@agent-beam/beam 0.2.38 → 0.2.40

package/dist/client.js

@@ -1,14 +1,22 @@
+import { spoolHookEvent } from "./hook-spool.js";
+import { hookKind } from "./hook-catalog.js";
+import { activityFor, commandOf } from "./activity.js";
+import { classifyActionContext } from "./action-context.js";
+import { environmentRisk } from "./access-risk.js";
 import { mkdir, open, readdir, readFile, rename, stat, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { isAbsolute, join, relative, resolve, sep } from "node:path";
-import { getBeamHome, getCollectorUrl, getDataDirectory } from "./config.js";
-import { normalize, scanText } from "./core.js";
+import { getApiUrl, getBeamHome, getCollectorUrl, getDataDirectory } from "./config.js";
+import { normalize, scanText, setIgnoredRules } from "./core.js";
 import { adaptHookPayload } from "./hook-adapters.js";
 import { forwardEvents } from "./forward.js";
 import { evaluate, readPolicy } from "./policy.js";
 import { extractAgent } from "./extract.js";
+import { readIdentity } from "./enroll.js";
 import { loadCustomRules } from "./custom-rules.js";
 import { redactSensitive } from "./data-detectors.js";
+import { redactWithSessionEntities } from "./entity-redaction.js";
+import { recordAndCheckAnomaly } from "./behavioral-anomaly.js";
 import { applyJevHook } from "./jev.js";
 import { applyJudgeHook } from "./judge.js";
 import { isPathTrusted, readTrustedPaths } from "./trusted-paths.js";
@@ -16,6 +24,8 @@ import { addBlockedTarget, isTargetBlocked, readBlockedTargets } from "./blocked
 import { promptTty } from "./tty-prompt.js";
 import { gateSkill } from "./skill-gate.js";
 import { notePrompt, sessionContextFor, sessionTitlesEnabled } from "./session-title.js";
+import { clampGrantMinutes, createApprovalRequest } from "./approvals.js";
+import { consumeApprovedAction, recordApprovedAction } from "./approved-actions.js";
 export async function readToken() {
     if (process.env.BEAM_TOKEN)
         return process.env.BEAM_TOKEN;
@@ -39,6 +49,16 @@ async function send(route, body) {
         throw new Error(`Collector rejected request: ${await response.text()}`);
     return response.json();
 }
+async function get(route) {
+    const url = getCollectorUrl();
+    const response = await fetch(`${url.origin}${route}`, {
+        headers: { Authorization: `Bearer ${await readToken()}` },
+        signal: AbortSignal.timeout(5000)
+    });
+    if (!response.ok)
+        throw new Error(`Collector rejected request: ${await response.text()}`);
+    return response.json();
+}
 async function boundedFile(filePath) {
     const stats = await stat(filePath);
     if (stats.size > 2_000_000)
@@ -51,6 +71,112 @@ export async function importEvents(filePath) {
 export async function reloadRemoteRules() {
     return send("/rules/reload", "{}");
 }
+function fromRemoteApproval(remote) {
+    return {
+        request_id: remote.id, approver: remote.approver, level: remote.level, mode: "SINGLE",
+        agent: remote.agent, tool: remote.tool, command: remote.command ?? "",
+        path: remote.path ?? undefined, url: remote.url ?? undefined,
+        policy_version: 1, risk_score: remote.riskScore, risk_level: remote.riskLevel, risk_factors: remote.riskFactors,
+        created_at: remote.createdAt, expires_at: remote.expiresAt,
+        status: remote.status, decision: remote.decision ?? undefined,
+        fingerprint: "", // approvalStillValid()'s dedup concept never applies to a remote-filed request
+        reason: remote.reason ?? undefined, decision_reason: remote.decisionReason ?? undefined,
+        grant_minutes: remote.grantMinutes ?? undefined,
+    };
+}
+// An enrolled device's request needs a workspace admin to see and resolve it, which only ever
+// happens on the shared collector -- same getApiUrl() + device-secret precedent as
+// forwardMcpInventory/forwardSkillInventory in forward.ts, never the local loopback server (which
+// has no concept of "another person" to ask). The collector's own /v1/approvals is
+// device-authenticated and device-scoped on purpose: a device can file and poll its own request,
+// but there is deliberately no device-authenticated way to resolve one -- that would let a device
+// approve its own blocked action. Resolution is an admin action in the dashboard (or, for a
+// single, unenrolled machine, the local `beam policy approve`/`reject` below).
+async function askRemoteApproval(identity, options, timeoutMs) {
+    const base = getApiUrl();
+    const auth = { Authorization: `Bearer ${identity.deviceSecret}` };
+    const postRes = await fetch(`${base}/v1/approvals`, {
+        method: "POST", signal: AbortSignal.timeout(5000),
+        headers: { ...auth, "Content-Type": "application/json" },
+        body: JSON.stringify({
+            agent: options.agent, tool: options.tool, command: options.command, path: options.path, url: options.url,
+            reason: options.reason, level: options.level, approver: options.approver ? [options.approver] : undefined,
+            timeoutSeconds: Math.max(1, Math.min(3600, Math.round(timeoutMs / 1000))),
+        }),
+    });
+    if (!postRes.ok)
+        throw new Error(`Collector rejected request: ${await postRes.text()}`);
+    const filed = fromRemoteApproval(await postRes.json());
+    const pollMs = options.pollMs ?? 2000;
+    for (;;) {
+        const listRes = await fetch(`${base}/v1/approvals`, { headers: auth, signal: AbortSignal.timeout(5000) });
+        if (!listRes.ok)
+            throw new Error(`Collector rejected request: ${await listRes.text()}`);
+        const all = (await listRes.json()).map(fromRemoteApproval);
+        const current = all.find(r => r.request_id === filed.request_id);
+        if (!current)
+            throw new Error("The collector lost track of this approval request.");
+        if (current.status !== "PENDING")
+            return current;
+        if (Date.parse(current.expires_at) <= Date.now())
+            return { ...current, status: "EXPIRED", decision: "EXPIRE" };
+        await new Promise(resolve => setTimeout(resolve, pollMs));
+    }
+}
+async function askLocalApproval(options, timeoutMs) {
+    const request = createApprovalRequest({
+        approver: [options.approver ?? "admin"],
+        level: options.level ?? "ADMIN",
+        mode: "SINGLE",
+        agent: options.agent,
+        tool: options.tool,
+        command: options.command ?? "",
+        path: options.path,
+        url: options.url,
+        policy_version: 1,
+        risk_score: 50,
+        risk_level: "MEDIUM",
+        risk_factors: [],
+        reason: options.reason,
+    }, timeoutMs);
+    await send("/approvals", JSON.stringify(request));
+    const pollMs = options.pollMs ?? 2000;
+    for (;;) {
+        const all = await get("/approvals");
+        const current = all.find(r => r.request_id === request.request_id);
+        if (!current)
+            throw new Error("The collector lost track of this approval request.");
+        if (current.status !== "PENDING")
+            return current;
+        if (Date.parse(current.expires_at) <= Date.now())
+            return { ...current, status: "EXPIRED", decision: "EXPIRE" };
+        await new Promise(resolve => setTimeout(resolve, pollMs));
+    }
+}
+export async function askApproval(options) {
+    const timeoutMs = options.timeoutMs ?? 10 * 60_000;
+    const identity = await readIdentity();
+    const result = identity ? await askRemoteApproval(identity, options, timeoutMs) : await askLocalApproval(options, timeoutMs);
+    // Closes the loop: the agent's retry of this exact action goes straight through next time,
+    // without filing a second request -- see approved-actions.ts. The approver's own chosen
+    // duration (10-60 minutes, grant_minutes) drives how long the retry window stays open; an
+    // older collector/dashboard that never set it falls back to DEFAULT_GRANT_MINUTES.
+    if (result.status === "APPROVED") {
+        const ttlMs = clampGrantMinutes(result.grant_minutes) * 60_000;
+        await recordApprovedAction({ agent: options.agent, tool: options.tool, command: options.command, path: options.path, url: options.url }, ttlMs).catch(() => { });
+    }
+    return result;
+}
+// Local-machine only, deliberately: see askRemoteApproval()'s comment above for why an enrolled
+// device has no remote equivalent of these two yet (that's an admin-authenticated dashboard
+// surface, not this device-authenticated collector).
+export async function listPendingApprovals() {
+    const all = await get("/approvals");
+    return all.filter(r => r.status === "PENDING");
+}
+export async function resolveApproval(requestId, decision, approver, decisionReason, grantMinutes) {
+    return send("/approvals/resolve", JSON.stringify({ request_id: requestId, decision, approver, decision_reason: decisionReason, grant_minutes: grantMinutes }));
+}
 export async function scanFile(filePath, options = {}, beamHome = getBeamHome()) {
     const content = await boundedFile(filePath);
     const kind = options.mcp ? "mcp" : "skill";
@@ -70,6 +196,7 @@ const INGEST_BATCH_SIZE = 2000; // matches the collector's own per-request recor
 // custom rules instead of erroring, so keep them distinct rather than reusing one parameter.
 export async function extractPreview(agentId, limit = 200, home = homedir(), beamHome = getBeamHome()) {
     await loadCustomRules(beamHome);
+    setIgnoredRules((await readPolicy().catch(() => null))?.rules.ignoredRules ?? [], agentId);
     const records = await extractAgent(agentId, home);
     const events = [];
     for (const record of records) {
@@ -405,17 +532,38 @@ async function readStdin(limitBytes) {
     return input;
 }
 // Never throws: best-effort capture must not suppress configured policy enforcement.
-export async function captureHook(sourceAgent = "claude-code", home = homedir()) {
+export async function captureHook(sourceAgent = "claude-code", home = homedir(), suppliedEvent) {
+    let canBlock = suppliedEvent === undefined || hookKind(suppliedEvent) === "pre";
     try {
-        const input = await readStdin(100_000);
+        const input = await readStdin(2_000_000);
         const raw = JSON.parse(input);
-        let data = adaptHookPayload(sourceAgent, raw);
+        let data = adaptHookPayload(sourceAgent, raw, suppliedEvent);
+        sourceAgent = String(data.source_agent ?? sourceAgent);
         data.source_agent = sourceAgent;
         data.source_type = "hook";
-        if (data.hook_event_name === "UserPromptSubmit" && typeof data.prompt === "string") {
-            data.event_type = data.event_type ?? "prompt.submit";
-            data.tool_name = data.tool_name ?? "UserPromptSubmit";
-            data.command = data.command ?? data.prompt;
+        const eventKind = hookKind(String(data.hook_event_name ?? ""));
+        const promptGate = eventKind === "prompt" && ["claude-code", "codex", "cursor", "gemini"].includes(sourceAgent);
+        canBlock = eventKind === "pre" || promptGate;
+        if (eventKind === "prompt" && typeof data.prompt === "string") {
+            data.event_type = "prompt.submit";
+            data.tool_name = data.tool_name ?? data.hook_event_name;
+            data.command = data.prompt;
+            if (sessionTitlesEnabled())
+                await notePrompt(String(data.session_id ?? ""), data.prompt, String(data.cwd ?? "")).catch(() => { });
+        }
+        // Completed actions, permission notifications, and lifecycle callbacks are observation only.
+        // They must never run pre-action policy, skill approval, or action-judge gates.
+        if (!canBlock) {
+            if (eventKind === "post" && sourceAgent === "claude-code") {
+                const bundle = await readPolicy().catch(() => null);
+                await emitRedactedOutput(sourceAgent, data.tool_response, String(data.session_id ?? ""), bundle?.rules.customDetectors).catch(() => { });
+            }
+            await captureActivity(data);
+            if (sourceAgent === "cline")
+                process.stdout.write(JSON.stringify({ cancel: false }));
+            if (sourceAgent === "antigravity" && eventKind === "assistant")
+                process.stdout.write(JSON.stringify({ decision: "stop" }));
+            return;
         }
         // Model and token-usage backfill are independent: a newer agent build (Codex 0.155.1+ sends
         // `model` as a common field on every hook event -- see learn.chatgpt.com/docs/hooks) can
@@ -457,13 +605,29 @@ export async function captureHook(sourceAgent = "claude-code", home = homedir())
             catch { /* best-effort enrichment only -- never block the hook on this */ }
         }
         // 1. Enforcement first — a local file read, so it works even if the collector is down.
-        //    Only acts when a manager has set the policy to advisory/enforce; observe mode
-        //    (the default) is a no-op and Beam stays observation-only.
+        //    General rules follow advisory/enforce mode. Explicit mandatory mitigation
+        //    blocks can deny matching calls while unrelated calls remain in observe mode.
         const toolInput = data.tool_input && typeof data.tool_input === "object"
             ? data.tool_input : {};
-        const command = String(data.command ?? toolInput.command ?? "");
-        let decision = evaluate(await readPolicy().catch(() => null), {
+        const command = commandOf(data);
+        // Beam's own escape hatch: an agent blocked by policy -- even a fully disabled agent or a
+        // workspace-wide "blockedTools: [Bash]" -- must still be able to ask a human for an
+        // exception, or the block is a dead end with no way out. This unconditionally skips every
+        // check below (policy evaluate(), self-protection, risk escalation, anomaly tracking) for
+        // exactly that one command, before any of them run.
+        if (isApprovalEscapeHatch(String(data.tool_name ?? ""), command)) {
+            data.policy_decision = { action: "allow", rule: "beam.approval-escape-hatch" };
+            await captureActivity(data);
+            if (["cline", "antigravity"].includes(sourceAgent))
+                emitAllow(sourceAgent, undefined, String(data.hook_event_name ?? "PreToolUse"));
+            return;
+        }
+        const policyBundle = await readPolicy().catch(() => null);
+        setIgnoredRules(policyBundle?.rules.ignoredRules ?? [], sourceAgent);
+        let decision = evaluate(policyBundle, {
             agent: sourceAgent,
+            eventType: promptGate ? "prompt.submit" : undefined,
+            input: toolInput,
             tool: String(data.tool_name ?? ""),
             command,
             args: Array.isArray(toolInput.args) ? toolInput.args.map(String) : command.split(/\s+/).slice(1),
@@ -471,7 +635,7 @@ export async function captureHook(sourceAgent = "claude-code", home = homedir())
             url: String(toolInput.url ?? data.url ?? ""),
             role: typeof data.role === "string" ? data.role : undefined,
             user: typeof data.user === "string" ? data.user : undefined,
-            cwd: typeof data.cwd === "string" ? data.cwd : undefined,
+            cwd: typeof toolInput.workdir === "string" ? toolInput.workdir : typeof data.cwd === "string" ? data.cwd : undefined,
             repository: typeof data.repository === "string" ? data.repository : undefined,
             branch: typeof data.branch === "string" ? data.branch : undefined,
             environment: typeof data.environment === "string" ? data.environment : undefined,
@@ -496,6 +660,25 @@ export async function captureHook(sourceAgent = "claude-code", home = homedir())
                 reason: "Beam protection cannot be disabled, removed, or modified by an agent.",
             };
         }
+        // Behavioral anomaly: a burst of high/critical-severity actions from one session, independent
+        // of whether any single one was individually blocked -- the shape an agent shows when it's
+        // been talked into a chain of risky actions (injection, a compromised skill, a confused
+        // multi-step plan), even if each step alone only ever rated "ask". Recorded regardless of this
+        // action's own decision (a blocked/asked action still happened and still counts), but only
+        // ever escalates a decision that's currently allow/warn -- never downgrades an existing ask/deny.
+        try {
+            const anomaly = await recordAndCheckAnomaly(String(data.session_id ?? data.sessionId ?? ""), decision.riskLevel);
+            if (anomaly.triggered) {
+                const reason = `${anomaly.count} high/critical-severity actions from this session in the last ${anomaly.windowMinutes} minutes.`;
+                if (decision.mode === "observe" && decision.action === "allow") {
+                    decision = { ...decision, riskFactors: [...new Set([...decision.riskFactors, "behavioral anomaly: action burst"])], reason };
+                }
+                else if (decision.mode !== "observe" && (decision.action === "allow" || decision.action === "warn")) {
+                    decision = { ...decision, action: "ask", rule: "beam.behavioral-anomaly", reason };
+                }
+            }
+        }
+        catch { /* best-effort: must never block the agent on anomaly-tracking failure */ }
         const policyMode = decision.mode;
         if (decision.action === "allow" && workspace) {
             const escaping = outsideWorkspacePaths(workspace, targetPath, command);
@@ -549,46 +732,38 @@ export async function captureHook(sourceAgent = "claude-code", home = homedir())
         // step only ever runs for Beam's own soft, non-mandatory fallback.
         if (decision.action === "warn")
             decision = await resolveWarnInteractively(decision, targetPath, command);
-        // Detection and policy enforcement above already ran against the real prompt text and
-        // session id -- neither is forwarded to the local collector or the workspace dashboard from
-        // this point on. event_type/tool_name still identify a prompt-submit event; the content and
-        // the session identifier do not leave this machine. Scoped to prompt.submit only -- deleting
-        // session_id on every event type broke session grouping (and the tool_use_id dedup in
-        // core.ts, which is keyed per-hostname/phase but not per-session) for all other hook events.
-        // The only things derived from a prompt that are allowed out: a session title (first prompt) and
-        // a short per-turn topic, both redacted and capped at 80 characters -- see session-title.ts.
-        // Raw prompt text still never leaves the machine.
-        if (sessionTitlesEnabled()) {
-            try {
-                const sessionId = String(data.session_id ?? data.sessionId ?? "");
-                // Cursor (beforeSubmitPrompt) and Gemini (BeforeAgent) name their prompt hook differently
-                // from Claude Code / Codex, and are not rewritten to prompt.submit above (each agent's
-                // block contract is keyed on its own event name), so recognise them here.
-                const otherPromptHook = ["beforeSubmitPrompt", "BeforeAgent"].includes(String(data.hook_event_name)) && typeof data.prompt === "string";
-                if (data.event_type === "prompt.submit" || otherPromptHook) {
-                    await notePrompt(sessionId, String(data.prompt ?? ""), String(data.cwd ?? ""));
-                    if (otherPromptHook)
-                        delete data.prompt; // the raw prompt must not travel further than this check
-                }
-                else {
-                    const context = await sessionContextFor(sourceAgent, sessionId, { home, transcriptPath: typeof data.transcript_path === "string" ? data.transcript_path : undefined });
-                    if (context) {
-                        data.session_title = context.title;
-                        data.session_title_source = context.titleSource;
-                        data.turn = context.turn;
-                        data.turn_topic = context.topic;
-                        data.turn_shift = context.shift;
-                    }
-                }
+        // Retain redacted prompts and session identities now that prompt activity is part of capture.
+        if (sessionTitlesEnabled() && data.session_id && eventKind !== "prompt") {
+            const context = await sessionContextFor(sourceAgent, String(data.session_id), { home }).catch(() => null);
+            if (context) {
+                data.session_title = context.title;
+                data.session_title_source = context.titleSource;
+                data.turn = context.turn;
+                data.turn_topic = context.topic;
+                data.turn_shift = context.shift;
             }
-            catch { /* best-effort: a title must never affect enforcement */ }
         }
-        if (data.event_type === "prompt.submit") {
-            delete data.prompt;
-            delete data.command;
-            delete data.session_id;
-            delete data.sessionId;
-            delete data.session;
+        // An admin already approved this exact action (via `beam policy ask`, resolved in the
+        // dashboard or locally with `beam policy approve`) -- let the retry through instead of
+        // blocking it again. Single-use (see approved-actions.ts) and never for self-protection, same
+        // as the hint below: that guardrail isn't something this channel can grant an exception to.
+        if ((decision.action === "deny" || decision.action === "ask") && decision.rule !== "beam.self-protection") {
+            const granted = await consumeApprovedAction({ agent: sourceAgent, tool: String(data.tool_name ?? ""), command, path: targetPath, url: String(toolInput.url ?? data.url ?? "") }).catch(() => false);
+            if (granted)
+                decision = { ...decision, action: "allow", rule: "beam.approval-granted", reason: "Approved by a workspace admin." };
+        }
+        // Tell the agent its way out: a flat "no" with no next step just invites it to retry, rephrase,
+        // or work around the block. Skipped for Beam's own self-protection -- that guardrail is never
+        // meant to be appealed through this channel.
+        if (decision.action === "deny" && decision.rule !== "beam.self-protection") {
+            const target = (toolInput.file_path ?? toolInput.path ?? data.file_path ?? toolInput.url ?? data.url ?? command ?? "").toString().replace(/"/g, '\\"');
+            // --agent/--tool must name the real agent and tool that's blocked here, not the CLI's own
+            // "cli"/"Bash" defaults -- an approval is recorded under exactly those two fields
+            // (approved-actions.ts), and the retry this is meant to unblock will report the real ones,
+            // not the defaults. A mismatch here is why an approval silently fails to grant the retry.
+            const toolName = String(data.tool_name ?? "Bash").replace(/"/g, '\\"');
+            if (target)
+                decision = { ...decision, reason: `${decision.reason ?? "Blocked by workspace policy."} If this is necessary, ask a workspace admin for an exception: beam policy ask "${target}" "<explain why you need this>" --agent "${sourceAgent}" --tool "${toolName}"` };
         }
         data.policy_decision = { action: decision.action, rule: decision.rule, reason: decision.reason, risk_score: decision.riskScore, risk_level: decision.riskLevel, risk_factors: decision.riskFactors };
         const hookEvent = String(data.hook_event_name ?? "PreToolUse");
@@ -602,7 +777,7 @@ export async function captureHook(sourceAgent = "claude-code", home = homedir())
             emitAsk(sourceAgent, decision.reason ?? "This action requires approval.", hookEvent);
         }
         else if (decision.action === "redact") {
-            const transformed = redactPayload(data, decision);
+            const transformed = await redactPayload(data, decision, String(data.session_id ?? data.sessionId ?? ""));
             if (!transformed.changed) {
                 emitAllow(sourceAgent, decision.reason, hookEvent);
             }
@@ -617,21 +792,10 @@ export async function captureHook(sourceAgent = "claude-code", home = homedir())
             // prompt.
             process.stderr.write(`\n⚠ Beam policy (advisory): ${decision.reason}\n`);
         }
-        // 2. Local capture (best-effort — a failure here must not skip enforcement or throw). The
-        //    running collector (serve.ts) also batches this event into its own workspace forward --
-        //    see ForwardQueue in forward.ts -- so most events reach the dashboard in groups rather
-        //    than one request per action. Allowed prompt.submit events are skipped here: policy
-        //    enforcement above already ran against them, but every keystroke-triggered prompt
-        //    otherwise floods the Activity/Overview views with noise nobody reviews. A blocked
-        //    prompt is still surfaced -- see step 3 below.
-        if (data.event_type !== "prompt.submit" || decision.action === "deny") {
-            try {
-                await send("/ingest", JSON.stringify(data));
-            }
-            catch (e) {
-                console.error(e instanceof Error ? e.message : String(e));
-            }
-        }
+        if (["cline", "antigravity"].includes(sourceAgent) && ["allow", "audit", "warn"].includes(decision.action))
+            emitAllow(sourceAgent, decision.reason, hookEvent);
+        // Capture every lifecycle event, including allowed prompts and tool completions.
+        await captureActivity(data);
         // 3. A policy-blocked action carries a finding the collector's own normalize() can't
         //    reconstruct (it only knows about *this* process's policy decision) -- forward it to the
         //    workspace immediately rather than folding it into the batch, so a manager sees a block
@@ -651,13 +815,46 @@ export async function captureHook(sourceAgent = "claude-code", home = homedir())
         // confirms exit 2 blocks both BeforeTool and BeforeAgent, same as decision: "deny") and is
         // also treated as failure by OpenCode's native plugin wrapper.
         const policy = await readPolicy().catch(() => null);
-        if (policy && (policy.rules.mode === "enforce" || policy.errors?.length)) {
+        if (canBlock && policy && (policy.rules.mode === "enforce" || policy.errors?.length)) {
             // emitDeny already sets exit code 2 for the agents where that's the documented fail-closed
             // signal (see EXIT_2_FAILS_CLOSED above).
             emitDeny(sourceAgent, "Beam security policy could not complete safely; execution is denied.");
         }
     }
 }
+async function captureActivity(data) {
+    try {
+        const policy = await readPolicy().catch(() => null);
+        const redacted = await redactPayload(data, { customDetectors: policy?.rules.customDetectors }, String(data.session_id ?? ""));
+        const a = activityFor(redacted.data, value => redactSensitive(value, policy?.rules.customDetectors).text);
+        if (!a)
+            return;
+        const projected = {};
+        for (const field of ["source_agent", "source_type", "hook_event_name", "session_id", "parent_session_id", "tool_name", "tool_use_id", "event_type", "command", "file_path", "url", "cwd", "model", "timestamp", "session_title", "session_title_source", "turn", "turn_topic", "turn_shift", "input_tokens", "output_tokens", "policy_decision", "status", "error", "is_error", "reason", "decision", "permission_decision", "permissionDecision", "approval", "approved", "agent_id", "agent_type", "subagent_id", "child_session_id", "exit_code", "exitCode", "duration_ms"]) {
+            const value = redacted.data[field];
+            if (value !== undefined)
+                projected[field] = typeof value === "string" ? value.slice(0, 4000) : value;
+        }
+        const details = a.details;
+        if (details)
+            for (const [key, value] of Object.entries(details))
+                projected[key] = value;
+        projected.tool_input = a.input;
+        projected.tool_response = a.output;
+        projected.prompt = a.prompt;
+        projected.assistant_text = a.assistant;
+        projected.capture_truncated = a.truncated;
+        try {
+            await send("/ingest", JSON.stringify(projected));
+        }
+        catch {
+            await spoolHookEvent(projected);
+        }
+    }
+    catch (e) {
+        process.stderr.write(`Beam activity capture failed: ${e instanceof Error ? e.message : String(e)}\n`);
+    }
+}
 function safeNormalize(data) {
     try {
         return normalize(data);
@@ -695,12 +892,18 @@ async function resolveWarnInteractively(decision, targetPath, command) {
 }
 function isEnvironmentAccess(tool, command, path, input) {
     const text = `${tool} ${command} ${path} ${Object.values(input).filter(value => typeof value === "string").join(" ")}`;
+    const context = classifyActionContext(tool, { ...input, file_path: path }, "", command, v => v, false);
+    const scoped = environmentRisk(context);
+    if (context.actions.length && context.actions.every(a => a.operation === "source-search"))
+        return false;
     // File reads: .env, .env.local, .env.prod, etc. Also catch common env/config
     // locations that contain exported credentials.
     if (/(^|[\\/\s"'])\.env(?:\.[\w.-]+)?(?:$|[\\/\s"'])/i.test(text))
         return true;
     if (/(^|[\\/\s"'])\.aws[\\/]credentials(?:$|[\\/\s"'])|(^|[\\/\s"'])\.config[\\/]gcloud(?:$|[\\/\s"'])/i.test(text))
         return true;
+    if (scoped && ("suppress" in scoped || "severity" in scoped && scoped.severity === "info"))
+        return false;
     // Shell/process environment reads: env, printenv, set, export -p, $FOO,
     // process.env, os.environ and equivalent tool arguments.
     return /\b(?:printenv|env|export\s+-p|process\.env|os\.environ|System\.getenv)\b/i.test(text)
@@ -724,6 +927,30 @@ function outsideWorkspacePaths(cwd, target, command) {
         return escaped === ".." || escaped.startsWith(`..${sep}`) || isAbsolute(escaped);
     });
 }
+// Exempts exactly `beam policy ask`/`pending` from every policy check -- filing or reading a
+// request is harmless and must always be reachable, even for a fully disabled agent. Deliberately
+// NOT `approve`/`reject`: those decide a request rather than merely file or read one, and exempting
+// them would let an agent on an unenrolled, single-machine setup file its own request and
+// immediately self-approve it, defeating the whole point of asking a human.
+function isApprovalEscapeHatch(tool, command) {
+    if (!/^(?:bash|shell|terminal|exec_command|shell_command|run_shell_command|command|execute_bash|run_command|run_terminal_cmd)$/i.test(tool))
+        return false;
+    const trimmed = command.trim();
+    // Command substitution ($(...) and backticks) stays live even inside double quotes in a POSIX
+    // shell, so a malicious payload hidden in the reason/target argument -- `beam policy ask
+    // "$(rm -rf /)" "x"` -- can't be waved through just because it's quoted; checked against the
+    // raw string, before anything is stripped.
+    if (/\$\(|`/.test(trimmed))
+        return false;
+    // Control operators (; & | < > newline) lose their meaning once quoted, so a legitimate reason
+    // like "deploy; already reviewed" must not trip this -- checked with quoted spans stripped out
+    // first. Anything left outside quotes (real chaining, e.g. `beam policy ask x y && rm -rf /`)
+    // still gets caught.
+    const unquoted = trimmed.replace(/"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'/g, "");
+    if (/[;&|<>\n]/.test(unquoted))
+        return false;
+    return /^(?:\S*[\\/])?beam(?:\.exe)?\s+policy\s+(?:ask\s+\S[\s\S]*|pending\b(?:\s+--?[\w-]+(?:\s+\S+)?)*\s*)$/i.test(trimmed);
+}
 function isBeamSelfProtectionTarget(tool, command, target) {
     const beamHome = resolve(getBeamHome());
     const beamData = resolve(getDataDirectory());
@@ -736,28 +963,55 @@ function isBeamSelfProtectionTarget(tool, command, target) {
 function blockedFinding(reason = "Blocked by workspace policy.") {
     return { id: "policy.blocked", title: "Blocked by workspace policy", severity: "high", explanation: reason, evidence: "" };
 }
-function redactPayload(data, decision) {
+async function redactPayload(data, decision, sessionId) {
     const copy = structuredClone(data);
     let changed = false;
-    const redactValue = (value) => {
+    const redactValue = async (value) => {
         if (typeof value === "string") {
-            const result = redactSensitive(value, decision.customDetectors);
+            const result = await redactWithSessionEntities(value, sessionId, decision.customDetectors);
             changed ||= result.text !== value;
             return result.text;
         }
         if (Array.isArray(value))
-            return value.map(redactValue);
+            return Promise.all(value.map(redactValue));
         if (value && typeof value === "object")
-            return Object.fromEntries(Object.entries(value).map(([k, v]) => [k, redactValue(v)]));
+            return Object.fromEntries(await Promise.all(Object.entries(value).map(async ([k, v]) => [k, await redactValue(v)])));
         return value;
     };
-    return { data: redactValue(copy), changed };
+    const redacted = await redactValue(copy);
+    return { data: redacted, changed };
 }
 // Claude Code and Codex use the same hookSpecificOutput.permissionDecision contract for every
 // hook event -- only the echoed hookEventName differs per event (verified against
-// code.claude.com/docs/en/hooks for both PreToolUse and UserPromptSubmit).
+// code.claude.com/docs/en/hooks for PreToolUse, UserPromptSubmit, and PostToolUse).
 function claudeStyleHookEventName(event) {
-    return event === "UserPromptSubmit" ? "UserPromptSubmit" : "PreToolUse";
+    return event === "UserPromptSubmit" || event === "PostToolUse" ? event : "PreToolUse";
+}
+// A tool has already run by the time PostToolUse fires -- there is nothing left to block, only
+// what Claude sees afterward to rewrite (hookSpecificOutput.updatedToolOutput). This is the
+// counterpart to redactPayload()/emitRedacted() below, which redact a secret that was already in
+// the *command text* before it runs; this instead catches a secret that only appears in a
+// command's *output* (`cat .env` holding a real, un-migrated value; an app echoing its own
+// resolved config) -- the input had nothing to redact, so PreToolUse redaction never saw it.
+// Only wired for claude-code (see agents.ts notes): Codex's PostToolUse payload shape and
+// updatedToolOutput support are unverified, and sending a rewrite a client doesn't honor would
+// silently do nothing while looking like protection.
+async function emitRedactedOutput(agent, toolResponse, sessionId, customDetectors) {
+    if (agent !== "claude-code" || toolResponse === null || toolResponse === undefined)
+        return;
+    const redactValue = async (value) => {
+        if (typeof value === "string")
+            return (await redactWithSessionEntities(value, sessionId, customDetectors)).text;
+        if (Array.isArray(value))
+            return Promise.all(value.map(redactValue));
+        if (value && typeof value === "object")
+            return Object.fromEntries(await Promise.all(Object.entries(value).map(async ([k, v]) => [k, await redactValue(v)])));
+        return value;
+    };
+    const redacted = await redactValue(toolResponse);
+    if (JSON.stringify(redacted) === JSON.stringify(toolResponse))
+        return; // nothing to rewrite
+    process.stdout.write(JSON.stringify({ hookSpecificOutput: { hookEventName: "PostToolUse", updatedToolOutput: redacted } }));
 }
 function emitAsk(agent, reason, event = "PreToolUse") {
     if (agent === "claude-code" || agent === "codex") {
@@ -787,6 +1041,14 @@ function emitRedacted(agent, data, reason, event = "PreToolUse") {
         emitDeny(agent, "Beam cannot safely return transformed input through this hook contract.", event);
 }
 function emitAllow(agent, reason, event = "PreToolUse") {
+    if (agent === "cline") {
+        process.stdout.write(JSON.stringify({ cancel: false }));
+        return;
+    }
+    if (agent === "antigravity") {
+        process.stdout.write(JSON.stringify({ decision: "ask" }));
+        return;
+    }
     if (agent === "claude-code" || agent === "codex")
         process.stdout.write(JSON.stringify({ hookSpecificOutput: { hookEventName: claudeStyleHookEventName(event), permissionDecision: "allow", permissionDecisionReason: reason } }));
     else if (agent === "cursor" && event === "beforeSubmitPrompt")
@@ -804,12 +1066,12 @@ function emitAllow(agent, reason, event = "PreToolUse") {
 // content", separately from the exit-0 hookSpecificOutput.permissionDecision path). Setting this
 // alongside the JSON is belt-and-suspenders, not a replacement -- the JSON still carries the
 // clean reason text; exit 2 just guarantees the block itself isn't silently skipped.
-const EXIT_2_FAILS_CLOSED = new Set(["claude-code", "codex", "cursor", "copilot-cli", "gemini", "opencode", "openclaw", "hermes"]);
+const EXIT_2_FAILS_CLOSED = new Set(["claude-code", "codex", "cursor", "copilot-cli", "gemini", "opencode", "openclaw", "hermes", "windsurf", "kimi", "qwen", "auggie", "kiro", "goose", "openhands", "crush", "junie"]);
 // Claude Code / Codex hook contract: a JSON decision on stdout denies the tool call or prompt.
 // Other agents get a stderr note only (their block contracts differ and aren't verified), except
 // where noted below.
 function emitDeny(agent, reason, event = "PreToolUse") {
-    if (agent === "claude-code" || agent === "codex") {
+    if (["claude-code", "codex", "muse", "vscode", "factory"].includes(agent)) {
         process.stdout.write(JSON.stringify({
             hookSpecificOutput: {
                 hookEventName: claudeStyleHookEventName(event),
@@ -839,9 +1101,26 @@ function emitDeny(agent, reason, event = "PreToolUse") {
         process.stdout.write(JSON.stringify({ decision: "deny", reason: `Beam: ${reason}` }));
     }
     else if (agent === "hermes") {
-        // Hermes shell hooks block with {"decision": "block", "reason"} (or exit 2, set below).
+        process.stdout.write(JSON.stringify({ action: "block", message: `Beam: ${reason}`, decision: "block", reason: `Beam: ${reason}` }));
+    }
+    else if (["pi", "kilo"].includes(agent)) {
+        process.stdout.write(JSON.stringify({ block: true, reason: `Beam: ${reason}` }));
+    }
+    else if (agent === "cline") {
+        process.stdout.write(JSON.stringify({ cancel: true, errorMessage: `Beam: ${reason}` }));
+    }
+    else if (agent === "amp") {
+        process.stdout.write(JSON.stringify({ action: "reject-and-continue", message: `Beam: ${reason}` }));
+    }
+    else if (["antigravity", "grok"].includes(agent)) {
+        process.stdout.write(JSON.stringify({ decision: "deny", reason: `Beam: ${reason}` }));
+    }
+    else if (agent === "devin") {
         process.stdout.write(JSON.stringify({ decision: "block", reason: `Beam: ${reason}` }));
     }
+    else if (["windsurf", "kimi", "qwen", "auggie", "kiro", "goose", "openhands", "crush", "junie"].includes(agent)) {
+        // These hosts use exit code 2, set below.
+    }
     else {
         // OpenCode has no installed hook/plugin path in this repository. A message cannot block it.
         process.stderr.write(`\n✖ Beam cannot block this agent (${agent}): no verified enforcement adapter is installed.\n`);