@agent-beam/beam 0.1.0

package/dist/enroll.js

@@ -0,0 +1,68 @@
+import { generateKeyPairSync } from "node:crypto";
+import { hostname } from "node:os";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { dirname } from "node:path";
+import { getApiUrl, getIdentityPath } from "./config.js";
+const CODE_RE = /^BEAM-[A-Z2-9]{4}-[A-Z2-9]{4}-[A-Z2-9]{4}$/;
+export async function readIdentity() {
+    try {
+        return JSON.parse(await readFile(getIdentityPath(), "utf8"));
+    }
+    catch {
+        return null;
+    }
+}
+// Never blocks anything; enrollment just writes credentials this machine uses later.
+export async function enrollDevice(options) {
+    const code = options.code.trim().toUpperCase();
+    if (!CODE_RE.test(code))
+        throw new Error("Code must look like BEAM-XXXX-XXXX-XXXX.");
+    const base = (options.url ?? getApiUrl()).replace(/\/+$/, "");
+    const { publicKey, privateKey } = generateKeyPairSync("ed25519");
+    const pub = publicKey.export({ type: "spki", format: "der" }).toString("base64");
+    const priv = privateKey.export({ type: "pkcs8", format: "der" }).toString("base64");
+    const os = process.platform;
+    const host = hostname();
+    let response;
+    try {
+        response = await fetch(`${base}/v1/enroll`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ code, device: { hostname: host, os, public_key: pub } }),
+            signal: AbortSignal.timeout(10_000),
+        });
+    }
+    catch {
+        throw new Error(`Could not reach ${base}. Pass --url or set BEAM_API_URL.`);
+    }
+    if (!response.ok) {
+        let message = `Enrollment rejected (${response.status}).`;
+        try {
+            const body = (await response.json());
+            if (body.error)
+                message = body.error;
+        }
+        catch { /* keep the status-only message */ }
+        throw new Error(message);
+    }
+    const data = (await response.json());
+    if (!data.device_id || !data.device_secret || !data.org_id) {
+        throw new Error("Enrollment response is missing device credentials.");
+    }
+    const identity = {
+        deviceId: data.device_id,
+        deviceSecret: data.device_secret,
+        orgId: data.org_id,
+        apiBase: (data.api_base ?? base).replace(/\/+$/, ""),
+        publicKey: pub,
+        privateKey: priv,
+        hostname: host,
+        os,
+        enrolledAt: new Date().toISOString(),
+    };
+    const path = getIdentityPath();
+    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+    await writeFile(path, `${JSON.stringify(identity, null, 2)}\n`, { mode: 0o600 });
+    return identity;
+}
+//# sourceMappingURL=enroll.js.map

package/dist/enroll.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enroll.js","sourceRoot":"","sources":["../src/enroll.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAczD,MAAM,OAAO,GAAG,4CAA4C,CAAC;AAE7D,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,eAAe,EAAE,EAAE,MAAM,CAAC,CAAa,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAuC;IACxE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/C,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAErF,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAE9D,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACjE,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACjF,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACpF,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC5B,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;IAExB,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,YAAY,EAAE;YAC1C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,EAAE,CAAC;YAC/E,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,mCAAmC,CAAC,CAAC;IAC9E,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,IAAI,OAAO,GAAG,wBAAwB,QAAQ,CAAC,MAAM,IAAI,CAAC;QAC1D,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAuB,CAAC;YAC3D,IAAI,IAAI,CAAC,KAAK;gBAAE,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC,CAAC,kCAAkC,CAAC,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAKlC,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,QAAQ,GAAa;QACzB,QAAQ,EAAE,IAAI,CAAC,SAAS;QACxB,YAAY,EAAE,IAAI,CAAC,aAAa;QAChC,KAAK,EAAE,IAAI,CAAC,MAAM;QAClB,OAAO,EAAE,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QACpD,SAAS,EAAE,GAAG;QACd,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,IAAI;QACd,EAAE;QACF,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrC,CAAC;IAEF,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7D,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjF,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/extract.d.ts

@@ -0,0 +1,6 @@
+export type Obj = Record<string, unknown>;
+export declare function extractClaudeCode(home: string): Promise<Obj[]>;
+export declare function extractCodex(home: string): Promise<Obj[]>;
+export type ExtractorId = "claude-code" | "codex";
+export declare function supportsExtraction(agentId: string): agentId is ExtractorId;
+export declare function extractAgent(agentId: string, home: string): Promise<Obj[]>;

package/dist/extract.js

@@ -0,0 +1,148 @@
+import { readFile, readdir, stat } from "node:fs/promises";
+import { join } from "node:path";
+// Forensic extraction reads an agent's own existing session/transcript files -- no hook
+// required, and it can see activity from before beam was ever installed. Bounded generously so
+// a huge or pathological transcript directory can't exhaust memory or flood the collector.
+const MAX_FILE_SIZE = 50_000_000; // 50 MB per transcript file
+const MAX_RECORDS_PER_FILE = 20_000; // parsed JSONL lines kept per file
+const MAX_FILES = 2000; // transcript files walked per extraction run
+function obj(v) { return v && typeof v === "object" && !Array.isArray(v) ? v : {}; }
+function str(v) { return typeof v === "string" ? v : ""; }
+function arr(v) { return Array.isArray(v) ? v : []; }
+function isFinitePastTimestamp(v) { return v.length > 0 && Number.isFinite(Date.parse(v)); }
+async function walk(dir, out = []) {
+    let entries;
+    try {
+        entries = await readdir(dir, { withFileTypes: true });
+    }
+    catch {
+        return out;
+    }
+    for (const entry of entries) {
+        if (out.length >= MAX_FILES)
+            break;
+        const full = join(dir, entry.name);
+        if (entry.isDirectory())
+            await walk(full, out);
+        else if (entry.isFile() && entry.name.endsWith(".jsonl"))
+            out.push(full);
+    }
+    return out;
+}
+async function readJsonlRows(path) {
+    try {
+        if ((await stat(path)).size > MAX_FILE_SIZE)
+            return [];
+    }
+    catch {
+        return [];
+    }
+    let content;
+    try {
+        content = await readFile(path, "utf8");
+    }
+    catch {
+        return [];
+    }
+    const rows = [];
+    for (const line of content.split("\n")) {
+        const trimmed = line.trim();
+        if (!trimmed)
+            continue;
+        try {
+            rows.push(JSON.parse(trimmed));
+        }
+        catch { /* skip a malformed line, not the whole file */ }
+        if (rows.length >= MAX_RECORDS_PER_FILE)
+            break;
+    }
+    return rows;
+}
+// ~/.claude/projects/<encoded-project-path>/<session-uuid>.jsonl -- an "assistant" line's
+// message.content array carries tool_use blocks alongside prose/thinking blocks.
+export async function extractClaudeCode(home) {
+    const files = await walk(join(home, ".claude", "projects"));
+    const records = [];
+    for (const file of files) {
+        for (const row of await readJsonlRows(file)) {
+            if (row.type !== "assistant")
+                continue;
+            const message = obj(row.message);
+            const timestamp = str(row.timestamp);
+            if (!isFinitePastTimestamp(timestamp))
+                continue;
+            for (const item of arr(message.content)) {
+                const block = obj(item);
+                if (block.type !== "tool_use")
+                    continue;
+                const eventId = str(block.id);
+                records.push({
+                    ...(eventId ? { event_id: eventId } : {}),
+                    tool_name: block.name,
+                    tool_input: block.input,
+                    session_id: str(row.session_id) || str(row.sessionId),
+                    project_path: str(row.cwd),
+                    timestamp,
+                    model: str(message.model),
+                    source_agent: "claude-code",
+                    source_type: "extract",
+                });
+            }
+        }
+    }
+    return records;
+}
+// ~/.codex/{sessions,archived_sessions}/rollout-*.jsonl -- a leading "session_meta" record
+// carries session_id/cwd; "response_item" records of payload.type "function_call" (shell/exec
+// tools; arguments is a JSON *string*) or "custom_tool_call" (e.g. apply_patch; input is raw
+// text, not JSON) are the actions. Everything else (message/reasoning/output records) is
+// conversation, not an action -- skipped, matching what a live PreToolUse hook would ever see.
+export async function extractCodex(home) {
+    const roots = [join(home, ".codex", "sessions"), join(home, ".codex", "archived_sessions")];
+    const records = [];
+    for (const root of roots) {
+        for (const file of await walk(root)) {
+            let sessionId = "";
+            let cwd = "";
+            for (const row of await readJsonlRows(file)) {
+                if (row.type === "session_meta") {
+                    const payload = obj(row.payload);
+                    sessionId = str(payload.session_id) || str(payload.id);
+                    cwd = str(payload.cwd);
+                    continue;
+                }
+                if (row.type !== "response_item")
+                    continue;
+                const timestamp = str(row.timestamp);
+                if (!isFinitePastTimestamp(timestamp))
+                    continue;
+                const payload = obj(row.payload);
+                const callId = str(payload.call_id);
+                const base = { ...(callId ? { event_id: callId } : {}), session_id: sessionId, project_path: cwd, timestamp, source_agent: "codex", source_type: "extract" };
+                if (payload.type === "function_call") {
+                    let args = {};
+                    try {
+                        args = JSON.parse(str(payload.arguments));
+                    }
+                    catch { /* arguments wasn't JSON */ }
+                    records.push({ ...base, tool_name: payload.name, command: args.cmd ?? args.command, tool_input: args });
+                }
+                else if (payload.type === "custom_tool_call") {
+                    const input = payload.input;
+                    records.push({ ...base, tool_name: payload.name, content_preview: typeof input === "string" ? input : JSON.stringify(input ?? {}) });
+                }
+            }
+        }
+    }
+    return records;
+}
+const extractors = { "claude-code": extractClaudeCode, codex: extractCodex };
+export function supportsExtraction(agentId) {
+    return Object.prototype.hasOwnProperty.call(extractors, agentId);
+}
+export async function extractAgent(agentId, home) {
+    if (!supportsExtraction(agentId))
+        throw new Error(`Forensic extraction isn't built for '${agentId}' yet. Supported: ${Object.keys(extractors).join(", ")}.`);
+    return extractors[agentId](home);
+}
+//# sourceMappingURL=extract.js.map

package/dist/extract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"extract.js","sourceRoot":"","sources":["../src/extract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAIjC,wFAAwF;AACxF,+FAA+F;AAC/F,2FAA2F;AAC3F,MAAM,aAAa,GAAG,UAAU,CAAC,CAAC,4BAA4B;AAC9D,MAAM,oBAAoB,GAAG,MAAM,CAAC,CAAC,mCAAmC;AACxE,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,6CAA6C;AAErE,SAAS,GAAG,CAAC,CAAU,IAAS,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACzG,SAAS,GAAG,CAAC,CAAU,IAAY,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC3E,SAAS,GAAG,CAAC,CAAU,IAAe,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACzE,SAAS,qBAAqB,CAAC,CAAS,IAAa,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAE7G,KAAK,UAAU,IAAI,CAAC,GAAW,EAAE,MAAgB,EAAE;IACjD,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QAAC,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,GAAG,CAAC;IAAC,CAAC;IACpF,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,GAAG,CAAC,MAAM,IAAI,SAAS;YAAE,MAAM;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,KAAK,CAAC,WAAW,EAAE;YAAE,MAAM,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;aAC1C,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,IAAY;IACvC,IAAI,CAAC;QAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,aAAa;YAAE,OAAO,EAAE,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,EAAE,CAAC;IAAC,CAAC;IACpF,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QAAC,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,EAAE,CAAC;IAAC,CAAC;IACpE,MAAM,IAAI,GAAU,EAAE,CAAC;IACvB,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,IAAI,CAAC;YAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAQ,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,+CAA+C,CAAC,CAAC;QACxG,IAAI,IAAI,CAAC,MAAM,IAAI,oBAAoB;YAAE,MAAM;IACjD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,0FAA0F;AAC1F,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAY;IAClD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAU,EAAE,CAAC;IAC1B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,MAAM,GAAG,IAAI,MAAM,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5C,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW;gBAAE,SAAS;YACvC,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACjC,MAAM,SAAS,GAAG,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACrC,IAAI,CAAC,qBAAqB,CAAC,SAAS,CAAC;gBAAE,SAAS;YAChD,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBACxC,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;gBACxB,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU;oBAAE,SAAS;gBACxC,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBAC9B,OAAO,CAAC,IAAI,CAAC;oBACX,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACzC,SAAS,EAAE,KAAK,CAAC,IAAI;oBACrB,UAAU,EAAE,KAAK,CAAC,KAAK;oBACvB,UAAU,EAAE,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC;oBACrD,YAAY,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC;oBAC1B,SAAS;oBACT,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC;oBACzB,YAAY,EAAE,aAAa;oBAC3B,WAAW,EAAE,SAAS;iBACvB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,2FAA2F;AAC3F,8FAA8F;AAC9F,6FAA6F;AAC7F,yFAAyF;AACzF,+FAA+F;AAC/F,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY;IAC7C,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAC,CAAC;IAC5F,MAAM,OAAO,GAAU,EAAE,CAAC;IAC1B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,MAAM,IAAI,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,IAAI,SAAS,GAAG,EAAE,CAAC;YAAC,IAAI,GAAG,GAAG,EAAE,CAAC;YACjC,KAAK,MAAM,GAAG,IAAI,MAAM,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5C,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;oBAChC,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;oBACjC,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;oBACvD,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;oBACvB,SAAS;gBACX,CAAC;gBACD,IAAI,GAAG,CAAC,IAAI,KAAK,eAAe;oBAAE,SAAS;gBAC3C,MAAM,SAAS,GAAG,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBACrC,IAAI,CAAC,qBAAqB,CAAC,SAAS,CAAC;oBAAE,SAAS;gBAChD,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBACjC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;gBACpC,MAAM,IAAI,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,GAAG,EAAE,SAAS,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;gBAC7J,IAAI,OAAO,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;oBACrC,IAAI,IAAI,GAAQ,EAAE,CAAC;oBACnB,IAAI,CAAC;wBAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAQ,CAAC;oBAAC,CAAC;oBAAC,MAAM,CAAC,CAAC,2BAA2B,CAAC,CAAC;oBAC/F,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC1G,CAAC;qBAAM,IAAI,OAAO,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;oBAC/C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;oBAC5B,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,IAAI,EAAE,eAAe,EAAE,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;gBACvI,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAGD,MAAM,UAAU,GAA0D,EAAE,aAAa,EAAE,iBAAiB,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;AAEpI,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAe,EAAE,IAAY;IAC9D,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,OAAO,qBAAqB,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7J,OAAO,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC"}

package/dist/forward.d.ts

@@ -0,0 +1,8 @@
+import type { Event } from "./core.js";
+export declare function forwardEvents(events: Event | Event[]): Promise<void>;
+export interface PolicySyncResult {
+    status: "updated" | "unchanged" | "not-enrolled" | "unreachable";
+    version?: number;
+    path?: string;
+}
+export declare function syncPolicy(): Promise<PolicySyncResult>;

package/dist/forward.js

@@ -0,0 +1,53 @@
+import { mkdir, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { getDataDirectory } from "./config.js";
+import { readIdentity } from "./enroll.js";
+function policyPath() {
+    return join(getDataDirectory(), "policy.json");
+}
+// Fire-and-forget: forwarding to the workspace must never block or fail the agent.
+export async function forwardEvents(events) {
+    const identity = await readIdentity();
+    if (!identity)
+        return;
+    try {
+        await fetch(`${identity.apiBase}/v1/ingest`, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                Authorization: `Bearer ${identity.deviceSecret}`,
+            },
+            body: JSON.stringify(events),
+            signal: AbortSignal.timeout(5000),
+        });
+    }
+    catch {
+        /* offline / unreachable — the local collector still has the record */
+    }
+}
+// Pull the current policy bundle and cache it locally for the hook to enforce.
+export async function syncPolicy() {
+    const identity = await readIdentity();
+    if (!identity)
+        return { status: "not-enrolled" };
+    let response;
+    try {
+        response = await fetch(`${identity.apiBase}/v1/policy`, {
+            headers: { Authorization: `Bearer ${identity.deviceSecret}` },
+            signal: AbortSignal.timeout(5000),
+        });
+    }
+    catch {
+        return { status: "unreachable" };
+    }
+    if (response.status === 304)
+        return { status: "unchanged" };
+    if (!response.ok)
+        return { status: "unreachable" };
+    const bundle = await response.json();
+    const path = policyPath();
+    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+    await writeFile(path, `${JSON.stringify(bundle, null, 2)}\n`, { mode: 0o600 });
+    return { status: "updated", version: bundle.version, path };
+}
+//# sourceMappingURL=forward.js.map

package/dist/forward.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"forward.js","sourceRoot":"","sources":["../src/forward.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C,SAAS,UAAU;IACjB,OAAO,IAAI,CAAC,gBAAgB,EAAE,EAAE,aAAa,CAAC,CAAC;AACjD,CAAC;AAED,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,MAAuB;IACzD,MAAM,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAC;IACtC,IAAI,CAAC,QAAQ;QAAE,OAAO;IACtB,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,GAAG,QAAQ,CAAC,OAAO,YAAY,EAAE;YAC3C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,QAAQ,CAAC,YAAY,EAAE;aACjD;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;YAC5B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;IACxE,CAAC;AACH,CAAC;AAQD,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,MAAM,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAC;IACtC,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAEjD,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,QAAQ,CAAC,OAAO,YAAY,EAAE;YACtD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,QAAQ,CAAC,YAAY,EAAE,EAAE;YAC7D,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACnC,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC5D,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAEnD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC;IAC1B,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7D,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/E,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC;AAC9D,CAAC"}

package/dist/hook-adapters.d.ts

@@ -0,0 +1,2 @@
+import { type Obj } from "./agents.js";
+export declare function adaptHookPayload(sourceAgent: string, raw: Obj): Obj;

package/dist/hook-adapters.js

@@ -0,0 +1,36 @@
+import { findAgent } from "./agents.js";
+// Claude Code, Codex, and Cursor all send tool_name/tool_input/session_id/cwd/hook_event_name
+// (core.normalize already reads exactly these fields, case-insensitively for hook_event_name).
+function passthrough(raw) {
+    return raw;
+}
+// GitHub Copilot CLI's preToolUse payload is camelCase and has no hook_event_name field —
+// it's implied by which hooks.json array the handler is registered under.
+function copilotCamel(raw) {
+    return {
+        ...raw,
+        session_id: raw.sessionId ?? raw.session_id,
+        cwd: raw.cwd,
+        tool_name: raw.toolName ?? raw.tool_name,
+        tool_input: raw.toolArgs ?? raw.tool_input,
+        hook_event_name: raw.hook_event_name ?? "PreToolUse",
+    };
+}
+// Best-effort fallback for agents whose stdin schema is not (yet) verified against vendor docs.
+function generic(raw) {
+    return {
+        ...raw,
+        session_id: raw.session_id ?? raw.sessionId ?? raw.session,
+        cwd: raw.cwd ?? raw.project_path ?? raw.workingDirectory ?? raw.working_directory,
+        tool_name: raw.tool_name ?? raw.toolName ?? raw.tool,
+        tool_input: raw.tool_input ?? raw.toolArgs ?? raw.toolInput ?? raw.input,
+        hook_event_name: raw.hook_event_name ?? raw.hookEventName ?? raw.event,
+    };
+}
+const adapters = { passthrough, "copilot-camel": copilotCamel, generic };
+export function adaptHookPayload(sourceAgent, raw) {
+    const agent = findAgent(sourceAgent);
+    const adapter = adapters[agent?.adapter ?? "generic"];
+    return adapter(raw);
+}
+//# sourceMappingURL=hook-adapters.js.map

package/dist/hook-adapters.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hook-adapters.js","sourceRoot":"","sources":["../src/hook-adapters.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAY,MAAM,aAAa,CAAC;AAElD,8FAA8F;AAC9F,+FAA+F;AAC/F,SAAS,WAAW,CAAC,GAAQ;IAC3B,OAAO,GAAG,CAAC;AACb,CAAC;AAED,0FAA0F;AAC1F,0EAA0E;AAC1E,SAAS,YAAY,CAAC,GAAQ;IAC5B,OAAO;QACL,GAAG,GAAG;QACN,UAAU,EAAE,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,UAAU;QAC3C,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,SAAS,EAAE,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,SAAS;QACxC,UAAU,EAAE,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,UAAU;QAC1C,eAAe,EAAE,GAAG,CAAC,eAAe,IAAI,YAAY;KACrD,CAAC;AACJ,CAAC;AAED,gGAAgG;AAChG,SAAS,OAAO,CAAC,GAAQ;IACvB,OAAO;QACL,GAAG,GAAG;QACN,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,OAAO;QAC1D,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,YAAY,IAAI,GAAG,CAAC,gBAAgB,IAAI,GAAG,CAAC,iBAAiB;QACjF,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI;QACpD,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,KAAK;QACxE,eAAe,EAAE,GAAG,CAAC,eAAe,IAAI,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,KAAK;KACvE,CAAC;AACJ,CAAC;AAED,MAAM,QAAQ,GAAG,EAAE,WAAW,EAAE,eAAe,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;AAEzE,MAAM,UAAU,gBAAgB,CAAC,WAAmB,EAAE,GAAQ;IAC5D,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,EAAE,OAAO,IAAI,SAAS,CAAC,CAAC;IACtD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;AACtB,CAAC"}

package/dist/install.d.ts

@@ -0,0 +1,15 @@
+export interface InstallResult {
+    agent: string;
+    path: string;
+    alreadyInstalled: boolean;
+}
+export declare function installHook(agentId: string, home?: string): Promise<InstallResult>;
+export type InstallAllStatus = "installed" | "already-installed" | "not-detected" | "not-supported" | "error";
+export interface InstallAllResult {
+    agent: string;
+    name: string;
+    status: InstallAllStatus;
+    path?: string;
+    error?: string;
+}
+export declare function installAllDetectedHooks(home?: string): Promise<InstallAllResult[]>;

package/dist/install.js

@@ -0,0 +1,68 @@
+import { access, mkdir, readFile, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { AGENTS, findAgent, hookConfigFullPath } from "./agents.js";
+export async function installHook(agentId, home = homedir()) {
+    const agent = findAgent(agentId);
+    if (!agent)
+        throw new Error(`Unknown agent '${agentId}'. Run 'beam agent list' to see supported agents.`);
+    if (!agent.hookConfigPath || !agent.mergeHookConfig)
+        throw new Error(`${agent.name} has no supported hook install path yet; see 'beam agent list' for its status.`);
+    const path = hookConfigFullPath(agent, home);
+    const command = `beam hook ${agent.id}`;
+    let existing = {};
+    let raw = "";
+    try {
+        raw = await readFile(path, "utf8");
+        existing = raw.trim() ? JSON.parse(raw) : {};
+    }
+    catch (e) {
+        if (e.code !== "ENOENT") {
+            if (e instanceof SyntaxError)
+                throw new Error(`${path} contains invalid JSON; fix or remove it before installing.`);
+            throw e;
+        }
+    }
+    const merged = agent.mergeHookConfig(existing, command);
+    const alreadyInstalled = JSON.stringify(merged) === JSON.stringify(existing) && raw.trim() !== "";
+    if (!alreadyInstalled) {
+        await mkdir(dirname(path), { recursive: true });
+        await writeFile(path, `${JSON.stringify(merged, null, 2)}\n`);
+    }
+    return { agent: agent.id, path, alreadyInstalled };
+}
+async function isDetected(agent, home) {
+    for (const relativePath of agent.configs) {
+        try {
+            await access(join(home, relativePath));
+            return true;
+        }
+        catch { /* check the next path */ }
+    }
+    return false;
+}
+// Detects which agents are actually present on this machine (via agents.ts's real, non-circular
+// config-presence signals — never the hook file beam itself would write) and installs beam's
+// hook into every one that's both detected and supported, skipping the rest without erroring.
+export async function installAllDetectedHooks(home = homedir()) {
+    const results = [];
+    for (const agent of AGENTS) {
+        if (!(await isDetected(agent, home))) {
+            results.push({ agent: agent.id, name: agent.name, status: "not-detected" });
+            continue;
+        }
+        if (!agent.hookConfigPath || !agent.mergeHookConfig) {
+            results.push({ agent: agent.id, name: agent.name, status: "not-supported" });
+            continue;
+        }
+        try {
+            const result = await installHook(agent.id, home);
+            results.push({ agent: agent.id, name: agent.name, status: result.alreadyInstalled ? "already-installed" : "installed", path: result.path });
+        }
+        catch (e) {
+            results.push({ agent: agent.id, name: agent.name, status: "error", error: e instanceof Error ? e.message : String(e) });
+        }
+    }
+    return results;
+}
+//# sourceMappingURL=install.js.map

package/dist/install.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"install.js","sourceRoot":"","sources":["../src/install.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,kBAAkB,EAAkC,MAAM,aAAa,CAAC;AAIpG,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAe,EAAE,IAAI,GAAG,OAAO,EAAE;IACjE,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,OAAO,mDAAmD,CAAC,CAAC;IAC1G,IAAI,CAAC,KAAK,CAAC,cAAc,IAAI,CAAC,KAAK,CAAC,eAAe;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,IAAI,gFAAgF,CAAC,CAAC;IAEpK,MAAM,IAAI,GAAG,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,aAAa,KAAK,CAAC,EAAE,EAAE,CAAC;IAExC,IAAI,QAAQ,GAAQ,EAAE,CAAC;IACvB,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,CAAC;QAAC,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAAC,QAAQ,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IAAC,CAAC;IAChG,OAAO,CAAC,EAAE,CAAC;QACT,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACnD,IAAI,CAAC,YAAY,WAAW;gBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,6DAA6D,CAAC,CAAC;YACpH,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,CAAC,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACxD,MAAM,gBAAgB,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;IAElG,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAChE,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;AACrD,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,KAAsB,EAAE,IAAY;IAC5D,KAAK,MAAM,YAAY,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACzC,IAAI,CAAC;YAAC,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,yBAAyB,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAKD,gGAAgG;AAChG,6FAA6F;AAC7F,8FAA8F;AAC9F,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,IAAI,GAAG,OAAO,EAAE;IAC5D,MAAM,OAAO,GAAuB,EAAE,CAAC;IACvC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QAChI,IAAI,CAAC,KAAK,CAAC,cAAc,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QAChJ,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YACjD,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9I,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC1H,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/inventory.d.ts

@@ -0,0 +1,12 @@
+import type { Event } from "./core.js";
+export declare function inventory(events: Event[], home?: string): Promise<{
+    agent: string;
+    name: string;
+    configPresent: boolean;
+    artifactsPresent: boolean;
+    captureStatus: string;
+    lastReceived: string | null;
+    hookInstallable: boolean;
+    payloadVerified: boolean;
+    integration: string;
+}[]>;

package/dist/inventory.js

@@ -0,0 +1,23 @@
+import { access } from "node:fs/promises";
+import { join } from "node:path";
+import { homedir } from "node:os";
+import { AGENTS } from "./agents.js";
+export async function inventory(events, home = homedir()) {
+    const exists = async (paths) => (await Promise.all(paths.map(async (p) => { try {
+        await access(join(home, p));
+        return true;
+    }
+    catch {
+        return false;
+    } }))).some(Boolean);
+    return Promise.all(AGENTS.map(async (d) => {
+        const matches = events.filter(e => e.agent === d.id || e.agent === d.id.replace("-code", "").replace("-cli", ""));
+        const last = matches.reduce((value, e) => !value || e.receivedAt > value ? e.receivedAt : value, null);
+        return {
+            agent: d.id, name: d.name, configPresent: await exists(d.configs), artifactsPresent: await exists(d.artifacts),
+            captureStatus: last ? "records received" : "not verified", lastReceived: last,
+            hookInstallable: Boolean(d.hookConfigPath), payloadVerified: d.verifiedPayload, integration: d.notes,
+        };
+    }));
+}
+//# sourceMappingURL=inventory.js.map

package/dist/inventory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inventory.js","sourceRoot":"","sources":["../src/inventory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAElC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,MAAe,EAAE,IAAI,GAAG,OAAO,EAAE;IAC/D,MAAM,MAAM,GAAG,KAAK,EAAE,KAAe,EAAE,EAAE,CAAC,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAC,CAAC,EAAC,EAAE,GAAG,IAAI,CAAC;QAAC,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACjL,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAC,CAAC,EAAC,EAAE;QACtC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;QAClH,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAgB,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACtH,OAAO;YACL,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,gBAAgB,EAAE,MAAM,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;YAC9G,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,cAAc,EAAE,YAAY,EAAE,IAAI;YAC7E,eAAe,EAAE,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,eAAe,EAAE,WAAW,EAAE,CAAC,CAAC,KAAK;SACrG,CAAC;IACJ,CAAC,CAAC,CAAC,CAAC;AACN,CAAC"}

package/dist/open-browser.d.ts

@@ -0,0 +1 @@
+export declare function openBrowser(url: string): void;

package/dist/open-browser.js

@@ -0,0 +1,8 @@
+import { spawn } from "node:child_process";
+export function openBrowser(url) {
+    const platform = process.platform;
+    const command = platform === "darwin" ? "open" : platform === "win32" ? "start" : "xdg-open";
+    const args = platform === "win32" ? ["", url] : [url];
+    spawn(command, args, { detached: true, stdio: "ignore", shell: platform === "win32" }).unref();
+}
+//# sourceMappingURL=open-browser.js.map

package/dist/open-browser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"open-browser.js","sourceRoot":"","sources":["../src/open-browser.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE3C,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAClC,MAAM,OAAO,GAAG,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;IAC7F,MAAM,IAAI,GAAG,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACtD,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,KAAK,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;AACjG,CAAC"}

package/dist/os-monitor.d.ts

@@ -0,0 +1,5 @@
+import { type Event } from "./core.js";
+export interface OsMonitorHandle {
+    stop: () => void;
+}
+export declare function startOsMonitor(sink: (events: Event[]) => void | Promise<void>): Promise<OsMonitorHandle>;

package/dist/os-monitor.js

@@ -0,0 +1,26 @@
+// Enterprise plugin loader. OS-level observation of AI agent activity (watching `ps`/`lsof` for
+// process starts/exits, independent of any agent's own hook cooperation) is NOT part of this
+// open-source repo -- that detection logic (os-detect.ts, os-process.ts, os-network.ts, and the
+// monitor loop itself) lives in the private `beam-enterprise` package.
+//
+// This file just tries to load that package at runtime. If it isn't installed -- the normal case
+// for OSS users, since it's a private/paid npm package -- startOsMonitor() is a silent no-op:
+// `beam start` works exactly the same without it, just without OS-level rows. See
+// beam-enterprise/README.md for the plugin contract this depends on.
+import { normalize } from "./core.js";
+// Not a string literal type on purpose: a literal specifier makes TypeScript try to resolve the
+// module at compile time and fail typecheck for every OSS dev/CI run that (correctly) doesn't
+// have this private package installed. Widening to `string` makes it a genuine runtime-only
+// dynamic import.
+const ENTERPRISE_PACKAGE = "beam-enterprise";
+export async function startOsMonitor(sink) {
+    let plugin;
+    try {
+        plugin = (await import(ENTERPRISE_PACKAGE));
+    }
+    catch {
+        return { stop: () => { } };
+    }
+    return plugin.startOsMonitor(async (records) => { await sink(records.map(normalize)); });
+}
+//# sourceMappingURL=os-monitor.js.map

package/dist/os-monitor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"os-monitor.js","sourceRoot":"","sources":["../src/os-monitor.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,6FAA6F;AAC7F,gGAAgG;AAChG,uEAAuE;AACvE,EAAE;AACF,iGAAiG;AACjG,8FAA8F;AAC9F,kFAAkF;AAClF,qEAAqE;AACrE,OAAO,EAAE,SAAS,EAAc,MAAM,WAAW,CAAC;AAQlD,gGAAgG;AAChG,8FAA8F;AAC9F,4FAA4F;AAC5F,kBAAkB;AAClB,MAAM,kBAAkB,GAAW,iBAAiB,CAAC;AAErD,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAA+C;IAClF,IAAI,MAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAqB,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,CAAC;IAC5B,CAAC;IACD,OAAO,MAAM,CAAC,cAAc,CAAC,KAAK,EAAC,OAAO,EAAC,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACzF,CAAC"}

package/dist/policy.d.ts

@@ -0,0 +1,27 @@
+export type PolicyMode = "observe" | "advisory" | "enforce";
+export interface PolicyRules {
+    mode: PolicyMode;
+    blockedTools: string[];
+    blockedCommandPatterns: string[];
+    disabledAgents: string[];
+}
+export interface PolicyBundle {
+    version: number;
+    rules: PolicyRules;
+    notAfter: string | null;
+}
+export declare function policyPath(): string;
+export declare function readPolicy(): Promise<PolicyBundle | null>;
+export type DecisionAction = "allow" | "warn" | "deny";
+export interface Decision {
+    action: DecisionAction;
+    reason?: string;
+    mode: PolicyMode;
+    policyVersion: number;
+}
+export interface ActionContext {
+    agent: string;
+    tool: string;
+    command: string;
+}
+export declare function evaluate(bundle: PolicyBundle | null, ctx: ActionContext): Decision;

package/dist/policy.js

@@ -0,0 +1,59 @@
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { getDataDirectory } from "./config.js";
+const EMPTY = { mode: "observe", blockedTools: [], blockedCommandPatterns: [], disabledAgents: [] };
+export function policyPath() {
+    return join(getDataDirectory(), "policy.json");
+}
+export async function readPolicy() {
+    try {
+        const parsed = JSON.parse(await readFile(policyPath(), "utf8"));
+        if (!parsed.rules)
+            return null;
+        return {
+            version: typeof parsed.version === "number" ? parsed.version : 0,
+            notAfter: parsed.notAfter ?? null,
+            rules: { ...EMPTY, ...parsed.rules },
+        };
+    }
+    catch {
+        return null;
+    }
+}
+// Evaluate a proposed action. No policy, observe mode, or an expired bundle => allow.
+export function evaluate(bundle, ctx) {
+    if (!bundle)
+        return { action: "allow", mode: "observe", policyVersion: 0 };
+    const { rules, version } = bundle;
+    const base = { mode: rules.mode, policyVersion: version };
+    if (rules.mode === "observe")
+        return { action: "allow", ...base };
+    // Stale cached policy: fail open rather than trap the user offline.
+    if (bundle.notAfter && Date.parse(bundle.notAfter) < Date.now())
+        return { action: "allow", ...base };
+    const hit = (reason) => ({
+        action: rules.mode === "enforce" ? "deny" : "warn",
+        reason,
+        ...base,
+    });
+    if (rules.disabledAgents.some((a) => a.toLowerCase() === ctx.agent.toLowerCase())) {
+        return hit(`${ctx.agent} is disabled for your account by workspace policy.`);
+    }
+    if (ctx.tool && rules.blockedTools.some((t) => t.toLowerCase() === ctx.tool.toLowerCase())) {
+        return hit(`The ${ctx.tool} tool is blocked by workspace policy.`);
+    }
+    for (const pattern of rules.blockedCommandPatterns) {
+        if (!ctx.command)
+            break;
+        try {
+            if (new RegExp(pattern, "i").test(ctx.command)) {
+                return hit(`This command matches a blocked pattern: /${pattern}/`);
+            }
+        }
+        catch {
+            /* ignore an unparseable pattern */
+        }
+    }
+    return { action: "allow", ...base };
+}
+//# sourceMappingURL=policy.js.map