feat(agent): replace the shell tool with the myshell process EDSL

The agent no longer has a shell. Commands are spawned from `run_moonbit`
programs through `bobzhang/myshell`, a shell-free process EDSL where the
executable and the argument vector stay separate: `Cmd("moon", ["check"])`
passes every argument literally, so `|`, `>`, `&&`, `$()` and `*` have no
meaning and there is no quoting to get wrong. Pipes and control flow are
ordinary MoonBit — capture `out.stdout` and filter it in code — which is
also what replaces grep/sed/awk.

What this removes is a parsing layer and the string heuristics defending
it. What it keeps is everything the shell tool actually delivered:

- Background jobs move to `run_moonbit`'s `run_in_background`, watched by
  `job_output` and `job_stop` (renamed from `shell_output`/`shell_stop`,
  since a registry without a shell must not advertise shell names). The
  job runtime, its spill dir, and the completion-notice steer are wired
  as before.
- A detached snippet owns its directory until the session scope ends,
  rather than being reclaimed by the call that started it.
- The foreground bound rises from 60s to 300s, because a snippet now runs
  whole `moon test` cycles rather than only compute.

The source-write sandbox still wraps every run. Note the consequence: the
shell tool could statically recognize trusted source-writing moon commands
(`moon fmt`, `moon info`, `moon add`, `moon test --update`) and run them
exempt, but an arbitrary snippet cannot be classified that way, so those
commands are denied and source changes go through the file tools. The
system prompt says so directly and tells the agent to report the commands
it could not run.

`run_moonbit` keeps refusing native FFI; it no longer refuses spawning
processes, which is now the point of the tool.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: tonyfettes

README.mbt.md

@@ -131,9 +131,12 @@ The `cmd/openseek` package is the single-binary entry point — a subcommand tre
 (default: the terminal UI; `run`/`serve`/`review`/`sessions` for the headless
 engine; `mcp` to validate MCP configuration). `openseek run` parses arguments
 and runs the agent package. The agent sends DeepSeek native function tools and
-supports twelve local tools: `shell` (with `shell_output` and `shell_stop` for
-background jobs — on Windows the plain foreground shell only), `read`, `edit`,
-`multi_edit`, `write`, `remove`, `plan`, `goal`, `run_moonbit`, and `finish`.
+supports eleven local tools: `run_moonbit` — which is both the scripting surface
+and the command runner, spawning processes through the shell-free
+[`bobzhang/myshell`](https://mooncakes.io/docs/bobzhang/myshell) EDSL, with
+`job_output` and `job_stop` watching anything it detaches as a background job —
+plus `read`, `edit`, `multi_edit`, `write`, `remove`, `plan`, `goal`, and
+`finish`. There is no shell tool, so no command ever goes through a shell.
 
 ```bash
 export DEEPSEEK=sk-...

agent/README.mbt.md

@@ -103,10 +103,11 @@ calls `@agent.run`, but that decision lives outside the `agent` package.
 
 `build_tools(runtime, scope)` returns the standard local tool registry:
 
-- `shell`: run a command under the workspace root or an explicit cwd (including
-  `moon check` for compiler feedback), with `run_in_background` support;
-- `shell_output` / `shell_stop`: read or stop a background shell job (omitted on
-  Windows, where background jobs are not wired);
+- `run_moonbit`: compile and run a self-contained MoonBit program — both the
+  scripting surface (transform files, parse JSON, compute, probe the language)
+  and the command runner, since processes are spawned from the program through
+  the shell-free `bobzhang/myshell` EDSL. Supports `run_in_background`;
+- `job_output` / `job_stop`: read or stop a background job;
 - `read`: read a text file;
 - `edit`: replace exact text in a file;
 - `multi_edit`: apply several explicit line-anchored replacements to one file;
@@ -115,16 +116,16 @@ calls `@agent.run`, but that decision lives outside the `agent` package.
 - `plan`: record or replace the step-by-step plan for a multi-step task;
 - `goal`: report standing-goal status (`met`, `continuing`, or `blocked`;
   `met` clears the goal — setting one is the serve `goal` command's job);
-- `run_moonbit`: compile and run a self-contained MoonBit program in an
-  isolated package (automation and language probes; standard batteries only,
-  no local packages);
 - `finish`: end the task with a final answer.
 
+There is no shell tool: every command the agent runs is an argument vector
+handed to `@myshell.Cmd`, so no command text is ever parsed by a shell.
+
 File-oriented tools capture `runtime.workspace_root()` when the registry is
 built. The registry also receives the runtime and task scope for stateful
-tools: the shell tools use both — background-job completion notices are pushed
-through `runtime.queue_steer`, and the background-job runtime plus its spill-dir
-cleanup are owned by the task scope's group.
+tools: the background-job path uses both — completion notices are pushed
+through `runtime.queue_steer`, and the job runtime plus its spill-dir cleanup
+are owned by the task scope's group.
 
 ```mbt check
 ///|
@@ -139,9 +140,6 @@ async test "standard tools are registered in dispatch order" {
       ],
       content=(
         #|[
-        #|  "shell",
-        #|  "shell_output",
-        #|  "shell_stop",
         #|  "read",
         #|  "edit",
         #|  "multi_edit",
@@ -150,6 +148,8 @@ async test "standard tools are registered in dispatch order" {
         #|  "plan",
         #|  "goal",
         #|  "run_moonbit",
+        #|  "job_output",
+        #|  "job_stop",
         #|  "finish",
         #|]
       ),
@@ -283,9 +283,9 @@ answer, `finish`, `abort`, cancellation, unexpected failure, or exhausted
 
 ## Operational Notes
 
-This package is intended for trusted local automation. The standard `shell`
-tool can run arbitrary commands, while `edit` and `write` can modify files
-visible to the process. Use the CLI package for application-level policy,
+This package is intended for trusted local automation. `run_moonbit` can run
+arbitrary commands (its snippets spawn processes), while `edit` and `write` can
+modify files visible to the process. Use the CLI package for application-level policy,
 session storage, logging configuration, and serve-mode wire handling.
 
 Run the package tests with:
@@ -312,11 +312,12 @@ improving:
   logs through async logging so piped runs such as `2>&1 | tee run.log` receive
   step output promptly.
 - Current MoonBit projects use `moon.mod`; `moon.mod.json` is legacy. Manifest
-  or package-import edits should be followed quickly by a shell `moon check` or
-  another explicit shell validation command.
-- Use `shell` for exact end-to-end MoonBit command validation beyond compiler
-  feedback, especially `moon test`, `moon run`, `moon info`, `moon fmt`, and
-  README command checks.
+  or package-import edits should be followed quickly by a `moon check` or
+  another explicit validation command.
+- Use `run_moonbit` for exact end-to-end MoonBit command validation beyond
+  compiler feedback, especially `moon test`, `moon run`, and README command
+  checks. Source-writing commands (`moon fmt`, `moon info`) are denied by the
+  snippet sandbox and belong to the caller, not the agent.
 - For snapshot updates, run plain `moon test` first and only run
   `moon test --update` after deciding the failure is a stale snapshot or
   intentional output change, not a behavior bug.

agent/moon.pkg

@@ -5,8 +5,8 @@ import {
   "bobzhang/openseek/agent_runtime",
   "bobzhang/openseek/agent_tool",
   "bobzhang/openseek/agent_tool/bgjobs",
-  "bobzhang/openseek/agent_tool/shell_output",
-  "bobzhang/openseek/agent_tool/shell_stop",
+  "bobzhang/openseek/agent_tool/job_output",
+  "bobzhang/openseek/agent_tool/job_stop",
   "bobzhang/openseek/agent_tool/edit",
   "bobzhang/openseek/agent_tool/finish",
   "bobzhang/openseek/agent_tool/goal",
@@ -15,7 +15,6 @@ import {
   "bobzhang/openseek/agent_tool/run_moonbit",
   "bobzhang/openseek/agent_tool/read",
   "bobzhang/openseek/agent_tool/remove",
-  "bobzhang/openseek/agent_tool/shell",
   "bobzhang/openseek/agent_tool/write",
   "bobzhang/openseek/deepseek",
   "bobzhang/openseek/deepseek/client",

agent/steer_test.mbt

@@ -16,7 +16,7 @@ async fn steer_test_server(group : @async.TaskGroup[Unit]) -> String? {
         assert_true(request_body.contains("also rename the file"))
         // The prebuilt registry reached the request: the standard tools ride
         // along even though the caller, not the turn, constructed them.
-        assert_true(request_body.contains("\"name\":\"shell\""))
+        assert_true(request_body.contains("\"name\":\"run_moonbit\""))
         conn.send_response(200, "OK", extra_headers={
           "Content-Type": "text/event-stream",
         })