fix: preserve safe shell previews and avoid self-blocking status

[Mr-Lucky]

Summary

Fix excessive redaction and false-positive blocking of safe shell commands in DSH runtime events.

• Preserve useful, bounded command previews for commands such as curl, tail, grep, env, cat, ls, stat, and chmod.
• Normalize absolute user-home paths to ~ while continuing to redact actual secrets.
• Prevent Codex and Claude Code hooks from reclassifying safely masked agentguard status output as PII or bulk egress.
• Keep the exemption narrowly scoped to standalone agentguard status commands; compound commands, other AgentGuard commands, and unmasked secrets remain subject to normal policy checks.
• Ensure OpenClaw, QClaw, Hermes, and DSH integrations do not incorrectly block safe status output.
• Add regression tests and update privacy/runtime documentation.

Type

• Bug fix
• New feature / detection rule
• Refactoring
• Documentation

Testing

• npm run build passes
• npm test passes (900 passed, 1 platform-specific test skipped)
• Manually tested the change

Related Issues

Closes #

[github-actions]

AgentGuard PR Review

1. severity: high — src/runtime/self-command.ts / src/runtime/protect.ts
   The new isAgentGuardStatusCommand() only matches the exact string agentguard status and drops support for shell wrappers, env, command, builtin, alternate executable names (agentguard-mcp), and path-qualified invocations. In protect.ts, this predicate is now used to suppress rescanning and to mark Claude batch status calls, so legitimate self-status invocations that were previously recognized can be treated as ordinary tool output again. That can reintroduce self-blocking for agentguard status in wrapped/shelled native hooks and can cause the new suppression logic to miss safe status calls, producing false positives and inconsistent behavior.
   Fix: restore the prior wrapper-aware parser for status detection, or keep the exact-command check only as an additional guard while preserving the existing token-based matching for wrapped/prefixed invocations.

2. severity: medium — src/runtime/protect.ts (projectClaudeBatchForInspection, projectAgentGuardStatusOutput)
   The batch projection replaces verified status output with a fixed placeholder before content scanning, but claudeBatchFacts() now calculates redactedBytes from the projected inspection data instead of the original payload. This means the reported redaction statistics no longer reflect the actual amount of sensitive data in the incoming batch and can undercount or overcount redactions depending on how much output was suppressed. That breaks audit accuracy and may hide the true size of sensitive content from downstream policy decisions or telemetry.
   Fix: compute redaction metrics from the original batch payload, and only use the projected copy for classification/suppression decisions.