Default: ; sandbox and model omitted; parent wait 15m. Bare is an asked-for TUI. "Use <model>" adds . A named sandbox adds . "Worktree" adds boolean , never a name or invented path. "Review" selects . Missing values or conflicts are .

Sandbox read-only constrains model-generated shell, not the whole process. Workspace-write is not auto-approve. is rejected. and are global, before . Skip-git-repo-check needs an explicit request; do not initialize a repo to evade the check. Named waivers are required for bypass-approvals-and-sandbox, bypass-hook-trust, danger-full-access, approve-for-me, approval never, yolo, and ignore-rules. Before a waiver or on sandbox failure, apply ; failure does not authorize a bypass.

Fix workspace, prompt, mode, session, worktree, sandbox, and wait. Check binary and without exposing secrets. Missing binary → follow ; missing auth → unless login was requested. Omit sandbox unless the user named it. Record . Done when target, binary, auth, and authorized options are fixed.

Build argv, quote the prompt literally, and use for the target. Default text is quiet until exit; silence is not a hang. Wait until exit or the recorded deadline; kill only this run's PID at that deadline. Nonzero exit: capture stderr, inspect the tree, report .

For JSONL/last-message output, follow . For resume/fork, follow . For worktrees/parallel runs, follow . For review, TUI, login, MCP, or plugins, follow . On a rejected flag, use scoped or . Done when the process exits or a named failure/authorization gate is reported.

Inspect status and diff; CLI text is unverified. Run the narrowest covering tests for edited executable code. Check every child worktree; read-only sandbox is not a tree-unchanged guarantee. Remove only clean worktrees this run created and the user did not ask to keep; preserve login, MCP, plugins. Report command, mode, session/worktree, waiver, wait, and outcome evidence. Done when every requested outcome is observed or a blocker is evidenced.

Terminals: , , , .