[sleegme]

Fixes #167.

What changed

1. Enforced no-shell boundary (m1, authored by NTG Bulldozer/Bobcat under WQ-22): runner.mjs sets NTG_BULLDOZER_NO_SHELL=1 only on bulldozer-role invocations; hooks.json registers a PreToolUse guard (hooks/bulldozer-shell-guard.py) that denies run_command under the marker with the message "discovery routes to Jaguar". All other tools and all other roles untouched. Ambience is stripped for non-bulldozer roles.
2. Single sanctioned exception: the TEMPORARY headless Excavator transport (node .../scripts/excavator-agy.mjs) is allowed, and only as a plain invocation - chained (;, &&, ||, |), backtick or $(...) forms are denied like everything else. This keeps the documented Excavator: TEMPORARY headless Argon path via agy CLI (follow-up to #173) #174 hard-repair path working.
3. Self-referential role text removed (m2): agents/bulldozer.md no longer names scripts/spine.mjs, so packet-named files cannot induce runner-inspection loops. Role-guidance base pin recomputed and documented in tests/test_role_guidance.mjs.

Evidence

• Live probe (.omo/evidence/167-live-probe.md): worktree build installed, marker set, agy -p "Reply with exactly: BULLDOZER_NO_SHELL_PASS" on gemini-3.8-flash-high returned the string in 1 turn / 4.2s with ZERO tool calls. Issue Enforce Bulldozer no-shell boundary and eliminate self-referential script reading loops #167 baseline: 3 tool calls incl. run_command grep, 7 steps, 24.1s. Plugin restored to main and diff-verified afterwards.
• Tests: node --test tests/*.mjs 361 tests, 0 fail (21 pre-existing skips); python3 tests/test_bulldozer_shell_guard.py 11/11 OK (deny under marker, allow excavator transport, deny chained/substituted, allow without marker, malformed input).

작성: 벨로나냥(리드 — 산문 #180 회피로 m2·프로브·화이트리스트·핀 갱신 수검) + NTG(m1 구현; #180 Zen 산문 봉투 버그로 자체 검증은 대리 검증).

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.