beam
Publish a redacted local coding session to an authenticated read-only Beam catalog.
它会碰到什么
关于「读环境变量(配置)」:这个技能会读 process.env 之类的环境变量,但读到的都是端口、目录、超时这类配置项,没有读取密钥类变量。扫描规则原本把「读环境变量」一律算作「读凭据」,本站按变量名做了细化区分,命中明细仍如实列在下面。
逐条看命中(9 条严重或高危)
- 高
references/claude-code-hooks.json:2identity-config-write"hooks": { - 高
references/claude-code-hooks.json:5identity-config-write"hooks": [
- 高
references/claude-code-hooks.json:16identity-config-write"hooks": [
- 高
scripts/beam.test.mjs:6exec-spawnimport { execFileSync, spawn } from "node:child_process"; - 高
scripts/beam.test.mjs:180identity-writetest("standalone sanitizer keeps ordinary AGENTS.md tasks", () => { - 高
scripts/beam.test.mjs:182identity-writesanitizeVisibleText("Update AGENTS.md with your instructions for the new command."), - 高
scripts/beam.test.mjs:183identity-write"Update AGENTS.md with your instructions for the new command.",
- 高
scripts/beam.test.mjs:933identity-config-writeconst hook = { - 高
scripts/beam.test.mjs:1025cred-envreadPATH: `${binDir}${path.delimiter}${process.env.PATH}`,
这一栏是扫描器报的事实,不是结论。命中多不等于有毒(安全工具、规则库、示例脚本本来就会包含危险写法),命中少也不等于干净。它和你手上的凭据、文件、网络有什么关系,需要你自己看。
技能内容
Beam
Use when the user explicitly asks to beam, publish, or share the current local coding session with an authenticated OpenClaw receiver.
Contract
- Treat invoking this skill as approval for one snapshot upload to the named destination.
- Never upload raw JSONL, reasoning, system/developer prompts, tool output, environment values, credentials, browser state, cookies, or local paths.
- The helper is self-contained: it resolves and parses exact Claude Code or Codex transcripts, then uploads only locally redacted user/assistant messages and compact tool counts.
- Beam is a read-only projection. Do not connect a node, expose a terminal, resume the local harness remotely, or grant the receiver filesystem/tool access.
- Require HTTPS except for loopback development endpoints.
- Authenticate with
BEAM_ACCESS_TOKEN,BEAM_AUTH_TOKEN, or an interactivecloudflared access login. Never print those values. - Live synchronization is opt-in persistent behavior. Do not install hooks unless the user explicitly asks for live Beam updates.
Snapshot
Set or obtain the destination receiver URL first:
export BEAM_ENDPOINT="https://example.internal/api/v1/beam/sessions"
Prefer the harness-specific exact identifier. Resolve the directory containing this SKILL.md as BEAM_SKILL_DIR first.
Claude Code exposes the current session id:
node "$BEAM_SKILL_DIR/scripts/beam" publish \
--endpoint "$BEAM_ENDPOINT" \
--session-id "${CLAUDE_SESSION_ID}"
In Codex, resolve the directory containing this SKILL.md as BEAM_SKILL_DIR; normal shell-tool children expose the current thread id:
node "$BEAM_SKILL_DIR/scripts/beam" publish \
--endpoint "$BEAM_ENDPOINT" \
--thread-id "$CODEX_THREAD_ID"
Prefer exact harness metadata when available:
- Claude Code:
${CLAUDE_SESSION_ID}identifies the current local conversation; the helper finds its transcript. - Codex shell tools:
CODEX_THREAD_IDidentifies the current thread. - Hook adapters: pass their JSON to
beam hook;transcript_pathis authoritative. - Exact fallback: Beam scans only the native Claude/Codex session roots for the supplied id and fails closed on no match or ambiguity.
Useful options:
node "$BEAM_SKILL_DIR/scripts/beam" publish --endpoint "$BEAM_ENDPOINT" --session /path/to/session.jsonl
node "$BEAM_SKILL_DIR/scripts/beam" publish --endpoint "$BEAM_ENDPOINT" --thread-id "$CODEX_THREAD_ID"
node "$BEAM_SKILL_DIR/scripts/beam" publish --endpoint "$BEAM_ENDPOINT" --title "Fix upload flow"
node "$BEAM_SKILL_DIR/scripts/beam" publish --endpoint "$BEAM_ENDPOINT" --complete
node "$BEAM_SKILL_DIR/scripts/beam" publish --endpoint "$BEAM_ENDPOINT" --dry-run
--dry-run prints the sanitized payload locally and performs no network request.
On success, return only the Beam URL and a short disclosure summary: source harness, shared message count, whether older entries were truncated, and whether the beam is complete. The URL uses the endpoint-derived Control UI base path followed by /beam/<title-slug>-<id-prefix>, for example https://gateway.example.com/beam/fix-upload-flow-0123456789ab. The title comes from --title or the first shared user message. The stable ID suffix identifies the session; links with an earlier title remain valid.
The helper also accepts bare /beam/<id-prefix> links and, during rollout, the current server's exact /chat/<agent>?catalog=beam&host=gateway&thread=<full-beam-id> response. It still rejects the obsolete ?session=catalog:... beta form.
Live Hooks
The helper accepts the snake_case JSON emitted by both Claude Code and Codex lifecycle hooks:
node "$BEAM_SKILL_DIR/scripts/beam" hook --endpoint "$BEAM_ENDPOINT" --quiet
Configure root Stop hooks for turn-by-turn updates. Claude Code can also use SessionEnd for finalization; Codex finalization uses an explicit publish --complete. See:
references/claude-code-hooks.jsonreferences/codex-hooks.toml
Hook failures must not block the coding session. Keep them quiet on success; log one concise redacted error on failure.
Full installation, authentication, data-boundary, and hook documentation:
[README.md](README.md).
Development
node --check skills/beam/scripts/beam
node --check skills/beam/scripts/beam-session.js
node --test skills/beam/scripts/beam.test.mjs
scripts/validate-skills想直接用这个技能?
本站把开放许可(MIT / Apache 等)的技能按仓库打包整理到网盘,点一下转存到你自己的网盘,不用一个个从 GitHub 拉。许可未声明的技能只给原始仓库链接,不打包。