dscli-agent 0.3.0__tar.gz → 0.5.0__tar.gz

{dscli_agent-0.3.0 → dscli_agent-0.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dscli-agent
-Version: 0.3.0
+Version: 0.5.0
 Summary: A local coding agent that uses DeepSeek web chat as its model
 Author: Anish
 License-Expression: MIT
@@ -147,11 +147,11 @@ it collapses to the same limited view with a `Ctrl+O` hint; press `Ctrl+O` at th
 prompt to print the full reasoning block (up to 500 rows) into the transcript.
 The streamed block is TUI-only; `--plain` and `run` do not show it.
 
-The prompt footer tracks session token usage against a 1,000,000-token budget, and the
-same progress bar renders below the live Thinking and Responding output:
+The prompt footer tracks the session's context volume against a 1,000,000-token budget,
+and the same progress bar renders below the live Thinking and Responding output:
 
 ```text
-  tokens ███████░░░░░ 612.4k / 1.0M · 61%
+  context ███████░░░░░ 612.4k / 1.0M · 61%
 ```
 
 Counts are estimated locally from every prompt sent and reply received (one token per
@@ -161,7 +161,7 @@ a new chat is opened.
 
 ### Conversation compaction
 
-When the estimate reaches 1,000,000 tokens, dscli compacts the session instead of
+When the count reaches 1,000,000 tokens, dscli compacts the session instead of
 stopping. Before the next prompt is sent it asks the current chat to write a structured
 compaction summary — an `<analysis>` pass followed by a `<summary>` covering the request,
 technical decisions, files and code, errors and fixes, user messages, pending tasks, and
@@ -179,7 +179,7 @@ Files are saved under `%APPDATA%\dscli\compactions` on Windows
 `~/.config/dscli/compactions` elsewhere) as `compaction-YYYYmmdd-HHMMSS.txt`. The check
 runs before every model turn, so it also works mid-task; the TUI shows a
 `Compacting conversation` spinner while the summary is written, then a
-`⟳ Compacted 1.0M tokens → … · new chat` notice. `/new` clears the recorded
+`⟳ Compacted context at 1.0M tokens → … · new chat` notice. `/new` clears the recorded
 conversation as well.
 
 ### Deeplanning mode
@@ -262,8 +262,11 @@ dscli run "Refactor the parser" -f src/parser.py -f tests/test_parser.py
 # Globs work too; quote them so the shell does not expand them
 dscli run "Fix the bug" -f "src/**/*.py" --workspace C:\projects\app
 
-# Read a long task from a file; auto-approve edits; allow shell commands
-dscli run --prompt-file task.md -y --allow-shell
+# Read a long task from a file; auto-approve edits and approved shell commands
+dscli run --prompt-file task.md -y
+
+# Disable command execution entirely for this run
+dscli run "Review the docs" --no-shell
 ```
 
 The final answer is printed to stdout. Progress, diffs, and approval prompts go to
@@ -281,7 +284,7 @@ failures and unconfirmed completions are always logged to stderr, including unde
 | `-f, --file PATH` | Attach a file (repeatable, globs supported). |
 | `--workspace PATH` | Root the tools may touch. Defaults to the current directory. |
 | `-y, --yes` | Approve every write/patch/command without asking. |
-| `--allow-shell` | Enable `run_command` (still approved per command). |
+| `--no-shell` | Disable `run_command` for this run (commands are otherwise enabled and approved per command). |
 | `--allow-outside` | Let tools read/write outside the workspace. |
 | `--headed` / `--headless` | Show or hide the browser. Headless is the default. |
 | `--search` | Turn DeepSeek's Search mode on for the run (DeepThink is always on). |
@@ -355,12 +358,19 @@ creep and unnecessary abstractions, confirm hard-to-reverse actions, reference c
 | `apply_patch` | The only way to edit an existing file: exact `search` → `replace`. |
 | `list_files` | Bounded recursive listing. |
 | `delete_file` | Delete one file when explicitly requested (approval required). |
-| `run_command` | Run a shell command (only with `--allow-shell`, approval required). |
+| `run_command` | Run a command with an approval prompt via PowerShell, cmd.exe, sh, or bash. |
 | `update_plan` | Create or revise the task plan; the task cannot finish while steps are unfinished. |
 
 `apply_patch` normalises line endings for matching, preserves the file's encoding and
 line endings when writing, and refuses ambiguous matches unless `replace_all` is set.
 
+`run_command` uses `shell: auto` by default: PowerShell when available on Windows
+(cmd.exe otherwise), and `/bin/sh` elsewhere. Pass `"shell": "cmd"` for cmd.exe syntax
+such as `%VAR%` or batch builtins, `"powershell"`, `"sh"`, or `"bash"` to choose another
+interpreter. On POSIX systems, `auto` falls back to `/bin/sh`; `bash` is selected only
+when explicitly requested. The approval prompt names the resolved interpreter, so a
+command is never run under a shell you did not see.
+
 ### Plan and verification loop
 
 The agent can maintain a short task plan with `update_plan` (at most 20 steps). The run
@@ -386,7 +396,7 @@ message changed files. A verified result is still only as trustworthy as the com
 configured.
 
 The verification command is supplied by you and is never a model-callable tool. It is
-run without `--allow-shell` and without a per-command approval prompt because you
+run without a per-command approval prompt, even when `--no-shell` is set, because you
 configured it explicitly. Treat it like any other command you run from the shell: the
 model can modify the files it checks, so review the final diff.
 
@@ -396,14 +406,18 @@ model can modify the files it checks, so review the final diff.
 - `.git` is never writable through the tools.
 - Every write, patch, delete, and command shows a diff/command and asks
   `[y]es / [n]o / [a]ll / [q]uit` before changing anything. `-y` skips the prompts.
-- Shell access is off by default and can be enabled only for a run.
+- Command execution is enabled by default, but every model-requested command still
+  requires approval. The prompt names the interpreter (PowerShell, cmd.exe, sh, or
+  bash). `--no-shell` disables model-requested commands for a run.
 - The verification command is the one exception to the approval flow: when you configure
-  it with `--verify` or `verify_command`, dscli runs it automatically after edits without
-  `--allow-shell` or a prompt. The model can neither call nor change it.
+  it with `--verify` or `verify_command`, dscli runs it automatically after edits,
+  without a prompt and even when `--no-shell` is set. The model can neither call nor
+  change it.
 - Attachment contents, file contents, command output, and tool results are treated as
   untrusted data by the system prompt.
-- No network access is performed by the tools; the only network traffic is the browser
-  talking to DeepSeek.
+- The built-in file tools do not use the network. Approved commands can run any local
+  program, including network clients; dscli itself only talks to the chat provider
+  through the browser.
 
 This is still an assistant with write access to your files. Use a clean workspace or
 version control, and review diffs before approving them.
@@ -425,10 +439,13 @@ Useful keys: `url` (the DeepSeek chat URL; set it only for a custom deployment),
 import), `chrome_profile` (empty = Chrome's last-used profile, or a name such as
 `Default` / `Profile 1`), `user_agent` (empty = derive a normal Chrome UA from the
 installed browser), `response_timeout_sec`, `first_response_timeout_sec`,
-`stable_seconds`, `fallback_stable_seconds`, `auto_human_check` (true = open a visible
+`stable_seconds`, `fallback_stable_seconds`, `activity_settle_seconds` (how long the
+page must stay free of DOM mutations before a reply counts as finished; default 1.5),
+`auto_human_check` (true = open a visible
 window to solve a verification check; false = fail fast), `max_steps`, `max_tool_calls`,
-`max_read_chars`, `max_attachment_mb`, `search`, `deeplanning`, `allow_shell`,
-`allow_outside`, `verify_command` (empty disables verification),
+`max_read_chars`, `max_attachment_mb`, `search`, `deeplanning`, `shell_enabled`
+(default true; every command still requires approval), `allow_outside`,
+`verify_command` (empty disables verification),
 `verify_timeout_sec` (clamped to 1–600, default 300).
 
 Headless Chrome normally sends a `HeadlessChrome/...` user agent, which DeepSeek's CDN
@@ -487,10 +504,11 @@ profile.
 may exceed the chat's limit, or the selector may have changed. Run `doctor` and check
 the reported counts.
 
-**A response is cut off around 12 s after the last text change.** DeepSeek did not
-show its completion toolbar (`Read aloud`), so dscli used the fallback completion
-detector. Increase `fallback_stable_seconds` if replies are still streaming at that
-point.
+**A response is cut off around 12 s after the last text change.** dscli normally waits
+for the reply text to stabilize while the page itself stops changing DOM nodes and
+text (`activity_settle_seconds`, default 1.5 s). If the page keeps mutating, the
+fallback detector returns the reply after `fallback_stable_seconds` of text stability.
+Increase `fallback_stable_seconds` if replies are still streaming at that point.
 
 **Chrome will not launch.** Set `"channel": ""` in the config to use Playwright's
 Chromium, after running `python -m playwright install chromium`.
@@ -507,7 +525,7 @@ Debug screenshots and unparsed replies are written to `%APPDATA%\dscli\debug`.
 - Streaming is approximated by polling the DOM, not by tokens from the model. The
   interactive chat streams a final answer as the page updates only after it declares
   `complete: true`; tool calls still wait for the complete, validated JSON envelope.
-  The token bar is likewise a local estimate of sent and received text, not usage
+  The context bar is likewise a local estimate of sent and received text, not usage
   reported by DeepSeek.
 - Interrupting with Ctrl+C clicks DeepSeek's labelled stop button when dscli can find
   it. If the page does not expose one, generation may continue in the web chat; the

{dscli_agent-0.3.0 → dscli_agent-0.5.0}/README.md

@@ -117,11 +117,11 @@ it collapses to the same limited view with a `Ctrl+O` hint; press `Ctrl+O` at th
 prompt to print the full reasoning block (up to 500 rows) into the transcript.
 The streamed block is TUI-only; `--plain` and `run` do not show it.
 
-The prompt footer tracks session token usage against a 1,000,000-token budget, and the
-same progress bar renders below the live Thinking and Responding output:
+The prompt footer tracks the session's context volume against a 1,000,000-token budget,
+and the same progress bar renders below the live Thinking and Responding output:
 
 ```text
-  tokens ███████░░░░░ 612.4k / 1.0M · 61%
+  context ███████░░░░░ 612.4k / 1.0M · 61%
 ```
 
 Counts are estimated locally from every prompt sent and reply received (one token per
@@ -131,7 +131,7 @@ a new chat is opened.
 
 ### Conversation compaction
 
-When the estimate reaches 1,000,000 tokens, dscli compacts the session instead of
+When the count reaches 1,000,000 tokens, dscli compacts the session instead of
 stopping. Before the next prompt is sent it asks the current chat to write a structured
 compaction summary — an `<analysis>` pass followed by a `<summary>` covering the request,
 technical decisions, files and code, errors and fixes, user messages, pending tasks, and
@@ -149,7 +149,7 @@ Files are saved under `%APPDATA%\dscli\compactions` on Windows
 `~/.config/dscli/compactions` elsewhere) as `compaction-YYYYmmdd-HHMMSS.txt`. The check
 runs before every model turn, so it also works mid-task; the TUI shows a
 `Compacting conversation` spinner while the summary is written, then a
-`⟳ Compacted 1.0M tokens → … · new chat` notice. `/new` clears the recorded
+`⟳ Compacted context at 1.0M tokens → … · new chat` notice. `/new` clears the recorded
 conversation as well.
 
 ### Deeplanning mode
@@ -232,8 +232,11 @@ dscli run "Refactor the parser" -f src/parser.py -f tests/test_parser.py
 # Globs work too; quote them so the shell does not expand them
 dscli run "Fix the bug" -f "src/**/*.py" --workspace C:\projects\app
 
-# Read a long task from a file; auto-approve edits; allow shell commands
-dscli run --prompt-file task.md -y --allow-shell
+# Read a long task from a file; auto-approve edits and approved shell commands
+dscli run --prompt-file task.md -y
+
+# Disable command execution entirely for this run
+dscli run "Review the docs" --no-shell
 ```
 
 The final answer is printed to stdout. Progress, diffs, and approval prompts go to
@@ -251,7 +254,7 @@ failures and unconfirmed completions are always logged to stderr, including unde
 | `-f, --file PATH` | Attach a file (repeatable, globs supported). |
 | `--workspace PATH` | Root the tools may touch. Defaults to the current directory. |
 | `-y, --yes` | Approve every write/patch/command without asking. |
-| `--allow-shell` | Enable `run_command` (still approved per command). |
+| `--no-shell` | Disable `run_command` for this run (commands are otherwise enabled and approved per command). |
 | `--allow-outside` | Let tools read/write outside the workspace. |
 | `--headed` / `--headless` | Show or hide the browser. Headless is the default. |
 | `--search` | Turn DeepSeek's Search mode on for the run (DeepThink is always on). |
@@ -325,12 +328,19 @@ creep and unnecessary abstractions, confirm hard-to-reverse actions, reference c
 | `apply_patch` | The only way to edit an existing file: exact `search` → `replace`. |
 | `list_files` | Bounded recursive listing. |
 | `delete_file` | Delete one file when explicitly requested (approval required). |
-| `run_command` | Run a shell command (only with `--allow-shell`, approval required). |
+| `run_command` | Run a command with an approval prompt via PowerShell, cmd.exe, sh, or bash. |
 | `update_plan` | Create or revise the task plan; the task cannot finish while steps are unfinished. |
 
 `apply_patch` normalises line endings for matching, preserves the file's encoding and
 line endings when writing, and refuses ambiguous matches unless `replace_all` is set.
 
+`run_command` uses `shell: auto` by default: PowerShell when available on Windows
+(cmd.exe otherwise), and `/bin/sh` elsewhere. Pass `"shell": "cmd"` for cmd.exe syntax
+such as `%VAR%` or batch builtins, `"powershell"`, `"sh"`, or `"bash"` to choose another
+interpreter. On POSIX systems, `auto` falls back to `/bin/sh`; `bash` is selected only
+when explicitly requested. The approval prompt names the resolved interpreter, so a
+command is never run under a shell you did not see.
+
 ### Plan and verification loop
 
 The agent can maintain a short task plan with `update_plan` (at most 20 steps). The run
@@ -356,7 +366,7 @@ message changed files. A verified result is still only as trustworthy as the com
 configured.
 
 The verification command is supplied by you and is never a model-callable tool. It is
-run without `--allow-shell` and without a per-command approval prompt because you
+run without a per-command approval prompt, even when `--no-shell` is set, because you
 configured it explicitly. Treat it like any other command you run from the shell: the
 model can modify the files it checks, so review the final diff.
 
@@ -366,14 +376,18 @@ model can modify the files it checks, so review the final diff.
 - `.git` is never writable through the tools.
 - Every write, patch, delete, and command shows a diff/command and asks
   `[y]es / [n]o / [a]ll / [q]uit` before changing anything. `-y` skips the prompts.
-- Shell access is off by default and can be enabled only for a run.
+- Command execution is enabled by default, but every model-requested command still
+  requires approval. The prompt names the interpreter (PowerShell, cmd.exe, sh, or
+  bash). `--no-shell` disables model-requested commands for a run.
 - The verification command is the one exception to the approval flow: when you configure
-  it with `--verify` or `verify_command`, dscli runs it automatically after edits without
-  `--allow-shell` or a prompt. The model can neither call nor change it.
+  it with `--verify` or `verify_command`, dscli runs it automatically after edits,
+  without a prompt and even when `--no-shell` is set. The model can neither call nor
+  change it.
 - Attachment contents, file contents, command output, and tool results are treated as
   untrusted data by the system prompt.
-- No network access is performed by the tools; the only network traffic is the browser
-  talking to DeepSeek.
+- The built-in file tools do not use the network. Approved commands can run any local
+  program, including network clients; dscli itself only talks to the chat provider
+  through the browser.
 
 This is still an assistant with write access to your files. Use a clean workspace or
 version control, and review diffs before approving them.
@@ -395,10 +409,13 @@ Useful keys: `url` (the DeepSeek chat URL; set it only for a custom deployment),
 import), `chrome_profile` (empty = Chrome's last-used profile, or a name such as
 `Default` / `Profile 1`), `user_agent` (empty = derive a normal Chrome UA from the
 installed browser), `response_timeout_sec`, `first_response_timeout_sec`,
-`stable_seconds`, `fallback_stable_seconds`, `auto_human_check` (true = open a visible
+`stable_seconds`, `fallback_stable_seconds`, `activity_settle_seconds` (how long the
+page must stay free of DOM mutations before a reply counts as finished; default 1.5),
+`auto_human_check` (true = open a visible
 window to solve a verification check; false = fail fast), `max_steps`, `max_tool_calls`,
-`max_read_chars`, `max_attachment_mb`, `search`, `deeplanning`, `allow_shell`,
-`allow_outside`, `verify_command` (empty disables verification),
+`max_read_chars`, `max_attachment_mb`, `search`, `deeplanning`, `shell_enabled`
+(default true; every command still requires approval), `allow_outside`,
+`verify_command` (empty disables verification),
 `verify_timeout_sec` (clamped to 1–600, default 300).
 
 Headless Chrome normally sends a `HeadlessChrome/...` user agent, which DeepSeek's CDN
@@ -457,10 +474,11 @@ profile.
 may exceed the chat's limit, or the selector may have changed. Run `doctor` and check
 the reported counts.
 
-**A response is cut off around 12 s after the last text change.** DeepSeek did not
-show its completion toolbar (`Read aloud`), so dscli used the fallback completion
-detector. Increase `fallback_stable_seconds` if replies are still streaming at that
-point.
+**A response is cut off around 12 s after the last text change.** dscli normally waits
+for the reply text to stabilize while the page itself stops changing DOM nodes and
+text (`activity_settle_seconds`, default 1.5 s). If the page keeps mutating, the
+fallback detector returns the reply after `fallback_stable_seconds` of text stability.
+Increase `fallback_stable_seconds` if replies are still streaming at that point.
 
 **Chrome will not launch.** Set `"channel": ""` in the config to use Playwright's
 Chromium, after running `python -m playwright install chromium`.
@@ -477,7 +495,7 @@ Debug screenshots and unparsed replies are written to `%APPDATA%\dscli\debug`.
 - Streaming is approximated by polling the DOM, not by tokens from the model. The
   interactive chat streams a final answer as the page updates only after it declares
   `complete: true`; tool calls still wait for the complete, validated JSON envelope.
-  The token bar is likewise a local estimate of sent and received text, not usage
+  The context bar is likewise a local estimate of sent and received text, not usage
   reported by DeepSeek.
 - Interrupting with Ctrl+C clicks DeepSeek's labelled stop button when dscli can find
   it. If the page does not expose one, generation may continue in the web chat; the

{dscli_agent-0.3.0 → dscli_agent-0.5.0}/dscli/__init__.py

@@ -1,3 +1,3 @@
 """dscli - a local coding agent for your terminal."""
 
-__version__ = "0.3.0"
+__version__ = "0.5.0"

{dscli_agent-0.3.0 → dscli_agent-0.5.0}/dscli/agent.py

@@ -2,6 +2,7 @@ from __future__ import annotations
 
 import json
 import logging
+import secrets
 import time
 from dataclasses import dataclass, field
 from pathlib import Path
@@ -23,7 +24,7 @@ from .prompts import (
 )
 from .protocol import ProtocolError, Step, ToolCall, extract_final_prefix, parse_step
 from .providers import MODEL_NAME
-from .tokens import MAX_TOKENS, format_tokens
+from .tokens import MAX_CONTEXT_TOKENS, format_tokens
 from .tools import (
     ApprovalRequired,
     PlanStep,
@@ -102,11 +103,12 @@ class Agent:
         self._verify_timeout = config.verification_timeout()
         self._sent_any = False
         self._previous_plan: list[PlanStep] = []
+        self.turn_id = ""
 
-    def _token_budget_reached(self) -> bool:
-        used = getattr(self.session, "tokens_used", 0)
+    def _context_budget_reached(self) -> bool:
+        used = getattr(self.session, "context_tokens", 0)
         try:
-            return int(used or 0) >= MAX_TOKENS
+            return int(used or 0) >= MAX_CONTEXT_TOKENS
         except (TypeError, ValueError):
             return False
 
@@ -144,9 +146,9 @@ class Agent:
         *,
         wrapup: bool,
     ) -> tuple[str, list[Path] | None]:
-        if not self._token_budget_reached():
+        if not self._context_budget_reached():
             return message, files
-        used = int(getattr(self.session, "tokens_used", 0) or 0)
+        used = int(getattr(self.session, "context_tokens", 0) or 0)
         plan = self.toolbox.plan if self._sent_any else self._previous_plan
         tree = project_structure(self.workspace)
         summary = self._request_compaction_summary(plan)
@@ -157,20 +159,20 @@ class Agent:
             plan=plan,
             changed=self.toolbox.changed_files,
             verification=self._verification_summary(),
-            tokens_used=used,
+            context_tokens=used,
             project_tree=tree,
             summary=summary,
         )
         self.session.new_chat()
         self.display.compaction_started(str(compaction.path), used)
         log.warning(
-            "Token estimate reached %s. Compacted the conversation to %s and started "
+            "Context estimate reached %s. Compacted the conversation to %s and started "
             "a new chat.",
             format_tokens(used),
             compaction.path,
         )
         self.history.add_note(
-            f"Compacted at {used:,} estimated tokens into {compaction.path.name}; "
+            f"Compacted at {used:,} estimated context tokens into {compaction.path.name}; "
             "a new chat was started."
         )
         resume = build_resume_prompt(
@@ -182,7 +184,7 @@ class Agent:
             live_plan=self.toolbox.plan,
             changed=self.toolbox.changed_files,
             attachments=self.attachments,
-            allow_shell=self.cfg.allow_shell,
+            allow_shell=self.cfg.shell_enabled,
             allow_outside=self.cfg.allow_outside,
             max_steps=self.cfg.max_steps,
             verify_command=self._verify_command,
@@ -190,6 +192,7 @@ class Agent:
             wrapup=wrapup,
             deeplanning=self.cfg.deeplanning,
             max_tool_calls=self.cfg.max_tool_calls,
+            turn_id=self.turn_id,
         )
         attachments = [compaction.path]
         for attachment in self.attachments:
@@ -221,7 +224,7 @@ class Agent:
 
         def on_reply_snapshot(raw: str) -> None:
             nonlocal last_final
-            final = extract_final_prefix(raw)
+            final = extract_final_prefix(raw, turn_id=self.turn_id or None)
             if final is not None and final != last_final:
                 last_final = final
                 if not self._streamed_final:
@@ -251,7 +254,25 @@ class Agent:
             ),
         )
 
+    def _turn_id_error(self, step: Step) -> str | None:
+        if not self.turn_id:
+            return None
+        if step.turn_id is None:
+            return (
+                "The envelope is missing the required turn_id field. Every reply to this "
+                f'message must include "turn_id":"{self.turn_id}".'
+            )
+        if step.turn_id != self.turn_id:
+            return (
+                f"The envelope's turn_id {step.turn_id!r} does not match the current "
+                f"message's turn id {self.turn_id!r}. It looks like text from an earlier "
+                "message, so it was not executed. Answer the current message and include "
+                f'"turn_id":"{self.turn_id}".'
+            )
+        return None
+
     def run(self) -> AgentOutcome:
+        self.turn_id = secrets.token_hex(4)
         self._previous_plan = [
             step for step in self.toolbox.plan if step.status != "completed"
         ]
@@ -267,6 +288,7 @@ class Agent:
         if self.followup:
             initial = build_followup_prompt(
                 self.task,
+                turn_id=self.turn_id,
                 verify_command=self._verify_command,
                 deeplanning=self.cfg.deeplanning,
                 max_tool_calls=self.cfg.max_tool_calls,
@@ -277,12 +299,13 @@ class Agent:
                 workspace=self.workspace,
                 attachments=self.attachments,
                 workspace_tree=workspace_preview(self.workspace),
-                allow_shell=self.cfg.allow_shell,
+                allow_shell=self.cfg.shell_enabled,
                 allow_outside=self.cfg.allow_outside,
                 max_steps=self.cfg.max_steps,
                 verify_command=self._verify_command,
                 deeplanning=self.cfg.deeplanning,
                 max_tool_calls=self.cfg.max_tool_calls,
+                turn_id=self.turn_id,
             )
         if len(initial) > 80000:
             raise ValueError(
@@ -330,7 +353,32 @@ class Agent:
                 if turn >= self.cfg.max_steps:
                     return self._wrap_up(turn, last_reply or str(exc))
                 message = build_protocol_repair(
-                    str(exc), task=self.task, step=turn, max_steps=self.cfg.max_steps
+                    str(exc),
+                    task=self.task,
+                    step=turn,
+                    max_steps=self.cfg.max_steps,
+                    turn_id=self.turn_id,
+                )
+                continue
+
+            turn_error = self._turn_id_error(step)
+            if turn_error is not None:
+                protocol_failures += 1
+                self.session.save_last_response(last_reply, "turn-id-error")
+                if protocol_failures > self.cfg.max_protocol_retries:
+                    raise ProtocolError(
+                        f"{turn_error} The raw reply was saved to the dscli debug directory.",
+                        last_reply,
+                    )
+                self.display.protocol_error(turn_error)
+                if turn >= self.cfg.max_steps:
+                    return self._wrap_up(turn, last_reply)
+                message = build_protocol_repair(
+                    turn_error,
+                    task=self.task,
+                    step=turn,
+                    max_steps=self.cfg.max_steps,
+                    turn_id=self.turn_id,
                 )
                 continue
 
@@ -378,6 +426,7 @@ class Agent:
                     task=self.task,
                     step=turn,
                     max_steps=self.cfg.max_steps,
+                    turn_id=self.turn_id,
                 )
                 continue
 
@@ -468,7 +517,7 @@ class Agent:
             step=turn,
             max_steps=self.cfg.max_steps,
             changed=self.toolbox.changed_files,
-            allow_shell=self.cfg.allow_shell,
+            allow_shell=self.cfg.shell_enabled,
             per_result_chars=self.cfg.max_tool_output_chars,
             total_chars=self.cfg.max_turn_output_chars,
             notice=notice,
@@ -476,6 +525,7 @@ class Agent:
             verify_command=self._verify_command,
             deeplanning=self.cfg.deeplanning,
             max_tool_calls=self.cfg.max_tool_calls,
+            turn_id=self.turn_id,
         )
 
     def _completion_reminder_message(
@@ -594,6 +644,7 @@ class Agent:
             step=turn,
             plan=self.toolbox.plan,
             verify_command=self._verify_command,
+            turn_id=self.turn_id,
         )
         self.display.wrapup_started()
         reply = self._send_and_wait(prompt, stream_final=False, wrapup=True)
@@ -611,13 +662,20 @@ class Agent:
                 limit_reached=True,
                 plan_incomplete=plan_incomplete,
             )
-        if step.final is not None:
+        turn_error = self._turn_id_error(step)
+        if turn_error is not None:
+            self.session.save_last_response(reply, "wrapup-turn-id-error")
+            log.warning("The wrap-up reply failed the turn-id check; showing the raw text.")
+            final = reply.strip() or "Stopped: the model-turn budget was exhausted."
+        elif step.final is not None:
             final = (step.final or "").strip() or "Stopped: the model-turn budget was exhausted."
         else:
             self.session.save_last_response(reply, "wrapup-with-tools")
             final = reply.strip() or "Stopped: the model-turn budget was exhausted."
         plan_incomplete = self.toolbox.plan_has_pending()
-        completed = step.complete is True and not plan_incomplete
+        completed = (
+            turn_error is None and step.complete is True and not plan_incomplete
+        )
         self._verify_if_needed()
         return self._outcome(
             final,