Asymptote-Labs/agent-beacon v1.3.47 on GitHub

Changelog

Features

90b19ae feat(hooks): add neutral Cursor and Codex hook extension points (#1097)

Bug Fixes

a7682f0 fix(cli): stop beacon scan from cutting characters in half (#1055)
0cbc3a2 fix(dashboard): stop shortened labels from splitting emoji (#1060)
edde3ea fix(gitlink): read commits correctly when log.showSignature is set (#1073)
89e3468 fix(handoff): close detached-launch races and carry more store paths (#1014)
a2cf26c fix(harness): keep codex config sections whose header has a comment (#1070)
3761a87 fix(harness): read commented vs code settings in telemetry status (#1061)
68bd91a fix(harness): stop claude configure from wiping unparseable settings (#1063)
b14d151 fix(hooks): keep the platform of hooks installed under a path with an apostrophe (#1075)
7291792 fix(hooks): recognize --platform= hooks in shared settings files (#1059)
cff7076 fix(inventory): keep the snapshot digest stable across identical scans (#1062)
781a977 fix(inventory): list skills named build, dist, vendor, tmp or temp (#1074)
647a539 fix(inventory): redact auth-scheme credentials and secrets inside definition strings (#1076)
ee9d3ae fix(onboarding): stop modified arrow keys from picking an option (#1077)
69b5d21 fix(opencode): record every path a shell rm deletes (#1056)
093d8d9 fix(redaction): redact google oauth access tokens (#1058)
6247ce4 fix(redaction): redact url passwords that have no user name (#1068)
73f9317 fix(rules): cover every githooks(5) hook name in git-hook-installed (#1025)
6a1dd08 fix(rules): flag every octal chmod mode that makes a file world-writable (#1021)
9096ae5 fix(rules): flag force-pushes that target a protected branch through a refspec (#1022)
389e15a fix(rules): flag remote..pushurl rewrites in git-remote-tampering (#1038)
9db792a fix(rules): match --volume=/: and --mount source=/ in privileged-container-run (#1029)
edb2e2b fix(rules): match -oProxyCommand and quoted ProxyCommand in shell-escape-via-interactive-tool (#1037)
1f518e6 fix(rules): match /bin/bash and /usr/bin/sh in base64-decode-piped-to-shell (#1032)
e9a2d8d fix(rules): match PATH lines piped through tee into a login file (#1045)
834dbbc fix(rules): match chmod +s and 6xxx/04xxx setuid modes (#1020)
d1dc80a fix(rules): match codex -s danger-full-access in agent-permission-bypass-spawn (#1024)
e3250c6 fix(rules): match crontab file loads followed by another command (#1048)
888fb8f fix(rules): match curl --json uploads in env-dump-piped-to-network (#1049)
3470085 fix(rules): match curl -F and --data stdin uploads in archive-then-upload (#1046)
bf9fc4c fix(rules): match dd disk fills that put of= before if= (#1030)
75d3b03 fix(rules): match env-prefixed git commands in git-history-rewrite (#1053)
cec58be fix(rules): match gpg2 and --export-secret-key in gpg-keyring-access (#1044)
2e14402 fix(rules): match modprobe loads followed by parameters or another command (#1042)
255e426 fix(rules): match ps auxww and ps -eo in process-table-secret-scrape (#1028)
0f9be51 fix(rules): match spaced and named fork bombs in fork-bomb-pattern (#1031)
5d1505e fix(rules): match ssh forwards that are not the first argument (#1023)
1fce3e6 fix(rules): match ssh-add -l after other options in ssh-agent-key-enumeration (#1050)
3b39065 fix(rules): match sudo with flags in curl-pipe-to-shell (#1016)
c90813d fix(rules): match systemctl enable after options in persistence-install-command (#1034)
2812a5d fix(rules): match tee --append and clustered tee flags into /etc/sudoers (#1043)
f20712c fix(rules): match the macOS Microsoft Edge profile in browser-session rules (#1027)
561c48c fix(rules): match the rm forms that actually delete / in recursive-root-delete (#1015)
ea1f6fe fix(rules): match usermod --groups and gpasswd --add in root-equivalent-group-add (#1033)
f4e3756 fix(rules): stop flagging .env.example templates as credential reads (#1057)
c2f579d fix(rules): treat rm -fr as high-risk in high-risk-approval-allowed-without-reason (#1036)
6d045a4 fix(sdk): accept the default-export anthropic class in instrumentmodules (#1064)
b9bd3c5 fix(sdk): treat empty environment variables as unset (#1052)
33b751a fix(selfupdate): find format-qualified linux packages in update check (#1065)
d9892d7 fix(sync): stable ids for Grok chat events; backfill treats a retention stop as limited (#1019)
e4bf0dd fix(telemetry): drop the uri slash before a windows drive in mcp file paths (#1072)
f001a24 fix(telemetry): read the command of codex shell and shell_command tool results (#1071)
71ef441 fix(tokens): match dotted claude versions in the context window table (#1051)

Other

69df985 docs(browser-extension): state that reasoning is not available on claude.ai or ChatGPT (#1013)
928bc86 gitlink: read shell commands with a real shell parser (#1092)
b95de42 hooks: keep quotes that belong to a tool argument (#1094)
6681a86 hooks: remove the unused GetRemoteInfo and its helpers (#1093)
b5cdbee test(hooks): pin the Cursor and Codex hook files Beacon writes (#1096)

Installation

Homebrew (macOS/Linux)

brew update
brew trust asymptote-labs/tap
brew tap asymptote-labs/tap
brew install beacon

Linux (Debian, Ubuntu, Fedora, RHEL)

curl -fsSL https://github.com/asymptote-labs/agent-beacon/releases/download/v1.3.47/install.sh | BEACON_VERSION=1.3.47 bash

Manual Download

Download the appropriate archive for your platform from the assets below, extract it, and add the binary to your PATH.

Quick Start

beacon endpoint install
beacon endpoint status
beacon endpoint wazuh print-config

Threat detection rules

beacon ships with a small built-in baseline. Install the full threat-rule
pack (attached as threat-rules.tar.gz below) and scan your local telemetry:

beacon rules pull https://github.com/asymptote-labs/agent-beacon/releases/download/v1.3.47/threat-rules.tar.gz
beacon rules list
beacon scan