agent-inspect 6.0.0 → 6.3.0

package/packages/cli/dist/index.mjs

@@ -11,7 +11,7 @@ import { createServer } from 'http';
 import { createRequire } from 'module';
 
 // package.json
-var version = "6.0.0";
+var version = "6.3.0";
 
 // packages/cli/src/trace-dir-scale.ts
 var TRACE_COUNT_WARN = 1e3;
@@ -3129,13 +3129,13 @@ function pairSteps(left, right) {
   return pairs;
 }
 function compareLeafSteps(L, R, segments, opts, out) {
-  const path23 = buildPath(segments);
+  const path25 = buildPath(segments);
   if (L.name !== R.name) {
     out.push({
       kind: "structure",
       severity: "warning",
       message: "Step name differs",
-      path: path23,
+      path: path25,
       left: L.name,
       right: R.name
     });
@@ -3145,7 +3145,7 @@ function compareLeafSteps(L, R, segments, opts, out) {
       kind: "step-type",
       severity: "warning",
       message: "Step type differs",
-      path: path23,
+      path: path25,
       left: L.type,
       right: R.type
     });
@@ -3155,7 +3155,7 @@ function compareLeafSteps(L, R, segments, opts, out) {
       kind: "step-status",
       severity: "warning",
       message: "Step status differs",
-      path: path23,
+      path: path25,
       left: L.status,
       right: R.status
     });
@@ -3167,7 +3167,7 @@ function compareLeafSteps(L, R, segments, opts, out) {
       kind: "error",
       severity: "error",
       message: "Step error message differs",
-      path: path23,
+      path: path25,
       left: le || void 0,
       right: re || void 0
     });
@@ -3185,7 +3185,7 @@ function compareLeafSteps(L, R, segments, opts, out) {
         kind: "duration",
         severity: "info",
         message: "Step duration differs",
-        path: path23,
+        path: path25,
         left: ld,
         right: rd
       });
@@ -3198,7 +3198,7 @@ function compareLeafSteps(L, R, segments, opts, out) {
       kind: "metadata",
       severity: "info",
       message: "Step metadata differs",
-      path: path23,
+      path: path25,
       left: L.metadata,
       right: R.metadata
     });
@@ -3210,7 +3210,7 @@ function compareLeafSteps(L, R, segments, opts, out) {
       kind: "output",
       severity: "info",
       message: "Output preview differs",
-      path: path23,
+      path: path25,
       left: L.outputPreview,
       right: R.outputPreview
     });
@@ -3370,11 +3370,11 @@ function diffRuns(left, right, options) {
 }
 
 // packages/core/src/diff/renderer.ts
-function formatPath(path23) {
-  if (path23 === void 0 || path23.path.length === 0) {
+function formatPath(path25) {
+  if (path25 === void 0 || path25.path.length === 0) {
     return "(run)";
   }
-  return path23.path.map((s) => s.name).join(" > ");
+  return path25.path.map((s) => s.name).join(" > ");
 }
 function formatValue(v, verbose) {
   if (v === void 0) return "(undefined)";
@@ -4479,17 +4479,17 @@ function applyRule(rule, value, replacement) {
   }
   return value;
 }
-function childPath(path23, key) {
+function childPath(path25, key) {
   if (/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(key)) {
-    return path23 ? `${path23}.${key}` : key;
+    return path25 ? `${path25}.${key}` : key;
   }
-  return `${path23 || "$"}[${JSON.stringify(key)}]`;
+  return `${path25 || "$"}[${JSON.stringify(key)}]`;
 }
-function indexPath(path23, index) {
-  return `${path23 || "$"}[${index}]`;
+function indexPath(path25, index) {
+  return `${path25 || "$"}[${index}]`;
 }
-function makeFinding(path23, detector, action, matchKind, severity = "warning", preview) {
-  return preview === void 0 ? { path: path23, detector, action, severity, matchKind } : { path: path23, detector, action, severity, matchKind, preview };
+function makeFinding(path25, detector, action, matchKind, severity = "warning", preview) {
+  return preview === void 0 ? { path: path25, detector, action, severity, matchKind } : { path: path25, detector, action, severity, matchKind, preview };
 }
 function createRedactionProfile(profile = "local") {
   switch (profile) {
@@ -4558,11 +4558,11 @@ var Redactor2 = class {
   #recordFinding(state, finding) {
     if (this.#collectFindings) state.findings.push(finding);
   }
-  #redactValue(value, key, path23, depth, state) {
+  #redactValue(value, key, path25, depth, state) {
     if (depth > this.#maxDepth) {
       this.#recordFinding(
         state,
-        makeFinding(path23, "structure.maxDepth", "truncate", "value", "warning")
+        makeFinding(path25, "structure.maxDepth", "truncate", "value", "warning")
       );
       return "[Truncated]";
     }
@@ -4571,19 +4571,19 @@ var Redactor2 = class {
       if (rule) {
         this.#recordFinding(
           state,
-          makeFinding(path23, `key.${rule.key}`, actionForRule(rule), "key", "warning")
+          makeFinding(path25, `key.${rule.key}`, actionForRule(rule), "key", "warning")
         );
         return applyRule(rule, value, this.#replacement);
       }
     }
     for (const detector of this.#detectors) {
-      const detections = detector.detect({ path: path23, key, value });
+      const detections = detector.detect({ path: path25, key, value });
       for (const detection of detections) {
         const action = detection.action ?? "replace";
         this.#recordFinding(
           state,
           makeFinding(
-            path23,
+            path25,
             detector.id,
             action,
             detection.matchKind ?? detector.matchKind ?? "custom",
@@ -4601,7 +4601,7 @@ var Redactor2 = class {
       const out = [];
       state.seen.set(value, out);
       value.forEach((item, index) => {
-        out[index] = this.#redactValue(item, void 0, indexPath(path23, index), depth + 1, state);
+        out[index] = this.#redactValue(item, void 0, indexPath(path25, index), depth + 1, state);
       });
       return out;
     }
@@ -4613,7 +4613,7 @@ var Redactor2 = class {
         out[entryKey] = this.#redactValue(
           entryValue,
           entryKey,
-          childPath(path23 === "$" ? "" : path23, entryKey),
+          childPath(path25 === "$" ? "" : path25, entryKey),
           depth + 1,
           state
         );
@@ -5540,23 +5540,23 @@ function evaluatePromptInjection(text, options = {}) {
   }
   return fail(ruleId, `Matched ${evidence.length} injection pattern(s).`, evidence, "warning");
 }
-function validateSchemaField(value, field, path23, evidence) {
+function validateSchemaField(value, field, path25, evidence) {
   const ruleId = "guardrail.structured-output";
   if (field.type) {
     const actual = value === null ? "null" : Array.isArray(value) ? "array" : typeof value;
     if (actual !== field.type) {
-      evidence.push({ ruleId, path: path23, preview: `expected ${field.type}, got ${actual}` });
+      evidence.push({ ruleId, path: path25, preview: `expected ${field.type}, got ${actual}` });
       return;
     }
   }
   if (field.enum && !field.enum.some((item) => Object.is(item, value))) {
-    evidence.push({ ruleId, path: path23, preview: "value not in enum" });
+    evidence.push({ ruleId, path: path25, preview: "value not in enum" });
   }
   if (field.type === "object" && field.required && value && typeof value === "object" && !Array.isArray(value)) {
     const record = value;
     for (const key of field.required) {
       if (!(key in record)) {
-        evidence.push({ ruleId, path: `${path23}.${key}`, preview: "missing required key" });
+        evidence.push({ ruleId, path: `${path25}.${key}`, preview: "missing required key" });
       }
     }
   }
@@ -6057,10 +6057,10 @@ function printHuman(result) {
     console.log(`- ${diagnostic3.code}: ${diagnostic3.message}`);
   }
   for (const finding of result.findings) {
-    const path23 = finding.evidence[0]?.path;
+    const path25 = finding.evidence[0]?.path;
     const run = finding.evidence[0]?.runId;
     const runPrefix = run ? `[${run}] ` : "";
-    console.log(`- ${runPrefix}${finding.ruleId}: ${finding.message}${path23 ? ` (${path23})` : ""}`);
+    console.log(`- ${runPrefix}${finding.ruleId}: ${finding.message}${path25 ? ` (${path25})` : ""}`);
   }
 }
 function readErrorResult(error) {
@@ -7105,9 +7105,103 @@ function parsePort2(value) {
   }
   return parsed;
 }
+function summarizeFileDropResult(result) {
+  if (result.skipped) {
+    console.log(`[AgentInspect studio] file-drop skipped: ${result.reason ?? "disabled"}`);
+    return;
+  }
+  console.log(
+    `[AgentInspect studio] file-drop scanned=${result.scanned} imported=${result.imported} skipped=${result.skippedFiles}`
+  );
+  for (const warning of result.warnings) {
+    console.warn(`[AgentInspect studio] ${warning}`);
+  }
+  for (const error of result.errors) {
+    console.error(`[AgentInspect studio] ${error}`);
+  }
+}
+function summarizeGitHubResult(result) {
+  if (result.skipped) {
+    console.log(`[AgentInspect studio] github import skipped: ${result.reason ?? "disabled"}`);
+    return;
+  }
+  if (result.imported) {
+    console.log(
+      `[AgentInspect studio] github artifact imported to ${result.destPath ?? "(unknown)"}`
+    );
+  } else if (result.destPath) {
+    console.log(`[AgentInspect studio] github artifact unchanged: ${result.destPath}`);
+  }
+  for (const warning of result.registryImportWarnings) {
+    console.warn(`[AgentInspect studio] ${warning}`);
+  }
+  for (const error of result.errors) {
+    console.error(`[AgentInspect studio] ${error}`);
+  }
+}
+async function studioImportBundleCommand(options) {
+  const mod = await loadStudio();
+  if (!mod) return;
+  const result = await mod.runStudioBundleUploadImport({
+    ...options.workspace !== void 0 ? { workspacePath: options.workspace } : {},
+    ...options.db !== void 0 ? { dbPath: options.db } : {},
+    bundlePath: options.path,
+    ...options.cwd !== void 0 ? { cwd: options.cwd } : {}
+  });
+  if (result.skipped) {
+    console.log(`[AgentInspect studio] bundle import skipped: ${result.reason ?? "disabled"}`);
+  } else if (result.imported) {
+    console.log(`[AgentInspect studio] bundle imported to ${result.destPath ?? "(unknown)"}`);
+  } else if (result.destPath) {
+    console.log(`[AgentInspect studio] bundle unchanged: ${result.destPath}`);
+  }
+  for (const warning of result.registryImportWarnings) {
+    console.warn(`[AgentInspect studio] ${warning}`);
+  }
+  for (const error of result.errors) {
+    console.error(`[AgentInspect studio] ${error}`);
+  }
+  if (result.errors.length > 0) process.exitCode = 1;
+}
+async function studioImportGitHubCommand(options) {
+  const mod = await loadStudio();
+  if (!mod) return;
+  const result = await mod.runStudioGitHubArtifactImport({
+    ...options.workspace !== void 0 ? { workspacePath: options.workspace } : {},
+    ...options.db !== void 0 ? { dbPath: options.db } : {},
+    repo: options.repo,
+    runId: options.runId,
+    artifact: options.artifact,
+    ...options.tokenEnv !== void 0 ? { tokenEnv: options.tokenEnv } : {},
+    ...options.cwd !== void 0 ? { cwd: options.cwd } : {}
+  });
+  summarizeGitHubResult(result);
+  if (result.errors.length > 0) {
+    process.exitCode = 1;
+  }
+}
+async function studioImportDropCommand(options = {}) {
+  const mod = await loadStudio();
+  if (!mod) return;
+  const result = await mod.runStudioFileDropImport({
+    ...options.workspace !== void 0 ? { workspacePath: options.workspace } : {},
+    ...options.db !== void 0 ? { dbPath: options.db } : {},
+    ...options.dir !== void 0 ? { dropDir: options.dir } : {},
+    ...options.archive === true ? { archiveAfterImport: true } : {},
+    ...options.cwd !== void 0 ? { cwd: options.cwd } : {}
+  });
+  summarizeFileDropResult(result);
+  if (result.errors.length > 0) {
+    process.exitCode = 1;
+  }
+}
 async function studioCommand(options = {}) {
   const mod = await loadStudio();
   if (!mod) return;
+  const ingest = options.ingest?.trim();
+  if (ingest && ingest !== "file-drop" && ingest !== "http") {
+    throw new Error(`Unsupported --ingest channel: ${ingest}. Supported: file-drop, http`);
+  }
   const port = parsePort2(options.port);
   const host = options.host?.trim();
   const info = await mod.startStudioServer({
@@ -7118,8 +7212,18 @@ async function studioCommand(options = {}) {
     ...options.server === true ? { server: true } : {},
     ...options.cwd !== void 0 ? { cwd: options.cwd } : {},
     ...options.auth === "basic" ? { auth: "basic" } : {},
-    ...options.passwordEnv !== void 0 ? { passwordEnv: options.passwordEnv } : {}
+    ...options.passwordEnv !== void 0 ? { passwordEnv: options.passwordEnv } : {},
+    ...ingest === "file-drop" ? { ingestFileDrop: true } : {},
+    ...ingest === "http" ? { ingestHttp: true } : {},
+    ...options.ingestTokenEnv !== void 0 ? { ingestTokenEnv: options.ingestTokenEnv } : {},
+    ...options.archiveFileDrop === true ? { archiveFileDrop: true } : {}
   });
+  if (ingest === "file-drop") {
+    console.log(`[AgentInspect studio] file-drop ingest enabled for startup scan`);
+  }
+  if (ingest === "http") {
+    console.log(`[AgentInspect studio] HTTP ingest enabled (token required on POST routes)`);
+  }
   console.log(`AgentInspect studio (read-only): ${info.url}`);
   if (options.open === true && info.host !== "127.0.0.1" && info.host !== "localhost") {
     console.warn("Skipping browser open for non-local host binding.");
@@ -7300,10 +7404,10 @@ async function evalRun(input3, options = {}) {
     diagnostics: []
   };
 }
-function evidenceForRun(run, path23) {
-  return [{ runId: run.runId, ...path23 !== void 0 ? { path: path23 } : {} }];
+function evidenceForRun(run, path25) {
+  return [{ runId: run.runId, ...path25 !== void 0 ? { path: path25 } : {} }];
 }
-function evidenceForEvent(event, path23) {
+function evidenceForEvent(event, path25) {
   return [
     {
       runId: event.runId,
@@ -7311,7 +7415,7 @@ function evidenceForEvent(event, path23) {
       ...event.parentId !== void 0 ? { parentId: event.parentId } : {},
       kind: event.kind,
       name: event.name,
-      ...path23 !== void 0 ? { path: path23 } : {}
+      ...path25 !== void 0 ? { path: path25 } : {}
     }
   ];
 }
@@ -7469,9 +7573,9 @@ function collectTextFields(nodes, keys, preferredKinds = []) {
 function tokenize(text) {
   return [...text.toLowerCase().matchAll(/[a-z0-9][a-z0-9'-]{2,}/g)].map((match) => match[0].replace(/^['-]+|['-]+$/g, "")).filter((token) => token.length > 2 && !STOP_WORDS.has(token));
 }
-function firstEvidence(fields, run, path23) {
+function firstEvidence(fields, run, path25) {
   const first = fields[0];
-  return first === void 0 ? evidenceForRun(run, path23) : evidenceForEvent(first.node.event, first.path);
+  return first === void 0 ? evidenceForRun(run, path25) : evidenceForEvent(first.node.event, first.path);
 }
 function collectSourceIds(nodes, keys) {
   const wanted = keySet(keys);
@@ -7848,8 +7952,8 @@ function renderEvalMarkdown(result) {
   if (result.findings.length > 0) {
     lines.push("", "## Findings");
     for (const finding of result.findings) {
-      const path23 = finding.evidence[0]?.path;
-      lines.push(`- ${finding.ruleId}: ${finding.message}${path23 ? ` (${path23})` : ""}`);
+      const path25 = finding.evidence[0]?.path;
+      lines.push(`- ${finding.ruleId}: ${finding.message}${path25 ? ` (${path25})` : ""}`);
     }
   }
   return `${lines.join("\n")}
@@ -8042,8 +8146,8 @@ function printHuman2(result) {
     console.log(`- ${diagnostic3.code}: ${diagnostic3.message}`);
   }
   for (const finding of result.findings) {
-    const path23 = finding.evidence[0]?.path;
-    console.log(`- ${finding.ruleId}: ${finding.message}${path23 ? ` (${path23})` : ""}`);
+    const path25 = finding.evidence[0]?.path;
+    console.log(`- ${finding.ruleId}: ${finding.message}${path25 ? ` (${path25})` : ""}`);
   }
 }
 function readErrorResult2(error) {
@@ -8281,8 +8385,8 @@ function printHuman3(result) {
     console.log(`- ${diagnostic3.code}: ${diagnostic3.message}`);
   }
   for (const finding of result.findings) {
-    const path23 = finding.evidence[0]?.path;
-    console.log(`- ${finding.ruleId}: ${finding.message}${path23 ? ` (${path23})` : ""}`);
+    const path25 = finding.evidence[0]?.path;
+    console.log(`- ${finding.ruleId}: ${finding.message}${path25 ? ` (${path25})` : ""}`);
   }
   console.log(`Note: ${result.note}`);
 }
@@ -8433,8 +8537,8 @@ function renderCheckSection(result) {
     `Diagnostics: ${result.diagnostics.length}`
   ];
   for (const finding of result.findings.slice(0, 10)) {
-    const path23 = finding.evidence[0]?.path ?? "(run)";
-    lines.push(`- ${finding.ruleId}: ${finding.message} (${path23})`);
+    const path25 = finding.evidence[0]?.path ?? "(run)";
+    lines.push(`- ${finding.ruleId}: ${finding.message} (${path25})`);
   }
   for (const diagnostic3 of result.diagnostics.slice(0, 10)) {
     lines.push(`- ${diagnostic3.code}: ${diagnostic3.message}`);
@@ -9759,6 +9863,176 @@ Summary: ${failed} failed, ${warned} warnings`);
   if (failed > 0) process2.exitCode = 1;
 }
 
+// packages/adapter-sdk/src/privacy.ts
+var PRIVACY_CHECKLIST_ITEMS = [
+  {
+    id: "capture-metadata-only-default",
+    label: "Default capture is metadata-only (no full prompts/outputs on disk)",
+    required: true
+  },
+  {
+    id: "no-network-by-default",
+    label: "Adapter tests and defaults do not call external networks",
+    required: true
+  },
+  {
+    id: "no-upload",
+    label: "Adapter does not upload traces or logs to vendors by default",
+    required: true
+  },
+  {
+    id: "redaction-documented",
+    label: "Redaction/capture modes are documented for adapter users",
+    required: true
+  },
+  {
+    id: "framework-deps-scoped",
+    label: "Framework SDK dependencies stay in the optional adapter package",
+    required: true
+  }
+];
+function runPrivacyChecklist(input3 = {}) {
+  const captureMode = input3.captureMode ?? "metadata-only";
+  const items = [
+    {
+      id: "capture-metadata-only-default",
+      ok: captureMode === "metadata-only",
+      detail: captureMode === "metadata-only" ? void 0 : `captureMode is ${captureMode}; metadata-only is required by default`
+    },
+    {
+      id: "no-network-by-default",
+      ok: input3.networkAllowed !== true,
+      detail: input3.networkAllowed ? "network must be disabled in adapter defaults" : void 0
+    },
+    {
+      id: "no-upload",
+      ok: input3.uploadAllowed !== true,
+      detail: input3.uploadAllowed ? "upload must not be enabled by default" : void 0
+    },
+    {
+      id: "redaction-documented",
+      ok: input3.redactionDocumented !== false,
+      detail: input3.redactionDocumented === false ? "document capture/redaction behavior in adapter README" : void 0
+    },
+    {
+      id: "framework-deps-scoped",
+      ok: input3.frameworkDepsPackageScoped !== false,
+      detail: input3.frameworkDepsPackageScoped === false ? "keep framework SDK deps out of agent-inspect root/core" : void 0
+    }
+  ];
+  const requiredFailed = items.some(
+    (item) => PRIVACY_CHECKLIST_ITEMS.find((def) => def.id === item.id)?.required && !item.ok
+  );
+  return { ok: !requiredFailed, items };
+}
+var PLUGIN_MANIFEST_FILENAME = "agent-inspect-plugin.manifest.json";
+var PLUGIN_NAME_PREFIXES = [
+  "agent-inspect-plugin-",
+  "agent-inspect-adapter-",
+  "agent-inspect-renderer-",
+  "agent-inspect-check-",
+  "agent-inspect-importer-"
+];
+function isPlainObject2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isPluginPackageName(name) {
+  return PLUGIN_NAME_PREFIXES.some((prefix) => name.startsWith(prefix));
+}
+function inferPluginTypeFromName(name) {
+  if (name.startsWith("agent-inspect-adapter-")) return "adapter";
+  if (name.startsWith("agent-inspect-renderer-")) return "renderer";
+  if (name.startsWith("agent-inspect-check-")) return "check";
+  if (name.startsWith("agent-inspect-importer-")) return "importer";
+  if (name.startsWith("agent-inspect-plugin-")) return "plugin";
+  return void 0;
+}
+function parsePluginManifest(input3) {
+  const errors = [];
+  const warnings = [];
+  if (!isPlainObject2(input3)) {
+    return { ok: false, errors: ["manifest must be a JSON object"], warnings };
+  }
+  if (input3.schemaVersion !== "1.0") {
+    errors.push('schemaVersion must be "1.0"');
+  }
+  const id = typeof input3.id === "string" ? input3.id.trim() : "";
+  if (!id || !isPluginPackageName(id)) {
+    errors.push("id must use an agent-inspect plugin naming prefix");
+  }
+  const type = typeof input3.type === "string" ? input3.type.trim() : "";
+  const allowedTypes = [
+    "plugin",
+    "adapter",
+    "renderer",
+    "check",
+    "importer"
+  ];
+  if (!allowedTypes.includes(type)) {
+    errors.push(`type must be one of: ${allowedTypes.join(", ")}`);
+  }
+  const name = typeof input3.name === "string" ? input3.name.trim() : "";
+  if (!name) errors.push("name must be a non-empty string");
+  const version2 = typeof input3.version === "string" ? input3.version.trim() : "";
+  if (!version2) errors.push("version must be a non-empty string");
+  let privacy;
+  if (input3.privacy !== void 0) {
+    if (!isPlainObject2(input3.privacy)) {
+      errors.push("privacy must be an object");
+    } else {
+      privacy = {};
+      if (input3.privacy.captureMode !== void 0) {
+        privacy.captureMode = String(input3.privacy.captureMode);
+      }
+      if (input3.privacy.networkAllowed !== void 0) {
+        privacy.networkAllowed = Boolean(input3.privacy.networkAllowed);
+      }
+      if (input3.privacy.uploadAllowed !== void 0) {
+        privacy.uploadAllowed = Boolean(input3.privacy.uploadAllowed);
+      }
+      if (input3.privacy.redactionDocumented !== void 0) {
+        privacy.redactionDocumented = Boolean(input3.privacy.redactionDocumented);
+      }
+      if (input3.privacy.frameworkDepsPackageScoped !== void 0) {
+        privacy.frameworkDepsPackageScoped = Boolean(input3.privacy.frameworkDepsPackageScoped);
+      }
+      if (privacy.networkAllowed === true || privacy.uploadAllowed === true) {
+        warnings.push("plugin declares network or upload \u2014 review before install");
+      }
+    }
+  } else {
+    warnings.push("privacy block missing; plugins doctor will assume conservative defaults");
+  }
+  if (errors.length > 0) return { ok: false, errors, warnings };
+  return {
+    ok: true,
+    manifest: {
+      schemaVersion: "1.0",
+      id,
+      type,
+      name,
+      version: version2,
+      ...privacy ? { privacy } : {}
+    },
+    errors: [],
+    warnings
+  };
+}
+async function readPluginManifestFile(packageDir) {
+  const manifestPath = path14.join(packageDir, PLUGIN_MANIFEST_FILENAME);
+  try {
+    const raw = await readFile(manifestPath, "utf8");
+    const parsed = parsePluginManifest(JSON.parse(raw));
+    return { ...parsed, path: manifestPath };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return { ok: false, path: manifestPath, errors: [message], warnings: [] };
+  }
+}
+function validatePluginPrivacy(manifest) {
+  return runPrivacyChecklist(manifest.privacy ?? {});
+}
+
 // packages/adapter-sdk/src/indexer.ts
 function defineIndexer(indexer) {
   if (!indexer.id.trim()) throw new Error("indexer id is required");
@@ -9816,7 +10090,115 @@ function createTraceDirectoryIndexer() {
   });
 }
 
-// packages/cli/src/index-cmd.ts
+// packages/cli/src/plugins.ts
+async function readPackageName(packageDir) {
+  try {
+    const raw = await readFile(path14.join(packageDir, "package.json"), "utf8");
+    const parsed = JSON.parse(raw);
+    return typeof parsed.name === "string" ? parsed.name : void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function discoverPlugins(cwd = process.cwd()) {
+  const nodeModules = path14.join(cwd, "node_modules");
+  const found = [];
+  let entries;
+  try {
+    entries = await readdir(nodeModules);
+  } catch {
+    return found;
+  }
+  for (const entry of entries.sort()) {
+    if (entry.startsWith("@")) continue;
+    if (!isPluginPackageName(entry)) continue;
+    const packageDir = path14.join(nodeModules, entry);
+    const manifestRead = await readPluginManifestFile(packageDir);
+    found.push({
+      packageName: entry,
+      packageDir,
+      ...manifestRead.manifest ? { manifest: manifestRead.manifest } : {},
+      manifestErrors: manifestRead.errors,
+      warnings: manifestRead.warnings
+    });
+  }
+  return found;
+}
+async function validatePluginPackage(packageRef, cwd = process.cwd()) {
+  const packageDir = path14.isAbsolute(packageRef) ? packageRef : path14.join(cwd, "node_modules", packageRef);
+  const packageName = await readPackageName(packageDir) ?? packageRef;
+  const errors = [];
+  const warnings = [];
+  if (!isPluginPackageName(packageName)) {
+    errors.push(`package name ${packageName} does not match plugin naming convention`);
+  }
+  const manifestRead = await readPluginManifestFile(packageDir);
+  errors.push(...manifestRead.errors);
+  warnings.push(...manifestRead.warnings);
+  if (manifestRead.manifest) {
+    const inferred = inferPluginTypeFromName(packageName);
+    if (inferred && inferred !== manifestRead.manifest.type) {
+      warnings.push(`manifest type ${manifestRead.manifest.type} differs from name prefix (${inferred})`);
+    }
+    const privacy = validatePluginPrivacy(manifestRead.manifest);
+    if (!privacy.ok) {
+      errors.push(
+        ...privacy.items.filter((item) => !item.ok).map((item) => item.detail ?? item.id)
+      );
+    }
+  } else if (manifestRead.errors.some((e) => e.includes("ENOENT"))) {
+    warnings.push(`missing ${PLUGIN_MANIFEST_FILENAME}; add manifest for doctor/validate`);
+  }
+  return {
+    ok: errors.length === 0,
+    packageName,
+    packageDir,
+    errors,
+    warnings,
+    manifest: manifestRead.manifest
+  };
+}
+async function pluginsListCommand(cwd) {
+  const plugins = await discoverPlugins(cwd);
+  if (plugins.length === 0) {
+    console.log("No agent-inspect plugins found in node_modules.");
+    return;
+  }
+  for (const plugin of plugins) {
+    const type = plugin.manifest?.type ?? inferPluginTypeFromName(plugin.packageName) ?? "unknown";
+    console.log(`${plugin.packageName} (${type})`);
+  }
+}
+async function pluginsDoctorCommand(cwd) {
+  const plugins = await discoverPlugins(cwd);
+  if (plugins.length === 0) {
+    console.log("No agent-inspect plugins found.");
+    return;
+  }
+  let issues = 0;
+  for (const plugin of plugins) {
+    const result = await validatePluginPackage(plugin.packageName, cwd);
+    if (result.ok && result.warnings.length === 0) {
+      console.log(`OK  ${plugin.packageName}`);
+      continue;
+    }
+    issues += 1;
+    console.log(`WARN ${plugin.packageName}`);
+    for (const warning of result.warnings) console.log(`  - ${warning}`);
+    for (const error of result.errors) console.log(`  ! ${error}`);
+  }
+  if (issues > 0) process.exitCode = 1;
+}
+async function pluginsValidateCommand(packageRef, cwd) {
+  const result = await validatePluginPackage(packageRef, cwd);
+  for (const warning of result.warnings) console.warn(`warning: ${warning}`);
+  if (!result.ok) {
+    for (const error of result.errors) console.error(`error: ${error}`);
+    process.exitCode = 1;
+    return;
+  }
+  console.log(`Valid: ${result.packageName}`);
+}
 var INDEX_FILENAME = ".agent-inspect-index.json";
 function traceIndexPath(traceDir) {
   return path14.join(traceDir, INDEX_FILENAME);
@@ -10781,11 +11163,21 @@ function createCliProgram() {
   program.command("viewer").description("Start localhost read-only viewer (traces, suite, or workspace) (v5.3+)").option("--dir <path>", "trace directory (trace mode)").option("--suite", "suite evidence mode").option("--workspace", "workspace mode").option("--config <path>", "suite config path (suite mode)").option("--host <host>", "bind host (default 127.0.0.1)", "127.0.0.1").option("--port <number>", "bind port (default 7337)", "7337").option("--open", "open browser locally when host is localhost").action((opts) => {
     runCommand(() => serveCommand(opts));
   });
-  program.command("studio").description(
+  const studioCmd = program.command("studio").description(
     "Start self-hosted read-only Studio analyzer (requires @agent-inspect/studio) (v6.0+)"
-  ).option("--workspace <path>", "studio registry manifest path").option("--db <path>", "studio database path (sqlite file or postgres URL)").option("--host <host>", "bind host (default 127.0.0.1)", "127.0.0.1").option("--port <number>", "bind port (default 7340)", "7340").option("--server", "bind for network access (0.0.0.0; requires explicit opt-in)").option("--auth <mode>", "auth mode: none or basic", "none").option("--password-env <name>", "env var for basic-auth password").option("--open", "open browser locally when host is localhost").action((opts) => {
+  ).option("--workspace <path>", "studio registry manifest path").option("--db <path>", "studio database path (sqlite file or postgres URL)").option("--host <host>", "bind host (default 127.0.0.1)", "127.0.0.1").option("--port <number>", "bind port (default 7340)", "7340").option("--server", "bind for network access (0.0.0.0; requires explicit opt-in)").option("--auth <mode>", "auth mode: none or basic", "none").option("--password-env <name>", "env var for basic-auth password").option("--ingest <channel>", "enable ingest channel on startup (file-drop, http)").option("--ingest-token-env <name>", "env var for HTTP ingest token (default STUDIO_INGEST_TOKEN)").option("--archive-file-drop", "archive file-drop sources after successful import").option("--open", "open browser locally when host is localhost").action((opts) => {
     runCommand(() => studioCommand(opts));
   });
+  const studioImportCmd = studioCmd.command("import").description("Import external evidence into Studio (v6.1+)");
+  studioImportCmd.command("drop").description("Import allowlisted files from a file-drop directory").option("--workspace <path>", "studio registry manifest path").option("--db <path>", "studio database path (sqlite file or postgres URL)").option("--dir <path>", "file-drop directory (defaults to registry import.fileDropDir)").option("--archive", "move imported files into .imported/ under the drop dir").action((opts) => {
+    runCommand(() => studioImportDropCommand(opts));
+  });
+  studioImportCmd.command("github").description("Download a GitHub Actions artifact into the studio import dirs").requiredOption("--repo <owner/name>", "GitHub repository").requiredOption("--run-id <id>", "workflow run id").requiredOption("--artifact <name>", "artifact name").option("--workspace <path>", "studio registry manifest path").option("--db <path>", "studio database path (sqlite file or postgres URL)").option("--token-env <name>", "env var for GitHub token (default GITHUB_TOKEN)").action((opts) => {
+    runCommand(() => studioImportGitHubCommand(opts));
+  });
+  studioImportCmd.command("bundle").description("Import a local share-safe bundle directory into Studio").requiredOption("--path <dir>", "bundle directory path").option("--workspace <path>", "studio registry manifest path").option("--db <path>", "studio database path (sqlite file or postgres URL)").action((opts) => {
+    runCommand(() => studioImportBundleCommand(opts));
+  });
   program.command("eval").description("Run deterministic local evals against a trace").argument("<trace-path-or-run-id>", "trace file, directory, stdin -, or run id").option("--dir <path>", "trace directory for run-id lookup").addOption(
     new Option("--format <format>", "trace input format").choices([
       "agent-inspect-jsonl",
@@ -10999,6 +11391,16 @@ function createCliProgram() {
   ).action((opts) => {
     runCommand(() => doctorCommand(opts));
   });
+  const pluginsCmd = program.command("plugins").description("List and validate explicit-install agent-inspect plugins (v6.2+)");
+  pluginsCmd.command("list").description("List installed plugin packages in node_modules").action(() => {
+    runCommand(() => pluginsListCommand());
+  });
+  pluginsCmd.command("doctor").description("Validate plugin manifests and privacy checklists").action(() => {
+    runCommand(() => pluginsDoctorCommand());
+  });
+  pluginsCmd.command("validate").description("Validate one plugin package by name or path").argument("<package>", "plugin package name or directory path").action((packageRef) => {
+    runCommand(() => pluginsValidateCommand(packageRef));
+  });
   const indexCmd = program.command("index").description("Optional local trace directory index (rebuildable metadata cache)");
   indexCmd.command("build").description("Build or refresh .agent-inspect-index.json").option("--dir <path>", "trace directory").option("--json", "print JSON result").option("--max-entries <n>", "cap indexed entries (default 10000)").action((opts) => {
     runCommand(() => indexBuildCommand(opts));