Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.asymptotelabs.ai/llms.txt

Use this file to discover all available pages before exploring further.

​
Schema Examples

Beacon writes endpoint events as JSONL records. Each line is a complete JSON object that follows the schema described in the Endpoint Event Schema.

​
Example command event

{
  "timestamp": "2026-05-11T22:21:00Z",
  "vendor": "beacon",
  "product": "endpoint-agent",
  "schema_version": "1.0",
  "event": {
    "kind": "agent_runtime",
    "action": "command.executed",
    "category": "command"
  },
  "severity": "info",
  "endpoint": {
    "hostname": "example-mac",
    "os": "darwin",
    "agent_version": "0.0.11"
  },
  "user": {
    "name": "local-user"
  },
  "harness": {
    "name": "cursor"
  },
  "session": {
    "id": "conversation-1",
    "working_directory": "/Users/local-user/repo"
  },
  "tool": {
    "name": "Shell",
    "command": "go test ./..."
  },
  "command": {
    "command": "go test ./..."
  },
  "content": {
    "retention": "metadata",
    "included": false
  },
  "message": "Shell command executed"
}

​
Privacy and retention fields

Beacon records configured content fields by default. Content retention is configurable with --content-retention full, --content-retention redacted, or --content-retention metadata.
  • full: default; includes configured content fields in local or customer-controlled logs, still subject to event size limits
  • redacted: includes configured content fields after local redaction and size limits
  • metadata: excludes prompt text, raw attributes, command output, and raw diffs
Beacon also caps event size, redacts common secret patterns, and marks events with field_truncated when fields must be shortened before writing. For Codex CLI, Beacon writes semantic session, prompt, approval, and tool-result events while suppressing noisy startup, turn, transport, metric, and duplicate span records by default. Beacon also filters generic process and runtime OTLP metrics, such as process CPU, memory, Node.js event loop, and V8 heap telemetry, out of the JSONL log by default. Use --include-runtime-metrics during endpoint install or repair only when those low-level runtime metrics are required, and use --include-codex-spans only when raw Codex spans are needed for troubleshooting. The schema remains the same; these filters reduce low-signal records rather than changing event fields.

Endpoint event schema

Return to the schema overview.

Schema fields

Review entities, optional context, and shared top-level fields.

Runtime integrations

See which runtime surfaces produce endpoint events.