fix: harden post-tool batch cloud reporting

[Mr-Lucky]

Summary

Harden Claude Code PostToolBatch Cloud reporting:

• Generate summaries through a dedicated allowlisted path that ignores raw batch content, tool inputs, arguments, and file paths.
• Upload only batches that were actually blocked and enforced.
• Keep warned, unenforced, and unconfirmed batch findings local.
• Add regression coverage for forged metadata and non-blocking batch events.

Type

• Bug fix
• New feature / detection rule
• Refactoring
• Documentation

Testing

• npm run build passes
• npm test passes (32 tests)
• Manually tested the change

node --test dist/tests/runtime-cloud.test.js passes all 93 tests.

Related Issues

Closes #

[github-actions]

AgentGuard PR Review

1. high — src/runtime/audit.ts (shouldReportClaudePostToolBatchEvent and claudePostToolBatchAuditInput)

   • What can go wrong: The new cloud-reporting gate only allows Claude post-tool-batch events when decision === 'block', enforcementStatus === 'enforced', lifecycleStage === 'post_tool_batch', canBlockCurrentAction === true, and metadata.continuationBlockedOnly === true. If any real blocked post-tool batch event arrives with a different but still security-relevant state (for example policyDecision: 'block' but decision not set to block, or missing continuationBlockedOnly), it will no longer be reported to cloud. This creates a silent telemetry gap for security events.
   • Fix suggestion: Base the reporting decision on the authoritative block/finding fields already used elsewhere, or explicitly preserve the previous behavior as a fallback (e.g. hasMaterialAuditFinding(event)) when the new conditions are absent. Add tests for representative blocked post-tool-batch variants to ensure they still upload.

2. medium — src/runtime/audit.ts (claudePostToolBatchAuditInput)

   • What can go wrong: The sanitized cloud payload now includes SAFE_REASON_TITLES[reason.code] from the first matching reason only. If reasons contains multiple findings, the upload may omit the most relevant one, reducing the incident context and making cloud triage less accurate. This is especially risky because the new logic is used for a security-sensitive event type.
   • Fix suggestion: Prefer the highest-severity material finding, or serialize a bounded list of safe reason titles instead of only the first match. Add a test covering multiple reasons to ensure the intended finding is exposed.