fix: address 7 CLI consistency issues from automated inspection

pkg/cli/add_interactive_git.go

@@ -38,13 +38,13 @@ func (c *AddInteractiveConfig) createWorkflowPRAndConfigureSecret(ctx context.Co
 		EngineOverride:               c.EngineOverride,
 		Name:                         "",
 		Force:                        false,
-		AppendText:                   "",
+		AppendText:                   c.AppendText,
 		CreatePR:                     true,
 		NoGitattributes:              c.NoGitattributes,
 		WorkflowDir:                  c.WorkflowDir,
 		NoStopAfter:                  c.NoStopAfter,
 		StopAfter:                    c.StopAfter,
-		DisableSecurityScanner:       false,
+		DisableSecurityScanner:       c.DisableSecurityScanner,
 		AddCopilotRequestsPermission: c.UseCopilotRequests,
 	}
 	result, err := AddResolvedWorkflows(ctx, c.WorkflowSpecs, c.resolvedWorkflows, opts)

pkg/cli/add_interactive_orchestrator.go

@@ -18,17 +18,19 @@ var addInteractiveLog = logger.New("cli:add_interactive")
 
 // AddInteractiveConfig holds configuration for interactive add mode
 type AddInteractiveConfig struct {
-	Ctx             context.Context // Context for cancellation (Ctrl-C handling)
-	WorkflowSpecs   []string
-	Verbose         bool
-	EngineOverride  string
-	NoGitattributes bool
-	WorkflowDir     string
-	NoStopAfter     bool
-	StopAfter       string
-	SkipWorkflowRun bool
-	SkipSecret      bool   // Skip the API secret prompt (useful when secret is set at org level)
-	RepoOverride    string // owner/repo format, if user provides it
+	Ctx                    context.Context // Context for cancellation (Ctrl-C handling)
+	WorkflowSpecs          []string
+	Verbose                bool
+	EngineOverride         string
+	NoGitattributes        bool
+	WorkflowDir            string
+	NoStopAfter            bool
+	StopAfter              string
+	SkipWorkflowRun        bool
+	SkipSecret             bool   // Skip the API secret prompt (useful when secret is set at org level)
+	RepoOverride           string // owner/repo format, if user provides it
+	AppendText             string // Extra content to append to the workflow on installation
+	DisableSecurityScanner bool   // Disable security scanning of workflow markdown content
 
 	// UseCopilotRequests indicates the user chose org-billing (copilot-requests) auth
 	// instead of a PAT when setting up the Copilot engine during the wizard.

pkg/cli/add_wizard_command.go

@@ -53,6 +53,8 @@ Note: To create a new workflow from scratch, use the 'new' command instead.`,
   ` + string(constants.CLIExtensionPrefix) + ` add-wizard https://example.com/workflow.json        # Import JSON workflow definition with guided setup
   ` + string(constants.CLIExtensionPrefix) + ` add-wizard githubnext/agentics/ci-doctor --engine copilot   # Pre-select engine
   ` + string(constants.CLIExtensionPrefix) + ` add-wizard githubnext/agentics/ci-doctor --no-secret        # Skip secret prompt
+  ` + string(constants.CLIExtensionPrefix) + ` add-wizard githubnext/agentics/ci-doctor --append "custom footer"            # Append custom content
+  ` + string(constants.CLIExtensionPrefix) + ` add-wizard githubnext/agentics/ci-doctor --no-security-scanner             # Skip security scan
 `,
 		Args: func(cmd *cobra.Command, args []string) error {
 			if len(args) < 1 {
@@ -71,6 +73,8 @@ Note: To create a new workflow from scratch, use the 'new' command instead.`,
 			noSecret, _ := cmd.Flags().GetBool("no-secret")
 			skipSecretLegacy, _ := cmd.Flags().GetBool("skip-secret")
 			skipSecret := noSecret || skipSecretLegacy
+			appendText, _ := cmd.Flags().GetString("append")
+			disableSecurityScanner, _ := cmd.Flags().GetBool("no-security-scanner")
 
 			addWizardLog.Printf("Starting add-wizard: workflows=%v, engine=%s, verbose=%v", workflows, engineOverride, verbose)
 
@@ -87,14 +91,16 @@ Note: To create a new workflow from scratch, use the 'new' command instead.`,
 			}
 
 			return RunAddInteractive(cmd.Context(), &AddInteractiveConfig{
-				WorkflowSpecs:   workflows,
-				Verbose:         verbose,
-				EngineOverride:  engineOverride,
-				NoGitattributes: noGitattributes,
-				WorkflowDir:     workflowDir,
-				NoStopAfter:     noStopAfter,
-				StopAfter:       stopAfter,
-				SkipSecret:      skipSecret,
+				WorkflowSpecs:          workflows,
+				Verbose:                verbose,
+				EngineOverride:         engineOverride,
+				NoGitattributes:        noGitattributes,
+				WorkflowDir:            workflowDir,
+				NoStopAfter:            noStopAfter,
+				StopAfter:              stopAfter,
+				SkipSecret:             skipSecret,
+				AppendText:             appendText,
+				DisableSecurityScanner: disableSecurityScanner,
 			})
 		},
 	}
@@ -119,6 +125,12 @@ Note: To create a new workflow from scratch, use the 'new' command instead.`,
 	cmd.Flags().Bool("skip-secret", false, "Skip the API secret prompt (use when the secret is already set at the org or repo level)")
 	_ = cmd.Flags().MarkHidden("skip-secret")
 
+	// Add append flag (matches --append in add command)
+	cmd.Flags().String("append", "", "Append extra content to the end of agentic workflow on installation")
+
+	// Add no-security-scanner flag (matches --no-security-scanner in add command)
+	cmd.Flags().Bool("no-security-scanner", false, "Disable security scanning of workflow markdown content")
+
 	// Register completions
 	RegisterEngineFlagCompletion(cmd)
 	RegisterDirFlagCompletion(cmd, "dir")

pkg/cli/add_wizard_command_test.go

@@ -24,3 +24,25 @@ func TestAddWizardCommand_UsesStandardThreePartWorkflowSpecWording(t *testing.T)
 	assert.Contains(t, cmd.Long, "For github/*, githubnext/*, and microsoft/* sources, shorthand resolves on github.com.")
 	assert.Contains(t, cmd.Long, "Use full https://github.com/... source URLs for other public github.com workflows.")
 }
+
+func TestAddWizardCommand_FlagUsageMatchesAddCommand(t *testing.T) {
+	addCmd := NewAddCommand(validateEngineStub)
+	wizardCmd := NewAddWizardCommand(validateEngineStub)
+
+	for _, flagName := range []string{"append", "no-security-scanner"} {
+		addFlag := addCmd.Flags().Lookup(flagName)
+		wizardFlag := wizardCmd.Flags().Lookup(flagName)
+
+		require.NotNil(t, addFlag, "add should define %q", flagName)
+		require.NotNil(t, wizardFlag, "add-wizard should define %q", flagName)
+		assert.Equal(t, addFlag.Usage, wizardFlag.Usage, "%q usage should stay in sync between add and add-wizard", flagName)
+	}
+}
+
+func TestAddWizardCommand_ExamplesMentionNewFlags(t *testing.T) {
+	cmd := NewAddWizardCommand(func(string) error { return nil })
+	require.NotNil(t, cmd)
+
+	assert.Contains(t, cmd.Example, "--append \"custom footer\"", "add-wizard examples should show append usage")
+	assert.Contains(t, cmd.Example, "--no-security-scanner", "add-wizard examples should show no-security-scanner usage")
+}

pkg/cli/add_workflow_pr.go

@@ -87,7 +87,6 @@ func addWorkflowsWithPR(ctx context.Context, workflows []*ResolvedWorkflow, opts
 	// Add workflows using the resolved workflow path
 	addWorkflowPRLog.Print("Adding workflows to repository")
 	prOpts := opts
-	prOpts.DisableSecurityScanner = false
 	if err := addWorkflowsWithTracking(ctx, workflows, tracker, prOpts); err != nil {
 		addWorkflowPRLog.Printf("Failed to add workflows: %v", err)
 		// Rollback on error

pkg/cli/audit.go

@@ -111,7 +111,7 @@ func registerAuditCommandFlags(cmd *cobra.Command) {
 	addRepoFlag(cmd)
 	cmd.Flags().Bool("parse", false, "Run JavaScript parsers on agent logs and firewall logs, writing Markdown to log.md and firewall.md")
 	cmd.Flags().String("format", "pretty", "Diff output format for multi-run mode: pretty, markdown")
-	cmd.Flags().StringSlice("artifacts", nil, "Artifact sets to download (default: all). Valid sets: "+strings.Join(ValidArtifactSetNames(), ", "))
+	cmd.Flags().StringSlice("artifacts", nil, "Artifact sets to download (default: all, because auditing requires comprehensive artifacts for analysis). Valid sets: "+strings.Join(ValidArtifactSetNames(), ", "))
 	cmd.Flags().Bool("stdin", false, "Read workflow run IDs or URLs from stdin (one per line) instead of positional arguments")
 	cmd.Flags().String("experiment", "", "Filter to runs that include this experiment name")
 	cmd.Flags().String("variant", "", "Filter to runs with a specific variant value (requires --experiment)")

pkg/cli/audit_diff_command.go

@@ -104,7 +104,7 @@ analyzes their data, and produces a diff showing:
 	addJSONFlag(cmd)
 	addRepoFlag(cmd)
 	cmd.Flags().String("format", "pretty", "Output format: pretty, markdown")
-	cmd.Flags().StringSlice("artifacts", nil, "Artifact sets to download (default: all). Valid sets: "+strings.Join(ValidArtifactSetNames(), ", "))
+	cmd.Flags().StringSlice("artifacts", nil, "Artifact sets to download (default: all, because auditing requires comprehensive artifacts for analysis). Valid sets: "+strings.Join(ValidArtifactSetNames(), ", "))
 
 	return cmd
 }

pkg/cli/env_command.go

@@ -137,7 +137,7 @@ func newDefaultsGetCommand() *cobra.Command {
 		Short: "Download defaults into a YAML file",
 		Long: `Download compiler defaults into a YAML file.
 
-When [file] is omitted, the command writes to file.yml.
+When [file] is omitted, the command writes to file.yml in the current directory.
 
 Scope resolution:
 - --scope defaults to repo.
@@ -174,7 +174,7 @@ func newDefaultsUpdateCommand() *cobra.Command {
 		Short: "Upload defaults from a YAML file",
 		Long: `Upload compiler defaults from a YAML file.
 
-When [file] is omitted, the command reads from file.yml.
+When [file] is omitted, the command reads from file.yml in the current directory.
 
 Scope and flag behavior:
 - --scope is required (repo|org|ent).

pkg/cli/init_command.go

@@ -68,7 +68,7 @@ After running this command, you can:
   ` + string(constants.CLIExtensionPrefix) + ` init --no-mcp                       # Skip MCP configuration
   ` + string(constants.CLIExtensionPrefix) + ` init --no-skill                     # Skip dispatcher skill creation
   ` + string(constants.CLIExtensionPrefix) + ` init --no-agent                     # Skip custom agent creation
-  ` + string(constants.CLIExtensionPrefix) + ` init --codespaces ""               # Configure Codespaces for current repo only
+  ` + string(constants.CLIExtensionPrefix) + ` init --codespaces ""                # Configure Codespaces for current repo only
   ` + string(constants.CLIExtensionPrefix) + ` init --codespaces repo1,repo2       # Codespaces with additional repos
   ` + string(constants.CLIExtensionPrefix) + ` init --completions                  # Install shell completions
   ` + string(constants.CLIExtensionPrefix) + ` init --create-pull-request          # Initialize and create a pull request`,

pkg/cli/logs_command.go

@@ -376,7 +376,7 @@ Downloaded artifacts include (when using --artifacts all):
 	logsCmd.Flags().String("format", "", "Output format: console (decorated tables), tsv (tab-separated), pretty (cross-run report), markdown (cross-run Markdown). Default: compact agent-optimized output")
 	logsCmd.Flags().String("report-file", "", "Write --format markdown output directly to this file path instead of stdout (creates parent directories as needed)")
 	logsCmd.Flags().Int("last", 0, "Alias for --count: number of recent runs to download")
-	logsCmd.Flags().StringSlice("artifacts", []string{"usage"}, "Artifact sets to download (default: usage). Use 'all' for everything, or comma-separate sets. Valid sets: "+validArtifactSets)
+	logsCmd.Flags().StringSlice("artifacts", []string{"usage"}, "Artifact sets to download (default: usage — compact summary for faster downloads). Use 'all' for everything, or comma-separate sets. Valid sets: "+validArtifactSets)
 	logsCmd.Flags().String("cache-before", "", "(Cache eviction) Evict locally cached run folders for runs before this date, prior to downloading. Accepts deltas like -1d, -1w, -1mo (or explicit day counts like -30d), or an absolute date YYYY-MM-DD. Unlike --start-date, this only clears local cache and does not filter which runs are fetched.")
 	logsCmd.Flags().String("after", "", "Alias for --cache-before")
 	_ = logsCmd.Flags().MarkHidden("after")

pkg/cli/mcp_server_json_integration_test.go

@@ -85,14 +85,15 @@ This is a test workflow.
 	serverCmd.Dir = tmpDir
 	transport := &mcp.CommandTransport{Command: serverCmd}
 
-	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
-
-	session, err := client.Connect(ctx, transport, nil)
+	connectCtx, connectCancel := context.WithTimeout(context.Background(), 30*time.Second)
+	session, err := client.Connect(connectCtx, transport, nil)
+	connectCancel()
 	if err != nil {
-		cancel()
 		t.Fatalf("Failed to connect to MCP server: %v", err)
 	}
 
+	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Minute)
+
 	return session, originalDir, ctx, cancel
 }
 

pkg/cli/project_command.go

@@ -75,7 +75,7 @@ Project Setup:
   - Custom fields (Tracker Id, Worker Workflow, Target Repo, Priority, Size, dates)
   - Enhanced Status field with "Review Required" option`,
 		Example: `  gh aw project new "My Project" --owner @me                           # Create user project
-  gh aw project new "Team Board" --owner myorg                         # Create org project  
+  gh aw project new "Team Board" --owner myorg                         # Create org project
   gh aw project new "Bugs" --owner myorg --link myorg/myrepo           # Create and link to repo
   gh aw project new "Project Q1" --owner myorg --with-project-setup     # With project setup`,
 		Args: cobra.ExactArgs(1),

pkg/cli/upgrade_command.go

@@ -71,7 +71,7 @@ This command always upgrades all Markdown files in .github/workflows.`,
   ` + string(constants.CLIExtensionPrefix) + ` upgrade --org my-org --create-issue --yes  # Auto-accept per-repo confirmations (required in CI)
   ` + string(constants.CLIExtensionPrefix) + ` upgrade --audit           # Check dependency health without upgrading
   ` + string(constants.CLIExtensionPrefix) + ` upgrade --audit --json    # Output audit results in JSON format
-  ` + string(constants.CLIExtensionPrefix) + ` upgrade --pre-releases    # Include prerelease versions when self-upgrading the extension (stable releases are the default)`,
+  ` + string(constants.CLIExtensionPrefix) + ` upgrade --pre-releases    # Include pre-release versions when upgrading the extension (stable releases are the default)`,
 		Args: cobra.NoArgs,
 		RunE: func(cmd *cobra.Command, args []string) error {
 			verbose, _ := cmd.Flags().GetBool("verbose")