dscli-agent 0.3.0__tar.gz → 0.4.0__tar.gz

{dscli_agent-0.3.0 → dscli_agent-0.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dscli-agent
-Version: 0.3.0
+Version: 0.4.0
 Summary: A local coding agent that uses DeepSeek web chat as its model
 Author: Anish
 License-Expression: MIT
@@ -262,8 +262,11 @@ dscli run "Refactor the parser" -f src/parser.py -f tests/test_parser.py
 # Globs work too; quote them so the shell does not expand them
 dscli run "Fix the bug" -f "src/**/*.py" --workspace C:\projects\app
 
-# Read a long task from a file; auto-approve edits; allow shell commands
-dscli run --prompt-file task.md -y --allow-shell
+# Read a long task from a file; auto-approve edits and approved shell commands
+dscli run --prompt-file task.md -y
+
+# Disable command execution entirely for this run
+dscli run "Review the docs" --no-shell
 ```
 
 The final answer is printed to stdout. Progress, diffs, and approval prompts go to
@@ -281,7 +284,7 @@ failures and unconfirmed completions are always logged to stderr, including unde
 | `-f, --file PATH` | Attach a file (repeatable, globs supported). |
 | `--workspace PATH` | Root the tools may touch. Defaults to the current directory. |
 | `-y, --yes` | Approve every write/patch/command without asking. |
-| `--allow-shell` | Enable `run_command` (still approved per command). |
+| `--no-shell` | Disable `run_command` for this run (commands are otherwise enabled and approved per command). |
 | `--allow-outside` | Let tools read/write outside the workspace. |
 | `--headed` / `--headless` | Show or hide the browser. Headless is the default. |
 | `--search` | Turn DeepSeek's Search mode on for the run (DeepThink is always on). |
@@ -355,12 +358,19 @@ creep and unnecessary abstractions, confirm hard-to-reverse actions, reference c
 | `apply_patch` | The only way to edit an existing file: exact `search` → `replace`. |
 | `list_files` | Bounded recursive listing. |
 | `delete_file` | Delete one file when explicitly requested (approval required). |
-| `run_command` | Run a shell command (only with `--allow-shell`, approval required). |
+| `run_command` | Run a command with an approval prompt via PowerShell, cmd.exe, sh, or bash. |
 | `update_plan` | Create or revise the task plan; the task cannot finish while steps are unfinished. |
 
 `apply_patch` normalises line endings for matching, preserves the file's encoding and
 line endings when writing, and refuses ambiguous matches unless `replace_all` is set.
 
+`run_command` uses `shell: auto` by default: PowerShell when available on Windows
+(cmd.exe otherwise), and `/bin/sh` elsewhere. Pass `"shell": "cmd"` for cmd.exe syntax
+such as `%VAR%` or batch builtins, `"powershell"`, `"sh"`, or `"bash"` to choose another
+interpreter. On POSIX systems, `auto` falls back to `/bin/sh`; `bash` is selected only
+when explicitly requested. The approval prompt names the resolved interpreter, so a
+command is never run under a shell you did not see.
+
 ### Plan and verification loop
 
 The agent can maintain a short task plan with `update_plan` (at most 20 steps). The run
@@ -386,7 +396,7 @@ message changed files. A verified result is still only as trustworthy as the com
 configured.
 
 The verification command is supplied by you and is never a model-callable tool. It is
-run without `--allow-shell` and without a per-command approval prompt because you
+run without a per-command approval prompt, even when `--no-shell` is set, because you
 configured it explicitly. Treat it like any other command you run from the shell: the
 model can modify the files it checks, so review the final diff.
 
@@ -396,14 +406,18 @@ model can modify the files it checks, so review the final diff.
 - `.git` is never writable through the tools.
 - Every write, patch, delete, and command shows a diff/command and asks
   `[y]es / [n]o / [a]ll / [q]uit` before changing anything. `-y` skips the prompts.
-- Shell access is off by default and can be enabled only for a run.
+- Command execution is enabled by default, but every model-requested command still
+  requires approval. The prompt names the interpreter (PowerShell, cmd.exe, sh, or
+  bash). `--no-shell` disables model-requested commands for a run.
 - The verification command is the one exception to the approval flow: when you configure
-  it with `--verify` or `verify_command`, dscli runs it automatically after edits without
-  `--allow-shell` or a prompt. The model can neither call nor change it.
+  it with `--verify` or `verify_command`, dscli runs it automatically after edits,
+  without a prompt and even when `--no-shell` is set. The model can neither call nor
+  change it.
 - Attachment contents, file contents, command output, and tool results are treated as
   untrusted data by the system prompt.
-- No network access is performed by the tools; the only network traffic is the browser
-  talking to DeepSeek.
+- The built-in file tools do not use the network. Approved commands can run any local
+  program, including network clients; dscli itself only talks to the chat provider
+  through the browser.
 
 This is still an assistant with write access to your files. Use a clean workspace or
 version control, and review diffs before approving them.
@@ -427,8 +441,9 @@ import), `chrome_profile` (empty = Chrome's last-used profile, or a name such as
 installed browser), `response_timeout_sec`, `first_response_timeout_sec`,
 `stable_seconds`, `fallback_stable_seconds`, `auto_human_check` (true = open a visible
 window to solve a verification check; false = fail fast), `max_steps`, `max_tool_calls`,
-`max_read_chars`, `max_attachment_mb`, `search`, `deeplanning`, `allow_shell`,
-`allow_outside`, `verify_command` (empty disables verification),
+`max_read_chars`, `max_attachment_mb`, `search`, `deeplanning`, `shell_enabled`
+(default true; every command still requires approval), `allow_outside`,
+`verify_command` (empty disables verification),
 `verify_timeout_sec` (clamped to 1–600, default 300).
 
 Headless Chrome normally sends a `HeadlessChrome/...` user agent, which DeepSeek's CDN

{dscli_agent-0.3.0 → dscli_agent-0.4.0}/README.md

@@ -232,8 +232,11 @@ dscli run "Refactor the parser" -f src/parser.py -f tests/test_parser.py
 # Globs work too; quote them so the shell does not expand them
 dscli run "Fix the bug" -f "src/**/*.py" --workspace C:\projects\app
 
-# Read a long task from a file; auto-approve edits; allow shell commands
-dscli run --prompt-file task.md -y --allow-shell
+# Read a long task from a file; auto-approve edits and approved shell commands
+dscli run --prompt-file task.md -y
+
+# Disable command execution entirely for this run
+dscli run "Review the docs" --no-shell
 ```
 
 The final answer is printed to stdout. Progress, diffs, and approval prompts go to
@@ -251,7 +254,7 @@ failures and unconfirmed completions are always logged to stderr, including unde
 | `-f, --file PATH` | Attach a file (repeatable, globs supported). |
 | `--workspace PATH` | Root the tools may touch. Defaults to the current directory. |
 | `-y, --yes` | Approve every write/patch/command without asking. |
-| `--allow-shell` | Enable `run_command` (still approved per command). |
+| `--no-shell` | Disable `run_command` for this run (commands are otherwise enabled and approved per command). |
 | `--allow-outside` | Let tools read/write outside the workspace. |
 | `--headed` / `--headless` | Show or hide the browser. Headless is the default. |
 | `--search` | Turn DeepSeek's Search mode on for the run (DeepThink is always on). |
@@ -325,12 +328,19 @@ creep and unnecessary abstractions, confirm hard-to-reverse actions, reference c
 | `apply_patch` | The only way to edit an existing file: exact `search` → `replace`. |
 | `list_files` | Bounded recursive listing. |
 | `delete_file` | Delete one file when explicitly requested (approval required). |
-| `run_command` | Run a shell command (only with `--allow-shell`, approval required). |
+| `run_command` | Run a command with an approval prompt via PowerShell, cmd.exe, sh, or bash. |
 | `update_plan` | Create or revise the task plan; the task cannot finish while steps are unfinished. |
 
 `apply_patch` normalises line endings for matching, preserves the file's encoding and
 line endings when writing, and refuses ambiguous matches unless `replace_all` is set.
 
+`run_command` uses `shell: auto` by default: PowerShell when available on Windows
+(cmd.exe otherwise), and `/bin/sh` elsewhere. Pass `"shell": "cmd"` for cmd.exe syntax
+such as `%VAR%` or batch builtins, `"powershell"`, `"sh"`, or `"bash"` to choose another
+interpreter. On POSIX systems, `auto` falls back to `/bin/sh`; `bash` is selected only
+when explicitly requested. The approval prompt names the resolved interpreter, so a
+command is never run under a shell you did not see.
+
 ### Plan and verification loop
 
 The agent can maintain a short task plan with `update_plan` (at most 20 steps). The run
@@ -356,7 +366,7 @@ message changed files. A verified result is still only as trustworthy as the com
 configured.
 
 The verification command is supplied by you and is never a model-callable tool. It is
-run without `--allow-shell` and without a per-command approval prompt because you
+run without a per-command approval prompt, even when `--no-shell` is set, because you
 configured it explicitly. Treat it like any other command you run from the shell: the
 model can modify the files it checks, so review the final diff.
 
@@ -366,14 +376,18 @@ model can modify the files it checks, so review the final diff.
 - `.git` is never writable through the tools.
 - Every write, patch, delete, and command shows a diff/command and asks
   `[y]es / [n]o / [a]ll / [q]uit` before changing anything. `-y` skips the prompts.
-- Shell access is off by default and can be enabled only for a run.
+- Command execution is enabled by default, but every model-requested command still
+  requires approval. The prompt names the interpreter (PowerShell, cmd.exe, sh, or
+  bash). `--no-shell` disables model-requested commands for a run.
 - The verification command is the one exception to the approval flow: when you configure
-  it with `--verify` or `verify_command`, dscli runs it automatically after edits without
-  `--allow-shell` or a prompt. The model can neither call nor change it.
+  it with `--verify` or `verify_command`, dscli runs it automatically after edits,
+  without a prompt and even when `--no-shell` is set. The model can neither call nor
+  change it.
 - Attachment contents, file contents, command output, and tool results are treated as
   untrusted data by the system prompt.
-- No network access is performed by the tools; the only network traffic is the browser
-  talking to DeepSeek.
+- The built-in file tools do not use the network. Approved commands can run any local
+  program, including network clients; dscli itself only talks to the chat provider
+  through the browser.
 
 This is still an assistant with write access to your files. Use a clean workspace or
 version control, and review diffs before approving them.
@@ -397,8 +411,9 @@ import), `chrome_profile` (empty = Chrome's last-used profile, or a name such as
 installed browser), `response_timeout_sec`, `first_response_timeout_sec`,
 `stable_seconds`, `fallback_stable_seconds`, `auto_human_check` (true = open a visible
 window to solve a verification check; false = fail fast), `max_steps`, `max_tool_calls`,
-`max_read_chars`, `max_attachment_mb`, `search`, `deeplanning`, `allow_shell`,
-`allow_outside`, `verify_command` (empty disables verification),
+`max_read_chars`, `max_attachment_mb`, `search`, `deeplanning`, `shell_enabled`
+(default true; every command still requires approval), `allow_outside`,
+`verify_command` (empty disables verification),
 `verify_timeout_sec` (clamped to 1–600, default 300).
 
 Headless Chrome normally sends a `HeadlessChrome/...` user agent, which DeepSeek's CDN

{dscli_agent-0.3.0 → dscli_agent-0.4.0}/dscli/__init__.py

@@ -1,3 +1,3 @@
 """dscli - a local coding agent for your terminal."""
 
-__version__ = "0.3.0"
+__version__ = "0.4.0"

{dscli_agent-0.3.0 → dscli_agent-0.4.0}/dscli/agent.py

@@ -182,7 +182,7 @@ class Agent:
             live_plan=self.toolbox.plan,
             changed=self.toolbox.changed_files,
             attachments=self.attachments,
-            allow_shell=self.cfg.allow_shell,
+            allow_shell=self.cfg.shell_enabled,
             allow_outside=self.cfg.allow_outside,
             max_steps=self.cfg.max_steps,
             verify_command=self._verify_command,
@@ -277,7 +277,7 @@ class Agent:
                 workspace=self.workspace,
                 attachments=self.attachments,
                 workspace_tree=workspace_preview(self.workspace),
-                allow_shell=self.cfg.allow_shell,
+                allow_shell=self.cfg.shell_enabled,
                 allow_outside=self.cfg.allow_outside,
                 max_steps=self.cfg.max_steps,
                 verify_command=self._verify_command,
@@ -468,7 +468,7 @@ class Agent:
             step=turn,
             max_steps=self.cfg.max_steps,
             changed=self.toolbox.changed_files,
-            allow_shell=self.cfg.allow_shell,
+            allow_shell=self.cfg.shell_enabled,
             per_result_chars=self.cfg.max_tool_output_chars,
             total_chars=self.cfg.max_turn_output_chars,
             notice=notice,

{dscli_agent-0.3.0 → dscli_agent-0.4.0}/dscli/cli.py

@@ -97,8 +97,12 @@ def _add_agent_flags(parser: argparse.ArgumentParser) -> None:
                         help="Workspace root (default: current directory).")
     parser.add_argument("-y", "--yes", action="store_true",
                         help="Approve file writes and commands automatically.")
-    parser.add_argument("--allow-shell", action="store_true",
-                        help="Allow run_command (still approved per command).")
+    shell = parser.add_mutually_exclusive_group()
+    shell.add_argument("--allow-shell", dest="allow_shell", action="store_true",
+                       default=None,
+                       help="Enable run_command with per-command approval (default).")
+    shell.add_argument("--no-shell", dest="allow_shell", action="store_false",
+                       help="Disable command execution for this run.")
     parser.add_argument("--allow-outside", action="store_true",
                         help="Allow tools to access paths outside the workspace.")
     parser.add_argument("--max-steps", type=int, default=None,
@@ -198,8 +202,8 @@ def _apply_run_config(cfg: Config, args: argparse.Namespace) -> Config:
         cfg.search = args.search
     if args.deeplanning is not None:
         cfg.deeplanning = args.deeplanning
-    if args.allow_shell:
-        cfg.allow_shell = True
+    if args.allow_shell is not None:
+        cfg.shell_enabled = args.allow_shell
     if args.allow_outside:
         cfg.allow_outside = True
     if getattr(args, "verify", None) is not None:
@@ -697,7 +701,7 @@ def cmd_chat(args: argparse.Namespace) -> int:
     toolbox = Toolbox(
         workspace,
         allow_outside=cfg.allow_outside,
-        allow_shell=cfg.allow_shell,
+        allow_shell=cfg.shell_enabled,
         confirm=tui.confirm if tui is not None else _confirm(args),
         max_read_chars=cfg.max_read_chars,
         max_write_chars=cfg.max_write_chars,
@@ -809,7 +813,7 @@ def cmd_run(args: argparse.Namespace, parser: argparse.ArgumentParser) -> int:
             workspace=workspace,
             attachments=attachments,
             workspace_tree=workspace_preview(workspace),
-            allow_shell=cfg.allow_shell,
+            allow_shell=cfg.shell_enabled,
             allow_outside=cfg.allow_outside,
             max_steps=cfg.max_steps,
             verify_command=cfg.verification_command(),
@@ -830,7 +834,7 @@ def cmd_run(args: argparse.Namespace, parser: argparse.ArgumentParser) -> int:
     toolbox = Toolbox(
         workspace,
         allow_outside=cfg.allow_outside,
-        allow_shell=cfg.allow_shell,
+        allow_shell=cfg.shell_enabled,
         confirm=confirm,
         max_read_chars=cfg.max_read_chars,
         max_write_chars=cfg.max_write_chars,

{dscli_agent-0.3.0 → dscli_agent-0.4.0}/dscli/compaction.py

@@ -66,7 +66,10 @@ class ConversationLog:
             if args.get("path") is not None:
                 detail = str(args["path"])
             elif result.name == "run_command":
-                detail = _clip(str(args.get("command", "")), 120).replace("\n", " ")
+                shell = str(args.get("shell") or "auto")
+                detail = f"{shell}: " + _clip(
+                    str(args.get("command", "")), 120
+                ).replace("\n", " ")
             elif result.name == "update_plan":
                 steps = args.get("steps")
                 count = len(steps) if isinstance(steps, list) else 0

{dscli_agent-0.3.0 → dscli_agent-0.4.0}/dscli/config.py

@@ -84,7 +84,8 @@ class Config:
     search: bool = False
     # Require a non-empty update_plan before any mutating tool may run.
     deeplanning: bool = False
-    allow_shell: bool = False
+    # Commands are available by default, but every one requires approval.
+    shell_enabled: bool = True
     allow_outside: bool = False
     shell_timeout_sec: int = 120
 

{dscli_agent-0.3.0 → dscli_agent-0.4.0}/dscli/display.py

@@ -13,7 +13,9 @@ def call_label(call: ToolCall) -> str:
     args = call.arguments or {}
     path = args.get("path")
     if call.name == "run_command":
-        command = str(args.get("command", ""))
+        shell = str(args.get("shell") or "").strip()
+        prefix = f"[{shell}] " if shell and shell.lower() != "auto" else ""
+        command = prefix + str(args.get("command", ""))
         if len(command) > 90:
             command = command[:87] + "..."
         return f"run_command {command}"

{dscli_agent-0.3.0 → dscli_agent-0.4.0}/dscli/prompts.py

@@ -43,8 +43,8 @@ TOOLS
   List files and directories. Depth defaults to 2 and is capped at 6. Large/ignored directories are skipped and very large listings are truncated.
 - delete_file {"path": "relative/path"}
   Delete one existing file. Only use this when the user explicitly asks for that file to be deleted. Never delete a file to replace, rewrite, or recreate it, and never delete it because apply_patch failed.
-- run_command {"command": "a shell command", "timeout_sec": 120}
-  Run a command in the workspace root. Only available if the environment block says shell is enabled. It is still subject to user approval. timeout_sec is capped at 600 seconds, and very long output is truncated.
+- run_command {"command": "a shell command", "shell": "auto", "timeout_sec": 120}
+  Run a command in the workspace root after the user approves it. shell is one of auto, powershell, cmd, sh, or bash. auto uses PowerShell on Windows and /bin/sh elsewhere; pass shell="cmd" for cmd.exe syntax on Windows, or shell="bash" for bash. Every command shows its interpreter and text to the user for approval; if the user denies it, do not retry or work around the denial. Command execution is available unless the environment block says shell is disabled. timeout_sec is capped at 600 seconds, and very long output is truncated.
 - update_plan {"steps": [{"text": "step description", "status": "pending"}]}
   Replace the task plan. Valid statuses are pending, in_progress, and completed. The plan belongs to the current user message and starts empty for each new request. Create a short plan before multi-step work and update the statuses as you make progress. Plans are capped at __MAX_PLAN_STEPS__ steps of at most __MAX_PLAN_STEP_CHARS__ characters each. The task cannot finish while any step is pending or in progress. Pass an empty list to clear the plan only when the work is abandoned or the plan no longer matches the task.
 
@@ -148,11 +148,11 @@ def _recap(task: str, limit: int = 1800) -> str:
 
 
 def _shell_description(allow_shell: bool) -> str:
+    if not allow_shell:
+        return "disabled for this run"
     if platform.system() == "Windows":
-        shell = "PowerShell" if allow_shell else "PowerShell (disabled for this run)"
-    else:
-        shell = "/bin/sh" if allow_shell else "/bin/sh (disabled for this run)"
-    return shell
+        return "auto (PowerShell if installed, otherwise cmd.exe; shell='cmd' forces cmd.exe)"
+    return "auto (/bin/sh by default; shell='bash' selects bash)"
 
 
 def _environment_lines(
@@ -423,7 +423,7 @@ def _args_summary(result: ToolResult) -> str:
         count = len(steps) if isinstance(steps, list) else 0
         return json.dumps({"steps": count}, ensure_ascii=False)
     summary: dict[str, object] = {}
-    for key in ("path", "start_line", "end_line", "depth", "command", "timeout_sec", "replace_all"):
+    for key in ("path", "start_line", "end_line", "depth", "command", "shell", "timeout_sec", "replace_all"):
         if key in args:
             summary[key] = args[key]
     if "content" in args and isinstance(args["content"], str):

{dscli_agent-0.3.0 → dscli_agent-0.4.0}/dscli/tools.py

@@ -35,6 +35,20 @@ MAX_PLAN_STEPS = 20
 MAX_PLAN_STEP_CHARS = 300
 PLAN_STATUSES = {"pending", "in_progress", "completed"}
 
+SHELL_CHOICES = ("auto", "powershell", "cmd", "sh", "bash")
+_SHELL_ALIASES = {
+    "auto": "auto",
+    "default": "auto",
+    "shell": "auto",
+    "powershell": "powershell",
+    "pwsh": "powershell",
+    "ps": "powershell",
+    "cmd": "cmd",
+    "command_prompt": "cmd",
+    "sh": "sh",
+    "bash": "bash",
+}
+
 SKIP_DIRS = {
     ".git",
     ".hg",
@@ -151,6 +165,27 @@ def _decode(raw: bytes) -> str:
     return raw.decode("utf-8", errors="replace")
 
 
+def _normalize_shell(value: Any) -> str:
+    if value is None:
+        return "auto"
+    if not isinstance(value, str):
+        raise ToolError(
+            f"shell must be a string, got {type(value).__name__}."
+        )
+    cleaned = value.strip().lower()
+    if not cleaned:
+        return "auto"
+    cleaned = cleaned.rsplit("\\", 1)[-1].rsplit("/", 1)[-1]
+    if cleaned.endswith(".exe"):
+        cleaned = cleaned[:-4]
+    normalized = _SHELL_ALIASES.get(cleaned)
+    if normalized is None:
+        raise ToolError(
+            f"Unknown shell '{value}'. Use one of: {', '.join(SHELL_CHOICES)}."
+        )
+    return normalized
+
+
 def _rel(path: Path, root: Path) -> str:
     try:
         return path.relative_to(root).as_posix()
@@ -235,7 +270,7 @@ class Toolbox:
         root: Path,
         *,
         allow_outside: bool = False,
-        allow_shell: bool = False,
+        allow_shell: bool = True,
         confirm: ConfirmFn | None = None,
         max_read_chars: int = 40000,
         max_write_chars: int = 1_000_000,
@@ -482,6 +517,9 @@ class Toolbox:
             command = pick("command", "cmd", "script", "input")
             if command is not None:
                 args["command"] = command
+            shell = pick("shell", "interpreter", "shell_type")
+            if shell is not None:
+                args["shell"] = shell
             timeout = pick("timeout_sec", "timeout", "timeout_seconds")
             if timeout is not None:
                 args["timeout_sec"] = timeout
@@ -780,8 +818,8 @@ class Toolbox:
     def _run_command(self, args: dict[str, Any]) -> ToolResult:
         if not self.allow_shell:
             raise ToolError(
-                "Shell access is disabled for this run. Ask the user to rerun with --allow-shell "
-                "and approve the command."
+                "Command execution is disabled for this run (--no-shell or "
+                "shell_enabled=false)."
             )
         command = args.get("command")
         if not isinstance(command, str) or not command.strip():
@@ -793,9 +831,17 @@ class Toolbox:
         except (TypeError, ValueError):
             timeout = self.shell_timeout_sec
         timeout = max(1, min(timeout, 600))
-        self._approve(f"Run command in {self.root}?", command)
-        return self._execute_shell_command(
-            command, timeout, name="run_command", arguments=args
+        argv, shell_label = self._build_shell_command(command, args.get("shell"))
+        self._approve(
+            f"Run {shell_label} command in {self.root}?",
+            command,
+        )
+        return self._run_shell_process(
+            argv,
+            timeout,
+            name="run_command",
+            arguments=args,
+            shell_label=shell_label,
         )
 
     def run_verification(self, command: str, *, timeout_sec: int = 300) -> ToolResult:
@@ -824,6 +870,66 @@ class Toolbox:
                 output=f"Could not start the verification command: {exc}",
             )
 
+    def _build_shell_command(
+        self, command: str, shell: Any
+    ) -> tuple[list[str] | str, str]:
+        requested = _normalize_shell(shell)
+        if requested == "auto":
+            if os.name != "nt":
+                return ["/bin/sh", "-c", command], "/bin/sh"
+            if shutil.which("pwsh") or shutil.which("powershell"):
+                requested = "powershell"
+            else:
+                requested = "cmd"
+
+        if requested == "powershell":
+            exe = shutil.which("pwsh") or shutil.which("powershell")
+            if exe is None:
+                raise ToolError(
+                    "PowerShell was not found on PATH. On Windows, retry with "
+                    "shell='cmd' or shell='auto'."
+                )
+            return [
+                exe,
+                "-NoLogo",
+                "-NoProfile",
+                "-NonInteractive",
+                "-Command",
+                "$ProgressPreference='SilentlyContinue'; "
+                "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8; " + command,
+            ], "PowerShell"
+
+        if requested == "cmd":
+            if os.name != "nt":
+                raise ToolError(
+                    "shell='cmd' is only available on Windows. Use shell='sh' "
+                    "or shell='bash'."
+                )
+            exe = os.environ.get("COMSPEC") or shutil.which("cmd.exe") or "cmd.exe"
+            # cmd.exe has its own quoting rules. Python's list-to-command-line
+            # conversion backslash-escapes inner quotes, which cmd prints
+            # literally, so build the command line ourselves.
+            return f'"{exe}" /d /s /c "{command}"', "cmd.exe"
+
+        if requested == "sh":
+            if os.name == "nt":
+                exe = shutil.which("sh")
+                if exe is None:
+                    raise ToolError(
+                        "No sh interpreter was found on PATH. On Windows, use "
+                        "shell='cmd' or shell='powershell'."
+                    )
+                return [exe, "-c", command], "sh"
+            return ["/bin/sh", "-c", command], "/bin/sh"
+
+        if requested == "bash":
+            exe = shutil.which("bash")
+            if exe is None:
+                raise ToolError("bash was not found on PATH. Use shell='sh' instead.")
+            return [exe, "-c", command], "bash"
+
+        raise ToolError(f"Unsupported shell: {requested}.")
+
     def _execute_shell_command(
         self,
         command: str,
@@ -832,25 +938,27 @@ class Toolbox:
         name: str,
         arguments: dict[str, Any],
     ) -> ToolResult:
-        if os.name == "nt":
-            pwsh = shutil.which("pwsh") or shutil.which("powershell")
-            if pwsh:
-                cmd = [
-                    pwsh,
-                    "-NoLogo",
-                    "-NoProfile",
-                    "-NonInteractive",
-                    "-Command",
-                    "$ProgressPreference='SilentlyContinue'; "
-                    "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8; " + command,
-                ]
-            else:
-                cmd = [os.environ.get("COMSPEC", "cmd.exe"), "/d", "/s", "/c", command]
-        else:
-            cmd = ["/bin/sh", "-c", command]
+        argv, shell_label = self._build_shell_command(command, "auto")
+        return self._run_shell_process(
+            argv,
+            timeout,
+            name=name,
+            arguments=arguments,
+            shell_label=shell_label,
+        )
+
+    def _run_shell_process(
+        self,
+        argv: list[str] | str,
+        timeout: int,
+        *,
+        name: str,
+        arguments: dict[str, Any],
+        shell_label: str,
+    ) -> ToolResult:
         try:
             proc = subprocess.run(
-                cmd,
+                argv,
                 cwd=str(self.root),
                 stdout=subprocess.PIPE,
                 stderr=subprocess.PIPE,
@@ -877,7 +985,10 @@ class Toolbox:
         if not combined:
             combined = "(no output)"
         ok = proc.returncode == 0
-        header = f"exit code {proc.returncode} (cwd {self._display(self.root) or '.'})"
+        header = (
+            f"exit code {proc.returncode} ({shell_label}, "
+            f"cwd {self._display(self.root) or '.'})"
+        )
         return ToolResult(
             name=name,
             arguments=arguments,

{dscli_agent-0.3.0 → dscli_agent-0.4.0}/dscli/tui.py

@@ -99,7 +99,9 @@ def _first_sentence(text: str) -> str:
 def _tool_target(name: str, args: dict | None, limit: int = 110) -> str:
     args = args or {}
     if name == "run_command":
-        return _shorten(str(args.get("command", "")), limit)
+        shell = str(args.get("shell") or "").strip()
+        prefix = f"{shell}: " if shell and shell.lower() != "auto" else ""
+        return _shorten(prefix + str(args.get("command", "")), limit)
     if name == "update_plan":
         steps = args.get("steps")
         count = len(steps) if isinstance(steps, list) else 0
@@ -297,8 +299,7 @@ class Tui:
             modes.append("search")
         if cfg.deeplanning:
             modes.append("deeplanning")
-        if cfg.allow_shell:
-            modes.append("shell allowed")
+        modes.append("shell allowed" if cfg.shell_enabled else "shell off")
         verify = cfg.verification_command()
         if verify:
             modes.append(f"verify: {_shorten(verify, 60)}")

{dscli_agent-0.3.0 → dscli_agent-0.4.0}/dscli_agent.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dscli-agent
-Version: 0.3.0
+Version: 0.4.0
 Summary: A local coding agent that uses DeepSeek web chat as its model
 Author: Anish
 License-Expression: MIT
@@ -262,8 +262,11 @@ dscli run "Refactor the parser" -f src/parser.py -f tests/test_parser.py
 # Globs work too; quote them so the shell does not expand them
 dscli run "Fix the bug" -f "src/**/*.py" --workspace C:\projects\app
 
-# Read a long task from a file; auto-approve edits; allow shell commands
-dscli run --prompt-file task.md -y --allow-shell
+# Read a long task from a file; auto-approve edits and approved shell commands
+dscli run --prompt-file task.md -y
+
+# Disable command execution entirely for this run
+dscli run "Review the docs" --no-shell
 ```
 
 The final answer is printed to stdout. Progress, diffs, and approval prompts go to
@@ -281,7 +284,7 @@ failures and unconfirmed completions are always logged to stderr, including unde
 | `-f, --file PATH` | Attach a file (repeatable, globs supported). |
 | `--workspace PATH` | Root the tools may touch. Defaults to the current directory. |
 | `-y, --yes` | Approve every write/patch/command without asking. |
-| `--allow-shell` | Enable `run_command` (still approved per command). |
+| `--no-shell` | Disable `run_command` for this run (commands are otherwise enabled and approved per command). |
 | `--allow-outside` | Let tools read/write outside the workspace. |
 | `--headed` / `--headless` | Show or hide the browser. Headless is the default. |
 | `--search` | Turn DeepSeek's Search mode on for the run (DeepThink is always on). |
@@ -355,12 +358,19 @@ creep and unnecessary abstractions, confirm hard-to-reverse actions, reference c
 | `apply_patch` | The only way to edit an existing file: exact `search` → `replace`. |
 | `list_files` | Bounded recursive listing. |
 | `delete_file` | Delete one file when explicitly requested (approval required). |
-| `run_command` | Run a shell command (only with `--allow-shell`, approval required). |
+| `run_command` | Run a command with an approval prompt via PowerShell, cmd.exe, sh, or bash. |
 | `update_plan` | Create or revise the task plan; the task cannot finish while steps are unfinished. |
 
 `apply_patch` normalises line endings for matching, preserves the file's encoding and
 line endings when writing, and refuses ambiguous matches unless `replace_all` is set.
 
+`run_command` uses `shell: auto` by default: PowerShell when available on Windows
+(cmd.exe otherwise), and `/bin/sh` elsewhere. Pass `"shell": "cmd"` for cmd.exe syntax
+such as `%VAR%` or batch builtins, `"powershell"`, `"sh"`, or `"bash"` to choose another
+interpreter. On POSIX systems, `auto` falls back to `/bin/sh`; `bash` is selected only
+when explicitly requested. The approval prompt names the resolved interpreter, so a
+command is never run under a shell you did not see.
+
 ### Plan and verification loop
 
 The agent can maintain a short task plan with `update_plan` (at most 20 steps). The run
@@ -386,7 +396,7 @@ message changed files. A verified result is still only as trustworthy as the com
 configured.
 
 The verification command is supplied by you and is never a model-callable tool. It is
-run without `--allow-shell` and without a per-command approval prompt because you
+run without a per-command approval prompt, even when `--no-shell` is set, because you
 configured it explicitly. Treat it like any other command you run from the shell: the
 model can modify the files it checks, so review the final diff.
 
@@ -396,14 +406,18 @@ model can modify the files it checks, so review the final diff.
 - `.git` is never writable through the tools.
 - Every write, patch, delete, and command shows a diff/command and asks
   `[y]es / [n]o / [a]ll / [q]uit` before changing anything. `-y` skips the prompts.
-- Shell access is off by default and can be enabled only for a run.
+- Command execution is enabled by default, but every model-requested command still
+  requires approval. The prompt names the interpreter (PowerShell, cmd.exe, sh, or
+  bash). `--no-shell` disables model-requested commands for a run.
 - The verification command is the one exception to the approval flow: when you configure
-  it with `--verify` or `verify_command`, dscli runs it automatically after edits without
-  `--allow-shell` or a prompt. The model can neither call nor change it.
+  it with `--verify` or `verify_command`, dscli runs it automatically after edits,
+  without a prompt and even when `--no-shell` is set. The model can neither call nor
+  change it.
 - Attachment contents, file contents, command output, and tool results are treated as
   untrusted data by the system prompt.
-- No network access is performed by the tools; the only network traffic is the browser
-  talking to DeepSeek.
+- The built-in file tools do not use the network. Approved commands can run any local
+  program, including network clients; dscli itself only talks to the chat provider
+  through the browser.
 
 This is still an assistant with write access to your files. Use a clean workspace or
 version control, and review diffs before approving them.
@@ -427,8 +441,9 @@ import), `chrome_profile` (empty = Chrome's last-used profile, or a name such as
 installed browser), `response_timeout_sec`, `first_response_timeout_sec`,
 `stable_seconds`, `fallback_stable_seconds`, `auto_human_check` (true = open a visible
 window to solve a verification check; false = fail fast), `max_steps`, `max_tool_calls`,
-`max_read_chars`, `max_attachment_mb`, `search`, `deeplanning`, `allow_shell`,
-`allow_outside`, `verify_command` (empty disables verification),
+`max_read_chars`, `max_attachment_mb`, `search`, `deeplanning`, `shell_enabled`
+(default true; every command still requires approval), `allow_outside`,
+`verify_command` (empty disables verification),
 `verify_timeout_sec` (clamped to 1–600, default 300).
 
 Headless Chrome normally sends a `HeadlessChrome/...` user agent, which DeepSeek's CDN

{dscli_agent-0.3.0 → dscli_agent-0.4.0}/tests/test_agent.py

@@ -501,7 +501,7 @@ class PlanAndVerificationTests(unittest.TestCase):
                 ),
                 envelope(final="done", complete=True),
             ],
-            config=Config(deeplanning=True, allow_shell=True),
+            config=Config(deeplanning=True, shell_enabled=True),
         )
         self.assertTrue(outcome.completed)
         self.assertTrue((self.workspace / "keep.txt").exists())

{dscli_agent-0.3.0 → dscli_agent-0.4.0}/tests/test_cli.py

@@ -212,9 +212,35 @@ class InteractiveChatTests(unittest.TestCase):
         self.assertEqual(run.task, ["do work"])
         self.assertTrue(run.allow_shell)
         self.assertTrue(run.dry_run)
+        self.assertIsNone(
+            build_parser().parse_args(["run", "do work"]).allow_shell
+        )
+        no_shell = build_parser().parse_args(["run", "do work", "--no-shell"])
+        self.assertFalse(no_shell.allow_shell)
+        with redirect_stderr(io.StringIO()), self.assertRaises(SystemExit):
+            build_parser().parse_args(
+                ["run", "do work", "--allow-shell", "--no-shell"]
+            )
         with redirect_stderr(io.StringIO()), self.assertRaises(SystemExit):
             build_parser().parse_args(["run", "do work", "--no-clear"])
 
+    def test_apply_shell_config_precedence(self) -> None:
+        parser = build_parser()
+        cfg = _apply_run_config(Config(), parser.parse_args(["run", "task"]))
+        self.assertTrue(cfg.shell_enabled)
+
+        cfg = _apply_run_config(
+            Config(shell_enabled=True),
+            parser.parse_args(["run", "task", "--no-shell"]),
+        )
+        self.assertFalse(cfg.shell_enabled)
+
+        cfg = _apply_run_config(
+            Config(shell_enabled=False),
+            parser.parse_args(["run", "task", "--allow-shell"]),
+        )
+        self.assertTrue(cfg.shell_enabled)
+
     def test_should_use_tui_respects_flags_and_environment(self) -> None:
         plain = build_parser().parse_args(["chat", "--plain"])
         self.assertFalse(_should_use_tui(plain))

{dscli_agent-0.3.0 → dscli_agent-0.4.0}/tests/test_config.py

@@ -33,6 +33,26 @@ class DeeplanningConfigTests(unittest.TestCase):
         self.assertTrue(cfg.deeplanning)
 
 
+class ShellConfigTests(unittest.TestCase):
+    def test_shell_is_enabled_by_default(self) -> None:
+        self.assertTrue(Config().shell_enabled)
+
+    def test_shell_enabled_loads_from_json(self) -> None:
+        with tempfile.TemporaryDirectory() as tmp:
+            path = Path(tmp) / "config.json"
+            path.write_text(json.dumps({"shell_enabled": False}), encoding="utf-8")
+            cfg = load_config(path)
+        self.assertFalse(cfg.shell_enabled)
+
+    def test_legacy_allow_shell_key_is_ignored(self) -> None:
+        with tempfile.TemporaryDirectory() as tmp:
+            path = Path(tmp) / "config.json"
+            path.write_text(json.dumps({"allow_shell": False}), encoding="utf-8")
+            cfg = load_config(path)
+        self.assertTrue(cfg.shell_enabled)
+        self.assertNotIn("allow_shell", cfg.to_dict())
+
+
 class SelectorTests(unittest.TestCase):
     def test_defaults_are_used(self) -> None:
         self.assertEqual(Config().merged_selectors(), dict(DEEPSEEK_SELECTORS))

{dscli_agent-0.3.0 → dscli_agent-0.4.0}/tests/test_tools.py

@@ -1,5 +1,7 @@
 from __future__ import annotations
 
+import os
+import shutil
 import tempfile
 import unittest
 from pathlib import Path
@@ -85,7 +87,12 @@ class ToolboxTests(unittest.TestCase):
         self.assertIn("outside the workspace", result.output)
 
     def test_shell_disabled(self) -> None:
-        result = self.execute("run_command", command="echo hi")
+        box = Toolbox(
+            self.root,
+            allow_shell=False,
+            confirm=lambda title, detail: True,
+        )
+        result = box.execute(call("run_command", command="echo hi"))
         self.assertFalse(result.ok)
         self.assertIn("disabled", result.output)
 
@@ -144,7 +151,7 @@ class PlanToolTests(unittest.TestCase):
         self.assertIn("cleared", result.output.lower())
 
     def test_update_plan_needs_no_confirmer_or_shell(self) -> None:
-        box = Toolbox(self.root)
+        box = Toolbox(self.root, allow_shell=False)
         result = box.execute(call("update_plan", steps=[{"text": "x"}]))
         self.assertTrue(result.ok, result.output)
         self.assertFalse(box.allow_shell)
@@ -193,6 +200,98 @@ class PlanToolTests(unittest.TestCase):
         self.assertEqual(self.box.changed_files, ["a.txt", "b.txt"])
 
 
+class CommandExecutionTests(unittest.TestCase):
+    def setUp(self) -> None:
+        self.tmp = tempfile.TemporaryDirectory()
+        self.root = Path(self.tmp.name)
+
+    def tearDown(self) -> None:
+        self.tmp.cleanup()
+
+    def test_shell_is_enabled_with_approval_by_default(self) -> None:
+        approvals: list[tuple[str, str | None]] = []
+
+        def confirm(title: str, detail: str | None) -> bool:
+            approvals.append((title, detail))
+            return True
+
+        box = Toolbox(self.root, confirm=confirm)
+        result = box.execute(call("run_command", command="echo shell-ok"))
+        self.assertTrue(result.ok, result.output)
+        self.assertIn("shell-ok", result.output)
+        self.assertEqual(len(approvals), 1)
+        title, detail = approvals[0]
+        self.assertEqual(detail, "echo shell-ok")
+        if os.name == "nt":
+            has_powershell = bool(
+                shutil.which("pwsh") or shutil.which("powershell")
+            )
+            expected_shell = "PowerShell" if has_powershell else "cmd.exe"
+        else:
+            expected_shell = "/bin/sh"
+        self.assertIn(expected_shell, title)
+
+    @unittest.skipUnless(os.name == "nt", "cmd.exe is Windows-only")
+    def test_cmd_shell_runs_through_cmd_exe(self) -> None:
+        approvals: list[tuple[str, str | None]] = []
+
+        def confirm(title: str, detail: str | None) -> bool:
+            approvals.append((title, detail))
+            return True
+
+        box = Toolbox(self.root, confirm=confirm)
+        result = box.execute(
+            call("run_command", command='echo "cmd-ok"', shell="cmd")
+        )
+        self.assertTrue(result.ok, result.output)
+        self.assertIn('"cmd-ok"', result.output)
+        self.assertNotIn('\\"cmd-ok\\"', result.output)
+        self.assertIn("cmd.exe", approvals[0][0])
+        self.assertIn("cmd.exe", result.output)
+
+    @unittest.skipUnless(os.name == "nt", "PowerShell is Windows-only here")
+    def test_powershell_can_be_requested_explicitly(self) -> None:
+        if not (shutil.which("pwsh") or shutil.which("powershell")):
+            self.skipTest("PowerShell is not installed")
+        approvals: list[str] = []
+        box = Toolbox(
+            self.root,
+            confirm=lambda title, detail: approvals.append(title) or True,
+        )
+        result = box.execute(
+            call(
+                "run_command",
+                command="Write-Output powershell-ok",
+                shell="powershell",
+            )
+        )
+        self.assertTrue(result.ok, result.output)
+        self.assertIn("powershell-ok", result.output)
+        self.assertIn("PowerShell", approvals[0])
+
+    def test_unknown_shell_is_rejected_without_approval(self) -> None:
+        approvals: list[str] = []
+        box = Toolbox(
+            self.root,
+            confirm=lambda title, detail: approvals.append(title) or True,
+        )
+        result = box.execute(
+            call("run_command", command="echo hi", shell="fish")
+        )
+        self.assertFalse(result.ok)
+        self.assertIn("Unknown shell", result.output)
+        self.assertEqual(approvals, [])
+
+    @unittest.skipIf(os.name == "nt", "cmd.exe is available on Windows")
+    def test_cmd_shell_is_rejected_off_windows(self) -> None:
+        box = Toolbox(self.root, confirm=lambda title, detail: True)
+        result = box.execute(
+            call("run_command", command="echo hi", shell="cmd")
+        )
+        self.assertFalse(result.ok)
+        self.assertIn("only available on Windows", result.output)
+
+
 class VerificationTests(unittest.TestCase):
     def setUp(self) -> None:
         self.tmp = tempfile.TemporaryDirectory()

{dscli_agent-0.3.0 → dscli_agent-0.4.0}/tests/test_tui.py

@@ -420,7 +420,7 @@ class TuiTests(unittest.TestCase):
         tui.banner(
             Config(
                 search=True,
-                allow_shell=True,
+                shell_enabled=True,
                 verify_command="pytest -q",
             )
         )
@@ -449,6 +449,13 @@ class TuiTests(unittest.TestCase):
         self.assertIn("search", text)
         self.assertIn("deeplanning", text)
 
+    def test_banner_reports_disabled_shell(self) -> None:
+        from dscli.config import Config
+
+        tui = self.make_tui()
+        tui.banner(Config(shell_enabled=False))
+        self.assertIn("shell off", self.output())
+
     def test_banner_clears_the_screen_by_default(self) -> None:
         tui = self.make_tui()
         from dscli.config import Config