refactor(commands)!: remove the lrun local-execution command

lrun ran an arbitrary command in mtui's local shell. It is removed from
both surfaces as a design choice:

- Over MCP it never made sense: the client already has its own local
  execution, which is exactly why lrun was permanently deny-listed there
  from the start. A tool that exists only to be denied is dead surface.
- In the REPL the tester is already sitting at a shell; prefixing a
  local command with 'lrun' bought nothing over running it directly (or
  over 'run' for the reference hosts).

Removal, not denial: the command is gone from the registry, so neither
the REPL nor MCP can reach it, and the MCP deny-list shrinks to the
interactive/REPL-only set. A new registry test pins the removal (absent
from the registry AND from the deny-list, so no stale entry lingers).
MCP tests that used lrun as their deny-list specimen now use shell,
which keeps the same assertions meaningful. The MCP tool surface is
unchanged - lrun was never synthesised - so downstream LLM configs are
unaffected. cli.md regenerated via cargo xtask gen-docs; help-listing
snapshot refreshed.

BREAKING CHANGE: the lrun REPL command no longer exists. Use your shell
directly, or 'run' for commands on the reference hosts.

Author: plusky

AGENTS.md

@@ -131,8 +131,9 @@ see phase progress. Phase 0 (workspace bootstrap) is already complete (closed).
   converting the command's `clap` arg spec to a JSON schema, reconstructing argv
   from tool kwargs, and dispatching through the **same engine** as the REPL.
   REPL-only commands (`quit`, `exit`, `EOF`, `edit`, `shell`, `help`, `terms`,
-  `switch`) and local process execution (`lrun`) are deny-listed; the deny-list ∩
-  registry is consistency-tested and drift is warned about at boot.
+  `switch`) are deny-listed; the deny-list ∩ registry is consistency-tested and
+  drift is warned about at boot. Local process execution has no command at all —
+  `lrun` was removed by design; do not reintroduce it.
 
 ## Contracts (do not break without intent — these enable ecosystem interop)
 - **RRID grammar** `project:kind:maintenance_id:review_id` and its parse errors.

CHANGELOG.md

@@ -99,6 +99,14 @@ _The entries below document the final Python releases, retained for history._
   immediately instead of each repeating the doomed download, so a down
   server costs one transport timeout, not one per caller.
 
+### Removed
+
+- The `lrun` command (run a command in the local shell) has been removed from
+  both the REPL and the MCP server. It never made sense over MCP — the client
+  already has its own local execution, which is why it was permanently
+  deny-listed there — and in the REPL a tester is already at a shell. Use the
+  shell directly, or `run` for commands on the reference hosts.
+
 ## 19.0.1 - 2026-07-17
 
 ### Added

README.md

@@ -37,10 +37,11 @@ ecosystem.
 
 ### MCP security boundary
 
-`lrun` executes commands as the local process user. It remains available through
-direct `mtui` use and trusted callers of the core engine, but MCP synthesis and
-routing never expose it over stdio or HTTP. This permanent deny applies under
-every MCP profile and cannot be reversed with `[mcp] tools_allow`.
+Interactive/REPL-only commands (`shell`, `edit`, `terms`, …) are permanently
+deny-listed: MCP synthesis and routing never expose them over stdio or HTTP,
+under every MCP profile, and the deny cannot be reversed with
+`[mcp] tools_allow`. Local process execution is not exposed at all — the former
+`lrun` command was removed from mtui entirely.
 
 MCP profiles reduce the advertised tool surface; they are not authentication or
 authorization. HTTP session isolation is likewise not caller authentication.

crates/mtui-core/src/commands/localrun.rs

@@ -6,7 +6,7 @@
 //! [`Session`](crate::Session).
 //!
 //! Ported in port-order "waves" (`PLAN-phase5.md §5.5`). Wave 1 — the core
-//! workflow that gates the phase — lands here: `run`, `lrun`, `update`,
+//! workflow that gates the phase — lands here: `run`, `update`,
 //! `install`/`uninstall`, `prepare`, `downgrade`, `reboot`, `set_repo`,
 //! `show_update_repos`.
 
@@ -15,7 +15,6 @@ pub mod support;
 mod perform;
 
 mod downgrade;
-mod localrun;
 mod prepare;
 mod reboot;
 mod run;
@@ -82,7 +81,6 @@ mod help;
 mod terms;
 
 pub use downgrade::Downgrade;
-pub use localrun::LocalRun;
 pub use prepare::Prepare;
 pub use reboot::Reboot;
 pub use run::Run;

crates/mtui-core/src/commands/mod.rs

@@ -117,8 +117,9 @@ impl Registry {
 /// Commands that must not be synthesised into MCP tools.
 ///
 /// Ports and hardens upstream's MCP deny-list (`AGENTS.md`): these commands drive
-/// the interactive shell, require a controlling terminal, or execute locally
-/// with the `mtui-mcp` process user's authority. The Phase-7 `mtui-mcp` tool
+/// the interactive shell or require a controlling terminal. (Local process
+/// execution used to be the third category; its `lrun` command was removed
+/// outright rather than merely denied.) The Phase-7 `mtui-mcp` tool
 /// synthesiser skips every registry command whose name or alias appears here,
 /// and warns at boot if a deny-list entry no longer resolves (so a
 /// renamed/removed command does not drift silently). Kept here, beside
@@ -132,7 +133,6 @@ pub const MCP_DENYLIST: &[&str] = &[
     "quit", "exit", "EOF",    // session exit (Wave 2)
     "switch", // active-template pointer, REPL-only (Wave 2)
     "shell",  // interactive PTY attach, Phase 6 (Wave 2)
-    "lrun",   // arbitrary local execution as the mtui-mcp process user
     "help",   // registry listing / per-command help, REPL-only (Phase 6)
     "edit",   // $EDITOR spawn on the controlling TTY, REPL-only (Phase 6)
     "terms",  // spawn terminal-launcher scripts to hosts, REPL-only (Phase 6)
@@ -152,7 +152,6 @@ pub fn register_all() -> Registry {
     let mut registry = Registry::new();
     // Wave 1 — core workflow (gates the phase).
     registry.register(Arc::new(commands::Run));
-    registry.register(Arc::new(commands::LocalRun));
     registry.register(Arc::new(commands::Update));
     registry.register(Arc::new(commands::Install));
     registry.register(Arc::new(commands::Uninstall));
@@ -269,7 +268,6 @@ mod tests {
         // Wave 1 — core workflow.
         for name in [
             "run",
-            "lrun",
             "update",
             "install",
             "uninstall",
@@ -362,12 +360,13 @@ mod tests {
 
     #[test]
     fn register_all_command_count() {
-        // 10 Wave 1 + 14 Wave 2 + 17 Wave 3 + 12 Wave 4 (incl. request_review)
-        // + 4 P5 follow-ups (export, list_refhosts, load_template, list_locks)
-        // + 2 openQA-holder follow-ups (reload_openqa, set_workflow:
+        // 9 Wave 1 (10 originally; `lrun` was later removed outright) + 14
+        // Wave 2 + 17 Wave 3 + 12 Wave 4 (incl. request_review) + 4 P5
+        // follow-ups (export, list_refhosts, load_template, list_locks) + 2
+        // openQA-holder follow-ups (reload_openqa, set_workflow:
         // mtui-rs-zs4/plt) + 3 Phase 6 (help: mtui-rs-lhz.9; edit:
-        // mtui-rs-lhz.10; terms: mtui-rs-lhz.11) = 62 canonical commands.
-        assert_eq!(register_all().len(), 62);
+        // mtui-rs-lhz.10; terms: mtui-rs-lhz.11) = 61 canonical commands.
+        assert_eq!(register_all().len(), 61);
     }
 
     #[test]
@@ -397,11 +396,18 @@ mod tests {
     }
 
     #[test]
-    fn mcp_denylist_blocks_local_execution() {
-        assert!(MCP_DENYLIST.contains(&"lrun"));
+    fn lrun_is_fully_removed() {
+        // `lrun` (arbitrary local execution) was removed as a design choice —
+        // not merely MCP-denied. It must be absent from the registry (so
+        // neither the REPL nor MCP can reach it) and absent from the deny-list
+        // (which would otherwise imply it still exists somewhere).
         assert!(
-            register_all().contains("lrun"),
-            "lrun remains a REPL command"
+            !register_all().contains("lrun"),
+            "lrun must not be a registered command"
+        );
+        assert!(
+            !MCP_DENYLIST.contains(&"lrun"),
+            "a removed command must not linger on the deny-list"
         );
     }
 
@@ -419,8 +425,8 @@ mod tests {
             let _reserved_or_registered = r.contains(name);
         }
         // Sanity: the currently-registered deny-listed commands are the Wave 2
-        // REPL-only set (quit+aliases, switch, shell), local execution (`lrun`),
-        // plus `help`, `edit`, and `terms` (Phase 6).
+        // REPL-only set (quit+aliases, switch, shell) plus `help`, `edit`, and
+        // `terms` (Phase 6).
         let registered_denied: Vec<&str> = MCP_DENYLIST
             .iter()
             .copied()
@@ -429,7 +435,7 @@ mod tests {
         assert_eq!(
             registered_denied,
             vec![
-                "quit", "exit", "EOF", "switch", "shell", "lrun", "help", "edit", "terms"
+                "quit", "exit", "EOF", "switch", "shell", "help", "edit", "terms"
             ]
         );
     }

crates/mtui-core/src/registry.rs

@@ -11,12 +11,12 @@ get                   help                  install               list_bugs
 list_history          list_hosts            list_locks            list_metadata
 list_packages         list_products         list_refhosts         list_sessions
 list_templates        list_timeout          list_update_commands  list_versions
-load_template         lock                  lrun                  openqa_jobs
-openqa_overview       prepare               put                   quit
-reboot                regenerate            reject                reload_openqa
-reload_products       remove_host           request_review        run
-set_host_state        set_log_level         set_repo              set_timeout
-set_workflow          shell                 show_diff             show_log
-show_update_repos     switch                terms                 unassign
-uninstall             unload                unlock                update
-updates               whoami
+load_template         lock                  openqa_jobs           openqa_overview
+prepare               put                   quit                  reboot
+regenerate            reject                reload_openqa         reload_products
+remove_host           request_review        run                   set_host_state
+set_log_level         set_repo              set_timeout           set_workflow
+shell                 show_diff             show_log              show_update_repos
+switch                terms                 unassign              uninstall
+unload                unlock                update                updates
+whoami

crates/mtui-core/tests/snapshots/help_listing__help_listing.snap

@@ -1,9 +1,10 @@
 //! Commands the MCP server must not expose as tools.
 //!
-//! Hardening of upstream `mtui/mcp/deny.py`. Each entry either cannot
-//! meaningfully run outside an interactive terminal session or crosses a local
-//! process trust boundary, and is filtered out when [`crate::tools`] synthesises
-//! tools from the command [`Registry`].
+//! Hardening of upstream `mtui/mcp/deny.py`. Each entry cannot meaningfully run
+//! outside an interactive terminal session, and is filtered out when
+//! [`crate::tools`] synthesises tools from the command [`Registry`]. (Upstream's
+//! third category — local process execution via `lrun` — no longer needs
+//! denying: the command was removed from mtui entirely.)
 //!
 //! The deny surface is **not** re-declared here: it is the single
 //! [`mtui_core::MCP_DENYLIST`], which sits beside `register_all` so the list and
@@ -19,8 +20,6 @@
 //!   (P7.8) operate on the loaded report file directly instead.
 //! - `shell`: opens an interactive root PTY on a refhost and needs a TTY the MCP
 //!   transports do not provide.
-//! - `lrun`: executes arbitrary local commands with the `mtui-mcp` process user's
-//!   authority. It remains available to a human through the direct REPL.
 //! - `help`: prints argparser help to stdout; the MCP protocol already
 //!   advertises tool descriptions.
 //! - `terms`: launches local terminal-emulator scripts on the operator's
@@ -48,7 +47,7 @@ mod tests {
     #[test]
     fn blocked_commands_are_denied() {
         for name in [
-            "quit", "exit", "EOF", "edit", "shell", "lrun", "help", "terms", "switch",
+            "quit", "exit", "EOF", "edit", "shell", "help", "terms", "switch",
         ] {
             assert!(is_denied(name), "{name} must be denied");
         }

crates/mtui-mcp/src/deny.rs

@@ -12,7 +12,7 @@
 //! An operator selects a profile with `[mcp] profile` and can fine-tune with
 //! `[mcp] tools_allow` / `[mcp] tools_deny` (see [`apply_profile`]).
 //! Profiles only filter the surface remaining after the permanent MCP deny-list;
-//! `tools_allow` cannot restore a command such as `lrun` that was never
+//! `tools_allow` cannot restore a command such as `shell` that was never
 //! synthesised.
 //!
 //! The default is `full` so existing deployments are unchanged; slimming the tool