@agent-beam/beam 0.2.37 → 0.2.39

package/dist/agents.js

@@ -1,188 +1,34 @@
+import { HOOK_CATALOG, hookKind } from "./hook-catalog.js";
+import { mergeHookSpec, unmergeHookSpec } from "./hook-config.js";
 import { join } from "node:path";
-function obj(v) { return v && typeof v === "object" && !Array.isArray(v) ? v : {}; }
-function arr(v) { return Array.isArray(v) ? v : []; }
-// Claude Code, Codex, Cursor, and Gemini CLI all install into a `hooks.<Event>` array of
-// `{ matcher, hooks: [{ type: "command", command }] }` entries (Claude Code's own shape, which
-// Gemini CLI's settings.json also uses verbatim per geminicli.com/docs/hooks/reference).
-// A handful of events -- UserPromptSubmit (Claude/Codex) and BeforeAgent (Gemini) among them --
-// have no matcher concept at all (they always fire); the docs' own examples omit the field there
-// entirely rather than sending an empty string, so this does the same to avoid relying on an
-// "ignored" field being tolerated rather than rejected.
-const CLAUDE_STYLE_EVENTS_WITHOUT_MATCHER = new Set(["UserPromptSubmit", "BeforeAgent"]);
-function mergeClaudeStyleHooks(event) {
-    const supportsMatcher = !CLAUDE_STYLE_EVENTS_WITHOUT_MATCHER.has(event);
-    return (existing, command) => {
-        const hooks = obj(existing.hooks);
-        const list = arr(hooks[event]).map(obj);
-        const alreadyInstalled = list.some(entry => arr(entry.hooks).map(obj).some(h => h.command === command));
-        if (!alreadyInstalled)
-            list.push({ ...(supportsMatcher ? { matcher: "" } : {}), hooks: [{ type: "command", command }] });
-        return { ...existing, hooks: { ...hooks, [event]: list } };
-    };
-}
-// Cursor's own hooks.json instead nests `{ command, matcher }` directly under the event array.
-function mergeCursorHooks(event) {
-    return (existing, command) => {
-        const hooks = obj(existing.hooks);
-        const list = arr(hooks[event]).map(obj);
-        if (!list.some(entry => entry.command === command))
-            list.push({ command, matcher: ".*" });
-        return { version: existing.version ?? 1, ...existing, hooks: { ...hooks, [event]: list } };
-    };
-}
-// Copilot CLI's dedicated hook file uses `{ type: "command", bash, timeoutSec }` entries.
-function mergeCopilotHooks(event) {
-    return (existing, command) => {
-        const hooks = obj(existing.hooks);
-        const list = arr(hooks[event]).map(obj);
-        if (!list.some(entry => entry.bash === command))
-            list.push({ type: "command", bash: command, timeoutSec: 30 });
-        return { version: existing.version ?? 1, ...existing, hooks: { ...hooks, [event]: list } };
-    };
-}
-// Reverse of mergeClaudeStyleHooks: drops beam's command out of each entry's inner hooks array
-// (rather than the whole entry), so a user-added hook sharing the same matcher is left alone.
-function unmergeClaudeStyleHooks(event) {
-    return (existing, isOwnCommand) => {
-        const hooks = obj(existing.hooks);
-        if (!(event in hooks))
-            return existing;
-        const list = arr(hooks[event]).map(obj)
-            .map(entry => ({ ...entry, hooks: arr(entry.hooks).map(obj).filter(h => !isOwnCommand(String(h.command ?? ""))) }))
-            .filter(entry => arr(entry.hooks).length > 0);
-        return { ...existing, hooks: { ...hooks, [event]: list } };
-    };
-}
-// Reverse of mergeCursorHooks.
-function unmergeCursorHooks(event) {
-    return (existing, isOwnCommand) => {
-        const hooks = obj(existing.hooks);
-        if (!(event in hooks))
-            return existing;
-        const list = arr(hooks[event]).map(obj).filter(entry => !isOwnCommand(String(entry.command ?? "")));
-        return { ...existing, hooks: { ...hooks, [event]: list } };
-    };
-}
-// Reverse of mergeCopilotHooks.
-function unmergeCopilotHooks(event) {
-    return (existing, isOwnCommand) => {
-        const hooks = obj(existing.hooks);
-        if (!(event in hooks))
-            return existing;
-        const list = arr(hooks[event]).map(obj).filter(entry => !isOwnCommand(String(entry.bash ?? "")));
-        return { ...existing, hooks: { ...hooks, [event]: list } };
-    };
-}
-// Installs beam into more than one hook event (e.g. the tool-call gate *and* the prompt-submit
-// gate) by folding each single-event merger over the config in turn. A disabled agent only ever
-// reliably stops at the pre-action gate if that agent never calls a tool in a turn (pure chat) --
-// registering the prompt-submit event too means a disabled agent's policy.disabledAgents block
-// (see policy.ts's evaluate()) fires before the prompt is even processed, not just before a tool
-// call that may never come.
-function mergeAll(mergers) {
-    return (existing, command) => mergers.reduce((acc, merge) => merge(acc, command), existing);
-}
-function unmergeAll(unmergers) {
-    return (existing, isOwnCommand) => unmergers.reduce((acc, unmerge) => unmerge(acc, isOwnCommand), existing);
-}
-export const AGENTS = [
-    {
-        id: "claude-code", name: "Claude Code",
-        configs: [".claude/settings.json"], artifacts: [".claude/projects"],
-        hookConfigPath: ".claude/settings.json", hookEventName: "PreToolUse",
-        mergeHookConfig: mergeAll([mergeClaudeStyleHooks("PreToolUse"), mergeClaudeStyleHooks("UserPromptSubmit")]),
-        unmergeHookConfig: unmergeAll([unmergeClaudeStyleHooks("PreToolUse"), unmergeClaudeStyleHooks("UserPromptSubmit")]),
-        adapter: "passthrough", verifiedPayload: true,
-        notes: "Payload verified against code.claude.com/docs/en/hooks. Also installs UserPromptSubmit (same hookSpecificOutput.permissionDecision contract, just hookEventName: \"UserPromptSubmit\") so a disabled agent is stopped before the prompt is processed, not only at its first tool call."
-    },
-    {
-        id: "codex", name: "Codex",
-        configs: [".codex/config.toml"], artifacts: [".codex/sessions", ".codex/archived_sessions"],
-        hookConfigPath: ".codex/hooks.json", hookEventName: "PreToolUse",
-        mergeHookConfig: mergeAll([mergeClaudeStyleHooks("PreToolUse"), mergeClaudeStyleHooks("UserPromptSubmit")]),
-        unmergeHookConfig: unmergeAll([unmergeClaudeStyleHooks("PreToolUse"), unmergeClaudeStyleHooks("UserPromptSubmit")]),
-        adapter: "passthrough", verifiedPayload: true,
-        notes: "Same hooks.json shape and stdin payload fields as Claude Code (session_id, cwd, hook_event_name, tool_name, tool_input, tool_use_id). Also installs UserPromptSubmit for the same disabled-agent-at-prompt-time reason."
-    },
-    {
-        id: "cursor", name: "Cursor",
-        // ".cursor/hooks.json" is the file beam itself writes on install, so it can never be used to
-        // detect a pre-existing Cursor install (circular). The bare ".cursor" directory is what
-        // Cursor itself creates just from being used, so it's a real presence signal.
-        configs: [".cursor"], artifacts: [".cursor/projects"],
-        hookConfigPath: ".cursor/hooks.json", hookEventName: "preToolUse",
-        mergeHookConfig: mergeAll([mergeCursorHooks("preToolUse"), mergeCursorHooks("beforeSubmitPrompt")]),
-        unmergeHookConfig: unmergeAll([unmergeCursorHooks("preToolUse"), unmergeCursorHooks("beforeSubmitPrompt")]),
-        adapter: "passthrough", verifiedPayload: true,
-        notes: "Payload verified against cursor.com/docs/hooks; extra fields (model, conversation_id, ...) are ignored, not misread. Also installs beforeSubmitPrompt -- unlike preToolUse's permission field, that event's block contract is {continue: false, user_message} (see client.ts emitDeny)."
-    },
-    {
-        id: "copilot-cli", name: "GitHub Copilot CLI",
-        // Same circularity as Cursor above: ".copilot/hooks/beam.json" is our own output.
-        // ".copilot/config.json" is what the real Copilot CLI writes on its own first run.
-        configs: [".copilot/config.json"], artifacts: [".copilot/session-state"],
-        hookConfigPath: ".copilot/hooks/beam.json", hookEventName: "preToolUse",
-        mergeHookConfig: mergeAll([mergeCopilotHooks("preToolUse"), mergeCopilotHooks("userPromptSubmitted")]),
-        unmergeHookConfig: unmergeAll([unmergeCopilotHooks("preToolUse"), unmergeCopilotHooks("userPromptSubmitted")]),
-        adapter: "copilot-camel", verifiedPayload: true,
-        notes: "Payload verified against docs.github.com Copilot hooks reference (camelCase: sessionId, cwd, toolName, toolArgs). userPromptSubmitted is also installed for observation/audit only -- GitHub's docs state its stdout is ignored (no blocking contract), so a disabled agent is only actually stopped at its first preToolUse call."
-    },
-    {
-        id: "gemini", name: "Gemini CLI",
-        // ".gemini/settings.json" is our own write target (circular, like Cursor/Copilot above); the
-        // bare ".gemini" directory (created by any use of the Gemini CLI, e.g. mcp_config.json,
-        // projects/) is the reliable presence signal instead.
-        configs: [".gemini"], artifacts: [".gemini/tmp"],
-        hookConfigPath: ".gemini/settings.json", hookEventName: "BeforeTool",
-        // BeforeTool/BeforeAgent use the exact same {matcher, hooks: [{type, command}]} array shape
-        // as Claude Code's PreToolUse/UserPromptSubmit (geminicli.com/docs/hooks/reference) --
-        // beam previously targeted ".agents/hooks.json" with a "pre_tool_execution" event and a
-        // "beam-security" wrapper, which is actually the unrelated Gemini API "Managed Agents"
-        // sandbox hook contract (ai.google.dev/gemini-api/docs/agent-hooks), not Gemini CLI's own.
-        mergeHookConfig: mergeAll([mergeClaudeStyleHooks("BeforeTool"), mergeClaudeStyleHooks("BeforeAgent")]),
-        unmergeHookConfig: unmergeAll([unmergeClaudeStyleHooks("BeforeTool"), unmergeClaudeStyleHooks("BeforeAgent")]),
-        adapter: "gemini", verifiedPayload: true,
-        notes: "Payload verified against geminicli.com/docs/hooks/reference: stdin is flat (session_id, cwd, hook_event_name, tool_name, tool_input, prompt), not the nested tool_call shape the \"gemini\" adapter also tolerates as a defensive fallback. Also installs BeforeAgent so a disabled agent is stopped before the prompt reaches the model, not only at its first tool call; both events accept {decision: \"deny\", reason} and both also honor exit code 2 (see client.ts's EXIT_2_FAILS_CLOSED)."
-    },
-    {
-        id: "opencode", name: "OpenCode",
-        configs: [".config/opencode/opencode.json", ".config/opencode/opencode.jsonc"], artifacts: [".local/share/opencode"],
-        hookConfigPath: null, pluginPath: ".opencode/plugins/beam.ts", hookEventName: "tool.execute.before",
-        mergeHookConfig: null, unmergeHookConfig: null, adapter: "passthrough", verifiedPayload: true,
-        notes: "Uses OpenCode's native tool.execute.before plugin hook."
-    },
-    {
-        id: "hermes", name: "Hermes Agent",
-        configs: [".hermes"], artifacts: [],
-        hookConfigPath: ".hermes/config.yaml", hookEventName: "pre_tool_call",
-        mergeHookConfig: null, unmergeHookConfig: null, customInstall: true,
-        adapter: "pre-tool-alias", verifiedPayload: true,
-        notes: "Installs a shell hook under hooks.pre_tool_call in ~/.hermes/config.yaml (default profile), between beam:begin/beam:end comments. Stdin fields (hook_event_name, tool_name, tool_input, session_id, cwd) and the block contract ({decision: \"block\", reason} or exit 2) verified against hermes-agent.nousresearch.com/docs/user-guide/features/hooks; tool_input shapes per Hermes tool are not. Hermes asks you to approve the hook on first use, and a hook that errors or times out fails open unless fail_closed is set."
-    },
-    {
-        id: "openclaw", name: "OpenClaw",
-        configs: [".openclaw"], artifacts: [],
-        hookConfigPath: null, hookEventName: "before_tool_call",
-        mergeHookConfig: null, unmergeHookConfig: null, customInstall: true,
-        adapter: "pre-tool-alias", verifiedPayload: false,
-        notes: "OpenClaw has no hook config file: beam writes a small plugin that registers api.on(\"before_tool_call\") and links it with 'openclaw plugins install --link' and 'openclaw plugins enable'. Registration and the { block, blockReason } return follow docs.openclaw.ai/plugins/hooks and published plugins, but the event field names are not printed in a reference, so the plugin reads them defensively; treat enforcement as unverified until you see a real event."
-    },
-    {
-        id: "jev", name: "Jev (TypeSafe AI)",
-        // TypeSafe's own Jev tooling and at least half a dozen independent third-party CLIs
-        // (jev-cli, jev-axi, jev-guard, ...) each pick their own config layout, so unlike the
-        // agents above there's no single vendor-documented directory or hook contract to target.
-        // These are the paths seen across that ecosystem as of Sept 2026; treat as best-effort.
-        configs: [".config/jev", ".config/jev-axi", ".jev"], artifacts: [".config/jev-axi/stats"],
-        hookConfigPath: null, hookEventName: null,
-        mergeHookConfig: null, unmergeHookConfig: null,
-        adapter: "generic", verifiedPayload: false, unverifiedEcosystem: true,
-        notes: "Jev is TypeSafe AI's non-generative 'System One' judgment model (launched 2026-09-15), " +
-            "increasingly wired into other agents' tool-call gating (e.g. jev-guard) rather than run as " +
-            "a coding agent itself. No single vendor hook contract exists yet across the many third-party " +
-            "CLIs wrapping it, so this entry is discovery-only (config/artifact presence), not installable."
-    },
-];
+export const AGENTS = HOOK_CATALOG.map(spec => ({
+    id: spec.id, name: spec.name, configs: spec.id === "copilot-cli" ? [".copilot/config.json"] : [spec.detect], artifacts: { "claude-code": [".claude/projects"], codex: [".codex/sessions", ".codex/archived_sessions"], cursor: [".cursor/projects"], "copilot-cli": [".copilot/session-state"], gemini: [".gemini/tmp"], opencode: [".local/share/opencode"] }[spec.id] ?? [],
+    hookConfigPath: spec.format === "plugin" ? null : spec.path,
+    pluginPath: spec.format === "plugin" ? spec.path : null,
+    hookEventName: spec.events.find(e => hookKind(e) === "pre") ?? null,
+    hookEvents: spec.events,
+    customInstall: true,
+    mergeHookConfig: (existing, command) => mergeHookSpec(spec, existing, command),
+    unmergeHookConfig: (existing, own) => unmergeHookSpec(spec, existing, own),
+    adapter: ["claude-code", "codex", "cursor"].includes(spec.id) ? "passthrough" : spec.id === "hermes" ? "pre-tool-alias" : spec.id === "copilot-cli" || spec.id === "vscode" ? "copilot-camel" : spec.id === "gemini" ? "gemini" : "generic",
+    verifiedPayload: ["claude-code", "codex", "cursor", "copilot-cli", "gemini", "hermes"].includes(spec.id),
+    notes: "Configuration and payload mapping based on Numbat's host contracts; validate with a live session on your agent version. See docs/agent-hooks.md.",
+}));
+AGENTS.push({
+    id: "jev", name: "Jev (TypeSafe AI)",
+    // TypeSafe's own Jev tooling and at least half a dozen independent third-party CLIs
+    // (jev-cli, jev-axi, jev-guard, ...) each pick their own config layout, so unlike the
+    // agents above there's no single vendor-documented directory or hook contract to target.
+    // These are the paths seen across that ecosystem as of Sept 2026; treat as best-effort.
+    configs: [".config/jev", ".config/jev-axi", ".jev"], artifacts: [".config/jev-axi/stats"],
+    hookConfigPath: null, hookEventName: null,
+    mergeHookConfig: null, unmergeHookConfig: null,
+    adapter: "generic", verifiedPayload: false, unverifiedEcosystem: true,
+    notes: "Jev is TypeSafe AI's non-generative 'System One' judgment model (launched 2026-09-15), " +
+        "increasingly wired into other agents' tool-call gating (e.g. jev-guard) rather than run as " +
+        "a coding agent itself. No single vendor hook contract exists yet across the many third-party " +
+        "CLIs wrapping it, so this entry is discovery-only (config/artifact presence), not installable."
+});
 export function findAgent(id) {
     return AGENTS.find(a => a.id === id);
 }

package/dist/agents.js.map

@@ -1 +1 @@
-{"version":3,"file":"agents.js","sourceRoot":"","sources":["../src/agents.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AA8CjC,SAAS,GAAG,CAAC,CAAU,IAAS,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACzG,SAAS,GAAG,CAAC,CAAU,IAAe,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAEzE,yFAAyF;AACzF,+FAA+F;AAC/F,yFAAyF;AACzF,gGAAgG;AAChG,iGAAiG;AACjG,6FAA6F;AAC7F,wDAAwD;AACxD,MAAM,mCAAmC,GAAG,IAAI,GAAG,CAAC,CAAC,kBAAkB,EAAE,aAAa,CAAC,CAAC,CAAC;AACzF,SAAS,qBAAqB,CAAC,KAAa;IAC1C,MAAM,eAAe,GAAG,CAAC,mCAAmC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACxE,OAAO,CAAC,QAAa,EAAE,OAAe,EAAO,EAAE;QAC7C,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC;QACxG,IAAI,CAAC,gBAAgB;YAAE,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;QACzH,OAAO,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;IAC7D,CAAC,CAAC;AACJ,CAAC;AAED,+FAA+F;AAC/F,SAAS,gBAAgB,CAAC,KAAa;IACrC,OAAO,CAAC,QAAa,EAAE,OAAe,EAAO,EAAE;QAC7C,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1F,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,IAAI,CAAC,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;IAC7F,CAAC,CAAC;AACJ,CAAC;AAED,0FAA0F;AAC1F,SAAS,iBAAiB,CAAC,KAAa;IACtC,OAAO,CAAC,QAAa,EAAE,OAAe,EAAO,EAAE;QAC7C,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/G,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,IAAI,CAAC,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;IAC7F,CAAC,CAAC;AACJ,CAAC;AAED,+FAA+F;AAC/F,8FAA8F;AAC9F,SAAS,uBAAuB,CAAC,KAAa;IAC5C,OAAO,CAAC,QAAa,EAAE,YAA0C,EAAO,EAAE;QACxE,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC;YAAE,OAAO,QAAQ,CAAC;QACvC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;aACpC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;aAClH,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAChD,OAAO,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;IAC7D,CAAC,CAAC;AACJ,CAAC;AAED,+BAA+B;AAC/B,SAAS,kBAAkB,CAAC,KAAa;IACvC,OAAO,CAAC,QAAa,EAAE,YAA0C,EAAO,EAAE;QACxE,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC;YAAE,OAAO,QAAQ,CAAC;QACvC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACpG,OAAO,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;IAC7D,CAAC,CAAC;AACJ,CAAC;AAED,gCAAgC;AAChC,SAAS,mBAAmB,CAAC,KAAa;IACxC,OAAO,CAAC,QAAa,EAAE,YAA0C,EAAO,EAAE;QACxE,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC;YAAE,OAAO,QAAQ,CAAC;QACvC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACjG,OAAO,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;IAC7D,CAAC,CAAC;AACJ,CAAC;AAED,+FAA+F;AAC/F,gGAAgG;AAChG,kGAAkG;AAClG,+FAA+F;AAC/F,iGAAiG;AACjG,4BAA4B;AAC5B,SAAS,QAAQ,CAAC,OAAuD;IACvE,OAAO,CAAC,QAAa,EAAE,OAAe,EAAO,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;AAChH,CAAC;AACD,SAAS,UAAU,CAAC,SAAoF;IACtG,OAAO,CAAC,QAAa,EAAE,YAA0C,EAAO,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,QAAQ,CAAC,CAAC;AACtJ,CAAC;AAED,MAAM,CAAC,MAAM,MAAM,GAAsB;IACvC;QACE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,aAAa;QACtC,OAAO,EAAE,CAAC,uBAAuB,CAAC,EAAE,SAAS,EAAE,CAAC,kBAAkB,CAAC;QACnE,cAAc,EAAE,uBAAuB,EAAE,aAAa,EAAE,YAAY;QACpE,eAAe,EAAE,QAAQ,CAAC,CAAC,qBAAqB,CAAC,YAAY,CAAC,EAAE,qBAAqB,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC3G,iBAAiB,EAAE,UAAU,CAAC,CAAC,uBAAuB,CAAC,YAAY,CAAC,EAAE,uBAAuB,CAAC,kBAAkB,CAAC,CAAC,CAAC;QACnH,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,IAAI;QAC7C,KAAK,EAAE,wRAAwR;KAChS;IACD;QACE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO;QAC1B,OAAO,EAAE,CAAC,oBAAoB,CAAC,EAAE,SAAS,EAAE,CAAC,iBAAiB,EAAE,0BAA0B,CAAC;QAC3F,cAAc,EAAE,mBAAmB,EAAE,aAAa,EAAE,YAAY;QAChE,eAAe,EAAE,QAAQ,CAAC,CAAC,qBAAqB,CAAC,YAAY,CAAC,EAAE,qBAAqB,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC3G,iBAAiB,EAAE,UAAU,CAAC,CAAC,uBAAuB,CAAC,YAAY,CAAC,EAAE,uBAAuB,CAAC,kBAAkB,CAAC,CAAC,CAAC;QACnH,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,IAAI;QAC7C,KAAK,EAAE,yNAAyN;KACjO;IACD;QACE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ;QAC5B,6FAA6F;QAC7F,wFAAwF;QACxF,8EAA8E;QAC9E,OAAO,EAAE,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC,kBAAkB,CAAC;QACrD,cAAc,EAAE,oBAAoB,EAAE,aAAa,EAAE,YAAY;QACjE,eAAe,EAAE,QAAQ,CAAC,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAAE,gBAAgB,CAAC,oBAAoB,CAAC,CAAC,CAAC;QACnG,iBAAiB,EAAE,UAAU,CAAC,CAAC,kBAAkB,CAAC,YAAY,CAAC,EAAE,kBAAkB,CAAC,oBAAoB,CAAC,CAAC,CAAC;QAC3G,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,IAAI;QAC7C,KAAK,EAAE,yRAAyR;KACjS;IACD;QACE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,oBAAoB;QAC7C,kFAAkF;QAClF,mFAAmF;QACnF,OAAO,EAAE,CAAC,sBAAsB,CAAC,EAAE,SAAS,EAAE,CAAC,wBAAwB,CAAC;QACxE,cAAc,EAAE,0BAA0B,EAAE,aAAa,EAAE,YAAY;QACvE,eAAe,EAAE,QAAQ,CAAC,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,iBAAiB,CAAC,qBAAqB,CAAC,CAAC,CAAC;QACtG,iBAAiB,EAAE,UAAU,CAAC,CAAC,mBAAmB,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC,qBAAqB,CAAC,CAAC,CAAC;QAC9G,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,IAAI;QAC/C,KAAK,EAAE,oUAAoU;KAC5U;IACD;QACE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY;QAChC,6FAA6F;QAC7F,wFAAwF;QACxF,sDAAsD;QACtD,OAAO,EAAE,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC,aAAa,CAAC;QAChD,cAAc,EAAE,uBAAuB,EAAE,aAAa,EAAE,YAAY;QACpE,4FAA4F;QAC5F,uFAAuF;QACvF,wFAAwF;QACxF,uFAAuF;QACvF,2FAA2F;QAC3F,eAAe,EAAE,QAAQ,CAAC,CAAC,qBAAqB,CAAC,YAAY,CAAC,EAAE,qBAAqB,CAAC,aAAa,CAAC,CAAC,CAAC;QACtG,iBAAiB,EAAE,UAAU,CAAC,CAAC,uBAAuB,CAAC,YAAY,CAAC,EAAE,uBAAuB,CAAC,aAAa,CAAC,CAAC,CAAC;QAC9G,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI;QACxC,KAAK,EAAE,meAAme;KAC3e;IACD;QACE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU;QAChC,OAAO,EAAE,CAAC,gCAAgC,EAAE,iCAAiC,CAAC,EAAE,SAAS,EAAE,CAAC,uBAAuB,CAAC;QACpH,cAAc,EAAE,IAAI,EAAE,UAAU,EAAE,2BAA2B,EAAE,aAAa,EAAE,qBAAqB;QACnG,eAAe,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,IAAI;QAC7F,KAAK,EAAE,yDAAyD;KACjE;IACD;QACE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc;QAClC,OAAO,EAAE,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,EAAE;QACnC,cAAc,EAAE,qBAAqB,EAAE,aAAa,EAAE,eAAe;QACrE,eAAe,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI;QACnE,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,IAAI;QAChD,KAAK,EAAE,igBAAigB;KACzgB;IACD;QACE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU;QAChC,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE,SAAS,EAAE,EAAE;QACrC,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE,kBAAkB;QACvD,eAAe,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI;QACnE,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,KAAK;QACjD,KAAK,EAAE,ycAAyc;KACjd;IACD;QACE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB;QACpC,oFAAoF;QACpF,sFAAsF;QACtF,yFAAyF;QACzF,wFAAwF;QACxF,OAAO,EAAE,CAAC,aAAa,EAAE,iBAAiB,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,uBAAuB,CAAC;QACzF,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI;QACzC,eAAe,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI;QAC9C,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,KAAK,EAAE,mBAAmB,EAAE,IAAI;QACrE,KAAK,EAAE,yFAAyF;YAC9F,6FAA6F;YAC7F,+FAA+F;YAC/F,gGAAgG;KACnG;CACF,CAAC;AAEF,MAAM,UAAU,SAAS,CAAC,EAAU;IAClC,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAsB,EAAE,IAAY;IACrE,IAAI,CAAC,KAAK,CAAC,cAAc;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,IAAI,yCAAyC,CAAC,CAAC;IACnG,OAAO,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;AAC1C,CAAC"}
+{"version":3,"file":"agents.js","sourceRoot":"","sources":["../src/agents.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AA+CjC,MAAM,CAAC,MAAM,MAAM,GAAsB,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,KAAK,aAAa,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAG,EAAE,aAAa,EAAE,CAAC,kBAAkB,CAAC,EAAE,KAAK,EAAE,CAAC,iBAAiB,EAAE,0BAA0B,CAAC,EAAE,MAAM,EAAE,CAAC,kBAAkB,CAAC,EAAE,aAAa,EAAE,CAAC,wBAAwB,CAAC,EAAE,MAAM,EAAE,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,CAAC,uBAAuB,CAAC,EAA+B,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE;IAC3Y,cAAc,EAAE,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI;IAC3D,UAAU,EAAE,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;IACvD,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI;IACnE,UAAU,EAAE,IAAI,CAAC,MAAM;IACvB,aAAa,EAAE,IAAI;IACnB,eAAe,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC;IAC9E,iBAAiB,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC;IAC1E,OAAO,EAAE,CAAC,aAAa,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,aAAa,IAAI,IAAI,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;IAC3O,eAAe,EAAE,CAAC,aAAa,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;IACxG,KAAK,EAAE,kJAAkJ;CAC1J,CAAC,CAAC,CAAC;AACJ,MAAM,CAAC,IAAI,CACX;IACI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB;IACpC,oFAAoF;IACpF,sFAAsF;IACtF,yFAAyF;IACzF,wFAAwF;IACxF,OAAO,EAAE,CAAC,aAAa,EAAE,iBAAiB,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,uBAAuB,CAAC;IACzF,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI;IACzC,eAAe,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI;IAC9C,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,KAAK,EAAE,mBAAmB,EAAE,IAAI;IACrE,KAAK,EAAE,yFAAyF;QAC9F,6FAA6F;QAC7F,+FAA+F;QAC/F,gGAAgG;CACnG,CAAC,CAAC;AAEL,MAAM,UAAU,SAAS,CAAC,EAAU;IAClC,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAsB,EAAE,IAAY;IACrE,IAAI,CAAC,KAAK,CAAC,cAAc;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,IAAI,yCAAyC,CAAC,CAAC;IACnG,OAAO,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;AAC1C,CAAC"}

package/dist/behavioral-anomaly.d.ts

@@ -0,0 +1,16 @@
+/** The rolling window an action burst is measured over. */
+export declare const ANOMALY_WINDOW_MS: number;
+/** High/critical-severity actions within the window that count as a burst. */
+export declare const ANOMALY_THRESHOLD = 5;
+export interface AnomalyResult {
+    triggered: boolean;
+    count: number;
+    windowMinutes: number;
+}
+/**
+ * Records one HIGH/CRITICAL-severity action for `sessionId` (a LOW/MEDIUM `riskLevel` is a
+ * no-op: it still prunes/persists housekeeping but never adds an event or can trigger), and
+ * reports whether this session has hit `ANOMALY_THRESHOLD` such actions within
+ * `ANOMALY_WINDOW_MS`. `home` is the beam data directory (injectable for tests).
+ */
+export declare function recordAndCheckAnomaly(sessionId: string, riskLevel: string, home?: string): Promise<AnomalyResult>;

package/dist/behavioral-anomaly.js

@@ -0,0 +1,66 @@
+// Behavioral anomaly detection: flags a burst of high/critical-severity actions from one agent
+// session within a short window, independent of whether any single action was individually
+// blocked. An agent that's been talked into a chain of risky actions (prompt injection, a
+// compromised skill, a confused multi-step plan) often shows this shape even when each step
+// individually only rates "ask" rather than "deny" -- worth a human's attention as a pattern,
+// not just as isolated findings. Node-only (fs-backed session state), called from the CLI hook
+// path in client.ts only -- same separation from data-detectors.ts/rule-catalog.ts as
+// entity-redaction.ts, which stay pure so they can keep backing the edge-runtime SDK path.
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { getDataDirectory } from "./config.js";
+import { withFileLock } from "./file-lock.js";
+function activityPath(home) {
+    return join(home, "behavioral-activity.json");
+}
+async function readActivity(home) {
+    try {
+        return JSON.parse(await readFile(activityPath(home), "utf8"));
+    }
+    catch {
+        return {};
+    }
+}
+async function writeActivity(map, home) {
+    const path = activityPath(home);
+    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+    await writeFile(path, `${JSON.stringify(map, null, 2)}\n`, { mode: 0o600 });
+}
+/** The rolling window an action burst is measured over. */
+export const ANOMALY_WINDOW_MS = 10 * 60 * 1000; // 10 minutes
+/** High/critical-severity actions within the window that count as a burst. */
+export const ANOMALY_THRESHOLD = 5;
+// A session with no new high/critical event in this long is dropped entirely, so the file
+// doesn't grow forever -- only timestamps live here, nothing sensitive either way.
+const SESSION_TTL_MS = 24 * 60 * 60 * 1000;
+/**
+ * Records one HIGH/CRITICAL-severity action for `sessionId` (a LOW/MEDIUM `riskLevel` is a
+ * no-op: it still prunes/persists housekeeping but never adds an event or can trigger), and
+ * reports whether this session has hit `ANOMALY_THRESHOLD` such actions within
+ * `ANOMALY_WINDOW_MS`. `home` is the beam data directory (injectable for tests).
+ */
+export async function recordAndCheckAnomaly(sessionId, riskLevel, home = getDataDirectory()) {
+    if (!sessionId)
+        return { triggered: false, count: 0, windowMinutes: ANOMALY_WINDOW_MS / 60_000 };
+    // Locked end-to-end (read, mutate, write) so concurrent tool calls in the same turn -- each
+    // spawning its own `beam hook` process -- don't lose each other's increments to a read-write
+    // race (see file-lock.ts). Without this, a genuine 5-action parallel burst could collapse to
+    // a single persisted event, since every process would independently read "0 prior events".
+    return withFileLock(activityPath(home), async () => {
+        const map = await readActivity(home);
+        const now = Date.now();
+        for (const [id, session] of Object.entries(map)) {
+            const last = session.events.at(-1) ?? 0;
+            if (now - last > SESSION_TTL_MS)
+                delete map[id];
+        }
+        const session = map[sessionId] ?? { events: [] };
+        if (riskLevel === "HIGH" || riskLevel === "CRITICAL")
+            session.events.push(now);
+        session.events = session.events.filter(at => now - at <= ANOMALY_WINDOW_MS);
+        map[sessionId] = session;
+        await writeActivity(map, home).catch(() => { });
+        return { triggered: session.events.length >= ANOMALY_THRESHOLD, count: session.events.length, windowMinutes: ANOMALY_WINDOW_MS / 60_000 };
+    });
+}
+//# sourceMappingURL=behavioral-anomaly.js.map

package/dist/behavioral-anomaly.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"behavioral-anomaly.js","sourceRoot":"","sources":["../src/behavioral-anomaly.ts"],"names":[],"mappings":"AAAA,+FAA+F;AAC/F,2FAA2F;AAC3F,0FAA0F;AAC1F,4FAA4F;AAC5F,8FAA8F;AAC9F,+FAA+F;AAC/F,sFAAsF;AACtF,2FAA2F;AAC3F,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAK9C,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,IAAI,CAAC,IAAI,EAAE,0BAA0B,CAAC,CAAC;AAChD,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,IAAY;IACtC,IAAI,CAAC;QAAC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAiB,CAAC;IAAC,CAAC;IACtF,MAAM,CAAC;QAAC,OAAO,EAAE,CAAC;IAAC,CAAC;AACtB,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,GAAiB,EAAE,IAAY;IAC1D,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7D,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,2DAA2D;AAC3D,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,aAAa;AAC9D,8EAA8E;AAC9E,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC;AACnC,0FAA0F;AAC1F,mFAAmF;AACnF,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAI3C;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,SAAiB,EAAE,SAAiB,EAAE,IAAI,GAAG,gBAAgB,EAAE;IAE/D,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,aAAa,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAAC;IAEjG,4FAA4F;IAC5F,6FAA6F;IAC7F,6FAA6F;IAC7F,2FAA2F;IAC3F,OAAO,YAAY,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,IAAI,EAAE;QACjD,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACxC,IAAI,GAAG,GAAG,IAAI,GAAG,cAAc;gBAAE,OAAO,GAAG,CAAC,EAAE,CAAC,CAAC;QAClD,CAAC;QAED,MAAM,OAAO,GAAoB,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QAClE,IAAI,SAAS,KAAK,MAAM,IAAI,SAAS,KAAK,UAAU;YAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/E,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,IAAI,iBAAiB,CAAC,CAAC;QAC5E,GAAG,CAAC,SAAS,CAAC,GAAG,OAAO,CAAC;QAEzB,MAAM,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAwE,CAAC,CAAC,CAAC;QAErH,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,iBAAiB,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAAC;IAC5I,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/cli.js

@@ -11,7 +11,7 @@ import { configuredPort, installService, serviceLogPaths, serviceStatus, startSe
 import { waitForCollectorUp } from "./collector-health.js";
 import { getBeamHome, getCollectorUrl, getDataDirectory, getIdentityPath } from "./config.js";
 import { clearIdentity, readIdentity } from "./enroll.js";
-import { startConnect } from "./connect.js";
+import { PlanLimitError, startConnect } from "./connect.js";
 import { runSetup, promptYesNo } from "./setup.js";
 import { installEnterprisePackage } from "./enterprise-install.js";
 import { fetchAccount, revokeDevice } from "./account.js";
@@ -423,7 +423,20 @@ program.command("connect")
     const session = await startConnect();
     console.log(`Connect Beam CLI to Agentbeam:\n${cyan(session.url)}\n`);
     openBrowser(session.url);
-    const identity = await withSpinner("Waiting for you to finish in the browser", () => session.poll());
+    let identity;
+    try {
+        identity = await withSpinner("Waiting for you to finish in the browser", () => session.poll());
+    }
+    catch (error) {
+        if (!(error instanceof PlanLimitError))
+            throw error;
+        console.error(`✖ ${error.message}`);
+        console.error(existing
+            ? "  This device stays connected as before."
+            : "  Beam keeps protecting this machine locally. Run 'beam connect' again once there's room.");
+        process.exitCode = 1;
+        return;
+    }
     console.log(`${green("✔")} Connected device ${identity.deviceId}\n` +
         `  org:      ${identity.orgId}\n` +
         `  api:      ${identity.apiBase}\n` +
@@ -844,27 +857,31 @@ mcp.command("proxy")
     .argument("[args...]", "arguments passed to the MCP server")
     .action(async (command, args) => { process.exitCode = await runMcpProxy(command, args ?? []); });
 program.command("hook")
-    .description("Forward a hook payload from stdin for the given agent (observation only, never blocks the agent). Payload field names are adapted per agent; see 'beam agent list'.")
+    .description("Capture an agent lifecycle payload and apply workspace policy at supported pre-action gates")
     .argument("[source-agent]", "reporting agent id, e.g. claude-code, codex, cursor, copilot-cli", "claude-code")
-    .action(async (sourceAgent) => captureHook(sourceAgent));
+    .option("--event <name>", "Native event name supplied by the installed hook")
+    .action(async (sourceAgent, options) => captureHook(sourceAgent, undefined, options.event));
 const agent = program.command("agent").description("Discover and configure supported AI agents");
 agent.command("list")
     .alias("ls")
     .description("List supported agents and their hook payload verification status")
-    .action(() => {
+    .option("--events", "Include all configured lifecycle event names")
+    .action((options) => {
     const rows = AGENTS.map(a => [
         a.id,
         a.name,
-        a.hookConfigPath ? "installable" : "config wiring not built yet",
+        a.id === "openhands" ? "project-scoped" : a.customInstall || a.hookConfigPath ? "installable" : "discovery only",
         a.verifiedPayload ? "payload verified" : "payload best-effort",
+        ...(options.events ? [(a.hookEvents ?? []).join(", ")] : []),
     ]);
-    console.log(renderColumns(["id", "name", "status", "payload"], rows));
+    console.log(renderColumns(["id", "name", "status", "payload", ...(options.events ? ["events"] : [])], rows));
 });
 agent.command("install")
     .description("Wire beam's hook into an agent's own hook config file, without disturbing existing hooks")
     .argument("<agent>", "agent id, e.g. claude-code, codex, cursor, copilot-cli")
-    .action(async (agentId) => {
-    const result = await installHook(agentId);
+    .option("--settings <path>", "Explicit hook config path (required for OpenHands project hooks)")
+    .action(async (agentId, options) => {
+    const result = await installHook(agentId, undefined, options.settings);
     await recordExpectedHooks();
     console.log(result.alreadyInstalled ? `✔ Already installed for ${result.agent}\n  → ${result.path}` : `✔ Installed beam hook for ${result.agent}\n  → ${result.path}`);
     if (result.note)
@@ -874,6 +891,7 @@ agent.command("uninstall")
     .description("Detach beam's hook from a single agent's own hook config, leaving everything else installed")
     .argument("<agent>", "agent id, e.g. claude-code, codex, cursor, copilot-cli")
     .option("--yes", "skip the confirmation prompt")
+    .option("--settings <path>", "Explicit hook config path")
     .action(async (agentId, options) => {
     const identity = await readIdentity();
     const proceed = await confirmControlAction(`This will detach beam's hook from ${agentId}. Its activity will no longer be observed or policy-enforced by beam.`, identity, options.yes);
@@ -883,7 +901,7 @@ agent.command("uninstall")
     }
     if (identity)
         await reportControlEvent(`agent-uninstall-${agentId}`, `Beam hook detached from ${agentId} on ${identity.hostname}`, `This device ran 'beam agent uninstall ${agentId}'. ${agentId} is no longer being observed or policy-enforced by beam.`);
-    const result = await uninstallHook(agentId);
+    const result = await uninstallHook(agentId, undefined, options.settings);
     await recordExpectedHooks();
     console.log(result.removed ? `✔ Detached beam's hook from ${result.agent}\n  → ${result.path}` : `— No beam hook found for ${result.agent}.`);
     if (result.note)