[Mr-Lucky]

Summary

Preserve the exact saved AgentGuard activation link in Claude Code display and supported own-command output while redacting other credentials.
Limit installer and npx exceptions to verified commands and output, with regression coverage.
Bump the package version to 1.2.4-beta.2.

Type

• Bug fix
• New feature / detection rule
• Refactoring
• Documentation

Testing

• npm run build passes
• npm test passes (917 tests: 916 passed, 1 skipped)
• Manually tested the change

Related Issues

Closes #

[github-actions]

AgentGuard PR Review

I found one actionable issue in the patch.

1. severity: high — src/runtime/self-command.ts (isVerifiedAgentGuardNpxInvocation)
   • What can go wrong: The new npx allowlist accepts npx @goplus/agentguard ... and npx @goplus/agentguard@latest|@beta ... without requiring the safe --yes/-y flag or any package provenance pinning. In npx, omitting --yes can trigger interactive install/prompts or resolve from an attacker-controlled local/project context, and @latest/@beta permits unpinned code execution. Because this predicate now powers the native self-output exemptions in protect.ts, a malicious command shaped like a supported AgentGuard invocation could inherit special handling and bypass normal blocking/redaction paths.
   • Concrete fix: Restrict the npx recognition to the documented, non-interactive form only (for example require -y/--yes and a pinned semver or verified package provenance), or remove npx from the owned/self-output exception entirely unless the package path is fully trusted.