fix: preserve safe native hook audit previews

[Mr-Lucky]

Summary

Restore privacy-safe command previews for native shell audit events instead of replacing routine commands with a generic placeholder.

This change:

• Keeps locally redacted native Bash command previews visible in Cloud audit events.
• Falls back to [LOCAL_ONLY_LLM_CONTENT] when sensitive content cannot be safely redacted.
• Redacts quoted shell credential assignments such as API_KEY="...".
• Preserves bounded summaries for protected-file access.
• Prevents redirects, substitutions, and command tails from being misidentified as protected-file targets.
• Adds regression coverage and updates the privacy documentation.

Type

• Bug fix
• New feature / detection rule
• Refactoring
• Documentation

Testing

• npm run build passes
• npm test passes (861 tests, 1 skipped)
• Manually tested the change

Related Issues

Closes #

[github-actions]

AgentGuard PR Review

1. severity: high — src/runtime/audit.ts (nativeHookShellPreview, new shell-preview path)

   • What can go wrong: shell hook previews are now emitted for any shell action without a SECRET_ACCESS reason, even when the command includes other sensitive data not covered by redactText or NATIVE_SENSITIVE_CONTENT_RULES. This expands Cloud/audit exposure of command contents that previously stayed local, increasing the chance of leaking secrets, PII, or internal paths through audit logs.
   • Fix: keep the default behavior local-only for shell hooks and only allow an explicitly bounded preview for commands that match a tightly validated allowlist. Add tests for commands containing environment-variable expansions, inline assignments, here-docs, and uncommon secret formats.

2. severity: high — src/runtime/redaction.ts (SECRET_VALUE_PATTERN change)

   • What can go wrong: the new regex only redacts quoted values when the secret key is followed by =, but it still misses common shell forms like export KEY="value" in some tokenization paths, multi-line assignments, and values containing escaped quotes or command substitutions. The new shell-preview feature relies on this redaction to prevent secret leakage, so incomplete coverage can expose credentials in audit/cloud events.
   • Fix: add tests for shell assignment variants (export, declare, set, inline KEY=value cmd, escaped quotes, multiline input) and expand redaction to handle shell syntax before preview generation.

3. severity: medium — src/runtime/audit.ts (safeGenericProtectedTarget hunk)

   • What can go wrong: the new split(/[;&|<>\r\n]/, 1) and parenthesis check can still misclassify complex shell commands, especially with redirects or subshells nested inside quotes, causing a protected-file command to be summarized as safe when it should be hidden. That can leak the existence of protected paths or imply file access where the command actually targets another destination.
   • Fix: parse shell tokens more robustly or conservatively return [LOCAL_ONLY_LLM_CONTENT] whenever the command contains redirects, substitutions, or control operators outside a strictly validated single-target pattern. Add tests for quoted redirects/subshells and mixed command chains.