feat(agent): replace the shell tool with the myshell process EDSL

.github/workflows/copilot-setup-steps.yml

@@ -29,9 +29,12 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v5
 
+      # Pre-release, to match CI: `run_moonbit`'s policy states its spawn
+      # allowlist with `process.allow`, which stable's moonrun rejects outright,
+      # so an agent working here on stable would find every snippet refused.
       - name: Set up MoonBit
         run: |
-          curl -fsSL https://cli.moonbitlang.com/install/unix.sh | bash
+          curl -fsSL https://cli.moonbitlang.com/install/unix.sh | bash -s pre-release
           echo "$HOME/.moon/bin" >> $GITHUB_PATH
 
       - name: Update MoonBit dependencies

.github/workflows/desktop-release.yml

@@ -159,9 +159,14 @@ jobs:
           expected="version = \"$RELEASE_VERSION\""
           grep -Fx "$expected" desktop/moon.mod
 
+      # Pre-release, matching CI. This is the toolchain that BUILDS the app, not
+      # the seed it ships (that one is pinned by `desktop/.moonbit-version`), but
+      # if the two channels differed then a change compiling on the channel CI
+      # runs could still break the release build, and nothing would catch it
+      # until a release ran.
       - name: Set up MoonBit
         run: |
-          curl -fsSL https://cli.moonbitlang.com/install/unix.sh | bash
+          curl -fsSL https://cli.moonbitlang.com/install/unix.sh | bash -s pre-release
           echo "$HOME/.moon/bin" >> "$GITHUB_PATH"
 
       - name: Show MoonBit version

README.mbt.md

@@ -130,9 +130,12 @@ The `cmd/openseek` package is the single-binary entry point — a subcommand tre
 (default: the terminal UI; `run`/`serve`/`review`/`sessions` for the headless
 engine; `mcp` to validate MCP configuration). `openseek run` parses arguments
 and runs the agent package. The agent sends DeepSeek native function tools and
-supports twelve local tools: `shell` (with `shell_output` and `shell_stop` for
-background jobs — on Windows the plain foreground shell only), `read`, `edit`,
-`multi_edit`, `write`, `remove`, `plan`, `goal`, `run_moonbit`, and `finish`.
+supports eleven local tools: `run_moonbit` — both the scripting surface and the
+command runner, spawning processes through the shell-free
+[`bobzhang/myshell`](https://mooncakes.io/docs/bobzhang/myshell) EDSL, with
+`job_output` and `job_stop` watching anything it detaches as a background job —
+plus `read`, `edit`, `multi_edit`, `write`, `remove`, `plan`, `goal`, and
+`finish`. There is no shell tool, so no command ever goes through a shell.
 
 ```bash
 export DEEPSEEK=sk-...

agent/README.mbt.md

@@ -103,10 +103,11 @@ calls `@agent.run`, but that decision lives outside the `agent` package.
 
 `build_tools(runtime, scope)` returns the standard local tool registry:
 
-- `shell`: run a command under the workspace root or an explicit cwd (including
-  `moon check` for compiler feedback), with `run_in_background` support;
-- `shell_output` / `shell_stop`: read or stop a background shell job (omitted on
-  Windows, where background jobs are not wired);
+- `run_moonbit`: compile and run a self-contained MoonBit program — both the
+  scripting surface (transform files, parse JSON, compute, probe the language)
+  and the command runner, since processes are spawned from the program through
+  the shell-free `bobzhang/myshell` EDSL. Supports `run_in_background`;
+- `job_output` / `job_stop`: read or stop a background job;
 - `read`: read a text file;
 - `edit`: replace exact text in a file;
 - `multi_edit`: apply several explicit line-anchored replacements to one file;
@@ -115,16 +116,16 @@ calls `@agent.run`, but that decision lives outside the `agent` package.
 - `plan`: record or replace the step-by-step plan for a multi-step task;
 - `goal`: report standing-goal status (`met`, `continuing`, or `blocked`;
   `met` clears the goal — setting one is the serve `goal` command's job);
-- `run_moonbit`: compile and run a self-contained MoonBit program in an
-  isolated package (automation and language probes; standard batteries only,
-  no local packages);
 - `finish`: end the task with a final answer.
 
+There is no shell tool: every command the agent runs is an argument vector
+handed to `@myshell.Cmd`, so no command text is ever parsed by a shell.
+
 File-oriented tools capture `runtime.workspace_root()` when the registry is
 built. The registry also receives the runtime and task scope for stateful
-tools: the shell tools use both — background-job completion notices are pushed
-through `runtime.queue_steer`, and the background-job runtime plus its spill-dir
-cleanup are owned by the task scope's group.
+tools: the background-job path uses both — completion notices are pushed
+through `runtime.queue_steer`, and the job runtime plus its spill-dir cleanup
+are owned by the task scope's group.
 
 ```mbt check
 ///|
@@ -139,9 +140,6 @@ async test "standard tools are registered in dispatch order" {
       ],
       content=(
         #|[
-        #|  "shell",
-        #|  "shell_output",
-        #|  "shell_stop",
         #|  "read",
         #|  "edit",
         #|  "multi_edit",
@@ -150,6 +148,8 @@ async test "standard tools are registered in dispatch order" {
         #|  "plan",
         #|  "goal",
         #|  "run_moonbit",
+        #|  "job_output",
+        #|  "job_stop",
         #|  "finish",
         #|]
       ),
@@ -283,9 +283,9 @@ answer, `finish`, `abort`, cancellation, unexpected failure, or exhausted
 
 ## Operational Notes
 
-This package is intended for trusted local automation. The standard `shell`
-tool can run arbitrary commands, while `edit` and `write` can modify files
-visible to the process. Use the CLI package for application-level policy,
+This package is intended for trusted local automation. `run_moonbit` can run
+arbitrary commands (its snippets spawn processes), while `edit` and `write` can
+modify files visible to the process. Use the CLI package for application-level policy,
 session storage, logging configuration, and serve-mode wire handling.
 
 Run the package tests with:
@@ -312,11 +312,12 @@ improving:
   logs through async logging so piped runs such as `2>&1 | tee run.log` receive
   step output promptly.
 - Current MoonBit projects use `moon.mod`; `moon.mod.json` is legacy. Manifest
-  or package-import edits should be followed quickly by a shell `moon check` or
-  another explicit shell validation command.
-- Use `shell` for exact end-to-end MoonBit command validation beyond compiler
-  feedback, especially `moon test`, `moon run`, `moon info`, `moon fmt`, and
-  README command checks.
+  or package-import edits should be followed quickly by a `moon check` or
+  another explicit validation command.
+- Use `run_moonbit` for exact end-to-end MoonBit command validation beyond
+  compiler feedback, especially `moon test`, `moon run`, and README command
+  checks. Source-writing commands (`moon fmt`, `moon info`) are denied by the
+  snippet sandbox and belong to the caller, not the agent.
 - For snapshot updates, run plain `moon test` first and only run
   `moon test --update` after deciding the failure is a stale snapshot or
   intentional output change, not a behavior bug.

agent/moon.pkg

@@ -5,8 +5,8 @@ import {
   "bobzhang/openseek/agent_runtime",
   "bobzhang/openseek/agent_tool",
   "bobzhang/openseek/agent_tool/bgjobs",
-  "bobzhang/openseek/agent_tool/shell_output",
-  "bobzhang/openseek/agent_tool/shell_stop",
+  "bobzhang/openseek/agent_tool/job_output",
+  "bobzhang/openseek/agent_tool/job_stop",
   "bobzhang/openseek/agent_tool/edit",
   "bobzhang/openseek/agent_tool/finish",
   "bobzhang/openseek/agent_tool/goal",
@@ -15,7 +15,6 @@ import {
   "bobzhang/openseek/agent_tool/run_moonbit",
   "bobzhang/openseek/agent_tool/read",
   "bobzhang/openseek/agent_tool/remove",
-  "bobzhang/openseek/agent_tool/shell",
   "bobzhang/openseek/agent_tool/write",
   "bobzhang/openseek/deepseek",
   "bobzhang/openseek/deepseek/client",

agent/steer_test.mbt

@@ -16,7 +16,7 @@ async fn steer_test_server(group : @async.TaskGroup[Unit]) -> String? {
         assert_true(request_body.contains("also rename the file"))
         // The prebuilt registry reached the request: the standard tools ride
         // along even though the caller, not the turn, constructed them.
-        assert_true(request_body.contains("\"name\":\"shell\""))
+        assert_true(request_body.contains("\"name\":\"run_moonbit\""))
         conn.send_response(200, "OK", extra_headers={
           "Content-Type": "text/event-stream",
         })