@aiwg/cli 2026.8.15 → 2026.8.17

package/dist/src/artifacts/browser-export.js

@@ -454,6 +454,7 @@ function recordForEntry(cwd, entry, graphName, dependencyGraph, privacy, schemaV
                         ...(entry.searchTerms?.length
                             ? { aiwg_search_terms: uniqueSorted(entry.searchTerms) }
                             : {}),
+                        ...(entry.script ? { aiwg_script: entry.script } : {}),
                     },
                 },
             }

package/dist/src/artifacts/cli.js

@@ -494,7 +494,7 @@ async function handleBuild(args) {
         console.log('');
         console.log('Default behavior (no --graph): builds all graphs with defaultBuild: true');
         console.log('Multi-graph builds run by buildOrder/buildTier (refs → citations → bibliography before heavy graphs)');
-        console.log('  Built-in defaults: project (always), codebase (skipped if src/test/tools absent)');
+        console.log('  Built-in defaults: project (always), codebase (auto-detects JavaScript/TypeScript and Python layouts)');
         console.log('');
         console.log('Examples:');
         console.log('  aiwg index build');

package/dist/src/artifacts/fortemi-core-query-adapter.js

@@ -210,6 +210,7 @@ function artifactTypeFromRecord(record) {
 function entryFromRecord(record) {
     const indexedFrontmatter = record.search?.frontmatter ?? {};
     const indexedSearchTerms = indexedFrontmatter.aiwg_search_terms;
+    const indexedScript = indexedFrontmatter.aiwg_script;
     return {
         path: record.source.path,
         type: artifactTypeFromRecord(record),
@@ -245,6 +246,11 @@ function entryFromRecord(record) {
         kernel: typeof record.search?.frontmatter?.kernel === "boolean"
             ? record.search.frontmatter.kernel
             : undefined,
+        script: indexedScript && typeof indexedScript === "object"
+            && typeof indexedScript.entrypoint === "string"
+            && typeof indexedScript.runtime === "string"
+            ? indexedScript
+            : undefined,
         operationalState: record.operational_state,
     };
 }

package/dist/src/artifacts/index-builder.js

@@ -17,30 +17,10 @@ import { DEFAULT_INDEX_EXTENSIONS, INDEX_EXTRACTOR_VERSION, INDEX_VERSION, INDEX
 import { parseCitationSidecar, citationResultToEdges, buildRefToPathMap } from './citation-parser.js';
 import { writeIndexFile, resolveIndexDir, loadGraphIndexFile } from './index-reader.js';
 import { loadManifest, writeManifest, statMatches, makeEntry } from './checksum-manifest.js';
-import { workspaceLinkedFiles } from '../smiths/context-pipeline/workspace-context.js';
 import { normalizeOperationalState } from './operational-state.js';
 import { DEFAULT_PROJECT_AIWG_DIR, resolveProjectAiwgDir, } from '../config/project-artifacts.js';
 import { normalizeStateTransferProjection } from './state-transfer.js';
-function pathContains(parent, child) {
-    const relative = path.relative(parent, child);
-    return relative === '' || (!relative.startsWith('..') && !path.isAbsolute(relative));
-}
-function toPosixPath(value) {
-    return value.split(path.sep).join('/');
-}
-function indexPathFor(cwd, fullPath, graph) {
-    if (!graph || graph === 'project') {
-        const artifactRoot = resolveProjectAiwgDir(cwd);
-        if (pathContains(artifactRoot, fullPath)) {
-            const relative = toPosixPath(path.relative(artifactRoot, fullPath));
-            return relative ? `${DEFAULT_PROJECT_AIWG_DIR}/${relative}` : DEFAULT_PROJECT_AIWG_DIR;
-        }
-    }
-    const rel = path.relative(cwd, fullPath);
-    if (!rel.startsWith('..') && !path.isAbsolute(rel))
-        return toPosixPath(rel);
-    return fullPath;
-}
+import { collectGraphIndexFiles, findArtifactFiles, indexPathFor } from './index-files.js';
 function absoluteEntryPath(cwd, entryPath, graph) {
     if ((!graph || graph === 'project') && entryPath.startsWith(`${DEFAULT_PROJECT_AIWG_DIR}/`)) {
         return path.join(resolveProjectAiwgDir(cwd), entryPath.slice(DEFAULT_PROJECT_AIWG_DIR.length + 1));
@@ -587,31 +567,6 @@ function applyMetadataSupplements(entries, supplements, cwd) {
         }
     }
 }
-/**
- * Recursively find all indexable files under a directory
- */
-function findArtifactFiles(dir, extensions = [...DEFAULT_INDEX_EXTENSIONS]) {
-    const results = [];
-    if (!fs.existsSync(dir))
-        return results;
-    const entries = fs.readdirSync(dir, { withFileTypes: true });
-    for (const entry of entries) {
-        const fullPath = path.join(dir, entry.name);
-        if (entry.isSymbolicLink() && !fs.existsSync(fullPath)) {
-            continue;
-        }
-        if (entry.isDirectory()) {
-            // Skip hidden dirs and .index
-            if (entry.name.startsWith('.'))
-                continue;
-            results.push(...findArtifactFiles(fullPath, extensions));
-        }
-        else if (extensions.some(ext => entry.name.endsWith(ext))) {
-            results.push(fullPath);
-        }
-    }
-    return results;
-}
 /**
  * Build the artifact index
  */
@@ -798,24 +753,9 @@ export async function buildIndex(cwd, options = {}) {
         pruned: 0,
     };
     // Collect files from all scan directories
-    const files = [];
-    for (const dir of existingDirs) {
-        files.push(...findArtifactFiles(dir, fileExtensions));
-    }
-    // WORKSPACE.md is the root of the project context graph. Index it and its
-    // local Markdown-linked nodes without copying them into provider trees.
-    if (!scope && (!graph || graph === 'project')) {
-        const workspacePath = path.join(cwd, 'WORKSPACE.md');
-        const contextFiles = [
-            ...(fs.existsSync(workspacePath) ? [workspacePath] : []),
-            ...await workspaceLinkedFiles(cwd),
-        ];
-        for (const contextFile of contextFiles) {
-            if (fileExtensions.some((extension) => contextFile.endsWith(extension)) && !files.includes(contextFile)) {
-                files.push(contextFile);
-            }
-        }
-    }
+    const files = scope
+        ? existingDirs.flatMap(dir => findArtifactFiles(dir, fileExtensions))
+        : await collectGraphIndexFiles(cwd, graph);
     const entries = {};
     const tagIndex = {};
     const depGraph = {};

package/dist/src/artifacts/index-files.js

@@ -0,0 +1,80 @@
+/**
+ * Shared artifact source-file enumeration.
+ *
+ * Index builds and coverage reporting must use the same file set so project
+ * context files cannot inflate the indexed count beyond the reported total.
+ *
+ * @implements jmagly/aiwg#146
+ */
+import fs from 'fs';
+import path from 'path';
+import { DEFAULT_INDEX_EXTENSIONS, GRAPH_CONFIGS, resolveGraphScanDir, } from './types.js';
+import { DEFAULT_PROJECT_AIWG_DIR, resolveProjectAiwgDir, } from '../config/project-artifacts.js';
+import { workspaceLinkedFiles } from '../smiths/context-pipeline/workspace-context.js';
+function pathContains(parent, child) {
+    const relative = path.relative(parent, child);
+    return relative === '' || (!relative.startsWith('..') && !path.isAbsolute(relative));
+}
+function toPosixPath(value) {
+    return value.split(path.sep).join('/');
+}
+export function indexPathFor(cwd, fullPath, graph) {
+    if (!graph || graph === 'project') {
+        const artifactRoot = resolveProjectAiwgDir(cwd);
+        if (pathContains(artifactRoot, fullPath)) {
+            const relative = toPosixPath(path.relative(artifactRoot, fullPath));
+            return relative ? `${DEFAULT_PROJECT_AIWG_DIR}/${relative}` : DEFAULT_PROJECT_AIWG_DIR;
+        }
+    }
+    const relative = path.relative(cwd, fullPath);
+    if (!relative.startsWith('..') && !path.isAbsolute(relative))
+        return toPosixPath(relative);
+    return fullPath;
+}
+/** Recursively find indexable files, excluding hidden directories such as .index. */
+export function findArtifactFiles(dir, extensions = DEFAULT_INDEX_EXTENSIONS) {
+    const results = [];
+    if (!fs.existsSync(dir))
+        return results;
+    const entries = fs.readdirSync(dir, { withFileTypes: true });
+    for (const entry of entries) {
+        const fullPath = path.join(dir, entry.name);
+        if (entry.isSymbolicLink() && !fs.existsSync(fullPath))
+            continue;
+        if (entry.isDirectory()) {
+            if (entry.name.startsWith('.'))
+                continue;
+            results.push(...findArtifactFiles(fullPath, extensions));
+        }
+        else if (extensions.some(extension => entry.name.endsWith(extension))) {
+            results.push(fullPath);
+        }
+    }
+    return results;
+}
+/** Return the exact current source-file set used by a standard graph build. */
+export async function collectGraphIndexFiles(cwd, graph) {
+    const config = graph ? GRAPH_CONFIGS[graph] : undefined;
+    const scanDirs = config
+        ? config.scanDirs.map(directory => resolveGraphScanDir(cwd, directory))
+        : [resolveProjectAiwgDir(cwd)];
+    const extensions = config?.extensions ?? [...DEFAULT_INDEX_EXTENSIONS];
+    const files = new Set();
+    for (const scanDir of scanDirs) {
+        for (const file of findArtifactFiles(scanDir, extensions))
+            files.add(file);
+    }
+    if (!graph || graph === 'project') {
+        const workspacePath = path.join(cwd, 'WORKSPACE.md');
+        const contextFiles = [
+            ...(fs.existsSync(workspacePath) ? [workspacePath] : []),
+            ...await workspaceLinkedFiles(cwd),
+        ];
+        for (const contextFile of contextFiles) {
+            if (extensions.some(extension => contextFile.endsWith(extension)))
+                files.add(contextFile);
+        }
+    }
+    return [...files];
+}
+//# sourceMappingURL=index-files.js.map

package/dist/src/artifacts/stats.js

@@ -7,40 +7,23 @@
  * @source @src/artifacts/types.ts
  * @tests @test/unit/artifacts/stats.test.ts
  */
-import fs from 'fs';
-import path from 'path';
-import { GRAPH_CONFIGS, loadUserGraphConfigs, resolveGraphScanDir } from './types.js';
+import { GRAPH_CONFIGS, loadUserGraphConfigs } from './types.js';
 import { loadIndexStats, loadGraphIndexFile } from './index-reader.js';
-/**
- * Count total indexable files under scan directories (excluding .index/)
- */
-function countArtifactFiles(cwd, graphType) {
-    const config = graphType ? GRAPH_CONFIGS[graphType] : undefined;
-    const scanDirs = config
-        ? config.scanDirs.map(d => resolveGraphScanDir(cwd, d))
-        : [resolveGraphScanDir(cwd, '.aiwg')];
-    const extensions = config?.extensions ?? ['.md', '.yaml', '.json'];
-    let count = 0;
-    function walk(dir) {
-        if (!fs.existsSync(dir))
-            return;
-        const entries = fs.readdirSync(dir, { withFileTypes: true });
-        for (const entry of entries) {
-            const full = path.join(dir, entry.name);
-            if (entry.isDirectory()) {
-                if (entry.name.startsWith('.'))
-                    continue; // Skip .index, etc.
-                walk(full);
-            }
-            else if (extensions.some(ext => entry.name.endsWith(ext))) {
-                count++;
-            }
-        }
-    }
-    for (const dir of scanDirs) {
-        walk(dir);
-    }
-    return count;
+import { collectGraphIndexFiles, indexPathFor } from './index-files.js';
+/** Calculate coverage over the same current file set used by the index builder. */
+async function calculateCoverage(cwd, stats, graphType) {
+    const sourcePaths = new Set((await collectGraphIndexFiles(cwd, graphType))
+        .map(file => indexPathFor(cwd, file, graphType)));
+    const index = loadGraphIndexFile(cwd, 'metadata.json', graphType);
+    const indexed = index
+        ? Object.keys(index.entries).filter(entryPath => sourcePaths.has(entryPath)).length
+        : Math.min(stats.totalArtifacts, sourcePaths.size);
+    const totalFiles = sourcePaths.size;
+    return {
+        indexed,
+        totalFiles,
+        percentage: totalFiles > 0 ? Math.round((indexed / totalFiles) * 100) : 100,
+    };
 }
 /**
  * Show artifact index statistics
@@ -84,14 +67,10 @@ export async function showStats(cwd, options = {}) {
         // JSON mode: aggregate all graphs into one response
         const combined = {};
         for (const { type, stats: s } of availableGraphs) {
-            const totalFiles = countArtifactFiles(cwd, type);
+            const coverage = await calculateCoverage(cwd, s, type);
             combined[type] = {
                 ...s,
-                coverage: {
-                    indexed: s.totalArtifacts,
-                    totalFiles,
-                    percentage: totalFiles > 0 ? Math.round((s.totalArtifacts / totalFiles) * 100) : 100,
-                },
+                coverage,
             };
         }
         console.log(JSON.stringify(combined, null, 2));
@@ -108,14 +87,10 @@ export async function showStats(cwd, options = {}) {
  */
 async function renderStats(cwd, stats, options, graphType) {
     if (options.json) {
-        const totalFiles = countArtifactFiles(cwd, graphType);
+        const coverage = await calculateCoverage(cwd, stats, graphType);
         console.log(JSON.stringify({
             ...stats,
-            coverage: {
-                indexed: stats.totalArtifacts,
-                totalFiles,
-                percentage: totalFiles > 0 ? Math.round((stats.totalArtifacts / totalFiles) * 100) : 100,
-            },
+            coverage,
         }, null, 2));
         return;
     }
@@ -167,11 +142,8 @@ async function renderStats(cwd, stats, options, graphType) {
     }
     console.log('');
     // Coverage
-    const totalFiles = countArtifactFiles(cwd, graphType);
-    const coverage = totalFiles > 0
-        ? Math.round((stats.totalArtifacts / totalFiles) * 100)
-        : 100;
+    const coverage = await calculateCoverage(cwd, stats, graphType);
     console.log('Index Health:');
-    console.log(`  Coverage: ${stats.totalArtifacts}/${totalFiles} artifacts indexed (${coverage}%)`);
+    console.log(`  Coverage: ${coverage.indexed}/${coverage.totalFiles} artifacts indexed (${coverage.percentage}%)`);
 }
 //# sourceMappingURL=stats.js.map

package/dist/src/artifacts/types.js

@@ -195,6 +195,60 @@ export const BUILTIN_GRAPH_CONFIGS = {
  * @implements #426
  */
 export const GRAPH_CONFIGS = { ...BUILTIN_GRAPH_CONFIGS };
+function freshBuiltinGraphConfig(name) {
+    const config = BUILTIN_GRAPH_CONFIGS[name];
+    return {
+        ...config,
+        scanDirs: [...config.scanDirs],
+        extensions: [...config.extensions],
+    };
+}
+/**
+ * Detect conventional Python layouts without treating every top-level folder
+ * as source. A Python project manifest activates `.py`/`.pyi` support; package
+ * roots are immediate directories containing `__init__.py`, plus the common
+ * `tests/` and `scripts/` roots when present.
+ */
+function detectPythonCodebaseConfig(cwd, base) {
+    const hasPythonManifest = ['pyproject.toml', 'setup.py', 'setup.cfg']
+        .some((manifest) => fs.existsSync(path.join(cwd, manifest)));
+    if (!hasPythonManifest)
+        return base;
+    const detectedRoots = [];
+    for (const root of ['tests', 'scripts']) {
+        if (fs.existsSync(path.join(cwd, root)))
+            detectedRoots.push(root);
+    }
+    const excluded = new Set([
+        '.aiwg', '.git', '.github', '.venv', 'venv', 'node_modules',
+        'src', 'test', 'tests', 'tools', 'scripts', 'docs', 'documentation',
+    ]);
+    try {
+        for (const entry of fs.readdirSync(cwd, { withFileTypes: true })) {
+            if (!entry.isDirectory() || excluded.has(entry.name) || entry.name.startsWith('.'))
+                continue;
+            if (fs.existsSync(path.join(cwd, entry.name, '__init__.py')))
+                detectedRoots.push(entry.name);
+        }
+    }
+    catch {
+        // Layout detection is best-effort; the immutable defaults still apply.
+    }
+    return {
+        ...base,
+        scanDirs: [...new Set([...base.scanDirs, ...detectedRoots])],
+        extensions: [...new Set([...base.extensions, '.py', '.pyi'])],
+    };
+}
+function applyBuiltinGraphOverride(base, override) {
+    if (!override)
+        return base;
+    return {
+        ...base,
+        scanDirs: override.scanDirs ? [...override.scanDirs] : base.scanDirs,
+        extensions: override.extensions ? [...override.extensions] : base.extensions,
+    };
+}
 /**
  * Normalize metadataSupplements entries.
  *
@@ -400,6 +454,11 @@ export function loadModuleGraphConfigs(cwd, diagnostics) {
  * @implements #426 #726
  */
 export function loadUserGraphConfigs(cwd, diagnostics) {
+    // Built-ins are immutable in index.graphs, but codebase roots/extensions may
+    // be adapted through the explicitly bounded graphOverrides contract (#2123).
+    // Reset on every project load so a prior cwd cannot leak its override or
+    // detected Python package roots into a later build in the same process.
+    GRAPH_CONFIGS.codebase = detectPythonCodebaseConfig(cwd, freshBuiltinGraphConfig('codebase'));
     // Load module-declared graphs first (frameworks/addons)
     const moduleLoaded = loadModuleGraphConfigs(cwd, diagnostics);
     const loaded = [...moduleLoaded];
@@ -408,6 +467,7 @@ export function loadUserGraphConfigs(cwd, diagnostics) {
     // config.yaml is a
     // deprecated fallback so un-migrated corpora keep working.
     let graphs;
+    let graphOverrides;
     let fromDeprecatedYaml = false;
     // (a) Canonical: .aiwg/aiwg.config (JSON).
     try {
@@ -418,6 +478,9 @@ export function loadUserGraphConfigs(cwd, diagnostics) {
             const g = idx?.graphs;
             if (g && typeof g === 'object')
                 graphs = g;
+            const overrides = idx?.graphOverrides;
+            if (overrides && typeof overrides === 'object')
+                graphOverrides = overrides;
         }
     }
     catch {
@@ -430,7 +493,7 @@ export function loadUserGraphConfigs(cwd, diagnostics) {
         });
     }
     // (b) Fallback: legacy .aiwg/config.yaml.
-    if (!graphs) {
+    if (!graphs && !graphOverrides) {
         try {
             const configPath = projectAiwgPath(cwd, 'config.yaml');
             if (fs.existsSync(configPath)) {
@@ -441,12 +504,21 @@ export function loadUserGraphConfigs(cwd, diagnostics) {
                     graphs = g;
                     fromDeprecatedYaml = true;
                 }
+                const overrides = idx?.graphOverrides;
+                if (overrides && typeof overrides === 'object') {
+                    graphOverrides = overrides;
+                    fromDeprecatedYaml = true;
+                }
             }
         }
         catch {
             // best-effort
         }
     }
+    const codebaseOverride = graphOverrides?.codebase;
+    if (codebaseOverride && typeof codebaseOverride === 'object' && !Array.isArray(codebaseOverride)) {
+        GRAPH_CONFIGS.codebase = applyBuiltinGraphOverride(GRAPH_CONFIGS.codebase, codebaseOverride);
+    }
     if (!graphs)
         return loaded;
     if (fromDeprecatedYaml && !yamlIndexDeprecationWarned) {

package/dist/src/cli/agent-spawn.js

@@ -27,8 +27,10 @@ export const PROVIDER_CONFIGS = {
     },
     codex: {
         binary: 'codex',
-        // Codex supports --full-auto (no approval prompts) and --approval-mode full-auto
-        dangerousFlag: '--full-auto',
+        // Current Codex releases use the explicit bypass flag for unrestricted,
+        // non-interactive execution. Keep this centralized so every launcher maps
+        // AIWG's --dangerous option consistently.
+        dangerousFlag: '--dangerously-bypass-approvals-and-sandbox',
         name: 'OpenAI Codex',
     },
     hermes: {

package/dist/src/cli/handlers/cockpit.js

@@ -3,6 +3,7 @@ import { existsSync } from 'node:fs';
 import { mkdir, readFile } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import path from 'node:path';
+import { formatCockpitDoctor, runCockpitDoctor, } from '../../cockpit/doctor.js';
 export const COCKPIT_PACKAGE_NAME = '@aiwg/cockpit';
 export function cockpitHome() {
     return process.env.AIWG_COCKPIT_HOME || path.join(homedir(), '.aiwg', 'cockpit', 'package');
@@ -22,6 +23,16 @@ async function coreVersion(frameworkRoot) {
 function packageRoot(home = cockpitHome()) {
     return path.join(home, 'node_modules', '@aiwg', 'cockpit');
 }
+function valueAfter(args, flag) {
+    const index = args.indexOf(flag);
+    return index >= 0 ? args[index + 1] : undefined;
+}
+function doctorFormat(args) {
+    if (args.includes('--json'))
+        return 'json';
+    const value = valueAfter(args, '--format');
+    return value === 'json' || value === 'markdown' ? value : 'text';
+}
 export async function resolveCockpitInstall(home = cockpitHome()) {
     const root = packageRoot(home);
     const pkg = await readJson(path.join(root, 'package.json'));
@@ -95,6 +106,36 @@ export const cockpitHandler = {
         const install = await resolveCockpitInstall();
         const version = await coreVersion(ctx.frameworkRoot);
         const autoInstall = ctx.args.includes('--install') || ctx.args.includes('--yes') || ctx.args.includes('-y');
+        if (ctx.args[0] === 'doctor' || ctx.args.includes('--doctor')) {
+            const sourcePackageRoot = path.join(ctx.frameworkRoot, 'apps', 'cockpit');
+            const sourcePackage = !install.installed ? await readJson(path.join(sourcePackageRoot, 'package.json')) : null;
+            const doctorInstall = install.installed ? install : {
+                installed: Boolean(sourcePackage),
+                version: typeof sourcePackage?.version === 'string' ? sourcePackage.version : undefined,
+                packageRoot: sourcePackageRoot,
+            };
+            const topologyValue = valueAfter(ctx.args, '--topology');
+            const topology = topologyValue === 'ssh-local' || topologyValue === 'ssh-reverse'
+                ? topologyValue
+                : 'same-host';
+            const report = await runCockpitDoctor({
+                coreVersion: version,
+                cockpitInstalled: doctorInstall.installed,
+                cockpitVersion: doctorInstall.version,
+                cockpitPackageRoot: doctorInstall.packageRoot,
+                topology,
+                cockpitHost: valueAfter(ctx.args, '--cockpit-host'),
+                executorHost: valueAfter(ctx.args, '--executor-host'),
+                expectedExecutorVersion: valueAfter(ctx.args, '--executor-version'),
+                forwardEndpoint: valueAfter(ctx.args, '--forward-endpoint'),
+                runtimeFile: valueAfter(ctx.args, '--runtime-file'),
+            });
+            return {
+                exitCode: report.status === 'blocked' ? 1 : 0,
+                message: formatCockpitDoctor(report, doctorFormat(ctx.args)),
+                rawOutput: true,
+            };
+        }
         if (ctx.args.includes('--status')) {
             return {
                 exitCode: 0,

package/dist/src/cli/handlers/help.js

@@ -91,7 +91,7 @@ function displayHelp() {
     ]);
     helpGroup('FEATURES', [
         ['features', 'Show optional feature install status'],
-        ['cockpit [--status]', 'Launch the opt-in AIWG Cockpit control plane'],
+        ['cockpit [--status|doctor]', 'Launch Cockpit or diagnose its executor topology'],
     ]);
     helpGroup('VALIDATION', [
         ['validate-metadata [path]', 'Validate AIWG component metadata (defaults to agentic/code)'],

package/dist/src/cli/handlers/ralph.js

@@ -278,7 +278,8 @@ LFD LOOP CONTROLS (hard cumulative ceilings; loop stops with a best-output repor
                           Spawnable: claude, opencode, codex, hermes
   --dangerous             Enable unrestricted mode for the selected provider.
                           Passes the provider's native flag (e.g. --dangerously-skip-permissions
-                          for claude/opencode, --full-auto for codex). No effect if the
+                          for claude/opencode,
+                          --dangerously-bypass-approvals-and-sandbox for codex). No effect if the
                           provider doesn't have a dangerous mode flag.
   --params "<args>"       Pass arbitrary args verbatim to the agent binary.
                           Appended after all other flags. Quoted segments preserved.

package/dist/src/cli/handlers/sdlc-accelerate.js

@@ -123,7 +123,8 @@ AGENT OPTIONS:
                           IDE-integrated (guidance only): copilot, cursor, factory, warp, windsurf
   --dangerous             Enable unrestricted mode (skips permission prompts).
                           Maps to the provider's native flag — e.g. claude gets
-                          --dangerously-skip-permissions, codex gets --full-auto.
+                          --dangerously-skip-permissions, codex gets
+                          --dangerously-bypass-approvals-and-sandbox.
                           Has no effect on providers that don't support it.
   --params "<args>"       Pass arbitrary args directly to the agent binary.
                           Appended verbatim after all other flags. You are