Fix/selective post tool cloud reporting

[Mr-Lucky]

Summary

• Report native PreToolUse events normally while keeping routine successful PostToolUse events local.
• Upload Post events only for execution failures, risk escalation, anomalous results, or newly detected risks.
• Preserve sanitized web-fetch destinations without exposing credentials, fragments, query values, or sensitive path segments.
• Preserve safe summaries for file operations, configuration changes, model switches, and policy reasons.
• Keep absolute paths, file contents, patch bodies, raw stdout/stderr, credentials, endpoints, and raw reason text out of Cloud events.
• Add regression coverage and update privacy-boundary documentation.

Type

• Bug fix
• New feature / detection rule
• Refactoring
• Documentation

Testing

• npm run build passes
• npm test passes (867 passed, 1 skipped)
• Manually tested the change

Related Issues

Closes #

[github-actions]

AgentGuard PR Review

I found two actionable regressions in the diff.

1. severity: high — src/runtime/protect.ts / pickNativeFileTargets() and buildRuntimeAction()

   • What can go wrong: The new native file-target extraction stores structured targets from tool_input and patch bodies into metadata.nativeFileTargets, but nativeHookSafeMetadata() does not strip this field anywhere in the shown code. Since Cloud/event persistence now depends on metadata scrubbing, this can leak full file paths (and potentially derived patch/file targets) into audit records and Cloud uploads. In particular, pickNativeFileTargets() collects raw toolInput records and raw.file_path, and the corresponding summary logic in src/runtime/audit.ts trusts this metadata.
   • Concrete fix: Ensure nativeFileTargets is explicitly removed or redacted before any persisted audit/Cloud serialization, or replace it with a strictly validated basename-only structure at capture time. Add tests asserting the serialized audit/Cloud payload never contains absolute paths from nativeFileTargets.

2. severity: medium — src/runtime/audit.ts / nativeHookFilePreview()

   • What can go wrong: nativeHookFilePreview() returns [LOCAL_ONLY_LLM_CONTENT] whenever there is more than one target, but nativeFileTargets is sliced to 100 items and can be populated from multi-file edits/patches. That means a large class of legitimate file-write/read events will lose all context and may fail downstream expectations that rely on a minimal file summary being present. This is a correctness regression introduced by the new preview path and can break Cloud-side filtering or tests that expect a bounded filename/count summary.
   • Concrete fix: Preserve a bounded aggregate summary for multi-target events instead of dropping to the generic placeholder, e.g. write 3 files/read 3 files, using only a count and no path data. Add regression tests for multi-file reads/writes and patch-based writes.