Assisted-by: Claude Opus 4.7 via Claude Code

diff --git a/src/bin/quire/commands/ci.rs b/src/bin/quire/commands/ci.rs
index 433eb4c..1f75d54 100644
--- a/src/bin/quire/commands/ci.rs
+++ b/src/bin/quire/commands/ci.rs
@@ -41,7 +41,11 @@ pub async fn validate(maybe_sha: Option<&str>) -> Result<()> {
 /// default), creates a transient Run rooted at a tempdir, drives the
 /// pipeline through it, and prints each job's `(ci.sh …)` output to
 /// stdout. The tempdir is removed when the command exits.
-pub async fn run(quire: &Quire, maybe_sha: Option<&str>) -> Result<()> {
+pub async fn run(
+    quire: &Quire,
+    maybe_sha: Option<&str>,
+    executor: Executor,
+) -> Result<()> {
     let repo_path = discover_repo()?;
     let commit = resolve_commit(maybe_sha)?;
     let ci = Ci::new(repo_path.clone());
@@ -84,7 +88,7 @@ pub async fn run(quire: &Quire, maybe_sha: Option<&str>) -> Result<()> {
         secrets,
         &repo_path.join(".git"),
         &workspace,
-        Executor::Host,
+        executor,
     );
 
     match exec_result {
diff --git a/src/bin/quire/main.rs b/src/bin/quire/main.rs
index da0706f..42c0530 100644
--- a/src/bin/quire/main.rs
+++ b/src/bin/quire/main.rs
@@ -94,9 +94,30 @@ enum CiCommands {
         /// Commit SHA to run. Defaults to the working-copy revision.
         #[arg(short, long)]
         sha: Option<String>,
+
+        /// Where to run `(sh ...)` calls. `host` runs them locally in the
+        /// materialized workspace; `docker` builds `.quire/Dockerfile` and
+        /// routes commands through `docker exec`.
+        #[arg(long, value_enum, default_value = "host")]
+        executor: CliExecutor,
     },
 }
 
+#[derive(Clone, Debug, clap::ValueEnum)]
+enum CliExecutor {
+    Host,
+    Docker,
+}
+
+impl From<CliExecutor> for quire::ci::Executor {
+    fn from(value: CliExecutor) -> Self {
+        match value {
+            CliExecutor::Host => quire::ci::Executor::Host,
+            CliExecutor::Docker => quire::ci::Executor::Docker,
+        }
+    }
+}
+
 /// Initialize Sentry if the global config provides a DSN.
 ///
 /// Returns the guard if initialized, or None if Sentry is not configured.
@@ -185,7 +206,9 @@ async fn main() -> Result<()> {
         },
         Commands::Ci { command } => match command {
             CiCommands::Validate { sha } => commands::ci::validate(sha.as_deref()).await?,
-            CiCommands::Run { sha } => commands::ci::run(&quire, sha.as_deref()).await?,
+            CiCommands::Run { sha, executor } => {
+                commands::ci::run(&quire, sha.as_deref(), executor.into()).await?
+            }
         },
     }