scripts: add dev-exec.sh

diff --git a/AGENTS.md b/AGENTS.md
index 2b52289..e93b2de 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -22,9 +22,15 @@ wrapper in the bitbox02 crate.
 ## Build, Test, and Development Commands
 - `make dockerpull` / `make dockerdev`: fetch and enter the maintained development container.
 
-All make commands are to be run inside docker like this: `./scripts/docker_exec.sh make -j <command>`, e.g.  `./scripts/docker_exec.sh make -j firmware`.
-Any shell command can be run inside docker using `./scripts/docker_exec.sh <command>` - do not use
-`bash -lc` before the command.
+Run regular Unix commands such as `git`, `rg`, `grep`, `ls`, `find`, `sed`, and `cat` directly on
+the host.
+
+Use `./scripts/dev_exec.sh <command>` only for project-specific commands that depend on the project
+toolchain or compiler environment.
+
+Do not wrap `./scripts/dev_exec.sh` itself in `bash -lc`. If a command genuinely needs shell
+features such as `cd && ...`, pass an explicit shell as the command, e.g.
+`./scripts/dev_exec.sh bash -lc 'cd src/rust && cargo fmt'`.
 
 
 - `make firmware` / `make bootloader`: compile firmware or bootloader ELFs into `build/`.
@@ -40,8 +46,9 @@ Any shell command can be run inside docker using `./scripts/docker_exec.sh <comm
 pinned toolchain in `rust-toolchain.toml`; keep module paths aligned with `src/rust` and regenerate
 bindings (`cbindgen`, protobuf) when interfaces change.
 
-For C code changes, run ./scripts/format to format the code. For Python changes, run `black` to format the code.
-For Rust code changes, run `cd src/rust && cargo fmt` to format the code.
+For C code changes, run `./scripts/dev_exec.sh ./scripts/format` to format the code. For Python
+changes, run `./scripts/dev_exec.sh black` to format the code. For Rust code changes, run
+`./scripts/dev_exec.sh bash -lc 'cd src/rust && cargo fmt'`.
 
 ## Testing Guidelines
 Place new C specs in `test/unit-test` and add doubles to `test/hardware-fakes` when hardware
diff --git a/BUILD.md b/BUILD.md
index d958d1d..56c2810 100644
--- a/BUILD.md
+++ b/BUILD.md
@@ -16,6 +16,10 @@ There is a container image with all the build dependencies and there are some
 > [!TIP]
 > It is highly recommended to use the container for development.
 
+For automation and editor integrations, use `./scripts/dev_exec.sh <command>` as the project
+entrypoint. It runs commands natively on the host by default and can be switched to container
+execution with `BITBOX_FW_EXEC_MODE=docker`.
+
 Accessing USB devices, like the flashing tool and the bitbox, is easier outside
 of the container. So it is recommended to install the J-Link Software on your
 development machine to follow the instructions below.
@@ -385,8 +389,8 @@ docker exec -u 0 -it bitbox02-firmware-dev bash -c 'apt update && apt install -y
 
 There is a Python api library in `py/bitbox02`.
 
-> [!IMPORTANT]  
-> The Python scripts and editable installs require **pip ≥ 25**. Older pip versions will fail.  
+> [!IMPORTANT]
+> The Python scripts and editable installs require **pip ≥ 25**. Older pip versions will fail.
 > For setup and usage instructions, see [`py/README.md`](py/README.md).
 
 ### BitBox02 CLI client
diff --git a/scripts/dev_exec.sh b/scripts/dev_exec.sh
new file mode 100755
index 0000000..d61cb67
--- /dev/null
+++ b/scripts/dev_exec.sh
@@ -0,0 +1,26 @@
+#!/bin/bash
+# SPDX-License-Identifier: Apache-2.0
+
+set -e
+
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null && pwd )"
+MODE="${BITBOX_FW_EXEC_MODE:-host}"
+
+if [ "$#" -eq 0 ]; then
+    echo "Usage: $0 <command> [args...]" >&2
+    exit 1
+fi
+
+case "$MODE" in
+    docker)
+        exec "$DIR/docker_exec.sh" "$@"
+        ;;
+    host)
+        exec "$@"
+        ;;
+    *)
+        echo "Unsupported BITBOX_FW_EXEC_MODE: '$MODE'." >&2
+        echo "Use BITBOX_FW_EXEC_MODE=docker or BITBOX_FW_EXEC_MODE=host." >&2
+        exit 1
+        ;;
+esac