@agent-beam/beam 0.1.0

package/README.md

@@ -0,0 +1,188 @@
+# Beam
+
+Local observation and heuristic risk scanning for AI agent activity. Beam runs entirely on your machine: a loopback-only HTTP collector stores normalized events and scan reports in NDJSON files under `~/.beam`, and the `beam` CLI talks to it (or scans files completely offline).
+
+Beam does not execute, block, or approve anything an agent does. It observes, redacts secrets before persisting, and flags risky patterns for human review.
+
+## Install
+
+```bash
+npm run setup:global
+```
+
+This installs dependencies, builds, `npm link`s the `beam` binary globally, and starts a background watcher so the global command always reflects the current source — no manual rebuild needed after edits.
+
+## Commands
+
+```bash
+beam start                          # start the local collector (binds 127.0.0.1:4319)
+beam start --port 4400              # use a different port
+
+beam studio                         # open the activity dashboard in your browser
+
+beam token                          # print the collector's pairing token
+
+beam import events.ndjson           # send normalized events to /ingest
+beam scan SKILL.md                  # scan offline for risky instructions
+beam scan mcp.json --mcp            # scan an MCP config (checks version pinning)
+beam scan SKILL.md --save           # also persist the report to the collector
+
+beam hook claude-code < payload.json # forward a hook payload for the given agent (stdin)
+
+beam agent list                     # supported agents and payload verification status
+beam agent install cursor           # wire beam's hook into that agent's own config, non-destructively
+beam agent install-all              # detect every agent actually installed on this machine and wire them all
+
+beam rule list                      # the active rule catalog (built-in + custom + sequence), grouped by category
+beam rule reload                    # apply edits to ~/.beam/rules.json into the running collector, no restart
+
+beam service install                # run the collector as a background service (starts on login)
+beam service status                 # is it installed / running
+beam service stop                   # stop it
+beam service start                  # start it again
+beam service uninstall              # remove it
+beam service logs                   # where its log files are (or the command to follow them)
+```
+
+`scan` runs entirely offline unless `--save` is passed — no collector required. `hook` never throws or blocks the calling agent; capture failures are logged to stderr only. This mirrors Beam's core rule: **observation must never become enforcement.**
+
+## Studio (activity dashboard)
+
+`beam start` or `beam service install` also serves a dashboard at `GET /` and `GET /studio` on the collector itself — no separate app, no build step, no dependency added to the package (plain HTML/CSS/JS, no fonts or CDNs). `beam studio` opens it in your default browser for you.
+
+- **Activity** — every captured event, searchable and filterable by agent/risk, with a detail drawer per action.
+- **Findings** — the subset with heuristic matches, with a per-event "mark reviewed" (a record of your assessment, never an approval or block).
+- **Skill & MCP scan** — paste or check a file's content and see findings live, same engine as `beam scan`.
+
+The page itself carries no secret and needs no auth to load — only the API calls it makes do. `beam studio` reads the pairing token from disk and passes it once via a URL that's immediately scrubbed from the address bar (`history.replaceState`) after the page reads it. From there it's saved in that browser's `localStorage` (scoped to the collector's own origin, `127.0.0.1:4319` — no other site or app can read it), so reloading the tab or closing and reopening the browser stays connected without re-pairing. If the collector ever rejects the stored token (e.g. `beam service uninstall && beam service install` generates a new one), the page detects that and clears it automatically rather than looping silently. Use the **Disconnect** button to clear it yourself.
+
+Sessions and Usage views from the original Sentinel console aren't ported yet — Activity/Findings/Scan cover the core loop first.
+
+## Multi-agent coverage
+
+Different agents send different JSON shapes to their hooks. `beam hook <agent>` picks the right adapter for the agent id you pass, and `beam agent install <agent>` writes beam's hook into that agent's real config file in its own native format, merging with (never overwriting) whatever hooks are already there.
+
+`npm run setup:global` runs `beam agent install-all` automatically at the end, so every agent it can detect on your machine gets wired without you having to know which ones you have installed. Detection uses each agent's own real, pre-existing files (e.g. `~/.codex/config.toml`, `~/.copilot/config.json`) — never a file beam itself writes — so an agent that was never actually installed won't get a hook, and one that's already wired won't get a duplicate entry on a second run.
+
+| Agent id | Config file `agent install` writes | Payload |
+|---|---|---|
+| `claude-code` | `~/.claude/settings.json` (`hooks.PreToolUse`) | Verified against Claude Code's docs |
+| `codex` | `~/.codex/hooks.json` (`hooks.PreToolUse`) | Same shape as Claude Code; verified |
+| `cursor` | `~/.cursor/hooks.json` (`hooks.preToolUse`) | Verified against Cursor's docs |
+| `copilot-cli` | `~/.copilot/hooks/beam.json` (`hooks.preToolUse`) | Verified (camelCase — translated internally) |
+| `gemini` | `~/.gemini/settings.json` (`hooks.BeforeTool`) | **Not verified** — Gemini CLI's stdin schema isn't published; capture uses a generic best-effort field adapter |
+| `opencode` | not built yet | discovery (config/artifact presence) only — OpenCode uses a generated TS plugin, not a JSON hook file |
+
+Run `beam agent list` for the current status of each. Adding a new agent means one entry in `src/agents.ts` (config path + how to merge the hook block) and, if its stdin payload uses different field names than `tool_name`/`tool_input`/`session_id`/`cwd`/`hook_event_name`, one adapter function in `src/hook-adapters.ts`.
+
+This is an intentionally small first slice of what a full multi-agent observer could cover. Wider agent coverage, enforcement/blocking, and portable case bundles aren't built yet — tracked as future slices, not silently unsupported.
+
+## Forensic extraction (no hook required)
+
+`beam agent extract <agent>` reads an agent's own existing session/transcript files directly — no hook needed, and it works for history from *before* Beam was ever installed:
+
+```bash
+beam agent extract claude-code              # preview: normalizes locally, prints JSON, nothing sent anywhere
+beam agent extract claude-code --limit 20   # cap how many events the preview prints (default 200)
+beam agent extract claude-code --save       # import into the running collector (dedupes by event_id)
+beam agent extract codex --save
+```
+
+Supported today: **`claude-code`** (`~/.claude/projects/**/*.jsonl` — reads `tool_use` blocks out of assistant turns) and **`codex`** (`~/.codex/{sessions,archived_sessions}/**/*.jsonl` — reads `function_call` and `custom_tool_call` response items). Every extracted event gets `source: "extract"` and `phase: "observed"` so it's visibly distinct from a live hook capture (which is `"proposed"`/`"completed hook"`). Preview mode normalizes (and therefore redacts) locally without ever contacting the collector; `--save` sends the raw records through the same `/ingest` pipeline a live hook uses, batched under the collector's 2,000-record-per-request cap. Bounded like everything else in Beam: 50 MB max per transcript file, 20,000 parsed lines per file, 2,000 files walked per run.
+
+Other agents aren't wired yet — `beam agent extract <agent>` fails clearly rather than silently returning nothing for one that isn't supported.
+
+## Rule engine
+
+Detection has three layers now, all active in both `beam scan` (offline) and the running collector:
+
+- **Categorized built-in rules** — every rule has a `category` (`exec`, `exfil`, `impact`, `integrity`, `persistence`, `privilege`, `recon`, `secrets`, `source_control`), not just a flat id. `beam rule list` shows the full catalog grouped by category.
+- **Custom rules from `~/.beam/rules.json`** — extend detection without touching Beam's source. A JSON array of `{ id, pattern, severity, title?, explanation?, category? }`; `pattern` is a regex (case-insensitive). Loaded once at collector startup; a malformed entry is skipped and reported (`beam rule list` / `beam start`'s output shows why), never crashes the rest of detection.
+
+  ```json
+  [
+    { "id": "internal_host", "pattern": "wiki\\.internal\\.corp", "severity": "high", "category": "exfil", "title": "Internal wiki referenced" }
+  ]
+  ```
+
+  `beam rule reload` applies edits to the running collector immediately, no restart needed.
+- **Cross-event sequence rules** — some risk only shows up as a *pattern of actions*, not one action in isolation: a credential read followed by network activity later in the same session, or a network scan followed by remote code execution, even across separate, unrelated-looking tool calls that a single-event regex could never connect. Beam re-evaluates a session's recent events (last 50) whenever new events land, and attaches one composite finding to the event that completes the pattern — idempotently, so re-ingesting the same history never duplicates it.
+
+All three feed the same `Finding[]` shape everywhere — Studio, `/export`, `/state` — so there's nothing separate to look at.
+
+## Running as a background service
+
+`beam start` in a terminal works, but closing that terminal stops the collector. `beam service install` instead registers it as a real background service:
+
+- **macOS**: a `launchd` user agent at `~/Library/LaunchAgents/ai.beam.collector.plist` (`RunAtLoad` + `KeepAlive`, so it starts on login and restarts if it crashes).
+- **Linux**: a `systemd --user` unit at `~/.config/systemd/user/beam.service` (`enable --now`, `Restart=always`).
+
+Both embed the resolved `BEAM_DATA_DIR` directly into the service definition (launchd/systemd don't inherit your shell's environment), so `BEAM_DATA_DIR=/custom/path beam service install` keeps using that path even after a reboot. Logs go to `$BEAM_DATA_DIR/logs/`.
+
+This is a userspace HTTP server, same as running `beam start` yourself — not kernel-level capture. Beam has nothing to observe at the kernel level: the actual signal comes from agents calling `beam hook <agent>` at the moment they're about to act, the same way whether run in a terminal or as a background service.
+
+Windows isn't supported yet (`beam service *` will say so and tell you to run `beam start` directly).
+
+## Configuration
+
+- `BEAM_HOME` — root config directory (default `~/.beam`).
+- `BEAM_DATA_DIR` — where events/scans/token are stored (default `$BEAM_HOME/data`).
+- `BEAM_TOKEN` — pairing token (skips reading the token file).
+- `BEAM_COLLECTOR_URL` — collector origin the CLI talks to (default `http://127.0.0.1:4319`); must stay on HTTP loopback.
+- `BEAM_PORT` — port `beam start` binds to (default `4319`).
+- `BEAM_ALLOWED_ORIGINS` — comma-separated browser origins allowed to call the collector (for a future local UI).
+
+## Connect a Claude Code hook
+
+```json
+{
+  "hooks": {
+    "PreToolUse": [{
+      "matcher": "",
+      "hooks": [{
+        "type": "command",
+        "command": "beam hook claude-code"
+      }]
+    }]
+  }
+}
+```
+
+Choose `PreToolUse` to observe proposed actions before they run. `beam` must be on the agent's PATH (or use its absolute path).
+
+## API
+
+All routes require `Authorization: Bearer <token>` and are bound to loopback only.
+
+- `GET /health` — collector version and retention.
+- `GET /state` — retained events, scans, reviews, rule catalog.
+- `GET /agents` — existence checks on common agent config/artifact locations, hook-install/payload-verification status; no contents are read.
+- `POST /ingest` — one normalized JSON object, JSON array, or NDJSON (up to 2 MB / 2,000 records; 100 KB per record).
+- `POST /v1/logs` — OTLP/HTTP **JSON** (not protobuf).
+- `POST /scan` — `{ "name": "SKILL.md", "kind": "skill", "content": "..." }` (or `kind: "mcp"`; max 500 KB).
+- `POST /review` — `{ "id": "...", "reviewed": true }`.
+- `POST /rules/reload` — reload `~/.beam/rules.json` into this running process; returns `{ path, loaded, errors }`.
+- `GET /export` — redacted event NDJSON.
+
+## Limits and guarantees
+
+- Retention: latest 10,000 events and 500 scan reports. Each accepted batch atomically replaces the bounded event file.
+- Known credential formats, assignments, auth headers, URL query strings, and private keys are redacted before persistence. Other sensitive text may remain; inspect exports before sharing.
+- Data directory mode `0700`, files `0600`. Token is generated once per data directory and reused across restarts.
+- The heuristic scanner is pattern matching, not semantic malware analysis or a safety guarantee. Findings require human review.
+
+## Development
+
+```bash
+npm test
+npm run typecheck
+npm run build
+```
+
+## Related
+
+- [beam-mcp](https://github.com/whyashthakker/beam-mcp) — an MCP server exposing this CLI's scanning to MCP-compatible hosts. Open source.
+
+## License
+
+AGPL-3.0-only — see [LICENSE](./LICENSE).

package/dist/agents.d.ts

@@ -0,0 +1,26 @@
+export type Obj = Record<string, unknown>;
+export interface AgentDefinition {
+    id: string;
+    name: string;
+    /** Paths (relative to home) checked for config presence during discovery. */
+    configs: string[];
+    /** Paths (relative to home) checked for session/transcript artifacts during discovery. */
+    artifacts: string[];
+    /** Path (relative to home) beam writes the hook configuration into. */
+    hookConfigPath: string | null;
+    /** Event name this agent's hook contract uses for a pre-action gate (documented casing). */
+    hookEventName: string | null;
+    /**
+     * Merge beam's hook entry into this agent's existing hook config (parsed JSON, or {} if the
+     * file didn't exist yet). Must be idempotent — safe to call repeatedly without duplicating.
+     */
+    mergeHookConfig: ((existing: Obj, command: string) => Obj) | null;
+    /** Payload adapter id used by src/hook-adapters.ts to normalize this agent's stdin JSON. */
+    adapter: "passthrough" | "copilot-camel" | "generic";
+    /** Whether the adapter above was verified against vendor documentation (vs. best-effort). */
+    verifiedPayload: boolean;
+    notes: string;
+}
+export declare const AGENTS: AgentDefinition[];
+export declare function findAgent(id: string): AgentDefinition | undefined;
+export declare function hookConfigFullPath(agent: AgentDefinition, home: string): string;

package/dist/agents.js

@@ -0,0 +1,96 @@
+import { join } from "node:path";
+function obj(v) { return v && typeof v === "object" && !Array.isArray(v) ? v : {}; }
+function arr(v) { return Array.isArray(v) ? v : []; }
+// Claude Code, Codex, and Cursor all install into a `hooks.<Event>` array of
+// `{ matcher, hooks: [{ type: "command", command }] }` entries (Claude Code's own shape).
+function mergeClaudeStyleHooks(event) {
+    return (existing, command) => {
+        const hooks = obj(existing.hooks);
+        const list = arr(hooks[event]).map(obj);
+        const alreadyInstalled = list.some(entry => arr(entry.hooks).map(obj).some(h => h.command === command));
+        if (!alreadyInstalled)
+            list.push({ matcher: "", hooks: [{ type: "command", command }] });
+        return { ...existing, hooks: { ...hooks, [event]: list } };
+    };
+}
+// Cursor's own hooks.json instead nests `{ command, matcher }` directly under the event array.
+function mergeCursorHooks(event) {
+    return (existing, command) => {
+        const hooks = obj(existing.hooks);
+        const list = arr(hooks[event]).map(obj);
+        if (!list.some(entry => entry.command === command))
+            list.push({ command, matcher: ".*" });
+        return { version: existing.version ?? 1, ...existing, hooks: { ...hooks, [event]: list } };
+    };
+}
+// Copilot CLI's dedicated hook file uses `{ type: "command", bash, timeoutSec }` entries.
+function mergeCopilotHooks(event) {
+    return (existing, command) => {
+        const hooks = obj(existing.hooks);
+        const list = arr(hooks[event]).map(obj);
+        if (!list.some(entry => entry.bash === command))
+            list.push({ type: "command", bash: command, timeoutSec: 30 });
+        return { version: existing.version ?? 1, ...existing, hooks: { ...hooks, [event]: list } };
+    };
+}
+export const AGENTS = [
+    {
+        id: "claude-code", name: "Claude Code",
+        configs: [".claude/settings.json"], artifacts: [".claude/projects"],
+        hookConfigPath: ".claude/settings.json", hookEventName: "PreToolUse",
+        mergeHookConfig: mergeClaudeStyleHooks("PreToolUse"), adapter: "passthrough", verifiedPayload: true,
+        notes: "Payload verified against code.claude.com/docs/en/hooks."
+    },
+    {
+        id: "codex", name: "Codex",
+        configs: [".codex/config.toml"], artifacts: [".codex/sessions", ".codex/archived_sessions"],
+        hookConfigPath: ".codex/hooks.json", hookEventName: "PreToolUse",
+        mergeHookConfig: mergeClaudeStyleHooks("PreToolUse"), adapter: "passthrough", verifiedPayload: true,
+        notes: "Same hooks.json shape and stdin payload fields as Claude Code (session_id, cwd, hook_event_name, tool_name, tool_input, tool_use_id)."
+    },
+    {
+        id: "cursor", name: "Cursor",
+        // ".cursor/hooks.json" is the file beam itself writes on install, so it can never be used to
+        // detect a pre-existing Cursor install (circular). The bare ".cursor" directory is what
+        // Cursor itself creates just from being used, so it's a real presence signal.
+        configs: [".cursor"], artifacts: [".cursor/projects"],
+        hookConfigPath: ".cursor/hooks.json", hookEventName: "preToolUse",
+        mergeHookConfig: mergeCursorHooks("preToolUse"), adapter: "passthrough", verifiedPayload: true,
+        notes: "Payload verified against cursor.com/docs/hooks; extra fields (model, conversation_id, ...) are ignored, not misread."
+    },
+    {
+        id: "copilot-cli", name: "GitHub Copilot CLI",
+        // Same circularity as Cursor above: ".copilot/hooks/beam.json" is our own output.
+        // ".copilot/config.json" is what the real Copilot CLI writes on its own first run.
+        configs: [".copilot/config.json"], artifacts: [".copilot/session-state"],
+        hookConfigPath: ".copilot/hooks/beam.json", hookEventName: "preToolUse",
+        mergeHookConfig: mergeCopilotHooks("preToolUse"), adapter: "copilot-camel", verifiedPayload: true,
+        notes: "Payload verified against docs.github.com Copilot hooks reference (camelCase: sessionId, cwd, toolName, toolArgs)."
+    },
+    {
+        id: "gemini", name: "Gemini CLI",
+        // settings.json only exists once hooks/other settings are configured; the bare ".gemini"
+        // directory (created by any use of the Gemini CLI, e.g. mcp_config.json, projects/) is the
+        // reliable presence signal.
+        configs: [".gemini", ".gemini/settings.json"], artifacts: [".gemini/tmp"],
+        hookConfigPath: ".gemini/settings.json", hookEventName: "BeforeTool",
+        mergeHookConfig: mergeClaudeStyleHooks("BeforeTool"), adapter: "generic", verifiedPayload: false,
+        notes: "Config wiring only. Gemini CLI's BeforeTool stdin schema is not published; capture uses a best-effort generic field adapter and may miss fields."
+    },
+    {
+        id: "opencode", name: "OpenCode",
+        configs: [".config/opencode/opencode.json", ".config/opencode/opencode.jsonc"], artifacts: [".local/share/opencode"],
+        hookConfigPath: null, hookEventName: null,
+        mergeHookConfig: null, adapter: "generic", verifiedPayload: false,
+        notes: "OpenCode uses a generated TypeScript plugin, not a JSON hook file; beam does not generate plugin code yet. Discovery only."
+    },
+];
+export function findAgent(id) {
+    return AGENTS.find(a => a.id === id);
+}
+export function hookConfigFullPath(agent, home) {
+    if (!agent.hookConfigPath)
+        throw new Error(`${agent.name} has no supported hook config file yet.`);
+    return join(home, agent.hookConfigPath);
+}
+//# sourceMappingURL=agents.js.map

package/dist/agents.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agents.js","sourceRoot":"","sources":["../src/agents.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AA2BjC,SAAS,GAAG,CAAC,CAAU,IAAS,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACzG,SAAS,GAAG,CAAC,CAAU,IAAe,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAEzE,6EAA6E;AAC7E,0FAA0F;AAC1F,SAAS,qBAAqB,CAAC,KAAa;IAC1C,OAAO,CAAC,QAAa,EAAE,OAAe,EAAO,EAAE;QAC7C,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC;QACxG,IAAI,CAAC,gBAAgB;YAAE,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;QACzF,OAAO,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;IAC7D,CAAC,CAAC;AACJ,CAAC;AAED,+FAA+F;AAC/F,SAAS,gBAAgB,CAAC,KAAa;IACrC,OAAO,CAAC,QAAa,EAAE,OAAe,EAAO,EAAE;QAC7C,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1F,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,IAAI,CAAC,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;IAC7F,CAAC,CAAC;AACJ,CAAC;AAED,0FAA0F;AAC1F,SAAS,iBAAiB,CAAC,KAAa;IACtC,OAAO,CAAC,QAAa,EAAE,OAAe,EAAO,EAAE;QAC7C,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/G,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,IAAI,CAAC,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;IAC7F,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,MAAM,GAAsB;IACvC;QACE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,aAAa;QACtC,OAAO,EAAE,CAAC,uBAAuB,CAAC,EAAE,SAAS,EAAE,CAAC,kBAAkB,CAAC;QACnE,cAAc,EAAE,uBAAuB,EAAE,aAAa,EAAE,YAAY;QACpE,eAAe,EAAE,qBAAqB,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,IAAI;QACnG,KAAK,EAAE,yDAAyD;KACjE;IACD;QACE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO;QAC1B,OAAO,EAAE,CAAC,oBAAoB,CAAC,EAAE,SAAS,EAAE,CAAC,iBAAiB,EAAE,0BAA0B,CAAC;QAC3F,cAAc,EAAE,mBAAmB,EAAE,aAAa,EAAE,YAAY;QAChE,eAAe,EAAE,qBAAqB,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,IAAI;QACnG,KAAK,EAAE,uIAAuI;KAC/I;IACD;QACE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ;QAC5B,6FAA6F;QAC7F,wFAAwF;QACxF,8EAA8E;QAC9E,OAAO,EAAE,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC,kBAAkB,CAAC;QACrD,cAAc,EAAE,oBAAoB,EAAE,aAAa,EAAE,YAAY;QACjE,eAAe,EAAE,gBAAgB,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,IAAI;QAC9F,KAAK,EAAE,sHAAsH;KAC9H;IACD;QACE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,oBAAoB;QAC7C,kFAAkF;QAClF,mFAAmF;QACnF,OAAO,EAAE,CAAC,sBAAsB,CAAC,EAAE,SAAS,EAAE,CAAC,wBAAwB,CAAC;QACxE,cAAc,EAAE,0BAA0B,EAAE,aAAa,EAAE,YAAY;QACvE,eAAe,EAAE,iBAAiB,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,IAAI;QACjG,KAAK,EAAE,mHAAmH;KAC3H;IACD;QACE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY;QAChC,yFAAyF;QACzF,2FAA2F;QAC3F,4BAA4B;QAC5B,OAAO,EAAE,CAAC,SAAS,EAAE,uBAAuB,CAAC,EAAE,SAAS,EAAE,CAAC,aAAa,CAAC;QACzE,cAAc,EAAE,uBAAuB,EAAE,aAAa,EAAE,YAAY;QACpE,eAAe,EAAE,qBAAqB,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,KAAK;QAChG,KAAK,EAAE,kJAAkJ;KAC1J;IACD;QACE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU;QAChC,OAAO,EAAE,CAAC,gCAAgC,EAAE,iCAAiC,CAAC,EAAE,SAAS,EAAE,CAAC,uBAAuB,CAAC;QACpH,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI;QACzC,eAAe,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,KAAK;QACjE,KAAK,EAAE,4HAA4H;KACpI;CACF,CAAC;AAEF,MAAM,UAAU,SAAS,CAAC,EAAU;IAClC,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAsB,EAAE,IAAY;IACrE,IAAI,CAAC,KAAK,CAAC,cAAc;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,IAAI,yCAAyC,CAAC,CAAC;IACnG,OAAO,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;AAC1C,CAAC"}

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/cli.js

@@ -0,0 +1,234 @@
+#!/usr/bin/env node
+import fs from "node:fs";
+import { Command } from "commander";
+import { startServer } from "./serve.js";
+import { captureHook, extractPreview, extractSave, importEvents, readToken, reloadRemoteRules, scanFile } from "./client.js";
+import { supportsExtraction } from "./extract.js";
+import { AGENTS } from "./agents.js";
+import { installAllDetectedHooks, installHook } from "./install.js";
+import { installService, serviceLogPaths, serviceStatus, startService, stopService, uninstallService } from "./service.js";
+import { getCollectorUrl, getIdentityPath } from "./config.js";
+import { enrollDevice, readIdentity } from "./enroll.js";
+import { syncPolicy } from "./forward.js";
+import { openBrowser } from "./open-browser.js";
+import { ruleCatalog } from "./core.js";
+import { loadCustomRules } from "./custom-rules.js";
+import { sequenceRuleCatalog } from "./sequences.js";
+const packageJson = JSON.parse(fs.readFileSync(new URL("../package.json", import.meta.url), "utf8"));
+const program = new Command()
+    .name("beam")
+    .description("Local observation and heuristic risk scanning for AI agent activity")
+    .version(packageJson.version);
+program.command("start")
+    .description("Start the local Beam collector (binds to 127.0.0.1)")
+    .option("-p, --port <port>", "port to listen on")
+    .action(async (options) => {
+    const result = await startServer({ port: options.port ? Number(options.port) : undefined });
+    const rulesNote = result.customRules.loaded ? `\nCustom rules loaded: ${result.customRules.loaded} from ${result.customRules.path}` : "";
+    for (const message of result.customRules.errors)
+        console.error(`✖ ${message}`);
+    const policyNote = result.policySync ? "\nPolicy sync: on (every 60s)" : "\nPolicy sync: off (device not enrolled — run 'beam enroll')";
+    const newlyInstalled = result.agentInstalls.filter(r => r.status === "installed");
+    const installNote = newlyInstalled.length
+        ? `\nAgent hooks installed: ${newlyInstalled.map(r => r.name).join(", ")}`
+        : "";
+    for (const r of result.agentInstalls) {
+        if (r.status === "error")
+            console.error(`✖ Could not wire beam's hook into ${r.name}: ${r.error}`);
+    }
+    console.log(`Beam collector running.\nMode: observe only\nLocal storage: ${result.directory}${rulesNote}${policyNote}${installNote}\nRun 'beam agent list' to see every detected agent's capture status.\nRun 'beam token' for the pairing token.`);
+});
+const service = program.command("service").description("Run the collector as a background service (launchd on macOS, systemd --user on Linux)");
+service.command("install")
+    .description("Install and start the collector as a background service that survives reboots")
+    .option("-p, --port <port>", "port to listen on")
+    .action(async (options) => {
+    const result = await installService({ port: options.port ? Number(options.port) : undefined });
+    console.log(`✔ Installed and started the beam service (${result.platform})\n  config: ${result.configPath}`);
+});
+service.command("uninstall")
+    .description("Stop and remove the background service")
+    .action(async () => { await uninstallService(); console.log("✔ Removed the beam service."); });
+service.command("start").description("Start the installed background service").action(async () => { await startService(); console.log("✔ Started."); });
+service.command("stop").description("Stop the installed background service").action(async () => { await stopService(); console.log("✔ Stopped."); });
+service.command("status")
+    .description("Show whether the background service is installed and running")
+    .action(async () => {
+    const result = await serviceStatus();
+    console.log(`platform: ${result.platform}\ninstalled: ${result.managed}\nrunning: ${result.running ?? "unknown"}\nconfig: ${result.configPath}`);
+});
+service.command("logs")
+    .description("Print the background service's log file paths (or the command to follow them)")
+    .action(async () => {
+    const paths = await serviceLogPaths();
+    console.log(paths.err ? `stdout: ${paths.out}\nstderr: ${paths.err}` : paths.out);
+});
+program.command("studio")
+    .description("Open the local activity dashboard in your browser")
+    .action(async () => {
+    const origin = getCollectorUrl().origin;
+    let token;
+    try {
+        token = await readToken();
+    }
+    catch (e) {
+        throw new Error(`${e.message} 'beam studio' needs the collector running first.`);
+    }
+    try {
+        await fetch(`${origin}/health`, { signal: AbortSignal.timeout(2000) });
+    }
+    catch {
+        throw new Error("Cannot reach the collector. Run 'beam start' or 'beam service install' first.");
+    }
+    openBrowser(`${origin}/?token=${encodeURIComponent(token)}`);
+    console.log("Opening beam studio in your browser…");
+});
+program.command("enroll")
+    .description("Enroll this device with your Beam workspace using a code from your manager")
+    .requiredOption("--code <code>", "enrollment code, e.g. BEAM-XXXX-XXXX-XXXX")
+    .option("--url <url>", "Beam API base URL (default $BEAM_API_URL or http://127.0.0.1:3200)")
+    .action(async (options) => {
+    const existing = await readIdentity();
+    if (existing)
+        console.error(`Replacing the existing enrollment (device ${existing.deviceId}).`);
+    const identity = await enrollDevice(options);
+    console.log(`✔ Enrolled device ${identity.deviceId}\n` +
+        `  org:      ${identity.orgId}\n` +
+        `  api:      ${identity.apiBase}\n` +
+        `  identity: ${getIdentityPath()} (0600)\n\n` +
+        `Next: beam agent install-all && beam start`);
+});
+program.command("whoami")
+    .description("Show this device's enrollment, if any")
+    .action(async () => {
+    const identity = await readIdentity();
+    if (!identity)
+        throw new Error("This device is not enrolled. Run 'beam enroll --code <code>'.");
+    console.log(`device: ${identity.deviceId}\norg:    ${identity.orgId}\napi:    ${identity.apiBase}\nhost:   ${identity.hostname} (${identity.os})\nsince:  ${identity.enrolledAt}`);
+});
+program.command("sync")
+    .description("Pull the latest policy from your Beam workspace into ~/.beam/data/policy.json")
+    .action(async () => {
+    const result = await syncPolicy();
+    if (result.status === "not-enrolled")
+        throw new Error("This device is not enrolled. Run 'beam enroll --code <code>'.");
+    if (result.status === "unreachable")
+        throw new Error("Could not reach the Beam workspace. Check the network or 'beam whoami'.");
+    console.log(result.status === "updated" ? `✔ Policy v${result.version} synced → ${result.path}` : "✔ Policy already up to date.");
+});
+program.command("token")
+    .description("Print the Beam collector pairing token")
+    .action(async () => console.log(await readToken()));
+program.command("import")
+    .description("Send a normalized events file (JSON/NDJSON) to the collector")
+    .argument("<file>", "path to events.ndjson or a JSON array/object")
+    .action(async (file) => console.log(JSON.stringify(await importEvents(file), null, 2)));
+program.command("scan")
+    .description("Scan a SKILL.md or MCP config for risky instructions")
+    .argument("<file>", "path to SKILL.md or an MCP configuration file")
+    .option("--mcp", "treat the file as an MCP configuration instead of a skill")
+    .option("--save", "also save the report to the running collector")
+    .action(async (file, options) => console.log(JSON.stringify(await scanFile(file, options), null, 2)));
+program.command("hook")
+    .description("Forward a hook payload from stdin for the given agent (observation only, never blocks the agent). Payload field names are adapted per agent; see 'beam agent list'.")
+    .argument("[source-agent]", "reporting agent id, e.g. claude-code, codex, cursor, copilot-cli", "claude-code")
+    .action(captureHook);
+const agent = program.command("agent").description("Discover and configure supported AI agents");
+agent.command("list")
+    .alias("ls")
+    .description("List supported agents and their hook payload verification status")
+    .action(() => {
+    for (const a of AGENTS) {
+        const install = a.hookConfigPath ? "installable" : "config wiring not built yet";
+        const payload = a.verifiedPayload ? "payload verified" : "payload best-effort";
+        console.log(`${a.id}\t${a.name}\t${install}\t${payload}`);
+    }
+});
+agent.command("install")
+    .description("Wire beam's hook into an agent's own hook config file, without disturbing existing hooks")
+    .argument("<agent>", "agent id, e.g. claude-code, codex, cursor, copilot-cli")
+    .action(async (agentId) => {
+    const result = await installHook(agentId);
+    console.log(result.alreadyInstalled ? `✔ Already installed for ${result.agent}\n  → ${result.path}` : `✔ Installed beam hook for ${result.agent}\n  → ${result.path}`);
+});
+agent.command("extract")
+    .description("Forensic extraction: read an agent's existing session/transcript files directly, no hook or live capture required")
+    .argument("<agent>", `agent id (currently: claude-code, codex)`)
+    .option("--save", "import extracted records into the running collector instead of just previewing them")
+    .option("--limit <n>", "cap how many events the offline preview prints", "200")
+    .action(async (agentId, options) => {
+    if (!supportsExtraction(agentId))
+        throw new Error(`Forensic extraction isn't built for '${agentId}' yet. Supported: claude-code, codex.`);
+    if (options.save) {
+        const result = await extractSave(agentId);
+        console.log(`Found ${result.found} historical action${result.found === 1 ? "" : "s"} in ${agentId}'s session files.\n✔ Imported: ${result.accepted}\n— Already had: ${result.duplicates}\n— Skipped (unsupported record type): ${result.skipped}`);
+    }
+    else {
+        const result = await extractPreview(agentId, Number(options.limit) || 200);
+        console.log(JSON.stringify(result.events, null, 2));
+        console.log(`\n${result.found} historical action${result.found === 1 ? "" : "s"} found (showing ${result.previewed}). This was NOT sent to the collector -- rerun with --save to import.`);
+    }
+});
+agent.command("install-all")
+    .description("Detect which agents are actually installed on this machine and wire beam's hook into all of them")
+    .action(async () => {
+    const results = await installAllDetectedHooks();
+    for (const r of results) {
+        if (r.status === "installed")
+            console.log(`✔ Installed for ${r.name}\n  → ${r.path}`);
+        else if (r.status === "already-installed")
+            console.log(`✔ Already installed for ${r.name}`);
+        else if (r.status === "not-supported")
+            console.log(`— ${r.name} detected, but hook install isn't built for it yet`);
+        else if (r.status === "error")
+            console.log(`✖ ${r.name}: ${r.error}`);
+        // "not-detected" agents are omitted entirely to keep this output about what's actually on this machine.
+    }
+    const acted = results.filter(r => r.status === "installed" || r.status === "already-installed");
+    if (!acted.length)
+        console.log("No supported agents detected on this machine. Run 'beam agent list' to see what's supported.");
+});
+const rule = program.command("rule").description("Inspect the active detection rule catalog");
+rule.command("list")
+    .alias("ls")
+    .description("List every active rule (built-in, custom, and cross-event sequence rules) grouped by category")
+    .action(async () => {
+    const customResult = await loadCustomRules();
+    const catalog = ruleCatalog();
+    const byCategory = new Map();
+    for (const r of catalog) {
+        const list = byCategory.get(r.category);
+        if (list)
+            list.push(r);
+        else
+            byCategory.set(r.category, [r]);
+    }
+    for (const [category, entries] of [...byCategory.entries()].sort(([a], [b]) => a.localeCompare(b))) {
+        console.log(`\n${category}`);
+        for (const r of entries)
+            console.log(`  ${r.id}\t${r.severity}\t${r.title}`);
+    }
+    console.log(`\nsequence (cross-event, evaluated per session)`);
+    for (const r of sequenceRuleCatalog)
+        console.log(`  ${r.id}\t${r.severity}\t${r.title} (${r.steps.length} steps)`);
+    const customCount = catalog.filter(r => r.category === "custom").length;
+    console.log(`\n${catalog.length} single-event rule${catalog.length === 1 ? "" : "s"} (${customCount} custom), ${sequenceRuleCatalog.length} sequence rule${sequenceRuleCatalog.length === 1 ? "" : "s"}.`);
+    if (customResult.errors.length) {
+        console.log(`\nCustom rule file issues (${customResult.path}):`);
+        for (const e of customResult.errors)
+            console.log(`  ✖ ${e}`);
+    }
+});
+rule.command("reload")
+    .description("Reload ~/.beam/rules.json into the running collector, without restarting it")
+    .action(async () => {
+    const result = await reloadRemoteRules();
+    console.log(`Loaded ${result.loaded} custom rule${result.loaded === 1 ? "" : "s"} from ${result.path}.`);
+    for (const e of result.errors)
+        console.log(`✖ ${e}`);
+});
+program.parseAsync().catch((error) => {
+    console.error(`\n✖ ${error instanceof Error ? error.message : String(error)}`);
+    process.exitCode = 1;
+});
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,WAAW,EAAE,YAAY,EAAE,SAAS,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC7H,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,aAAa,EAAE,YAAY,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAC3H,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAErD,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAwB,CAAC;AAE5H,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE;KAC1B,IAAI,CAAC,MAAM,CAAC;KACZ,WAAW,CAAC,qEAAqE,CAAC;KAClF,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;AAEhC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC;KACrB,WAAW,CAAC,qDAAqD,CAAC;KAClE,MAAM,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;KAChD,MAAM,CAAC,KAAK,EAAE,OAA0B,EAAE,EAAE;IAC3C,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;IAC5F,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,0BAA0B,MAAM,CAAC,WAAW,CAAC,MAAM,SAAS,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACzI,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM;QAAE,OAAO,CAAC,KAAK,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC;IAC/E,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,8DAA8D,CAAC;IACxI,MAAM,cAAc,GAAG,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC;IAClF,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM;QACvC,CAAC,CAAC,4BAA4B,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAC1E,CAAC,CAAC,EAAE,CAAC;IACP,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACrC,IAAI,CAAC,CAAC,MAAM,KAAK,OAAO;YAAE,OAAO,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IACrG,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,+DAA+D,MAAM,CAAC,SAAS,GAAG,SAAS,GAAG,UAAU,GAAG,WAAW,gHAAgH,CAAC,CAAC;AACtP,CAAC,CAAC,CAAC;AAEL,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,WAAW,CAAC,uFAAuF,CAAC,CAAC;AAEhJ,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC;KACvB,WAAW,CAAC,+EAA+E,CAAC;KAC5F,MAAM,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;KAChD,MAAM,CAAC,KAAK,EAAE,OAA0B,EAAE,EAAE;IAC3C,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;IAC/F,OAAO,CAAC,GAAG,CAAC,6CAA6C,MAAM,CAAC,QAAQ,gBAAgB,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;AAC/G,CAAC,CAAC,CAAC;AAEL,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC;KACzB,WAAW,CAAC,wCAAwC,CAAC;KACrD,MAAM,CAAC,KAAK,IAAI,EAAE,GAAG,MAAM,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAEjG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,wCAAwC,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACxJ,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,uCAAuC,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAErJ,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC;KACtB,WAAW,CAAC,8DAA8D,CAAC;KAC3E,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,MAAM,GAAG,MAAM,aAAa,EAAE,CAAC;IACrC,OAAO,CAAC,GAAG,CAAC,aAAa,MAAM,CAAC,QAAQ,gBAAgB,MAAM,CAAC,OAAO,cAAc,MAAM,CAAC,OAAO,IAAI,SAAS,aAAa,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;AACnJ,CAAC,CAAC,CAAC;AAEL,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;KACpB,WAAW,CAAC,+EAA+E,CAAC;KAC5F,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAC;IACtC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,KAAK,CAAC,GAAG,aAAa,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AACpF,CAAC,CAAC,CAAC;AAEL,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC;KACtB,WAAW,CAAC,mDAAmD,CAAC;KAChE,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC,MAAM,CAAC;IACxC,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QAAC,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC;IAAC,CAAC;IAClC,OAAO,CAAC,EAAE,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,GAAI,CAAW,CAAC,OAAO,mDAAmD,CAAC,CAAC;IAAC,CAAC;IAC1G,IAAI,CAAC;QAAC,MAAM,KAAK,CAAC,GAAG,MAAM,SAAS,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAAC,CAAC;IAC/E,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAC;IAAC,CAAC;IAC3G,WAAW,CAAC,GAAG,MAAM,WAAW,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC7D,OAAO,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;AACtD,CAAC,CAAC,CAAC;AAEL,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC;KACtB,WAAW,CAAC,4EAA4E,CAAC;KACzF,cAAc,CAAC,eAAe,EAAE,2CAA2C,CAAC;KAC5E,MAAM,CAAC,aAAa,EAAE,oEAAoE,CAAC;KAC3F,MAAM,CAAC,KAAK,EAAE,OAAuC,EAAE,EAAE;IACxD,MAAM,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAC;IACtC,IAAI,QAAQ;QAAE,OAAO,CAAC,KAAK,CAAC,6CAA6C,QAAQ,CAAC,QAAQ,IAAI,CAAC,CAAC;IAChG,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;IAC7C,OAAO,CAAC,GAAG,CACT,qBAAqB,QAAQ,CAAC,QAAQ,IAAI;QAC1C,eAAe,QAAQ,CAAC,KAAK,IAAI;QACjC,eAAe,QAAQ,CAAC,OAAO,IAAI;QACnC,eAAe,eAAe,EAAE,aAAa;QAC7C,4CAA4C,CAC7C,CAAC;AACJ,CAAC,CAAC,CAAC;AAEL,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC;KACtB,WAAW,CAAC,uCAAuC,CAAC;KACpD,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAC;IACtC,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IAChG,OAAO,CAAC,GAAG,CAAC,WAAW,QAAQ,CAAC,QAAQ,aAAa,QAAQ,CAAC,KAAK,aAAa,QAAQ,CAAC,OAAO,aAAa,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,EAAE,cAAc,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;AACrL,CAAC,CAAC,CAAC;AAEL,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;KACpB,WAAW,CAAC,+EAA+E,CAAC;KAC5F,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;IAClC,IAAI,MAAM,CAAC,MAAM,KAAK,cAAc;QAAE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACvH,IAAI,MAAM,CAAC,MAAM,KAAK,aAAa;QAAE,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;IAChI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,aAAa,MAAM,CAAC,OAAO,aAAa,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC;AACpI,CAAC,CAAC,CAAC;AAEL,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC;KACrB,WAAW,CAAC,wCAAwC,CAAC;KACrD,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC,CAAC;AAEtD,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC;KACtB,WAAW,CAAC,8DAA8D,CAAC;KAC3E,QAAQ,CAAC,QAAQ,EAAE,8CAA8C,CAAC;KAClE,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAElG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;KACpB,WAAW,CAAC,sDAAsD,CAAC;KACnE,QAAQ,CAAC,QAAQ,EAAE,+CAA+C,CAAC;KACnE,MAAM,CAAC,OAAO,EAAE,2DAA2D,CAAC;KAC5E,MAAM,CAAC,QAAQ,EAAE,+CAA+C,CAAC;KACjE,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,OAA0C,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAEnJ,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;KACpB,WAAW,CAAC,qKAAqK,CAAC;KAClL,QAAQ,CAAC,gBAAgB,EAAE,kEAAkE,EAAE,aAAa,CAAC;KAC7G,MAAM,CAAC,WAAW,CAAC,CAAC;AAEvB,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,4CAA4C,CAAC,CAAC;AAEjG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;KAClB,KAAK,CAAC,IAAI,CAAC;KACX,WAAW,CAAC,kEAAkE,CAAC;KAC/E,MAAM,CAAC,GAAG,EAAE;IACX,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,6BAA6B,CAAC;QACjF,MAAM,OAAO,GAAG,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,qBAAqB,CAAC;QAC/E,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,KAAK,OAAO,KAAK,OAAO,EAAE,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;KACrB,WAAW,CAAC,0FAA0F,CAAC;KACvG,QAAQ,CAAC,SAAS,EAAE,wDAAwD,CAAC;KAC7E,MAAM,CAAC,KAAK,EAAE,OAAe,EAAE,EAAE;IAChC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;IAC1C,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,2BAA2B,MAAM,CAAC,KAAK,SAAS,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,6BAA6B,MAAM,CAAC,KAAK,SAAS,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;AACzK,CAAC,CAAC,CAAC;AAEL,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;KACrB,WAAW,CAAC,mHAAmH,CAAC;KAChI,QAAQ,CAAC,SAAS,EAAE,0CAA0C,CAAC;KAC/D,MAAM,CAAC,QAAQ,EAAE,qFAAqF,CAAC;KACvG,MAAM,CAAC,aAAa,EAAE,gDAAgD,EAAE,KAAK,CAAC;KAC9E,MAAM,CAAC,KAAK,EAAE,OAAe,EAAE,OAA2C,EAAE,EAAE;IAC7E,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,OAAO,uCAAuC,CAAC,CAAC;IAC1I,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,SAAS,MAAM,CAAC,KAAK,qBAAqB,MAAM,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,OAAO,OAAO,kCAAkC,MAAM,CAAC,QAAQ,oBAAoB,MAAM,CAAC,UAAU,0CAA0C,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACrP,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC;QAC3E,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACpD,OAAO,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,KAAK,qBAAqB,MAAM,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,mBAAmB,MAAM,CAAC,SAAS,uEAAuE,CAAC,CAAC;IAC7L,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC;KACzB,WAAW,CAAC,kGAAkG,CAAC;KAC/G,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,OAAO,GAAG,MAAM,uBAAuB,EAAE,CAAC;IAChD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,MAAM,KAAK,WAAW;YAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;aACjF,IAAI,CAAC,CAAC,MAAM,KAAK,mBAAmB;YAAE,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;aACvF,IAAI,CAAC,CAAC,MAAM,KAAK,eAAe;YAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,oDAAoD,CAAC,CAAC;aAC/G,IAAI,CAAC,CAAC,MAAM,KAAK,OAAO;YAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QACtE,wGAAwG;IAC1G,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,IAAI,CAAC,CAAC,MAAM,KAAK,mBAAmB,CAAC,CAAC;IAChG,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,CAAC,GAAG,CAAC,8FAA8F,CAAC,CAAC;AACjI,CAAC,CAAC,CAAC;AAEL,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,2CAA2C,CAAC,CAAC;AAE9F,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;KACjB,KAAK,CAAC,IAAI,CAAC;KACX,WAAW,CAAC,+FAA+F,CAAC;KAC5G,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,YAAY,GAAG,MAAM,eAAe,EAAE,CAAC;IAC7C,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAC9B,MAAM,UAAU,GAAG,IAAI,GAAG,EAA0B,CAAC;IACrD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,IAAI;YAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;;YAAM,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,CAAC;IACD,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnG,OAAO,CAAC,GAAG,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;QAC7B,KAAK,MAAM,CAAC,IAAI,OAAO;YAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC;IAC/D,KAAK,MAAM,CAAC,IAAI,mBAAmB;QAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,CAAC,MAAM,SAAS,CAAC,CAAC;IACnH,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC;IACxE,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,MAAM,qBAAqB,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,WAAW,aAAa,mBAAmB,CAAC,MAAM,iBAAiB,mBAAmB,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;IAC3M,IAAI,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,YAAY,CAAC,IAAI,IAAI,CAAC,CAAC;QAAC,KAAK,MAAM,CAAC,IAAI,YAAY,CAAC,MAAM;YAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAAC,CAAC;AACrK,CAAC,CAAC,CAAC;AAEL,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;KACnB,WAAW,CAAC,6EAA6E,CAAC;KAC1F,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,MAAM,GAAG,MAAM,iBAAiB,EAAE,CAAC;IACzC,OAAO,CAAC,GAAG,CAAC,UAAU,MAAM,CAAC,MAAM,eAAe,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,SAAS,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;IACzG,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM;QAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AACvD,CAAC,CAAC,CAAC;AAEL,OAAO,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;IAC5C,OAAO,CAAC,KAAK,CAAC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC/E,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC,CAAC,CAAC"}

package/dist/client.d.ts

@@ -0,0 +1,28 @@
+import { type Event, type Scan } from "./core.js";
+export declare function readToken(): Promise<string>;
+export declare function importEvents(filePath: string): Promise<unknown>;
+export interface RuleReloadResult {
+    path: string;
+    loaded: number;
+    errors: string[];
+}
+export declare function reloadRemoteRules(): Promise<RuleReloadResult>;
+export interface ScanOptions {
+    mcp?: boolean;
+    save?: boolean;
+}
+export declare function scanFile(filePath: string, options?: ScanOptions, beamHome?: string): Promise<Scan | unknown>;
+export interface ExtractPreviewResult {
+    found: number;
+    previewed: number;
+    events: Event[];
+}
+export interface ExtractSaveResult {
+    found: number;
+    accepted: number;
+    duplicates: number;
+    skipped: number;
+}
+export declare function extractPreview(agentId: string, limit?: number, home?: string, beamHome?: string): Promise<ExtractPreviewResult>;
+export declare function extractSave(agentId: string, home?: string): Promise<ExtractSaveResult>;
+export declare function captureHook(sourceAgent?: string): Promise<void>;