fix: preserve DSH shell command previews

[Mr-Lucky]

Summary

Preserve bounded, redacted DSH pre-execute shell command previews in Cloud audit events instead of collapsing commands such as curl, tail, and grep to their executable name and finding title.

Protected-file access and unmaskable sensitive findings continue to use safe summaries. Credentials, PII, and URL secrets remain redacted.

Type

• Bug fix
• New feature / detection rule
• Refactoring
• Documentation

Testing

• npm run build passes
• npm test passes (892 tests)
• Manually tested the change

Related Issues

Closes #

[github-actions]

AgentGuard PR Review

1. severity: medium — src/cloud/client.ts (safeDshShellPreview)

   • What can go wrong: The new Cloud preview is sent for any pre-execute shell event, but it does not exclude commands that are already supposed to stay local because they contain protected paths or other sensitive-but-maskable content. In those cases, the preview may still expose more command structure than the previous command-name-only summary, increasing leakage risk for Cloud-eligible events.
   • Concrete fix: Gate the preview on the same local-vs-Cloud privacy rules used elsewhere for DSH shell events, especially protected-file access and any sensitive findings that should never surface as command previews. If the event matches a local-only sensitivity rule, fall back to the existing bounded summary instead of emitting the redacted input.

2. severity: medium — src/cloud/client.ts (safeDshShellPreview, line hunk adding redacted.slice(0, 2000).trim())

   • What can go wrong: Truncation happens after redaction on the final string, which can cut off a redaction marker or split a multi-byte character sequence in the middle of a long command. That can produce malformed previews and may also leak partial tail content that was intended to be masked by a later token.
   • Concrete fix: Truncate on token/segment boundaries before serialization, or ensure the redaction pipeline produces a bounded, structurally safe preview object and only then stringify it. At minimum, avoid slicing raw rendered text arbitrarily at 2000 characters.