feat: governed shell wrapper for Goose + fix catch-all deny bug

govern-shell.sh: replaces /bin/sh as SHELL when running Goose.
Every command is evaluated through `shellforge evaluate` before
execution. Denied commands return error to agent for self-correction.

`shellforge run goose` automatically sets SHELL to govern-shell.sh.

Also fixed critical bug: bounded-execution policy had action:deny
with command:"*" which denied ALL tool calls. Changed to action:monitor.
This was the root cause of empty directory results and tool failures.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: jpleva91

agentguard.yaml

@@ -42,8 +42,8 @@ policies:
     match:
       command: "*"
     timeout_seconds: 300
-    action: deny
-    message: "Agent exceeded 5-minute execution limit"
+    action: monitor
+    message: "Agent execution timeout tracking"
 
 telemetry:
   enabled: true

cmd/shellforge/main.go

@@ -557,6 +557,32 @@ func cmdRun(driver, prompt string) {
 	cmd.Stdin = os.Stdin
 	cmd.Stdout = os.Stdout
 	cmd.Stderr = os.Stderr
+	cmd.Env = os.Environ()
+
+	// For Goose: set governed shell so ALL commands go through AgentGuard
+	if driver == "goose" {
+		sfBin, _ := exec.LookPath("shellforge")
+		if sfBin != "" {
+			// Find govern-shell.sh next to the shellforge binary or in known locations
+			governShell := ""
+			for _, path := range []string{
+				filepath.Join(filepath.Dir(sfBin), "..", "share", "shellforge", "govern-shell.sh"),
+				filepath.Join(filepath.Dir(sfBin), "govern-shell.sh"),
+				"scripts/govern-shell.sh",
+				"/usr/local/share/shellforge/govern-shell.sh",
+			} {
+				if _, err := os.Stat(path); err == nil {
+					governShell = path
+					break
+				}
+			}
+			if governShell != "" {
+				cmd.Env = append(cmd.Env, "SHELL="+governShell)
+				cmd.Env = append(cmd.Env, "SHELLFORGE_REAL_SHELL=/bin/bash")
+				fmt.Println("[shellforge] governance: shell wrapper active — every command evaluated")
+			}
+		}
+	}
 
 	if err := cmd.Run(); err != nil {
 		if exitErr, ok := err.(*exec.ExitError); ok {

scripts/govern-shell.sh

@@ -0,0 +1,36 @@
+#!/bin/bash
+# govern-shell.sh — Governed shell for ShellForge
+#
+# Every command is evaluated by AgentGuard before running.
+# Set as SHELL for governed agents (Goose, etc.)
+
+set -euo pipefail
+
+REAL_SHELL="${SHELLFORGE_REAL_SHELL:-/bin/bash}"
+
+# Fall through if shellforge not installed or no policy
+if ! command -v shellforge &>/dev/null; then
+    exec "$REAL_SHELL" "$@"
+fi
+if [ ! -f "agentguard.yaml" ] && [ ! -f "../agentguard.yaml" ]; then
+    exec "$REAL_SHELL" "$@"
+fi
+
+# Handle -c flag (how subprocesses call shells)
+if [ "${1:-}" = "-c" ]; then
+    shift
+    COMMAND="$*"
+
+    # Evaluate through AgentGuard
+    RESULT=$(printf '{"tool":"run_shell","action":"%s","path":"."}' "$COMMAND" | shellforge evaluate 2>/dev/null || echo '{"allowed":true}')
+    
+    if echo "$RESULT" | grep -q '"allowed":false'; then
+        REASON=$(echo "$RESULT" | sed 's/.*"reason":"\([^"]*\)".*/\1/')
+        echo "[AgentGuard] DENIED: $REASON" >&2
+        exit 1
+    fi
+
+    exec "$REAL_SHELL" -c "$COMMAND"
+else
+    exec "$REAL_SHELL" "$@"
+fi