@agent-beam/beam 0.2.20 → 0.2.22

package/README.md

@@ -2,6 +2,25 @@
 
 AgentBeam is a local security layer for AI agents. `beam` is the AgentBeam CLI. It installs hooks for the agents detected on your machine, captures agent and MCP activity, applies your AgentBeam policy locally, and sends approved telemetry to the AgentBeam dashboard.
 
+## WipeBench: coding agent safety benchmark
+
+[WipeBench](https://github.com/whyashthakker/WipeBench) gives coding agents an
+objective, captures the commands they choose, and evaluates task completion and
+harmful effects in Docker. A benchmark by [AgentBeam](https://agentbeam.com), in
+collaboration with [ExplainX.ai](https://explainx.ai).
+
+The [local snapshot](safety-bench/README.md) includes 112 scored scenarios across
+12 categories and a no-key smoke test:
+
+```sh
+python3 safety-bench/bench.py selftest --scenarios smoke-hello
+```
+
+Requires Python 3.11+ and a running Docker daemon. Scripted self-tests validate
+the harness; they are not model rankings. The benchmark snapshot uses its own
+[Apache-2.0 license](safety-bench/LICENSE). See the
+[benchmark page](https://agentbeam.com/benchmarks/wipebench) for scope and usage.
+
 ## Install and setup
 
 ```bash

package/dist/account.js

@@ -21,7 +21,7 @@ export async function fetchAccount(identity) {
         }
         catch { /* keep the status-only message */ }
         if (response.status === 401)
-            message = "This device's credentials were revoked. Run 'beam enroll' or 'beam connect' again.";
+            message = "This device's credentials were revoked. Run 'beam setup' again.";
         throw new Error(message);
     }
     return (await response.json());

package/dist/account.js.map

@@ -1 +1 @@
-{"version":3,"file":"account.js","sourceRoot":"","sources":["../src/account.ts"],"names":[],"mappings":"AAQA,+FAA+F;AAC/F,4FAA4F;AAC5F,yDAAyD;AACzD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAkB;IACnD,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,QAAQ,CAAC,OAAO,aAAa,EAAE;YACvD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,QAAQ,CAAC,YAAY,EAAE,EAAE;YAC7D,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,mBAAmB,QAAQ,CAAC,OAAO,GAAG,CAAC,CAAC;IAC1D,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,IAAI,OAAO,GAAG,oCAAoC,QAAQ,CAAC,MAAM,IAAI,CAAC;QACtE,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAuB,CAAC;YAC3D,IAAI,IAAI,CAAC,KAAK;gBAAE,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC,CAAC,kCAAkC,CAAC,CAAC;QAC9C,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,GAAG,oFAAoF,CAAC;QAC5H,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;IAED,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAY,CAAC;AAC5C,CAAC;AAED,+FAA+F;AAC/F,gGAAgG;AAChG,gGAAgG;AAChG,uEAAuE;AACvE,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAkB;IACnD,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,QAAQ,CAAC,OAAO,YAAY,EAAE;YACtD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,QAAQ,CAAC,YAAY,EAAE,EAAE;YAC7D,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,mBAAmB,QAAQ,CAAC,OAAO,GAAG,CAAC,CAAC;IAC1D,CAAC;IAED,6EAA6E;IAC7E,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO;IAEpC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,IAAI,OAAO,GAAG,iCAAiC,QAAQ,CAAC,MAAM,IAAI,CAAC;QACnE,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAuB,CAAC;YAC3D,IAAI,IAAI,CAAC,KAAK;gBAAE,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC,CAAC,kCAAkC,CAAC,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC"}
+{"version":3,"file":"account.js","sourceRoot":"","sources":["../src/account.ts"],"names":[],"mappings":"AAQA,+FAA+F;AAC/F,4FAA4F;AAC5F,yDAAyD;AACzD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAkB;IACnD,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,QAAQ,CAAC,OAAO,aAAa,EAAE;YACvD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,QAAQ,CAAC,YAAY,EAAE,EAAE;YAC7D,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,mBAAmB,QAAQ,CAAC,OAAO,GAAG,CAAC,CAAC;IAC1D,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,IAAI,OAAO,GAAG,oCAAoC,QAAQ,CAAC,MAAM,IAAI,CAAC;QACtE,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAuB,CAAC;YAC3D,IAAI,IAAI,CAAC,KAAK;gBAAE,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC,CAAC,kCAAkC,CAAC,CAAC;QAC9C,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,GAAG,iEAAiE,CAAC;QACzG,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;IAED,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAY,CAAC;AAC5C,CAAC;AAED,+FAA+F;AAC/F,gGAAgG;AAChG,gGAAgG;AAChG,uEAAuE;AACvE,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAkB;IACnD,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,QAAQ,CAAC,OAAO,YAAY,EAAE;YACtD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,QAAQ,CAAC,YAAY,EAAE,EAAE;YAC7D,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,mBAAmB,QAAQ,CAAC,OAAO,GAAG,CAAC,CAAC;IAC1D,CAAC;IAED,6EAA6E;IAC7E,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO;IAEpC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,IAAI,OAAO,GAAG,iCAAiC,QAAQ,CAAC,MAAM,IAAI,CAAC;QACnE,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAuB,CAAC;YAC3D,IAAI,IAAI,CAAC,KAAK;gBAAE,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC,CAAC,kCAAkC,CAAC,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC"}

package/dist/agents.d.ts

@@ -19,9 +19,15 @@ export interface AgentDefinition {
     /**
      * Reverse of mergeHookConfig — strips beam's hook entry back out, leaving any other hooks the
      * agent or the user configured untouched. Must be idempotent — safe to call on a config that
-     * never had beam installed (a no-op).
+     * never had beam installed (a no-op). Takes a predicate rather than an exact command string:
+     * a hook's command embeds the absolute path to whichever beam install wrote it (see
+     * resolveHookCommand in install.ts), which differs between a global npm install, a local dev
+     * checkout, or the same install after 'beam update' changes its resolved path. An uninstall
+     * running from a *different* beam install than the one that wrote the entry must still
+     * recognize and remove it -- matching only one exact string silently leaves it in place (and
+     * beam fully monitoring/enforcing) instead. See isOwnHookCommand in install.ts.
      */
-    unmergeHookConfig: ((existing: Obj, command: string) => Obj) | null;
+    unmergeHookConfig: ((existing: Obj, isOwnCommand: (command: string) => boolean) => Obj) | null;
     /** Payload adapter id used by src/hook-adapters.ts to normalize this agent's stdin JSON. */
     adapter: "passthrough" | "copilot-camel" | "generic" | "gemini";
     /** Whether the AGENT ITSELF (not just this entry's payload verification) is unverified — the

package/dist/agents.js

@@ -43,33 +43,33 @@ function mergeCopilotHooks(event) {
 // Reverse of mergeClaudeStyleHooks: drops beam's command out of each entry's inner hooks array
 // (rather than the whole entry), so a user-added hook sharing the same matcher is left alone.
 function unmergeClaudeStyleHooks(event) {
-    return (existing, command) => {
+    return (existing, isOwnCommand) => {
         const hooks = obj(existing.hooks);
         if (!(event in hooks))
             return existing;
         const list = arr(hooks[event]).map(obj)
-            .map(entry => ({ ...entry, hooks: arr(entry.hooks).map(obj).filter(h => h.command !== command) }))
+            .map(entry => ({ ...entry, hooks: arr(entry.hooks).map(obj).filter(h => !isOwnCommand(String(h.command ?? ""))) }))
             .filter(entry => arr(entry.hooks).length > 0);
         return { ...existing, hooks: { ...hooks, [event]: list } };
     };
 }
 // Reverse of mergeCursorHooks.
 function unmergeCursorHooks(event) {
-    return (existing, command) => {
+    return (existing, isOwnCommand) => {
         const hooks = obj(existing.hooks);
         if (!(event in hooks))
             return existing;
-        const list = arr(hooks[event]).map(obj).filter(entry => entry.command !== command);
+        const list = arr(hooks[event]).map(obj).filter(entry => !isOwnCommand(String(entry.command ?? "")));
         return { ...existing, hooks: { ...hooks, [event]: list } };
     };
 }
 // Reverse of mergeCopilotHooks.
 function unmergeCopilotHooks(event) {
-    return (existing, command) => {
+    return (existing, isOwnCommand) => {
         const hooks = obj(existing.hooks);
         if (!(event in hooks))
             return existing;
-        const list = arr(hooks[event]).map(obj).filter(entry => entry.bash !== command);
+        const list = arr(hooks[event]).map(obj).filter(entry => !isOwnCommand(String(entry.bash ?? "")));
         return { ...existing, hooks: { ...hooks, [event]: list } };
     };
 }
@@ -83,7 +83,7 @@ function mergeAll(mergers) {
     return (existing, command) => mergers.reduce((acc, merge) => merge(acc, command), existing);
 }
 function unmergeAll(unmergers) {
-    return (existing, command) => unmergers.reduce((acc, unmerge) => unmerge(acc, command), existing);
+    return (existing, isOwnCommand) => unmergers.reduce((acc, unmerge) => unmerge(acc, isOwnCommand), existing);
 }
 export const AGENTS = [
     {

package/dist/agents.js.map

@@ -1 +1 @@
-{"version":3,"file":"agents.js","sourceRoot":"","sources":["../src/agents.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAsCjC,SAAS,GAAG,CAAC,CAAU,IAAS,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACzG,SAAS,GAAG,CAAC,CAAU,IAAe,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAEzE,yFAAyF;AACzF,+FAA+F;AAC/F,yFAAyF;AACzF,gGAAgG;AAChG,iGAAiG;AACjG,6FAA6F;AAC7F,wDAAwD;AACxD,MAAM,mCAAmC,GAAG,IAAI,GAAG,CAAC,CAAC,kBAAkB,EAAE,aAAa,CAAC,CAAC,CAAC;AACzF,SAAS,qBAAqB,CAAC,KAAa;IAC1C,MAAM,eAAe,GAAG,CAAC,mCAAmC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACxE,OAAO,CAAC,QAAa,EAAE,OAAe,EAAO,EAAE;QAC7C,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC;QACxG,IAAI,CAAC,gBAAgB;YAAE,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;QACzH,OAAO,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;IAC7D,CAAC,CAAC;AACJ,CAAC;AAED,+FAA+F;AAC/F,SAAS,gBAAgB,CAAC,KAAa;IACrC,OAAO,CAAC,QAAa,EAAE,OAAe,EAAO,EAAE;QAC7C,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1F,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,IAAI,CAAC,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;IAC7F,CAAC,CAAC;AACJ,CAAC;AAED,0FAA0F;AAC1F,SAAS,iBAAiB,CAAC,KAAa;IACtC,OAAO,CAAC,QAAa,EAAE,OAAe,EAAO,EAAE;QAC7C,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/G,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,IAAI,CAAC,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;IAC7F,CAAC,CAAC;AACJ,CAAC;AAED,+FAA+F;AAC/F,8FAA8F;AAC9F,SAAS,uBAAuB,CAAC,KAAa;IAC5C,OAAO,CAAC,QAAa,EAAE,OAAe,EAAO,EAAE;QAC7C,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC;YAAE,OAAO,QAAQ,CAAC;QACvC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;aACpC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,EAAE,CAAC,CAAC;aACjG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAChD,OAAO,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;IAC7D,CAAC,CAAC;AACJ,CAAC;AAED,+BAA+B;AAC/B,SAAS,kBAAkB,CAAC,KAAa;IACvC,OAAO,CAAC,QAAa,EAAE,OAAe,EAAO,EAAE;QAC7C,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC;YAAE,OAAO,QAAQ,CAAC;QACvC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;QACnF,OAAO,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;IAC7D,CAAC,CAAC;AACJ,CAAC;AAED,gCAAgC;AAChC,SAAS,mBAAmB,CAAC,KAAa;IACxC,OAAO,CAAC,QAAa,EAAE,OAAe,EAAO,EAAE;QAC7C,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC;YAAE,OAAO,QAAQ,CAAC;QACvC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;QAChF,OAAO,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;IAC7D,CAAC,CAAC;AACJ,CAAC;AAED,+FAA+F;AAC/F,gGAAgG;AAChG,kGAAkG;AAClG,+FAA+F;AAC/F,iGAAiG;AACjG,4BAA4B;AAC5B,SAAS,QAAQ,CAAC,OAAuD;IACvE,OAAO,CAAC,QAAa,EAAE,OAAe,EAAO,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;AAChH,CAAC;AACD,SAAS,UAAU,CAAC,SAAyD;IAC3E,OAAO,CAAC,QAAa,EAAE,OAAe,EAAO,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;AACtH,CAAC;AAED,MAAM,CAAC,MAAM,MAAM,GAAsB;IACvC;QACE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,aAAa;QACtC,OAAO,EAAE,CAAC,uBAAuB,CAAC,EAAE,SAAS,EAAE,CAAC,kBAAkB,CAAC;QACnE,cAAc,EAAE,uBAAuB,EAAE,aAAa,EAAE,YAAY;QACpE,eAAe,EAAE,QAAQ,CAAC,CAAC,qBAAqB,CAAC,YAAY,CAAC,EAAE,qBAAqB,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC3G,iBAAiB,EAAE,UAAU,CAAC,CAAC,uBAAuB,CAAC,YAAY,CAAC,EAAE,uBAAuB,CAAC,kBAAkB,CAAC,CAAC,CAAC;QACnH,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,IAAI;QAC7C,KAAK,EAAE,wRAAwR;KAChS;IACD;QACE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO;QAC1B,OAAO,EAAE,CAAC,oBAAoB,CAAC,EAAE,SAAS,EAAE,CAAC,iBAAiB,EAAE,0BAA0B,CAAC;QAC3F,cAAc,EAAE,mBAAmB,EAAE,aAAa,EAAE,YAAY;QAChE,eAAe,EAAE,QAAQ,CAAC,CAAC,qBAAqB,CAAC,YAAY,CAAC,EAAE,qBAAqB,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC3G,iBAAiB,EAAE,UAAU,CAAC,CAAC,uBAAuB,CAAC,YAAY,CAAC,EAAE,uBAAuB,CAAC,kBAAkB,CAAC,CAAC,CAAC;QACnH,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,IAAI;QAC7C,KAAK,EAAE,yNAAyN;KACjO;IACD;QACE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ;QAC5B,6FAA6F;QAC7F,wFAAwF;QACxF,8EAA8E;QAC9E,OAAO,EAAE,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC,kBAAkB,CAAC;QACrD,cAAc,EAAE,oBAAoB,EAAE,aAAa,EAAE,YAAY;QACjE,eAAe,EAAE,QAAQ,CAAC,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAAE,gBAAgB,CAAC,oBAAoB,CAAC,CAAC,CAAC;QACnG,iBAAiB,EAAE,UAAU,CAAC,CAAC,kBAAkB,CAAC,YAAY,CAAC,EAAE,kBAAkB,CAAC,oBAAoB,CAAC,CAAC,CAAC;QAC3G,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,IAAI;QAC7C,KAAK,EAAE,yRAAyR;KACjS;IACD;QACE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,oBAAoB;QAC7C,kFAAkF;QAClF,mFAAmF;QACnF,OAAO,EAAE,CAAC,sBAAsB,CAAC,EAAE,SAAS,EAAE,CAAC,wBAAwB,CAAC;QACxE,cAAc,EAAE,0BAA0B,EAAE,aAAa,EAAE,YAAY;QACvE,eAAe,EAAE,QAAQ,CAAC,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,iBAAiB,CAAC,qBAAqB,CAAC,CAAC,CAAC;QACtG,iBAAiB,EAAE,UAAU,CAAC,CAAC,mBAAmB,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC,qBAAqB,CAAC,CAAC,CAAC;QAC9G,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,IAAI;QAC/C,KAAK,EAAE,oUAAoU;KAC5U;IACD;QACE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY;QAChC,6FAA6F;QAC7F,wFAAwF;QACxF,sDAAsD;QACtD,OAAO,EAAE,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC,aAAa,CAAC;QAChD,cAAc,EAAE,uBAAuB,EAAE,aAAa,EAAE,YAAY;QACpE,4FAA4F;QAC5F,uFAAuF;QACvF,wFAAwF;QACxF,uFAAuF;QACvF,2FAA2F;QAC3F,eAAe,EAAE,QAAQ,CAAC,CAAC,qBAAqB,CAAC,YAAY,CAAC,EAAE,qBAAqB,CAAC,aAAa,CAAC,CAAC,CAAC;QACtG,iBAAiB,EAAE,UAAU,CAAC,CAAC,uBAAuB,CAAC,YAAY,CAAC,EAAE,uBAAuB,CAAC,aAAa,CAAC,CAAC,CAAC;QAC9G,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI;QACxC,KAAK,EAAE,meAAme;KAC3e;IACD;QACE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU;QAChC,OAAO,EAAE,CAAC,gCAAgC,EAAE,iCAAiC,CAAC,EAAE,SAAS,EAAE,CAAC,uBAAuB,CAAC;QACpH,cAAc,EAAE,IAAI,EAAE,UAAU,EAAE,2BAA2B,EAAE,aAAa,EAAE,qBAAqB;QACnG,eAAe,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,IAAI;QAC7F,KAAK,EAAE,yDAAyD;KACjE;IACD;QACE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB;QACpC,oFAAoF;QACpF,sFAAsF;QACtF,yFAAyF;QACzF,wFAAwF;QACxF,OAAO,EAAE,CAAC,aAAa,EAAE,iBAAiB,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,uBAAuB,CAAC;QACzF,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI;QACzC,eAAe,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI;QAC9C,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,KAAK,EAAE,mBAAmB,EAAE,IAAI;QACrE,KAAK,EAAE,yFAAyF;YAC9F,6FAA6F;YAC7F,+FAA+F;YAC/F,gGAAgG;KACnG;CACF,CAAC;AAEF,MAAM,UAAU,SAAS,CAAC,EAAU;IAClC,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAsB,EAAE,IAAY;IACrE,IAAI,CAAC,KAAK,CAAC,cAAc;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,IAAI,yCAAyC,CAAC,CAAC;IACnG,OAAO,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;AAC1C,CAAC"}
+{"version":3,"file":"agents.js","sourceRoot":"","sources":["../src/agents.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AA4CjC,SAAS,GAAG,CAAC,CAAU,IAAS,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACzG,SAAS,GAAG,CAAC,CAAU,IAAe,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAEzE,yFAAyF;AACzF,+FAA+F;AAC/F,yFAAyF;AACzF,gGAAgG;AAChG,iGAAiG;AACjG,6FAA6F;AAC7F,wDAAwD;AACxD,MAAM,mCAAmC,GAAG,IAAI,GAAG,CAAC,CAAC,kBAAkB,EAAE,aAAa,CAAC,CAAC,CAAC;AACzF,SAAS,qBAAqB,CAAC,KAAa;IAC1C,MAAM,eAAe,GAAG,CAAC,mCAAmC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACxE,OAAO,CAAC,QAAa,EAAE,OAAe,EAAO,EAAE;QAC7C,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC;QACxG,IAAI,CAAC,gBAAgB;YAAE,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;QACzH,OAAO,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;IAC7D,CAAC,CAAC;AACJ,CAAC;AAED,+FAA+F;AAC/F,SAAS,gBAAgB,CAAC,KAAa;IACrC,OAAO,CAAC,QAAa,EAAE,OAAe,EAAO,EAAE;QAC7C,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1F,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,IAAI,CAAC,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;IAC7F,CAAC,CAAC;AACJ,CAAC;AAED,0FAA0F;AAC1F,SAAS,iBAAiB,CAAC,KAAa;IACtC,OAAO,CAAC,QAAa,EAAE,OAAe,EAAO,EAAE;QAC7C,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/G,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,IAAI,CAAC,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;IAC7F,CAAC,CAAC;AACJ,CAAC;AAED,+FAA+F;AAC/F,8FAA8F;AAC9F,SAAS,uBAAuB,CAAC,KAAa;IAC5C,OAAO,CAAC,QAAa,EAAE,YAA0C,EAAO,EAAE;QACxE,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC;YAAE,OAAO,QAAQ,CAAC;QACvC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;aACpC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;aAClH,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAChD,OAAO,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;IAC7D,CAAC,CAAC;AACJ,CAAC;AAED,+BAA+B;AAC/B,SAAS,kBAAkB,CAAC,KAAa;IACvC,OAAO,CAAC,QAAa,EAAE,YAA0C,EAAO,EAAE;QACxE,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC;YAAE,OAAO,QAAQ,CAAC;QACvC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACpG,OAAO,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;IAC7D,CAAC,CAAC;AACJ,CAAC;AAED,gCAAgC;AAChC,SAAS,mBAAmB,CAAC,KAAa;IACxC,OAAO,CAAC,QAAa,EAAE,YAA0C,EAAO,EAAE;QACxE,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC;YAAE,OAAO,QAAQ,CAAC;QACvC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACjG,OAAO,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;IAC7D,CAAC,CAAC;AACJ,CAAC;AAED,+FAA+F;AAC/F,gGAAgG;AAChG,kGAAkG;AAClG,+FAA+F;AAC/F,iGAAiG;AACjG,4BAA4B;AAC5B,SAAS,QAAQ,CAAC,OAAuD;IACvE,OAAO,CAAC,QAAa,EAAE,OAAe,EAAO,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;AAChH,CAAC;AACD,SAAS,UAAU,CAAC,SAAoF;IACtG,OAAO,CAAC,QAAa,EAAE,YAA0C,EAAO,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,QAAQ,CAAC,CAAC;AACtJ,CAAC;AAED,MAAM,CAAC,MAAM,MAAM,GAAsB;IACvC;QACE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,aAAa;QACtC,OAAO,EAAE,CAAC,uBAAuB,CAAC,EAAE,SAAS,EAAE,CAAC,kBAAkB,CAAC;QACnE,cAAc,EAAE,uBAAuB,EAAE,aAAa,EAAE,YAAY;QACpE,eAAe,EAAE,QAAQ,CAAC,CAAC,qBAAqB,CAAC,YAAY,CAAC,EAAE,qBAAqB,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC3G,iBAAiB,EAAE,UAAU,CAAC,CAAC,uBAAuB,CAAC,YAAY,CAAC,EAAE,uBAAuB,CAAC,kBAAkB,CAAC,CAAC,CAAC;QACnH,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,IAAI;QAC7C,KAAK,EAAE,wRAAwR;KAChS;IACD;QACE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO;QAC1B,OAAO,EAAE,CAAC,oBAAoB,CAAC,EAAE,SAAS,EAAE,CAAC,iBAAiB,EAAE,0BAA0B,CAAC;QAC3F,cAAc,EAAE,mBAAmB,EAAE,aAAa,EAAE,YAAY;QAChE,eAAe,EAAE,QAAQ,CAAC,CAAC,qBAAqB,CAAC,YAAY,CAAC,EAAE,qBAAqB,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC3G,iBAAiB,EAAE,UAAU,CAAC,CAAC,uBAAuB,CAAC,YAAY,CAAC,EAAE,uBAAuB,CAAC,kBAAkB,CAAC,CAAC,CAAC;QACnH,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,IAAI;QAC7C,KAAK,EAAE,yNAAyN;KACjO;IACD;QACE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ;QAC5B,6FAA6F;QAC7F,wFAAwF;QACxF,8EAA8E;QAC9E,OAAO,EAAE,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC,kBAAkB,CAAC;QACrD,cAAc,EAAE,oBAAoB,EAAE,aAAa,EAAE,YAAY;QACjE,eAAe,EAAE,QAAQ,CAAC,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAAE,gBAAgB,CAAC,oBAAoB,CAAC,CAAC,CAAC;QACnG,iBAAiB,EAAE,UAAU,CAAC,CAAC,kBAAkB,CAAC,YAAY,CAAC,EAAE,kBAAkB,CAAC,oBAAoB,CAAC,CAAC,CAAC;QAC3G,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,IAAI;QAC7C,KAAK,EAAE,yRAAyR;KACjS;IACD;QACE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,oBAAoB;QAC7C,kFAAkF;QAClF,mFAAmF;QACnF,OAAO,EAAE,CAAC,sBAAsB,CAAC,EAAE,SAAS,EAAE,CAAC,wBAAwB,CAAC;QACxE,cAAc,EAAE,0BAA0B,EAAE,aAAa,EAAE,YAAY;QACvE,eAAe,EAAE,QAAQ,CAAC,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,iBAAiB,CAAC,qBAAqB,CAAC,CAAC,CAAC;QACtG,iBAAiB,EAAE,UAAU,CAAC,CAAC,mBAAmB,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC,qBAAqB,CAAC,CAAC,CAAC;QAC9G,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,IAAI;QAC/C,KAAK,EAAE,oUAAoU;KAC5U;IACD;QACE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY;QAChC,6FAA6F;QAC7F,wFAAwF;QACxF,sDAAsD;QACtD,OAAO,EAAE,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC,aAAa,CAAC;QAChD,cAAc,EAAE,uBAAuB,EAAE,aAAa,EAAE,YAAY;QACpE,4FAA4F;QAC5F,uFAAuF;QACvF,wFAAwF;QACxF,uFAAuF;QACvF,2FAA2F;QAC3F,eAAe,EAAE,QAAQ,CAAC,CAAC,qBAAqB,CAAC,YAAY,CAAC,EAAE,qBAAqB,CAAC,aAAa,CAAC,CAAC,CAAC;QACtG,iBAAiB,EAAE,UAAU,CAAC,CAAC,uBAAuB,CAAC,YAAY,CAAC,EAAE,uBAAuB,CAAC,aAAa,CAAC,CAAC,CAAC;QAC9G,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI;QACxC,KAAK,EAAE,meAAme;KAC3e;IACD;QACE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU;QAChC,OAAO,EAAE,CAAC,gCAAgC,EAAE,iCAAiC,CAAC,EAAE,SAAS,EAAE,CAAC,uBAAuB,CAAC;QACpH,cAAc,EAAE,IAAI,EAAE,UAAU,EAAE,2BAA2B,EAAE,aAAa,EAAE,qBAAqB;QACnG,eAAe,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,IAAI;QAC7F,KAAK,EAAE,yDAAyD;KACjE;IACD;QACE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB;QACpC,oFAAoF;QACpF,sFAAsF;QACtF,yFAAyF;QACzF,wFAAwF;QACxF,OAAO,EAAE,CAAC,aAAa,EAAE,iBAAiB,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,uBAAuB,CAAC;QACzF,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI;QACzC,eAAe,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI;QAC9C,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,KAAK,EAAE,mBAAmB,EAAE,IAAI;QACrE,KAAK,EAAE,yFAAyF;YAC9F,6FAA6F;YAC7F,+FAA+F;YAC/F,gGAAgG;KACnG;CACF,CAAC;AAEF,MAAM,UAAU,SAAS,CAAC,EAAU;IAClC,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAsB,EAAE,IAAY;IACrE,IAAI,CAAC,KAAK,CAAC,cAAc;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,IAAI,yCAAyC,CAAC,CAAC;IACnG,OAAO,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;AAC1C,CAAC"}

package/dist/cli.js

@@ -6,11 +6,11 @@ import { startServer } from "./serve.js";
 import { captureHook, extractPreview, extractSave, importEvents, readToken, reloadRemoteRules, scanFile } from "./client.js";
 import { supportsExtraction } from "./extract.js";
 import { AGENTS } from "./agents.js";
-import { installAllDetectedHooks, installHook, uninstallAllHooks } from "./install.js";
+import { installAllDetectedHooks, installHook, uninstallAllHooks, uninstallHook } from "./install.js";
 import { configuredPort, installService, serviceLogPaths, serviceStatus, startService, stopService, uninstallService } from "./service.js";
 import { waitForCollectorUp } from "./collector-health.js";
 import { getBeamHome, getCollectorUrl, getDataDirectory, getIdentityPath } from "./config.js";
-import { clearIdentity, enrollDevice, readIdentity } from "./enroll.js";
+import { clearIdentity, readIdentity } from "./enroll.js";
 import { startConnect } from "./connect.js";
 import { runSetup, promptYesNo } from "./setup.js";
 import { installEnterprisePackage } from "./enterprise-install.js";
@@ -22,8 +22,13 @@ import { loadCustomRules } from "./custom-rules.js";
 import { sequenceRuleCatalog } from "./sequences.js";
 import { printBanner } from "./banner.js";
 import { runWithSudoFallback } from "./elevate.js";
-import { renderColumns, withSpinner } from "./prompts.js";
-import { cyan, green } from "./color.js";
+import { confirm, renderColumns, withSpinner } from "./prompts.js";
+import { cyan, dim, green, red } from "./color.js";
+import { ALL_SKILL_AGENTS, addSkill, isBlocked, scanInstalledSkills } from "./skills.js";
+import { scanSkillDir } from "./skill-scan.js";
+import { syncSkillInventory } from "./skill-sync.js";
+import { agentSkillRoots, deviceSkillsScore, indexSkills, inventoryFile, readInventory, trustedHashes } from "./skill-inventory.js";
+import { readTrustedSkills, trustSkill, untrustSkill } from "./trusted-skills.js";
 import { runAgent } from "./run.js";
 import { AGENT_BINARIES, installShims, listShims, pathExportLine, shimDir, uninstallShims } from "./shims.js";
 import { runMcpProxy } from "./mcp-proxy.js";
@@ -31,6 +36,7 @@ import { registerJevCommands } from "./jev-cli.js";
 import { addTrustedPath, readTrustedPaths, removeTrustedPath, trustedPathsFile } from "./trusted-paths.js";
 import { blockedTargetsFile, readBlockedTargets, removeBlockedTarget } from "./blocked-targets.js";
 import { checkForUpdate, installUpdate } from "./update.js";
+import { recordExpectedHooks, reportControlEvent } from "./tamper.js";
 // Lets 'BEAM_API_URL=... beam connect' style overrides live in a .env file instead of the
 // shell profile. Checked in cwd first (handy when developing from the repo), then in
 // ~/.beam so overrides still apply when 'beam' is run globally from any directory.
@@ -74,7 +80,7 @@ program.command("start")
     const rulesNote = result.customRules.loaded ? `\nCustom rules loaded: ${result.customRules.loaded} from ${result.customRules.path}` : "";
     for (const message of result.customRules.errors)
         console.error(`✖ ${message}`);
-    const policyNote = result.policySync ? "\nPolicy sync: on (every 60s)" : "\nPolicy sync: off (device not enrolled — run 'beam enroll')";
+    const policyNote = result.policySync ? "\nPolicy sync: on (every 60s)" : "\nPolicy sync: off (device not enrolled — run 'beam setup')";
     const newlyInstalled = result.agentInstalls.filter(r => r.status === "installed");
     const installNote = newlyInstalled.length
         ? `\nAgent hooks installed: ${newlyInstalled.map(r => r.name).join(", ")}`
@@ -85,6 +91,22 @@ program.command("start")
     }
     console.log(`Beam collector running.\nMode: observe only\nLocal storage: ${result.directory}${rulesNote}${policyNote}${installNote}\nRun 'beam agent list' to see every detected agent's capture status.\nRun 'beam token' for the pairing token.`);
 });
+// Shared gate for every command that reduces or removes beam's visibility on this device
+// (stopping/uninstalling the service, detaching an agent's hook, or logging out entirely). On an
+// enrolled device these are exactly the actions an employee could otherwise use to go dark to
+// their org's dashboard without anyone knowing -- see tamper.ts. So each one prints what will
+// actually happen and, when enrolled, that the org admin will be notified this device did it,
+// then requires an explicit "Yes" (or --yes, for scripted/CI use) before doing anything. There is
+// no path to run the underlying action without either declining here or accepting the notice: the
+// action and the report are the same decision, not two.
+async function confirmControlAction(message, identity, yes) {
+    console.log(identity
+        ? `${message}\nYour organization admin will be notified that this device (${identity.hostname}) did this.`
+        : message);
+    if (yes)
+        return true;
+    return promptYesNo("\nProceed?", false);
+}
 const service = program.command("service").description("Run the collector as a background service (launchd on macOS, systemd --user on Linux)");
 service.command("install")
     .description("Install and start the collector as a background service that survives reboots")
@@ -102,7 +124,19 @@ service.command("install")
 });
 service.command("uninstall")
     .description("Stop and remove the background service")
-    .action(async () => { await uninstallService(); console.log("✔ Removed the beam service."); });
+    .option("--yes", "skip the confirmation prompt")
+    .action(async (options) => {
+    const identity = await readIdentity();
+    const proceed = await confirmControlAction("This will stop and remove beam's background service. It will no longer observe or policy-enforce AI agent activity on this device.", identity, options.yes);
+    if (!proceed) {
+        console.log("Cancelled.");
+        return;
+    }
+    if (identity)
+        await reportControlEvent("service-uninstall", `Beam service removed on ${identity.hostname}`, "This device ran 'beam service uninstall'. Beam's background collector will no longer start automatically -- it is not observing or policy-enforcing until 'beam service install' runs again.");
+    await uninstallService();
+    console.log("✔ Removed the beam service.");
+});
 service.command("start")
     .description("Start the installed background service")
     .action(async () => {
@@ -116,7 +150,21 @@ service.command("start")
         process.exitCode = 1;
     }
 });
-service.command("stop").description("Stop the installed background service").action(async () => { await stopService(); console.log("✔ Stopped."); });
+service.command("stop")
+    .description("Stop the installed background service")
+    .option("--yes", "skip the confirmation prompt")
+    .action(async (options) => {
+    const identity = await readIdentity();
+    const proceed = await confirmControlAction("This will stop beam's background service. It will not observe or policy-enforce AI agent activity on this device until it's started again.", identity, options.yes);
+    if (!proceed) {
+        console.log("Cancelled.");
+        return;
+    }
+    if (identity)
+        await reportControlEvent("service-stop", `Beam service stopped on ${identity.hostname}`, "This device ran 'beam service stop'. Beam's background collector is not running -- it is not observing or policy-enforcing until it's started again.");
+    await stopService();
+    console.log("✔ Stopped.");
+});
 service.command("status")
     .description("Show whether the background service is installed and running")
     .action(async () => {
@@ -149,27 +197,12 @@ program.command("studio")
     openBrowser(`${origin}/?token=${encodeURIComponent(token)}`);
     console.log("Opening beam studio in your browser…");
 });
-program.command("enroll")
-    .description("Enroll this device with your Beam workspace using a code from your manager")
-    .requiredOption("--code <code>", "enrollment code, e.g. BEAM-XXXX-XXXX-XXXX")
-    .option("--url <url>", "Beam API base URL (default $BEAM_API_URL or https://collector.agentbeam.com)")
-    .action(async (options) => {
-    const existing = await readIdentity();
-    if (existing)
-        console.error(`Replacing the existing enrollment (device ${existing.deviceId}).`);
-    const identity = await enrollDevice(options);
-    console.log(`${green("✔")} Enrolled device ${identity.deviceId}\n` +
-        `  org:      ${identity.orgId}\n` +
-        `  api:      ${identity.apiBase}\n` +
-        `  identity: ${getIdentityPath()} (0600)\n\n` +
-        cyan(`Next: beam agent install-all && beam start`));
-});
 program.command("whoami")
     .description("Show this device's enrollment, if any")
     .action(async () => {
     const identity = await readIdentity();
     if (!identity)
-        throw new Error("This device is not enrolled. Run 'beam enroll --code <code>'.");
+        throw new Error("This device is not enrolled. Run 'beam setup'.");
     console.log(`device: ${identity.deviceId}\norg:    ${identity.orgId}\napi:    ${identity.apiBase}\nhost:   ${identity.hostname} (${identity.os})\nsince:  ${identity.enrolledAt}`);
 });
 program.command("account")
@@ -177,7 +210,7 @@ program.command("account")
     .action(async () => {
     const identity = await readIdentity();
     if (!identity)
-        throw new Error("This device is not enrolled. Run 'beam connect' or 'beam enroll --code <code>'.");
+        throw new Error("This device is not enrolled. Run 'beam setup'.");
     const account = await fetchAccount(identity);
     console.log(`user:   ${account.user.email}${account.user.name ? ` (${account.user.name})` : ""}\n` +
         `org:    ${account.org.name} (${account.org.slug})\n` +
@@ -186,12 +219,22 @@ program.command("account")
 });
 program.command("logout")
     .description("Disconnect this device from your Beam workspace and remove local credentials")
-    .action(async () => {
+    .option("--yes", "skip the confirmation prompt")
+    .action(async (options) => {
     const identity = await readIdentity();
     if (!identity) {
         console.log("This device is not enrolled -- nothing to do.");
         return;
     }
+    const proceed = await confirmControlAction("This will disconnect this device from your Beam workspace. It will stop reporting activity until it's re-enrolled.", identity, options.yes);
+    if (!proceed) {
+        console.log("Cancelled.");
+        return;
+    }
+    // Sent while identity.json still exists, so it authenticates -- and before revokeDevice()
+    // below, so it's an authenticated "I chose to log out" record rather than something an admin
+    // has to infer from the device simply going quiet (see tamper.ts).
+    await reportControlEvent("logout", `Beam logged out on ${identity.hostname}`, `This device was logged out via 'beam logout'. It is no longer enrolled and will stop reporting until re-enrolled.`);
     try {
         await revokeDevice(identity);
     }
@@ -209,18 +252,23 @@ program.command("uninstall")
     .action(async (options) => {
     const beamHome = getBeamHome();
     const dataDir = getDataDirectory();
-    console.log("This will remove:\n" +
+    const identityBeforeUninstall = await readIdentity();
+    const proceed = await confirmControlAction("This will remove:\n" +
         "  - the beam background service (if installed)\n" +
         "  - beam's hooks from every AI agent config it was wired into\n" +
         `  - ${beamHome} (identity, cached policy, event logs, custom rules)\n` +
         "  - this device's registration with your Beam workspace" +
-        (options.keepPackage ? "" : "\n  - the globally installed beam (and beam-enterprise, if present) npm package"));
-    if (!options.yes) {
-        const proceed = await promptYesNo("\nProceed?", false);
-        if (!proceed) {
-            console.log("Cancelled.");
-            return;
-        }
+        (options.keepPackage ? "" : "\n  - the globally installed beam (and beam-enterprise, if present) npm package"), identityBeforeUninstall, options.yes);
+    if (!proceed) {
+        console.log("Cancelled.");
+        return;
+    }
+    // Sent first, before anything below touches identity.json, the service, or hooks -- so the
+    // workspace has an authenticated "this was a deliberate 'beam uninstall'" record even if a
+    // later step in this command fails partway through. See tamper.ts: this is what distinguishes
+    // an authorized removal from the silent kind checkForTampering() is built to catch.
+    if (identityBeforeUninstall) {
+        await reportControlEvent("uninstall", `Beam uninstalled on ${identityBeforeUninstall.hostname}`, "This device ran 'beam uninstall'. Its background service, agent hooks, and local data are being removed, and its registration is being revoked.");
     }
     try {
         await uninstallService();
@@ -229,14 +277,23 @@ program.command("uninstall")
     catch (e) {
         console.log(`— Skipped background service (${e.message}).`);
     }
-    const hookResults = await uninstallAllHooks();
-    const removedHooks = hookResults.filter(r => r.removed);
-    if (removedHooks.length) {
-        for (const r of removedHooks)
-            console.log(`✔ Removed beam's hook from ${r.agent}\n  → ${r.path}`);
+    // Wrapped like uninstallService() above: one agent's hook config being unreadable (invalid
+    // JSON, a permission error) must not abort the rest of 'beam uninstall' -- in particular it
+    // must not skip revokeDevice() below, or the device is wiped locally but the dashboard shows
+    // it as connected forever with nothing left running here to ever tell it otherwise.
+    try {
+        const hookResults = await uninstallAllHooks();
+        const removedHooks = hookResults.filter(r => r.removed);
+        if (removedHooks.length) {
+            for (const r of removedHooks)
+                console.log(`✔ Removed beam's hook from ${r.agent}\n  → ${r.path}`);
+        }
+        else {
+            console.log("— No installed agent hooks found.");
+        }
     }
-    else {
-        console.log("— No installed agent hooks found.");
+    catch (e) {
+        console.log(`— Could not remove every agent hook (${e.message}).`);
     }
     const identity = await readIdentity();
     if (identity) {
@@ -277,7 +334,7 @@ program.command("sync")
     .action(async () => {
     const result = await syncPolicy();
     if (result.status === "not-enrolled")
-        throw new Error("This device is not enrolled. Run 'beam enroll --code <code>'.");
+        throw new Error("This device is not enrolled. Run 'beam setup'.");
     if (result.status === "unreachable")
         throw new Error("Could not reach the Beam workspace. Check the network or 'beam whoami'.");
     console.log(result.status === "updated" ? `✔ Policy v${result.version} synced → ${result.path}` : "✔ Policy already up to date.");
@@ -366,6 +423,178 @@ program.command("scan")
     .option("--mcp", "treat the file as an MCP configuration instead of a skill")
     .option("--save", "also save the report to the running collector")
     .action(async (file, options) => console.log(JSON.stringify(await scanFile(file, options), null, 2)));
+function printSkillScan(scan) {
+    const badge = scan.risk === "critical" || scan.risk === "high" ? red(scan.risk.toUpperCase()) : scan.risk === "medium" ? scan.risk : green(scan.findings.length ? scan.risk : "clean");
+    console.log(`\n${scan.name}  [${badge}]  risk score ${scan.score}/100 (${scan.level})  ${scan.filesScanned} files scanned`);
+    for (const f of scan.findings.slice(0, 10))
+        console.log(`  ${f.severity.padEnd(8)} ${f.title}  ${dim(`${f.file}${f.line ? `:${f.line}` : ""}`)}\n           ${dim(f.evidence.split("\n")[0].slice(0, 100))}`);
+    if (scan.findings.length > 10)
+        console.log(dim(`  … ${scan.findings.length - 10} more (use --json for all)`));
+    for (const s of scan.skipped)
+        console.log(dim(`  skipped ${s}`));
+}
+const add = program.command("add").description("Add reusable AI assets, scanned before they are installed");
+add.command("skill")
+    .description("Download a skill, scan it for prompt injection and risky instructions, then install it only if it passes")
+    .argument("<source>", "owner/repo, a GitHub/GitLab https URL, or a local folder")
+    .option("--skill <name>", "pick one skill when the source contains several")
+    .option("--agent <agent...>", `target agent(s): ${ALL_SKILL_AGENTS.join(", ")} (default: claude-code)`)
+    .option("--all-agents", "install for every supported agent")
+    .option("-g, --global", "install for your user instead of the current project")
+    .option("--force", "install even when the scan finds prompt injection or critical risk")
+    .option("--scan-only", "scan without installing anything")
+    .option("--json", "print the scan result as JSON")
+    .action(async (source, options) => {
+    let result;
+    try {
+        result = await withSpinner(`Fetching and scanning ${source}`, () => addSkill(source, options));
+    }
+    catch (e) {
+        console.error(`✖ ${e instanceof Error ? e.message : e}`);
+        process.exitCode = 1;
+        return;
+    }
+    if (options.json) {
+        console.log(JSON.stringify(result, null, 2));
+    }
+    else {
+        result.scans.forEach(printSkillScan);
+        console.log("");
+        for (const i of result.installed)
+            console.log(`${green("✔")} Installed ${i.name} → ${i.path}`);
+        if (result.blocked.length)
+            console.error(`✖ Not installed (prompt injection or critical risk): ${result.blocked.join(", ")}\n  Review the findings above. If you trust the source, re-run with --force.`);
+        if (options.scanOnly)
+            console.log(dim("Scan only: nothing was installed."));
+    }
+    if (result.blocked.length)
+        process.exitCode = 2;
+});
+const skills = program.command("skills").description("Inspect installed agent skills");
+skills.command("scan")
+    .description("Scan installed skills (or one skill folder) for prompt injection and risky instructions")
+    .argument("[path]", "a skill folder; omit to scan every installed skill for the supported agents")
+    .option("--json", "print results as JSON")
+    .action(async (target, options) => {
+    const scans = target ? [await scanSkillDir(path.resolve(target), path.basename(path.resolve(target)))] : await scanInstalledSkills();
+    if (options.json)
+        console.log(JSON.stringify(scans, null, 2));
+    else if (!scans.length)
+        console.log("No installed skills found.");
+    else
+        scans.forEach(printSkillScan);
+    if (scans.some(isBlocked))
+        process.exitCode = 2;
+});
+skills.command("index")
+    .description("Find every skill on this machine (repos, nested folders, plugins), scan them, and write the inventory file")
+    .option("--root <dir...>", "folders to search instead of your home directory")
+    .option("--agents-only", "only check the agents' own skill folders (~/.claude, ~/.agents, ...), not the rest of your home directory")
+    .option("--depth <n>", "maximum folder depth (default 10)")
+    .option("--json", "print the inventory as JSON")
+    .action(async (options) => {
+    const roots = options.agentsOnly ? await agentSkillRoots() : options.root?.map(r => path.resolve(r));
+    if (!options.json && !roots)
+        console.error(dim("Searching your home folder for skills. macOS may ask you to allow access to Desktop, Documents or Downloads; use --agents-only to skip that."));
+    const search = () => indexSkills({ roots, maxDepth: options.depth ? Number(options.depth) : undefined });
+    const { inventory, changes } = options.json ? await search() : await withSpinner("Searching for skills", search);
+    if (options.json) {
+        console.log(JSON.stringify({ inventory, changes }, null, 2));
+        return;
+    }
+    const risky = inventory.skills.filter(s => s.level === "HIGH" || s.level === "CRITICAL").length;
+    console.log(`${green("✔")} ${inventory.skills.length} skills indexed (${risky} high/critical) → ${inventoryFile()}`);
+    if (changes.added.length || changes.modified.length || changes.removed.length)
+        console.log(`  ${changes.added.length} new, ${changes.modified.length} modified, ${changes.removed.length} removed since last index`);
+    if (inventory.truncated)
+        console.log(dim("  Search hit its time/size budget; some folders were not visited. Narrow it with --root."));
+    console.log(dim("Run 'beam skills list' to view them."));
+    // A new or changed skill is reported to the workspace right away (enrolled devices only).
+    const sent = await syncSkillInventory().catch(() => null);
+    if (sent?.status === "sent")
+        console.log(dim(`Reported ${sent.skills} skills to your workspace.`));
+});
+skills.command("list")
+    .alias("ls")
+    .description("List every skill in the inventory with its risk score (run 'beam skills index' first)")
+    .option("--risk <level>", "only show LOW, MEDIUM, HIGH or CRITICAL (that level and above)")
+    .option("--agent <agent>", "only show one agent, e.g. claude-code, codex, universal")
+    .option("--json", "print as JSON")
+    .action(async (options) => {
+    let inv = await readInventory();
+    // Nothing has searched beyond the agents' own folders yet. Ask here, at the moment the list is
+    // wanted, rather than at install or startup -- this is what makes macOS ask for folder access.
+    if (!inv?.lastFullScanAt && process.stdin.isTTY && process.stdout.isTTY && !options.json) {
+        const ok = await confirm(`${inv ? "Skills inside your project folders haven't been searched." : "No skill list yet."} Search your home folder now? (macOS may ask for access to Desktop, Documents and Downloads)`, true);
+        if (ok) {
+            await withSpinner("Searching for skills", () => indexSkills());
+            inv = await readInventory();
+        }
+        else if (!inv) {
+            inv = (await indexSkills({ roots: await agentSkillRoots() })).inventory;
+        }
+    }
+    if (!inv) {
+        console.error("No inventory yet. Run: beam skills index");
+        process.exitCode = 1;
+        return;
+    }
+    const order = ["LOW", "MEDIUM", "HIGH", "CRITICAL"];
+    const min = options.risk ? order.indexOf(options.risk.toUpperCase()) : 0;
+    if (min < 0) {
+        console.error(`--risk must be one of ${order.join(", ")}`);
+        process.exitCode = 1;
+        return;
+    }
+    const trusted = await trustedHashes();
+    const rows = inv.skills.filter(s => order.indexOf(s.level) >= min && (!options.agent || s.agent === options.agent));
+    if (options.json) {
+        console.log(JSON.stringify(rows.map(s => ({ ...s, trusted: trusted.has(s.hash) })), null, 2));
+        return;
+    }
+    console.log(renderColumns(["skill", "agent", "scope", "risk", "trusted", "path"], rows.map(s => [s.name, s.agent, s.scope, `${s.score} ${s.level}${s.injection ? " ⚠inj" : ""}`, trusted.has(s.hash) ? "yes" : "", s.dir])));
+    console.log(dim(`\n${rows.length} of ${inv.skills.length} skills · indexed ${inv.generatedAt}${inv.truncated ? " (partial)" : ""} · ${inventoryFile()}`));
+    const device = deviceSkillsScore(inv.skills, trusted);
+    console.log(`Device skills score: ${device.score}/100${device.highCount ? ` (${device.highCount} untrusted high/critical skill${device.highCount > 1 ? "s" : ""})` : ""}`);
+    if (!inv.lastFullScanAt)
+        console.log(dim("Only the agents' own skill folders were checked. Run 'beam skills index' to search your project folders too."));
+});
+skills.command("sync")
+    .description("Send skill names and risk scores (never contents) to your workspace, if they changed since the last send")
+    .option("--force", "send even if nothing changed")
+    .action(async (options) => {
+    // Refreshes only the agents' own folders, so this never triggers a macOS folder-access prompt.
+    // Run 'beam skills index' first if you want project folders included.
+    const roots = await agentSkillRoots();
+    if (roots.length || !await readInventory())
+        await indexSkills({ roots });
+    const result = await syncSkillInventory({ force: options.force });
+    if (result.status === "sent")
+        console.log(`${green("✔")} Sent ${result.skills} skills to your workspace.`);
+    else if (result.status === "unchanged")
+        console.log("Nothing changed since the last send. Use --force to send anyway.");
+    else {
+        console.error(`✖ ${result.status === "not-enrolled" ? "This device isn't connected to a workspace. Run: beam setup" : result.reason ?? result.status}`);
+        process.exitCode = 1;
+    }
+});
+skills.command("trust")
+    .description("Mark a reviewed skill as trusted so the hook stops holding it for approval (pinned to its current content)")
+    .argument("<path>", "skill folder")
+    .action(async (target) => {
+    const dir = path.resolve(target);
+    const scan = await scanSkillDir(dir, path.basename(dir));
+    printSkillScan(scan);
+    await trustSkill(scan.name, scan.hash);
+    console.log(`\n${green("✔")} Trusted ${scan.name} (score ${scan.score}/100). Any later edit to it will be scanned again.`);
+});
+skills.command("untrust")
+    .description("Remove a skill from the trusted list")
+    .argument("<name-or-hash>")
+    .action(async (key) => console.log(`Removed ${await untrustSkill(key)} trusted skill(s).`));
+skills.command("trusted")
+    .description("List trusted skills")
+    .action(async () => { const l = await readTrustedSkills(); console.log(l.length ? renderColumns(["name", "hash", "trusted"], l.map(t => [t.name, t.hash.slice(0, 12), t.trustedAt])) : "No trusted skills."); });
 const mcp = program.command("mcp").description("Run and protect local MCP integrations");
 mcp.command("proxy")
     .description("Run an MCP server through Beam response filtering")
@@ -394,8 +623,26 @@ agent.command("install")
     .argument("<agent>", "agent id, e.g. claude-code, codex, cursor, copilot-cli")
     .action(async (agentId) => {
     const result = await installHook(agentId);
+    await recordExpectedHooks();
     console.log(result.alreadyInstalled ? `✔ Already installed for ${result.agent}\n  → ${result.path}` : `✔ Installed beam hook for ${result.agent}\n  → ${result.path}`);
 });
+agent.command("uninstall")
+    .description("Detach beam's hook from a single agent's own hook config, leaving everything else installed")
+    .argument("<agent>", "agent id, e.g. claude-code, codex, cursor, copilot-cli")
+    .option("--yes", "skip the confirmation prompt")
+    .action(async (agentId, options) => {
+    const identity = await readIdentity();
+    const proceed = await confirmControlAction(`This will detach beam's hook from ${agentId}. Its activity will no longer be observed or policy-enforced by beam.`, identity, options.yes);
+    if (!proceed) {
+        console.log("Cancelled.");
+        return;
+    }
+    if (identity)
+        await reportControlEvent(`agent-uninstall-${agentId}`, `Beam hook detached from ${agentId} on ${identity.hostname}`, `This device ran 'beam agent uninstall ${agentId}'. ${agentId} is no longer being observed or policy-enforced by beam.`);
+    const result = await uninstallHook(agentId);
+    await recordExpectedHooks();
+    console.log(result.removed ? `✔ Detached beam's hook from ${result.agent}\n  → ${result.path}` : `— No beam hook found for ${result.agent}.`);
+});
 agent.command("extract")
     .description("Forensic extraction: read an agent's existing session/transcript files directly, no hook or live capture required")
     .argument("<agent>", `agent id (currently: claude-code, codex)`)
@@ -418,6 +665,7 @@ agent.command("install-all")
     .description("Detect which agents are actually installed on this machine and wire beam's hook into all of them")
     .action(async () => {
     const results = await installAllDetectedHooks();
+    await recordExpectedHooks();
     for (const r of results) {
         if (r.status === "installed")
             console.log(`✔ Installed for ${r.name}\n  → ${r.path}`);