@agent-beam/beam 0.2.18 → 0.2.21

package/dist/tamper.js

@@ -0,0 +1,116 @@
+// Tamper detection: beam's hook install/service can be removed two ways -- through beam itself
+// ('beam uninstall', 'beam agent install-all', ...), which is authorized and already tells the
+// workspace via revokeDevice()/reportControlEvent() below, or by hand (editing an agent's config
+// file directly, deleting it, unloading the launchd/systemd job) -- which today leaves no record
+// anywhere. This module gives the collector a baseline of what *should* be installed and reports
+// the difference as a critical finding the moment it notices something vanished outside beam's
+// own code path. It cannot detect the collector process itself being killed -- a dead process
+// can't self-report -- that has to be inferred workspace-side from a heartbeat/last-seen gap;
+// this module only covers "the collector is still alive but something under it was tampered with."
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { homedir, hostname } from "node:os";
+import { dirname, join } from "node:path";
+import { getDataDirectory } from "./config.js";
+import { findAgent } from "./agents.js";
+import { installedHookAgentIds } from "./install.js";
+import { normalize } from "./core.js";
+import { forwardEvents } from "./forward.js";
+function tamperStatePath() {
+    return join(getDataDirectory(), "tamper-state.json");
+}
+export async function readTamperState() {
+    try {
+        return JSON.parse(await readFile(tamperStatePath(), "utf8"));
+    }
+    catch {
+        return null;
+    }
+}
+async function writeTamperState(state) {
+    const path = tamperStatePath();
+    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+    await writeFile(path, `${JSON.stringify(state, null, 2)}\n`, { mode: 0o600 });
+}
+// Snapshots which agents currently have beam's hook installed and remembers it as the expected
+// baseline. Call this right after any *authorized* change to hook state (installHook,
+// uninstallHook, installAllDetectedHooks, uninstallAllHooks, and every 'beam start') so the
+// baseline always reflects the last state a beam command itself produced. checkForTampering()
+// below then only flags a gap between that baseline and reality -- i.e. a change nobody made
+// through beam.
+export async function recordExpectedHooks(home = homedir()) {
+    const expectedHooks = await installedHookAgentIds(home);
+    await writeTamperState({ expectedHooks, updatedAt: new Date().toISOString() });
+}
+function selfMonitorRecord(fields, severity) {
+    return {
+        record_type: "finding",
+        source_agent: "beam",
+        source_type: "self-monitor",
+        severity,
+        hostname: hostname(),
+        timestamp: new Date().toISOString(),
+        ...fields,
+    };
+}
+function tamperFindingRecord(agentId) {
+    const name = findAgent(agentId)?.name ?? agentId;
+    return selfMonitorRecord({
+        event_type: "beam.tamper",
+        rule_id: "beam.tamper.hook_removed",
+        title: `Beam monitoring hook removed from ${name}`,
+        summary: `${name}'s beam hook disappeared from its config on ${hostname()} outside of any 'beam uninstall' or 'beam agent' command. This agent is no longer being observed or policy-enforced by beam.`,
+    }, "critical");
+}
+// Compares the live on-disk hook set against the last known-good baseline and returns one
+// critical finding Event per hook that vanished without going through beam. The caller (serve.ts)
+// stores these locally and forwards them to the workspace exactly like any other captured event,
+// so they land on the dashboard's existing Activity/Security risks views with no new backend
+// route required. Never throws -- a failure here must not take down the collector's poll loop.
+export async function checkForTampering(home = homedir()) {
+    try {
+        const state = await readTamperState();
+        const current = await installedHookAgentIds(home);
+        if (!state) {
+            await recordExpectedHooks(home);
+            return [];
+        }
+        const missing = state.expectedHooks.filter(id => !current.includes(id));
+        const changed = missing.length > 0
+            || current.length !== state.expectedHooks.length
+            || current.some(id => !state.expectedHooks.includes(id));
+        if (changed)
+            await writeTamperState({ expectedHooks: current, updatedAt: new Date().toISOString() });
+        if (!missing.length)
+            return [];
+        const events = [];
+        for (const agentId of missing) {
+            try {
+                events.push(normalize(tamperFindingRecord(agentId)));
+            }
+            catch { /* skip a record normalize() can't accept */ }
+        }
+        return events;
+    }
+    catch {
+        return [];
+    }
+}
+// Explicit, non-tamper notice for an authorized stop/uninstall/logout, so the dashboard can tell
+// "an admin or device owner deliberately turned this off" apart from the silent disappearance
+// checkForTampering() exists to catch. Sent directly (not through the local collector, which may
+// already be shutting down as part of the same command) using whatever identity is still on disk
+// at the moment the caller invokes this -- callers must call it *before* clearing that identity.
+// Best-effort: never blocks the command that calls it.
+export async function reportControlEvent(ruleSuffix, title, detail) {
+    try {
+        const event = normalize(selfMonitorRecord({
+            event_type: "beam.control",
+            rule_id: `beam.control.${ruleSuffix}`,
+            title,
+            summary: detail,
+        }, "info"));
+        await forwardEvents(event);
+    }
+    catch { /* best-effort only */ }
+}
+//# sourceMappingURL=tamper.js.map

package/dist/tamper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tamper.js","sourceRoot":"","sources":["../src/tamper.ts"],"names":[],"mappings":"AAAA,+FAA+F;AAC/F,+FAA+F;AAC/F,iGAAiG;AACjG,iGAAiG;AACjG,iGAAiG;AACjG,+FAA+F;AAC/F,8FAA8F;AAC9F,8FAA8F;AAC9F,mGAAmG;AACnG,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,SAAS,EAA6B,MAAM,WAAW,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAI7C,SAAS,eAAe;IACtB,OAAO,IAAI,CAAC,gBAAgB,EAAE,EAAE,mBAAmB,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,IAAI,CAAC;QAAC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,eAAe,EAAE,EAAE,MAAM,CAAC,CAAgB,CAAC;IAAC,CAAC;IACpF,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AACxB,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,KAAkB;IAChD,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7D,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAChF,CAAC;AAED,+FAA+F;AAC/F,sFAAsF;AACtF,4FAA4F;AAC5F,8FAA8F;AAC9F,6FAA6F;AAC7F,gBAAgB;AAChB,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAI,GAAG,OAAO,EAAE;IACxD,MAAM,aAAa,GAAG,MAAM,qBAAqB,CAAC,IAAI,CAAC,CAAC;IACxD,MAAM,gBAAgB,CAAC,EAAE,aAAa,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,iBAAiB,CAAC,MAA+B,EAAE,QAAkB;IAC5E,OAAO;QACL,WAAW,EAAE,SAAS;QACtB,YAAY,EAAE,MAAM;QACpB,WAAW,EAAE,cAAc;QAC3B,QAAQ;QACR,QAAQ,EAAE,QAAQ,EAAE;QACpB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,GAAG,MAAM;KACV,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAe;IAC1C,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,EAAE,IAAI,IAAI,OAAO,CAAC;IACjD,OAAO,iBAAiB,CAAC;QACvB,UAAU,EAAE,aAAa;QACzB,OAAO,EAAE,0BAA0B;QACnC,KAAK,EAAE,qCAAqC,IAAI,EAAE;QAClD,OAAO,EAAE,GAAG,IAAI,+CAA+C,QAAQ,EAAE,8HAA8H;KACxM,EAAE,UAAU,CAAC,CAAC;AACjB,CAAC;AAED,0FAA0F;AAC1F,kGAAkG;AAClG,iGAAiG;AACjG,6FAA6F;AAC7F,+FAA+F;AAC/F,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAI,GAAG,OAAO,EAAE;IACtD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,CAAC,KAAK,EAAE,CAAC;YAAC,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;YAAC,OAAO,EAAE,CAAC;QAAC,CAAC;QAE3D,MAAM,OAAO,GAAG,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;QACxE,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC;eAC7B,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC,aAAa,CAAC,MAAM;eAC7C,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3D,IAAI,OAAO;YAAE,MAAM,gBAAgB,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACrG,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,OAAO,EAAE,CAAC;QAE/B,MAAM,MAAM,GAAY,EAAE,CAAC;QAC3B,KAAK,MAAM,OAAO,IAAI,OAAO,EAAE,CAAC;YAC9B,IAAI,CAAC;gBAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,4CAA4C,CAAC,CAAC;QACtH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,iGAAiG;AACjG,8FAA8F;AAC9F,iGAAiG;AACjG,iGAAiG;AACjG,iGAAiG;AACjG,uDAAuD;AACvD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,UAAkB,EAAE,KAAa,EAAE,MAAc;IACxF,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,SAAS,CAAC,iBAAiB,CAAC;YACxC,UAAU,EAAE,cAAc;YAC1B,OAAO,EAAE,gBAAgB,UAAU,EAAE;YACrC,KAAK;YACL,OAAO,EAAE,MAAM;SAChB,EAAE,MAAM,CAAC,CAAC,CAAC;QACZ,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC;AACpC,CAAC"}

package/dist/trusted-paths.d.ts

@@ -0,0 +1,5 @@
+export declare function trustedPathsFile(): string;
+export declare function readTrustedPaths(): Promise<string[]>;
+export declare function addTrustedPath(path: string): Promise<string[]>;
+export declare function removeTrustedPath(path: string): Promise<string[]>;
+export declare function isPathTrusted(candidate: string, trusted: string[]): boolean;

package/dist/trusted-paths.js

@@ -0,0 +1,59 @@
+import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { isAbsolute, join, relative, resolve } from "node:path";
+import { getDataDirectory } from "./config.js";
+// A global, human-maintained allowlist of outside-workspace paths/globs that should stop
+// triggering Beam's "This action accesses a path outside the current workspace" ask. Lives
+// under the data directory -- the same directory isBeamSelfProtectionTarget() already protects
+// from agent writes -- so only a human running `beam trust` from a real shell can add to it, not
+// an agent trying to approve its own escape.
+export function trustedPathsFile() { return join(getDataDirectory(), "trusted-paths.json"); }
+export async function readTrustedPaths() {
+    try {
+        const parsed = JSON.parse(await readFile(trustedPathsFile(), "utf8"));
+        return Array.isArray(parsed) ? parsed.filter((p) => typeof p === "string" && p.trim().length > 0) : [];
+    }
+    catch (e) {
+        if (e.code === "ENOENT")
+            return [];
+        return [];
+    }
+}
+async function writeTrustedPaths(paths) {
+    const dir = getDataDirectory();
+    await mkdir(dir, { recursive: true, mode: 0o700 });
+    const file = trustedPathsFile();
+    const temp = `${file}.tmp`;
+    await writeFile(temp, JSON.stringify(paths, null, 2) + "\n", { mode: 0o600 });
+    await rename(temp, file);
+}
+export async function addTrustedPath(path) {
+    const resolved = resolve(path);
+    const current = await readTrustedPaths();
+    if (current.includes(resolved))
+        return current;
+    const next = [...current, resolved];
+    await writeTrustedPaths(next);
+    return next;
+}
+export async function removeTrustedPath(path) {
+    const resolved = resolve(path);
+    const next = (await readTrustedPaths()).filter(p => p !== resolved);
+    await writeTrustedPaths(next);
+    return next;
+}
+// A candidate path is trusted if it equals a trusted entry or sits under one (directory trust).
+// Entries may also be globs (containing `*`) matched against the candidate.
+export function isPathTrusted(candidate, trusted) {
+    const target = resolve(candidate);
+    return trusted.some(entry => {
+        if (entry.includes("*")) {
+            const escaped = entry.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*\*/g, "§§").replace(/\*/g, "[^/]*").replace(/§§/g, ".*");
+            return new RegExp(`^${escaped}$`).test(target);
+        }
+        if (target === entry)
+            return true;
+        const rel = relative(entry, target);
+        return rel !== "" && !rel.startsWith("..") && !isAbsolute(rel);
+    });
+}
+//# sourceMappingURL=trusted-paths.js.map

package/dist/trusted-paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trusted-paths.js","sourceRoot":"","sources":["../src/trusted-paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/C,yFAAyF;AACzF,2FAA2F;AAC3F,+FAA+F;AAC/F,iGAAiG;AACjG,6CAA6C;AAC7C,MAAM,UAAU,gBAAgB,KAAa,OAAO,IAAI,CAAC,gBAAgB,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC,CAAC;AAErG,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,gBAAgB,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;QACtE,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QAC9D,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,KAAe;IAC9C,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;IAC/B,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,gBAAgB,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,GAAG,IAAI,MAAM,CAAC;IAC3B,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9E,MAAM,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAY;IAC/C,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,OAAO,GAAG,MAAM,gBAAgB,EAAE,CAAC;IACzC,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,OAAO,CAAC;IAC/C,MAAM,IAAI,GAAG,CAAC,GAAG,OAAO,EAAE,QAAQ,CAAC,CAAC;IACpC,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC9B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAY;IAClD,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,CAAC,MAAM,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC;IACpE,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC9B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,gGAAgG;AAChG,4EAA4E;AAC5E,MAAM,UAAU,aAAa,CAAC,SAAiB,EAAE,OAAiB;IAChE,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAClC,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;QAC1B,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAC/H,OAAO,IAAI,MAAM,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,MAAM,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QAClC,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACpC,OAAO,GAAG,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/tty-prompt.d.ts

@@ -0,0 +1,5 @@
+export interface TtyChoice {
+    key: string;
+    label: string;
+}
+export declare function promptTty(message: string, choices: TtyChoice[]): Promise<string | null>;

package/dist/tty-prompt.js

@@ -0,0 +1,55 @@
+import { closeSync, createReadStream, createWriteStream, openSync } from "node:fs";
+import { createInterface } from "node:readline";
+const PROMPT_TIMEOUT_MS = 120_000;
+// Reads a choice directly from the controlling terminal (/dev/tty), bypassing stdin/stdout --
+// those carry the hook's JSON protocol with the host agent (Claude Code, Codex, ...) and must
+// never be touched here. Returns null -- "could not prompt" -- when there's no TTY attached
+// (a headless run, CI, a detached process) or the prompt times out; callers must have a safe
+// fallback for that case, never assume a choice was made.
+export async function promptTty(message, choices) {
+    if (process.platform === "win32")
+        return null;
+    try {
+        closeSync(openSync("/dev/tty", "r+"));
+    }
+    catch {
+        return null;
+    }
+    return new Promise(resolvePromise => {
+        let settled = false;
+        let input;
+        let output;
+        try {
+            input = createReadStream("/dev/tty");
+            output = createWriteStream("/dev/tty");
+        }
+        catch {
+            resolvePromise(null);
+            return;
+        }
+        const rl = createInterface({ input, output, terminal: true });
+        const finish = (value) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            rl.close();
+            input.destroy();
+            output.destroy();
+            resolvePromise(value);
+        };
+        const timer = setTimeout(() => finish(null), PROMPT_TIMEOUT_MS);
+        output.write(`\n${message}\n`);
+        for (const c of choices)
+            output.write(`  [${c.key}] ${c.label}\n`);
+        rl.question("Choice: ", answer => {
+            const normalized = answer.trim().toLowerCase();
+            const match = choices.find(c => c.key.toLowerCase() === normalized)
+                ?? (normalized.length > 0 ? choices.find(c => c.label.toLowerCase().startsWith(normalized)) : undefined);
+            finish(match ? match.key : null);
+        });
+        rl.on("error", () => finish(null));
+        input.on("error", () => finish(null));
+    });
+}
+//# sourceMappingURL=tty-prompt.js.map

package/dist/tty-prompt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tty-prompt.js","sourceRoot":"","sources":["../src/tty-prompt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnF,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAIhD,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAElC,8FAA8F;AAC9F,8FAA8F;AAC9F,4FAA4F;AAC5F,6FAA6F;AAC7F,0DAA0D;AAC1D,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAAe,EAAE,OAAoB;IACnE,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,CAAC;QAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IAErE,OAAO,IAAI,OAAO,CAAC,cAAc,CAAC,EAAE;QAClC,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,KAA0C,CAAC;QAC/C,IAAI,MAA4C,CAAC;QACjD,IAAI,CAAC;YACH,KAAK,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;YACrC,MAAM,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,cAAc,CAAC,IAAI,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QACD,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,CAAC,KAAoB,EAAE,EAAE;YACtC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,CAAC,OAAO,EAAE,CAAC;YAChB,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,cAAc,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,iBAAiB,CAAC,CAAC;QAChE,MAAM,CAAC,KAAK,CAAC,KAAK,OAAO,IAAI,CAAC,CAAC;QAC/B,KAAK,MAAM,CAAC,IAAI,OAAO;YAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QACnE,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE;YAC/B,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAC/C,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC;mBAC9D,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC3G,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;QACH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACnC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/update.d.ts

@@ -0,0 +1,7 @@
+export interface UpdateCheck {
+    current: string;
+    latest: string;
+    upToDate: boolean;
+}
+export declare function checkForUpdate(current: string): Promise<UpdateCheck>;
+export declare function installUpdate(version: string): Promise<void>;

package/dist/update.js

@@ -0,0 +1,31 @@
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { runWithSudoFallback } from "./elevate.js";
+const run = promisify(execFile);
+const PACKAGE = "@agent-beam/beam";
+// Plain numeric semver compare (major.minor.patch, ignoring any prerelease suffix) -- good
+// enough for comparing against npm's published "latest" dist-tag. Returns >0 when `a` is newer.
+function compareVersions(a, b) {
+    const pa = a.split(/[.-]/).map(n => Number(n) || 0);
+    const pb = b.split(/[.-]/).map(n => Number(n) || 0);
+    for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+        const diff = (pa[i] ?? 0) - (pb[i] ?? 0);
+        if (diff !== 0)
+            return diff;
+    }
+    return 0;
+}
+export async function checkForUpdate(current) {
+    const { stdout } = await run("npm", ["view", PACKAGE, "version"], { timeout: 15_000 });
+    const latest = stdout.trim();
+    // Not just !==: a locally-run, unreleased build can be ahead of what's published -- that's
+    // "up to date" too, not something to offer downgrading.
+    return { current, latest, upToDate: compareVersions(latest, current) <= 0 };
+}
+// Installs the latest published version globally, falling back to sudo the same way
+// enterprise-install.ts and 'beam uninstall' do when the global node_modules isn't
+// user-writable (e.g. a system Node install).
+export async function installUpdate(version) {
+    await runWithSudoFallback("npm", ["install", "-g", `${PACKAGE}@${version}`], { timeout: 120_000 });
+}
+//# sourceMappingURL=update.js.map

package/dist/update.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"update.js","sourceRoot":"","sources":["../src/update.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAEnD,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAChC,MAAM,OAAO,GAAG,kBAAkB,CAAC;AAInC,2FAA2F;AAC3F,gGAAgG;AAChG,SAAS,eAAe,CAAC,CAAS,EAAE,CAAS;IAC3C,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACpD,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACpD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACxD,MAAM,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACzC,IAAI,IAAI,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;IAC9B,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAe;IAClD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IACvF,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC7B,2FAA2F;IAC3F,wDAAwD;IACxD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;AAC9E,CAAC;AAED,oFAAoF;AACpF,mFAAmF;AACnF,8CAA8C;AAC9C,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAe;IACjD,MAAM,mBAAmB,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,OAAO,IAAI,OAAO,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;AACrG,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-beam/beam",
-  "version": "0.2.18",
+  "version": "0.2.21",
   "description": "Local-first observation and heuristic risk scanning for AI coding agents (Claude Code, Codex, Cursor, Copilot CLI, Gemini). Redacts secrets, flags risky tool calls, scans skills and MCP configs offline.",
   "keywords": [
     "ai agent security",
@@ -39,9 +39,15 @@
     "dist",
     "Skills"
   ],
+  "pkg": {
+    "assets": [
+      "package.json"
+    ]
+  },
   "scripts": {
     "build": "tsc -p tsconfig.json && chmod +x dist/cli.js",
     "build:watch": "tsc -p tsconfig.json --watch --preserveWatchOutput",
+    "build:binaries": "npm run build && node scripts/build-binaries.mjs",
     "dev": "tsx src/cli.ts",
     "test": "node --no-warnings --experimental-vm-modules node_modules/jest/bin/jest.js --runInBand",
     "test:watch": "node --no-warnings --experimental-vm-modules node_modules/jest/bin/jest.js --watch",
@@ -63,6 +69,7 @@
   "devDependencies": {
     "@types/jest": "^30.0.0",
     "@types/node": "^22.20.2",
+    "@yao-pkg/pkg": "^6.22.0",
     "jest": "^30.2.0",
     "ts-jest": "^29.4.5",
     "tsx": "^4.19.2",