> ## Documentation Index
> Fetch the complete documentation index at: https://asymptotelabs-fix-postinstall-refresh-user-hooks.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Agent Beacon CLI Changelog

> Latest updates and improvements to the Agent Beacon CLI

## Latest updates

Stay up to date with the latest changes to the Agent Beacon CLI.

***

## June 2026

### v0.0.90 · June 26, 2026

* **Multiple daily updater windows** · The endpoint updater LaunchDaemon now checks during five local business-hour windows, at 9 AM, noon, 3 PM, 6 PM, and 9 PM, while still honoring update mode and jitter for fleet-friendly rollout.

### v0.0.89 · June 26, 2026

* **Rollback staging cleanup** · Successful update rollback now removes large staged package and rollback snapshots, leaving a small `last_failure.json` diagnostic instead of retaining a full old `/opt/beacon` tree. If rollback itself fails, recovery materials remain in place for manual repair.

### v0.0.88 · June 26, 2026

* **Vector forwarder preservation during self-update** · Package postinstall now restores pre-existing S3 and Falcon Vector forwarders with retry, running-state verification, and preserved `launchctl` diagnostics. A package update now fails loudly if a previously configured forwarder cannot be restored, avoiding silent log-forwarding outages.

### v0.0.87 · June 26, 2026

* **Updater reload waits for the running job** · Deferred updater LaunchDaemon reload now waits for the actual scheduled updater job to exit before reloading launchd, avoiding races with slow self-update health checks.

### v0.0.86 · June 26, 2026

* **Deferred updater reload after self-update** · Package postinstall schedules a safe updater LaunchDaemon reload after the active self-update exits, so new updater plist changes take effect without killing the in-flight update.

### v0.0.85 · June 26, 2026

* **Business-hours updater schedule** · The endpoint updater schedule moved from overnight to 2 PM local time so managed laptops are more likely to be awake for update checks.
* **Successful update staging cleanup** · Healthy self-updates now clean staged download and rollback directories, leaving only the reusable update lock in the updater state directory.

### v0.0.84 · June 26, 2026

* **Updater daemon persistence after self-update** · Auto-update reconciliation now leaves the running updater LaunchDaemon in place when package postinstall is invoked by the updater itself, so `auto` mode remains loaded after a successful daemon-driven update.

### v0.0.83 · June 26, 2026

* **CLI launch banner** · Added the new Beacon CLI banner and routed root command output through the shared splash path for a more consistent command-line entrypoint.

### v0.0.82 · June 25, 2026

* **Launchd restart hardening for self-update** · Self-update now restarts the collector with `launchctl kickstart -k` and handles already-loaded launchd jobs idempotently, preventing valid package updates from rolling back when package postinstall has already restarted the collector.

### v0.0.81 · June 25, 2026

* **Apply-capable updater daemon lifecycle** · Apple Silicon system package installs can explicitly enable `auto` mode so the updater LaunchDaemon applies compatible signed package releases on its scheduled run, while `--check-only` remains available and updates stay off by default.
* **Package lifecycle reconciliation** · macOS package installs preserve existing `auto_update` mode, reconcile the updater LaunchDaemon during postinstall, avoid killing the updater from preinstall, and remove the updater job during endpoint uninstall.

### v0.0.80 · June 25, 2026

* **Self-update verification on managed Macs** · Manual endpoint package apply no longer requires full Xcode just to run `stapler validate`. Beacon still requires the manifest checksum, Developer ID Installer signature, and Gatekeeper install assessment to pass, while treating unavailable `stapler` on Command Line Tools-only endpoints as a best-effort check so MDM-installed Macs can self-update.

### v0.0.79 · June 25, 2026

* **Full endpoint inventory heartbeats** · Inventory heartbeats now scan all supported local inventory candidates by default instead of only Cursor and Claude Code, while `inventory_heartbeat.runtimes` remains available for intentionally scoped deployments.
* **Codex inventory heartbeat hooks** · Codex CLI can install optional heartbeat-only hooks that refresh `inventory_state.jsonl` without duplicating Codex runtime telemetry, which continues to flow through local OTLP logs and metrics.
* **Expanded Codex inventory coverage** · Beacon now inventories Codex user and project `config.toml` plus `hooks.json` files so MCP and hook drift appears in endpoint inventory snapshots.

### v0.0.78 · June 25, 2026

* **Check-only endpoint update monitoring** · Apple Silicon package installs can opt into a local `launchd` job that checks the release manifest every 10 minutes and writes local-only update status events to `system.jsonl`. This phase does not download or apply packages.
* **Manual endpoint package apply** · Apple Silicon package installs can explicitly run `sudo /opt/beacon/bin/beacon endpoint update --apply` to download the signed package from the release manifest, verify its checksum/signature/notarization/staple, install it with Apple's `installer`, health-check it, and roll back the `/opt/beacon` tree if the new install is unhealthy.

### v0.0.76 · June 24, 2026

* **Signed Apple Silicon endpoint package releases** · A pushed version tag now runs the release pipeline end-to-end: GoReleaser publishes CLI archives and updates Homebrew, then CI builds, signs, notarizes, staples, and uploads the Apple Silicon endpoint `.pkg`, `.sha256`, and `update-manifest.json` assets to GitHub Releases for direct MDM/manual download.
* **Current bundled Vector in the macOS package** · The signed endpoint package includes `/opt/beacon/bin/vector` for Jamf/Fleet forwarder helpers and now targets Apple Silicon so Beacon can ship the current Vector macOS distribution rather than pinning all packages to an older dual-arch Vector release.
* **Cursor and Claude session attribution fix** · Fixed a hook attribution edge case where Cursor-shaped hook payloads invoked through the default hook platform could be stamped as Claude, making a single Cursor session UUID appear under both Cursor and Claude in runtime logs and managed dashboards.

### v0.0.73 · June 21, 2026

* **S3 token and cost analytics fields** · The S3 Vector forwarding template now preserves canonical `gen_ai.usage` and also emits top-level `input_tokens`, `output_tokens`, `cache_read_input_tokens`, `cache_creation_input_tokens`, `reasoning_output_tokens`, and `cost_usd` fields so downstream warehouses can persist usage attribution reliably.
* **Managed onboarding docs** · Added an onboarding page for managed ingest setup and clarified the S3 forwarding path for teams wiring Beacon endpoint telemetry into managed analytics.
* **Observe contract conformance** · Added cross-language contract checks to keep Beacon event constants aligned between the Go schema package and the TypeScript SDK.

### v0.0.72 · June 18, 2026

* **Inventory state separated from runtime activity** · Inventory heartbeat and snapshot telemetry now write to `inventory_state.jsonl`, keeping agent runtime activity in `runtime.jsonl` while preserving customer-managed forwarding paths.
* **Claude Code MCP and skill inventory fixes** · Beacon inventories Claude Code MCP servers from `~/.claude.json` and follows symlinked Claude skill directories, so shared skill stores such as `.agents/skills` appear in endpoint inventory.
* **Jamf S3 runtime and inventory forwarding** · The Jamf S3 Vector flow now forwards runtime and inventory JSONL to distinct S3 prefixes, supports MDM-injected AWS provider settings, normalizes older `.../runtime` prefixes, and reads initial inventory snapshots reliably.

### v0.0.71 · June 18, 2026

* **Inventory heartbeat telemetry** · Beacon can now emit metadata-only inventory heartbeat events for local agent harnesses, hooks, MCP servers, and skills, making endpoint coverage drift easier to inspect from the runtime log without collecting skill contents.
* **Dashboard hook coverage breakdowns** · The local inventory dashboard now shows hook status and coverage summaries by runtime so operators can quickly spot missing or stale telemetry setup.
* **Expanded inventory CLI filters** · `beacon endpoint inventory` adds focused flags for showing harnesses, hooks, MCP servers, skills, and telemetry state independently during audits and support workflows.
* **Managed S3 forwarder hardening** · Jamf Claude S3 deployment scripts and generated Vector configs now better preserve managed environment settings and make forwarder smoke testing clearer.

### v0.0.70 · June 18, 2026

* **Top-level token usage command** · `beacon token-usage` replaces the previous `beacon endpoint tokens` command path for local token, cost, model, session, run, harness, and repository attribution from Beacon runtime logs. Update scripts and runbooks that still call the old endpoint subcommand.
* **Consistent token rollups across CLI and dashboard** · The CLI and local dashboard now share the same token aggregation helpers, read the full filtered runtime log in append order, and apply exact case-insensitive session filtering so cumulative metrics and per-session drilldowns stay aligned.
* **CI run filtering improvements** · `--run-id` accepts either a bare run id or the composite `provider/run_id` key shown in the report, making copied CI runtime logs easier to inspect.
* **Docs navigation cleanup** · The docs now separate Agent SDK integration pages from cloud-agent runtime pages and move CLI resources closer to install and upgrade guidance. Endpoint hook paths are presented in a runtime/global/project-local table for quicker deployment review.

### v0.0.69 · June 17, 2026

* **Persistent S3 forwarder credentials on macOS** · Fixed an issue where MDM-injected AWS provider-chain settings for the [S3 log forwarder](/log-forwarding/s3) were lost across `launchd` restarts. Provider env vars now persist in a root-owned env file so the managed `com.beacon.endpoint.s3-forwarder` job keeps shipping events after reboots and policy refreshes.
* **Credentials kept out of Vector config** · AWS provider settings stay in the root-owned env file rather than `s3-vector.toml`, so packaged Vector configs remain free of customer credentials. See the [Jamf Claude S3 deployment guide](/mdm/jamf/claude) for the supported MDM injection flow.
* **Reorganized Jamf Claude deployment scripts** · Jamf-managed [Claude](/mdm/jamf/claude) deployments now use a structured `jamf/claude/{common,falcon,s3}/` script layout. Existing Jamf policies that reference the old flat `jamf/scripts/*` paths must be updated to point at the new locations.
* **S3 forwarder for Claude on Jamf** · Added a Vector-based [S3 forwarding path](/mdm/jamf/claude) that tails `runtime.jsonl` and ships endpoint events to a customer-managed AWS S3 bucket as gzipped NDJSON, alongside the existing Falcon forwarder option.
* **Falcon hook-only flows via Vector** · `beacon endpoint repair` no longer manages Falcon HEC settings directly. Falcon delivery now runs through the dedicated Vector forwarder, keeping hook repair and log forwarding cleanly separated.
* **Optional macOS codesigning** · The macOS package build can codesign `beacon`, `beacon-otelcol`, and `vector` with a hardened runtime when `BEACON_APP_SIGN_IDENTITY` is set, simplifying notarized fleet rollouts.

### v0.0.68 · June 16, 2026

* **Agent skills inventory** · `beacon endpoint inventory` now discovers local agent skill manifests for Claude Code, Cursor, and `.agents/skills`, reporting names, paths, and content hashes for change detection. See the [Skills inventory guide](/inventory/skills).
* **Skills in the local dashboard** · The Agent Inventory view in the local dashboard shows an Agent Skills table and summary card alongside agent harnesses and MCP servers, so operators can see installed skills at a glance.
* **Metadata-only by design** · Skill discovery records hashes and file paths only — `SKILL.md` instruction bodies are never read or stored, consistent with Beacon's [data inventory](/security/data-inventory) posture.
* **Optional inventory snapshot events** · Running inventory with `--write-event` appends metadata-only inventory heartbeat and snapshot events to `inventory_state.jsonl` so installed-skill state can be kept separate from runtime activity telemetry.

### v0.0.67 · June 15, 2026

* **Devin Cloud agent telemetry** · Added `beacon cloud devin pull` to capture autonomous [Devin Cloud agent](/runtimes/devin-cloud-agents) telemetry org-wide. Using a Devin organization service key, one central run pulls every user's cloud sessions from the Devin API, normalizes them into Beacon endpoint events (`provider=devin_cloud`), writes the runtime JSONL, and optionally uploads a per-session snapshot to a customer-managed GCS bucket. No per-user or per-sandbox setup is required.
* **Live and scheduled capture** · `--watch` polls continuously for near-real-time capture; a single sweep (the default) suits cron and CI runners. Re-runs are idempotent — events are deduplicated by Devin event id and unchanged sessions are skipped — and `--full-resync` re-fetches and re-uploads every session for backfills.
* **Per-user attribution** · Devin Cloud events carry the Devin session id as `run_id` and the Devin user id as `run.actor`, so org-wide telemetry stays attributable per end-user and forwards to any existing SIEM destination over the normalized runtime log. Telemetry is message-level (session lifecycle, prompts, agent messages, status, pull requests, and ACU usage); the Devin API does not expose per-tool or per-command events for autonomous sessions.

### v0.0.66 · June 13, 2026

* **Dashboard routing fixes** · Fixed local dashboard route handling so Log Search, Security Overview, Detections, Findings, and inventory views resolve reliably from the loopback dashboard.
* **Dedicated dashboard inventory** · Split agent inventory into its own dashboard area so runtime coverage, MCP server context, and telemetry state are easier to inspect separately from the Security Overview.
* **Threat-rule pack guidance** · Release notes now point operators at the versioned `threat-rules.tar.gz` asset for installing the full rule pack with `beacon rules pull`.

### v0.0.65 · June 13, 2026

* **Dashboard route reliability** · Continued dashboard routing fixes for the new detections, findings, and inventory screens.
* **Rule-pack release asset guidance** · Kept the published release notes aligned with the versioned `threat-rules.tar.gz` rule-pack asset.

### v0.0.64 · June 13, 2026

* **Rule-pack archive cleanup** · Ignored macOS metadata files when installing packaged threat rules, so Finder-created archive entries do not appear as rule-pack content.
* **Rule-pack release asset guidance** · Kept the full threat-rule pack available as the release-attached `threat-rules.tar.gz` archive.

### v0.0.63 · June 13, 2026

* **Comprehensive threat-rule pack** · Added the first full threat-rule pack, ported from BlastRadius-style detections, with coverage for risky agent behavior beyond the small built-in baseline.
* **Additional rule coverage** · Added invisible-character and shell-escape detection rules from ATR review.
* **External rule-pack distribution** · Ships the full threat-rule pack as a release asset instead of embedding it in the Beacon binary, so operators explicitly install it with `beacon rules pull`.

### v0.0.62 · June 13, 2026

* **Dashboard detections view** · Added a local dashboard Detections screen for browsing the active threat-rule set from the endpoint rule store or built-in baseline without using the CLI.
* **Dashboard findings view** · Added a local dashboard Findings screen that runs the active rules over the configured runtime log on demand, with severity and session filtering for focused investigations.
* **Read-only local investigation** · Dashboard detection and finding APIs mirror `beacon scan` behavior while staying offline, loopback-only, and read-only against local endpoint telemetry.
* **Finding ordering and severity helpers** · Shared severity ranking, filtering, fail-threshold counting, and stable finding sorting between `beacon scan` and the dashboard.

### v0.0.61 · June 13, 2026

* **Local threat scanning** · Added `beacon scan` to run threat-detection rules over local endpoint telemetry without network access, with JSON output, session filtering, severity filtering, and CI-friendly `--fail-on` exit behavior.
* **Threat rule management** · Added `beacon rules` for listing active rules, installing local `.rule.yaml` files, explicitly pulling rule packs, linting rules, and printing event fields available to CEL match expressions.
* **Open YAML rule format** · Added a versioned threat-rule format with CEL expressions over Beacon endpoint events, single-event and session-correlated detections, severity/status metadata, and embedded conformance fixtures.
* **Rule-pack hardening** · Hardened rule-pack extraction and install paths against archive path traversal while preserving nested rule-pack layouts.

### v0.0.60 · June 13, 2026

* **Codex token attribution** · `beacon endpoint tokens` and the dashboard token view now report Codex CLI token usage. `beacon endpoint install` configures the Codex metrics exporter, and the collector normalizes Codex's `codex.turn.token_usage` metric into the canonical `gen_ai.usage` representation alongside other runtimes.
* **Disjoint Codex cache accounting** · Codex reports prompt tokens inclusive of the cached portion. Beacon subtracts cached input so `input_tokens` and `cache_read` stay disjoint and totals are not double-counted.
* **Codex attribution limits** · Codex emits no cost signal and no conversation id on its usage metric, so `cost_usd` and per-session attribution are unavailable for Codex. Model, harness, repository, and run attribution are supported.

### v0.0.59 · June 13, 2026

* **Managed ingest commands** · Added `beacon ingest` commands for checking managed ingest status and uploading endpoint telemetry to configured Asymptote Managed destinations.
* **Endpoint token reporting** · Added `beacon endpoint tokens` for local token, cost, model, session, run, harness, and repository attribution from Beacon runtime logs.
* **Token attribution fixes** · Improved token usage normalization for Claude Code telemetry, cumulative metric batches, composite run IDs, and SDK session attributes.

### v0.0.58 · June 13, 2026

* **Token usage foundation** · Added token usage aggregation, dashboard token views, and trace identity fields so endpoint activity can report usage and cost consistently.
* **Managed ingest support** · Added the endpoint ingest plumbing that lets authenticated Beacon clients upload endpoint telemetry to Asymptote Managed when configured.
* **Telemetry schema updates** · Added trace identity, usage cost, and int64 token count fields while preserving local runtime log workflows.

### v0.0.57 · June 11, 2026

* **Beacon dashboard login** · Added `beacon login` so the Beacon CLI can authenticate with the Asymptote dashboard through a browser-based flow.
* **Credential replacement controls** · `beacon login --force` lets operators replace saved credentials when switching users or organizations.
* **Dashboard URL configuration** · Login can target a custom dashboard URL with `--dashboard-url` or `BEACON_DASHBOARD_URL`, while endpoint telemetry remains local-only unless cloud features are explicitly used.

### v0.0.56 · June 10, 2026

* **Cursor Cloud committed hooks** · Cursor Cloud telemetry now expects project hooks to be committed in `.cursor/hooks.json` before the agent starts; `beacon cloud cursor print-hooks` is the supported way to generate that file.
* **Binary-only Cursor setup** · `beacon cloud cursor print-setup` now installs Beacon binaries in the sandbox without mutating `.cursor/hooks.json`, and the removed `beacon cloud cursor install-hooks` command is no longer part of the cloud flow.
* **Cursor cloud reliability** · Generated Cursor Cloud hooks avoid broad `preToolUse` matchers and rely on Cursor's supported project hook surfaces for file, shell, tool-failure, subagent, and compaction events.

### v0.0.55 · June 10, 2026

* **Cursor Cloud run IDs** · Cursor Cloud telemetry uses Cursor's `conversation_id` as the default `run.run_id` when `BEACON_RUN_ID` is not set, so GCS object paths line up with the Cursor cloud conversation.
* **Lower-noise Cursor Cloud events** · Reduced duplicate read and shell telemetry where Cursor exposes both generic and specific hook surfaces.

### v0.0.54 · June 10, 2026

* **Cloud upload run IDs** · Cloud-agent GCS uploads now wait for a real provider run ID, such as Claude's `CLAUDE_CODE_REMOTE_SESSION_ID`, instead of creating fallback `manual-*` upload folders from early hook processes.
* **Cleaner cloud traces** · Claude Code cloud sessions now keep GCS object paths and event metadata aligned under the provider session ID.

### v0.0.53 · June 10, 2026

* **Cursor configuration support** · Added Cursor cloud-agent configuration updates used by the generated cloud setup and hook workflows.
* **Cursor hook safe mode** · Added safer Cursor hook behavior for cloud and project-hook telemetry setup.
* **README support matrices** · Updated upstream README guidance with CI and cloud-agent support matrices and refreshed links.

### v0.0.52 · June 10, 2026

* **Cursor Cloud Agents** · Added Cursor cloud agent telemetry support through sandbox-local Beacon hooks and per-session GCS upload.
* **Cursor cloud CLI helpers** · Added `beacon cloud cursor print-setup`, `beacon cloud cursor print-hooks`, and `beacon cloud cursor install-hooks` for generated setup scripts and project-level `.cursor/hooks.json` management.
* **Cursor telemetry fixes** · Fixed duplicate Cursor shell command events, preserved cloud uploads after edit failures, and improved Cursor session and subagent metadata handling.

### v0.0.51 · June 10, 2026

* **Cloud agent telemetry preview** · Added `beacon cloud` helpers for Claude Code Cloud Agents, including generated cloud setup scripts and sandbox-local hook configuration.
* **GCS upload for cloud sessions** · Claude Code cloud agent sessions can write Beacon `runtime.jsonl` in the cloud sandbox and upload one readable per-session object to customer-managed Google Cloud Storage.
* **Standalone hook packaging** · Release archives and Homebrew installs now include `beacon-hooks` alongside `beacon` and `beacon-otelcol` so cloud sandboxes can install hook telemetry without extracting embedded binaries.

### v0.0.50 · June 9, 2026

* **CI session mode** · Added `beacon ci start` and `beacon ci finish` so Beacon can capture telemetry around multi-step CI workflows and third-party agent actions, not just a single child command.
* **Codex CI telemetry** · Added Codex CI setup through a generated `CODEX_HOME`, enabling OpenAI Codex Action and other local Codex CI steps to export telemetry to Beacon's ephemeral collector.
* **CI run normalization** · Promoted GitHub Actions run context to top-level `origin` and `run` fields in CI JSONL, including decoded PR, repository, workflow, and branch metadata.

### v0.0.49 · June 8, 2026

* **CrowdStrike Falcon Vector forwarding** · Added `beacon endpoint falcon` content-pack commands for forwarding Beacon `runtime.jsonl` events to CrowdStrike Falcon HEC with Vector.
* **Hook-only Claude forwarding** · Added a managed macOS Vector forwarder for deployments where Claude Code events are written by user-level hooks instead of Beacon's local OTLP collector.
* **Jamf deployment helpers** · Added packaged Jamf scripts and inventory checks to install, repair, and monitor the Falcon Vector forwarder while keeping HEC tokens in a root-owned env file.

### v0.0.48 · June 8, 2026

* **OpenTelemetry GenAI schema support** · Beacon now preserves standard `gen_ai` request, response, usage, tool, retrieval, evaluation, message, provider, workflow, and system-instruction metadata in endpoint events.
* **Observe package rename** · Renamed the shared schema package from Asymptote Trace to Asymptote Observe while preserving the public Beacon event schema version.
* **Content handling fixes** · Improved prompt detection for empty GenAI input messages and kept `content.retention` validation backward compatible while using `content.truncated` for truncation display where available.

### v0.0.47 · June 8, 2026

* **Content handling simplification** · Deprecated the legacy content-retention flag and removed stale `content_retention` references from dashboard, Sentinel, generated pack, and packaging paths.
* **Telemetry sample upload** · Added sample upload coverage for Beacon telemetry handoff workflows.
* **Release cleanup** · Removed obsolete retention plumbing from endpoint configuration, generated assets, and MDM inventory helpers so docs and package behavior match the current full-content-with-redaction posture.

### v0.0.46 · June 7, 2026

* **CI telemetry release polish** · Continued the Agent Beacon CI telemetry release line for Claude Code telemetry captured to Beacon JSONL, workflow artifacts, and customer-managed destinations.

### v0.0.45 · June 7, 2026

* **Agent Beacon CI Telemetry** · Published the CI telemetry release for capturing Claude Code activity to Beacon JSONL, GitHub Actions artifacts, and customer-managed export destinations.
* **Action naming update** · Updated the GitHub Action presentation around Agent Beacon CI Telemetry.

### v0.0.44 · June 7, 2026

* **CI telemetry exports** · `beacon ci exec` can upload completed CI runtime JSONL to Amazon S3 or Google Cloud Storage with repeatable `--upload s3` and `--upload gcs` destinations.
* **GitHub Actions artifact controls** · The Agent Beacon action now exposes `upload`, `upload-artifact`, and `artifact-name` inputs so teams can retain CI telemetry as workflow artifacts or hand it off through object storage.
* **CI export reliability and safety** · CI uploads still run when `--require-telemetry=false` downgrades validation failures, child command exit codes remain authoritative, and common AWS and Google credential variables are stripped from the child agent process during observed runs.

### v0.0.43 · June 5, 2026

* **Doctor auto-remediation** · Added `beacon endpoint doctor --fix` and the top-level `beacon doctor --fix` alias so operators can apply safe fixes after health checks.
* **Resilient collector repair** · Doctor fixes can recreate missing runtime logs and repair macOS collector service files with config validation, readiness checks, and rollback if service repair fails.
* **Clearer health results** · Doctor now prints refreshed results after partial fixes, includes applied and skipped fix details in JSON output, and avoids suggesting automated fixes for unsafe permission or non-macOS service cases.

### v0.0.42 · June 5, 2026

* **AWS CloudWatch Logs forwarding support** · Added `beacon endpoint cloudwatch` commands for generating customer-managed CloudWatch Logs forwarding content over Beacon's local `runtime.jsonl`.
* **CloudWatch content pack** · Added generated setup guidance, a Vector `aws_cloudwatch_logs` forwarding template, and sample events for JSON log events in a customer-managed CloudWatch Logs log group.
* **CloudWatch validation guidance** · Added validation events with `destination.type=cloudwatch` and `destination.mode=aws_cloudwatch_logs`, plus AWS CLI and CloudWatch Logs Insights queries for confirming remote delivery without storing AWS credentials in Beacon endpoint configuration.

### v0.0.41 · June 5, 2026

* **Expanded endpoint inventory** · Beacon inventory now covers a broader set of endpoint configuration signals, including supported agent config files and MCP server configuration context where available.
* **Inventory filtering fixes** · JSON inventory output now applies the same default filtering as human-readable output, so config and MCP server records are omitted unless they are relevant or `--all` is set.
* **Managed-state detection fixes** · Improved Beacon-managed detection for Gemini CLI, VS Code OTLP, GitHub Copilot CLI, and Factory Droid so status and inventory output more accurately reflect customer-managed versus Beacon-managed configuration.

### v0.0.40 · June 5, 2026

* **Hermes Agent support** · Added Hermes Agent as a first-class hook harness with `beacon endpoint hooks install --harness hermes`, `status`, and `uninstall` support through Beacon-managed shell hooks.
* **Hermes telemetry coverage** · Beacon now normalizes Hermes prompts, observed tool calls, command and file activity, approval request and response events, session lifecycle, and subagent stop metadata into local endpoint events.
* **Hermes deployment controls** · Hermes hooks are installed in user-level `~/.hermes/config.yaml`, preserve existing settings and non-Beacon hooks, and document first-use hook consent options for non-interactive runs.
* **CI PR context fix** · CI run metadata now assigns pull request fields only when the GitHub ref shape contains PR context, avoiding incorrect PR numbers on non-PR events.

### v0.0.39 · June 4, 2026

* **Devin Desktop support** · Added Devin Desktop coverage through Beacon's hook adapter using Cascade/Windsurf-compatible hook configuration alongside existing Devin CLI hooks.
* **Runtime support organization** · Split agent harness documentation into coding agent harnesses and knowledge-worker agent harnesses so local coding agents and service or gateway integrations are easier to compare.
* **Output destination organization** · Split forwarding destinations into SIEM, log aggregation, object storage, and local categories, with clearer links for Google Cloud Storage forwarding and customer-managed pipeline guidance.
* **Release workflow polish** · Updated release automation and upstream documentation ordering for the latest Agent Beacon artifacts.

### v0.0.38 · June 3, 2026

* **Google Cloud Storage forwarding support** · Added `beacon endpoint gcs` commands for generating customer-managed GCS forwarding content over Beacon's local `runtime.jsonl`.
* **GCS content pack** · Added generated setup guidance, a Vector `gcp_cloud_storage` forwarding template, one-shot `gcloud storage` or `gsutil` smoke-test script, and sample events for gzip-compressed NDJSON objects with date-partitioned keys.
* **Customer-managed Google Cloud controls** · Kept Google Cloud credentials, service accounts, workload identity, bucket IAM, lifecycle, retention, and encryption settings outside Beacon endpoint configuration.

### v0.0.37 · June 3, 2026

* **AWS S3 forwarding support** · Added `beacon endpoint s3` commands for generating customer-managed AWS S3 forwarding content over Beacon's local `runtime.jsonl`.
* **S3 content pack** · Added generated setup guidance, a Vector `aws_s3` forwarding template, one-shot AWS CLI smoke-test script, and sample events for gzip-compressed NDJSON objects with date-partitioned keys.
* **Community links** · Surfaced the Agent Beacon Discord community link in upstream project documentation.

### v0.0.36 · June 1, 2026

* **Release artifact validation** · Added release checks that build and validate the bundled `beacon-otelcol` collector alongside the CLI.
* **Cross-platform release confidence** · Release validation now covers macOS and Linux archives for `amd64` and `arm64`, confirms each archive contains both `beacon` and `beacon-otelcol`, and smoke-runs the Linux archive.
* **Project documentation polish** · Added upstream README star growth visibility and release automation cleanup.

### v0.0.35 · June 1, 2026

* **Release update checks** · `beacon version check` now checks the latest published Beacon release and prints Homebrew or manual download guidance when an update is available.
* **Claude CI telemetry** · Added `beacon ci exec` and `beacon ci validate` for ephemeral Claude Code telemetry collection in CI without installing a persistent endpoint service or modifying user harness configuration.
* **CI validation reliability** · CI validation now scopes malformed-line checks to the active session window and tightens collector shutdown handling so job artifacts are easier to validate.
* **CLI usage polish** · Root command usage now routes through the Beacon banner output.

## May 2026

### v0.0.34 · May 29, 2026

* **Endpoint repair reliability** · `beacon endpoint repair` now stops the existing collector before reinstalling so unhealthy services can free their ports and complete repair cleanly.
* **Rollback preservation** · If endpoint reinstall fails during repair, Beacon restores the previous endpoint configuration instead of leaving partial rollback state behind.
* **macOS package bootstrap fix** · The package postinstall now handles transient `launchctl bootstrap` failures under `set -e` by checking whether the service is already registered before failing the package install.

### v0.0.33 · May 28, 2026

* **Claude Code hook support** · Added optional Claude Code hook telemetry through `beacon endpoint hooks install --harness claude`, complementing the existing local OTLP setup.
* **Claude hook coverage** · Beacon now records Claude Code session, prompt, pre-tool, post-tool, failed-tool, stop, subagent, permission-request, and session-end events where Claude exposes hook payloads.
* **Settings-safe hook management** · Claude Code hook install and uninstall preserve existing Claude settings and non-Beacon hooks while replacing older Beacon-managed Claude hook entries.

### v0.0.32 · May 27, 2026

* **Microsoft Sentinel support** · Added `beacon endpoint sentinel` commands for forwarding Beacon's local `runtime.jsonl` into Microsoft Sentinel through Azure Monitor Agent custom log collection.
* **Sentinel content pack** · Added generated `table-schema.json`, `dcr-template.json`, `dcr-transform.kql`, starter hunting queries, detection examples, and sample events for the `BeaconRuntime_CL` table.
* **DCR template reliability** · Fixed Sentinel validation messaging, escaped log paths and KQL correctly in the DCR template JSON, and removed duplicate transform rendering in the generated pack.

### v0.0.31 · May 27, 2026

* **VS Code Copilot telemetry** · Added VS Code Copilot Chat support through local OpenTelemetry export to Beacon's endpoint collector with normalized `vscode_copilot` prompt, model, session, and tool events.
* **Low-noise VS Code normalization** · Beacon filters noisy VS Code Copilot chat spans, embeddings, repeated session-start logs, turn summaries, and low-level metrics by default while preserving useful prompt and tool activity.
* **Optional VS Code hooks** · Added preview VS Code hook installation for teams that want extra lifecycle and cross-agent detail when `Chat: Use Hooks` is enabled by their organization.

### v0.0.30 · May 26, 2026

* **Antigravity prompt reliability** · Fixed Antigravity pre-tool handling so `prompt.submitted` is emitted after readable transcript text exists instead of being suppressed when the first pre-tool hook fires before the transcript file is written.
* **Hook release packaging** · Restored the embedded `beacon-hooks` binary in release artifacts so Antigravity hook telemetry remains available after install or upgrade.

### v0.0.29 · May 26, 2026

* **Antigravity CLI hook support** · Added Antigravity CLI endpoint telemetry through Beacon's hook adapter with user-level hooks in `~/.gemini/config/hooks.json` and project-level hooks in `./.agents/hooks.json`.
* **Antigravity event coverage** · Beacon now records Antigravity prompt, pre-tool, post-tool, invocation, stop, command, file edit, and diff telemetry where Antigravity exposes hook payloads.
* **Antigravity telemetry fixes** · Fixed duplicate prompt telemetry in metadata mode, failed edit handling, quoted path parsing, and `edit_file` diff extraction.

### v0.0.28 · May 26, 2026

* **Wazuh dashboard helper** · Added `apply-dashboard-default-columns.sh` to the generated Wazuh content pack so local Wazuh Dashboard validation can show Beacon event action, prompt text, harness, model, repository, command, file, and session fields by default.
* **Wazuh pack coverage** · Updated Wazuh content-pack tests so generated packs include the dashboard helper and avoid unmapped Wazuh display fields.

### v0.0.27 · May 25, 2026

* **CrowdStrike Falcon LogScale HEC forwarding** · Added optional Falcon LogScale HEC forwarding from Beacon's bundled collector while preserving the local `runtime.jsonl` audit log.
* **Falcon endpoint flags** · Added install and repair flags for Falcon HEC endpoint, ingest token, repository, source, parser, TLS verification, and custom CA configuration.
* **Collector packaging fix** · Fixed the Falcon collector exporter module path in the collector builder so release builds include the new Falcon HEC exporter.

### v0.0.26 · May 25, 2026

* **Vector forwarding templates** · Added generated `vector.toml` templates to the Sumo Logic and Rapid7 content packs so teams can run Vector as a customer-managed host agent for Beacon JSONL forwarding.
* **Sumo Logic Vector path** · The Sumo template tails `runtime.jsonl`, parses each Beacon JSON line, and forwards newline-delimited JSON to a Sumo HTTP Logs & Metrics Source with source category, fields, and optional auth-header token settings supplied through Vector.
* **Rapid7 Vector path** · The Rapid7 template tails the same local runtime log, preserves one Beacon event per line, and posts newline-delimited JSON to the Rapid7 InsightIDR Custom Logs webhook while keeping the webhook URL outside Beacon endpoint configuration.

### v0.0.25 · May 24, 2026

* **Rapid7 InsightIDR endpoint integration** · Added `beacon endpoint rapid7` commands for forwarding Beacon's local `runtime.jsonl` into Rapid7 InsightIDR Custom Logs through a webhook event source.
* **Rapid7 content pack** · Added generated setup guidance, a one-shot NDJSON upload smoke-test script, and sample events for managed endpoint deployments.
* **Validation workflow** · Added `beacon endpoint rapid7 validate` so teams can write a known-good Beacon event and verify Rapid7 Log Search ingestion with the expected validation query and fields.

### v0.0.24 · May 24, 2026

* **GitHub Copilot CLI support** · Added Copilot CLI discovery, status reporting, and OTLP span normalization for prompt, session, tool, and approval-like activity when Copilot exports to Beacon's local HTTP collector.
* **MDM-managed Copilot telemetry** · Beacon now validates Copilot CLI telemetry from `COPILOT_OTEL_ENABLED=true` and a localhost OTLP endpoint while making clear that Copilot launch-environment configuration stays under MDM or customer policy control.
* **Quieter operational metrics** · Copilot CLI and OpenClaw operational metrics are filtered from endpoint JSONL by default, with `--include-runtime-metrics` available when teams need low-level metrics for troubleshooting.

### v0.0.23 · May 23, 2026

* **Local MCP server** · Added `beacon mcp serve` and `beacon mcp doctor` so MCP clients can search, summarize, and retrieve compact local Beacon activity from `runtime.jsonl` over stdio or loopback HTTP JSON-RPC.
* **Activity filter fixes** · `list_activity_filters` now scans the full matching activity window for accurate facets, and HTTP MCP activity queries preserve command context.
* **Security and contribution docs** · Added upstream `SECURITY.md` and `CONTRIBUTING.md` guidance covering Beacon's local-only posture, disclosure process, validation commands, and contribution expectations.

### v0.0.22 · May 23, 2026

* **Bounded runtime logs** · Beacon now rotates the active `runtime.jsonl` file at 10 MiB and keeps five numbered local archives, preserving the stable handoff path for dashboards and external shippers.
* **Safer concurrent writes** · Runtime log writers now use a lock file during append and rotation so hook, CLI, and collector writes stay serialized.
* **Dashboard archive lookup fix** · Fixed local dashboard event detail lookup for records stored in rotated archives, including cases where older archive numbers have already been pruned.

### v0.0.21 · May 22, 2026

* **Endpoint health checks** · Fixed `beacon endpoint doctor` and `beacon doctor` so failed health checks return a failing exit code for scripts and MDM validation.
* **Inventory accuracy** · Fixed endpoint inventory config scoping, restored `--all` output for all supported targets, and corrected the `droid` hook alias lookup for Factory Droid inventory.
* **Diagnostics reliability** · Fixed `beacon endpoint test-event` writable-log checks, `beacon endpoint discover --all`, and diagnostics bundle output so missing logs still produce empty summaries without leaking the last raw event.

### v0.0.20 · May 22, 2026

* **Sumo Logic endpoint integration** · Added `beacon endpoint sumo` commands for forwarding Beacon's local `runtime.jsonl` into a Sumo Logic Hosted Collector HTTP Logs & Metrics Source.
* **Sumo Logic content pack** · Added generated setup guidance, a one-shot upload smoke-test script, and sample events for managed endpoint deployments.
* **Sumo smoke-test fix** · Removed an unused argument from the Sumo upload smoke-test template.

### v0.0.19 · May 21, 2026

* **Grok Build hook support** · Added Grok Build endpoint telemetry through Beacon's hook adapter with user-level and project-level managed hook files.
* **Grok event coverage** · Beacon now records Grok session, prompt, pre-tool, post-tool, stop, and session-end activity, including command and file-operation context where Grok exposes it.
* **Grok failure severity fix** · Grok post-tool failures now normalize to `tool.failed` with high severity instead of being logged as successful info-level tool events.

### v0.0.18 · May 20, 2026

* **Datadog endpoint integration** · Added `beacon endpoint datadog` commands for Datadog Agent custom log collection over Beacon's local `runtime.jsonl`.
* **Datadog content pack** · Added generated Datadog Agent `conf.yaml`, setup guidance, and sample events for managed endpoint deployments.
* **Datadog validation event** · Added `beacon endpoint datadog validate` so teams can write a known-good Beacon event and verify Log Explorer ingestion with `service:beacon-endpoint-agent`.

### v0.0.17 · May 20, 2026

* **OpenClaw Gateway support** · Added OpenClaw Gateway endpoint integration commands for printing OTLP/HTTP configuration, checking status, and validating observed events.
* **Gateway telemetry guidance** · Documented OpenClaw's Gateway-configured diagnostics export path alongside other supported runtime surfaces.

### v0.0.16 · May 20, 2026

* **Quieter Codex telemetry** · Beacon now keeps Codex endpoint timelines focused on semantic session, prompt, approval, and tool-result events while suppressing high-volume Codex startup, turn, transport, metric, and duplicate trace records by default.
* **Codex span troubleshooting opt-in** · Added `--include-codex-spans` for `beacon endpoint install` and `beacon endpoint repair` when teams need raw Codex OTLP spans for debugging.
* **Metadata retention fix** · Codex prompt text is no longer copied into the event `message` field when `--content-retention metadata` is configured.
* **Elastic prompt visibility** · The generated Kibana saved search now includes `beacon.prompt.text`, so prompt content is visible in Elastic when retention allows it.

### v0.0.15 · May 20, 2026

* **Devin hook support** · Added Devin hook installation, status, uninstall, discovery, and normalization through the `devin` hook harness.
* **Devin hook paths** · Beacon can manage user-level Devin hooks in `~/.config/devin/config.json` or project-level hooks in `./.devin/hooks.v1.json` while preserving unrelated settings and non-Beacon hooks.
* **Devin event coverage** · Devin hooks cover session start, prompt submission, pre-tool and post-tool activity, permission requests, stop events, session-end events, approvals, and file telemetry where payloads are available.
* **Dependency maintenance** · Updated OpenTelemetry dependencies and removed an unreachable pre-tool observation branch.

### v0.0.14 · May 19, 2026

* **Gemini CLI support** · Added opt-in Gemini CLI local OpenTelemetry configuration through the `gemini` endpoint harness.
* **Gemini discovery and status** · `beacon endpoint discover` and `beacon endpoint status` now report Gemini CLI telemetry state from `~/.gemini/settings.json`.
* **Gemini event normalization** · Beacon normalizes Gemini CLI prompts, tool calls, MCP tool activity, file operations, and approval-related events into the endpoint event schema.
* **Deployment guidance** · MDM deployments can include Gemini CLI by adding `gemini` to the endpoint harness list, for example `claude,codex,gemini`.

### v0.0.13 · May 18, 2026

* **Collector startup fix** · Beacon now omits the `include_runtime_metrics` collector-exporter option unless explicitly enabled, so the bundled `beacon-otelcol` starts cleanly after Homebrew installs and upgrades.
* **Apple Silicon hook fix** · Release builds now serialize target packaging around the embedded `beacon-hooks` adapter, preventing arm64 Homebrew releases from embedding an amd64 hook binary.
* **Elastic validation polish** · Updated Elastic content-pack assets and docs to use ingested `beacon.*` fields and the `Beacon Endpoint Events` Kibana data view name.
* **Release validation runbook** · Added an end-to-end Beacon release validation runbook for Homebrew install, endpoint setup, runtime telemetry, and local Elastic ingestion checks.

### v0.0.12 · May 18, 2026

* **Hook binary validation** · Beacon now validates that the embedded `beacon-hooks` binary matches the host architecture before installing Cursor, Factory, or OpenCode hooks.
* **Clearer hook failures** · Hook installation now fails early with an actionable architecture error instead of writing a hook configuration that points at an unusable binary.
* **README support overview** · Expanded the upstream Beacon README with supported agent harnesses, SIEM/output destinations, MDM deployment paths, architecture notes, dashboard guidance, and quickstart links.
* **Release guidance** · Added maintainer release instructions for tag-based GoReleaser deployments and pre-release test gates.

### v0.0.11 · May 18, 2026

* **Elastic content pack** · Added `beacon endpoint elastic install-pack` to generate Filebeat, standalone Elastic Agent, Elasticsearch template, ingest pipeline, ILM, Kibana, and sample event assets for Beacon endpoint events.
* **Local Elastic validation** · Added `beacon endpoint elastic up` and `beacon endpoint elastic down` for a loopback-only macOS development stack with Elasticsearch, Kibana, and Filebeat.
* **Elastic CLI config** · Added `beacon endpoint elastic print-config` for quickly printing Filebeat configuration that tails Beacon's local `runtime.jsonl`.
* **SIEM forwarding docs** · Documented local, Elastic Cloud, and self-managed Elastic setup while keeping Elastic hosts and credentials outside Beacon endpoint configuration.

### v0.0.10 · May 18, 2026

* **OpenCode plugin support** · Added OpenCode discovery and hook/plugin support through `beacon endpoint discover` and `beacon endpoint hooks`.
* **Managed OpenCode plugin** · Beacon now installs an owned local OpenCode plugin at `~/.config/opencode/plugins/beacon.ts` or `./.opencode/plugins/beacon.ts`, forwarding supported chat, session, command, permission, diff, and error events through Beacon's local hook adapter.
* **Local retention and normalization** · OpenCode hook payloads use the same local normalization, redaction, retention, and JSONL output path as other Beacon endpoint events.
* **Release polish** · Updated upstream README links and OpenCode casing in release documentation.

### v0.0.9 · May 18, 2026

* **Endpoint dashboard visibility** · Improved the local dashboard and runtime visibility with the latest main-branch investigation updates.
* **Claude Code prompt content** · Enabled Claude Code prompt content export when endpoint retention is set to `full` or `redacted`.
* **Runtime metric filtering** · Filtered noisy generic process and runtime OTLP metrics from Beacon JSONL by default, with `--include-runtime-metrics` available when those low-level metrics are needed.
* **Collector release build** · Fixed collector release builds by pinning generated collector log modules consistently.

### v0.0.8 · May 18, 2026

* **Dashboard views** · Refactored the local dashboard into separate **Log Search** and **Security Overview** views for investigation and posture review.
* **Model-aware investigation** · Added model filtering and model summary data so teams can search and summarize local activity by agent model.
* **Dashboard usability** · Improved dashboard layout, including clearer investigation columns, quick filters, top harnesses, top models, top repositories, and MCP server summaries.
* **Documentation references** · Streamlined the upstream README and added clearer links into the Agent Beacon CLI docs.
* **Dependency maintenance** · Updated the bundled collector exporter dependency on `google.golang.org/grpc`.

### v0.0.7 · May 16, 2026

* **Factory Droid telemetry** · Added Factory Droid discovery, OTLP endpoint validation, and local telemetry collection support.
* **Factory hooks** · Added Factory hook install, status, and uninstall support for prompt, session, tool, file, stop, and session-end telemetry.
* **Hook preservation** · Improved Factory hook management so install and uninstall preserve non-Beacon hooks in mixed Factory settings groups and handle `hooks: null` safely.
* **Metric normalization** · Fixed metric event naming after category inference so metric events can fall back to the message field when needed.

### v0.0.6 · May 15, 2026

* **Splunk HEC exporter** · Added optional Splunk HEC forwarding from the bundled collector while preserving Beacon's local JSONL audit log.
* **Endpoint forwarding flags** · Added install and repair flags for Splunk HEC endpoint, token, index, source, sourcetype, and TLS configuration.
* **MDM forwarding support** · Added Jamf and Fleet package support, scripts, and inventory signals for Splunk HEC forwarding state.

### v0.0.5 · May 15, 2026

* **Factory Droid support** · Added Factory Droid discovery and OTLP validation, with guidance for managing `OTEL_TELEMETRY_ENDPOINT` through Droid's launch environment.
* **Factory hooks** · Added Beacon endpoint hooks for Factory prompt, session, write/edit/create tool, stop, and session-end telemetry.
* **Agent harness integrations** · Added an agent harness support matrix covering collection paths, hook support, MDM support, telemetry coverage, and local JSONL/dashboard output.
* **Splunk HEC forwarding** · Documented optional Splunk HEC collector forwarding while preserving the local Beacon JSONL audit log.

### v0.0.4 · May 14, 2026

* **Cursor hook reliability** · Fixed Cursor hook handling so prompt submission and hook-emitted events are captured more consistently.
* **Prompt events** · Improved prompt event normalization so local timelines better reflect what users asked supported agents to do.
* **Release artifacts** · Published macOS and Linux archives for `amd64` and `arm64`, plus SHA-256 checksums for release verification.

### v0.0.3 · May 14, 2026

* **Codex discovery** · Fixed Codex CLI detection so `beacon endpoint discover` and `beacon endpoint status` report Codex telemetry state more accurately.
* **Release packaging** · Packaged target-specific `beacon-otelcol` collector binaries with each platform archive.
* **Hook distribution** · Cleaned up release packaging for embedded hook assets and Homebrew distribution.

### v0.0.2 · May 14, 2026

* **Release artifacts** · Beacon now publishes platform archives for macOS and Linux on `amd64` and `arm64`, plus SHA-256 checksums for release verification.
* **Default local install** · Endpoint commands now use per-user paths by default, with `--system` reserved for root-managed package and MDM deployments.
* **Runtime log visibility** · Status output and the local dashboard now surface warnings when a system collector may be writing OTLP events to a different runtime log than the selected user-mode view.
* **Jamf-ready packaging** · macOS packaging now includes system-mode install and uninstall helpers for Jamf, Kandji, or generic MDM command runners.

### Codex

* **Telemetry defaults** · Beacon now writes structured Codex OTEL exporter configuration for logs, traces, and metrics while setting `log_user_prompt = false`.
* **Noisy trace filtering** · Beacon filters noisy internal Codex transport traces so endpoint timelines focus on meaningful Codex activity instead of HTTP/2 framing and flow-control churn.

### Beacon Endpoint

* **Endpoint telemetry** · Beacon now configures local agent harness telemetry and writes normalized endpoint events to local JSONL logs.
* **Runtime discovery** · Beacon discovers supported local agent harnesses, including Claude Code, Codex CLI, Cursor, and Claude Cowork.
* **Local dashboard** · Inspect Beacon runtime logs from a local-only endpoint dashboard.

### Wazuh

* **Wazuh content pack** · Generate localfile configuration, rules, and validation content for Beacon endpoint events.
* **Validation event** · Write a Beacon validation event to confirm Wazuh ingestion paths are configured correctly.

### Hooks

* **Cursor hooks** · Install, inspect, and remove Beacon endpoint hooks for supported harnesses.

### v0.0.1 · May 13, 2026

* **Endpoint telemetry** · Introduced the open-source Beacon Endpoint Agent for local agent harness telemetry.
* **Collector exporter** · Added the `beaconjson` OpenTelemetry Collector exporter for normalized Beacon endpoint JSONL.
* **Runtime integrations** · Added support for Claude Code, Codex CLI, Cursor hooks, and Claude Cowork telemetry validation.
* **Local dashboard** · Added a loopback-only dashboard for inspecting local runtime inventory, event timelines, filters, and event details.
* **Wazuh output** · Added Wazuh localfile configuration, rules, sample content, and validation events for Beacon endpoint logs.
* **Release distribution** · Established Homebrew and manual archive distribution for macOS and Linux.