@agent-beam/beam 0.2.38 → 0.2.39

package/dist/entity-redaction.js

@@ -0,0 +1,88 @@
+// Session-consistent entity redaction: the same real secret value redacted twice in one session
+// becomes the same placeholder both times (e.g. [SECRET_001]), and a *different* value of the
+// same kind gets its own number ([SECRET_002]) -- unlike data-detectors.ts's redactSensitive(),
+// which always emits the same static "[SECRET_REDACTED]" regardless of which value matched, so
+// two different leaked secrets are indistinguishable in what the agent/reviewer sees. Only a
+// truncated SHA-256 hash of each matched value is ever written to disk; the real value is hashed
+// in memory and discarded immediately, never persisted or logged.
+//
+// Node-only (uses node:crypto and node:fs) -- kept out of data-detectors.ts on purpose, which
+// stays pure/stateless so it can keep backing the edge-runtime SDK path (see its callers:
+// monitor-rules.ts only imports its CustomDetector *type*, never calls its functions, at
+// runtime). This module is only ever called from the CLI hook path in client.ts.
+import { createHash } from "node:crypto";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { getDataDirectory } from "./config.js";
+import { detectSensitive } from "./data-detectors.js";
+import { withFileLock } from "./file-lock.js";
+function entityMapPath(home = getDataDirectory()) {
+    return join(home, "entity-map.json");
+}
+async function readMap(home) {
+    try {
+        return JSON.parse(await readFile(entityMapPath(home), "utf8"));
+    }
+    catch {
+        return {};
+    }
+}
+async function writeMap(map, home) {
+    const path = entityMapPath(home);
+    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+    await writeFile(path, `${JSON.stringify(map, null, 2)}\n`, { mode: 0o600 });
+}
+// A session untouched this long is pruned so the file doesn't grow forever. Only hashes and
+// counters live here, never a real value, but there's no reason to keep them past the session's
+// useful life either.
+const SESSION_TTL_MS = 7 * 24 * 60 * 60 * 1000;
+function hashValue(value) {
+    return createHash("sha256").update(value).digest("hex").slice(0, 16);
+}
+/**
+ * Same redaction `detectSensitive()`/`redactSensitive()` already do, except each distinct real
+ * value gets a stable, numbered placeholder ([SECRET_001], [API_KEY_002], ...) that's consistent
+ * for that exact value within `sessionId`, and distinct per different value of the same kind.
+ * `home` is the beam data directory (injectable for tests); defaults to the real one.
+ */
+export async function redactWithSessionEntities(text, sessionId, custom = [], home = getDataDirectory()) {
+    const findings = detectSensitive(text, custom);
+    if (findings.length === 0)
+        return { text, findings: [] };
+    // Locked end-to-end so concurrent tool calls in the same turn -- each spawning its own
+    // `beam hook` process -- can't both read the same pre-update counter and independently assign
+    // the same next id to two different values (see file-lock.ts / behavioral-anomaly.ts, which
+    // has the identical read-modify-write race).
+    return withFileLock(entityMapPath(home), async () => {
+        const map = await readMap(home);
+        const now = new Date().toISOString();
+        const cutoff = Date.now() - SESSION_TTL_MS;
+        for (const [id, session] of Object.entries(map))
+            if (Date.parse(session.updatedAt) < cutoff)
+                delete map[id];
+        const session = map[sessionId] ?? { updatedAt: now, counters: {}, entries: {} };
+        session.updatedAt = now;
+        // detectSensitive() returns findings sorted start-descending (last match first) specifically
+        // so a splice-based replace loop can apply them right-to-left without later offsets shifting
+        // -- this loop relies on that same ordering.
+        let result = text;
+        const entityFindings = [];
+        for (const finding of findings) {
+            const value = text.slice(finding.start, finding.end);
+            const hash = hashValue(value);
+            let id = session.entries[hash];
+            if (!id) {
+                session.counters[finding.kind] = (session.counters[finding.kind] ?? 0) + 1;
+                id = `${finding.kind}_${String(session.counters[finding.kind]).padStart(3, "0")}`;
+                session.entries[hash] = id;
+            }
+            const replacement = `[${id}]`;
+            result = result.slice(0, finding.start) + replacement + result.slice(finding.end);
+            entityFindings.push({ ...finding, replacement });
+        }
+        map[sessionId] = session;
+        await writeMap(map, home).catch(() => { });
+        return { text: result, findings: entityFindings };
+    });
+}
+//# sourceMappingURL=entity-redaction.js.map

package/dist/entity-redaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entity-redaction.js","sourceRoot":"","sources":["../src/entity-redaction.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,8FAA8F;AAC9F,gGAAgG;AAChG,+FAA+F;AAC/F,6FAA6F;AAC7F,iGAAiG;AACjG,kEAAkE;AAClE,EAAE;AACF,8FAA8F;AAC9F,0FAA0F;AAC1F,yFAAyF;AACzF,iFAAiF;AACjF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAyC,MAAM,qBAAqB,CAAC;AAC7F,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAK9C,SAAS,aAAa,CAAC,IAAI,GAAG,gBAAgB,EAAE;IAC9C,OAAO,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;AACvC,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,IAAY;IACjC,IAAI,CAAC;QAAC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAkB,CAAC;IAAC,CAAC;IACxF,MAAM,CAAC;QAAC,OAAO,EAAE,CAAC;IAAC,CAAC;AACtB,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,GAAkB,EAAE,IAAY;IACtD,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7D,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,4FAA4F;AAC5F,gGAAgG;AAChG,sBAAsB;AACtB,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE/C,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACvE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,IAAY,EAAE,SAAiB,EAAE,SAA2B,EAAE,EAAE,IAAI,GAAG,gBAAgB,EAAE;IAEzF,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC/C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAEzD,uFAAuF;IACvF,8FAA8F;IAC9F,4FAA4F;IAC5F,6CAA6C;IAC7C,OAAO,YAAY,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,KAAK,IAAI,EAAE;QAClD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,CAAC;QAC3C,KAAK,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,MAAM;gBAAE,OAAO,GAAG,CAAC,EAAE,CAAC,CAAC;QAE5G,MAAM,OAAO,GAAoB,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QACjG,OAAO,CAAC,SAAS,GAAG,GAAG,CAAC;QAExB,6FAA6F;QAC7F,6FAA6F;QAC7F,6CAA6C;QAC7C,IAAI,MAAM,GAAG,IAAI,CAAC;QAClB,MAAM,cAAc,GAAkB,EAAE,CAAC;QACzC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;YACrD,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAC9B,IAAI,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC/B,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;gBAC3E,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;gBAClF,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YAC7B,CAAC;YACD,MAAM,WAAW,GAAG,IAAI,EAAE,GAAG,CAAC;YAC9B,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAClF,cAAc,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;QACnD,CAAC;QAED,GAAG,CAAC,SAAS,CAAC,GAAG,OAAO,CAAC;QACzB,MAAM,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAwE,CAAC,CAAC,CAAC;QAEhH,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC;IACpD,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/file-lock.d.ts

@@ -0,0 +1 @@
+export declare function withFileLock<T>(path: string, fn: () => Promise<T>): Promise<T>;

package/dist/file-lock.js

@@ -0,0 +1,54 @@
+// A minimal, zero-dependency exclusive lock for a read-modify-write cycle against one JSON state
+// file, used by behavioral-anomaly.ts and entity-redaction.ts. Without it, two `beam hook`
+// processes racing (the common case: an agent issuing several tool calls in parallel in one turn,
+// each spawning its own short-lived hook process) both read the same pre-update state, both
+// compute their own "+1", and whichever writes last wins -- the other's update is silently lost.
+// For the anomaly detector this is a real bypass: 5 genuinely concurrent high-risk actions can
+// collapse to 1 persisted event, since each process independently sees itself as the first.
+//
+// Mechanism: `open(lockPath, "wx")` atomically fails with EEXIST if the lock file already exists
+// (POSIX O_EXCL semantics, no race window), so creating it IS the acquisition. A short backoff
+// retry loop waits for a concurrent holder to release it (by deleting the file). Fails open on a
+// timeout or any error -- a hook must never hang or crash the agent's turn waiting on a lock; a
+// worst-case missed increment is far better than a stuck tool call.
+import { mkdir, open, rm, stat, unlink } from "node:fs/promises";
+import { dirname } from "node:path";
+const MAX_WAIT_MS = 2000;
+const RETRY_DELAY_MS = 20;
+// A lock older than this is assumed to belong to a process that crashed or was killed mid-update
+// (hook processes are short-lived; nothing legitimate holds this lock for seconds) and is removed
+// so a stuck lock file doesn't permanently block every future update.
+const STALE_LOCK_MS = 5000;
+export async function withFileLock(path, fn) {
+    const lockPath = `${path}.lock`;
+    await mkdir(dirname(path), { recursive: true, mode: 0o700 }).catch(() => { });
+    const deadline = Date.now() + MAX_WAIT_MS;
+    let acquired = false;
+    while (Date.now() < deadline) {
+        try {
+            const handle = await open(lockPath, "wx");
+            await handle.close();
+            acquired = true;
+            break;
+        }
+        catch (e) {
+            if (e.code !== "EEXIST")
+                break; // unexpected error: proceed unlocked rather than hang
+            try {
+                const info = await stat(lockPath);
+                if (Date.now() - info.mtimeMs > STALE_LOCK_MS)
+                    await rm(lockPath, { force: true });
+            }
+            catch { /* lock vanished between the failed open and this check -- fine, loop will retry the open */ }
+            await new Promise(resolve => setTimeout(resolve, RETRY_DELAY_MS + Math.random() * RETRY_DELAY_MS));
+        }
+    }
+    try {
+        return await fn();
+    }
+    finally {
+        if (acquired)
+            await unlink(lockPath).catch(() => { });
+    }
+}
+//# sourceMappingURL=file-lock.js.map

package/dist/file-lock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-lock.js","sourceRoot":"","sources":["../src/file-lock.ts"],"names":[],"mappings":"AAAA,iGAAiG;AACjG,2FAA2F;AAC3F,kGAAkG;AAClG,4FAA4F;AAC5F,iGAAiG;AACjG,+FAA+F;AAC/F,4FAA4F;AAC5F,EAAE;AACF,iGAAiG;AACjG,+FAA+F;AAC/F,iGAAiG;AACjG,gGAAgG;AAChG,oEAAoE;AACpE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,MAAM,WAAW,GAAG,IAAI,CAAC;AACzB,MAAM,cAAc,GAAG,EAAE,CAAC;AAC1B,iGAAiG;AACjG,kGAAkG;AAClG,sEAAsE;AACtE,MAAM,aAAa,GAAG,IAAI,CAAC;AAE3B,MAAM,CAAC,KAAK,UAAU,YAAY,CAAI,IAAY,EAAE,EAAoB;IACtE,MAAM,QAAQ,GAAG,GAAG,IAAI,OAAO,CAAC;IAChC,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAE7E,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC;IAC1C,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YAC1C,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACrB,QAAQ,GAAG,IAAI,CAAC;YAChB,MAAM;QACR,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,CAAC,sDAAsD;YACjH,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAClC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,GAAG,aAAa;oBAAE,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACrF,CAAC;YAAC,MAAM,CAAC,CAAC,4FAA4F,CAAC,CAAC;YACxG,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,cAAc,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,cAAc,CAAC,CAAC,CAAC;QACrG,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,EAAE,CAAC;IACpB,CAAC;YAAS,CAAC;QACT,IAAI,QAAQ;YAAE,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACvD,CAAC;AACH,CAAC"}

package/dist/forward.d.ts

@@ -1,22 +1,29 @@
+import { type Identity } from "./enroll.js";
 import type { Event, Scan } from "./core.js";
 import type { McpInventory } from "./mcp-config.js";
 import type { SkillReport } from "./skill-sync.js";
-export declare function forwardEvents(events: Event | Event[]): Promise<void>;
+export declare function forwardEvents(events: Event | Event[], expected?: Pick<Identity, "deviceId" | "orgId" | "apiBase">): Promise<boolean>;
 export interface ForwardMcpInventoryResult {
     ok: boolean;
     reason?: string;
 }
 export declare function forwardMcpInventory(servers: McpInventory[]): Promise<ForwardMcpInventoryResult>;
-export declare function forwardSkillInventory(report: SkillReport): Promise<ForwardMcpInventoryResult>;
+export declare function forwardSkillInventory(report: SkillReport, existingSyncId?: string): Promise<ForwardMcpInventoryResult>;
 export declare const FORWARD_BATCH_SIZE = 6;
 export declare const FORWARD_FLUSH_MS = 10000;
+export declare const SKILL_INVENTORY_BATCH_SIZE = 20;
 export declare class ForwardQueue {
-    private pending;
     private flushTimer;
-    push(events: Event[]): void;
+    private writing;
+    private flushing;
+    private stopped;
+    private readonly directory;
+    constructor(directory?: string);
+    push(events: Event[]): Promise<void>;
     private scheduleFlush;
-    /** Force out whatever is pending right now (e.g. on collector shutdown). */
-    flush(): void;
+    flush(): Promise<void>;
+    close(): Promise<void>;
+    private deliver;
 }
 export declare function forwardScan(scan: Scan): Promise<void>;
 export declare function forwardReview(id: string, reviewed: boolean): Promise<void>;

package/dist/forward.js

@@ -1,4 +1,5 @@
-import { mkdir, rename, writeFile } from "node:fs/promises";
+import { mkdir, readdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { randomUUID } from "node:crypto";
 import { dirname, join } from "node:path";
 import { getApiUrl, getDataDirectory } from "./config.js";
 import { lastGoodPolicyPath } from "./policy.js";
@@ -7,18 +8,19 @@ import { versionHeaders } from "./version.js";
 function policyPath() {
     return join(getDataDirectory(), "policy.json");
 }
-// Fire-and-forget: forwarding to the workspace must never block or fail the agent. Like every
-// other identity-authenticated call in this file, this must hit the *enrolled* device's own
+// Like other identity-authenticated calls, this must hit the enrolled device's own
 // identity.apiBase -- not a separately configured URL -- otherwise a device enrolled against a
 // non-default workspace API (self-hosted, staging, a local dev dashboard) silently forwards
 // events to the wrong place while `beam whoami`/`beam account` and policy sync (which do use
 // identity.apiBase) keep reporting the device as enrolled and healthy.
-export async function forwardEvents(events) {
+export async function forwardEvents(events, expected) {
     const identity = await readIdentity();
     if (!identity)
-        return;
+        return false;
+    if (expected && (identity.deviceId !== expected.deviceId || identity.orgId !== expected.orgId || identity.apiBase !== expected.apiBase))
+        return false;
     try {
-        await fetch(`${identity.apiBase}/v1/ingest`, {
+        const response = await fetch(`${identity.apiBase}/v1/ingest`, {
             method: "POST",
             headers: {
                 "Content-Type": "application/json",
@@ -27,9 +29,13 @@ export async function forwardEvents(events) {
             body: JSON.stringify(events),
             signal: AbortSignal.timeout(5000),
         });
+        if (!response.ok)
+            throw new Error(`HTTP ${response.status}`);
+        return true;
     }
-    catch {
-        /* offline / unreachable — the local collector still has the record */
+    catch (error) {
+        console.error(`Beam workspace event delivery failed: ${error instanceof Error ? error.message : String(error)}`);
+        return false;
     }
 }
 // Unlike every other call in this file, this deliberately does NOT use identity.apiBase (the
@@ -65,19 +71,24 @@ export async function forwardMcpInventory(servers) {
     }
 }
 // Same host and auth as MCP inventory: the dedicated collector, keyed by the device secret.
-export async function forwardSkillInventory(report) {
+export async function forwardSkillInventory(report, existingSyncId) {
     const identity = await readIdentity();
     if (!identity)
         return { ok: false, reason: "This device isn't connected to a Beam workspace." };
     const collectorBase = getApiUrl();
     try {
-        const response = await fetch(`${collectorBase}/v1/skills/inventory`, {
-            method: "POST", headers: { "Content-Type": "application/json", Authorization: `Bearer ${identity.deviceSecret}` },
-            body: JSON.stringify(report), signal: AbortSignal.timeout(15_000),
-        });
-        if (response.ok)
-            return { ok: true };
-        return { ok: false, reason: response.status === 404 ? "This workspace's collector doesn't support skill inventory yet." : `Collector responded with HTTP ${response.status}.` };
+        const batchCount = Math.max(1, Math.ceil(report.skills.length / SKILL_INVENTORY_BATCH_SIZE));
+        const syncId = existingSyncId ?? randomUUID();
+        for (let batchIndex = 0; batchIndex < batchCount; batchIndex++) {
+            const skills = report.skills.slice(batchIndex * SKILL_INVENTORY_BATCH_SIZE, (batchIndex + 1) * SKILL_INVENTORY_BATCH_SIZE);
+            const response = await fetch(`${collectorBase}/v1/skills/inventory`, {
+                method: "POST", headers: { "Content-Type": "application/json", Authorization: `Bearer ${identity.deviceSecret}` },
+                body: JSON.stringify({ ...report, skills, syncId, batchIndex, batchCount, totalSkills: report.skills.length }), signal: AbortSignal.timeout(15_000),
+            });
+            if (!response.ok)
+                return { ok: false, reason: response.status === 404 ? "This workspace's collector doesn't support skill inventory yet." : `Collector rejected skill batch ${batchIndex + 1}/${batchCount} with HTTP ${response.status}.` };
+        }
+        return { ok: true };
     }
     catch (error) {
         return { ok: false, reason: `Could not reach ${collectorBase}: ${error instanceof Error ? error.message : String(error)}` };
@@ -85,49 +96,116 @@ export async function forwardSkillInventory(report) {
 }
 export const FORWARD_BATCH_SIZE = 6;
 export const FORWARD_FLUSH_MS = 10_000;
-// Batches events in memory (per collector process) and forwards them to the workspace in
-// groups of FORWARD_BATCH_SIZE, instead of one HTTP request per captured action. Lives on the
-// long-running collector (see serve.ts) since that's the only process with state that persists
-// across the many short-lived `beam hook` invocations. A leftover partial batch (below
-// FORWARD_BATCH_SIZE) is flushed after FORWARD_FLUSH_MS of inactivity so a quiet machine still
-// reaches the dashboard instead of waiting indefinitely for a 15th event.
+export const SKILL_INVENTORY_BATCH_SIZE = 20;
+// Persist before acknowledging local ingest. Delivery failures and process restarts leave
+// events in this outbox; the remote (orgId, dedupeKey) constraint makes retries idempotent.
+// Each envelope is bound to the enrolled device so re-enrollment cannot send old activity
+// into a different workspace. Only already-normalized, redacted events enter this queue.
 export class ForwardQueue {
-    pending = [];
     flushTimer;
-    push(events) {
-        if (!events.length)
-            return;
-        this.pending.push(...events);
-        while (this.pending.length >= FORWARD_BATCH_SIZE) {
-            const batch = this.pending.splice(0, FORWARD_BATCH_SIZE);
-            void forwardEvents(batch);
-        }
+    writing = Promise.resolve();
+    flushing;
+    stopped = false;
+    directory;
+    constructor(directory = getDataDirectory()) {
+        this.directory = join(directory, "event-outbox");
         this.scheduleFlush();
     }
+    push(events) {
+        const write = this.writing.then(async () => {
+            if (!events.length)
+                return;
+            const identity = await readIdentity();
+            if (!identity)
+                return;
+            await mkdir(this.directory, { recursive: true, mode: 0o700 });
+            for (let i = 0; i < events.length; i += FORWARD_BATCH_SIZE) {
+                const name = `${Date.now()}-${randomUUID()}`;
+                const temp = join(this.directory, `${name}.tmp`);
+                const envelope = { deviceId: identity.deviceId, orgId: identity.orgId, apiBase: identity.apiBase, events: events.slice(i, i + FORWARD_BATCH_SIZE) };
+                try {
+                    await writeFile(temp, JSON.stringify(envelope), { mode: 0o600, flag: "wx" });
+                    await rename(temp, join(this.directory, `${name}.json`));
+                }
+                finally {
+                    await rm(temp, { force: true });
+                }
+            }
+        });
+        this.writing = write.catch(() => { });
+        return write.then(() => {
+            if (events.length >= FORWARD_BATCH_SIZE)
+                void this.flush();
+        });
+    }
     scheduleFlush() {
-        if (this.flushTimer)
-            clearTimeout(this.flushTimer);
-        if (!this.pending.length)
+        if (this.stopped || this.flushTimer)
             return;
         this.flushTimer = setTimeout(() => {
             this.flushTimer = undefined;
-            if (!this.pending.length)
-                return;
-            const batch = this.pending.splice(0, this.pending.length);
-            void forwardEvents(batch);
+            void this.flush();
         }, FORWARD_FLUSH_MS);
         this.flushTimer.unref?.();
     }
-    /** Force out whatever is pending right now (e.g. on collector shutdown). */
     flush() {
+        if (this.flushing)
+            return this.flushing;
         if (this.flushTimer) {
             clearTimeout(this.flushTimer);
             this.flushTimer = undefined;
         }
-        if (!this.pending.length)
+        this.flushing = this.deliver().catch(error => {
+            console.error(`Beam event outbox: ${error instanceof Error ? error.message : String(error)}`);
+        }).finally(() => { this.flushing = undefined; this.scheduleFlush(); });
+        return this.flushing;
+    }
+    close() {
+        this.stopped = true;
+        return this.flush();
+    }
+    async deliver() {
+        await this.writing;
+        const identity = await readIdentity();
+        if (!identity)
             return;
-        const batch = this.pending.splice(0, this.pending.length);
-        void forwardEvents(batch);
+        let files;
+        try {
+            files = await readdir(this.directory);
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return;
+            throw error;
+        }
+        let attempted = 0;
+        let pending = [];
+        let paths = [];
+        const send = async () => {
+            if (!pending.length)
+                return true;
+            if (!await forwardEvents(pending, identity))
+                return false;
+            for (const path of paths)
+                await rm(path, { force: true });
+            pending = [];
+            paths = [];
+            return true;
+        };
+        for (const name of files.filter(n => /^\d+-[\da-f-]+\.json$/.test(n)).sort()) {
+            const path = join(this.directory, name);
+            const envelope = JSON.parse(await readFile(path, "utf8"));
+            if (envelope.deviceId !== identity.deviceId || envelope.orgId !== identity.orgId || envelope.apiBase !== identity.apiBase)
+                continue;
+            if (attempted++ >= 100)
+                break;
+            if (pending.length + envelope.events.length > FORWARD_BATCH_SIZE && !await send())
+                return;
+            pending.push(...envelope.events);
+            paths.push(path);
+            if (pending.length >= FORWARD_BATCH_SIZE && !await send())
+                return;
+        }
+        await send();
     }
 }
 // Fire-and-forget: forwarding a local skill/MCP scan must never block or fail the caller.

package/dist/forward.js.map

@@ -1 +1 @@
-{"version":3,"file":"forward.js","sourceRoot":"","sources":["../src/forward.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAI3C,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE9C,SAAS,UAAU;IACjB,OAAO,IAAI,CAAC,gBAAgB,EAAE,EAAE,aAAa,CAAC,CAAC;AACjD,CAAC;AAED,8FAA8F;AAC9F,4FAA4F;AAC5F,+FAA+F;AAC/F,4FAA4F;AAC5F,6FAA6F;AAC7F,uEAAuE;AACvE,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,MAAuB;IACzD,MAAM,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAC;IACtC,IAAI,CAAC,QAAQ;QAAE,OAAO;IACtB,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,GAAG,QAAQ,CAAC,OAAO,YAAY,EAAE;YAC3C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,QAAQ,CAAC,YAAY,EAAE;aACjD;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;YAC5B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;IACxE,CAAC;AACH,CAAC;AAID,6FAA6F;AAC7F,gGAAgG;AAChG,4FAA4F;AAC5F,gGAAgG;AAChG,uFAAuF;AACvF,+CAA+C;AAC/C,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAAuB;IAC/D,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAC;IACtC,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kDAAkD,EAAE,CAAC;IAChG,MAAM,aAAa,GAAG,SAAS,EAAE,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,aAAa,mBAAmB,EAAE;YAChE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,QAAQ,CAAC,YAAY,EAAE,EAAE;YACjH,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SACrE,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACrC,4FAA4F;QAC5F,oFAAoF;QACpF,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,KAAK,GAAG;YACpC,CAAC,CAAC,+DAA+D;YACjE,CAAC,CAAC,iCAAiC,QAAQ,CAAC,MAAM,GAAG,CAAC;QACxD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,aAAa,KAAK,OAAO,EAAE,EAAE,CAAC;IAC/E,CAAC;AACH,CAAC;AAED,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,MAAmB;IAC7D,MAAM,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAC;IACtC,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kDAAkD,EAAE,CAAC;IAChG,MAAM,aAAa,GAAG,SAAS,EAAE,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,aAAa,sBAAsB,EAAE;YACnE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,QAAQ,CAAC,YAAY,EAAE,EAAE;YACjH,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SAClE,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACrC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,iEAAiE,CAAC,CAAC,CAAC,iCAAiC,QAAQ,CAAC,MAAM,GAAG,EAAE,CAAC;IAClL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,aAAa,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;IAC9H,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC;AACpC,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEvC,yFAAyF;AACzF,8FAA8F;AAC9F,+FAA+F;AAC/F,uFAAuF;AACvF,+FAA+F;AAC/F,0EAA0E;AAC1E,MAAM,OAAO,YAAY;IACf,OAAO,GAAY,EAAE,CAAC;IACtB,UAAU,CAA6B;IAE/C,IAAI,CAAC,MAAe;QAClB,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,OAAO;QAC3B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC;QAC7B,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,kBAAkB,EAAE,CAAC;YACjD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;YACzD,KAAK,aAAa,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;QACD,IAAI,CAAC,aAAa,EAAE,CAAC;IACvB,CAAC;IAEO,aAAa;QACnB,IAAI,IAAI,CAAC,UAAU;YAAE,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACnD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,OAAO;QACjC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,GAAG,EAAE;YAChC,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;YAC5B,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM;gBAAE,OAAO;YACjC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC1D,KAAK,aAAa,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC,EAAE,gBAAgB,CAAC,CAAC;QACrB,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,CAAC;IAC5B,CAAC;IAED,4EAA4E;IAC5E,KAAK;QACH,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAAC,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAAC,CAAC;QACpF,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,OAAO;QACjC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC1D,KAAK,aAAa,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;CACF;AAED,0FAA0F;AAC1F,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAU;IAC1C,MAAM,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAC;IACtC,IAAI,CAAC,QAAQ;QAAE,OAAO;IACtB,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,GAAG,QAAQ,CAAC,OAAO,WAAW,EAAE;YAC1C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,QAAQ,CAAC,YAAY,EAAE;aACjD;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;IACxE,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAAU,EAAE,QAAiB;IAC/D,MAAM,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAC;IACtC,IAAI,CAAC,QAAQ;QAAE,OAAO;IACtB,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,GAAG,QAAQ,CAAC,OAAO,YAAY,EAAE;YAC3C,MAAM,EAAE,OAAO;YACf,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,QAAQ,CAAC,YAAY,EAAE;aACjD;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;YACtC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;IACxE,CAAC;AACH,CAAC;AAQD,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,MAAM,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAC;IACtC,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAEjD,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,QAAQ,CAAC,OAAO,YAAY,EAAE;YACtD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,QAAQ,CAAC,YAAY,EAAE,EAAE,GAAG,cAAc,EAAE,EAAE;YAClF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACnC,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC5D,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAEnD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC;IAC1B,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;IACxD,MAAM,IAAI,GAAG,GAAG,IAAI,MAAM,CAAC;IAC3B,MAAM,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,MAAM,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACzB,MAAM,SAAS,CAAC,kBAAkB,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC;AAC9D,CAAC"}
+{"version":3,"file":"forward.js","sourceRoot":"","sources":["../src/forward.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACnF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,YAAY,EAAiB,MAAM,aAAa,CAAC;AAI1D,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE9C,SAAS,UAAU;IACjB,OAAO,IAAI,CAAC,gBAAgB,EAAE,EAAE,aAAa,CAAC,CAAC;AACjD,CAAC;AAED,mFAAmF;AACnF,+FAA+F;AAC/F,4FAA4F;AAC5F,6FAA6F;AAC7F,uEAAuE;AACvE,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,MAAuB,EAAE,QAA2D;IACtH,MAAM,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAC;IACtC,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACtJ,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,QAAQ,CAAC,OAAO,YAAY,EAAE;YAC5D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,QAAQ,CAAC,YAAY,EAAE;aACjD;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;YAC5B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,yCAAyC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACjH,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAID,6FAA6F;AAC7F,gGAAgG;AAChG,4FAA4F;AAC5F,gGAAgG;AAChG,uFAAuF;AACvF,+CAA+C;AAC/C,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAAuB;IAC/D,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAC;IACtC,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kDAAkD,EAAE,CAAC;IAChG,MAAM,aAAa,GAAG,SAAS,EAAE,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,aAAa,mBAAmB,EAAE;YAChE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,QAAQ,CAAC,YAAY,EAAE,EAAE;YACjH,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SACrE,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACrC,4FAA4F;QAC5F,oFAAoF;QACpF,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,KAAK,GAAG;YACpC,CAAC,CAAC,+DAA+D;YACjE,CAAC,CAAC,iCAAiC,QAAQ,CAAC,MAAM,GAAG,CAAC;QACxD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,aAAa,KAAK,OAAO,EAAE,EAAE,CAAC;IAC/E,CAAC;AACH,CAAC;AAED,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,MAAmB,EAAE,cAAuB;IACtF,MAAM,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAC;IACtC,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kDAAkD,EAAE,CAAC;IAChG,MAAM,aAAa,GAAG,SAAS,EAAE,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,0BAA0B,CAAC,CAAC,CAAC;QAC7F,MAAM,MAAM,GAAG,cAAc,IAAI,UAAU,EAAE,CAAC;QAC9C,KAAK,IAAI,UAAU,GAAG,CAAC,EAAE,UAAU,GAAG,UAAU,EAAE,UAAU,EAAE,EAAE,CAAC;YAC/D,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,GAAG,0BAA0B,EAAE,CAAC,UAAU,GAAG,CAAC,CAAC,GAAG,0BAA0B,CAAC,CAAC;YAC3H,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,aAAa,sBAAsB,EAAE;gBACnE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,QAAQ,CAAC,YAAY,EAAE,EAAE;gBACjH,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;aACpJ,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,iEAAiE,CAAC,CAAC,CAAC,kCAAkC,UAAU,GAAG,CAAC,IAAI,UAAU,cAAc,QAAQ,CAAC,MAAM,GAAG,EAAE,CAAC;QAC/O,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,aAAa,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;IAC9H,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC;AACpC,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC;AACvC,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAE7C,0FAA0F;AAC1F,4FAA4F;AAC5F,0FAA0F;AAC1F,yFAAyF;AACzF,MAAM,OAAO,YAAY;IACf,UAAU,CAA6B;IACvC,OAAO,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3C,QAAQ,CAA4B;IACpC,OAAO,GAAG,KAAK,CAAC;IACP,SAAS,CAAS;IAEnC,YAAY,SAAS,GAAG,gBAAgB,EAAE;QACxC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;QACjD,IAAI,CAAC,aAAa,EAAE,CAAC;IACvB,CAAC;IAED,IAAI,CAAC,MAAe;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YACzC,IAAI,CAAC,MAAM,CAAC,MAAM;gBAAE,OAAO;YAC3B,MAAM,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAC;YACtC,IAAI,CAAC,QAAQ;gBAAE,OAAO;YACtB,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC9D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,kBAAkB,EAAE,CAAC;gBAC3D,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,UAAU,EAAE,EAAE,CAAC;gBAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,IAAI,MAAM,CAAC,CAAC;gBACjD,MAAM,QAAQ,GAAG,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,kBAAkB,CAAC,EAAE,CAAC;gBACpJ,IAAI,CAAC;oBACH,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;oBAC7E,MAAM,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC;gBAC3D,CAAC;wBAAS,CAAC;oBAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAAC,CAAC;YAChD,CAAC;QACH,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACrC,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE;YACrB,IAAI,MAAM,CAAC,MAAM,IAAI,kBAAkB;gBAAE,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;QAC7D,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,aAAa;QACnB,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,UAAU;YAAE,OAAO;QAC5C,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,GAAG,EAAE;YAChC,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;YAC5B,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;QACpB,CAAC,EAAE,gBAAgB,CAAC,CAAC;QACrB,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,CAAC;IAC5B,CAAC;IAED,KAAK;QACH,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC;QACxC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAAC,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAAC,CAAC;QACpF,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE;YAC3C,OAAO,CAAC,KAAK,CAAC,sBAAsB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAChG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACvE,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED,KAAK;QACH,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;IAEO,KAAK,CAAC,OAAO;QACnB,MAAM,IAAI,CAAC,OAAO,CAAC;QACnB,MAAM,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAC;QACtC,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,IAAI,KAAe,CAAC;QACpB,IAAI,CAAC;YAAC,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAAC,CAAC;QAC9C,OAAO,KAAK,EAAE,CAAC;YAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO;YAAC,MAAM,KAAK,CAAC;QAAC,CAAC;QAC9F,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,IAAI,OAAO,GAAY,EAAE,CAAC;QAC1B,IAAI,KAAK,GAAa,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,KAAK,IAAsB,EAAE;YACxC,IAAI,CAAC,OAAO,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YACjC,IAAI,CAAC,MAAM,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC1D,KAAK,MAAM,IAAI,IAAI,KAAK;gBAAE,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1D,OAAO,GAAG,EAAE,CAAC;YAAC,KAAK,GAAG,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;QACF,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YAC7E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;YAC1D,IAAI,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO;gBAAE,SAAS;YACpI,IAAI,SAAS,EAAE,IAAI,GAAG;gBAAE,MAAM;YAC9B,IAAI,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,kBAAkB,IAAI,CAAC,MAAM,IAAI,EAAE;gBAAE,OAAO;YAC1F,OAAO,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;YAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnD,IAAI,OAAO,CAAC,MAAM,IAAI,kBAAkB,IAAI,CAAC,MAAM,IAAI,EAAE;gBAAE,OAAO;QACpE,CAAC;QACD,MAAM,IAAI,EAAE,CAAC;IACf,CAAC;CACF;AAED,0FAA0F;AAC1F,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAU;IAC1C,MAAM,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAC;IACtC,IAAI,CAAC,QAAQ;QAAE,OAAO;IACtB,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,GAAG,QAAQ,CAAC,OAAO,WAAW,EAAE;YAC1C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,QAAQ,CAAC,YAAY,EAAE;aACjD;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;IACxE,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAAU,EAAE,QAAiB;IAC/D,MAAM,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAC;IACtC,IAAI,CAAC,QAAQ;QAAE,OAAO;IACtB,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,GAAG,QAAQ,CAAC,OAAO,YAAY,EAAE;YAC3C,MAAM,EAAE,OAAO;YACf,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,QAAQ,CAAC,YAAY,EAAE;aACjD;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;YACtC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;IACxE,CAAC;AACH,CAAC;AAQD,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,MAAM,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAC;IACtC,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAEjD,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,QAAQ,CAAC,OAAO,YAAY,EAAE;YACtD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,QAAQ,CAAC,YAAY,EAAE,EAAE,GAAG,cAAc,EAAE,EAAE;YAClF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACnC,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC5D,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAEnD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC;IAC1B,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;IACxD,MAAM,IAAI,GAAG,GAAG,IAAI,MAAM,CAAC;IAC3B,MAAM,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,MAAM,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACzB,MAAM,SAAS,CAAC,kBAAkB,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC;AAC9D,CAAC"}

package/dist/hook-adapters.d.ts

@@ -1,2 +1,2 @@
-import { type Obj } from "./agents.js";
-export declare function adaptHookPayload(sourceAgent: string, raw: Obj): Obj;
+import type { Obj } from './agents.js';
+export declare function adaptHookPayload(sourceAgent: string, raw: Obj, suppliedEvent?: string): Obj;

package/dist/hook-adapters.js

@@ -1,74 +1,73 @@
-import { findAgent } from "./agents.js";
-// Claude Code, Codex, and Cursor all send tool_name/tool_input/session_id/cwd/hook_event_name
-// (core.normalize already reads exactly these fields, case-insensitively for hook_event_name).
-function passthrough(raw) {
-    // Cursor names its session `conversation_id`; without this its events are all "unassigned".
-    return raw.session_id === undefined && typeof raw.conversation_id === "string" ? { ...raw, session_id: raw.conversation_id } : raw;
-}
-// GitHub Copilot CLI's preToolUse payload is camelCase and has no hook_event_name field —
-// it's implied by which hooks.json array the handler is registered under.
-// toolArgs arrives as a JSON *string* (docs.github.com Copilot hooks reference), so parse it --
-// left as a string, everything downstream reads tool_input as empty.
+import { hookSpec, hookKind } from './hook-catalog.js';
+import { commandOf } from './activity.js';
+const obj = (v) => v && typeof v === 'object' && !Array.isArray(v) ? v : {};
 function parseArgs(value) {
-    if (typeof value !== "string")
+    if (typeof value !== 'string')
         return value;
     try {
-        const parsed = JSON.parse(value);
-        return parsed && typeof parsed === "object" ? parsed : value;
+        return JSON.parse(value);
     }
     catch {
         return value;
     }
 }
-function copilotCamel(raw) {
-    return {
-        ...raw,
-        session_id: raw.sessionId ?? raw.session_id,
-        cwd: raw.cwd,
-        tool_name: raw.toolName ?? raw.tool_name,
-        tool_input: parseArgs(raw.toolArgs ?? raw.tool_input),
-        // userPromptSubmitted carries `prompt` and no tool; treat it like Claude's UserPromptSubmit.
-        hook_event_name: raw.hook_event_name ?? (typeof raw.prompt === "string" && !(raw.toolName ?? raw.tool_name) ? "UserPromptSubmit" : "PreToolUse"),
-    };
-}
-// Best-effort fallback for agents whose stdin schema is not (yet) verified against vendor docs.
-function generic(raw) {
-    return {
-        ...raw,
-        session_id: raw.session_id ?? raw.sessionId ?? raw.session,
-        cwd: raw.cwd ?? raw.project_path ?? raw.workingDirectory ?? raw.working_directory,
-        tool_name: raw.tool_name ?? raw.toolName ?? raw.tool,
-        tool_input: raw.tool_input ?? raw.toolArgs ?? raw.toolInput ?? raw.input ?? raw.args,
-        hook_event_name: raw.hook_event_name ?? raw.hookEventName ?? raw.event,
-    };
+function text(value) {
+    if (typeof value === 'string')
+        return value;
+    if (Array.isArray(value))
+        return value.map(p => text(obj(p).text ?? obj(p).content) ?? '').filter(Boolean).join('\n');
+    if (value && typeof value === 'object')
+        return text(obj(value).content ?? obj(value).text);
 }
-// Gemini's documented pre_tool_execution contract nests the call under tool_call.
-// Gemini CLI's own documented hook payload (geminicli.com/docs/hooks/reference) is already flat
-// -- session_id, cwd, hook_event_name, tool_name, tool_input, prompt -- the same shape as Claude
-// Code/Codex/Cursor. The tool_call.{name,args} nesting and environment_id field below are kept
-// only as a defensive fallback for the unrelated Gemini API "Managed Agents" sandbox hook format
-// (ai.google.dev/gemini-api/docs/agent-hooks), which beam's config previously (incorrectly)
-// targeted for the "Gemini CLI" agent entry -- harmless to keep matching, never the primary path.
-function gemini(raw) {
-    const call = raw.tool_call && typeof raw.tool_call === "object" ? raw.tool_call : {};
+export function adaptHookPayload(sourceAgent, raw, suppliedEvent) {
+    let fields = raw;
+    if (sourceAgent === 'windsurf')
+        fields = Object.keys(obj(raw.tool_info)).length ? obj(raw.tool_info) : raw;
+    if (sourceAgent === 'antigravity')
+        fields = Object.keys(obj(raw.toolCall)).length ? obj(raw.toolCall) : raw;
+    if (sourceAgent === 'cline') {
+        for (const name of ['preToolUse', 'postToolUse', 'userPromptSubmit', 'taskStart', 'taskResume', 'taskCancel', 'taskComplete', 'taskError', 'sessionShutdown'])
+            if (raw[name] && typeof raw[name] === 'object') {
+                fields = obj(raw[name]);
+                break;
+            }
+    }
+    const kindName = suppliedEvent ?? raw.hook_event_name ?? raw.hookEventName ?? raw.hookName ?? raw.event;
+    const event = String(kindName ?? (typeof raw.prompt === 'string' && !(raw.toolName ?? raw.tool_name) ? 'UserPromptSubmit' : hookSpec(sourceAgent)?.events.find(e => hookKind(e) === 'pre') ?? ''));
+    const kind = hookKind(event);
+    const nested = obj(raw.tool_call);
+    let tool = fields.tool_name ?? fields.toolName ?? fields.tool ?? fields.name ?? nested.name;
+    if (sourceAgent === 'windsurf' && !tool)
+        tool = /read_code/.test(event) ? 'Read' : /write_code/.test(event) ? 'Edit' : /run_command/.test(event) ? 'Bash' : /mcp/.test(event) ? fields.mcp_tool_name : undefined;
+    if (event === 'beforeReadFile')
+        tool = tool ?? 'Read';
+    const inputValue = fields.tool_input ?? fields.toolArgs ?? fields.toolInput ?? fields.tool_args ?? fields.mcp_tool_arguments ?? fields.parameters ?? fields.arguments ?? fields.input ?? fields.args ?? nested.args;
+    const parsed = parseArgs(inputValue);
+    const toolInput = parsed === undefined ? (['windsurf', 'antigravity', 'cline'].includes(sourceAgent) ? { ...fields } : {}) : parsed;
+    const args = obj(toolInput);
+    const workspaceRoots = raw.workspace_roots ?? raw.workspaceRoots ?? raw.workspacePaths;
+    const roots = Array.isArray(workspaceRoots) ? workspaceRoots : [];
+    const prompt = text(raw.prompt ?? raw.user_prompt ?? raw.userPrompt ?? obj(raw.extra).user_message ?? fields.prompt ?? fields.userMessage ?? fields.message ?? (kind === 'prompt' ? raw.message ?? raw.input : undefined));
+    const isVSCode = ['copilot-cli', 'vscode'].includes(sourceAgent) && ((raw.hookEventName !== undefined && /^[A-Z]/.test(String(raw.hookEventName))) || (raw.tool_name !== undefined && raw.toolName === undefined && /^[A-Z]/.test(String(raw.hook_event_name ?? ''))));
     return {
         ...raw,
-        session_id: raw.session_id ?? raw.sessionId ?? raw.environment_id,
-        tool_name: raw.tool_name ?? raw.toolName ?? call.name,
-        tool_input: raw.tool_input ?? raw.toolArgs ?? call.args,
-        hook_event_name: raw.hook_event_name ?? "BeforeTool",
+        source_agent: isVSCode ? 'vscode' : sourceAgent,
+        session_id: (sourceAgent === "codex" ? raw.agent_id : undefined) ?? raw.session_id ?? raw.sessionId ?? raw.sessionID ?? raw.conversation_id ?? raw.conversationId ?? raw.trajectory_id ?? raw.taskId ?? raw.execution_id ?? raw.session ?? raw.environment_id,
+        parent_session_id: raw.parent_session_id ?? raw.parentSessionId ?? (sourceAgent === "codex" && raw.agent_id ? raw.session_id : undefined),
+        cwd: sourceAgent === 'junie' ? raw.project_path ?? raw.cwd : raw.cwd ?? raw.project_path ?? raw.workingDirectory ?? raw.working_directory ?? raw.working_dir ?? fields.cwd ?? roots[0],
+        tool_name: tool,
+        tool_input: toolInput,
+        tool_use_id: fields.tool_use_id ?? fields.toolUseId ?? fields.tool_call_id ?? fields.toolCallId ?? fields.callID ?? raw.tool_use_id ?? raw.tool_call_id ?? raw.call_id,
+        tool_response: raw.tool_response ?? raw.tool_result ?? raw.toolResult ?? raw.tool_output ?? raw.toolOutput ?? raw.result ?? raw.output ?? raw.metadata ?? fields.result ?? fields.output,
+        hook_event_name: event,
+        timestamp: typeof raw.timestamp === 'number' && Number.isFinite(raw.timestamp) ? new Date(raw.timestamp < 100000000000 ? raw.timestamp * 1000 : raw.timestamp).toISOString() : raw.timestamp,
+        command: commandOf({ ...raw, command: raw.command ?? fields.command ?? fields.commandLine ?? fields.command_line, tool_name: tool, tool_input: toolInput }),
+        file_path: raw.file_path ?? fields.file_path ?? fields.filePath ?? fields.path ?? args.file_path ?? args.filePath ?? args.path,
+        ...(prompt !== undefined ? { prompt } : {}),
+        ...(kind === 'prompt' ? { event_type: 'prompt.submit', tool_name: tool ?? event } : {}),
+        ...(kind === 'permission' ? { event_type: /denied/i.test(event) ? 'permission.denied' : /result|response/i.test(event) ? 'permission.result' : 'permission.requested' } : {}),
+        ...(kind === 'session' ? { event_type: /stop|end|finalize|shutdown|complete|cancel|error|deleted/i.test(event) ? 'session.end' : 'session.start' } : {}),
+        ...(kind === 'assistant' ? { event_type: 'message.assistant', assistant_text: text(raw.assistant_text ?? raw.last_assistant_message ?? obj(raw.extra).assistant_message ?? raw.response ?? raw.text ?? raw.message) } : {}),
     };
 }
-// Hermes Agent (pre_tool_call) and OpenClaw (before_tool_call) send the Claude-style fields but
-// name the event in their own words; core.normalize only marks an action "proposed" for PreToolUse.
-function preToolAlias(raw) {
-    const name = typeof raw.hook_event_name === "string" ? raw.hook_event_name.toLowerCase() : "";
-    return name === "pre_tool_call" || name === "before_tool_call" ? { ...raw, hook_event_name: "PreToolUse" } : raw;
-}
-const adapters = { passthrough, "copilot-camel": copilotCamel, generic, gemini, "pre-tool-alias": preToolAlias };
-export function adaptHookPayload(sourceAgent, raw) {
-    const agent = findAgent(sourceAgent);
-    const adapter = adapters[agent?.adapter ?? "generic"];
-    return adapter(raw);
-}
 //# sourceMappingURL=hook-adapters.js.map