agent: add deterministic secret and scope regex guards alongside Cedar

Component

Agent (Python runtime)

Describe the feature

Add a fast, deterministic PreToolUse guard layer in agent/src/hooks.py (or a dedicated regex_guards.py) that runs before Cedar evaluation for selected tool classes. Guards should be pure regex / JSON field checks with no LLM involvement.

Minimum guard set:

Emit tool_decision / progress events when a guard blocks (for observability parity with Cedar denies).

Use case

Cedar policies express intent well but are not ideal for high-velocity pattern matching on raw file content or shell one-liners. A compromised or jailbroken model might still reach bash or write paths before policy catches edge cases.

Operators need defense-in-depth: Cedar for governance and HITL, regex guards for known credential and exfiltration shapes that must never reach the repo.

Proposed solution

1. Implement guards as pure functions returning ALLOW / DENY + reason string.
2. Wire into existing PreToolUse hook path in hooks.py before PolicyEngine.evaluate().
3. Load scope from agent/src/config.py task context (repo, branch, issue_number, etc.) — same fields hydration already sets.
4. Add agent/tests/test_regex_guards.py with table-driven cases (≥10 per guard): allowed benign cases + blocked malicious cases.
5. Document in docs/design/SECURITY.md under §Tool access control as "Layer 0: deterministic guards".
6. Optional: mirror critical patterns in output_scanner.py PostToolUse for defense in depth.

Other information

• Complements existing Cedar hard/soft deny (docs/design/CEDAR_HITL_GATES.md) — does not replace it.
• Related: #225 (egress DLP on progress events / PR content), #390 (execution-layer hardening below tool policy). This issue is PreToolUse input blocking; #225 is egress; output_scanner.py today is PostToolUse only.
• Scope guard should align with per-task SessionRole tags (repo, task_id) semantics in docs/design/SECURITY.md.
• Consider nosemgrep only if semgrep flags intentional test fixtures.

Acknowledgements

• I may be able to implement this feature
• This might be a breaking change

agent/src/hooks.py と既存の PreToolUse パスから始め、次に agent/src/config.py を調べて task-scope の hydration と Cedar の評価呼び出しを確認してください。agent/tests/test_regex_guards.py を使って、テーブル駆動の benign ケースと malicious ケースを用意し、既存のセキュリティおよび observability の慣例について docs/design/SECURITY.md と output_scanner.py を確認してください。完了条件は、guards が Cedar より前に実行され、blocking events を発行し、要求された coverage があり、文書化されていることです。