pathname === `${config.basePath}/bundle` || pathname === `${config.basePath}/artifact`;
 }
 async function handleHttpIngestRequest(req, res, ctx, options, pathname) {
-  const config = resolveHttpIngestConfig(options, ctx.registry.ingest?.http?.enabled);
+  const config = resolveHttpIngestConfig(options, ctx.registry.ingest?.http);
   if (!isHttpIngestRoute(pathname, config)) return false;
   if (!config.enabled) {
     sendJson(res, 404, { error: "HTTP ingest is disabled" });
@@ -1337,8 +1337,6 @@ async function loadBundleExportView(ctx, params) {
     note: "Studio does not mutate traces or upload bundles. Run the CLI locally to assemble a share-safe bundle."
   };
 }
-
-// packages/studio/src/auth.ts
 function resolveStudioAuthMode(options) {
   return options.auth === "basic" ? "basic" : "none";
 }
@@ -1358,13 +1356,19 @@ function parseBasicAuth(header) {
     return void 0;
   }
 }
+function timingSafePasswordEqual(provided, expected) {
+  const providedDigest = createHash("sha256").update(provided, "utf8").digest();
+  const expectedDigest = createHash("sha256").update(expected, "utf8").digest();
+  return timingSafeEqual(providedDigest, expectedDigest);
+}
 function isStudioRequestAuthorized(req, options) {
   const mode = resolveStudioAuthMode(options);
   if (mode === "none") return true;
   const expected = resolveStudioPassword(options);
   if (!expected) return false;
   const provided = parseBasicAuth(req.headers.authorization);
-  return provided === expected;
+  if (provided === void 0) return false;
+  return timingSafePasswordEqual(provided, expected);
 }
 function studioAuthRequiredResponse() {
   return {
@@ -1609,7 +1613,7 @@ function createStudioServer(options = {}) {
         contextPromise = createStudioContext(options);
       }
       const ctx = await contextPromise;
-      const httpConfig = resolveHttpIngestConfig(options, ctx.registry.ingest?.http?.enabled);
+      const httpConfig = resolveHttpIngestConfig(options, ctx.registry.ingest?.http);
       if (isHttpIngestRoute(pathname, httpConfig)) {
         const handled2 = await handleHttpIngestRequest(req, res, ctx, options, pathname);
         if (handled2) return;
@@ -1888,6 +1892,28 @@ async function validateBundleDirectory(bundleDir) {
   }
   return errors;
 }
+async function hashBundleContents(bundleDir) {
+  const hash = createHash("sha256");
+  const walk = async (dir, relPrefix) => {
+    const entries = (await readdir(dir, { withFileTypes: true })).sort(
+      (a, b) => a.name.localeCompare(b.name)
+    );
+    for (const entry of entries) {
+      const abs = path8.join(dir, entry.name);
+      const rel = relPrefix ? `${relPrefix}/${entry.name}` : entry.name;
+      if (entry.isDirectory()) {
+        await walk(abs, rel);
+      } else if (entry.isFile()) {
+        hash.update(rel);
+        hash.update("\0");
+        hash.update(await readFile(abs));
+        hash.update("\0");
+      }
+    }
+  };
+  await walk(bundleDir, "");
+  return hash.digest("hex");
+}
 async function copyDirectoryRecursive(sourceDir, destDir) {
   await mkdir(destDir, { recursive: true });
   const entries = await readdir(sourceDir, { withFileTypes: true });
@@ -1942,8 +1968,7 @@ async function importBundleUpload(options) {
       registryImportWarnings
     };
   }
-  const metadataRaw = await readFile(path8.join(bundlePath, "metadata.json"), "utf8");
-  const contentHash = createHash("sha256").update(metadataRaw).digest("hex");
+  const contentHash = await hashBundleContents(bundlePath);
   const sourceKey = `bundle:${bundlePath}`;
   const existing = findIngestFileBySourceKey(options.db, sourceKey);
   if (existing && existing.contentHash === contentHash) {