v1.1.0: Install Posture

Overview

Beekeeper v1.1.0 retires the package-manager nudge and replaces it with install posture: a default, tool-agnostic posture that Beekeeper enforces at the agent pre-exec hook. npm v12 blocks install lifecycle scripts by default, so the old steer-to-pnpm-or-Bun nudge is no longer the headline win. Install posture is the tool-agnostic successor: it applies the same structural checks to every package manager, at the hook, whichever one the agent reaches for.

Highlights

1. Default install posture at the hook

Three rules evaluate every package install an agent runs:

• Release age - a package first published less than 24 hours ago warns.
• Lifecycle scripts - an install that would run pre or post-install scripts warns.
• Git or remote-URL dependencies - a dependency pulled from a git ref or arbitrary URL instead of a registry warns.

All three warn by default and fail soft: an unknown answer (a registry timeout, a missing publish timestamp) warns rather than blocks, so a slow or offline check never stops an agent. The checks are tool agnostic and apply at the hook.

2. The beekeeper posture view (read-only)

beekeeper posture shows each package manager's install posture side-by-side with the posture Beekeeper enforces, machine-wide and read-only, naming the gaps. The same comparison appears as a read-only card in the TUI dashboard. beekeeper posture --full prints the full enforcement-boundary statement.

3. Scoped, audited overrides and per-rule opt-up

beekeeper posture allow <package> grants a scoped exception (--once or --always with a recorded --reason, scopable to one --rule or --ecosystem). An allow is posture-scoped: it silences a posture warn but never downgrades a catalog malware block. beekeeper posture enforce <rule> --block opts a single rule up from the default warn to block (--warn lowers it back); the unknown / fail-soft path always warns, so a registry outage never blocks an install even under --block. Per-rule opt-up is tighten-only from untrusted project or environment layers. Every override writes a distinct posture_override audit record (allow_once, allow_always, enforce_block, or enforce_warn).

4. SENTRY-009: install observation

A new Sentry rule observes and audits package-manager installs by a monitored descendant, including installs a person runs directly in a terminal and installs on harnesses with no pre-exec hook. It is detection-only process attribution (the package-manager PID/PPID, exe, and cmdline); it adds no registry I/O and does not evaluate posture in the privileged daemon. It records sentry_install_observed (severity info) but never blocks, kills, or quarantines.

5. Honest enforcement boundary

Install posture is enforced pre-execution at the agent hook for hooked harnesses that support it, inheriting each harness tier's caveats. For harnesses with no pre-exec hook, and for installs a person runs directly in a terminal, it is observed and audited by the Sentry layer rather than prevented, unless the experimental package-manager shim is installed. The MCP gateway is not a general install surface. The shim extends pre-exec enforcement to installs run through the shimmed PATH, but it is limited: it can be bypassed by calling a tool by its absolute path, and it requires adding the shim directory to your PATH. It is not a headline guarantee. See the security posture for the full statement.

Migration notes

• The package-manager nudge is removed. The old nudge subcommands (status, check, audit) no longer exist, and the config set nudge.* keys are gone (config set currently has no settable keys and rejects every key fail-closed). Use beekeeper posture instead.
• The nudge and version_drift audit record types are no longer written. The deprecated nudge_* fields are retained unpopulated for corpus schema compatibility only.

Roadmap (not shipped)

Config mutation from the posture view, a per-ecosystem and per-project policy matrix, and the package-manager shim as a first-class machine-wide enforcement surface are roadmap, not v1.1.0 guarantees.