@agent-beam/beam 0.2.37 → 0.2.39

package/dist/client.js

@@ -1,3 +1,8 @@
+import { spoolHookEvent } from "./hook-spool.js";
+import { hookKind } from "./hook-catalog.js";
+import { activityFor, commandOf } from "./activity.js";
+import { classifyActionContext } from "./action-context.js";
+import { environmentRisk } from "./access-risk.js";
 import { mkdir, open, readdir, readFile, rename, stat, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { isAbsolute, join, relative, resolve, sep } from "node:path";
@@ -9,6 +14,8 @@ import { evaluate, readPolicy } from "./policy.js";
 import { extractAgent } from "./extract.js";
 import { loadCustomRules } from "./custom-rules.js";
 import { redactSensitive } from "./data-detectors.js";
+import { redactWithSessionEntities } from "./entity-redaction.js";
+import { recordAndCheckAnomaly } from "./behavioral-anomaly.js";
 import { applyJevHook } from "./jev.js";
 import { applyJudgeHook } from "./judge.js";
 import { isPathTrusted, readTrustedPaths } from "./trusted-paths.js";
@@ -405,17 +412,38 @@ async function readStdin(limitBytes) {
     return input;
 }
 // Never throws: best-effort capture must not suppress configured policy enforcement.
-export async function captureHook(sourceAgent = "claude-code", home = homedir()) {
+export async function captureHook(sourceAgent = "claude-code", home = homedir(), suppliedEvent) {
+    let canBlock = suppliedEvent === undefined || hookKind(suppliedEvent) === "pre";
     try {
-        const input = await readStdin(100_000);
+        const input = await readStdin(2_000_000);
         const raw = JSON.parse(input);
-        let data = adaptHookPayload(sourceAgent, raw);
+        let data = adaptHookPayload(sourceAgent, raw, suppliedEvent);
+        sourceAgent = String(data.source_agent ?? sourceAgent);
         data.source_agent = sourceAgent;
         data.source_type = "hook";
-        if (data.hook_event_name === "UserPromptSubmit" && typeof data.prompt === "string") {
-            data.event_type = data.event_type ?? "prompt.submit";
-            data.tool_name = data.tool_name ?? "UserPromptSubmit";
-            data.command = data.command ?? data.prompt;
+        const eventKind = hookKind(String(data.hook_event_name ?? ""));
+        const promptGate = eventKind === "prompt" && ["claude-code", "codex", "cursor", "gemini"].includes(sourceAgent);
+        canBlock = eventKind === "pre" || promptGate;
+        if (eventKind === "prompt" && typeof data.prompt === "string") {
+            data.event_type = "prompt.submit";
+            data.tool_name = data.tool_name ?? data.hook_event_name;
+            data.command = data.prompt;
+            if (sessionTitlesEnabled())
+                await notePrompt(String(data.session_id ?? ""), data.prompt, String(data.cwd ?? "")).catch(() => { });
+        }
+        // Completed actions, permission notifications, and lifecycle callbacks are observation only.
+        // They must never run pre-action policy, skill approval, or action-judge gates.
+        if (!canBlock) {
+            if (eventKind === "post" && sourceAgent === "claude-code") {
+                const bundle = await readPolicy().catch(() => null);
+                await emitRedactedOutput(sourceAgent, data.tool_response, String(data.session_id ?? ""), bundle?.rules.customDetectors).catch(() => { });
+            }
+            await captureActivity(data);
+            if (sourceAgent === "cline")
+                process.stdout.write(JSON.stringify({ cancel: false }));
+            if (sourceAgent === "antigravity" && eventKind === "assistant")
+                process.stdout.write(JSON.stringify({ decision: "stop" }));
+            return;
         }
         // Model and token-usage backfill are independent: a newer agent build (Codex 0.155.1+ sends
         // `model` as a common field on every hook event -- see learn.chatgpt.com/docs/hooks) can
@@ -457,13 +485,15 @@ export async function captureHook(sourceAgent = "claude-code", home = homedir())
             catch { /* best-effort enrichment only -- never block the hook on this */ }
         }
         // 1. Enforcement first — a local file read, so it works even if the collector is down.
-        //    Only acts when a manager has set the policy to advisory/enforce; observe mode
-        //    (the default) is a no-op and Beam stays observation-only.
+        //    General rules follow advisory/enforce mode. Explicit mandatory mitigation
+        //    blocks can deny matching calls while unrelated calls remain in observe mode.
         const toolInput = data.tool_input && typeof data.tool_input === "object"
             ? data.tool_input : {};
-        const command = String(data.command ?? toolInput.command ?? "");
+        const command = commandOf(data);
         let decision = evaluate(await readPolicy().catch(() => null), {
             agent: sourceAgent,
+            eventType: promptGate ? "prompt.submit" : undefined,
+            input: toolInput,
             tool: String(data.tool_name ?? ""),
             command,
             args: Array.isArray(toolInput.args) ? toolInput.args.map(String) : command.split(/\s+/).slice(1),
@@ -471,21 +501,20 @@ export async function captureHook(sourceAgent = "claude-code", home = homedir())
             url: String(toolInput.url ?? data.url ?? ""),
             role: typeof data.role === "string" ? data.role : undefined,
             user: typeof data.user === "string" ? data.user : undefined,
-            cwd: typeof data.cwd === "string" ? data.cwd : undefined,
+            cwd: typeof toolInput.workdir === "string" ? toolInput.workdir : typeof data.cwd === "string" ? data.cwd : undefined,
             repository: typeof data.repository === "string" ? data.repository : undefined,
             branch: typeof data.branch === "string" ? data.branch : undefined,
             environment: typeof data.environment === "string" ? data.environment : undefined,
             time: typeof data.timestamp === "string" ? data.timestamp : undefined,
         });
-        if ((decision.action === "allow" || decision.action === "warn") && isEnvironmentAccess(String(data.tool_name ?? ""), command, String(toolInput.file_path ?? toolInput.path ?? data.file_path ?? ""), toolInput)) {
-            // Sensitive data (.env, credentials, secrets) is never left at a soft, easy-to-miss
-            // stderr warning -- it's always promoted to a real approval gate, regardless of what the
-            // matched policy rule or risk mapping would otherwise have produced.
-            decision = {
-                ...decision,
-                action: "ask",
-                reason: "Reading environment variables or .env files requires approval.",
-            };
+        const readsEnvironment = isEnvironmentAccess(String(data.tool_name ?? ""), command, String(toolInput.file_path ?? toolInput.path ?? data.file_path ?? ""), toolInput);
+        if (readsEnvironment && decision.mode === "observe" && decision.action === "allow") {
+            // Allow-all still records this sensitive read as a risk, without turning it into an approval gate.
+            decision = { ...decision, riskScore: Math.max(decision.riskScore, 35), riskLevel: decision.riskScore >= 70 ? decision.riskLevel : "MEDIUM", riskFactors: [...new Set([...decision.riskFactors, "sensitive environment data"])], reason: "Sensitive environment data access was allowed and flagged for review." };
+        }
+        else if (decision.mode !== "observe" && (decision.action === "allow" || decision.action === "warn") && readsEnvironment) {
+            // Sensitive data is always promoted to an approval gate in protective policy modes.
+            decision = { ...decision, action: "ask", reason: "Reading environment variables or .env files requires approval." };
         }
         const workspace = String(data.cwd ?? "");
         const targetPath = String(toolInput.file_path ?? toolInput.path ?? data.file_path ?? "");
@@ -497,20 +526,44 @@ export async function captureHook(sourceAgent = "claude-code", home = homedir())
                 reason: "Beam protection cannot be disabled, removed, or modified by an agent.",
             };
         }
+        // Behavioral anomaly: a burst of high/critical-severity actions from one session, independent
+        // of whether any single one was individually blocked -- the shape an agent shows when it's
+        // been talked into a chain of risky actions (injection, a compromised skill, a confused
+        // multi-step plan), even if each step alone only ever rated "ask". Recorded regardless of this
+        // action's own decision (a blocked/asked action still happened and still counts), but only
+        // ever escalates a decision that's currently allow/warn -- never downgrades an existing ask/deny.
+        try {
+            const anomaly = await recordAndCheckAnomaly(String(data.session_id ?? data.sessionId ?? ""), decision.riskLevel);
+            if (anomaly.triggered) {
+                const reason = `${anomaly.count} high/critical-severity actions from this session in the last ${anomaly.windowMinutes} minutes.`;
+                if (decision.mode === "observe" && decision.action === "allow") {
+                    decision = { ...decision, riskFactors: [...new Set([...decision.riskFactors, "behavioral anomaly: action burst"])], reason };
+                }
+                else if (decision.mode !== "observe" && (decision.action === "allow" || decision.action === "warn")) {
+                    decision = { ...decision, action: "ask", rule: "beam.behavioral-anomaly", reason };
+                }
+            }
+        }
+        catch { /* best-effort: must never block the agent on anomaly-tracking failure */ }
         const policyMode = decision.mode;
-        if (decision.action === "allow" && policyMode !== "observe" && workspace) {
+        if (decision.action === "allow" && workspace) {
             const escaping = outsideWorkspacePaths(workspace, targetPath, command);
-            if (escaping.length) {
-                // A human can pre-approve specific outside-workspace paths with `beam trust <path>`
-                // (~/.beam/data/trusted-paths.json) so this ask doesn't fire again for them. The agent
-                // can't write that file itself -- isBeamSelfProtectionTarget above blocks it.
-                const trusted = await readTrustedPaths().catch(() => []);
-                const untrusted = escaping.filter(path => !isPathTrusted(path, trusted));
-                if (untrusted.length) {
-                    // Hooks run as child processes while the host agent owns the terminal. Reading
-                    // /dev/tty here steals input from the host UI and can stall the session until timeout.
-                    // Return ASK promptly so the host can show its own permission prompt instead.
-                    decision = { ...decision, action: "ask", reason: "This action accesses a path outside the current workspace." };
+            if (policyMode === "observe" && escaping.length) {
+                decision = { ...decision, riskScore: Math.max(decision.riskScore, 35), riskLevel: decision.riskScore >= 70 ? decision.riskLevel : "MEDIUM", riskFactors: [...new Set([...decision.riskFactors, "access outside the current workspace"])], reason: "Access outside the current workspace was allowed and flagged for review." };
+            }
+            if (policyMode !== "observe") {
+                if (escaping.length) {
+                    // A human can pre-approve specific outside-workspace paths with `beam trust <path>`
+                    // (~/.beam/data/trusted-paths.json) so this ask doesn't fire again for them. The agent
+                    // can't write that file itself -- isBeamSelfProtectionTarget above blocks it.
+                    const trusted = await readTrustedPaths().catch(() => []);
+                    const untrusted = escaping.filter(path => !isPathTrusted(path, trusted));
+                    if (untrusted.length) {
+                        // Hooks run as child processes while the host agent owns the terminal. Reading
+                        // /dev/tty here steals input from the host UI and can stall the session until timeout.
+                        // Return ASK promptly so the host can show its own permission prompt instead.
+                        decision = { ...decision, action: "ask", reason: "This action accesses a path outside the current workspace." };
+                    }
                 }
             }
         }
@@ -522,7 +575,7 @@ export async function captureHook(sourceAgent = "claude-code", home = homedir())
                 const skill = await gateSkill(String(data.tool_name ?? ""), toolInput, workspace, policyMode === "enforce");
                 if (skill) {
                     decision = { ...decision, riskScore: Math.max(decision.riskScore, skill.scan.score), riskLevel: skill.scan.level, riskFactors: [...decision.riskFactors, ...skill.scan.findings.slice(0, 5).map(f => f.title)] };
-                    if (skill.action !== "allow")
+                    if (skill.action !== "allow" && policyMode !== "observe")
                         decision = { ...decision, action: skill.action, rule: "beam.skill-scan", reason: skill.reason };
                     else if (skill.reason)
                         process.stderr.write(`\n⚠ Beam skill scan: ${skill.reason}\n`);
@@ -545,46 +598,16 @@ export async function captureHook(sourceAgent = "claude-code", home = homedir())
         // step only ever runs for Beam's own soft, non-mandatory fallback.
         if (decision.action === "warn")
             decision = await resolveWarnInteractively(decision, targetPath, command);
-        // Detection and policy enforcement above already ran against the real prompt text and
-        // session id -- neither is forwarded to the local collector or the workspace dashboard from
-        // this point on. event_type/tool_name still identify a prompt-submit event; the content and
-        // the session identifier do not leave this machine. Scoped to prompt.submit only -- deleting
-        // session_id on every event type broke session grouping (and the tool_use_id dedup in
-        // core.ts, which is keyed per-hostname/phase but not per-session) for all other hook events.
-        // The only things derived from a prompt that are allowed out: a session title (first prompt) and
-        // a short per-turn topic, both redacted and capped at 80 characters -- see session-title.ts.
-        // Raw prompt text still never leaves the machine.
-        if (sessionTitlesEnabled()) {
-            try {
-                const sessionId = String(data.session_id ?? data.sessionId ?? "");
-                // Cursor (beforeSubmitPrompt) and Gemini (BeforeAgent) name their prompt hook differently
-                // from Claude Code / Codex, and are not rewritten to prompt.submit above (each agent's
-                // block contract is keyed on its own event name), so recognise them here.
-                const otherPromptHook = ["beforeSubmitPrompt", "BeforeAgent"].includes(String(data.hook_event_name)) && typeof data.prompt === "string";
-                if (data.event_type === "prompt.submit" || otherPromptHook) {
-                    await notePrompt(sessionId, String(data.prompt ?? ""), String(data.cwd ?? ""));
-                    if (otherPromptHook)
-                        delete data.prompt; // the raw prompt must not travel further than this check
-                }
-                else {
-                    const context = await sessionContextFor(sourceAgent, sessionId, { home, transcriptPath: typeof data.transcript_path === "string" ? data.transcript_path : undefined });
-                    if (context) {
-                        data.session_title = context.title;
-                        data.session_title_source = context.titleSource;
-                        data.turn = context.turn;
-                        data.turn_topic = context.topic;
-                        data.turn_shift = context.shift;
-                    }
-                }
+        // Retain redacted prompts and session identities now that prompt activity is part of capture.
+        if (sessionTitlesEnabled() && data.session_id && eventKind !== "prompt") {
+            const context = await sessionContextFor(sourceAgent, String(data.session_id), { home }).catch(() => null);
+            if (context) {
+                data.session_title = context.title;
+                data.session_title_source = context.titleSource;
+                data.turn = context.turn;
+                data.turn_topic = context.topic;
+                data.turn_shift = context.shift;
             }
-            catch { /* best-effort: a title must never affect enforcement */ }
-        }
-        if (data.event_type === "prompt.submit") {
-            delete data.prompt;
-            delete data.command;
-            delete data.session_id;
-            delete data.sessionId;
-            delete data.session;
         }
         data.policy_decision = { action: decision.action, rule: decision.rule, reason: decision.reason, risk_score: decision.riskScore, risk_level: decision.riskLevel, risk_factors: decision.riskFactors };
         const hookEvent = String(data.hook_event_name ?? "PreToolUse");
@@ -598,7 +621,7 @@ export async function captureHook(sourceAgent = "claude-code", home = homedir())
             emitAsk(sourceAgent, decision.reason ?? "This action requires approval.", hookEvent);
         }
         else if (decision.action === "redact") {
-            const transformed = redactPayload(data, decision);
+            const transformed = await redactPayload(data, decision, String(data.session_id ?? data.sessionId ?? ""));
             if (!transformed.changed) {
                 emitAllow(sourceAgent, decision.reason, hookEvent);
             }
@@ -613,21 +636,10 @@ export async function captureHook(sourceAgent = "claude-code", home = homedir())
             // prompt.
             process.stderr.write(`\n⚠ Beam policy (advisory): ${decision.reason}\n`);
         }
-        // 2. Local capture (best-effort — a failure here must not skip enforcement or throw). The
-        //    running collector (serve.ts) also batches this event into its own workspace forward --
-        //    see ForwardQueue in forward.ts -- so most events reach the dashboard in groups rather
-        //    than one request per action. Allowed prompt.submit events are skipped here: policy
-        //    enforcement above already ran against them, but every keystroke-triggered prompt
-        //    otherwise floods the Activity/Overview views with noise nobody reviews. A blocked
-        //    prompt is still surfaced -- see step 3 below.
-        if (data.event_type !== "prompt.submit" || decision.action === "deny") {
-            try {
-                await send("/ingest", JSON.stringify(data));
-            }
-            catch (e) {
-                console.error(e instanceof Error ? e.message : String(e));
-            }
-        }
+        if (["cline", "antigravity"].includes(sourceAgent) && ["allow", "audit", "warn"].includes(decision.action))
+            emitAllow(sourceAgent, decision.reason, hookEvent);
+        // Capture every lifecycle event, including allowed prompts and tool completions.
+        await captureActivity(data);
         // 3. A policy-blocked action carries a finding the collector's own normalize() can't
         //    reconstruct (it only knows about *this* process's policy decision) -- forward it to the
         //    workspace immediately rather than folding it into the batch, so a manager sees a block
@@ -647,13 +659,46 @@ export async function captureHook(sourceAgent = "claude-code", home = homedir())
         // confirms exit 2 blocks both BeforeTool and BeforeAgent, same as decision: "deny") and is
         // also treated as failure by OpenCode's native plugin wrapper.
         const policy = await readPolicy().catch(() => null);
-        if (policy && (policy.rules.mode === "enforce" || policy.errors?.length)) {
+        if (canBlock && policy && (policy.rules.mode === "enforce" || policy.errors?.length)) {
             // emitDeny already sets exit code 2 for the agents where that's the documented fail-closed
             // signal (see EXIT_2_FAILS_CLOSED above).
             emitDeny(sourceAgent, "Beam security policy could not complete safely; execution is denied.");
         }
     }
 }
+async function captureActivity(data) {
+    try {
+        const policy = await readPolicy().catch(() => null);
+        const redacted = await redactPayload(data, { customDetectors: policy?.rules.customDetectors }, String(data.session_id ?? ""));
+        const a = activityFor(redacted.data, value => redactSensitive(value, policy?.rules.customDetectors).text);
+        if (!a)
+            return;
+        const projected = {};
+        for (const field of ["source_agent", "source_type", "hook_event_name", "session_id", "parent_session_id", "tool_name", "tool_use_id", "event_type", "command", "file_path", "url", "cwd", "model", "timestamp", "session_title", "session_title_source", "turn", "turn_topic", "turn_shift", "input_tokens", "output_tokens", "policy_decision", "status", "error", "is_error", "reason", "decision", "permission_decision", "permissionDecision", "approval", "approved", "agent_id", "agent_type", "subagent_id", "child_session_id", "exit_code", "exitCode", "duration_ms"]) {
+            const value = redacted.data[field];
+            if (value !== undefined)
+                projected[field] = typeof value === "string" ? value.slice(0, 4000) : value;
+        }
+        const details = a.details;
+        if (details)
+            for (const [key, value] of Object.entries(details))
+                projected[key] = value;
+        projected.tool_input = a.input;
+        projected.tool_response = a.output;
+        projected.prompt = a.prompt;
+        projected.assistant_text = a.assistant;
+        projected.capture_truncated = a.truncated;
+        try {
+            await send("/ingest", JSON.stringify(projected));
+        }
+        catch {
+            await spoolHookEvent(projected);
+        }
+    }
+    catch (e) {
+        process.stderr.write(`Beam activity capture failed: ${e instanceof Error ? e.message : String(e)}\n`);
+    }
+}
 function safeNormalize(data) {
     try {
         return normalize(data);
@@ -691,12 +736,18 @@ async function resolveWarnInteractively(decision, targetPath, command) {
 }
 function isEnvironmentAccess(tool, command, path, input) {
     const text = `${tool} ${command} ${path} ${Object.values(input).filter(value => typeof value === "string").join(" ")}`;
+    const context = classifyActionContext(tool, { ...input, file_path: path }, "", command, v => v, false);
+    const scoped = environmentRisk(context);
+    if (context.actions.length && context.actions.every(a => a.operation === "source-search"))
+        return false;
     // File reads: .env, .env.local, .env.prod, etc. Also catch common env/config
     // locations that contain exported credentials.
     if (/(^|[\\/\s"'])\.env(?:\.[\w.-]+)?(?:$|[\\/\s"'])/i.test(text))
         return true;
     if (/(^|[\\/\s"'])\.aws[\\/]credentials(?:$|[\\/\s"'])|(^|[\\/\s"'])\.config[\\/]gcloud(?:$|[\\/\s"'])/i.test(text))
         return true;
+    if (scoped && ("suppress" in scoped || "severity" in scoped && scoped.severity === "info"))
+        return false;
     // Shell/process environment reads: env, printenv, set, export -p, $FOO,
     // process.env, os.environ and equivalent tool arguments.
     return /\b(?:printenv|env|export\s+-p|process\.env|os\.environ|System\.getenv)\b/i.test(text)
@@ -732,28 +783,55 @@ function isBeamSelfProtectionTarget(tool, command, target) {
 function blockedFinding(reason = "Blocked by workspace policy.") {
     return { id: "policy.blocked", title: "Blocked by workspace policy", severity: "high", explanation: reason, evidence: "" };
 }
-function redactPayload(data, decision) {
+async function redactPayload(data, decision, sessionId) {
     const copy = structuredClone(data);
     let changed = false;
-    const redactValue = (value) => {
+    const redactValue = async (value) => {
         if (typeof value === "string") {
-            const result = redactSensitive(value, decision.customDetectors);
+            const result = await redactWithSessionEntities(value, sessionId, decision.customDetectors);
             changed ||= result.text !== value;
             return result.text;
         }
         if (Array.isArray(value))
-            return value.map(redactValue);
+            return Promise.all(value.map(redactValue));
         if (value && typeof value === "object")
-            return Object.fromEntries(Object.entries(value).map(([k, v]) => [k, redactValue(v)]));
+            return Object.fromEntries(await Promise.all(Object.entries(value).map(async ([k, v]) => [k, await redactValue(v)])));
         return value;
     };
-    return { data: redactValue(copy), changed };
+    const redacted = await redactValue(copy);
+    return { data: redacted, changed };
 }
 // Claude Code and Codex use the same hookSpecificOutput.permissionDecision contract for every
 // hook event -- only the echoed hookEventName differs per event (verified against
-// code.claude.com/docs/en/hooks for both PreToolUse and UserPromptSubmit).
+// code.claude.com/docs/en/hooks for PreToolUse, UserPromptSubmit, and PostToolUse).
 function claudeStyleHookEventName(event) {
-    return event === "UserPromptSubmit" ? "UserPromptSubmit" : "PreToolUse";
+    return event === "UserPromptSubmit" || event === "PostToolUse" ? event : "PreToolUse";
+}
+// A tool has already run by the time PostToolUse fires -- there is nothing left to block, only
+// what Claude sees afterward to rewrite (hookSpecificOutput.updatedToolOutput). This is the
+// counterpart to redactPayload()/emitRedacted() below, which redact a secret that was already in
+// the *command text* before it runs; this instead catches a secret that only appears in a
+// command's *output* (`cat .env` holding a real, un-migrated value; an app echoing its own
+// resolved config) -- the input had nothing to redact, so PreToolUse redaction never saw it.
+// Only wired for claude-code (see agents.ts notes): Codex's PostToolUse payload shape and
+// updatedToolOutput support are unverified, and sending a rewrite a client doesn't honor would
+// silently do nothing while looking like protection.
+async function emitRedactedOutput(agent, toolResponse, sessionId, customDetectors) {
+    if (agent !== "claude-code" || toolResponse === null || toolResponse === undefined)
+        return;
+    const redactValue = async (value) => {
+        if (typeof value === "string")
+            return (await redactWithSessionEntities(value, sessionId, customDetectors)).text;
+        if (Array.isArray(value))
+            return Promise.all(value.map(redactValue));
+        if (value && typeof value === "object")
+            return Object.fromEntries(await Promise.all(Object.entries(value).map(async ([k, v]) => [k, await redactValue(v)])));
+        return value;
+    };
+    const redacted = await redactValue(toolResponse);
+    if (JSON.stringify(redacted) === JSON.stringify(toolResponse))
+        return; // nothing to rewrite
+    process.stdout.write(JSON.stringify({ hookSpecificOutput: { hookEventName: "PostToolUse", updatedToolOutput: redacted } }));
 }
 function emitAsk(agent, reason, event = "PreToolUse") {
     if (agent === "claude-code" || agent === "codex") {
@@ -783,6 +861,14 @@ function emitRedacted(agent, data, reason, event = "PreToolUse") {
         emitDeny(agent, "Beam cannot safely return transformed input through this hook contract.", event);
 }
 function emitAllow(agent, reason, event = "PreToolUse") {
+    if (agent === "cline") {
+        process.stdout.write(JSON.stringify({ cancel: false }));
+        return;
+    }
+    if (agent === "antigravity") {
+        process.stdout.write(JSON.stringify({ decision: "ask" }));
+        return;
+    }
     if (agent === "claude-code" || agent === "codex")
         process.stdout.write(JSON.stringify({ hookSpecificOutput: { hookEventName: claudeStyleHookEventName(event), permissionDecision: "allow", permissionDecisionReason: reason } }));
     else if (agent === "cursor" && event === "beforeSubmitPrompt")
@@ -800,12 +886,12 @@ function emitAllow(agent, reason, event = "PreToolUse") {
 // content", separately from the exit-0 hookSpecificOutput.permissionDecision path). Setting this
 // alongside the JSON is belt-and-suspenders, not a replacement -- the JSON still carries the
 // clean reason text; exit 2 just guarantees the block itself isn't silently skipped.
-const EXIT_2_FAILS_CLOSED = new Set(["claude-code", "codex", "cursor", "copilot-cli", "gemini", "opencode", "openclaw", "hermes"]);
+const EXIT_2_FAILS_CLOSED = new Set(["claude-code", "codex", "cursor", "copilot-cli", "gemini", "opencode", "openclaw", "hermes", "windsurf", "kimi", "qwen", "auggie", "kiro", "goose", "openhands", "crush", "junie"]);
 // Claude Code / Codex hook contract: a JSON decision on stdout denies the tool call or prompt.
 // Other agents get a stderr note only (their block contracts differ and aren't verified), except
 // where noted below.
 function emitDeny(agent, reason, event = "PreToolUse") {
-    if (agent === "claude-code" || agent === "codex") {
+    if (["claude-code", "codex", "muse", "vscode", "factory"].includes(agent)) {
         process.stdout.write(JSON.stringify({
             hookSpecificOutput: {
                 hookEventName: claudeStyleHookEventName(event),
@@ -835,9 +921,26 @@ function emitDeny(agent, reason, event = "PreToolUse") {
         process.stdout.write(JSON.stringify({ decision: "deny", reason: `Beam: ${reason}` }));
     }
     else if (agent === "hermes") {
-        // Hermes shell hooks block with {"decision": "block", "reason"} (or exit 2, set below).
+        process.stdout.write(JSON.stringify({ action: "block", message: `Beam: ${reason}`, decision: "block", reason: `Beam: ${reason}` }));
+    }
+    else if (["pi", "kilo"].includes(agent)) {
+        process.stdout.write(JSON.stringify({ block: true, reason: `Beam: ${reason}` }));
+    }
+    else if (agent === "cline") {
+        process.stdout.write(JSON.stringify({ cancel: true, errorMessage: `Beam: ${reason}` }));
+    }
+    else if (agent === "amp") {
+        process.stdout.write(JSON.stringify({ action: "reject-and-continue", message: `Beam: ${reason}` }));
+    }
+    else if (["antigravity", "grok"].includes(agent)) {
+        process.stdout.write(JSON.stringify({ decision: "deny", reason: `Beam: ${reason}` }));
+    }
+    else if (agent === "devin") {
         process.stdout.write(JSON.stringify({ decision: "block", reason: `Beam: ${reason}` }));
     }
+    else if (["windsurf", "kimi", "qwen", "auggie", "kiro", "goose", "openhands", "crush", "junie"].includes(agent)) {
+        // These hosts use exit code 2, set below.
+    }
     else {
         // OpenCode has no installed hook/plugin path in this repository. A message cannot block it.
         process.stderr.write(`\n✖ Beam cannot block this agent (${agent}): no verified enforcement adapter is installed.\n`);