@agent-beam/beam 0.2.3 → 0.2.5

package/dist/policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy.js","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAiB/C,MAAM,KAAK,GAAgB,EAAE,IAAI,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE,EAAE,sBAAsB,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC;AAEjH,MAAM,UAAU,UAAU;IACxB,OAAO,IAAI,CAAC,gBAAgB,EAAE,EAAE,aAAa,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,UAAU,EAAE,EAAE,MAAM,CAAC,CAA0B,CAAC;QACzF,IAAI,CAAC,MAAM,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAC/B,OAAO;YACL,OAAO,EAAE,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAChE,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,IAAI;YACjC,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE;SACrC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAgBD,sFAAsF;AACtF,MAAM,UAAU,QAAQ,CAAC,MAA2B,EAAE,GAAkB;IACtE,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC;IAE3E,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;IAClC,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;IAE1D,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;IAClE,oEAAoE;IACpE,IAAI,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;IAErG,MAAM,GAAG,GAAG,CAAC,MAAc,EAAY,EAAE,CAAC,CAAC;QACzC,MAAM,EAAE,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;QAClD,MAAM;QACN,GAAG,IAAI;KACR,CAAC,CAAC;IAEH,IAAI,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QAClF,OAAO,GAAG,CAAC,GAAG,GAAG,CAAC,KAAK,oDAAoD,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,IAAI,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QAC3F,OAAO,GAAG,CAAC,OAAO,GAAG,CAAC,IAAI,uCAAuC,CAAC,CAAC;IACrE,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,sBAAsB,EAAE,CAAC;QACnD,IAAI,CAAC,GAAG,CAAC,OAAO;YAAE,MAAM;QACxB,IAAI,CAAC;YACH,IAAI,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC/C,OAAO,GAAG,CAAC,4CAA4C,OAAO,GAAG,CAAC,CAAC;YACrE,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,mCAAmC;QACrC,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;AACtC,CAAC"}
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAS/C,MAAM,KAAK,GAAgB,EAAE,IAAI,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE,EAAE,sBAAsB,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC;AACjJ,MAAM,UAAU,UAAU,KAAa,OAAO,IAAI,CAAC,gBAAgB,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;AACxF,MAAM,UAAU,kBAAkB,KAAa,OAAO,IAAI,CAAC,gBAAgB,EAAE,EAAE,uBAAuB,CAAC,CAAC,CAAC,CAAC;AAE1G,SAAS,WAAW,CAAC,CAAU,IAAuB,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;AAC9I,SAAS,SAAS,CAAC,CAAU,EAAE,KAAa,EAAE,MAAgB;IAC5D,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAAC,MAAM,CAAC,IAAI,CAAC,SAAS,KAAK,qBAAqB,CAAC,CAAC;QAAC,OAAO,SAAS,CAAC;IAAC,CAAC;IAC5H,MAAM,CAAC,GAAG,CAA4B,CAAC;IACvC,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;QAAC,MAAM,CAAC,IAAI,CAAC,SAAS,KAAK,kBAAkB,CAAC,CAAC;QAAC,OAAO,SAAS,CAAC;IAAC,CAAC;IAClH,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;QAAC,MAAM,CAAC,IAAI,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,EAAE,yBAAyB,CAAC,CAAC;QAAC,OAAO,SAAS,CAAC;IAAC,CAAC;IACjH,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,EAAE,CAAC;QAAC,MAAM,CAAC,IAAI,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,EAAE,wBAAwB,CAAC,CAAC;QAAC,OAAO,SAAS,CAAC;IAAC,CAAC;IACrL,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;QAAC,MAAM,CAAC,IAAI,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC;QAAC,OAAO,SAAS,CAAC;IAAC,CAAC;IAC1K,OAAO,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,WAAW,EAAkB,EAAgB,CAAC;AACxF,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,MAAM,IAAI,GAAG,KAAK,EAAE,IAAY,EAAyB,EAAE;QACzD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAA0B,CAAC;QACjF,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;QACxF,MAAM,MAAM,GAAa,EAAE,CAAC;QAAC,MAAM,MAAM,GAAG,MAAM,CAAC,KAA6B,CAAC;QACjF,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,qEAAqE,CAAC,CAAC;QACrT,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YAAC,IAAI,CAAC;gBAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,MAAM,CAAC,IAAI,CAAC,oCAAoC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;YAAC,CAAC;QAAC,CAAC;QACjN,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAmB,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChJ,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;QACtG,OAAO,EAAE,OAAO,EAAE,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,CAAC;IACrM,CAAC,CAAC;IACF,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACpE,IAAI,CAAC;YAAC,OAAO,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YACtD,4EAA4E;YAC5E,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,iFAAiF,CAAC,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC;QAC3K,CAAC;IACH,CAAC;AACH,CAAC;AAKD,MAAM,MAAM,GAAiC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AACjG,SAAS,IAAI,CAAC,OAAe,EAAE,KAAa,IAAa,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACxP,SAAS,IAAI,CAAC,CAAqB,EAAE,CAAqB,IAAa,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AAClI,SAAS,QAAQ,CAAC,CAAgB,IAAyF,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,IAAI,IAAI,EAAE,IAAI,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,OAAO,GAAa,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAAC,CAAC,IAAI,EAAE,CAAC;IAAC,OAAO,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;AAAC,CAAC;KAAM,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAAC,CAAC,IAAI,EAAE,CAAC;IAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;AAAC,CAAC,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAAC,CAAC,IAAI,EAAE,CAAC;IAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;AAAC,CAAC,CAAC,IAAI,8BAA8B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAAC,CAAC,IAAI,EAAE,CAAC;IAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;AAAC,CAAC,CAAC,IAAI,uDAAuD,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAAC,CAAC,IAAI,EAAE,CAAC;IAAC,OAAO,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;AAAC,CAAC,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;AAC5zB,SAAS,OAAO,CAAC,CAAa,EAAE,CAAwC;IACtE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,WAAW,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9N,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IACrD,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IACjF,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IACxD,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IACrD,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/E,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAC/D,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;IAAC,CAAC;IACnJ,OAAO,IAAI,CAAC;AACd,CAAC;AACD,SAAS,WAAW,CAAC,CAAa,IAAY,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAEhN,MAAM,UAAU,QAAQ,CAAC,MAA2B,EAAE,GAAkB;IACtE,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAAC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IAAC,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,IAAI,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,IAAI,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,KAAK,CAAC,eAAe,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC5a,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;IACjD,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,6BAA6B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;IACvJ,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;IAC1I,MAAM,UAAU,GAA2C,EAAE,CAAC;IAC9D,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE;QAAE,IAAI,OAAO,CAAC,CAAC,EAAE,EAAE,GAAG,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;YAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACrI,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;QAAC,MAAM,CAAC,GAAe,EAAE,EAAE,EAAE,eAAe,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,IAAI,uCAAuC,EAAE,CAAC;QAAC,IAAI,OAAO,CAAC,CAAC,EAAE,EAAE,GAAG,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;YAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;IAAC,CAAC;IACxQ,IAAI,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,uBAAuB,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,mCAAmC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;IACrP,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,sBAAsB,EAAE,CAAC;QAAC,IAAI,CAAC;YAAC,IAAI,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,kBAAkB,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,qCAAqC,OAAO,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,qFAAqF,CAAC,CAAC;IAAC,CAAC;IACtW,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7G,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAAC,IAAI,MAAM,GAAiB,QAAQ,EAAE,MAAM,IAAI,OAAO,CAAC;IAC3H,IAAI,CAAC,QAAQ,IAAI,KAAK,IAAI,CAAC,UAAU,CAAC,OAAO,IAAI,EAAE,CAAC;QAAE,MAAM,GAAG,OAAO,CAAC;SAAM,IAAI,CAAC,QAAQ,IAAI,KAAK,IAAI,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE,CAAC;QAAE,MAAM,GAAG,KAAK,CAAC;IAChJ,MAAM,MAAM,GAAG,QAAQ,EAAE,MAAM,IAAI,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,cAAc,KAAK,+BAA+B,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,cAAc,KAAK,qBAAqB,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,wDAAwD,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACxQ,MAAM,MAAM,GAAmB,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,EAAoB,CAAC;IACjN,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AACvH,CAAC"}

package/dist/prompts.d.ts

@@ -9,3 +9,4 @@ export interface TableRow {
     value: string;
 }
 export declare function renderTable(rows: TableRow[]): string;
+export declare function renderColumns(headers: string[], rows: string[][]): string;

package/dist/prompts.js

@@ -1,4 +1,5 @@
 import { emitKeypressEvents } from "node:readline";
+import { cyan, green, red } from "./color.js";
 // Arrow-key checkbox list, ending in a "Submit" row — ↑/↓ to move, space/enter to toggle the
 // highlighted box, enter on Submit to finish. Falls back to "everything pre-checked" when stdin
 // or stdout isn't a TTY (piped/non-interactive shells), since there's no way to drive arrow keys.
@@ -64,7 +65,10 @@ export async function checkbox(title, items) {
         process.stdin.on("keypress", onKeypress);
     });
 }
-const FRAMES = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"];
+// Beam's own spinner: a watchful eye that opens and closes — the owl keeping
+// an eye on your agents. Doubled ends hold the shut/wide-open frames a beat
+// longer, so it reads as a blink-and-pulse rather than a flat cycle.
+const FRAMES = ["·", "·", "∘", "○", "◎", "◉", "◉", "◎", "○", "∘"];
 // Runs `fn` while animating a spinner in place on the current line, then replaces it with a
 // ✔/✖ result line. Falls back to plain "label..." on a non-TTY stdout (nothing to animate).
 export async function withSpinner(label, fn) {
@@ -81,20 +85,20 @@ export async function withSpinner(label, fn) {
         }
     }
     let frame = 0;
-    process.stdout.write(`${FRAMES[0]} ${label}`);
+    process.stdout.write(`\x1b[?25l${cyan(FRAMES[0])} ${label}`);
     const timer = setInterval(() => {
         frame = (frame + 1) % FRAMES.length;
-        process.stdout.write(`\r${FRAMES[frame]} ${label}`);
-    }, 80);
+        process.stdout.write(`\r\x1b[K${cyan(FRAMES[frame])} ${label}`);
+    }, 110);
     try {
         const result = await fn();
         clearInterval(timer);
-        process.stdout.write(`\r✔ ${label}\n`);
+        process.stdout.write(`\r\x1b[K${green("✔")} ${label}\x1b[?25h\n`);
         return result;
     }
     catch (e) {
         clearInterval(timer);
-        process.stdout.write(`\r✖ ${label}\n`);
+        process.stdout.write(`\r\x1b[K${red("✖")} ${label}\x1b[?25h\n`);
         throw e;
     }
 }
@@ -110,4 +114,16 @@ export function renderTable(rows) {
     out.push(line("└", "┴", "┘"));
     return out.join("\n");
 }
+// Same box-drawing style as renderTable, but for arbitrary-width listings (e.g. 'beam agent
+// list') instead of a fixed label/value pair.
+export function renderColumns(headers, rows) {
+    const widths = headers.map((h, i) => Math.max(h.length, ...rows.map(r => (r[i] ?? "").length)));
+    const line = (l, m, r) => `${l}${widths.map(w => "─".repeat(w + 2)).join(m)}${r}`;
+    const fmt = (cells) => `│ ${cells.map((c, i) => (c ?? "").padEnd(widths[i])).join(" │ ")} │`;
+    const out = [line("┌", "┬", "┐"), fmt(headers), line("├", "┼", "┤")];
+    for (const row of rows)
+        out.push(fmt(row));
+    out.push(line("└", "┴", "┘"));
+    return out.join("\n");
+}
 //# sourceMappingURL=prompts.js.map

package/dist/prompts.js.map

@@ -1 +1 @@
-{"version":3,"file":"prompts.js","sourceRoot":"","sources":["../src/prompts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAInD,6FAA6F;AAC7F,gGAAgG;AAChG,kGAAkG;AAClG,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,KAAa,EAAE,KAAqB;IACjE,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC;IAClD,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,mBAAmB;IAElD,SAAS,MAAM,CAAC,KAAc;QAC5B,IAAI,CAAC,KAAK;YAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;QAC7D,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAC9G,KAAK,CAAC,IAAI,CAAC,KAAK,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC;QAC9D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClD,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACnB,OAAO,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAC;IAC/E,MAAM,CAAC,IAAI,CAAC,CAAC;IAEb,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;QACnC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC/B,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAEvB,SAAS,OAAO;YACd,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YACnC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACtB,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QACvD,CAAC;QAED,SAAS,UAAU,CAAC,IAAY,EAAE,GAAsC;YACtE,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC;gBAAC,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAAC,CAAC;iBAC9D,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBAAC,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;gBAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAAC,CAAC;iBAC9E,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBAAC,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC;gBAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAAC,CAAC;iBACzE,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC9B,IAAI,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;oBAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;oBAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAAC,CAAC;YAC/E,CAAC;iBAAM,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACjC,IAAI,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;oBAC5B,OAAO,EAAE,CAAC;oBACV,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAC7E,CAAC;qBAAM,CAAC;oBACN,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;oBAC/B,MAAM,CAAC,KAAK,CAAC,CAAC;gBAChB,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AAElE,4FAA4F;AAC5F,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,WAAW,CAAI,KAAa,EAAE,EAAoB;IACtE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,EAAE,EAAE,CAAC;YAC1B,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;YAC1B,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;YAC1B,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IAED,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;QAC7B,KAAK,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;QACpC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC;IACtD,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,EAAE,EAAE,CAAC;QAC1B,aAAa,CAAC,KAAK,CAAC,CAAC;QACrB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC;QACvC,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,aAAa,CAAC,KAAK,CAAC,CAAC;QACrB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC;QACvC,MAAM,CAAC,CAAC;IACV,CAAC;AACH,CAAC;AAID,mFAAmF;AACnF,MAAM,UAAU,WAAW,CAAC,IAAgB;IAC1C,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAC3H,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAClC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,GAAG,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACpF,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAC9B,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACxB,CAAC"}
+{"version":3,"file":"prompts.js","sourceRoot":"","sources":["../src/prompts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC;AAI9C,6FAA6F;AAC7F,gGAAgG;AAChG,kGAAkG;AAClG,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,KAAa,EAAE,KAAqB;IACjE,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC;IAClD,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,mBAAmB;IAElD,SAAS,MAAM,CAAC,KAAc;QAC5B,IAAI,CAAC,KAAK;YAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;QAC7D,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAC9G,KAAK,CAAC,IAAI,CAAC,KAAK,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC;QAC9D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClD,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACnB,OAAO,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAC;IAC/E,MAAM,CAAC,IAAI,CAAC,CAAC;IAEb,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;QACnC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC/B,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAEvB,SAAS,OAAO;YACd,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YACnC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACtB,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QACvD,CAAC;QAED,SAAS,UAAU,CAAC,IAAY,EAAE,GAAsC;YACtE,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC;gBAAC,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAAC,CAAC;iBAC9D,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBAAC,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;gBAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAAC,CAAC;iBAC9E,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBAAC,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC;gBAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAAC,CAAC;iBACzE,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC9B,IAAI,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;oBAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;oBAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAAC,CAAC;YAC/E,CAAC;iBAAM,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACjC,IAAI,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;oBAC5B,OAAO,EAAE,CAAC;oBACV,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAC7E,CAAC;qBAAM,CAAC;oBACN,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;oBAC/B,MAAM,CAAC,KAAK,CAAC,CAAC;gBAChB,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,6EAA6E;AAC7E,4EAA4E;AAC5E,qEAAqE;AACrE,MAAM,MAAM,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AAElE,4FAA4F;AAC5F,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,WAAW,CAAI,KAAa,EAAE,EAAoB;IACtE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,EAAE,EAAE,CAAC;YAC1B,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;YAC1B,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;YAC1B,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IAED,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;QAC7B,KAAK,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;QACpC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC;IAClE,CAAC,EAAE,GAAG,CAAC,CAAC;IAER,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,EAAE,EAAE,CAAC;QAC1B,aAAa,CAAC,KAAK,CAAC,CAAC;QACrB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC;QAClE,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,aAAa,CAAC,KAAK,CAAC,CAAC;QACrB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC;QAChE,MAAM,CAAC,CAAC;IACV,CAAC;AACH,CAAC;AAID,mFAAmF;AACnF,MAAM,UAAU,WAAW,CAAC,IAAgB;IAC1C,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAC3H,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAClC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,GAAG,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACpF,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAC9B,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACxB,CAAC;AAED,4FAA4F;AAC5F,8CAA8C;AAC9C,MAAM,UAAU,aAAa,CAAC,OAAiB,EAAE,IAAgB;IAC/D,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAChG,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAC1G,MAAM,GAAG,GAAG,CAAC,KAAe,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;IACvG,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACrE,KAAK,MAAM,GAAG,IAAI,IAAI;QAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3C,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAC9B,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACxB,CAAC"}

package/dist/run.d.ts

@@ -0,0 +1 @@
+export declare function runAgent(command: string, args: string[]): Promise<never>;

package/dist/run.js

@@ -0,0 +1,48 @@
+// `beam run <agent> [args...]` -- launches any agent CLI (claude, codex, cursor-agent, opencode,
+// gemini, or anything else) wrapped in a kernel-enforced sandbox when the current policy has
+// enforce-mode BLOCK rules naming specific commands. See src/sandbox.ts for the platform-specific
+// mechanics. This file just: reads the policy, asks sandbox.ts for a plan, and execs.
+//
+// Deliberately agent-agnostic: this file has no per-agent knowledge (unlike src/agents.ts, which
+// knows how to install hooks into each agent's own config format). Wrapping a process by PID tree
+// doesn't need that -- it works identically no matter what's being launched.
+import { spawn } from "node:child_process";
+import { readPolicy } from "./policy.js";
+import { buildSandboxPlan } from "./sandbox.js";
+export async function runAgent(command, args) {
+    if (!command) {
+        console.error("Usage: beam run <command> [args...]");
+        process.exit(2);
+    }
+    const bundle = await readPolicy();
+    const plan = buildSandboxPlan(bundle);
+    const [spawnCmd, ...prefixArgs] = plan ? plan.prefix : [command];
+    const spawnArgs = plan ? [...prefixArgs, command, ...args] : args;
+    if (plan)
+        console.error(`beam run: ${plan.summary}`);
+    const child = spawn(spawnCmd, spawnArgs, { stdio: "inherit" });
+    // Forward termination signals to the child so Ctrl-C etc. behave the same as running the
+    // agent directly -- otherwise the wrapper process alone would exit and orphan the child.
+    const forward = (signal) => { if (!child.killed)
+        child.kill(signal); };
+    process.on("SIGINT", forward);
+    process.on("SIGTERM", forward);
+    return new Promise((resolve, reject) => {
+        child.on("error", (error) => {
+            // Sandbox tool itself failed to launch (shouldn't happen given the checks in sandbox.ts,
+            // but never let that be the reason the agent doesn't run at all) -- retry unwrapped once.
+            if (plan) {
+                console.error(`beam run: sandbox launch failed (${error.message}); running unsandboxed.`);
+                const fallback = spawn(command, args, { stdio: "inherit" });
+                fallback.on("exit", (code, signal) => process.exit(signal ? 1 : (code ?? 1)));
+                fallback.on("error", reject);
+                return;
+            }
+            reject(error);
+        });
+        child.on("exit", (code, signal) => {
+            process.exit(signal ? 1 : (code ?? 0));
+        });
+    });
+}
+//# sourceMappingURL=run.js.map

package/dist/run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.js","sourceRoot":"","sources":["../src/run.ts"],"names":[],"mappings":"AAAA,iGAAiG;AACjG,6FAA6F;AAC7F,kGAAkG;AAClG,sFAAsF;AACtF,EAAE;AACF,iGAAiG;AACjG,kGAAkG;AAClG,6EAA6E;AAC7E,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEhD,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAe,EAAE,IAAc;IAC5D,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACrD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,CAAC,QAAQ,EAAE,GAAG,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,UAAU,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAElE,IAAI,IAAI;QAAE,OAAO,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IAErD,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IAE/D,yFAAyF;IACzF,yFAAyF;IACzF,MAAM,OAAO,GAAG,CAAC,MAAsB,EAAE,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACvF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC9B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAE/B,OAAO,IAAI,OAAO,CAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC5C,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC1B,yFAAyF;YACzF,0FAA0F;YAC1F,IAAI,IAAI,EAAE,CAAC;gBACT,OAAO,CAAC,KAAK,CAAC,oCAAoC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;gBAC1F,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;gBAC5D,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC9E,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBAC7B,OAAO;YACT,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YAChC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/sandbox.d.ts

@@ -0,0 +1,13 @@
+import type { PolicyBundle } from "./policy.js";
+export interface SandboxPlan {
+    /** Human-readable summary of what's being enforced, printed once at launch. */
+    summary: string;
+    /** Prefix to prepend to the user's command: the real invocation becomes [...prefix, ...cmd]. */
+    prefix: string[];
+}
+/**
+ * Best-effort sandbox plan for the current platform and policy. Returns null (no wrapping) if
+ * there's nothing to block, the platform has no supported sandbox tool, or the tool isn't
+ * installed -- callers should fall back to running the command directly in every null case.
+ */
+export declare function buildSandboxPlan(bundle: PolicyBundle | null): SandboxPlan | null;

package/dist/sandbox.js

@@ -0,0 +1,116 @@
+// Kernel-enforced process-tree sandboxing for `beam run`. Wraps whichever agent binary the user
+// launches (claude, codex, cursor-agent, opencode, gemini, or anything else -- this file has no
+// agent-specific knowledge) so that BLOCK-rule commands are unreachable to *every* descendant of
+// that process, independent of whether the agent itself cooperates with beam's PreToolUse hook.
+//
+// This is a second, independent layer underneath the existing hook contract (src/policy.ts
+// evaluate()), not a replacement for it -- the hook still fires first and is what lets an agent
+// explain *why* to the user. This is the backstop for when that cooperation doesn't happen.
+//
+// Fail-open by design everywhere: if the sandbox tool isn't installed, the platform isn't
+// supported yet (Windows), or resolving a binary's path fails, `beam run` still runs the agent
+// normally rather than refusing to launch it. Never let this be the thing that breaks an agent.
+import { execFileSync } from "node:child_process";
+import { mkdtempSync, realpathSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+/**
+ * Absolute, symlink-resolved paths on disk for every place `name` resolves to on PATH (there can
+ * be more than one). Resolution matters: sandbox-exec's process-exec* and bwrap's bind-mount both
+ * act on the real path the kernel execs, not a symlink pointing at it -- e.g. Homebrew installs
+ * `/opt/homebrew/bin/git` as a symlink into `../Cellar/git/<version>/bin/git`, and a deny rule
+ * written against the symlink path silently doesn't match the resolved exec.
+ */
+function resolveAllOnPath(name) {
+    try {
+        const out = execFileSync("which", ["-a", name], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+        const found = out.split("\n").map(l => l.trim()).filter(Boolean);
+        const real = found.map(p => { try {
+            return realpathSync(p);
+        }
+        catch {
+            return p;
+        } });
+        return Array.from(new Set([...found, ...real]));
+    }
+    catch {
+        return [];
+    }
+}
+function commandExists(bin) {
+    try {
+        execFileSync("which", [bin], { stdio: "ignore" });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Binary names named directly by an enforce-mode BLOCK rule -- these are what get sandboxed. */
+function blockedBinaryNames(bundle) {
+    if (bundle.rules.mode !== "enforce")
+        return [];
+    const names = new Set();
+    for (const rule of bundle.rules.rules ?? []) {
+        if (rule.action === "BLOCK" && rule.command && !/[*?]/.test(rule.command))
+            names.add(rule.command);
+    }
+    return Array.from(names);
+}
+function macosPlan(binaries) {
+    if (!commandExists("sandbox-exec"))
+        return null;
+    const resolved = binaries.flatMap(resolveAllOnPath);
+    if (!resolved.length)
+        return null;
+    const literals = resolved.map(p => `(literal "${p.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}")`).join(" ");
+    const profile = `(version 1)\n(allow default)\n(deny process-exec* ${literals})\n(deny process-fork ${literals})\n`;
+    const dir = mkdtempSync(join(tmpdir(), "beam-sandbox-"));
+    const profilePath = join(dir, "profile.sb");
+    writeFileSync(profilePath, profile, { mode: 0o600 });
+    return {
+        summary: `sandbox-exec: exec denied for ${resolved.join(", ")}`,
+        prefix: ["sandbox-exec", "-f", profilePath, "--"],
+    };
+}
+function linuxPlan(binaries) {
+    if (!commandExists("bwrap"))
+        return null;
+    const resolved = binaries.flatMap(resolveAllOnPath);
+    if (!resolved.length)
+        return null;
+    // Bind-mount /bin/false (or /usr/bin/false) over each blocked binary's path, inside a private
+    // mount namespace scoped to this process tree only -- the real binary and the rest of the
+    // filesystem are untouched outside that namespace.
+    const stub = commandExists("false") ? resolveAllOnPath("false")[0] : "/bin/false";
+    if (!stub)
+        return null;
+    const binds = resolved.flatMap(p => ["--ro-bind", stub, p]);
+    return {
+        summary: `bwrap: exec masked for ${resolved.join(", ")}`,
+        prefix: ["bwrap", "--bind", "/", "/", "--dev-bind", "/dev", "/dev", "--proc", "/proc", ...binds, "--"],
+    };
+}
+/**
+ * Best-effort sandbox plan for the current platform and policy. Returns null (no wrapping) if
+ * there's nothing to block, the platform has no supported sandbox tool, or the tool isn't
+ * installed -- callers should fall back to running the command directly in every null case.
+ */
+export function buildSandboxPlan(bundle) {
+    if (!bundle)
+        return null;
+    const binaries = blockedBinaryNames(bundle);
+    if (!binaries.length)
+        return null;
+    try {
+        if (process.platform === "darwin")
+            return macosPlan(binaries);
+        if (process.platform === "linux")
+            return linuxPlan(binaries);
+        return null; // Windows: no equivalent wired up yet; beam run still works, just unsandboxed.
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=sandbox.js.map

package/dist/sandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../src/sandbox.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,gGAAgG;AAChG,iGAAiG;AACjG,gGAAgG;AAChG,EAAE;AACF,2FAA2F;AAC3F,gGAAgG;AAChG,4FAA4F;AAC5F,EAAE;AACF,0FAA0F;AAC1F,+FAA+F;AAC/F,gGAAgG;AAChG,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACnE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAUjC;;;;;;GAMG;AACH,SAAS,gBAAgB,CAAC,IAAY;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC3G,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACjE,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC;YAAC,OAAO,YAAY,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,CAAC,CAAC;QAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACrF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,IAAI,CAAC;QACH,YAAY,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,iGAAiG;AACjG,SAAS,kBAAkB,CAAC,MAAoB;IAC9C,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAC/C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;QAC5C,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrG,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,SAAS,CAAC,QAAkB;IACnC,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACpD,IAAI,CAAC,QAAQ,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7G,MAAM,OAAO,GAAG,qDAAqD,QAAQ,yBAAyB,QAAQ,KAAK,CAAC;IACpH,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,CAAC;IACzD,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAC5C,aAAa,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrD,OAAO;QACL,OAAO,EAAE,iCAAiC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAC/D,MAAM,EAAE,CAAC,cAAc,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC;KAClD,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,QAAkB;IACnC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACpD,IAAI,CAAC,QAAQ,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAClC,8FAA8F;IAC9F,0FAA0F;IAC1F,mDAAmD;IACnD,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;IAClF,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5D,OAAO;QACL,OAAO,EAAE,0BAA0B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACxD,MAAM,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,KAAK,EAAE,IAAI,CAAC;KACvG,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAA2B;IAC1D,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,CAAC,QAAQ,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC9D,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;YAAE,OAAO,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC,CAAC,+EAA+E;IAC9F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/setup.js

@@ -7,7 +7,10 @@ import { installService } from "./service.js";
 import { openBrowser } from "./open-browser.js";
 import { getIdentityPath } from "./config.js";
 import { checkbox, renderTable, withSpinner } from "./prompts.js";
-const TOTAL_STEPS = 4;
+import { showFirstRunWelcome } from "./owl.js";
+import { syncPolicy } from "./forward.js";
+import { AGENT_BINARIES } from "./shims.js";
+const TOTAL_STEPS = 5;
 function step(n, title) {
     console.log(`\nStep ${n}/${TOTAL_STEPS}: ${title}`);
 }
@@ -35,10 +38,13 @@ export async function promptYesNo(question, defaultYes = true) {
 // sudo via runWithSudoFallback -- service install never does, since it must write into the
 // invoking user's own home directory, not root's.
 export async function runSetup() {
+    // Owl says hello, but only the first time this machine is ever set up.
+    await showFirstRunWelcome();
     console.log("Setting up Beam — 4 quick steps.");
     const agentRows = [];
     let dashboardStatus = "not connected";
     let serviceStatus = "not started";
+    let policyStatus = "not enrolled";
     // --- Step 1: detect agents, then let the user choose which ones get the hook ---
     step(1, "Detecting AI agents on this machine");
     const detected = await detectAgents();
@@ -67,6 +73,14 @@ export async function runSetup() {
         for (const a of skipped)
             console.log(`  — Skipped ${a.name} (run 'beam agent install ${a.id}' later if you change your mind)`);
     }
+    // Shims are never installed automatically -- writing into PATH resolution is a bigger footprint
+    // than a hook install, and this session has no way to also edit the user's shell rc for them.
+    // Just point at the exact command for whichever detected agents shims actually support.
+    const shimmable = detected.filter(a => AGENT_BINARIES[a.id]);
+    if (shimmable.length) {
+        console.log(`\n  Tip: to sandbox ${shimmable.map(a => a.name).join(", ")} automatically (no need to type 'beam run'), run:`);
+        console.log(`    beam shims install ${shimmable.map(a => a.id).join(" ")}`);
+    }
     // --- Step 2: connect this device to the dashboard (dashboard-v1, or BEAM_DASHBOARD_URL) ---
     step(2, "Connecting to your Beam dashboard");
     let identity = await readIdentity();
@@ -96,8 +110,31 @@ export async function runSetup() {
             console.log("  Skipped. Run 'beam connect' whenever you're ready.");
         }
     }
-    // --- Step 3: background collector service ---
-    step(3, "Starting the background collector");
+    // --- Step 3: fetch this device's effective policy (org + any user-level override), if enrolled ---
+    // A device can be enrolled from a previous `beam setup`/`beam enroll` run without this run ever
+    // reaching Step 2's connect branch above -- so this always runs off whatever `identity` ended up
+    // being, not just the freshly-connected path.
+    step(3, "Fetching your org's policy");
+    if (identity) {
+        const result = await withSpinner("Syncing policy", () => syncPolicy());
+        if (result.status === "updated") {
+            console.log(`  ✔ Policy v${result.version} synced (org + any user override, merged).`);
+            policyStatus = `synced (v${result.version})`;
+        }
+        else if (result.status === "unchanged") {
+            console.log("  ✔ Already up to date.");
+            policyStatus = "up to date";
+        }
+        else if (result.status === "unreachable") {
+            console.error("  ✖ Could not reach the Beam workspace — will retry automatically once the service is running.");
+            policyStatus = "unreachable (will retry)";
+        }
+    }
+    else {
+        console.log("  Skipped — device isn't connected to a dashboard yet.");
+    }
+    // --- Step 4: background collector service ---
+    step(4, "Starting the background collector");
     const shouldStart = await promptYesNo("  Start the beam background service now (survives reboot/logout)?");
     if (shouldStart) {
         try {
@@ -112,17 +149,20 @@ export async function runSetup() {
         console.log("  Skipped. Run 'beam service install' (background) or 'beam start' (foreground) whenever you want it running.");
         serviceStatus = "skipped";
     }
-    // --- Step 4: summary ---
-    step(4, "Done");
+    // --- Step 5: summary ---
+    step(5, "Done");
     console.log();
     console.log(renderTable([
         { label: "Agent hooks", value: agentRows.length ? agentRows.join(", ") : "none" },
         { label: "Dashboard", value: dashboardStatus },
+        { label: "Policy", value: policyStatus },
         { label: "Service", value: serviceStatus },
     ]));
     console.log("\nUseful next commands:");
     console.log("  beam studio          open the activity dashboard");
     console.log("  beam service status  check whether the collector is running");
     console.log("  beam agent list      check hook status per agent");
+    if (shimmable.length)
+        console.log(`  beam shims install ${shimmable.map(a => a.id).join(" ")}   sandbox ${shimmable.map(a => a.name).join(", ")} automatically`);
 }
 //# sourceMappingURL=setup.js.map

package/dist/setup.js.map

@@ -1 +1 @@
-{"version":3,"file":"setup.js","sourceRoot":"","sources":["../src/setup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAElE,MAAM,WAAW,GAAG,CAAC,CAAC;AACtB,SAAS,IAAI,CAAC,CAAS,EAAE,KAAa;IACpC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,WAAW,KAAK,KAAK,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,QAAgB,EAAE,UAAU,GAAG,IAAI;IACnE,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;IAC9C,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,GAAG,QAAQ,IAAI,MAAM,0CAA0C,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;QACzG,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7E,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,GAAG,QAAQ,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAClF,IAAI,CAAC,MAAM;YAAE,OAAO,UAAU,CAAC;QAC/B,OAAO,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,KAAK,EAAE,CAAC;IACb,CAAC;AACH,CAAC;AAED,8FAA8F;AAC9F,yFAAyF;AACzF,+FAA+F;AAC/F,+FAA+F;AAC/F,2FAA2F;AAC3F,kDAAkD;AAClD,MAAM,CAAC,KAAK,UAAU,QAAQ;IAC5B,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;IAEhD,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,IAAI,eAAe,GAAG,eAAe,CAAC;IACtC,IAAI,aAAa,GAAG,aAAa,CAAC;IAElC,kFAAkF;IAClF,IAAI,CAAC,CAAC,EAAE,qCAAqC,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAC;IACtC,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,IAAI,CAAC,CAAC,eAAe,CAAC,CAAC;IAChF,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,cAAc,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;IAElF,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACrB,OAAO,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC;IACjE,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,CAAC,IAAI,WAAW;YAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,uCAAuC,CAAC,CAAC;IACjG,CAAC;IAED,IAAI,WAAW,CAAC,MAAM,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAC3B,WAAW,WAAW,CAAC,MAAM,SAAS,WAAW,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,gCAAgC,EACzG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CACzD,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;QAClD,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,uBAAuB,KAAK,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;gBACnG,SAAS,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC1F,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,SAAS,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,cAAc,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC1F,CAAC;QACH,CAAC;QACD,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAChE,KAAK,MAAM,CAAC,IAAI,OAAO;YAAE,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,6BAA6B,CAAC,CAAC,EAAE,kCAAkC,CAAC,CAAC;IACjI,CAAC;IAED,6FAA6F;IAC7F,IAAI,CAAC,CAAC,EAAE,mCAAmC,CAAC,CAAC;IAC7C,IAAI,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAC;IACpC,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,CAAC,GAAG,CAAC,+BAA+B,QAAQ,CAAC,QAAQ,IAAI,CAAC,CAAC;QAClE,eAAe,GAAG,cAAc,QAAQ,CAAC,QAAQ,GAAG,CAAC;IACvD,CAAC;SAAM,CAAC;QACN,MAAM,aAAa,GAAG,MAAM,WAAW,CAAC,mDAAmD,CAAC,CAAC;QAC7F,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,OAAO,GAAG,MAAM,YAAY,EAAE,CAAC;YACrC,OAAO,CAAC,GAAG,CAAC,qCAAqC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;YAChE,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACzB,QAAQ,GAAG,MAAM,WAAW,CAAC,0CAA0C,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YAC/F,OAAO,CAAC,GAAG,CACT,iBAAiB,QAAQ,CAAC,KAAK,IAAI;gBACnC,iBAAiB,QAAQ,CAAC,OAAO,IAAI;gBACrC,iBAAiB,eAAe,EAAE,SAAS,CAC5C,CAAC;YACF,eAAe,GAAG,cAAc,QAAQ,CAAC,QAAQ,GAAG,CAAC;YAErD,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,8BAA8B,EAAE,GAAG,EAAE,CAAC,wBAAwB,CAAC,QAAS,CAAC,CAAC,CAAC;YAChH,IAAI,UAAU,CAAC,MAAM,KAAK,WAAW;gBAAE,OAAO,CAAC,GAAG,CAAC,4DAA4D,CAAC,CAAC;iBAC5G,IAAI,UAAU,CAAC,MAAM,KAAK,OAAO;gBAAE,OAAO,CAAC,KAAK,CAAC,wCAAwC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;YACpH,iGAAiG;QACnG,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAED,+CAA+C;IAC/C,IAAI,CAAC,CAAC,EAAE,mCAAmC,CAAC,CAAC;IAC7C,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC,mEAAmE,CAAC,CAAC;IAC3G,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,0CAA0C,EAAE,GAAG,EAAE,CAAC,cAAc,EAAE,CAAC,CAAC;YACrG,aAAa,GAAG,YAAY,MAAM,CAAC,QAAQ,GAAG,CAAC;QACjD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,aAAa,GAAG,WAAY,GAAa,CAAC,OAAO,EAAE,CAAC;QACtD,CAAC;IACH,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,+GAA+G,CAAC,CAAC;QAC7H,aAAa,GAAG,SAAS,CAAC;IAC5B,CAAC;IAED,0BAA0B;IAC1B,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;QACtB,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE;QACjF,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,eAAe,EAAE;QAC9C,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,EAAE;KAC3C,CAAC,CAAC,CAAC;IACJ,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;IACvC,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,CAAC,+DAA+D,CAAC,CAAC;IAC7E,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;AACpE,CAAC"}
+{"version":3,"file":"setup.js","sourceRoot":"","sources":["../src/setup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C,MAAM,WAAW,GAAG,CAAC,CAAC;AACtB,SAAS,IAAI,CAAC,CAAS,EAAE,KAAa;IACpC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,WAAW,KAAK,KAAK,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,QAAgB,EAAE,UAAU,GAAG,IAAI;IACnE,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;IAC9C,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,GAAG,QAAQ,IAAI,MAAM,0CAA0C,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;QACzG,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7E,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,GAAG,QAAQ,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAClF,IAAI,CAAC,MAAM;YAAE,OAAO,UAAU,CAAC;QAC/B,OAAO,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,KAAK,EAAE,CAAC;IACb,CAAC;AACH,CAAC;AAED,8FAA8F;AAC9F,yFAAyF;AACzF,+FAA+F;AAC/F,+FAA+F;AAC/F,2FAA2F;AAC3F,kDAAkD;AAClD,MAAM,CAAC,KAAK,UAAU,QAAQ;IAC5B,uEAAuE;IACvE,MAAM,mBAAmB,EAAE,CAAC;IAC5B,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;IAEhD,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,IAAI,eAAe,GAAG,eAAe,CAAC;IACtC,IAAI,aAAa,GAAG,aAAa,CAAC;IAClC,IAAI,YAAY,GAAG,cAAc,CAAC;IAElC,kFAAkF;IAClF,IAAI,CAAC,CAAC,EAAE,qCAAqC,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAC;IACtC,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,IAAI,CAAC,CAAC,eAAe,CAAC,CAAC;IAChF,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,cAAc,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;IAElF,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACrB,OAAO,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC;IACjE,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,CAAC,IAAI,WAAW;YAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,uCAAuC,CAAC,CAAC;IACjG,CAAC;IAED,IAAI,WAAW,CAAC,MAAM,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAC3B,WAAW,WAAW,CAAC,MAAM,SAAS,WAAW,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,gCAAgC,EACzG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CACzD,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;QAClD,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,uBAAuB,KAAK,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;gBACnG,SAAS,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC1F,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,SAAS,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,cAAc,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC1F,CAAC;QACH,CAAC;QACD,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAChE,KAAK,MAAM,CAAC,IAAI,OAAO;YAAE,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,6BAA6B,CAAC,CAAC,EAAE,kCAAkC,CAAC,CAAC;IACjI,CAAC;IAED,gGAAgG;IAChG,8FAA8F;IAC9F,wFAAwF;IACxF,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7D,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;QACrB,OAAO,CAAC,GAAG,CAAC,uBAAuB,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;QAC7H,OAAO,CAAC,GAAG,CAAC,0BAA0B,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,6FAA6F;IAC7F,IAAI,CAAC,CAAC,EAAE,mCAAmC,CAAC,CAAC;IAC7C,IAAI,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAC;IACpC,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,CAAC,GAAG,CAAC,+BAA+B,QAAQ,CAAC,QAAQ,IAAI,CAAC,CAAC;QAClE,eAAe,GAAG,cAAc,QAAQ,CAAC,QAAQ,GAAG,CAAC;IACvD,CAAC;SAAM,CAAC;QACN,MAAM,aAAa,GAAG,MAAM,WAAW,CAAC,mDAAmD,CAAC,CAAC;QAC7F,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,OAAO,GAAG,MAAM,YAAY,EAAE,CAAC;YACrC,OAAO,CAAC,GAAG,CAAC,qCAAqC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;YAChE,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACzB,QAAQ,GAAG,MAAM,WAAW,CAAC,0CAA0C,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YAC/F,OAAO,CAAC,GAAG,CACT,iBAAiB,QAAQ,CAAC,KAAK,IAAI;gBACnC,iBAAiB,QAAQ,CAAC,OAAO,IAAI;gBACrC,iBAAiB,eAAe,EAAE,SAAS,CAC5C,CAAC;YACF,eAAe,GAAG,cAAc,QAAQ,CAAC,QAAQ,GAAG,CAAC;YAErD,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,8BAA8B,EAAE,GAAG,EAAE,CAAC,wBAAwB,CAAC,QAAS,CAAC,CAAC,CAAC;YAChH,IAAI,UAAU,CAAC,MAAM,KAAK,WAAW;gBAAE,OAAO,CAAC,GAAG,CAAC,4DAA4D,CAAC,CAAC;iBAC5G,IAAI,UAAU,CAAC,MAAM,KAAK,OAAO;gBAAE,OAAO,CAAC,KAAK,CAAC,wCAAwC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;YACpH,iGAAiG;QACnG,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAED,oGAAoG;IACpG,gGAAgG;IAChG,iGAAiG;IACjG,8CAA8C;IAC9C,IAAI,CAAC,CAAC,EAAE,4BAA4B,CAAC,CAAC;IACtC,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,gBAAgB,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC;QACvE,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAAC,OAAO,CAAC,GAAG,CAAC,eAAe,MAAM,CAAC,OAAO,4CAA4C,CAAC,CAAC;YAAC,YAAY,GAAG,YAAY,MAAM,CAAC,OAAO,GAAG,CAAC;QAAC,CAAC;aACrK,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;YAAC,YAAY,GAAG,YAAY,CAAC;QAAC,CAAC;aAC3G,IAAI,MAAM,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;YAAC,OAAO,CAAC,KAAK,CAAC,gGAAgG,CAAC,CAAC;YAAC,YAAY,GAAG,0BAA0B,CAAC;QAAC,CAAC;IAC3M,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;IACxE,CAAC;IAED,+CAA+C;IAC/C,IAAI,CAAC,CAAC,EAAE,mCAAmC,CAAC,CAAC;IAC7C,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC,mEAAmE,CAAC,CAAC;IAC3G,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,0CAA0C,EAAE,GAAG,EAAE,CAAC,cAAc,EAAE,CAAC,CAAC;YACrG,aAAa,GAAG,YAAY,MAAM,CAAC,QAAQ,GAAG,CAAC;QACjD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,aAAa,GAAG,WAAY,GAAa,CAAC,OAAO,EAAE,CAAC;QACtD,CAAC;IACH,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,+GAA+G,CAAC,CAAC;QAC7H,aAAa,GAAG,SAAS,CAAC;IAC5B,CAAC;IAED,0BAA0B;IAC1B,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;QACtB,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE;QACjF,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,eAAe,EAAE;QAC9C,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE;QACxC,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,EAAE;KAC3C,CAAC,CAAC,CAAC;IACJ,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;IACvC,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,CAAC,+DAA+D,CAAC,CAAC;IAC7E,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;IAClE,IAAI,SAAS,CAAC,MAAM;QAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;AACnK,CAAC"}

package/dist/shims.d.ts

@@ -0,0 +1,13 @@
+export declare const AGENT_BINARIES: Record<string, string>;
+export declare function shimDir(): string;
+export interface ShimResult {
+    agentId: string;
+    binary: string;
+    status: "installed" | "not-found";
+}
+/** Writes shim scripts for the given agent ids (default: every known one) into shimDir(). */
+export declare function installShims(agentIds?: string[]): ShimResult[];
+export declare function uninstallShims(): void;
+export declare function listShims(): string[];
+/** Line to add to the shell's rc file so the shim dir wins PATH resolution. */
+export declare function pathExportLine(): string;

package/dist/shims.js

@@ -0,0 +1,85 @@
+// Makes `claude`, `codex`, etc. sandboxed automatically -- no one has to remember to type
+// `beam run claude`. A small shim directory goes at the *front* of PATH; each shim is a one-line
+// script that execs the real agent binary through `beam run`. Shells resolve PATH left-to-right,
+// so once the shim dir wins, typing the agent's normal name is enough.
+//
+// This only decides *whether an invocation goes through beam run* -- src/sandbox.ts still decides
+// (per the current policy) whether that actually wraps anything. So installing a shim for an
+// agent with no enforce-mode BLOCK rules is a harmless no-op, same as `beam run` itself.
+import { chmodSync, mkdirSync, readdirSync, realpathSync, rmSync, writeFileSync } from "node:fs";
+import { execFileSync } from "node:child_process";
+import { join } from "node:path";
+import { getBeamHome } from "./config.js";
+// Binary name actually typed at a shell prompt, which can differ from the agent's own internal
+// id (e.g. the "cursor" agent's CLI binary is `cursor-agent`, "claude-code"'s is `claude`).
+export const AGENT_BINARIES = {
+    "claude-code": "claude",
+    codex: "codex",
+    cursor: "cursor-agent",
+    "copilot-cli": "copilot",
+    gemini: "gemini",
+    opencode: "opencode",
+};
+export function shimDir() {
+    return join(getBeamHome(), "shims");
+}
+function resolveBeamBin() {
+    try {
+        const out = execFileSync("which", ["beam"], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+        return out ? realpathSync(out) : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** The real agent binary's path, skipping any match that's actually one of our own shims. */
+function resolveRealBinary(name) {
+    const dir = shimDir();
+    try {
+        const out = execFileSync("which", ["-a", name], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+        const candidate = out.split("\n").map(l => l.trim()).find(p => p && !p.startsWith(dir));
+        return candidate ? realpathSync(candidate) : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Writes shim scripts for the given agent ids (default: every known one) into shimDir(). */
+export function installShims(agentIds = Object.keys(AGENT_BINARIES)) {
+    const beamBin = resolveBeamBin();
+    if (!beamBin)
+        throw new Error("Could not resolve the `beam` binary on PATH -- run this from a shell where `beam` already works.");
+    mkdirSync(shimDir(), { recursive: true });
+    return agentIds.map((agentId) => {
+        const binary = AGENT_BINARIES[agentId];
+        if (!binary)
+            throw new Error(`Unknown agent id: ${agentId}`);
+        const real = resolveRealBinary(binary);
+        if (!real)
+            return { agentId, binary, status: "not-found" };
+        const script = `#!/bin/sh\n# Installed by \`beam shims install\` -- routes ${binary} through beam run's sandbox.\nexec "${beamBin}" run "${real}" "$@"\n`;
+        const path = join(shimDir(), binary);
+        writeFileSync(path, script, { mode: 0o755 });
+        chmodSync(path, 0o755);
+        return { agentId, binary, status: "installed" };
+    });
+}
+export function uninstallShims() {
+    try {
+        rmSync(shimDir(), { recursive: true, force: true });
+    }
+    catch { /* nothing to remove */ }
+}
+export function listShims() {
+    try {
+        return readdirSync(shimDir());
+    }
+    catch {
+        return [];
+    }
+}
+/** Line to add to the shell's rc file so the shim dir wins PATH resolution. */
+export function pathExportLine() {
+    return `export PATH="${shimDir()}:$PATH"`;
+}
+//# sourceMappingURL=shims.js.map

package/dist/shims.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shims.js","sourceRoot":"","sources":["../src/shims.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAC1F,iGAAiG;AACjG,iGAAiG;AACjG,uEAAuE;AACvE,EAAE;AACF,kGAAkG;AAClG,6FAA6F;AAC7F,yFAAyF;AACzF,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACjG,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,+FAA+F;AAC/F,4FAA4F;AAC5F,MAAM,CAAC,MAAM,cAAc,GAA2B;IACpD,aAAa,EAAE,QAAQ;IACvB,KAAK,EAAE,OAAO;IACd,MAAM,EAAE,cAAc;IACtB,aAAa,EAAE,SAAS;IACxB,MAAM,EAAE,QAAQ;IAChB,QAAQ,EAAE,UAAU;CACrB,CAAC;AAEF,MAAM,UAAU,OAAO;IACrB,OAAO,IAAI,CAAC,WAAW,EAAE,EAAE,OAAO,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,cAAc;IACrB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9G,OAAO,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,6FAA6F;AAC7F,SAAS,iBAAiB,CAAC,IAAY;IACrC,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC3G,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;QACxF,OAAO,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAID,6FAA6F;AAC7F,MAAM,UAAU,YAAY,CAAC,WAAqB,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC;IAC3E,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;IACjC,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,kGAAkG,CAAC,CAAC;IAClI,SAAS,CAAC,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE1C,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QAC9B,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,OAAO,EAAE,CAAC,CAAC;QAC7D,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,WAAoB,EAAE,CAAC;QACpE,MAAM,MAAM,GAAG,8DAA8D,MAAM,uCAAuC,OAAO,UAAU,IAAI,UAAU,CAAC;QAC1J,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC,CAAC;QACrC,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7C,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACvB,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,WAAoB,EAAE,CAAC;IAC3D,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,IAAI,CAAC;QAAC,MAAM,CAAC,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,uBAAuB,CAAC,CAAC;AAChG,CAAC;AAED,MAAM,UAAU,SAAS;IACvB,IAAI,CAAC;QAAC,OAAO,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,EAAE,CAAC;IAAC,CAAC;AAC7D,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,cAAc;IAC5B,OAAO,gBAAgB,OAAO,EAAE,SAAS,CAAC;AAC5C,CAAC"}

package/dist/store.d.ts

@@ -1,13 +1,29 @@
 import type { Event, Scan } from "./core.js";
+import type { ApprovalRequest, ApprovalDecision } from "./approvals.js";
+export type ApprovalAudit = {
+    event: string;
+    request_id: string;
+    policy_id?: string;
+    user?: string;
+    agent: string;
+    decision?: string;
+    timestamp: string;
+    reason?: string;
+};
 export declare class Store {
     readonly directory: string;
     events: Event[];
     scans: Scan[];
     reviews: Record<string, boolean>;
+    approvals: ApprovalRequest[];
+    approvalAudit: ApprovalAudit[];
     private queue;
     readonly maxEvents = 10000;
     constructor(directory: string);
     init(): Promise<void>;
+    addApproval(request: ApprovalRequest): Promise<ApprovalRequest>;
+    auditApproval(event: ApprovalAudit): Promise<ApprovalAudit>;
+    resolveApproval(requestId: string, decision: ApprovalDecision, approver: string, apply: (request: ApprovalRequest, decision: ApprovalDecision, approver: string) => ApprovalRequest): Promise<ApprovalRequest>;
     private serialized;
     private replace;
     addEvents(rows: Event[]): Promise<{