fix: adapt AgentGuard to DSH 0.1.1-rc.2

[Mr-Lucky]

Summary

Update AgentGuard for DSH 0.1.1-rc.2 compatibility:

• Authorize AgentGuard package lifecycle builds during DSH profile installation.
• Enable DSH runtime protection by default in the packaged composition.
• Classify the persistent pwsh tool as shell execution.
• Update package lifecycle coverage and DSH documentation accordingly.

Type

• Bug fix
• New feature / detection rule
• Refactoring
• Documentation

Testing

• npm run build passes
• npm test passes (547 tests)
• Manually tested the change

Related Issues

Closes #

[github-actions]

AgentGuard PR Review

I found two actionable regressions introduced by this patch.

1. severity: high — src/dsh/runtime.ts / src/tests/dsh-runtime.test.ts

   • What can go wrong: Adding pwsh to SHELL_TOOLS makes PowerShell execution be classified as generic shell execution. In DSH protect mode, that can change policy handling for PowerShell calls, potentially causing them to be treated more permissively or to miss PowerShell-specific detection/approval paths.
   • Concrete fix: Confirm DSH’s actual pwsh semantics and, if it is a shell-equivalent, add dedicated test coverage for protect-mode decisions on pwsh (not just the mapping). If it is not equivalent, remove the mapping and handle it as its own runtime action.

2. severity: medium — scripts/test-dsh-package.mjs

   • What can go wrong: The new tarballBuildKey logic builds a file: allow-build key from relative(await realpath(profileDir), tarball). For relative paths outside the profile directory this can produce incorrect keys such as ../..., causing the install path to fail or the test to pass against the wrong build authorization format.
   • Concrete fix: Construct the build key using the exact pnpm-expected resolution from the package manager docs or derive it from the tarball path relative to the current working directory only when it is guaranteed to be inside the profile root. Add a test asserting the emitted --allow-build value matches the installed tarball’s actual package ID format on all supported platforms.