[Mr-Lucky]

Summary

Keep AgentGuard CLI commands and their output available across agent hooks, including installer and status results. Ask agents to run AgentGuard commands separately from unrelated shell commands so other output remains protected. Prevent generated approval action IDs from being mistaken for bank accounts while continuing to detect explicitly labeled bank account data.

Type

• Bug fix
• New feature / detection rule
• Refactoring
• Documentation

Testing

• npm run build passes
• npm test passes (928 passed, 1 skipped)
• Manually tested the change

Related Issues

Closes #

[github-actions]

AgentGuard PR Review

I found one actionable issue in the patch.

1. severity: high — src/runtime/self-command.ts / splitShellStatements and isMixedAgentGuardCliCommand
   What can go wrong: The new mixed-command detector treats any &&/;-separated shell sequence containing an AgentGuard command as a single security decision, but the parser is still ad hoc and does not safely cover shell syntax. It explicitly returns null for some constructs ($(), backticks, (, ), here-docs, comments), which can cause the hook to miss mixed-command cases entirely and allow a combined command to bypass the new deny path. In particular, shell constructs like subshells, command substitution, and here-docs are common in real agent output, so this is a correctness/security regression in a security-sensitive classifier.
   Fix suggestion: Do not rely on this partial string parser for enforcement. Use a real shell parser/AST (or restrict the feature to a narrow, fully-tokenized command grammar) and fail closed on any unparseable command by denying or requiring approval rather than returning false.